windchillscalanthes-ship-it
UserCatch the API change that breaks your consumers before it ships. A Claude Agent Skill that reviews REST/OpenAPI, GraphQL, and gRPC changes for backward-incompatible breaking changes and rewrites them to be compatible.
Categories
Indexed Skills (6)
api-break-check
Review an API change for backward-incompatible breaking changes before it ships and breaks existing consumers — removed or renamed fields, added required request parameters, narrowed types, tightened validation, changed status codes or error shapes, removed enum values, and (for gRPC) changed field numbers. Explains who breaks and why, then rewrites the change to be compatible: additive evolution, deprecate-then-sunset, or a new version with expand/contract. Use whenever writing, reviewing, or about to merge a change to an API contract — an OpenAPI / Swagger spec, a GraphQL schema, a protobuf / gRPC definition, or the handlers/DTOs/serializers behind them — especially for an API with consumers you don't control.
llm-cost-guard
Review LLM-calling code for token and cost blowups before they hit your bill — a large static prompt prefix re-sent uncached on every call, a frontier model doing a task a cheap one handles, unbounded context or output, per-item calls that should be batched, re-embedding unchanged content, and agent loops with no token budget. Estimates the dominant cost driver, rewrites it, and reports the before/after spend, naming the latency and quality trade-offs. Use whenever writing or reviewing code that calls an LLM or embedding API — Anthropic/Claude, OpenAI, Bedrock, Vertex, or a framework like LangChain/LlamaIndex — a chat endpoint, a RAG pipeline, an agent loop, or a batch job, especially one that runs at volume.
prompt-injection-review
Review an LLM application for prompt-injection and tool-abuse exposure before it ships — untrusted content (web pages, emails, documents, tool outputs, RAG chunks) that reaches the model with authority, over-permissioned or unconfirmed consequential tools, model output passed unchecked into eval/SQL/shell/HTTP/the UI, data-exfiltration channels, and the "lethal trifecta" of untrusted input + private data + an outbound path. Traces each untrusted source to its dangerous sink and recommends architectural mitigations. Use whenever building or reviewing an LLM-powered feature that reads untrusted input, retrieves documents (RAG), calls tools/functions, runs an agent, or renders model output — in any language or framework, against any model provider.
n-plus-one-hunter
Find and fix N+1 queries and related ORM query anti-patterns — the loop that quietly fires one database query per row. Reviews application code for N+1s, nested N+1s, count/exists-in-a-loop, cartesian eager-load blowups, over-fetching, and missing foreign-key indexes, then rewrites them with the correct eager-load strategy and shows the query-count before/after. Use whenever writing or reviewing code that loads a collection and touches an association, a serializer or API response, a GraphQL resolver, a view template, or a background job — in ActiveRecord/Rails, the Django ORM, Prisma, SQLAlchemy, Sequelize, TypeORM, Ecto, or raw query code — and especially before merging an endpoint that renders a list.
terraform-blast-radius
Review a Terraform or OpenTofu plan for destructive changes before you apply — the resources that will be destroyed and recreated (downtime), the stateful ones whose replacement means data loss, renames and count shifts that trigger mass recreation, and changes to shared resources with a wide blast radius. Explains which attribute forces replacement and rewrites the change to be safe with lifecycle rules, moved/removed blocks, for_each, or an out-of-band migration. Use whenever writing, reviewing, or about to apply Terraform/OpenTofu — reading a `terraform plan`, changing a resource attribute, renaming or removing a resource, upgrading a provider, or touching a database, disk, bucket, or other resource that holds data.
flaky-test-detective
Find and fix flaky (non-deterministic) tests — the ones that pass and fail on the same code — by tracing the root cause and rewriting the test to be deterministic. Covers test-order dependence and shared mutable state, time / timezone / clock assumptions, unseeded randomness, async race conditions and sleep-based waits, real network / filesystem / database calls, assertions on unordered collections, global state leaked between tests, and too-tight timeouts. Explains exactly why the test is non-deterministic, then hands back a stable version. Use whenever a test fails intermittently, "passes on rerun", is order-dependent, is green locally but red in CI, or you're writing or reviewing tests in pytest, Jest/Vitest, RSpec/Minitest, Go, JUnit, PHPUnit, or any other framework.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.