Become a 100×
developer with
Claude Code.

# Custom command: /review-pr Review the current git diff as a Staff Engineer. Check for: - Bugs, logic errors, race conditions - Security vulnerabilities (OWASP Top 10) - Performance issues (N+1, missing indexes, re-renders) - Missing error handling and edge cases - Test coverage gaps For each issue: file:line, severity, exact fix. End with a go/no-go recommendation.

# Custom command: /deploy-check Pre-deployment checklist: 1. Run all tests and report failures 2. Check for console.log / debugger statements 3. Verify no hardcoded secrets or API keys 4. Check for missing environment variables 5. Review database migrations are reversible 6. Confirm no TODO/FIXME in changed files Output: READY TO DEPLOY or BLOCKED (with reasons).

--- name: pr-review description: "Thorough PR review as a Staff Engineer" params: focus: string # e.g. "security", "performance", "all" severity: enum [critical, major, minor, all] --- You are a Staff Engineer doing a rigorous PR review. Review the current git diff. Focus on: {{focus}} Report issues of severity: {{severity}} and above. For each issue: - Location (file:line) - What's wrong and why it matters - The exact fix (show code) - Severity: Critical / Major / Minor End with: overall assessment and top 3 must-fix items.

# Run a skill with parameters claude skill pr-review --focus security --severity critical # List all available skills claude skill list # Run skill on specific files claude skill pr-review --files src/auth.ts src/api/payments.ts

.claude/skills/pr-review/ ├── SKILL.md # Main prompt template with params ├── reference.md # Team standards, style guide excerpts ├── examples.md # Good/bad examples for few-shot learning ├── scripts/ │ └── post-review.sh # Post-processing scripts └── templates/ └── report.md # Output format template

# Browse the marketplace /plugin marketplace # Search for a specific skill type /plugin marketplace search "code review" # Install a community plugin /plugin install @claude-community/pr-review # List installed plugins /plugin list

Use subagents to implement the user notifications feature in parallel: Agent 1 — Backend: - Notifications table (Prisma schema) - CRUD API endpoints in /app/api/notifications - Real-time via Server-Sent Events - Email queue integration (Resend) Agent 2 — Frontend: - NotificationBell component (unread count badge) - NotificationPanel (dropdown list, mark as read) - Real-time SSE subscription hook - Optimistic UI updates Agent 3 — Tests: - API endpoint tests (happy path + errors) - Component tests (render, interactions) - E2E test for the full notification flow Coordinate: Backend completes schema first, then Frontend and Tests can proceed in parallel. Report conflicts immediately. Merge when all three are green.

--- name: security-auditor tools: [Read, Glob, Grep] # Read-only — no writes model: opus --- You are a security auditor. Your job is to find vulnerabilities. Rules: - Focus on OWASP Top 10 - Check for injection, XSS, CSRF, auth bypass - Report file:line for every finding - Classify: Critical / High / Medium / Low - Suggest exact code fixes You cannot: - Write or modify files - Run shell commands - Access network resources

{ "hooks": [ { "event": "pre_write", "name": "lint-check", "description": "Run ESLint before writing any TS/JS file", "command": "eslint {{file}} --fix", "on_failure": "warn" // warn | block | ignore }, { "event": "post_write", "name": "run-tests", "description": "Run related tests after file changes", "command": "vitest run --related {{file}}", "on_failure": "warn" }, { "event": "post_session", "name": "notify-slack", "description": "Post session summary to #dev-ai channel", "command": "node .claude/scripts/slack-notify.js", "on_failure": "ignore" }, { "event": "pre_bash", "name": "command-audit", "description": "Log all shell commands Claude runs", "command": "echo '[CLAUDE] {{command}}' >> .claude/audit.log", "on_failure": "ignore" } ] }

{ "mcpServers": { "postgres": { "command": "npx", "args": ["@modelcontextprotocol/server-postgres"], "env": { "DATABASE_URL": "${DATABASE_URL}" } }, "github": { "command": "npx", "args": ["@modelcontextprotocol/server-github"], "env": { "GITHUB_TOKEN": "${GITHUB_TOKEN}" } }, "slack": { "command": "npx", "args": ["@modelcontextprotocol/server-slack"], "env": { "SLACK_BOT_TOKEN": "${SLACK_BOT_TOKEN}" } }, "jira": { "command": "npx", "args": ["@modelcontextprotocol/server-atlassian"], "env": { "ATLASSIAN_URL": "${JIRA_URL}", "ATLASSIAN_TOKEN": "${JIRA_TOKEN}" } } } }

# Toggle sandbox in REPL /sandbox # Launch with sandbox enabled claude --sandbox # Sandbox restricts: Network: No outbound requests (API calls blocked) Files: Writes tracked and reversible Shell: Commands run in isolated context Side effects: All changes shown for review before applying

name: Claude Code Review on: [pull_request] jobs: review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: { fetch-depth: 0 } - name: Install Claude Code run: npm install -g @anthropic-ai/claude-code - name: Run review env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | DIFF=$(git diff origin/main...HEAD) REVIEW=$(echo "$DIFF" | claude -p \ "Senior engineer PR review. Check: bugs, security, perf, missing tests. Format as GitHub markdown. Start: ✅ Looks Good / ⚠️ Issues / 🚨 Critical" \ --dangerously-skip-permissions) gh pr comment ${{ github.event.number }} --body "$REVIEW"

Comprehensive codebase audit across all files in src/. Report: 🚨 Security vulnerabilities — file:line, severity, fix ⚡ Performance bottlenecks — N+1s, missing indexes, bundle issues 🐛 Likely bugs — race conditions, null risks, edge case gaps 📊 Tech debt score per module (1–10), worst 5 explained ✅ What's working well — patterns to preserve Priority: fix immediately / this sprint / this quarter. Output as markdown report to share with the team.

Database migration pipeline for: [describe schema change] Execute these steps in order: 1. Generate migration SQL (forward + rollback) 2. Run migration on test database 3. Run rollback on test database — verify clean reversal 4. Re-run migration — verify idempotency 5. Run data integrity checks (foreign keys, constraints, orphaned records) 6. Benchmark: time the migration on [X] rows 7. Generate zero-downtime deployment plan If any step fails, stop and report. Do not proceed to production. Output: migration file, rollback file, validation queries, deployment runbook.

Upgrade all outdated dependencies in this project safely. Workflow per dependency: 1. Check current version vs latest 2. Read the changelog for breaking changes 3. Upgrade the dependency 4. Run the full test suite 5. If tests fail: fix the breaking change or roll back 6. If tests pass: commit with message "chore: upgrade [pkg] from vX to vY" Order: patch updates first, then minor, then major. Skip dependencies with known incompatibilities (list them). Output: summary table of all upgrades with status (✅ upgraded / ⚠️ breaking / ❌ skipped).

Incident response — production issue detected: [paste error logs, alerts, or symptoms] Execute: 1. TRIAGE — severity (P0–P3), blast radius, user impact estimate 2. ROOT CAUSE — trace the error through logs, identify the failing component 3. MITIGATION — propose immediate fix (hotfix, rollback, feature flag) 4. FIX — implement the fix, run tests 5. POSTMORTEM — draft a blameless postmortem: - Timeline of events - Root cause analysis (5 Whys) - What went well / what didn't - Action items with owners and deadlines - How to prevent recurrence Prioritize speed. Get the mitigation out first, then investigate.

# Project: [Your App Name] ## Stack - Framework: Next.js 14 (App Router) - Language: TypeScript (strict mode) - Styling: Tailwind CSS + shadcn/ui - Database: PostgreSQL + Prisma ORM - Testing: Vitest + Playwright - CI: GitHub Actions ## Architecture - src/app/ — Next.js pages and layouts (App Router) - src/components/ — Reusable UI components (atomic design) - src/lib/ — Business logic, utilities, types - src/server/ — API routes, server actions, DB queries - prisma/ — Schema and migrations ## Code Conventions - Use named exports, never default exports - Components: PascalCase files, co-located tests (.test.tsx) - Hooks: use[Name] pattern in src/hooks/ - Types: co-locate with usage, shared types in src/lib/types.ts - Prefer server components. Use "use client" only when needed. - Error handling: Result pattern, never throw in business logic ## DO NOT - Do not use any, suppress TypeScript errors, or add @ts-ignore - Do not use var — always const or let - Do not write console.log (use the logger utility) - Do not commit .env files or secrets - Do not modify prisma/schema.prisma without a migration plan - Do not skip tests. Every feature needs unit + integration tests. ## Testing - Run: npm run test (unit) / npm run test:e2e (Playwright) - Coverage threshold: 80% lines - Test naming: "should [expected behavior] when [condition]" ## Git - Branch naming: feat/ticket-123-short-description - Commit format: type(scope): description - Always squash merge to main