agentic-development-kit

In-depth API contract design knowledge — REST (OpenAPI 3.x/3.1), GraphQL, RPC (gRPC/Protobuf), and asynchronous message contracts for Kafka/RabbitMQ/Pub-Sub under the AsyncAPI 3.x standard (the same role as OpenAPI, but for messages instead of REST). Covers design principles, security (OWASP API Security Top 10), naming/versioning, and standardized error format (RFC 7807). Use before implementation, to finalize the communication contract before writing code.

Designs system architecture, from a single service's high-level design to distributed microservices decomposition. Produces architecture diagrams, ADRs, service boundary designs, deployment-topology decisions (VM/IaaS vs. cloud-native vs. hybrid vs. multi-cloud), and — for distributed systems — communication, data-ownership, and resilience strategies, each with explicit trade-offs. Use for new system design, architecture review, pattern selection (monolith/microservices/serverless/event-driven), monolith decomposition, choosing where a system or component runs (VM, cloud, hybrid), or documenting decisions as ADRs.

Integrates with Atlassian products to manage project tracking and documentation via MCP protocol. Use when querying Jira issues with JQL filters, creating and updating tickets with custom fields, searching or editing Confluence pages with CQL, managing sprints and backlogs, setting up MCP server authentication, syncing documentation, or debugging Atlassian API integrations.

Complete bug-fix workflow — gather symptoms, attempt to reproduce, wait for user confirmation before fixing, implement/fix in a loop until quality is met, then report, capture knowledge, and produce a postmortem. Fully technology-agnostic — invokes whichever technical skills the task needs. Works for any project or stack.

Generates, formats, and validates technical documentation — inline documentation (docstrings/comments), API specs (OpenAPI/Swagger, JSDoc-style annotations), documentation sites, and user guides — for any language or framework. Use when adding documentation to functions or classes, creating API documentation, building documentation sites, or writing tutorials and user guides.

Objective code-review checklist to run before reporting work complete — general conventions, clean-code, plus a per-technology checklist for whatever was actually used. This is the SELF-CHECK step Claude ALWAYS proactively runs as the last step before reporting done on any change involving code — no separate user request needed. Do NOT use this when the user actively requests a diff/PR review ("review this", "/code-review") — use the built-in `code-review`/`review` skill for that case.

In-depth database design and server-side optimization knowledge — RDBMS (Oracle, PostgreSQL, MySQL) and NoSQL (document: MongoDB; key-value: DynamoDB/ScyllaDB Alternator; column-based: Cassandra/ScyllaDB CQL). Transaction isolation, concurrency control/locking, indexing/EXPLAIN, query optimization, schema/data-model design, advanced PostgreSQL/MySQL tuning (JSONB, extensions, VACUUM, replication), partition/shard key design, migration. Use when a feature needs schema design/changes or query optimization against a server-based database.

In-depth Elasticsearch knowledge — index/mapping design, analyzers, Query DSL, aggregations, reindex strategy, shard/replica sizing. Use when the feature needs full-text search or analysis/aggregation over large datasets.

End-to-end workflow for building a new feature — requirements analysis, solution proposal, implement/test/fix loop until quality bar is met, then reporting and knowledge capture. Fully technology-agnostic — invokes whichever technical skills the task needs. Works for any project or stack.

In-depth Java + Spring ecosystem knowledge (Spring Boot 3.x, Java 21) — Spring MVC/WebFlux, Spring Data JPA, Spring Security 6 (JWT/OAuth2), Spring Cloud (Config/Eureka/Gateway)/Resilience4j, package structure (package-by-layer vs. package-by-feature, Spring Modulith, cross-module transactions), Java code style/formatting (Google Java Style, Spotless/Checkstyle), plus unit + integration testing (JUnit5, Mockito, Testcontainers). Does NOT cover Kafka/RabbitMQ (see `kafka-skill`/`rabbitmq-skill`), API contract design (see `api-contract-skill`), or DB schema design (see `database-skill`). Use when implementing Java/Spring business logic.

In-depth Apache Kafka knowledge — topic/partition design, consumer groups, delivery semantics, idempotency, schema evolution, dead-letter handling, lag monitoring. Use when the feature needs Kafka (project already depends on `spring-kafka` or an equivalent client, or the user names Kafka explicitly). If the request only says "async processing" with no technology named, check the actual dependency first — don't default to Kafka; for a simple queue see `rabbitmq-skill`, for GCP see `pubsub-skill`.

Designs incremental migration strategies, identifies service boundaries, produces dependency maps and migration roadmaps, and generates API facade designs for aging codebases. Use when modernizing legacy systems, implementing strangler fig pattern or branch by abstraction, decomposing monoliths, upgrading frameworks or languages, or reducing technical debt without disrupting business operations.

Use when building, debugging, or extending MCP (Model Context Protocol) servers or clients that connect AI systems with external tools and data sources. Invoke to implement tool/resource/prompt handlers with the high-level TypeScript (McpServer) or Python (FastMCP) SDKs, configure stdio or Streamable HTTP transport, add OAuth 2.1 authorization for remote servers, validate schemas with Zod or Pydantic, debug protocol compliance issues, or scaffold a complete MCP server/client project.

Manually-invoked, end-to-end setup for connecting a third-party MCP server to Claude Code — given a GitHub link, package name, or hosted URL, determines the transport/auth it needs, registers it via `claude mcp add` at the right scope, handles secrets safely, and verifies the connection actually works. Only run when the user explicitly invokes `/mcp-setup` or explicitly asks to install/connect/set up a specific MCP server by name or link. Do NOT auto-trigger this for general MCP questions, for authoring a new MCP server (use `mcp-developer`), or for Atlassian specifically (use `atlassian-mcp`, which already covers that server's setup).

Sets up continuous production observability — structured logging pipelines, Prometheus/Grafana metrics and dashboards, distributed tracing, and alerting rules — plus application profiling and capacity forecasting from real production trends. Use when adding observability to a service, debugging production issues via logs/metrics/traces, profiling CPU/memory bottlenecks, or forecasting capacity needs. For a one-off load test gating a merge or release as part of the QA test lifecycle (pass/fail, defect report), use `test-master` instead — this skill's load-testing content targets capacity/production-readiness validation, not CI gating.

In-depth Google Cloud Pub/Sub knowledge — topics/subscriptions, push vs. pull, ack deadlines, ordering keys, dead-letter topics, exactly-once delivery. Use when the feature needs Pub/Sub (project already uses a GCP client, or the infrastructure already runs on GCP). If the request only says "async processing" with no technology named, check the actual dependency/infrastructure first — don't default to Pub/Sub; for multi-cloud/on-prem see `kafka-skill`/`rabbitmq-skill`.

In-depth RabbitMQ knowledge — exchange types, routing, queue durability, dead-letter exchange, prefetch, quorum queues, priority queues. Use when the feature needs RabbitMQ (project already depends on `spring-boot-starter-amqp` or the user names RabbitMQ explicitly). If the request only says "async processing" with no technology named, check the actual dependency first — don't default to RabbitMQ; for high throughput/replay see `kafka-skill`, for GCP see `pubsub-skill`.

In-depth Redis knowledge — caching, distributed locks, lightweight queues, ranking/leaderboards. Use when the feature needs a cache, a distributed lock, a queue that can tolerate minimal loss, or a leaderboard. If strong durability/delivery guarantees are needed (retry, dead-letter, replay), see `kafka-skill`/`rabbitmq-skill` instead of Redis.

Code-refactoring workflow — improve structure/performance/maintainability WITHOUT changing external behavior (API responses, side effects, output must stay 100% identical). Use when the request is to clean up/restructure/improve code quality, not to add a new feature or fix wrong behavior. Fully technology-agnostic — invokes whichever technical skills the task needs.

Writes, reviews, and debugs idiomatic Rust code with memory safety and zero-cost abstractions. Implements ownership patterns, manages lifetimes, designs trait hierarchies, builds async applications with tokio, and structures error handling with Result/Option. Use when building Rust applications, solving ownership or borrowing issues, designing trait-based APIs, implementing async/await concurrency, creating FFI bindings, or optimizing for performance and memory safety. Invoke for Rust, Cargo, ownership, borrowing, lifetimes, async Rust, tokio, zero-cost abstractions, memory safety, systems programming.

Use when IMPLEMENTING authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities while writing code — custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Produces secure CODE, not audit reports. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For auditing/scanning EXISTING code or infrastructure for vulnerabilities (SAST, penetration testing, compliance checks) instead of writing new secure code, use `security-reviewer`.

Identifies security vulnerabilities in EXISTING code/infrastructure and generates structured audit reports with severity ratings (CVSS) and actionable remediation guidance — does not implement fixes itself. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists. For IMPLEMENTING secure code (auth, input validation, password hashing) while building a feature, use `secure-code-guardian` instead.

Provides the foundational engineering principles for designing sound solutions — SOLID and code-design heuristics (DRY/KISS/YAGNI, coupling/cohesion, Law of Demeter, Composed Method/Single Level of Abstraction, Command-Query Separation and TOCTOU-safe re-validation), the Well-Architected operational pillars (reliability, security, cost, performance, operational excellence), 12-Factor/cloud-native application practices, and environment-portability principles for systems that must run across VM and cloud (ports & adapters, config/secrets abstraction, consistent identity and observability). Use to evaluate whether a design or existing code follows sound engineering principles, to establish team design standards, or to audit a solution proposal for principle violations before implementation. Not for choosing an architecture pattern or deployment topology (that's architecture-designer), and not for writing language-specific implementation code.

Reverse-engineering specialist that extracts specifications from existing codebases. Use when working with legacy or undocumented systems, inherited projects, or old codebases with no documentation. Invoke to map code dependencies, generate API documentation from source, identify undocumented business logic, figure out what code does, or create architecture documentation from implementation. Trigger phrases: reverse engineer, old codebase, no docs, no documentation, figure out how this works, inherited project, legacy analysis, code archaeology, undocumented features.

Implementation knowledge for Tauri (Rust backend) + React (frontend) desktop apps — IPC commands/invoke, capabilities/permissions, standard plugins (dialog/fs/store/sql), local/offline storage design (SQLite/key-value/file), cross-OS handling (`#[cfg(target_os)]`), and React loading/error/empty state. Coordinates with `ui-ux-design-skill` (UX design) — this skill owns both storage design and the executable code for Tauri+React apps. Use when implementing/modifying code, or designing/changing the storage mechanism, in a Tauri+React app.

Writes and structures technical proposal documents (RFCs, đề xuất kỹ thuật, đề xuất giải pháp, đề xuất dự án) that argue for a technical decision to stakeholders or approvers — problem/context, goals, proposed solution, alternatives considered, risks, implementation plan, timeline and resources. Use whenever the user asks to write, draft, or review a technical proposal, RFC, design doc meant for approval, project proposal, or any "đề xuất" document — in Vietnamese or English — especially when it needs to persuade a reader (lead, leadership, another team) to approve a course of action, not just describe how a system works.

Generates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect reports across functional, performance, and security testing disciplines. Use when writing unit tests, integration tests, or E2E tests; creating test strategies or automation frameworks; analyzing coverage gaps; performance testing with k6 or Artillery; security testing with OWASP methods; debugging flaky tests; or working on QA, regression, test automation, quality gates, shift-left testing, or test maintenance.

In-depth Testcontainers setup/operation knowledge for integration tests — dependencies, container lifecycle (singleton pattern, reuse, cleanup), wait strategies, multi-container networking, CI integration. Does NOT cover infrastructure-specific test scenarios (see `database-skill`/`kafka-skill`/`rabbitmq-skill`/`redis-skill`/`elasticsearch-skill`). Use when an integration test needs real infrastructure via containers instead of a mock.

In-depth UI/UX design knowledge — usability, accessibility, and consistency principles, and responsive/cross-platform design for desktop apps. Use when a feature has a UI component that needs design before implementation; coordinates with `tauri-react-skill` for the actual build.

Use FIRST for any request asking Claude to WRITE OR CHANGE code — new feature, bug fix, refactor, enhancement, "improve", "add capability", etc. Classifies the request as feature-development, bug-fix, or refactor by its true nature (does external behavior change, and if so is it fixing a defect or adding/changing capability?), asking the user only if genuinely ambiguous, then hands off. Skip when the request type is already obvious. Do NOT use for no-code-change requests — pure questions/explanations, read-only exploration, or explicit review requests ("review this PR/diff") — handle those directly instead.