Claude Code Wsl Setup

Test-driven development reference for writing good tests, designing testable interfaces, mocking at system boundaries, and refactoring after green. Use when writing tests, reviewing test quality, or applying red-green-refactor workflow. Not for running test suites or CI configuration — use language-conventions or cicd-generation for those.

Use when planning implementation steps, deciding commit format, or structuring development approach. Provides brainstorm-plan-implement flow with conventional commits. Triggers on 'how should I approach this', 'commit format'.

Use when working with dbt (data build tool) - creating models, writing tests, CI/CD pipelines, materializations, sources, staging/intermediate/marts layers, Snowflake/BigQuery warehouse configuration, incremental strategies, Jinja macros, data quality, semantic layer, or making analytics engineering decisions

Fast codebase searches using grep/glob. Triggers on "find", "search", "where is", "grep for".

Use this skill when performing hardware security analysis for System-on-Chip components — threat modeling, verification scaffolding, compliance mapping, executive briefing, microarchitectural attack analysis, physical side-channel assessment, kernel security analysis, emerging hardware security, or TLA+ formal specification. Routes to the appropriate specialist. Trigger phrases include "threat model my SoC", "run STRIDE analysis", "generate SVA assertions", "compliance check against FIPS", "executive summary of findings", "Spectre analysis for cache", "DPA attack assessment", "kernel hardening review", "PQC hardware review", "TLA+ spec for access control". Do NOT use for software-only security, network security, or web application security.

Use this skill when creating a statistical plot or chart from a data file. Triggers on "plot this data", "make a chart", "graph this CSV", or "visualize these results". Applies to CSV, JSON, or tabular data needing bar charts, scatter plots, line graphs, or similar visualizations. Do NOT use for methodology diagrams from text (use generate-diagram) or diagram scoring (use evaluate-diagram).

Local git operations for syncing, branching, merging, and conflict resolution

Interactive wizard to craft effective prompts using Claude Code best practices

Use when creating GitHub Actions workflows, adding CI/CD to a project, or reviewing pipeline security. Produces fail-fast, security-hardened workflows with OIDC auth and SHA-pinned actions. Triggers on 'add CI', 'create workflow', 'github actions'.

GitHub interactions for issues, PRs, releases, and repository management

Use when creating Helm values.yaml files, converting docker-compose to Helm, or reviewing Helm configurations. Produces minimal-diff values that only override chart defaults. Triggers on 'helm values', 'create values.yaml', 'deploy to kubernetes'.

Use when working with Terraform or OpenTofu - creating modules, writing tests (native test framework, Terratest), setting up CI/CD pipelines, reviewing configurations, choosing between testing approaches, debugging state issues, implementing security scanning (trivy, checkov), or making infrastructure-as-code architecture decisions

Use this skill when scoring or comparing a generated diagram against a human reference. Triggers on "score this diagram", "evaluate my diagram", "compare to reference", or "how accurate is this". Applies when both a generated diagram and a reference image exist and quality assessment is needed. Do NOT use for creating new diagrams (use generate-diagram) or plotting data (use generate-plot).

Use this skill when creating a methodology diagram from research text. Triggers on "make a diagram", "visualize this methodology", "diagram this process", or "generate a figure from this paper". Applies to methodology descriptions, process flows, and research paper sections. Do NOT use for scoring existing diagrams (use evaluate-diagram) or plotting data from CSV/JSON (use generate-plot).

Language and project convention references for Python, TypeScript, and Terraform. Use when setting up new projects, reviewing code conventions, or ensuring consistency. Covers tooling, configs, patterns, testing, and project structure.

Use when creating Dockerfiles, optimizing container images, or reviewing Docker configurations. Produces multi-stage, security-hardened builds with proper layer caching. Triggers on 'create Dockerfile', 'dockerize', 'optimize container'.

Security audit checklist for web applications. Use when reviewing, auditing, or hardening a web app's security posture. Covers rate limiting, auth headers, IP blocking, CORS, security middleware, input validation, file upload limits, ORM usage, and password hashing. Triggers on requests like "review security", "harden this app", "security audit", "check for vulnerabilities", or when building/reviewing API endpoints.

Use when writing formal specifications in TLA+ to verify system properties, defining state variables, configuring TLC model checker, and documenting assumptions and limitations. Covers safety and liveness properties for protocols and concurrent systems. Do not use for security claim enumeration without specification intent (use invariant-analysis).

Use when a user reports a frontend bug, visual defect, or unexpected behavior in a Next.js/TypeScript application. Orchestrates a multi-phase QA pipeline — component mapping, diagnosis, fix, and regression testing — by classifying symptoms and dispatching to the appropriate specialist skill. Does not perform diagnosis or fixes directly; delegates all domain work to specialists. Not for backend-only issues, infrastructure problems, or build/deployment failures.

Capacity planning with traffic projections, scaling triggers, and cost-at-scale modeling

React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.

REST/RPC endpoint contracts with request/response types and error handling

Structured visual design critique with specific actionable feedback

Use when reviewing cryptographic implementations for algorithm choice correctness, key management soundness, side-channel resistance, and crypto agility readiness. Covers symmetric and asymmetric operations, key lifecycle, and construction safety. Do not use for protocol-level analysis (use protocol-analysis) or post-quantum migration planning (use pqc-readiness).

Use when assessing a system's readiness for post-quantum cryptography migration, inventorying classical crypto usage, mapping NIST-standardized PQC replacements, and planning phased migration timelines. Covers key exchange, digital signatures, and hybrid mode needs. Do not use for classical crypto implementation review (use crypto-review) or protocol state machine analysis (use protocol-analysis).

Golden dataset creation, automated scoring rubrics, and hallucination detection

STRIDE-based security threat analysis for proposed features

Design ML workflows — experiment tracking, feature stores, model training, serving, monitoring for drift

Animation principles, micro-interaction specs, and reduced-motion support

Use when reviewing the hardware/software security interface to verify hardware security feature enablement, IOMMU/SMMU DMA protection configuration, and HW/SW trust model coherence. Covers boot chain verification, memory protection, and control flow integrity features. Do not use for kernel configuration audit (use kernel-hardening) or isolation boundary analysis (use isolation-review).

Infrastructure cost modeling, scaling projections, and optimization recommendations

Technology maturity assessment with adoption recommendation and risk analysis

MoSCoW prioritization and value-effort matrix for defining minimum viable scope

Cache hierarchy design with TTL policies, invalidation flows, and warming strategies

Architecture Decision Record creation with options analysis and review triggers

Chunking strategies, embedding pipelines, vector DB selection, and retrieval optimization

Bottleneck identification with profiling baselines and prioritized optimization roadmap

Use when mapping isolation boundaries, enumerating crossing points, verifying enforcement mechanisms, and testing for bypass paths across trust domains. Covers containers, VMs, enclaves, namespaces, seccomp, and network segmentation. Do not use for kernel configuration audit (use kernel-hardening) or HW/SW security interface review (use hw-sw-boundary).

Use when auditing kernel security configuration for memory protection, syscall surface reduction, control flow integrity, and integrity mechanisms against local and remote attack vectors. Covers CIS/KSPP benchmarks, KASLR, SMAP/SMEP, seccomp, and secure boot chain. Do not use for isolation boundary analysis (use isolation-review) or HW/SW interface review (use hw-sw-boundary).

Use when a user reports CSS, layout, or styling issues in a Next.js application — "element overlapping," "spacing is wrong," "responsive layout broken," "dark mode not working," "Tailwind classes not applying," or "alignment off." Diagnoses through a 6-phase pipeline that mirrors browser evaluation order, covering token resolution, cascade conflicts, layout models, stacking contexts, and viewport responsiveness. Handles Tailwind, CSS Modules, styled-components, and vanilla CSS. Not for JavaScript logic bugs, data fetching issues, or server-side rendering errors — route those to ui-bug-investigator.

Use when a user reports a non-CSS UI bug in a Next.js App Router application — "blank page," "data not loading," "click does nothing," "hydration mismatch," "flicker on navigation," or "state not updating." Runs symptom-targeted diagnostic checks against a component map to identify rendering, state, event handling, and data flow issues. Not for CSS layout, styling, or visual design problems — route those to css-layout-debugger.

Map complete user journeys with entry points, states, emotions, and decision points

Use when analyzing cryptographic protocol security by modeling state machines, enumerating transitions, and identifying desynchronization, replay, downgrade, and session binding vulnerabilities. Covers protocol handshakes, session management, and negotiation integrity. Do not use for implementation-level crypto review (use crypto-review) or post-quantum assessment (use pqc-readiness).

Use when analyzing microarchitectural attack surfaces by mapping shared hardware structures, identifying speculative execution vectors, quantifying speculative windows, and proposing countermeasures. Covers cache timing, transient execution, and contention channels. Do not use for RTL-level design review (use rtl-security-review) or physical implementation analysis (use physical-design-security).

Deployment strategy with rollback procedures, feature flags, and zero-downtime releases

Structured library scoring with popularity, maintenance health, bundle impact, and API quality

Wireless protocol selection, stack design, and interoperability

Design data pipelines — ETL vs ELT, orchestration, batch vs streaming, idempotency, data quality, lineage

Use when reviewing RTL designs for security vulnerabilities including access control gate bypasses, insecure FSM transitions, timing-dependent information leakage, and unintended data paths. Covers Verilog, SystemVerilog, and VHDL modules with security-critical functions. Do not use for physical implementation review (use physical-design-security) or microarchitectural attack analysis (use microarch-analysis).

Onboarding funnels, referral systems, and A/B test infrastructure

System prompt design, chain-of-thought patterns, structured output, and prompt versioning

Platform guideline compliance audit across iOS, Android, and web

Use when enumerating security claims from a design, formalizing them as invariants, checking for hidden assumptions, and assessing verification feasibility. Covers safety invariants, temporal properties, and verification tool recommendations. Do not use for writing TLA+ specifications directly (use formal-spec) or implementation-level security review.

Device provisioning, OTA update strategy, and fleet-scale monitoring

Use when investigating any frontend issue before diagnosis or debugging — maps a Next.js route to its full component tree. Resolves "what components render on this page," "show me the component tree for /dashboard," or "trace imports for this route." Produces a ComponentMap artifact with server/client boundaries, props, hooks, data fetching, and styling metadata consumed by all downstream QA skills. Not for diagnosing bugs, fixing code, or generating tests — those are handled by specialist skills after mapping is complete.

Deep infrastructure analysis and context briefing for all council agents

Audit codebase patterns and conventions, evaluate proposed changes for consistency

Design comprehensive test strategies with test pyramid coverage and quality gates

GDPR/privacy compliance review for proposed features and data flows

Pricing tiers, subscription architecture, and paywall strategy