All authors
Claude Skills by VincentChuWaiChow
github.com/VincentChuWaiChow765 skills4 installs1,172 views
- Java Framework Production ReadinessUse this skill when statically reviewing a Spring Boot, Quarkus, or Micronaut service for production readiness — externalized configuration, health/readiness/liveness endpoint wiring, graceful shutdown, jakarta namespace correctness plus the framework's JDK floor, build-time DI/AOT reflection safety, profile/config validation, and dependency BOM alignment. Trigger when a user provides a build file (pom.xml/build.gradle), application.properties/application.yml (sanitized), or source annotation...Votes: 0GitHub stars: 23
- Java Jdk Lifecycle And UpgradeUse this skill when statically reviewing a Java estate's JDK lifecycle and upgrade posture — identifying the JDK vendor and version, mapping them to support and license boundaries, finding language/API upgrade blockers, and prescribing a phased, evidence-gated upgrade path. Trigger when a user provides build files (pom.xml, build.gradle), toolchain/CI config, or a Dockerfile and asks whether their JDK is supported, what an upgrade will break, or how to sequence it. Reads build files and sourc...Votes: 0GitHub stars: 23
- Java Jpa Hibernate PerformanceUse this skill when statically reviewing JPA/Hibernate data access for fetch-strategy correctness and reliability — N+1 exposure, JOIN FETCH vs @EntityGraph vs @BatchSize vs DTO projection, LazyInitializationException and open-in-view misuse, pagination combined with a collection fetch (cartesian product), MultipleBagFetchException, and HikariCP connection-pool sizing. Trigger when a user provides entity classes, mappings, Spring Data repositories, or JPQL/Criteria queries and asks why querie...Votes: 0GitHub stars: 23
- Java Jvm Performance And GcUse this skill when statically reviewing a proposed JVM garbage-collector or performance change — collector selection (G1, ZGC/Generational ZGC, Shenandoah, Parallel), allocation-pressure source patterns, heap-sizing/GC-flag configuration, and OOM/memory-leak triage. Trigger when a user proposes or has made a GC-collector switch, tunes GC/heap flags, shares JVM startup flags or a Dockerfile/K8s manifest with memory limits, or supplies GC logs, a JFR recording, or heap-dump analysis output and...Votes: 0GitHub stars: 23
- Java Kafka ReliabilityUse this skill when statically reviewing a Kafka producer/consumer pipeline for whether it actually delivers the delivery semantics it claims — idempotent-producer-vs-exactly-once conflation, transactional read-process-write wiring (transactional.id, initTransactions, sendOffsetsToTransaction, consumer isolation.level=read_committed), at-least-once with or without an idempotent consumer, commit-before-process message loss, ordering (max.in.flight.requests.per.connection combined with idempote...Votes: 0GitHub stars: 23
- Java MaestroJava Maestro routing skill. Classify the user's Java/JVM task, select the narrowest static-review specialist from the Java board (or the smallest team, max 4), and dispatch. Trigger when a user brings a Java, JVM, Spring, Jakarta EE, JDK-upgrade, JPA/Hibernate, or Java-security task and it is not yet clear which specialist should handle it. Routes only — never answers Java questions itself, never runs code, never requests secrets.Votes: 0GitHub stars: 23
- Java Resilience PatternUse this skill when statically reviewing resilience4j + Spring composition on a Java code path: decorator/aspect order between @Retry, @CircuitBreaker, @RateLimiter, @TimeLimiter, and @Bulkhead; retry safety on non-idempotent write paths (idempotency/dedup keys); TimeLimiter and total retry timeout-budget coherence; Bulkhead isolation strategy (semaphore vs thread pool); RateLimiter blocking/timeout behavior; fallback correctness (must not swallow the failure signal); bounded queues/backpress...Votes: 0GitHub stars: 23
- Java Spring SecurityUse this skill when statically reviewing a Spring Security 6 service's authorization and endpoint-exposure posture — multiple SecurityFilterChain beans and securityMatcher disjointness/ordering, authorizeHttpRequests matcher sequencing (first-match-wins, permitAll before authenticated, anyRequest() last), request-level vs @PreAuthorize/@PostAuthorize/@Secured method-security precedence, AuthorizationManager delegation and fail-closed behavior, CSRF on state-changing endpoints, and Spring Boot...Votes: 0GitHub stars: 23
- Java Test ArchitectureUse this skill when statically reviewing a JVM test suite's architecture for soundness and non-flakiness: JUnit 5 lifecycle and isolation (shared mutable static state, test-instance lifecycle, order dependence, time/locale/timezone dependence, and unguarded junit.jupiter.execution.parallel usage), Testcontainers discipline (singleton-container-with-Ryuk-reuse vs per-test @Container, explicit Wait strategies vs Thread.sleep), ArchUnit layering/cycle rules including FreezingArchRule brownfield ...Votes: 0GitHub stars: 23
- Java Transaction And ConsistencyUse this skill when statically reviewing Spring @Transactional boundary correctness — propagation (REQUIRED joining an existing transaction and silently ignoring an inner isolation/timeout; REQUIRES_NEW suspending it), isolation levels, readOnly, rollbackFor (checked exceptions do not roll back by default), proxy self-invocation bypass, and over-wide boundaries that hold a connection through an external call — plus cross-resource/cross-service consistency: the save()-then-send() dual-write an...Votes: 0GitHub stars: 23
- Kotlin Android ArchitectureUse this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app.Votes: 0GitHub stars: 23
- Kotlin Android Performance ReliabilityUse this skill to statically review measured Android runtime performance and reliability evidence: cold/warm startup via StartupTimingMetric and CompilationMode, frame jank via FrameTimingMetric/JankStats against the 60fps budget, Baseline Profile coverage, ANR root-causing against the main-thread-blocking threshold, and Macrobenchmark P50/P90/P99 regression-gating. Reads benchmark reports and source only; it never runs a benchmark or instruments a device.Votes: 0GitHub stars: 23
- Kotlin Android Security PrivacyUse this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.Votes: 0GitHub stars: 23
- Kotlin Backend Production ReadinessUse this skill to statically review production readiness for Ktor servers and the Kotlin-on-Spring coroutine surface: server lifecycle/monitoring events, Netty/CIO graceful-shutdown configuration, StatusPages typed exception mapping, DI/AutoCloseable resource cleanup on shutdown, and correctly routing the coroutine-context-loss hazard behind suspend WebFlux handlers to its root-cause owner. Reads source and sanitized configuration only; it never runs or deploys a server.Votes: 0GitHub stars: 23
- Kotlin Compose Ui Quality AccessibilityUse this skill to statically review Jetpack Compose UI correctness and accessibility: recomposition stability (@Stable/@Immutable, unstable parameters cascading recomposition), correct side-effect API usage with required cleanup, remember/derivedStateOf for recomposition scope, state hoisting and rememberSaveable, and mandatory semantics/contentDescription plus touch-target sizing for accessibility. Reads source only; it never renders or profiles the UI.Votes: 0GitHub stars: 23
- Kotlin Coroutines Flow ReliabilityUse this skill to statically review Kotlin coroutine and Flow reliability — structured concurrency and cancellation cooperation, dispatcher selection and blocking-call confinement, cold Flow vs hot StateFlow/SharedFlow semantics and backpressure, and context propagation (transaction, trace, MDC, security) across suspension and dispatcher switches. Reads source only; it never runs coroutine code or profiles live timing.Votes: 0GitHub stars: 23
- Kotlin Estate Modernization GovernorUse this skill to statically review Java-to-Kotlin migration strategy and mixed-codebase governance: strangler-fig / module-by-module vs file-by-file sequencing, the mixed Java/Kotlin interop boundary and its platform-type null-safety debt, reversibility of each migration step, when a module should NOT be migrated, and governance of J2K automatic-converter output (review required, never merge as-is). Reads module inventories, dependency graphs, and sanitized diffs only; it never runs the conv...Votes: 0GitHub stars: 23
- Kotlin Gradle Build EngineeringUse this skill to statically review Gradle build-graph quality and CI throughput for Kotlin/KMP projects: configuration-cache compatibility (no execution-time Project access), build-cache correctness (@CacheableTask annotation completeness and relocatable/reproducible output), kapt vs KSP annotation-processing configuration and incremental opt-in, configuration-avoidance API usage, and convention-plugin (build-logic included build) centralization. Reads Gradle build files and build-scan evide...Votes: 0GitHub stars: 23
- Kotlin Kmp Boundary InteropUse this skill to statically review Kotlin Multiplatform source-set architecture, expect/actual design and pairing completeness, platform-API-leakage prevention, cross-target dependency compatibility, Swift/Objective-C interop (suspend-to-async, @Throws, @ObjCName), and Kotlin/Native runtime correctness (new memory manager, freezing deprecation). Reads source and build configuration only; it never compiles or runs a target.Votes: 0GitHub stars: 23
- Kotlin Kmp Portfolio DecisionUse this skill to decide whether a product should adopt Kotlin Multiplatform at all, and how much to share, by weighing org topology and team ownership, product-roadmap alignment, platform-differentiation risk, skills/hiring constraints, lifecycle/maintenance cost, and reversibility. This skill can and must be able to recommend against KMP; it reasons from user-supplied context and never designs the expect/actual implementation.Votes: 0GitHub stars: 23
- Kotlin Language Api CorrectnessUse this skill to statically review Kotlin language-level correctness: nullability and Java-interop platform types, inline functions with reified type parameters past JVM erasure, @JvmInline value-class boxing behavior, statically-dispatched extension functions vs member precedence, and lateinit use-before-init hazards. Reads source only; it never compiles or runs code to observe runtime null-pointer or boxing behavior.Votes: 0GitHub stars: 23
- Kotlin Library Api Abi GovernanceUse this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release.Votes: 0GitHub stars: 23
- Kotlin MaestroUse this skill to classify a Kotlin, JVM-Kotlin, Android, or Kotlin Multiplatform task and route it to the narrowest static-review specialist on the Kotlin board, or to gate a production-mutation request to a named human owner. Routing and classification only — it never reviews Kotlin work itself, never answers a Kotlin question directly, and never contacts a live system.Votes: 0GitHub stars: 23
- Kotlin Serialization Wire ContractUse this skill to statically review kotlinx.serialization wire-contract safety and schema evolution: encodeDefaults/explicitNulls defaults and @EncodeDefault overrides, strict-decode ignoreUnknownKeys behavior, sealed-class closed polymorphism and class-discriminator conventions, and whether a schema change is additive or breaking given how defaults make a field optional on decode. Reads source and serializer configuration only; it never sends or receives real wire traffic.Votes: 0GitHub stars: 23
- Kotlin Supply Chain Release IntegrityUse this skill to statically review Kotlin/Gradle dependency trust and release integrity: whether `gradle/verification-metadata.xml` enforces checksum/signature verification in strict mode, whether dependency locking pins transitive versions for reproducible release builds, whether Gradle plugins are pinned and sourced from trusted repositories, whether repository scope prevents dependency confusion, and whether a KMP/Maven publication carries the metadata and evidence a consumer needs to tru...Votes: 0GitHub stars: 23
- Kotlin Test ArchitectureUse this skill to statically review Kotlin/coroutine/Compose/Android/KMP test architecture and determinism: `runTest` and virtual-time usage, `StandardTestDispatcher` vs `UnconfinedTestDispatcher` choice and advance-call discipline, `Dispatchers.setMain`/`resetMain` hygiene and dispatcher injection, Turbine Flow-testing idioms, Compose UI semantics-based testing, and the Robolectric-vs-instrumented boundary. Reads test source and build config only; it never runs the suite or a device/emulator.Votes: 0GitHub stars: 23
- External Secrets Operator ReviewUse this skill when reviewing External Secrets Operator (ESO) configuration, including SecretStore, ClusterSecretStore, ExternalSecret, and PushSecret resources. Trigger when a user provides ESO YAML manifests, asks about secret rotation interval compliance, questions whether ClusterSecretStore scope is too broad, or wants to audit the auth method used to reach an external secret store (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, HashiCorp Vault, 1Password).Votes: 0GitHub stars: 23
- Kubecost Chargeback Allocation ReviewUse this skill when reviewing a Kubecost or OpenCost installation for enterprise chargeback readiness. Trigger when the user asks whether cost allocation is accurate, whether label taxonomy is complete enough for chargeback, whether idle cost is properly attributed, whether the cost API is secured, or whether savings recommendations are being actioned.Votes: 0GitHub stars: 23
- Kubernetes Live Network Architecture Mutation GuardGuard live kubectl apply, patch, or create operations on Kubernetes networking *architecture* surface — Service spec (`internalTrafficPolicy`, `externalTrafficPolicy`, `topology-mode`, `trafficDistribution`), CoreDNS Corefile, NodeLocal DNSCache install, Gateway API resources (Gateway / HTTPRoute / GRPCRoute / TLSRoute / ReferenceGrant), and ClusterMesh peer Secrets. HARD REFUSE one-way doors (CNI replacement, kube-proxy mode swap, MTU change, Pod / Service CIDR resize, namespace deletion). P...Votes: 0GitHub stars: 23
- Kubernetes Live Rbac Mutation GuardGuard live kubectl apply, create, or delete operations on Kubernetes RBAC objects — Roles, ClusterRoles, RoleBindings, ClusterRoleBindings — with privilege-escalation verb detection, scope assessment, current-state diff, and explicit approval before any write. Use only when an intentional RBAC mutation is requested against a confirmed cluster target.Votes: 0GitHub stars: 23
- Kubernetes MaestroRoute Kubernetes tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know the specialist. Not for direct Kubernetes answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any live mutation specialist.Votes: 0GitHub stars: 23
- Kubernetes Network Architecture ReviewUse this skill for Kubernetes cluster network architecture review across the dataplane (CNI choice, kube-proxy mode, IPAM, MTU, encapsulation, dual-stack), service routing surface (Service types, EndpointSlices, internalTrafficPolicy/externalTrafficPolicy, topology-aware routing, Ingress, Gateway API), in-cluster DNS (CoreDNS, NodeLocal DNSCache, ndots), multi-cluster topology (ClusterMesh, Submariner, MCS-API design choices), and connectivity observability and troubleshooting. Trigger when t...Votes: 0GitHub stars: 23
- Kubernetes Pod Security Admission ReviewUse this skill for Kubernetes Pod Security Admission (PSA) review covering namespace labels for the three profiles (privileged, baseline, restricted), enforce/audit/warn modes, version pinning, and the migration path from deprecated PodSecurityPolicy. Trigger when the user asks whether a namespace label flip is safe, whether a workload meets a stricter profile, whether the audit/warn modes should be promoted to enforce, or whether an exemption is justified.Votes: 0GitHub stars: 23
- Kubernetes Pod Spec ReviewUse this skill when reviewing a Kubernetes Pod spec, Deployment spec, or StatefulSet spec for correctness, security posture, and production-readiness. Trigger on any request to audit, validate, or score a workload manifest.Votes: 0GitHub stars: 23
- Kubernetes Rbac ReviewUse this skill for Kubernetes RBAC, Role, ClusterRole, RoleBinding, ClusterRoleBinding, ServiceAccount, workload identity, or least-privilege review tasks. Trigger when the user asks whether cluster access is too broad, how to grant workload permissions safely, or how to audit RBAC state.Votes: 0GitHub stars: 23
- Kubernetes Workload Identity ReviewUse this skill for Kubernetes workload identity review covering AWS IRSA (IAM Roles for Service Accounts), Azure Workload Identity, GCP Workload Identity Federation, and the underlying ServiceAccount token volume projection plus OIDC issuer trust. Trigger when the user asks how a pod should authenticate to cloud services, whether long-lived credentials in a Secret can be replaced, whether the OIDC trust policy is correctly scoped, or whether ServiceAccount token reuse is a risk.Votes: 0GitHub stars: 23
- Kyverno Policy ReviewUse this skill for Kyverno policy review across the stable policies.kyverno.io/v1 API surface — ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy, and ImageValidatingPolicy. Trigger when the user asks whether an admission policy is safe, whether a PolicyException is justified, whether a policy should be enforced or audited, whether a Kyverno policy should be replaced by a native ValidatingAdmissionPolicy (CEL), or whether image signature verification is correctly configured.Votes: 0GitHub stars: 23
- Legal Counsel ReviewUse this skill when reviewing legal, contractual, regulatory, privacy, litigation, compliance, or risk-governance questions for an enterprise legal function. Trigger when a user provides a contract excerpt, a policy, a compliance question, a privacy-risk question, or a legal intake item and wants risks, evidence gaps, decision options, and escalation paths surfaced. This skill is an adversarial risk-review discipline; it does not provide legal advice, form an attorney-client relationship, or ...Votes: 0GitHub stars: 23
- Ai Advertising Targeting Fairness ReviewUse this skill when reviewing ad-platform audience targeting configurations and declared AI feature usage for protected-class discrimination risk. Trigger when a user provides a Meta Ads Manager audience definition, Google Ads targeting layer export, DSP deal config, or any ad platform audience spec annotated with AI features enabled (Advantage+ Audience, broad match, automated bidding, lookalike seeds). Use when a campaign is in housing, credit, employment, or insurance verticals, or when au...Votes: 0GitHub stars: 23
- Analytics Data Minimization ReviewUse this skill when reviewing analytics platform configuration — GA4 property settings, BigQuery export schema, custom event-parameter definitions, and user-property declarations — for data-minimization violations, excessive collection, and storage-period over-retention. Trigger when a user provides a GA4 property configuration export, a BigQuery raw-event export schema, a custom event or user-property inventory, data-retention settings, or asks whether their analytics setup collects more per...Votes: 0GitHub stars: 23
- Email Sender Authentication ReviewUse this skill when reviewing DNS sender-authentication records for a marketing domain to identify policy gaps exposing campaigns to rejection, spoofing, or inbox displacement. Trigger when a user provides DNS TXT record exports for SPF, DKIM, DMARC, or BIMI, or asks whether their email authentication posture meets Google/Yahoo bulk-sender requirements, DMARC enforcement standards, CISA BOD 18-01 obligations, PCI DSS v4.0 Req 5.3.3, or whether their transactional or marketing emails are at ri...Votes: 0GitHub stars: 23
- Eu Ai Act Marketing System ReviewUse this skill when reviewing a marketing AI system's description card against EU AI Act risk-tier criteria to classify the system (prohibited / high-risk / limited-risk / minimal-risk), flag documentation obligations, and identify deployment-readiness gaps before the August 2, 2026 full-enforcement date. Trigger when a user provides an AI system description card covering system purpose, input data types, output decisions, human-oversight mechanism, deployment geography, and whether it profil...Votes: 0GitHub stars: 23
- Influencer Disclosure Compliance ReviewUse this skill when reviewing an influencer campaign audit pack — campaign brief, creator agreement excerpt, platform post descriptions or screenshot descriptions, and the disclosure format and placement specification — against FTC Endorsement Guides to identify undisclosed material connections, inadequate disclosure placement, and brand liability exposure. Trigger when a user provides a structured influencer campaign audit pack and asks whether disclosures meet FTC requirements, whether the ...Votes: 0GitHub stars: 23
- Lookalike Audience Upload Compliance ReviewUse this skill when reviewing custom-audience and lookalike-audience upload specifications for hashing adequacy, PII field scope, consent-basis validity, and platform data-sharing restrictions before the upload is submitted to Meta, Google, LinkedIn, or TikTok. Trigger when a user provides an audience upload field-mapping specification (CSV schema or platform upload template), declared hashing method, consent-basis documentation, or originating list segment metadata — or when they ask whether...Votes: 0GitHub stars: 23
- Marketing Consent Data Collection ReviewUse this skill when reviewing a marketing site's consent and data-collection posture — cookie/consent banner (CMP) configuration, tag-manager container exports, Google Consent Mode wiring, or a cookie policy. Trigger when a user provides a CMP configuration, a tag manager container JSON, a consent-banner screenshot description, or asks whether their marketing tracking is GDPR/CCPA/ePrivacy compliant, whether tags fire before consent, or whether their opt-out path is valid.Votes: 0GitHub stars: 23
- Marketing Conversion Flow Dark Pattern ReviewUse this skill when reviewing marketing conversion flow specifications — subscription sign-up, upsell interstitial, free-trial enrollment, and cancellation path — for dark-pattern practices that invalidate consent or constitute unfair or deceptive acts under FTC Section 5 and state privacy laws. Trigger when a user provides a UX flow specification including step-by-step page descriptions, annotated wireframes, CTA labels, pre-checked options, visual weight of accept vs decline paths, countdow...Votes: 0GitHub stars: 23
- Marketing Email List Retention ReviewUse this skill when reviewing marketing email list segment metadata, consent-record completeness, suppression-list coverage, and documented data-retention schedules for GDPR storage-limitation, CASL record-keeping, and CCPA deletion-right compliance. Trigger when a user provides a CRM or ESP export of list segment metadata fields — consent source, consent timestamp, last-engagement date, subscription status, suppression-list entries — plus the organization's documented email data-retention po...Votes: 0GitHub stars: 23
- Marketing Gpc Signal Honoring ReviewUse this skill when reviewing the technical path by which a Global Privacy Control opt-out signal travels through the tag stack and CMP to determine whether ad tags, server-side forwarding, and conversion APIs actually cease firing. Trigger when a user provides a tag-manager container export, a CMP opt-out configuration, a server-side tag configuration, or asks whether their GPC implementation actually stops ad tags from firing, whether CPRA opt-out obligations are met technically, or whether...Votes: 0GitHub stars: 23
- Marketing MaestroRoute marketing-governance review tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know which marketing-governance specialist you need. Not for direct answers; Maestro classifies, dispatches, and synthesizes only. Dispatches a single agent for focused tasks or a parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard or mutating agents — requires explicit human confirmation with blast-radius and rollback before any l...Votes: 0GitHub stars: 23
- Marketing Pixel Data Leakage ReviewUse this skill when reviewing advertising pixels and event-tracking for personal-data leakage to third-party ad networks. Trigger when a user provides a tag-manager container, a Meta/TikTok/Google/LinkedIn pixel snippet, a conversion-event payload, a dataLayer specification, or asks whether their tracking pixels leak email, phone numbers, health, or financial data to ad platforms, or whether pixels on sensitive pages create a breach or HIPAA exposure.Votes: 0GitHub stars: 23