migration auditor
Catches dangerous database migrations before they hit production. Reviews schema changes for locking hazards, data loss, missing rollbacks, and index issues across PostgreSQL, MySQL, and SQLite.
Skills that help AI agents perform thorough code reviews, identify anti-patterns, suggest refactors, and enforce coding standards.
📖 Related guide: Best Code Review Skills for Claude Code →
136 skills
Catches dangerous database migrations before they hit production. Reviews schema changes for locking hazards, data loss, missing rollbacks, and index issues across PostgreSQL, MySQL, and SQLite.
Reviews your code for bugs, security vulnerabilities, logic errors, performance issues, and style violations. Organizes findings by severity and suggests fixes with code examples.
Enforce senior-level coding standards with a focus on verification, minimal diffs, and evidence-based bug fixing.
Messy, insecure, unfixable — that's what AI builds without architecture. This file is the architecture: 10 years of senior judgement on rendering, caching, security and SEO, so your agent builds it right from day one.
Expert Java code auditor for SE 8–24, flagging performance leaks, threading risks, and modernization gaps.
A multi-stage, evidence-grounded academic review agent modeled on the AAAI-26 AI Review Pilot research.
Automated, high-precision code reviews that detect bugs, security flaws, and performance bottlenecks in your PRs.
Deep audit toolkit for Next.js App Router to fix performance waterfalls, SEO errors, and client boundary leaks.
Audit your codebase for technical debt and generate a prioritized, actionable remediation report.
Creates safe modernization roadmaps for old, messy, undocumented, or fragile codebases, including risk audits, refactor phases, dependency reviews, testing plans, migration steps, and AI coding prompts.
Upgrade your AI agent with a senior-level engineering SOP focused on inspection, minimal diffs, and hard verification.
Three-pass automated code review that catches error handling gaps, structural issues, and naming problems — then auto-fixes everything before code reaches the user.
Supercharge repo exploration and refactoring with semantic call-graph tracing and structural AST pattern matching.
Idiomatic code translation between Python, TypeScript, and Go that preserves logic and adapts language-specific patterns.
Research comparable real projects before choosing, fixing, or shipping your project architecture.
Transform technical debt into a prioritized roadmap with professional-grade refactoring reports.
Backup hygiene audits: find stale exports, orphaned files, and shrink your storage footprint.
Professional-grade git diff auditor that identifies security vulnerabilities and code smells before you merge.
Transform your agent into a Senior Engineer that analyzes architecture and reuses code before writing a single line.
Preview code-like comment blocks across JavaScript, TypeScript, Python, Java, Go, Rust, HTML, and CSS. Preservation rules run before candidate detection; confirmed cleanups create .bak backups and remove only reviewed ranges.
Audit project manifests against source code to find unused, missing, and misplaced dependencies across major languages.
Reconstruct architecture and map risks in inherited legacy codebases with evidence-based auditing and migration plans.
Apply the 5-step engineering algorithm to ruthlessly delete, simplify, and accelerate any process or codebase.
Supercharge your agent with semantic code intelligence for safer refactors, precise navigation, and zero-error edits.
Expert guidance for native Kotlin Android development, architecture, Jetpack Compose, and Play Store readiness.
Elite technical due diligence and architecture hardening for scale, security, and enterprise readiness.
Catch typos, homophones, and near-miss misspellings across code, docs, and markdown, in a commit, your staged changes, a file, or a whole directory. Layers dictionary, phonetic (Soundex), and edit-distance checks with context-aware homonym rules to flag the their/there and its/it's a basic spellcheck sails right past.
Map any repo into an interactive D3 dependency graph plus a Markdown onboarding guide: entry points, module relationships, circular dependencies, and dead-code candidates, with refactor suggestions. Parses TypeScript, Python, Java, Go, and Rust imports, exports, and calls. Self-contained HTML, no source changes.
Audit codebases for structural debt, TODOs, and dependency rot to generate prioritized remediation reports.
A rigorous production-readiness auditor that identifies logic defects, security risks, and test gaps in code changes.
Apply Clean Code and Clean Architecture standards to automate refactoring, reviews, and dependency management.
Review Jamf and Kandji scripts for safer user context, prompts, logging, and rollout readiness.
Audit SQL and ORM queries for security vulnerabilities, N+1 performance issues, and indexing anti-patterns.
PR open but not merging? Find the #1 reason reviewers are stalling and get one ready-to-paste fix to unblock it.
Scan multi-language codebases for unused variables, orphaned functions, and unreachable code with severity ranking.
Find the LLM integration code that breaks when a model blocks a response or falls back to a different model. Flags calls with no try/except or refusal branch, responses used or parsed with no guard for a blocked or empty answer, and hardcoded model ids with no fallback handling. Built for the Fable 5 era, where a high-risk call is blocked and silently falls back to Opus 4.8.
Lint an exported n8n workflow before it ships: catches broken or duplicated nodes, missing error handlers, credential stubs, unhandled retries, unsafe webhooks, brittle expressions, and missing idempotency. A read-only pass over your workflow JSON that ranks production-readiness gaps with evidence and concrete fixes.
Structured, severity-aware code reviews focusing on security, bugs, and performance across all major languages.
⚠️ Attention. This is 1 of 6 skills that cover the entire product build lifecycle. Feel free to download other OptiTech skills to build your production-ready products.
Scan local Python, JavaScript, TypeScript, JSX/TSX, HTML, JSON, and .env files for build markers, returned fake-data terms, swallowed errors, placeholders, route-adjacent canned success, and advisory empty handlers. Read-only findings include rule, severity, file, line, and a plain fix.
Catch the dangerous migration before it locks or wrecks your production database. Scans SQL migration files for destructive and risky operations: DROP and TRUNCATE, drops without IF EXISTS, lossy column-type changes, NOT NULL added without a default, DELETE or UPDATE with no WHERE, non-concurrent index builds, dropped constraints, renames, and data backfills mixed into schema changes. Each finding is ranked by severity with a safer rewrite. Postgres, MySQL, and SQLite.
Find where knowledge is dangerously concentrated in a codebase. From your git history it flags the files only one person has ever touched, the high-churn files with a single owner, authors who own too much of the codebase, and the repo's overall truck factor. The catchy question with a real answer: what breaks if a key person leaves.
Plans safe dependency upgrades and framework migrations for legacy applications with risk analysis, compatibility mapping, test planning, rollback strategy, and phased AI coding prompts.
Catch the Open Graph and Twitter Card problems that make a shared link preview blank or broken. Flags missing og:title, og:image, og:description, og:url, or twitter:card, a relative og:image URL (crawlers need an absolute one), an SVG og:image (no platform renders it), and image dimensions that miss the 1200x630 standard. Reads your HTML or pasted head markup; it does not fetch the page or refresh a platform's cache.
Audit a JavaScript or TypeScript frontend for missing translations and hardcoded UI strings before you ship a new locale. Flags hardcoded JSX text and UI props (title, placeholder, aria-label, label, alt) not wrapped in t(), i18n.t(), or <Trans>; keys present in the default locale but missing from other locale files; keys referenced in code but absent from the locales (the raw dotted keys that leak to users); unused locale keys; and unparseable locale JSON.
Produces a codebase architecture assessment — dependency map, module boundary analysis, and a safe refactoring sequence. Use when the user says "review our codebase architecture", "reduce coupling in this module", "find circular dependencies", or "refactor this god object". Do not use when the user wants a migration plan to a different system, not restructuring the current codebase — that's code-migration-planner.
Stuck with a “wip” or “fix stuff” commit? Get one clean, ready-to-paste rewrite. Bad commit message you already wrote — “wip”, “fix stuff”, a vague subject a reviewer flagged? Find the #1 reason it fails and get a finished rewrite: clean subject, a why-body only when it’s needed.
Find the code that quietly runs up your LLM bill: uncapped generations, model calls looping with no limit, an expensive model doing a trivial job, and whole files stuffed into prompts. Read-only, every finding explained in plain English.
Claude defaults to complex. This skill does not let that happen. Before your session ships a 400-line solution to a 20-line problem, the simplicity filter stops it and asks: does this actually need to be this complex?
Reviewer left comments and your PR is stuck? Find the #1 blocking comment and get a finished reply — acknowledge, the fix, what to test — written to move the reviewer to approve.
Produces a review-ready PR package — self-review sweep, intent-first description, risk disclosure, and a guided reading order. Use when the user says "prepare this PR for review", "write my PR description", "help me self-review this diff", "should I split this PR", or "make this pull request reviewable". Do not use when the request is reviewing someone else's PR, not preparing your own.
Produces a migration plan and converted templates for moving a classic PHP WordPress theme to a Full Site Editing block theme, including splitting logic into a companion plugin. Use when the user says "convert classic theme to block theme", "migrate to FSE", "move to theme.json", or "modernize this WordPress theme". Do not use when the site just needs a Core Web Vitals fix — that's core-web-vitals-fixer.
Senior-level Python code auditor for PEP 8, type safety, security vulnerabilities, and 3.10+ modernizations.
Produces a pre-merge checklist derived from your diff — test coverage, migrations, docs, feature flags, and leftover debug code. Use when the user says "is this branch ready to merge", "pre-merge checklist", "what am I missing before I ship this", or "branch cleanup checklist". Do not use when the user wants a full code review of logic and design, not a merge-readiness checklist.
Professional Go code auditor for performance optimization, concurrency safety, and modern 1.21+ idioms.
Orchestrate human-supervised code migrations across repository fleets with verifier loops and judge review gates.
An automated security auditor that scans code for OWASP vulnerabilities, secrets, and injection flaws before deployment.
Catches the database migrations that lock tables or lose data — before they hit production.
Migrate your Shopify app off the legacy REST Admin API — full-codebase scan, phased cutover plan, client-ready migration report.
Verify AI-generated code for scope drift, false completions, and missing tests.
Makes your coding agent work like a senior developer: exact money, configurable rules, real audit trails, honest testing. Any stack, any country.
Write and audit production-ready Godot 4 GDScript using modern composition and typed patterns.
Transform your AI agent from a code generator into a senior architect that enforces clean design and SOLID principles.
A systematic engine for planning and executing framework migrations, library upgrades, and architectural refactoring.
Teaches AI coding agents to enforce hard numeric quality thresholds on code complexity — cyclomatic complexity, cognitive complexity, coupling, and maintainability index — as deterministic CI/CD gates
Builds a structured architectural map and implementation guide for unfamiliar software repositories.
A third-party skill is instructions your agent will trust. Review it before you install it. Structured security auditing for third-party skills to detect injection, exfiltration, and hidden malicious logic.
Comprehensive codebase analysis and implementation tool that reads every file to ensure architectural consistency.
Audit implementation behavior against test suites to find critical gaps in edge cases, security, and state transitions.
Paste a candidate's test assignment + job description, and get a structured review: scores across 6 criteria (code quality, task completion, edge cases, readability, architecture, problem-solving), key strengths, red flags, hire/no-hire recommendation, and 5 tailored interview questions based on what you saw. Saves 30–45 min per candidate. Works for engineering, data, and product roles.
Teaches AI coding agents to perform structured, high-signal code reviews specifically for AI-generated code — catching the failure modes unique to LLM output (confident hallucinations, silent error sw
Transforms software requirements into planned, implemented, tested, reviewed, and production-ready engineering changes.
Architectural auditor that transforms code smells and Git history into a prioritized, business-case refactoring roadmap.
Audits feature flag lifecycles to identify stale toggles, rollout risks, and evaluation drift.
Converts GitHub issues into repository-aware implementation plans, code changes, tests, and review-ready pull requests.
Eliminate 'any' types and enforce strict TypeScript boundaries across your codebase.
A rigorous reviewer that audits implementation plans for architectural risks, scope creep, and safety before you code.
Eliminate technical debt by enforcing a single source of truth for schemas, types, and constants across the stack.
Reviews a PR for security issues and answers: is this safe to merge? Gives ranked findings, fixes, and a BLOCK / FIX-FIRST / MERGE-SAFE decision.
A code-first documentation engineer that audits and writes docs based on implementation, not assumptions.
Audit, debug, and fix Claude SKILL.md files to ensure they trigger reliably and follow official templates.
Evaluates dependency and framework upgrades for breaking changes, peer conflicts, and deployment risks.
Translates user stories and acceptance criteria into architecture-consistent, production-ready code.
A senior pair-programming partner that detects project conventions and implements production-ready code after planning.
Audit authorization test coverage to find gaps in tenant isolation, object ownership, and privilege boundaries.
Orchestrate and verify large-scale, cross-module codebase refactors with automated planning and testing.
Analyzes codebases to generate prioritized, dependency-aware refactoring plans with concrete implementation steps.
Takes software work from coding and debugging through testing, release readiness, deployment verification, and production recovery.
An evidence-based, checklist-driven workflow for auditing and verifying AI-generated code before deployment.
Automate logical git commits and stacked GitHub pull requests with a safety-first workflow.
A six-phase independent QA auditor that finds hidden bugs in green test suites and production code.
A principal-level architect for diagnosing API failures, generating production-grade fixes, and auditing SecOps.
Verify AI-generated code against task requirements, evidence, tests, and merge-readiness criteria.
A legacy systems specialist that maps unfamiliar codebases using evidence-driven analysis and historical context.
A pedagogical code analysis tool that explains complex logic through layered, level-calibrated teaching.
A dependency strategist that plans staged, risk-tiered upgrades and audits changelogs for breaking changes.
A senior senior engineer persona that acts as a navigator, challenging your assumptions and logic as you code.
Scans your codebase or staged git changes for accidentally committed API keys, AWS credentials, private keys and tokens before you push.
Professional Zig 0.16.0 development specialist focusing on memory safety, 0.16.0 API compliance, and systems performance.
Professional audit tool to detect and fix React hooks anti-patterns, stale closures, and performance bottlenecks.
Produces a Socratic code review — the questions a senior reviewer would ask — covering correctness, edge cases, concurrency, API design, and test adequacy. Use when the user says "review my code", "review this PR", "review this diff", "critique my implementation", or "find problems in my code". Do not use for planning an implementation before writing code.
An adversarial senior engineer review gate that audits AI-written code for security gaps and logic errors before shipping.
Deep audit of TypeScript codebases for type safety violations, unsafe casts, and runtime-risk anti-patterns.
Teaches AI coding agents to systematically reduce code complexity by identifying and refactoring high-cognitive-load patterns: deeply nested conditionals, god functions, excessive state mutations, tan
Automated scanner for security misconfigurations, credential exposure risks, and unsafe environment settings.
Automated audit of codebases for hardcoded strings, missing translation keys, and RTL/locale formatting gaps.
An adversarial reviewer for AI-written code changes. It pressure-tests a pull request or diff for untested branches, silent behavior changes, missing edge cases, over-confident code that only looks right, and weak tests, then returns a PASS / REVISE / BLOCK verdict before the change merges.
Audit your frontend for accessibility violations before release — flags WCAG failures, gives prioritized fixes, and blocks the broken patterns that get sites sued.
Pre-merge PR quality gate. 40+ checks: diff size, tests, security, conventional commits, breaking changes, reviewer routing.
List every TODO, FIXME, HACK, XXX, BUG, and OPTIMIZE comment in your codebase with file, line, and tag. Scans 14 languages, groups the results by tag with counts, and skips node_modules, dist, build, and vendor. A clean tech-debt inventory instead of scrolling grep output.
Enforce senior-level architectural thinking by making your agent write a 5-line Design Note before coding.
Analyze code changes to map dependency blast radius, identify breaking contract changes, and score deployment risk.
Review an AI-generated code diff for the failure modes coding agents actually have — claimed-done-but-not-done, gamed or weakened tests, stubs passed off as complete, silent scope creep, hallucinated APIs, and security regressions. Returns an APPROVE or REQUEST CHANGES verdict with a completion check and severity-ranked fixes.
Audits agent skills and MCP manifests for prompt injection, data exfiltration, and over-permissioned access.
Plans evidence-based, staged migrations from JavaScript or loose TypeScript to strict mode while preserving runtime safety.
Automated WCAG 2.1 AA accessibility auditor that computes contrast ratios and provides code-level fixes.
Get an independent review of a code change from a second model: pack a tight file set, estimate token cost, call the provider API, and turn raw advice into an a
Detect unfinished code, empty tests, and swallowed errors in AI-generated diffs using structural analysis.
A 12-point rigorous audit for API endpoints to catch permanent design mistakes before they ship.