A curated collection of reusable slash command skills for Claude Code, Anthropic's CLI for Claude. These skills encode production-tested patterns for building secure microservices, running security audits, and generating TTS audio.
Author: Charlton D. Ho (@lantisprime)
Skills are markdown files that act as reusable prompts for Claude Code. When you type a slash command like /express-microservice, Claude Code reads the corresponding .md file and follows its instructions — giving you consistent, repeatable workflows.
| Skill | Command | Description |
|---|---|---|
| Express Microservice | /express-microservice |
Scaffold a production-ready Express + SQLite microservice |
| OWASP Audit | /owasp-audit |
Run a comprehensive OWASP Top 10 security audit |
| Harden Express | /harden-express |
Apply security best practices to an existing Express app |
| Generate TTS | /generate-tts |
Batch-generate text-to-speech audio using Edge TTS |
| Optimize Memory Docs | /optimize-memory-docs |
Compact CLAUDE.md and memory index files without losing information |
| Optimize CLAUDE.mds | /optimize-claude-mds |
Audit CLAUDE.md and rule files for conflicts, duplicates, and token waste |
| Herdr Driver | /herdr-driver |
Preferred driver: terminals and CLI agents via a private, throwaway Herdr session |
| tmux Driver | /tmux-driver |
Fallback driver: steer CLI agent seats over private per-run tmux sockets |
Copy the skill files to your Claude Code commands directory:
mkdir -p ~/.claude/commands
cp *.md ~/.claude/commands/Copy the skill files to your project's .claude/commands directory:
mkdir -p .claude/commands
cp *.md .claude/commands/Open Claude Code and type / — you should see the skills listed as available commands.
Scaffolds a complete microservice with Express, SQLite, authentication middleware, and security hardening.
/express-microservice payment-service 3005 handles subscriptions and billing
What it creates:
payment-service/
├── package.json # ES modules, Express, better-sqlite3, cors, helmet
├── server.js # Hardened entry point with auth on all routes
├── db/
│ ├── database.js # SQLite schema with WAL mode + foreign keys
│ └── seed.js # Seed data script
├── routes/
│ └── payments.js # CRUD endpoints with auth guards
└── middleware/
└── auth.js # requireAuth + requireAdmin with caching
Security included out of the box:
helmetsecurity headers- CORS restricted to explicit origin (no wildcard)
- JSON body size limit (100kb)
- All routes authenticated via
x-user-idheader - Write routes require admin role
- Parameterized SQL queries only
- Auth result caching (1min TTL)
Runs a thorough security audit checking all OWASP Top 10 vulnerability categories.
/owasp-audit
What it checks:
- Credential exposure — searches code and git history for leaked API keys, passwords, tokens
- A01 Broken Access Control — verifies every route has auth middleware
- A02 Cryptographic Failures — checks for plaintext passwords, exposed PII
- A03 Injection — validates parameterized SQL, checks for command injection, path traversal, XSS
- A04 Insecure Design — checks rate limiting, input validation, recursion limits
- A05 Security Misconfiguration — CORS, helmet, error messages, source maps
- A06 Vulnerable Components — runs
npm audit - A07 Auth Failures — checks for bypassable auth
- A08 Data Integrity — body size limits, prototype pollution
- A09 Logging — request logging, auth event logging
- A10 SSRF — user-controlled URLs in server-side fetch calls
Output format:
| Severity | OWASP | File:Line | Issue | Fix |
|---|---|---|---|---|
| CRITICAL | A01 | routes/users.js:7 | No auth on user list endpoint | Add requireAuth middleware |
Automatically fixes CRITICAL and HIGH issues. Asks before fixing MEDIUM/LOW.
Takes an existing Express application and applies security best practices.
/harden-express
What it does:
- Installs
helmetandcorsif not present - Applies middleware in correct order: helmet → cors (explicit origin) → json (size limit)
- Adds auth middleware to all unprotected routes
- Secures error handling (no stack trace leaks)
- Adds path traversal protection on file-serving routes
- Disables source maps in production
- Verifies
.gitignorecovers sensitive files - Scans git history for credential leaks
Batch-generates text-to-speech audio files using Edge TTS — completely free, no API key needed, no rate limits.
/generate-tts src/data/phrases.json public/audio ja-JP-NanamiNeural
What it does:
- Installs
edge-ttsPython package if needed - Creates a Node.js generation script that:
- Collects all text strings from the specified source
- Generates MP3 files named by MD5 hash (deduplication)
- Skips already-generated files (incremental builds)
- Writes a
manifest.jsonmapping text to filenames
- Runs the script and reports results
Available voices:
| Language | Voice | Gender | Style |
|---|---|---|---|
| Japanese | ja-JP-NanamiNeural |
Female | Natural, clear |
| Japanese | ja-JP-KeitaNeural |
Male | Calm |
| Japanese | ja-JP-DaichiNeural |
Male | Deep |
| English | en-US-JennyNeural |
Female | Friendly |
| English | en-GB-SoniaNeural |
Female | British |
| Chinese | zh-CN-XiaoxiaoNeural |
Female | Natural |
| Korean | ko-KR-SunHiNeural |
Female | Natural |
| Spanish | es-ES-ElviraNeural |
Female | Natural |
List all voices: edge-tts --list-voices
Key notes:
- Free with no rate limits or API keys
- ~10-15KB per short phrase
- Rate parameter must use
=format:--rate=-10% - Prerequisites: Python 3 +
pip3 install edge-tts
Compacts a project's CLAUDE.md and any always-loaded memory/context index file so they stay small without losing information — detail moves to on-demand reference files, the index keeps one-line pointers.
/optimize-memory-docs
What it does:
- Measures each file against its size limit
- Classifies status/workplan entries as current vs historical
- Moves historical detail to a dated reference file (move, never delete)
- Collapses the status section and enforces one-line index entries
- Preserves load-bearing trigger tables and always-on rules
- Re-measures and verifies every pointer resolves
Pairs with /optimize-claude-mds: resolve rule conflicts there first, then compact here.
Audits instruction docs — global/project CLAUDE.md, memory indexes, accumulated feedback/correction rule files — for contradicting rules and token waste. Conflicts are resolved before anything is compressed.
/optimize-claude-mds
What it does:
- Inventories docs and weighs them by loading cost (always-loaded first)
- Detects five conflict classes: rule-vs-rule, rule-vs-mode (interactive rules that break autonomous runs), rule-vs-harness (restating built-ins), duplicates, stale references
- Reports each finding with quoted lines from both locations and which rule currently wins
- Token-optimizes only after conflicts are resolved — never compresses a contradiction
- Waits for approval on user-owned files; encodes conflict resolutions with scope carve-outs so both corrections survive
The preferred seat driver: drives interactive terminals and CLI coding agents (codex, pi, REPLs) through the Herdr socket API — always in a private, per-run Herdr session with its own socket, so nothing it starts or stops can touch your interactive workspace. Native agent-status waits make supervision event-driven (a blocked seat is the wake-up signal) instead of poll-based.
/herdr-driver
What it does:
- Creates a uniquely named headless Herdr session (private socket)
- Spawns seats with
herdr agent startand drives them viapane run/agent send/send-keys - Synchronizes on native agent status or new-output matches — never scrollback greps
- Runs an interactive supervision loop: scans for approval dialogs (auto-approves read-only operations only, surfaces everything else), answers unambiguous questions, and steers seats that drift or stall
- Stops and deletes the private session on the way out, even on failure
Born from a shared-driver-socket incident: on a shared socket, one session's start/server stop kills a sibling session's server and its live seats. Private per-run sockets make that impossible.
The fallback for Herdr Driver when herdr isn't available: drives CLI agent seats (pi, codex, REPLs) through control-file driver scripts over private per-run tmux sockets, with the same supervision doctrine — approval-dialog scanning (look first, approve in a separate command, read-only auto-approves only), steering, and mandatory teardown.
/tmux-driver
What it does:
- Claims a unique socket name + scratchpad control dir per run — after verifying via
tmux -L <name> lsthat no sibling session owns it - Drives seats through the control-file protocol (
start|ask|send|key|poll|wait|read|stop) - Synchronizes on driver poll/wait actions, never whole-pane scrollback greps
- Supervises interactively: reads dialogs before answering, auto-approves read-only operations only, steers drifting seats
- Kills only its own private socket and removes its control dir on the way out
These skills encode patterns learned from building production microservice applications:
- All routes authenticated by default — public endpoints are the exception
- Auth validated via
x-user-idheader against a user service - In-memory cache with TTL to avoid hitting user service on every request
- Write operations require admin role on top of basic auth
- SQLite with WAL mode for concurrent reads
- Foreign keys enforced (
PRAGMA foreign_keys = ON) - All schemas use
CREATE TABLE IF NOT EXISTS(idempotent) - Cascade deletes on foreign keys
- Transactions for multi-table writes
- Helmet for security headers
- CORS with explicit origin whitelist
- Body size limits on JSON parser
- Parameterized queries only (no string concatenation in SQL)
- Path traversal protection on file serving
- No secrets in git history
- Source maps disabled in production
Contributions welcome! If you have a useful Claude Code skill pattern, open a PR.
MIT
Created by Charlton D. Ho (@lantisprime)
Built with patterns from the NihongoQuest project.