Code Review & Quality for Claude Code

Performs full specification-to-code compliance analysis for blockchain audits. Use when verifying that smart contract implementations correctly match their formal specifications or whitepapers.

Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.

Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.

Performs security-focused differential review of code changes

Creates Semgrep rules with test-first methodology

Verifies code implements specification requirements

Reviews workflow-based Claude Code skills for structural quality, pattern adherence, tool assignment correctness, and anti-pattern detection. Use when auditing an existing skill or validating a newly created skill before submission.

Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.

Blind Comparator Agent

Evaluate expectations against an execution transcript and outputs.

Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, modifying, or reviewing code — implementation tasks, code changes, refactoring, bug fixes, or feature development. Do NOT use for architecture design, documentation, or non-code tasks.

Finds duplicate business logic spread across multiple components and suggests consolidation. Use when asking "where is this logic duplicated?", "find common code between services", "what can be consolidated?", "detect shared domain logic", or analyzing component overlap before refactoring. Do NOT use for code-level duplication detection (use linters) or dependency analysis (use coupling-analysis).

Detects misplaced classes and fixes component hierarchy problems — finds code that should belong inside a component but sits at the root level. Use when asking "clean up component structure", "find orphaned classes", "fix module hierarchy", "flatten nested components", or analyzing why namespaces have misplaced code. Do NOT use for dependency analysis (use coupling-analysis) or domain grouping (use domain-identification-grouping).

Scores how completely an implementation fulfills a PRD/spec, case by case, and produces a single comparable final grade. Invoke only when explicitly named (e.g. run spec-driven-eval); do not auto-trigger. Use when benchmarking spec-driven implementations, grading acceptance criteria, evaluating whether a feature was 100% implemented, comparing multiple implementations of the same PRD, or auditing implementation and test coverage (unit and e2e) against product requirements. Do NOT use for plannin

Detects anemic domain models, validates and refactors them into rich domain models, and enforces tactical DDD patterns (Entities, Value Objects, Aggregates, Domain Services, Domain Events). Use when the user asks to validate, review, or check domain models or DDD code; detect anemia; refactor domain objects; improve encapsulation; or mentions terms like "anemic model", "rich domain", "aggregate", "value object", "domain event", "ubiquitous language", "is this good DDD", "does this follow DDD", o

Blind Comparator Agent

Blind Comparator Agent

Blind Comparator Agent

Evaluate expectations against an execution transcript and outputs.

Evaluate expectations against an execution transcript and outputs.

Evaluate expectations against an execution transcript and outputs.

Caching strategies — invalidation, TTL guidelines, cache keys, cache layers, and when not to cache. Use when implementing or reviewing caching logic.

Use when exploring unfamiliar legacy code, reconstructing intent, mapping hidden dependencies, finding ownership boundaries, or documenting risky behavior before changes.

Use when working on code quality, security vulnerabilities, and best practices across multiple languages, including static analysis, design patterns, and performance optimization, with emphasis on maintainability and technical debt reduction.

Analyze codebases and automatically generate architecture diagrams, flowcharts, and org charts. Uses AST parsing to map import dependencies for Python, JS/TS, Go, and Java, outputting Mermaid or SVG files. Triggered when users ask to visualize code architecture, understand dependencies, draw a flowchart, or create a module diagram from source code.

Explore a codebase to find opportunities for architectural improvement, focusing on making the codebase more testable by deepening shallow modules. Use when user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more AI-navigable.

Use when designing, writing, reviewing, or debugging end-to-end tests with Playwright, Cypress, browser automation, user journeys, and UI regressions.

Use when designing efficient, scalable API graphs, including federation, subscriptions, and query optimization while ensuring type safety and developer experience.

Use when building, reviewing, or debugging Next.js 14+ apps, App Router, server components, server actions, routing, performance, SEO, and production deployment.

Use when building, reviewing, or debugging Node.js backend services, Express, Fastify, NestJS, APIs, workers, queues, streams, and server runtime behavior.

Use when working on modern PHP 8.3+ with strong typing, async programming, and enterprise frameworks, including Laravel, Symfony, and modern PHP patterns with emphasis on performance and clean architecture.

Use when working on modern Python 3.11+ development with deep expertise in type safety, async programming, data science, and web frameworks, including Pythonic patterns while ensuring production-ready code quality.

Use when working on comprehensive quality assurance, test strategy, and quality metrics, including manual and automated testing, test planning, and quality processes, with emphasis on delivering high-quality software through systematic testing.

React Three Fiber (R3F) and Poimandres ecosystem best practices. Use when writing, reviewing, or optimizing R3F code. Triggers on tasks involving @react-three/fiber, @react-three/drei, zustand, @react-three/postprocessing, @react-three/rapier, or leva.

Use when working on Rails 8.1 with modern conventions, including convention over configuration, Hotwire/Turbo, Action Cable, and rapid application development, with emphasis on building elegant, maintainable web applications.

Use when working on safe code transformation techniques and design pattern application, including improving code structure, reducing complexity, and enhancing maintainability while preserving behavior, with emphasis on systematic, test-driven refactoring.

Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets. Triggered when users ask about Git analysis, code hotspots, who owns what code, secret scanning, security audits of commit history, or optimizing code review assignments.

Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and ready-to-use remediation guidance. Trigger this skill when users ask for a security review, vulnerability scan, or penetration testing assistance, or mention keywords like OWASP, SQL injection, XSS, code audit, or security checklist.

Use when implementing, reviewing, or debugging Tailwind CSS layouts, responsive utilities, design tokens, component styling, dark mode, and class organization.

Use when designing test strategy, coverage plans, test pyramids, fixtures, CI gates, quality metrics, or refactoring brittle test suites.