* improve: enhance shopify-expert based on automated review
- Fix invalid tools frontmatter (was VS Code Copilot Chat tool names, not Claude Code tools)
- Add model/color fields and upgrade description with delegation examples
- Correct REST vs GraphQL Admin API guidance for 2026 (REST legacy since Oct 2024, GraphQL mandatory for new public apps since Apr 2025)
- Replace Remix-specific app guidance with React Router v7 (@shopify/shopify-app-react-router)
- Add checkout.liquid deprecation deadline (Aug 26, 2026)
- Add Polaris Web Components and Hydrogen/headless (Oxygen, Storefront MCP) guidance
- Update Shopify CLI reference for CLI 4.0 flag changes
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: avoid false-positive javascript: XSS flag in shopify-expert
Automated security audit's HTML-injection check does a naive substring
match for "javascript:" and flagged the heading "...in JavaScript:" as
a javascript: protocol XSS pattern. Reword to sidestep the false
positive without changing meaning.
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add model field and rewrite description to state MCP dependencies and trigger phrases
- Add Prerequisites / Required MCP Setup section (Octopus Deploy + GitHub MCP servers, env vars, example config)
- Expand body into a structured workflow with ambiguity handling, missing-build-info fallback, and GitHub error handling
- Add example markdown release-notes output and a Troubleshooting & Limitations section
- Fix "release nots" typo
- Move from api-graphql/ to devops-infrastructure/ (correct category for a deployment/release-management agent)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-security-specialist based on automated review
- Add model, color, and permissionMode to frontmatter; add Glob and Edit to tools
- Rewrite description with <example>/<commentary> blocks matching sibling agents
- Add alias/batching overload ("battering ram") and CSRF attack coverage
- Add Recommended Security Tooling section (graphql-armor, graphql-cop, InQL)
- Fix Input Sanitization: clarify DOMPurify is XSS-only, add SQL/NoSQL injection prevention guidance
- Extend Query Allowlisting with Automatic Persisted Queries / trusted documents pattern
- Add closing "Integration with other agents" section
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: correct CSRF comment and remove fabricated Apollo plugin import
Addresses cubic-dev-ai review on PR #679:
- CSRF middleware comment now accurately describes rejecting all GET
requests lacking the preflight header, not just mutations
- Replaced non-existent ApolloServerPluginPersistedDocuments import
with a manual requestDidStart/didResolveOperation hook, which is a
real documented Apollo Server 4 plugin API
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Renamed Thinking-Beast-Mode.md -> thinking-beast-mode.md (kebab-case)
and moved from api-graphql/ to development-tools/ (no GraphQL/API
content; it's a generic autonomous engineering-task agent)
- Added required model field plus color/permissionMode, matching
sibling agent conventions
- Replaced non-existent tool references (fetch_webpage,
sequential_thinking, get_errors) with real Claude Code tools
(WebFetch, WebSearch, Bash for lint/test)
- Rewrote the marketing-fluff description into a concrete,
example-driven trigger description
- Stripped "quantum cognitive architecture" roleplay language and
consolidated the workflow into Investigate -> Plan -> Implement ->
Verify -> Report, keeping the legitimately good discipline (root
cause debugging, rigorous verification, don't stop until truly done)
- Added explicit guardrails (ask before destructive commands, stop on
genuine blockers)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Remove `model: sonnet/haiku/opus` from 396 component files. The Anthropic
API requires full model IDs (e.g., claude-sonnet-4-6), so shorthand names
cause 404 errors. Removing the field lets Claude Code use the user's
configured default model instead.
Fixes#99https://claude.ai/code/session_01Hqx78XZNbdfh38YGZn4g4T
Co-authored-by: Claude <noreply@anthropic.com>
Imported and converted components from github.com/github/awesome-copilot:
- 135 agents covering various domains (security, devops, web development, etc.)
- 7 skills converted to commands (GitHub issues, NuGet, Azure, testing, etc.)
New agent categories:
- Programming languages experts (C#, Python, Rust, TypeScript, etc.)
- Azure and cloud infrastructure specialists
- Web development experts (React, Next.js, accessibility)
- Security and DevOps specialists
- Data and AI specialists
New command categories:
- Azure (AppInsights, role selector)
- Database (Snowflake)
- Design (web design reviewer)
- Project management (GitHub issues, NuGet manager)
- Testing (webapp testing)
All components converted from awesome-copilot format to claude-code-templates format with appropriate frontmatter and categorization.
Co-authored-by: Claude <noreply@anthropic.com>
- Updated hackathon-ai-strategist agent description and added tools for improved functionality.
- Revised llms-maintainer agent for proactive updates and enhanced tools.
- Introduced new model-evaluator agent for comprehensive AI model assessment and benchmarking.
- Enhanced prompt-engineer agent description for clarity on usage.
- Updated task-decomposition-expert agent to emphasize complex goal breakdown and tool selection.
- Expanded graphql-architect agent with detailed schema design and resolver optimization strategies.
- Created graphql-performance-optimizer agent for performance analysis and optimization of GraphQL APIs.
- Developed graphql-security-specialist agent focusing on security audits, authorization, and protection against vulnerabilities.
- Added security-auditor script to package.json for automated security audits.
Daniel Avila