web-studio

a11y-audit

Audits accessibility against WCAG 2.2 AA — axe-core via Playwright, Lighthouse a11y, a manual keyboard/screen-reader checklist for key flows, game accessibility settings; findings with WCAG criteria and fixes. Required before release.

adopt

Brownfield onboarding — detects the real stack of an existing project (Go/PHP/Node, Angular/Vue/Nuxt, GraphQL/REST, three.js), fills technical-preferences from the facts, audits existing artifacts against studio formats, merges settings/CLAUDE.md, and produces a numbered adoption plan. Run when installing the studio into an existing project.

API & Backend Listed

api-contract

Designs the API contract before implementation — GraphQL SDL by default (types, Node/connections, inputs, mutations with payload errors, subscriptions, @auth, persisted operations) or OpenAPI 3.1 / AsyncAPI for REST/events; validates with graphql-inspector / spectral, generates types, documents in docs/architecture/api/. Also game WebSocket protocols.

architecture-decision

Creates an Architecture Decision Record (context, ≥2 options with costs, decision, consequences, verification) or retrofits an existing ADR to the template. Every significant technical choice (stack, API style, auth, data, engine, deployment) gets an ADR before code.

architecture-review

Cross-checks ADRs, API contracts, data model, threat model and feature specs for consistency and feasibility before build; verifies stack facts against the stack reference. Read-only report with PASS / CONCERNS / FAIL. Run at the architecture→build gate.

AI & Automation Listed

brainstorm

Explores a product or web-game idea before specification — audience, problem, competitors, constraints, differentiation, MVP candidates; for games also MDA and core loop. Produces a concept brief. Use when the idea is vague.

changelog

Generates or updates CHANGELOG.md from Conventional Commits since the last tag (Keep a Changelog format, SemVer bump proposal). Use before a release.

Code & Development Listed

code-review

Reviews code (files, directory, or current diff) for correctness, standards compliance, ADR adherence, security (OWASP), performance, testability; routes to the right lead and specialist by file type (Go/PHP/TS/Angular/Vue/GraphQL/three.js) and to appsec-engineer for sensitive paths. Read-only findings with BLOCKING/WARNING/INFO.

create-stories

Breaks a feature spec into implementable stories (vertical slices: contract → backend → frontend/game → tests) with acceptance criteria mapped to tests, size, layer, ADR links. Produces production/stories/F-NNN/S-NNN-*.md.

AI & Automation Listed

data-model

Designs or extends the data model — entities/relations, PostgreSQL DDL with constraints and indexes justified by queries, migration strategy (expand/contract), PII classification, backup/restore. Produces docs/architecture/data-model.md and migration drafts.

AI & Automation Listed

dependency-audit

Supply-chain audit (OWASP A03) — lockfiles present, npm/pnpm/composer audit, govulncheck, abandoned/unmaintained packages, versions vs the stack reference, licence check, Renovate/Dependabot config, SRI for external scripts, image pinning. Report with upgrade/replace actions.

DevOps & Infrastructure Listed

deploy

Plans and executes a deployment — verifies release readiness, build/tag, migration order, delegates the stack mutation to an installed deployment skill (container platform / Kubernetes / cloud) or produces manual runbook steps, runs post-deploy smoke checks, documents rollback. Every production mutation needs confirmation.

Show all 45 bundled skills

design-system

Defines the project design system — principles, --ds-* tokens (colour roles, spacing, type, radius, motion) for light/dark, component inventory with states and aria patterns, mapping to Angular Material / Taiga UI / Vue kits, game HUD rules. Produces docs/specs/design-system.md and a tokens CSS draft.

dev-story

Implements a story end-to-end: loads spec/contract/ADR/rules, routes to the right engineers (Go/PHP/Node/GraphQL/Angular/Vue/three.js/DB), drives code + tests, runs checks, confirms each acceptance criterion. The core implementation skill — run after stories exist, before /code-review and /story-done.

feature-spec

Authors a feature specification (scenarios, rules, data, API operations, UI states, edge cases, security, accessibility, acceptance criteria) from the product spec. Produces docs/specs/features/F-NNN-name.md. Run per feature before stories.

game-concept

Authors a web-game concept — pitch, core loop, MDA, mechanics, progression/economy, content scope, visual/audio direction, technical feasibility (engine, frame/memory/load budgets on mobile web, networking), accessibility, metrics, prototype plan. Produces docs/specs/game-concept.md.

harden

Hardens the runtime and perimeter — security headers/CSP, TLS/HSTS, proxy (Caddy/nginx) config, rate/body limits, WebSocket protections, Docker network/container hardening, CI permissions, secrets hygiene; verifies with live curl/scanner output; writes docs/security/hardening-checklist.md.

help

Shows where you are in the Web Studio pipeline and what to do next; `commands` lists every command with its description, `guide [topic]` opens the playbook (what to run in every situation). Use when the user asks 'what now', 'what should I do next', 'which commands exist', 'what do I do if…', or is stuck.

hotfix

Fast path for an urgent production fix — reproduce with a failing test, minimal fix on a hotfix branch from the release tag, mandatory security review for sensitive paths, expedited checklist, deploy and backport to main. Use for P1 production bugs.

impact

Classifies a change proposal before any code — architecture (ADR, boundary, stack, contract, data model, dependency, deployment), security (threat-model surface, security-sensitive path, auth, PII, secrets, CI permissions) or product scope — from the artifacts it touches, gets a short verdict from the owner of each triggered class (technical-director, security-lead, product-director) and hands off to the commands the verdict requires. Use when the user proposes a change outside the current story, before /dev-story picks it up, or whenever a change 'might touch architecture or security'.

DevOps & Infrastructure Listed

incident

Incident response and blameless postmortem — severity, containment steps, diagnosis (logs/metrics/containers via a deployment skill when present), fix/rollback, timeline, root cause, actions; writes docs/ops/incidents/INC-NNN.md.

init

One-time studio scaffolding for a project: asks the conversation language and review mode, creates/updates CLAUDE.md sections, seeds .claude/docs (stack reference, templates, roster), .claude/rules, docs/ and production/ folders, and merges settings (permissions/statusline). Run first in plugin mode; copy mode runs it to set the language.

pentest

Authorised dynamic security testing of the project's OWN application (dev/staging or explicitly approved prod) — OWASP ZAP baseline/API scan (OpenAPI/GraphQL), Nuclei, Schemathesis fuzzing, testssl.sh, nmap on the project's own host, manual OWASP checks for auth/IDOR/GraphQL limits; report with CVSS and fixes in docs/security/pentest-<date>.md. Scope must be confirmed first.

perf-audit

Measures and improves performance against budgets — Lighthouse (mobile) / Core Web Vitals, bundle analysis, API p95 with k6, DB EXPLAIN, Go/PHP profiles, game frame/draw-call/memory; ranks fixes by impact; writes docs/ops/perf-audit-<date>.md. Required before release.

product-spec

Authors the product specification (goals, users, scope, NFRs, risks, MVP acceptance) section by section with the user. Produces docs/specs/product-spec.md. Required before feature specs.

qa-plan

Creates the QA plan for a sprint or feature — maps each story's acceptance criteria to test levels/tools/files, test data and environment, regression set, quality risks; writes production/sprints/qa-plan-NN.md. Run at sprint start.

release-checklist

Runs the release gate — verifies stories done, audits (security/deps/harden/perf/a11y) without blocking findings, migration compatibility, changelog, secrets/env, backup; writes production/releases/vX.Y.Z.md with deploy and rollback steps.

security-audit

Audits the application against OWASP Top 10:2025 / ASVS for the project's stack (Go/PHP/Node, Angular/Vue, GraphQL/REST, WebSocket, containers) — code review by appsec-engineer, tooling (govulncheck, composer/pnpm audit, gitleaks, semgrep), findings with CVSS and fixes; writes docs/security/security-audit-<date>.md. Required before release.

setup-stack

Selects and pins the technology stack — project type, backend (Go/PHP-Yii3/Node), frontend (Angular/Vue/Nuxt), UI kit (Material/Taiga), API style (GraphQL default), game engine (three.js/Pixi/Phaser), database, tests, CI, layout — and writes technical-preferences.md with exact versions from the stack reference. Run once at project start or when the stack changes.

skill-improve

Improves a skill or agent with a test → fix → retest loop: runs /skill-test static (+category/spec), proposes targeted edits, applies them with approval, re-tests, keeps or reverts by score. Use after a failed /skill-test or after editing skills or agents.

Testing & QA Listed

skill-test

Validates Web Studio skills and agents: static (structural linter), spec (behavioural spec evaluation), category (rubric metrics), agent (agent spec evaluation), audit (coverage report). Uses the testing framework (catalog.yaml, quality-rubric.md, specs) from the kit repository or a project copy.

sprint-plan

Plans a sprint — goal, capacity, story selection by priority and dependencies, risks, QA plan link; triages the dependency-update queue (Dependabot/Renovate PRs: green patch/minor merged at sprint start, majors become stories); writes production/sprints/sprint-NN.md and roadmap markers. Use at sprint start.

sprint-status

Read-only sprint status from artifacts — story states, tests/CI evidence, blockers, the dependency-update queue, burn, risk to the sprint goal. Use for 'where are we' during a sprint.

stack-update

Refreshes the stack knowledge base — checks the latest versions of every technology in stack-reference (official llms.txt, release pages, endoflife.date, npm/packagist/pkg.go.dev), rewrites the reference files with dated facts and sources, compares with the project's lockfiles, and proposes an upgrade plan. Run when references are older than 60 days or before planning upgrades.

start

First-time onboarding for a new web project — asks where you are, configures the stack, and routes to product-spec or game-concept. Use when starting from scratch or when technical-preferences.md is still [TO BE CONFIGURED].

story-done

Verifies a story is truly done: every acceptance criterion has a passing test (with output), lint/typecheck/security checks pass, review is APPROVED, docs updated; then closes it and updates roadmap/session state. Run after /code-review.

team-feature

Orchestrates a full vertical slice for one feature: feature-spec check → API contract (GraphQL/REST) → data model → backend → frontend/game → tests → security review → code review, spawning the right leads and engineers in parallel where independent. Use to deliver a feature end-to-end.

team-game

Delivers a playable web-game slice: game-concept check → engine ADR → simulation + rendering (three.js/Pixi) + UI overlay (Angular/Vue) + optional multiplayer (Go server) in parallel → frame-budget measurement → accessibility settings → review. Use to build the prototype or a game feature.

team-release

Release pipeline end-to-end: perf-audit + a11y-audit + security quick check in parallel → changelog → release-checklist → deploy (via an installed deployment skill when present) → post-deploy verification. Use to ship a version.

team-security

Full security cycle: threat-model refresh → security-audit (code) → dependency-audit → harden (perimeter/containers) → optional pentest of the project's own app → consolidated report and stories. Use before release or after adding auth/payments/uploads/multiplayer.

tech-debt

Inventories technical debt — outdated dependencies vs the stack reference, TODO/FIXME, skipped tests, lint suppressions, ADR drift, missing docs, security/perf shortcuts; scores by impact/effort and proposes stories. Read-only report in docs/ops/tech-debt-<date>.md on approval.

Testing & QA Listed

test-setup

Sets up the test strategy and infrastructure for the chosen stack — Vitest/Playwright/PHPUnit/go test, testcontainers or a compose test profile, contract tests from GraphQL/OpenAPI, axe/Lighthouse/k6 hooks, CI stages, coverage thresholds. Produces docs/architecture/test-strategy.md and config files.

threat-model

Builds or updates the STRIDE threat model — assets, trust boundaries, attack surfaces (auth, GraphQL/REST, WebSocket, uploads, webhooks, admin, CI/CD, dependencies, infra), threats with likelihood/impact/mitigation, verification. Produces docs/architecture/threat-model.md. Required before build and when a new surface appears.

update

Updates the Web Studio itself in this project — plugin mode: claude plugin update + re-seed changed docs/rules with a diff; copy mode: re-run install.sh from the kit repository. Shows CHANGELOG deltas, preserves local edits, never touches project data.

ux-spec

Authors a UX specification for a flow or screen — user goal, flow, screens, all states, UI copy, accessibility, responsive behaviour, UX metrics. Produces docs/specs/ux/UX-NNN-name.md. Use before implementing user-facing features.