- Add required tools and model frontmatter fields (audit-only allowlist: Read, Grep, Glob, Bash, WebSearch, WebFetch)
- Modernize security toolchain with Foundry, Aderyn, Echidna/Medusa, Certora Prover/Halmos
- Reference OWASP Smart Contract Top 10 and add explicit severity classification (Critical/High/Medium/Low/Informational)
- Cover cross-chain bridge exploits and business logic/tokenomics attack categories
- Add Integration with Other Agents section and When to Stop and Ask guardrail
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance shopify-expert based on automated review
- Fix invalid tools frontmatter (was VS Code Copilot Chat tool names, not Claude Code tools)
- Add model/color fields and upgrade description with delegation examples
- Correct REST vs GraphQL Admin API guidance for 2026 (REST legacy since Oct 2024, GraphQL mandatory for new public apps since Apr 2025)
- Replace Remix-specific app guidance with React Router v7 (@shopify/shopify-app-react-router)
- Add checkout.liquid deprecation deadline (Aug 26, 2026)
- Add Polaris Web Components and Hydrogen/headless (Oxygen, Storefront MCP) guidance
- Update Shopify CLI reference for CLI 4.0 flag changes
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: avoid false-positive javascript: XSS flag in shopify-expert
Automated security audit's HTML-injection check does a naive substring
match for "javascript:" and flagged the heading "...in JavaScript:" as
a javascript: protocol XSS pattern. Reword to sidestep the false
positive without changing meaning.
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add model field and rewrite description to state MCP dependencies and trigger phrases
- Add Prerequisites / Required MCP Setup section (Octopus Deploy + GitHub MCP servers, env vars, example config)
- Expand body into a structured workflow with ambiguity handling, missing-build-info fallback, and GitHub error handling
- Add example markdown release-notes output and a Troubleshooting & Limitations section
- Fix "release nots" typo
- Move from api-graphql/ to devops-infrastructure/ (correct category for a deployment/release-management agent)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-security-specialist based on automated review
- Add model, color, and permissionMode to frontmatter; add Glob and Edit to tools
- Rewrite description with <example>/<commentary> blocks matching sibling agents
- Add alias/batching overload ("battering ram") and CSRF attack coverage
- Add Recommended Security Tooling section (graphql-armor, graphql-cop, InQL)
- Fix Input Sanitization: clarify DOMPurify is XSS-only, add SQL/NoSQL injection prevention guidance
- Extend Query Allowlisting with Automatic Persisted Queries / trusted documents pattern
- Add closing "Integration with other agents" section
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: correct CSRF comment and remove fabricated Apollo plugin import
Addresses cubic-dev-ai review on PR #679:
- CSRF middleware comment now accurately describes rejecting all GET
requests lacking the preflight header, not just mutations
- Replaced non-existent ApolloServerPluginPersistedDocuments import
with a manual requestDidStart/didResolveOperation hook, which is a
real documented Apollo Server 4 plugin API
---------
Co-authored-by: Claude <noreply@anthropic.com>
Syncs the skill with its canonical source at context-architecture.dev. The
previous version described eight principles and a retrofit-only/metabolism
framing; the current methodology is one rule, a write/verify loop, and nine
principles, applied to both greenfield and brownfield repositories.
Authored by Sergio Azocar, CC BY 4.0. Faithful copy of the source SKILL.md.
Compared all skills tracked in ANTHROPIC_ATTRIBUTION.md against
anthropics/skills. Content (docx, pptx, xlsx, pdf, artifacts-builder,
etc.) is already in sync. The only drift was two skills still carrying
the unfilled Apache-2.0 copyright placeholder in LICENSE.txt; every
other tracked skill already reads "Copyright 2026 Anthropic, PBC."
- development/artifacts-builder/LICENSE.txt
- development/webapp-testing/LICENSE.txt
claude-api, doc-coauthoring, and frontend-design also exist locally
under the same names as upstream Anthropic skills, but git history
shows they were migrated from a different marketplace source, so they
were left untouched to avoid overwriting differently-sourced content.
Catalog regeneration was skipped for this change: LICENSE.txt is not
part of the generated index, and running the generator in this
environment reset download counts and dropped an unrelated skill
(database/postgres-schema-design) from the index, which would have
been an unrelated regression.
Claude-Session: https://claude.ai/code/session_019nn9iHjwpu6g5Fc6HM8hJR
Co-authored-by: Claude <noreply@anthropic.com>
- Renamed Thinking-Beast-Mode.md -> thinking-beast-mode.md (kebab-case)
and moved from api-graphql/ to development-tools/ (no GraphQL/API
content; it's a generic autonomous engineering-task agent)
- Added required model field plus color/permissionMode, matching
sibling agent conventions
- Replaced non-existent tool references (fetch_webpage,
sequential_thinking, get_errors) with real Claude Code tools
(WebFetch, WebSearch, Bash for lint/test)
- Rewrote the marketing-fluff description into a concrete,
example-driven trigger description
- Stripped "quantum cognitive architecture" roleplay language and
consolidated the workflow into Investigate -> Plan -> Implement ->
Verify -> Report, keeping the legitimately good discipline (root
cause debugging, rigorous verification, don't stop until truly done)
- Added explicit guardrails (ask before destructive commands, stop on
genuine blockers)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance data-engineer based on automated review
- Add dbt transformation frameworks section (dbt Core, Fusion, tests, contracts, Semantic Layer)
- Add managed EL ingestion and CDC tooling (Fivetran, Airbyte, Meltano, Debezium)
- Name concrete data-quality/observability tools and data contracts (Great Expectations, Soda, Monte Carlo, Elementary, ODCS)
- Modernize orchestration section (Airflow 3.x, Dagster asset-centric model, mark Luigi as legacy)
- Add AI/LLM data pipeline expertise (vector DBs, embeddings, RAG data prep)
- Align frontmatter/structure with sibling data-scientist.md (model field, clarifying-questions preamble)
- Strengthen description for automatic delegation with PROACTIVELY phrasing and key tool names
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: use neutral Luigi label per review feedback
cubic flagged the unsourced "maintenance mode" claim about Luigi in
the orchestration section; use a neutral label instead.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add HikerAPI MCP server to web-data (Instagram data API)
* Add LamaTok MCP server to web-data (TikTok data API)
* Add DataLikers hosted MCP server to web-data (Instagram & TikTok data)
Add missing model field, sharpen proactive-use description, add AI
search/GEO visibility guidance, update Core Web Vitals to INP-based
thresholds, and cross-reference search-ai-optimization-expert.
Claude-Session: https://claude.ai/code/session_01GoWck91RfDye9q46JZDGUk
Co-authored-by: Claude <noreply@anthropic.com>
- Add missing model: sonnet frontmatter field to match sibling agents
- Rewrite system prompt to be Claude-specific: XML tag structuring,
role framing, multishot examples, extended thinking/effort parameter,
prompt caching, and grounded long-context answers
- Remove outdated JSON "Communication Protocol" handshake pattern in
favor of a plain-language Requirements Gathering step
- Add explicit boundaries vs. llm-architect, model-evaluator, and
task-decomposition-expert to reduce delegation ambiguity
- Reframe hardcoded example metrics (accuracy %, latency, cost) as
illustrative targets to confirm with the user rather than universal
thresholds
- Regenerate component catalog entries for prompt-engineer
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
- Add required model field (sonnet) and color field to frontmatter
- Add Write/Edit tools so the agent can produce the test plans/docs it describes
- Rewrite QA excellence and excellence checklists as concrete, verifiable criteria instead of vague adjectives
- Replace hardcoded fake metrics in progress tracking and delivery notification with placeholder templates and explicit anti-fabrication guidance
- Replace speculative JSON "Communication Protocol" context-manager pattern with plain-language context-gathering guidance
- Add AI-assisted and agentic testing practices section covering risk-based test planning and delegation to test-automator/playwright-tester
- Regenerate component catalog (docs/components.json, dashboard/public/components.json)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
- Add error handling and run-status checks (try/catch, ApifyApiError, run.status) to JS/TS and Python examples
- Expand Apify MCP tools list with run management, storage access, and discovery tools (get-actor-log, get-dataset-items, get-key-value-store*, add-actor, rag-web-browser, etc.)
- Add webhook guidance (event types, `webhooks` call parameter, 200 response requirement)
- Add proxy configuration guidance (proxyConfiguration, RESIDENTIAL/DATACENTER groups, checkAccess opt-out)
- Add input schema validation step to the recommended workflow
- Add production deployment notes (scheduling, memory/timeout, idempotency) and testing/mocking examples for both languages
- Cover key-value store OUTPUT record retrieval alongside dataset pagination guidance
- Add model/color frontmatter fields and a "use proactively" trigger phrase to the description
- Fix duplicate H1 headings and refresh a stale example date
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* feat: add Loops component type with referenced components
Introduce "loops" as a new first-class component type — autonomous
agentic workflows (goal + interval + stop condition) inspired by Loop
Engineering and the Forward Future Loop Library. A loop references other
components (agents, skills, hooks, commands) and the dashboard renders
those references as clickable cards on the loop detail page.
- Add 10 starter loops under cli-tool/components/loops/
(engineering, evaluation, operations)
- Catalog generator: scan loops + write per-component content files
- Dashboard: new type in icons/types/data, /loops page, and a
"Referenced Components" section on the loop detail page
- CLI: --loop flag installs the loop to .claude/loops/ and
auto-installs its referenced components
- Docs: CLAUDE.md and cli-tool rule updated
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9ynMiCHt8JwdMd8KjCkES
* feat: add 8 more loops (goal/loop/schedule patterns)
Expand the loops catalog to 18, drawing ideas from community "Loop
Engineering" patterns. Adds loops across the three trigger verbs
(/goal, /loop, /schedule) and emphasizes the verifier-in-the-loop and
budget / anti-spin guardrails:
- engineering/five-minute-maintainer-loop
- engineering/build-test-fix-loop
- engineering/anti-spin-build-loop
- engineering/completion-contract-loop (goal)
- engineering/goal-refiner-loop (goal)
- engineering/adversarial-review-loop (cross-model)
- operations/overnight-pr-routine-loop (schedule)
- evaluation/human-approval-loop (human-in-the-loop)
All referenced components verified to exist; catalog regenerated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9ynMiCHt8JwdMd8KjCkES
---------
Co-authored-by: Claude <noreply@anthropic.com>
Adds a browser game (Dino Runner, Snake, Flappy Bird) that launches
automatically when Claude enters Plan Mode. Users can play while
Claude thinks, with a live activity panel showing tool calls in real time.
- EnterPlanMode / /plan → starts Node.js server on port 3456, opens browser
- Read/Bash/Edit/etc → streams tool activity to the activity panel
- Write to ~/.claude/plans/ → also triggers the game (for /plan command)
- AskUserQuestion → pauses the game until user responds
- ExitPlanMode → shows "Claude Termino!" overlay with confetti
Features: 3 games with high score persistence, signed score sharing URLs,
pause overlay when Claude needs input, activity feed with tool icons.
Requires Node.js and curl. macOS only (uses 'open' command).
Install globally in ~/.claude/settings.json to work across all projects.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds the memex MCP server under mcps/integration. memex watches git
repos and builds a temporal knowledge graph of modules, symbols,
decisions, and open problems (Graphiti + Neo4j), serving it to AI
coding agents over MCP. 12 read/write tools.
npx -y stifler-memex-mcp serve --repo .
Adds a new skill in creative-design/luma-imagegen that generates images
via the Luma AI Dream Machine API (Photon models). Includes interactive
prompt collection, API key detection from env/.env, async polling, and
image download. Uses only Python stdlib — no extra dependencies.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove all hardcoded absolute paths (/Users/cam/VAULT01/...) and replace with relative paths rooted at ./
- Replace VAULT01-specific references with generic vault terminology
- Add model: sonnet field to frontmatter
- Add Grep and Edit to tools list; remove redundant LS
- Expand description with 3 concrete <example>/<commentary> blocks
- Add Native Fallback Workflow using Glob+Grep (no external script dependency)
- Make Script-Assisted Workflow optional with clear instructions to run from vault root
- Add MOC Hierarchy section explaining LYT three-tier system (Home/Topic/Sub-MOC)
- Add optional Dataview block to MOC template with note to remove if plugin absent
- Add vault-structure validation guidance before writing MOCs
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Major upstream rewrite with eval-driven iterative workflow:
- New agents/ dir (analyzer, comparator, grader)
- New eval-viewer/ for benchmark review UI
- New scripts for eval runs, benchmarking, and description optimization
- Updated SKILL.md with new process-oriented approach
- Preserved local-only files (output-patterns.md, workflows.md, init_skill.py)
Ivan