Evan-Daruwalla

@evan-daruwalla source repo

34 skills
0 followers
6 hours ago last updated

▌
Decision Log · evan-daruwalla bundle
Appends ONE dated decision line to append-only DECISIONS.md — reads the REAL clock, stamps the zone by UTC offset (UTC-6→CST, UTC-5→CDT), prints a paste-ready line for a record entry. The lightweight per-decision line, NOT the project record. Use when: "log this decision", "decision-log", "note that we decided X", "record the call we just made". Zero deps.

0
installs
▌
Etl Validate · evan-daruwalla bundle
Read-only source-vs-target assertion after a data transform or copy — prove every row moved. Compares CSV or SQLite endpoints (--src/--dst as csv:<path> | sqlite:<db>:<table>) on row count + an order-independent XOR content checksum; --key <col> names the first 10 missing keys. SQLite opens mode=ro. Use when: "validate the copy", "did every row move", "verify the ETL", "reconcile the table after a rebuild". Python stdlib only.

0
installs
▌
Opus Workers · evan-daruwalla
When spawning subagents or workflows for non-trivial work and a tier strictly cheaper than the session model fits: run doer agents on that cheaper tier (Opus medium/high for substantive generation, Sonnet low/medium for mechanical bulk) after pre-registering a review rubric, then review each output AS the session model — accept or send back with pointers. Skip for trivial one-shots, for GATED actions (commit/push/public changes stay with the orchestrator), and when no cheaper tier fits.

0
installs
▌
Seed Control · evan-daruwalla bundle
Read-only static scan for UNSEEDED randomness: Python random.*/np.random.* with no seed call in the file, every JS/TS Math.random() (no seed API exists). Reports file:line:snippet, exit 1 on findings; suppress a known-fine line with # seed-ok / // seed-ok. Use when: "reproducibility check", "did I forget to seed", "seed-control", before pinning a frozen or regression run. Zero deps, writes nothing.

0
installs
▌
Bisect Driver · evan-daruwalla bundle
Automates git bisect to find the commit that introduced a behavior change: give a known-good ref, a bad ref (default HEAD), and a repro command; drives `git bisect run`, parses the first-bad commit, ALWAYS resets bisect state. Refuses up front on a dirty tree or in-progress bisect. Use when: "bisect this", "which commit broke X", "when did this test start failing", "regression blame". Zero deps.

0
installs
▌
Landing Check · evan-daruwalla bundle
Post-work verification sweep run by a FRESH agent: did the change land where it actually executes (and does a new guard actually FIRE), do the stated claims match disk, what should have moved and didn't, and did anything land where it must NOT (a private identifier in a public copy). Reads claims from ARTIFACTS (diff, record entry, report), never from the session's recollection. Use when: "landing-check", "did that land", "sweep the changes", "verify what I just did", "check my work", before committing a multi-file or multi-tree change. Invoked only — never auto-fires. Ships landing-probe.js (hooksPath / twin / registration / remote census, zero deps) for the mechanical half. Defers code correctness to /code-review and whole-project sweeps to /audit.

0
installs
▌
Token Squeeze · evan-daruwalla bundle
Deterministic no-LLM compressor for text that will be REUSED — saved prompts, system prompts, skill bodies, repeatedly-pasted docs. Meaning-leaning, protects code/URLs/paths/quotes/numbers/negations. NOT for live chat turns: those tokens are already spent; this pays only when the compressed text replaces the original in future contexts. Use when: "compress this prompt/doc for reuse", "shrink this system prompt", "token-squeeze". Bundled Node CLI, no API key.

0
installs
▌
Experiment Log · evan-daruwalla bundle
Reproducibility provenance for a single run: executes a command and appends ONE JSON line — ISO timestamp, cwd, cmd, exit, duration, git {commit, dirty}, node/python versions, sha256 of declared inputs (hashed before) and outputs (after), note. Append-only JSONL; never touches HANDOFF.md or the record (project-memory owns the narrative). Use when: "log this run", "record provenance", "experiment log", "make this run reproducible", "what produced this output". Also ships a SubagentStop hook that logs every subagent run (cost, tools, duration) to agent-runs.jsonl automatically. Zero deps.

0
installs
▌
Reorg Proposal · evan-daruwalla
Produce a NON-DESTRUCTIVE, read-only proposal for restructuring a codebase's file/directory layout — current tree, proposed tree, and a per-move risk table — WITHOUT moving, renaming, or editing any file. Use ONLY when the user explicitly asks to propose/plan/design a reorganization or directory structure. Do NOT use for generic organize/clean-up/tidy/refactor requests, for performing moves, or for code-level refactors.

0
installs
▌
Research Brief · evan-daruwalla
Deep research on a technical or market topic producing a structured, sourced brief saved to the project's docs. Depth means verifiability, not length — citations re-fetched, negatives cross-checked, blind spots hunted by a fresh agent. Use when the user says "research X", "deep dive into X", "do research into X and propose candidates", or asks for analysis of an architecture, paper, strategy, or market event. Not for quick factual questions.

0
installs
▌
Milestone Track · evan-daruwalla bundle
READ-ONLY roadmap rollup for PRD_ROADMAP.md conventions: parses "- [ ]" checkboxes, ☐/☑ table glyphs, ~~struck~~ items (dropped, NEVER open), milestone headings; per-milestone done/open/struck, overall %, first open item as "next:". Fork-aware — a CURRENT DIRECTION section scopes by default, --all covers the whole file. Use when: "milestone status", "roadmap rollup", "how much of the PRD is done", "what's next on the roadmap". Never edits the PRD. Zero deps.

0
installs
▌
Cron Task Manage · evan-daruwalla bundle
Windows scheduled-task auditor — READ-ONLY, only ever runs `schtasks /query`. Flags Last Result != 0, Disabled, and enabled tasks whose Next Run Time is N/A or already past. plan mode PRINTS the `schtasks /create` line and NEVER runs create/delete/change. --fixture parses a saved capture offline. Use when: "audit my scheduled tasks", "did the scheduled task run", "why did the rebalance task fail", "is that task disabled", "cron-task-manage". Zero deps.

0
installs
▌
LLM Eval Harness · evan-daruwalla bundle
Measures how far a cheaper model falls from the Fable-5 quality bar on real task types — deterministic CHECKS (format, discipline, no-fabrication, surgical scope) plus line-similarity to captured Fable goldens; appends every run to a ratchet so the gap is trackable over time. No API key, no LLM-judge. Use when: "eval the model", "measure the Fable gap", "run the eval harness", "score this output", or deciding whether a cheaper model is good enough to switch to.

0
installs
▌
Path Quirk Audit · evan-daruwalla bundle
Read-only tree scan for Windows corruption traps: any non-ASCII byte in .bat/.cmd (one byte corrupts the whole parse — reports the offset), CRLF in .sh, BOM/invalid UTF-8 in .json, root files shadowing cmd builtins or purely numeric names, NTFS case collisions. Use when: "path-quirk-audit", "scan for windows file quirks", "check for bat/encoding landmines", before shipping a Windows-run repo. Symptom-side runbook = winfix. Zero deps.

0
installs
▌
Determinism Guard · evan-daruwalla bundle
Ephemeral invariance checker — run a command N times and prove byte-identical stdout, stderr AND exit code (first-divergence diff on failure); --files sha256s listed artifacts per run; --shuffle-stdin catches order-dependence. No stored baselines — freezing an output across time is golden-lock. Use when: "is this deterministic", "same output every run", "reproducible build check", "is my output order-dependent", before freezing or scheduling. Zero deps.

0
installs
▌
History Leak Scan · evan-daruwalla bundle
Deterministic secret scanner for git repos — full history (--history) or staged diff (--staged): 15 provider-key rules, private-key blocks, JWTs, sensitive filenames (.env, .pem, id_rsa, *_keys.env), high-entropy + weak-password heuristics. Backs commit-gate in staged mode. Use when: "scan for secrets", "leak scan", "did I commit a secret", after any repo goes public or any suspected exposure. Reads .claude/secrets-inventory.md. No deps, no API key.

0
installs
▌
Shell Portability · evan-daruwalla bundle
Read-only syntax scanner for cross-shell traps, reporting file:line + why + the PS-5.1-safe fix: && and || (PS 5.1 parser error), ternary / ?. / ?? (PS7-only), Read-Host/pause/Out-GridView (block non-interactive runs), Set-Content/Add-Content/Out-File without -Encoding, bash-isms in .ps1 and PowerShell-isms in .sh. Use when: "will this run on PowerShell 5.1", "lint my shell scripts", "shell-portability", before scheduling a script — and `check "<command>"` for ONE command string before handing it to someone to run, the surface a file scan cannot reach. Syntax only — encoding/filename quirks are path-quirk-audit. Zero deps.

0
installs
▌
Coding Conventions · evan-daruwalla bundle
The coding rules that drift without a trigger: surgical changes, root cause over symptom, simplicity-first rungs with marked shortcuts, verify before claiming done with one runnable check. hooks/postwrite-check.js injects this body after every Edit/Write of a CODE file (docs/config excluded, debounced so a burst nudges once) so the rules land where code is being written. Also "check this", "verify that code", "did that actually run". Not an audit (/audit), not a bug hunt (/code-review).

0
installs
▌
Github Repo Polish · evan-daruwalla
Makes an EXISTING repo professional: PRESENTATION (name, description, topics, README structure, semver tags/releases) plus git BRANCH WORKFLOW (GitHub Flow: feature branch → PR → merge → delete), grounded gh/git commands, propose-then-confirm on every public change. Use when explicitly asked to professionalize a repo's presentation or for branching/PR/GitHub-Flow guidance. NOT for writing code, routine "commit/push this", new-repo scaffolding, or CI/Actions.

0
installs
▌
Flaky Test Detector · evan-daruwalla bundle
Runs a test command N times and classifies: STABLE-PASS, STABLE-FAIL (identical failure every run = a bug, not flake, labeled as such), or FLAKY (exit codes varied — the finding). Per-run exit+duration table, pass/fail rates, --keep-logs saves numbered outputs for diffing. Use when: "is this test flaky", "does it pass reliably", "run it N times", "why does this fail intermittently". Deterministic harness, zero deps.

0
installs
▌
Data Integrity Audit · evan-daruwalla bundle
Read-only SQLite integrity audit — opens mode=ro, never writes. Three checks: PRAGMA integrity_check, PRAGMA foreign_key_check, and explicit orphan detection counting child rows whose FK value has no parent (catches inserts made with enforcement OFF). Per-check PASS/FAIL with counts + first 5 rowids; exit 1 on any failure. Use when: "audit the database", "check DB integrity", "find orphaned rows", "is the SQLite file corrupt". Zero deps.

0
installs
▌
Local Secrets Manage · evan-daruwalla bundle
Read-only hygiene audit of secret-bearing FILES by NAME (.env*, *.pem, *.key, id_rsa*, *_keys.env, credentials*.json, secrets.*): per-file verdict TRACKED-SECRET (already in the index — worst) / UNIGNORED (one `git add` from leaking) / OK. --fix-print proposes .gitignore lines, NEVER applies them. Names only — content/history scanning is history-leak-scan. Use when: "is my .env ignored", "audit secret files", "local-secrets", before a repo goes public. Zero deps.

0
installs
▌
Audit · evan-daruwalla bundle
Exhaustive project audit across BOTH domains — every code file and every doc, run COLD by a fresh auditor with no inherited session belief, fanned out to parallel workers under a file manifest that proves coverage. Runs the code method sweep, the docs method sweep, AND the cross-domain pass neither can do alone (doc claims tested against disk, code behaviour tested against stated intent). Severity-ranked findings with verification tiers, load-bearing negatives, and architecture findings ranked above the patch list. Use when: "audit", "full audit", "audit everything", "find issues / security fixes / edge cases", "what could break". Findings only by default; fixes after approval.

0
installs
▌
Cve Audit · evan-daruwalla bundle
Dependency-vulnerability audit: runs `npm audit --json` and `pip-audit --format json`, renders a severity table (critical/high/moderate/low) with package names, fails the build at a configurable level (default high). --fixture parses a saved npm-audit JSON offline. If pip-audit is not installed it says so — never fakes Python results. Use when: "audit dependencies", "cve audit", "are my deps vulnerable", "npm audit", "scan for CVEs". Zero deps.

0
installs
▌
Long Task · evan-daruwalla bundle
Execution loop for work longer than one sitting or more than ~7 steps: a numbered plan where every step ends in a check, riskiest step first, a one-line state tracker at the top of each turn, an iteration budget, and a progress lock — the same command failing the same way twice means change approach or stop and report NO-PROGRESS (hooks/no-progress.js fires this deterministically on PostToolUseFailure). Invoke: "long-task", "plan this out", "this is a big one", multi-hour or multi-session work. Small work → small-task. Cheaper-tier delegation → opus-workers. Launch risks → pre-mortem.

0
installs
▌
Skill Vet · evan-daruwalla
Evaluate an external Claude Code skill, plugin, or MCP server (usually a GitHub URL) before installing it. Use when the user says "look at this skill", "evaluate whether these skills would be useful", "install this skill", or pastes a repo/marketplace link. Produces a verdict (install / skip / install-modified) with reasoning, then installs cleanly on approval.

0
installs
▌
Venue Fit · evan-daruwalla
Scores a draft against ONE venue's real published reviewer criteria — per-criterion verdict with evidence quoted from the draft, plus the concrete gap for anything short. REFUSES to emit an acceptance probability. Learns only from real post-submission reviewer feedback, stored as data. Must be invoked — never fires on its own: "venue-fit", "would this get into <venue>", "review this against <venue>", "am I ready to submit".

0
installs
▌
Audit Code · evan-daruwalla
Exhaustive CODE audit, run COLD by a fresh auditor and fanned out to parallel workers under a file manifest that proves coverage. Fifteen methods (invariant tracing, call-site contracts, error paths, static tooling, relative-churn targeting, dynamic verification, spec conformance, data-at-rest, deps and supply chain, test-suite validation via mutation score, fuzzing and property-based exploration, adversary-first threat modelling, concurrency, architecture and dependency structure, compliance surface) plus a four-generator edge-case sweep. Defaults to the whole project; pass "recent" to scope to work since a base ref, plus the blast radius of unchanged callers. Use when: "audit the code", "code audit", "audit my changes", "find bugs / security fixes / edge cases". Findings only; fixes after approval.

0
installs
▌
Audit Docs · evan-daruwalla
Exhaustive DOCUMENTATION audit, run COLD and tested against disk — not a content inventory and not a style pass. Eight methods (claim verification, code-element reference drift, doc-vs-code semantic conformance, completeness against the real public surface, internal contradiction and copy divergence, executable content, structure, provenance and currency). Hunts WRONG before MISSING before UGLY, the measured practitioner priority. Defaults to the whole project; pass "recent" to scope to changed docs AND the docs that recent code changes should have updated but did not. Use when: "audit the docs", "docs audit", "are the docs true", "did I update the docs", "is the status doc still accurate". Findings only; fixes after approval.

0
installs
▌
Compact Io · evan-daruwalla bundle
Always-active output style: lead with the answer, length by question type, cut filler, keep every number/name/path. Also handles "compress this", "make this denser", "plainer words", "explain that more simply", "give me more context". Also the candor baseline (verdict first, no yes-man) and FULL-CRITIQUE mode on "be honest", "poke holes", "challenge me", "what am I missing", "critique this" — structure in references/critique.md. Yields to task/project instructions on format, never on honesty. Compressing a prompt or doc FOR REUSE is token-squeeze's job.

0
installs
▌
Small Task · evan-daruwalla bundle
Always-on framing for any task that fits one sitting: say what DONE proves, name blockers before starting, list micro-steps each ending in a check, do the riskiest step first, lock scope to this task. hooks/prompt-frame.js injects this body on every prompt so it sits at the point of writing, not at the top of a 100k-token context. Work longer than one sitting or more than ~7 steps → long-task.

0
installs
▌
Commit Gate · evan-daruwalla bundle
Blocks commits that stage a secret — TWO deterministic hooks (native git pre-commit covers shell commits; PreToolUse covers commits the model makes via Bash) over the shared pm-secretscan scanner; also helps split large changes into clean atomic commits. Use when: "commit-gate", "guard my commits", "block secret commits", "set up the pre-commit hook". Reads .claude/secrets-inventory.md.

0
installs
▌
Fetch First · evan-daruwalla
Routing rule for reaching the live internet: pick the cheapest surface that can actually answer, and escalate only on a named failure. Library/framework docs → a docs MCP (e.g. context7). Everything else → WebSearch/WebFetch first. A browser-automation tool only when the page needs JS, interaction, visual proof, or VERBATIM text (a fetch tool that answers through a summarizing sub-model cannot return exact quotes). A real logged-in browser only when the task needs an account already signed in. Use whenever you are about to search the web, look something up online, fetch a page or URL, check current docs or an API, read an article, research a product or market, or "find out what's the latest on X" — and whenever a browser tool is about to be opened for a read-only lookup.

0
installs
▌
Golden Lock · evan-daruwalla bundle
Freeze ANY output as a byte-exact golden baseline — command stdout, fixture file, or prompt/text asset — under .golden/; "check" re-produces it and fails with a line-numbered diff on drift, comparing bytes AND exit code. Use when: "freeze this output", "golden test", "lock the baseline", "did the output change", "prompt regression", "guard against output drift". Zero deps.

0
installs

34 published skills