Skill UI

This skill performs a comprehensive architecture audit on codebases by mapping module dependencies and checking layering integrity. It identifies structural decay using principles from classic engineering books. The tool generates Mermaid dependency graphs, assesses testability seams, and applies Conway's Law checks to ensure architectural health. It is suitable for developers needing to understand codebase structure, review folder organization, or detect circular imports before refactoring.

Orchestrates maintenance workflows for the brooks-lint plugin, running a sequential subagent pipeline (author, eval, QA, trigger-audit, release) to add or edit skills, refresh eval suites, keep manifests and docs in sync, and audit trigger boundaries. Ensures quality gates and consistency across the repository.

This skill performs a full-sweep analysis across all quality dimensions including code decay, architecture, tech debt, and test quality. It applies fixes directly to the codebase, auto-applying safe changes and confirming risky ones before execution. It iterates through reviews, tests, debt, and audits to converge on a clean state, generating a comprehensive Full Sweep Report.

This skill enables authorized reverse engineering of Chrome and Firefox browser extensions. It involves analyzing manifest files, background workers, and content scripts to investigate credential handling, data exposure, and malicious behavior. Suitable for security audits, supply chain poisoning investigations, and understanding extension logic through static and dynamic analysis using tools like DevTools and Frida.

An adversarial Quality Assurance (QA) pass designed to deep-dive into any codebase for logic errors, security flaws, and functional bugs. Instead of confirming that code 'looks right,' this skill actively attempts to break the code by simulating hostile inputs, tracing critical data paths, and checking for subtle, real-world correctness issues. Essential for high-stakes, critical code reviews.

A command-line utility to search and extract data from Burp Suite project files (.burp). It enables searching response headers or bodies with regex patterns, extracting security audit findings, and analyzing HTTP traffic. Requires Burp Suite Professional and a specific extension. Ideal for security auditing and traffic analysis without opening the GUI.

Audit and remediate CIS Benchmark violations with OpenSCAP, Lynis, InSpec, and kube-bench. Covers baseline scanning, risk prioritization, remediation, and compliance validation for explicitly authorized systems and clusters.

This comprehensive skill serves as an entry point for all web UI design needs, covering components, pages, dashboards, and advanced layouts using React, Vue, or pure HTML/CSS. It addresses not only aesthetics and polish (color, typography, spacing) but also deep structural concerns like responsive design, UX auditing, and visual system implementation. Use it whenever a user asks to improve the look, feel, or function of a digital interface.

Analyze a repository to detect its tech stack, build tools, and monorepo structure, then generate a reviewed read-only allow list for Claude Code settings.json permissions. Helps set up or audit project permission baselines safely.

This skill performs a defensive audit on deployed web applications to identify secrets exposed to the browser. It checks for hardcoded API keys, tokens in JavaScript or HTML, publicly accessible configuration files, and security header misconfigurations. It is designed for authorized assessments to prevent sensitive data leakage without exploiting or mutating the target system.

Audit authorized codebases for exploitable vulnerabilities using scoped reconnaissance, adversarial review, validation, and structured reporting. Use for security reviews, pen-testing, and vulnerability hunting in web apps, APIs, services, CLI tools, libraries, and daemons.

Perform authorized static analysis on source code to identify security vulnerabilities using tools like Semgrep and CodeQL. This workflow covers pattern hunting, dangerous API detection, and verification of vulnerability fixes. Essential for white-box audits and PR security reviews.