hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A lean, trustworthy personal Claude Code skills pack. It encodes my own conventions for detecting bugs, building features, testing, and shipping — and rides superpowers rather than duplicating it.
The goal is trust: when I follow one of these skills, the result is what I expect, with evidence — not a hopeful claim. This is the deliberate opposite of a maximalist catalog; every skill earns its place.
by name (brainstorming, writing-plans, subagent-driven-development, systematic-debugging, verification-before-completion, finishing-a-development-branch). It is the only required runtime dependency. Nothing else is installed.
Optional:ux-barandsecurity-barlayer on thefrontend-designandsecurity-reviewskills respectively, andtask-flow's SPIKE step can usedeep-research/feature-dev— each is used only if present, none are required.
Stable (any environment):
claude plugin marketplace add Endika/eskills
claude plugin install eskills@endikaYou only ever receive stable releases: work-in-progress commits on main share the same version until release-please bumps it.
Dev (load HEAD directly):
claude --plugin-dir ~/eskills # or: make devInvoked as eskills:<name>.
| Skill | Use when |
|---|---|
standards | About to commit, write/design tests, name identifiers, write user-facing copy, choose an ID type, or push — enforces my conventions floor (commits, tests, repo hygiene, inclusive language, IDs). |
task-flow | Implementing a feature end-to-end — orchestrates spec → plan → per-task implement/verify/review over superpowers, with a single human gate plus a human-pulled respec gate to correct the spec mid-build. |
spec-intake | Turning a task (Jira/Linear/URL/free text) into a normalized spec before planning. |
gen-uml | Generating a Mermaid diagram (architecture/flow/sequence) from existing code. |
postmortem | After an important bug/failure — capture, root cause, fix, lesson as an archivable doc. |
stack-gotchas | Hitting a known failure in my stack — release-please, GitHub Pages, Supabase — for a direct diagnose-and-recover recipe. |
context-budget | Context feels heavy / added skills, MCP, or memory — audits whole-setup token consumption with a prioritized trim list. |
exploit-hunt | Hunting actually-exploitable vulnerabilities (SSRF, SQLi, command injection, RCE, path traversal, XSS) — offensive counterpart to security-bar, on-demand, not a per-task lens. |
stacks | Working in a non-default stack (Flipper FAP/C now; Django/Flask/FastAPI coming) — per-stack architecture/build/test/release conventions under references/<stack>/. One skill, many stacks. |
gdpr | Building/shipping/auditing a B2C app for GDPR/privacy — data-posture classifier, decision gates, lawful basis/minimization/retention/DSR, processors & transfers, privacy notice, cookieless analytics. |
Short rubrics in my voice — usable standalone on a diff, and invoked by task-flow's review stage. Hard cap of 4.
| Lens | Use when |
|---|---|
ux-bar | Building/reviewing UI — my design-system, semantic-color and inclusive-copy rules on top of frontend-design. |
security-bar | Reviewing for security — my checklist on top of security-review. |
arch-bar | Judging whether an architecture fits its scale — catches over- and under-engineering. |
perf-bar | Assessing performance/algorithmic soundness — Big-O, N+1, egress, benchmarks. |
How task-flow sequences everything — Phase 1 → the single human gate → the Phase 2 per-task loop (where the quality lenses fan out) → Phase 3. The quality lenses live in step 4 of the loop.
flowchart TD
classDef gate fill:#FFF1EF,stroke:#FF5A47,stroke-width:2px,color:#9A3412
classDef plan fill:#EEF2FF,stroke:#6366F1,color:#3730A3
classDef lens fill:#F8FAFC,stroke:#94A3B8,color:#0F172A
classDef offensive fill:#FFF5F4,stroke:#DC2626,color:#991B1B
subgraph P1["Phase 1 — Understand and plan (auto, adaptive)"]
direction TB
SI["eskills:spec-intake<br/>objective · acceptance criteria · constraints · DoD<br/>classify greenfield/brownfield · flag hard-tech"]
CE["feature-dev:code-explorer<br/>understand the existing code"]
SP["SPIKE — 2-3 approaches<br/>benchmark with perf-bar · pick before planning"]
BR["superpowers:brainstorming<br/>refine intent and trade-offs"]
WP["superpowers:writing-plans<br/>files · concrete change · acceptance criteria · validation commands"]
PLAN(["PLAN + acceptance criteria + subagent design + rationale"])
SI -. if brownfield .-> CE
SI -. if hard-tech .-> SP
SI --> BR
CE --> BR
SP --> BR
BR --> WP --> PLAN
end
PLAN --> GATE{{"HUMAN GATE — the only human stop<br/>review and approve the plan · then /compact"}}
GATE --> IMP
subgraph P2["Phase 2 — Build (auto, per task)"]
direction TB
IMP["1 · Implementer<br/>implement · test · commit · self-review<br/>pulls eskills:stacks · stack-gotchas · gdpr as needed"]
SR["2 · Spec reviewer<br/>independent · does it match the spec?"]
AV["3 · Adversarial verifier<br/>fresh context · re-runs lint + types + tests<br/>defaults to NOT done"]
QR["4 · Quality reviewer<br/>applies only the lenses that fit · cap 4"]
UX["ux-bar<br/>semantic color · tokens · a11y · responsive"]
SEC["security-bar<br/>client guards are not security · RLS · server-side authz"]
ARCH["arch-bar<br/>over- and under-engineering"]
PERF["perf-bar<br/>Big-O · N+1 · egress"]
DONE(["all green → next task"])
RESPEC["RESPEC GATE — human-pulled<br/>pause · correct the spec · re-plan · relaunch"]
EH["exploit-hunt — offensive, on-demand<br/>NOT in the per-task loop"]
IMP --> SR --> AV --> QR
QR --> UX
QR --> SEC
QR --> ARCH
QR --> PERF
UX --> DONE
SEC --> DONE
ARCH --> DONE
PERF --> DONE
DONE -. next task .-> IMP
IMP -. spec is wrong .-> RESPEC
RESPEC -. re-spec → re-plan → relaunch .-> IMP
SEC -. offensive counterpart .-> EH
end
DONE --> VBC
subgraph P3["Phase 3 — Finish (auto)"]
direction TB
VBC["superpowers:verification-before-completion<br/>+ a final review pass"]
FIN["superpowers:finishing-a-development-branch"]
REL["PR / release<br/>Conventional Commits (eskills:standards) · release-please"]
VBC --> FIN --> REL
end
class GATE,RESPEC gate
class PLAN plan
class UX,SEC,ARCH,PERF lens
class EH offensiveOne rule shapes the whole repo:
Copy/adapt small, stable ideas where I want _my_ version. Reference large, living engines where I want to ride their updates.
So superpowers is referenced (invoked by name); a few small patterns are adapted and rewritten. ECC is never installed — it was mined for ideas only.
make # list targets
make list # skills + their trigger descriptions
make check # validate frontmatter, JSON, and design caps (run before pushing)
make new name=<kebab> # scaffold a new skill
make details # component inventory + token cost (anti-bloat watch)
make tag # create the release tag (validates plugin.json vs marketplace)Feature work on short-lived branches (feat/…, fix/…, chore/…) → PR → rebase-merge, so main stays linear (never a merge commit). Releases via release-please (Conventional Commits → version bump + CHANGELOG + tag).
MIT © Endika
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.