Claude Skills

A library of Claude Code Agent Skills — named, self-contained procedures that Claude Code loads on demand. Each is a markdown file with YAML frontmatter, written in one house style: decision tables, failure→cause→fix mappings, and explicit guardrails on what to do and, just as importantly, what not to do.

Two collections live here:

• Engineering skills (skills/backend, skills/frontend, skills/devops) — reusable, project-agnostic playbooks for everyday software work: scaffolding a service, migrating a schema, building an accessible component, deciding where state lives, hardening a pipeline or a container.
• Agentic-eval skills (the task directories) — the set used to build, red-team and tune agentic RL evaluation environments (containerized SRE/DevOps scenarios an AI agent is scored on).

This repo is about how the skills are engineered, not any one project's internals.

Engineering skills

Project-agnostic playbooks. Each is a skills/<domain>/<name>/SKILL.md with a Definition of done section, so "done" is a checklist, not a vibe.

Start with the two foundational skills — building-backends and building-frontends — which set the rules and defaults for all backend/frontend work and point to the specific playbooks below.

Domain	Skill	What it does
backend	building-backends	Foundational. The rules and defaults for every service — architecture, API design, data layer, security, concurrency, testing — before reaching for a specific playbook.
backend	api-service-scaffold	Scaffold a layered HTTP service with one error model, edge validation, config injection, and a health/readiness surface.
backend	db-migration-guardian	Zero-downtime relational migrations via expand→migrate→contract, lock-aware DDL, tested rollbacks.
backend	backend-observability	Structured logs + RED/USE metrics + tracing on one correlation id, with cardinality and PII guardrails.
frontend	building-frontends	Foundational. The rules and defaults for every UI — component architecture, state placement, data fetching, forms, accessibility, performance, testing — before reaching for a specific playbook.
frontend	react-component-builder	Accessible, controllable, correctly-typed components — all states, forwarded refs, a11y checklist.
frontend	frontend-state-architecture	A decision tree for where each piece of state lives: server cache vs URL vs form vs client.
frontend	web-performance-audit	Fix Core Web Vitals (LCP/INP/CLS) by measurement, not vibes; bundle budgets; no premature memoization.
devops	cicd-pipeline-hardening	Fast, reproducible, supply-chain-hardened pipelines: pinned actions, least-privilege tokens, OIDC, provenance.
devops	iac-terraform-guardian	Safe IaC: locked remote state, read-the-plan discipline, destroy/replace guardrails, module boundaries.
devops	container-image-hardening	Small, non-root, pinned, cache-friendly images; no secrets in layers or history.
devops	secrets-management	Keep secrets out of code/logs/images/state; injection hierarchy; leak response; rotation.

Agentic-eval skills

Rather than one giant prompt, each environment gets four narrow skills plus a shared reviewer. They call each other, so the agent loads only the context the current phase needs.

Skill	Responsibility
*-task-guardian	End-to-end owner. Pre-push safety checks, local quality/anatomy gates, push, validation handoff, rollout monitoring. Delegates down when something breaks.
*-validation-debugger	Diagnosis only. Maps observed validation-log patterns to root cause and the smallest safe fix. Invoked before any edit, so failures aren't fixed by guessing.
*-score-tuner	Difficulty tuning. Diagnoses score regressions — dead-weight subscores, collapsed variance, correlated axes — and picks one minimal lever per symptom.
*-iteration-loop	Orchestrator. Drives push → validate → red-team → measure → tune until the environment converges, delegating to the three above at the right phase.
horizon-agentic-reviewer	Adversarial red-team. Spins up a live container, probes as the agent user, and runs a 24-point checklist (20 live probes + 4 statistical) hunting undisclosed requirements, information leaks, dead-weight scoring and broken evidence trails.

Three ideas do most of the work:

• Diagnose before editing. The debugger skill is a hard gate in front of the tuner. Every known failure string has a documented root cause and a bounded fix, so the loop converges instead of oscillating.
• Smallest safe lever. Tuning skills forbid stacking new mechanics; each symptom maps to one change, with an explicit list of edits that are not allowed because they'd collapse measurement.
• Adversarial self-review. The reviewer skill assumes the setup logs are lying and verifies against the live system — hit the real API, exec into the real container, don't trust the claim.

Layout

skills/
  backend/                               # building-backends (foundational), api-service-scaffold, db-migration-guardian, backend-observability
  frontend/                              # building-frontends (foundational), react-component-builder, frontend-state-architecture, web-performance-audit
  devops/                                # cicd-pipeline-hardening, iac-terraform-guardian, container-image-hardening, secrets-management
  fanout-cve-rollout/                    # reward-shaped: 5 independent subscores, dense partial-credit gradient
  maddy-delivery-split-brain/            # mail-delivery split-brain; delivery vs observability axes
  oncall-schedule-coverage-collapse/     # on-call rota collapse; coverage vs monitoring axes
  variation-fanout-pipeline-break/       # mTLS pipeline break; handshake vs trust-governance axes
  variation-istio-split-brain/           # service-mesh split-brain; routing vs mesh-governance axes
  _archived-fanout-ring-restoration/     # an earlier, pre-`SKILL.md` generation, kept for contrast
QC-SPEC.md                               # the priority-ordered quality rubric every skill is written against

Each skill lives in its own directory as SKILL.md with name and description frontmatter — the standard Claude Code format. The archived set predates that layout and is stored as flat files.

Using them

Skills are picked up from a workspace's .claude/skills/ directory:

mkdir -p /path/to/project/.claude/skills
cp -R skills/variation-istio-split-brain/. /path/to/project/.claude/skills/

Claude Code then surfaces them by name (/istio-task-guardian), or the iteration loop drives the whole cycle itself.

Quality rubric

QC-SPEC.md is the priority-ordered spec (Critical → Error → Legitimacy) that all of these are designed against. The Critical and Error items are treated as hard constraints — no binary scoring, incremental rewards, functional tests as subscores, real subscore variance, equal weights, no dead weights. Most of what the tuner skills do is defending those properties while difficulty changes underneath them.

A note on redaction

These skills were written for live evaluation environments. Task identifiers, target score thresholds, internal model codenames, hidden grader check names and the specific hidden artefacts an agent must discover have been replaced with placeholders (<TASK_ID>, <TARGET_MEAN>, <eval-model>, <grader-check-fn>, <metadata-key>, <artefact>). The engineering — structure, reasoning, decision tables, guardrails — is intact and unedited.