* improve: enhance legacy-modernizer based on automated review
- Add missing model: sonnet frontmatter field (was required but absent)
- Add explicit ownership/hand-off statement clarifying scope vs
architecture-modernizer, refactoring-specialist, cloud-migration-specialist,
and database-optimizer
- Add concrete "Common legacy stacks & upgrade paths" section (COBOL,
Java EE/WebLogic, .NET Framework, AngularJS, Python 2, PHP 5/7)
- Add "AI-assisted analysis" guidance (dependency mapping, codemods,
auto-generated characterization tests)
- Replace vague filler bullets ("Team trained effectively", "Celebrate wins",
"Business value delivered continuously") with concrete, actionable deliverables
- Diversify description examples: replaced a redundant strangler-fig example
with a distinct mainframe/COBOL + version-upgrade-only scenario
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address greptile review feedback on legacy-modernizer
Align the third description example's context with what it actually
demonstrates (.NET Framework version-upgrade only), and de-duplicate
the implementation-approach bullets that repeated the checklist items
verbatim.
* fix: address cubic review feedback on legacy-modernizer accuracy
Scope the .NET Framework upgrade path (Web Forms/WCF have no direct
Upgrade Assistant port and need separate plans), note 2to3 was removed
in Python 3.13+, and clarify that Grep/Glob only inventories
dependencies rather than producing a validated call graph.
* fix: soften zero-risk claim in legacy-modernizer example commentary
Version-only upgrades can still change runtime/dependency/batch
behavior; describe risk minimization via validation and rollback
instead of guaranteeing zero production risk.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance bettoredge-value-finder based on automated review
- Fix name to kebab-case (bettoredge-value-finder) matching filename
- Add required tools/model frontmatter, scoped to Read + mcp__bettoredge__*
- Add system-prompt persona and "When invoked" workflow
- Add Guardrails section enforcing bankroll limits, no fabricated results,
and legal-age confirmation
- Caveat the bid/ask-midpoint value-detection methodology
- Add credential-handling guidance for live account login env vars
- Bump version to 1.0.1 to match published npm package
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address PR review feedback on bettoredge-value-finder
- Remove unnecessary Read from tools frontmatter (agent only calls
MCP tools, none of which touch the filesystem)
- Fix bootstrap paradox: step 1 no longer unconditionally calls
bettoredge_setup, which only exists once the MCP server is running
- Move credential-handling warning ahead of the first instruction
that has users embed BETTOREDGE_EMAIL/PASSWORD
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: clarify bettoredge_status is read-only in guardrail wording
bettoredge_status only surfaces current bankroll limits; it can't
change them. Point users to the BettorEdge platform for that instead
of implying the agent can modify limits through this tool.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add missing required `model: sonnet` frontmatter field
- Rewrite description with a "Use PROACTIVELY" trigger phrase and three <example> blocks for better delegation matching, dropping the unsupported "research-backed" claim (tools have no WebSearch/WebFetch)
- Fix broken "See Also" references: professional-effective-communication -> professional-communication skill, /compose-email command -> email-composer skill, remove non-existent tech-talks-craft skill and /feedback-composer command, add difficult-workplace-conversations skill for roleplay scenarios
- Add persona-drift resistance guidance to Roleplay Mode so simulated personas stay consistently resistant/motivated across an exchange instead of becoming generically agreeable
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* Fix unauthenticated command injection (RCE) in Studio server
The `--studio` server (cli-tool/src/sandbox-server.js) bound to 0.0.0.0
with wildcard CORS and no authentication, and passed request-body fields
into spawn(..., { shell: true }). Because shell:true makes Node join the
argv array into a single `sh -c` string, the fields were parsed by the
shell, allowing OS command injection (RCE) via POST /api/execute (prompt)
and POST /api/install-agent (agentName), reachable from the LAN or a
malicious web page (wildcard CORS).
- Remove shell:true from all three spawns so arguments stay discrete argv
entries; shell metacharacters can no longer inject commands.
- Validate agentName against ^[A-Za-z0-9._/-]+$ before use.
- Bind the server to 127.0.0.1 only (removes the LAN vector).
- Restrict CORS to the local UI origin and reject cross-origin requests
(removes the drive-by browser vector).
Fixes GHSA-79wm-x847-7cvg.
Co-Authored-By: Claude Opus <noreply@anthropic.com>
* security: Windows-safe spawns + release bump on top of GHSA-79wm-x847-7cvg fix
Builds on @spartan8806's fix (advisory-fix-1). Adds the two pieces that fix
lacked:
- Resolve npx/claude via their .cmd shims on Windows (NPX_CMD/CLAUDE_CMD).
Without shell:true, bare spawn('npx'/'claude') fails with ENOENT on win32,
which would break agent install/local execution. This keeps the security fix
cross-platform.
- Bump version to 1.29.4 (root + cli-tool package.json) and add the 1.29.4
Security entry to CHANGELOG for the patched release.
Refs GHSA-79wm-x847-7cvg.
---------
Co-authored-by: spartan8806 <spartan8806@users.noreply.github.com>
Co-authored-by: Claude Opus <noreply@anthropic.com>
Co-authored-by: Dani <dan.avila7@gmail.com>
* Add mac-storage-cleaner skill (productivity)
* Address cubic-dev-ai review (3x P3): match the App-caches emptiness check to the four scanned dir names; guard unquoted * globs against a literal-* path on empty dirs; surface an unwritable audit log instead of proceeding silently unlogged.
Reviews a PRD/spec/design brief before implementation and surfaces holes by
attacking what the document is silent about — undefined edge cases, missing
states, policy gaps. Rules Approve / Conditional / Reject and turns each hole
into a forwardable question.
Co-authored-by: dhha22 <10957270+dhha22@users.noreply.github.com>
* improve: enhance smart-contract-specialist based on automated review
- Narrow scope to architecture/design-pattern advisory role, resolving overlap with blockchain-developer
- Add model: sonnet and tools: Read, Grep, Glob, WebSearch, WebFetch frontmatter (least-privilege, no Write/Edit/Bash)
- Add "When to Stop and Ask" guardrails section
- Add 2026 EVM/Solidity coverage: EIP-1153 transient storage, EIP-7201 namespaced storage, EIP-7702 (Pectra) EOA delegation, via_ir pipeline
- Add security/verification toolchain advisory section (Slither, Aderyn, Echidna, Medusa, Certora, Halmos, forge snapshot)
- Add anti-hallucination delivery-summary instruction
- Add "Integration with Other Agents" section documenting handoff to blockchain-developer and smart-contract-auditor
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: remove unsourced gas-savings percentage for via_ir pipeline
Addresses cubic review feedback on PR #713 — the "10-30% gas reduction"
figure isn't backed by official Solidity docs, which only describe
via-IR as producing "better gas-optimized code" without a specific
percentage. Replaced with qualitative language consistent with the
file's own anti-hallucination guardrail.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Packages the self-hosted stargazers-chart solution as a reusable skill so any
repo can add a star history chart that never breaks. Includes the generator
script (repo auto-detected from git remote / GITHUB_REPOSITORY) and a weekly
GitHub Actions workflow template.
Also points the README chart link to the skill's page on aitmpl.com.
- Add required tools and model frontmatter fields (audit-only allowlist: Read, Grep, Glob, Bash, WebSearch, WebFetch)
- Modernize security toolchain with Foundry, Aderyn, Echidna/Medusa, Certora Prover/Halmos
- Reference OWASP Smart Contract Top 10 and add explicit severity classification (Critical/High/Medium/Low/Informational)
- Cover cross-chain bridge exploits and business logic/tokenomics attack categories
- Add Integration with Other Agents section and When to Stop and Ask guardrail
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance shopify-expert based on automated review
- Fix invalid tools frontmatter (was VS Code Copilot Chat tool names, not Claude Code tools)
- Add model/color fields and upgrade description with delegation examples
- Correct REST vs GraphQL Admin API guidance for 2026 (REST legacy since Oct 2024, GraphQL mandatory for new public apps since Apr 2025)
- Replace Remix-specific app guidance with React Router v7 (@shopify/shopify-app-react-router)
- Add checkout.liquid deprecation deadline (Aug 26, 2026)
- Add Polaris Web Components and Hydrogen/headless (Oxygen, Storefront MCP) guidance
- Update Shopify CLI reference for CLI 4.0 flag changes
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: avoid false-positive javascript: XSS flag in shopify-expert
Automated security audit's HTML-injection check does a naive substring
match for "javascript:" and flagged the heading "...in JavaScript:" as
a javascript: protocol XSS pattern. Reword to sidestep the false
positive without changing meaning.
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add model field and rewrite description to state MCP dependencies and trigger phrases
- Add Prerequisites / Required MCP Setup section (Octopus Deploy + GitHub MCP servers, env vars, example config)
- Expand body into a structured workflow with ambiguity handling, missing-build-info fallback, and GitHub error handling
- Add example markdown release-notes output and a Troubleshooting & Limitations section
- Fix "release nots" typo
- Move from api-graphql/ to devops-infrastructure/ (correct category for a deployment/release-management agent)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-security-specialist based on automated review
- Add model, color, and permissionMode to frontmatter; add Glob and Edit to tools
- Rewrite description with <example>/<commentary> blocks matching sibling agents
- Add alias/batching overload ("battering ram") and CSRF attack coverage
- Add Recommended Security Tooling section (graphql-armor, graphql-cop, InQL)
- Fix Input Sanitization: clarify DOMPurify is XSS-only, add SQL/NoSQL injection prevention guidance
- Extend Query Allowlisting with Automatic Persisted Queries / trusted documents pattern
- Add closing "Integration with other agents" section
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: correct CSRF comment and remove fabricated Apollo plugin import
Addresses cubic-dev-ai review on PR #679:
- CSRF middleware comment now accurately describes rejecting all GET
requests lacking the preflight header, not just mutations
- Replaced non-existent ApolloServerPluginPersistedDocuments import
with a manual requestDidStart/didResolveOperation hook, which is a
real documented Apollo Server 4 plugin API
---------
Co-authored-by: Claude <noreply@anthropic.com>
Syncs the skill with its canonical source at context-architecture.dev. The
previous version described eight principles and a retrofit-only/metabolism
framing; the current methodology is one rule, a write/verify loop, and nine
principles, applied to both greenfield and brownfield repositories.
Authored by Sergio Azocar, CC BY 4.0. Faithful copy of the source SKILL.md.
Compared all skills tracked in ANTHROPIC_ATTRIBUTION.md against
anthropics/skills. Content (docx, pptx, xlsx, pdf, artifacts-builder,
etc.) is already in sync. The only drift was two skills still carrying
the unfilled Apache-2.0 copyright placeholder in LICENSE.txt; every
other tracked skill already reads "Copyright 2026 Anthropic, PBC."
- development/artifacts-builder/LICENSE.txt
- development/webapp-testing/LICENSE.txt
claude-api, doc-coauthoring, and frontend-design also exist locally
under the same names as upstream Anthropic skills, but git history
shows they were migrated from a different marketplace source, so they
were left untouched to avoid overwriting differently-sourced content.
Catalog regeneration was skipped for this change: LICENSE.txt is not
part of the generated index, and running the generator in this
environment reset download counts and dropped an unrelated skill
(database/postgres-schema-design) from the index, which would have
been an unrelated regression.
Claude-Session: https://claude.ai/code/session_019nn9iHjwpu6g5Fc6HM8hJR
Co-authored-by: Claude <noreply@anthropic.com>
- Renamed Thinking-Beast-Mode.md -> thinking-beast-mode.md (kebab-case)
and moved from api-graphql/ to development-tools/ (no GraphQL/API
content; it's a generic autonomous engineering-task agent)
- Added required model field plus color/permissionMode, matching
sibling agent conventions
- Replaced non-existent tool references (fetch_webpage,
sequential_thinking, get_errors) with real Claude Code tools
(WebFetch, WebSearch, Bash for lint/test)
- Rewrote the marketing-fluff description into a concrete,
example-driven trigger description
- Stripped "quantum cognitive architecture" roleplay language and
consolidated the workflow into Investigate -> Plan -> Implement ->
Verify -> Report, keeping the legitimately good discipline (root
cause debugging, rigorous verification, don't stop until truly done)
- Added explicit guardrails (ask before destructive commands, stop on
genuine blockers)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Completes the error tracking rollout: aitmpl-dashboard and aitmpl-cli Sentry
projects now exist alongside aitmpl-workers, and all three are verified
end-to-end (manual test events returned HTTP 200 and appeared in each
project's Issues dashboard).
- Dashboard: SENTRY_DSN set as a Cloudflare Pages secret on aitmpl-dashboard
(production). No code change needed — error-tracking.ts already read it.
- CLI: the aitmpl-cli DSN is public by design (send-only), so it ships as
DEFAULT_SENTRY_DSN in error-reporting.js instead of requiring every user
to configure their own Sentry project. Reporting itself stays opt-in
(CCT_ERROR_REPORTING=true), unaffected by this change.
- .env.example and CLAUDE.md updated to match reality; removed a stale
Vercel Deployment block left over from the Cloudflare Pages migration.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds free-tier Sentry error reporting to close the biggest observability
gap: automated cron/worker failures were previously invisible (aitmpl-crons
had no error handling at all). Uses a dependency-free fetch()-based Sentry
envelope client (cloudflare-workers/*/sentry.js, dashboard error-tracking.ts,
cli-tool error-reporting.js) instead of the official SDKs, to keep the
zero-dependency worker style and avoid Cloudflare Pages SSR friction.
- Cloudflare Workers: report failures + Cron Monitor check-ins in crons,
pulse, and docs-monitor (complementing, not replacing, existing Telegram
alerts). Also drops the pulse Vercel collector (VERCEL_API/collectVercel),
since the dashboard no longer deploys to Vercel.
- Dashboard: captureApiError() wired into claude-code-check, health-check,
and the three track-* endpoints.
- CLI: opt-in only crash reporting (CCT_ERROR_REPORTING=true), always
deferring to the existing CCT_NO_TRACKING/CCT_NO_ANALYTICS/CI opt-outs.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* improve: enhance data-engineer based on automated review
- Add dbt transformation frameworks section (dbt Core, Fusion, tests, contracts, Semantic Layer)
- Add managed EL ingestion and CDC tooling (Fivetran, Airbyte, Meltano, Debezium)
- Name concrete data-quality/observability tools and data contracts (Great Expectations, Soda, Monte Carlo, Elementary, ODCS)
- Modernize orchestration section (Airflow 3.x, Dagster asset-centric model, mark Luigi as legacy)
- Add AI/LLM data pipeline expertise (vector DBs, embeddings, RAG data prep)
- Align frontmatter/structure with sibling data-scientist.md (model field, clarifying-questions preamble)
- Strengthen description for automatic delegation with PROACTIVELY phrasing and key tool names
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: use neutral Luigi label per review feedback
cubic flagged the unsourced "maintenance mode" claim about Luigi in
the orchestration section; use a neutral label instead.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add HikerAPI MCP server to web-data (Instagram data API)
* Add LamaTok MCP server to web-data (TikTok data API)
* Add DataLikers hosted MCP server to web-data (Instagram & TikTok data)
Add missing model field, sharpen proactive-use description, add AI
search/GEO visibility guidance, update Core Web Vitals to INP-based
thresholds, and cross-reference search-ai-optimization-expert.
Claude-Session: https://claude.ai/code/session_01GoWck91RfDye9q46JZDGUk
Co-authored-by: Claude <noreply@anthropic.com>
- Add missing model: sonnet frontmatter field to match sibling agents
- Rewrite system prompt to be Claude-specific: XML tag structuring,
role framing, multishot examples, extended thinking/effort parameter,
prompt caching, and grounded long-context answers
- Remove outdated JSON "Communication Protocol" handshake pattern in
favor of a plain-language Requirements Gathering step
- Add explicit boundaries vs. llm-architect, model-evaluator, and
task-decomposition-expert to reduce delegation ambiguity
- Reframe hardcoded example metrics (accuracy %, latency, cost) as
illustrative targets to confirm with the user rather than universal
thresholds
- Regenerate component catalog entries for prompt-engineer
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
- Add required model field (sonnet) and color field to frontmatter
- Add Write/Edit tools so the agent can produce the test plans/docs it describes
- Rewrite QA excellence and excellence checklists as concrete, verifiable criteria instead of vague adjectives
- Replace hardcoded fake metrics in progress tracking and delivery notification with placeholder templates and explicit anti-fabrication guidance
- Replace speculative JSON "Communication Protocol" context-manager pattern with plain-language context-gathering guidance
- Add AI-assisted and agentic testing practices section covering risk-based test planning and delegation to test-automator/playwright-tester
- Regenerate component catalog (docs/components.json, dashboard/public/components.json)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
- Add error handling and run-status checks (try/catch, ApifyApiError, run.status) to JS/TS and Python examples
- Expand Apify MCP tools list with run management, storage access, and discovery tools (get-actor-log, get-dataset-items, get-key-value-store*, add-actor, rag-web-browser, etc.)
- Add webhook guidance (event types, `webhooks` call parameter, 200 response requirement)
- Add proxy configuration guidance (proxyConfiguration, RESIDENTIAL/DATACENTER groups, checkAccess opt-out)
- Add input schema validation step to the recommended workflow
- Add production deployment notes (scheduling, memory/timeout, idempotency) and testing/mocking examples for both languages
- Cover key-value store OUTPUT record retrieval alongside dataset pagination guidance
- Add model/color frontmatter fields and a "use proactively" trigger phrase to the description
- Fix duplicate H1 headings and refresh a stale example date
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* feat: add Loops component type with referenced components
Introduce "loops" as a new first-class component type — autonomous
agentic workflows (goal + interval + stop condition) inspired by Loop
Engineering and the Forward Future Loop Library. A loop references other
components (agents, skills, hooks, commands) and the dashboard renders
those references as clickable cards on the loop detail page.
- Add 10 starter loops under cli-tool/components/loops/
(engineering, evaluation, operations)
- Catalog generator: scan loops + write per-component content files
- Dashboard: new type in icons/types/data, /loops page, and a
"Referenced Components" section on the loop detail page
- CLI: --loop flag installs the loop to .claude/loops/ and
auto-installs its referenced components
- Docs: CLAUDE.md and cli-tool rule updated
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9ynMiCHt8JwdMd8KjCkES
* feat: add 8 more loops (goal/loop/schedule patterns)
Expand the loops catalog to 18, drawing ideas from community "Loop
Engineering" patterns. Adds loops across the three trigger verbs
(/goal, /loop, /schedule) and emphasizes the verifier-in-the-loop and
budget / anti-spin guardrails:
- engineering/five-minute-maintainer-loop
- engineering/build-test-fix-loop
- engineering/anti-spin-build-loop
- engineering/completion-contract-loop (goal)
- engineering/goal-refiner-loop (goal)
- engineering/adversarial-review-loop (cross-model)
- operations/overnight-pr-routine-loop (schedule)
- evaluation/human-approval-loop (human-in-the-loop)
All referenced components verified to exist; catalog regenerated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9ynMiCHt8JwdMd8KjCkES
---------
Co-authored-by: Claude <noreply@anthropic.com>
Adds a browser game (Dino Runner, Snake, Flappy Bird) that launches
automatically when Claude enters Plan Mode. Users can play while
Claude thinks, with a live activity panel showing tool calls in real time.
- EnterPlanMode / /plan → starts Node.js server on port 3456, opens browser
- Read/Bash/Edit/etc → streams tool activity to the activity panel
- Write to ~/.claude/plans/ → also triggers the game (for /plan command)
- AskUserQuestion → pauses the game until user responds
- ExitPlanMode → shows "Claude Termino!" overlay with confetti
Features: 3 games with high score persistence, signed score sharing URLs,
pause overlay when Claude needs input, activity feed with tool icons.
Requires Node.js and curl. macOS only (uses 'open' command).
Install globally in ~/.claude/settings.json to work across all projects.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Analytics Dashboard (Phase 1 + Phase 2):
- Replace 8663-line vanilla JS monolith with Astro static build
- New bento-grid layout with Geist design system (dark/light themes)
- ECharts (offline, tree-shaken) replaces Chart.js CDN dependency
- React island with KPI cards, token timeline, activity heatmap, agent BarList
- WebSocket client with reconnect backoff; polling fallback when WS disconnects
- API client with 30s cache; normalizes backend field names (inputTokens→totalInput)
- Build source in analytics-ui/, output committed to src/analytics-web/
- Fix: /api/activity now uses in-memory cache (was re-scanning all files on each request)
- Fix: remove duplicate /api/agents route (dead code since Express uses first match)
- Fix: /api/data and /api/fast-update no longer mutate this.data.conversations in place
TUI Modernization:
- Add src/tui.js with @clack/prompts-powered banner and helpers
- Replace inline showBanner() in bin/create-claude-config.js with tui.showBanner()
- Migrate showMainMenu() in src/index.js to @clack select() (replaces inquirer)
- Add @clack/prompts ^1.5.1 and gradient-string ^2.0.2 to dependencies
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds the memex MCP server under mcps/integration. memex watches git
repos and builds a temporal knowledge graph of modules, symbols,
decisions, and open problems (Graphiti + Neo4j), serving it to AI
coding agents over MCP. 12 read/write tools.
npx -y stifler-memex-mcp serve --repo .
Daniel Avila