Agents and skills

14 specialist agents across five stages, so quality escalates before anything is committed.

Agent	Stage	Fires when
crew-planner	Understand	scope is ambiguous
crew-backend-expert	Produce	server / API / business logic
crew-database-expert	Produce	schema, migration, index, cache
crew-frontend-expert	Produce	UI, component, client work
crew-devops-expert	Produce	deployment, CI pipeline, incident
crew-docs-agent	Produce	README, guides, release notes, legal & privacy texts, store listings
crew-security-expert	Audit	auth / IDOR / injection / secret · mandatory if security-critical
crew-privacy-agent	Audit	personal data — KVKK/GDPR, plus any regime the project declares
crew-test-expert	Audit	tests, coverage, regression
crew-performance-expert	Audit	hot path, query/loop, render, payload
crew-refuter	Audit	a medium+ finding, before it is reported: tries to refute it
crew-review-agent	Close	pre-commit code-health review
crew-commit-agent	Close	proposes the commit, waits for approval
crew-session-manager	Hand off	context fills / phase boundary

Models are not pinned. Every agent runs on the model you chose for the session, so a review that clears a change is never weaker than whatever wrote it. Two exceptions earn their keep: crew-security-expert buys extra rigour with effort: high, and crew-commit-agent runs on haiku because turning a staged diff into a Conventional Commit is mechanical. Change any of it in the agent’s frontmatter if your project wants something else.

All 40 skills

The catalogue below is generated from each skill when the site is built; do not edit it by hand.

Skill	What it does
a11y	Use when building or changing UI, before shipping a user-facing screen, and when something cannot be reached with a keyboard, read by a screen reader, or seen at low contrast.
adr	Architecture Decision Record: context-decision-consequences, for decisions that are expensive to reverse.
api-design	Use when an API contract is designed or changed: a new endpoint or resource, how its errors and pages are returned, a field to add or remove, or a version to cut without breaking a consumer.
automode-policy	Auto-mode classifier config: inspect what the classifier that answers permission prompts is configured with, and catch the silent case where a custom autoMode block drops the built-in block rules.
backend-architecture	Decide, record and apply the backend stack and architecture pattern.
brainstorm	Use when the ask is still fuzzy and no direction is chosen yet: “not sure what we want”, several ways to go, or a scope to settle before any plan is written.
ci-pipeline	Use when a CI pipeline or workflow is written or changed, when a build or check fails in CI but not locally, and when a PR gate, a build cache or a secret in CI is set up.
commit-message	Conventional Commits: reads the staged diff and proposes type(scope): summary, with body/footer when needed.
confidence-check	Readiness gate BEFORE writing implementation code: does this already exist, does it fit the project’s architecture, is the API claim actually checked, is there a working reference, is the root cause known.
crew-code-review	Use when asked to review a change, a PR, or code just written before a push, and when acting on review comments someone else left.
db-migration	Apply schema migrations safely: detect the tool, classify the change by risk, gate destructive ones behind approval, back up in prod, preview-apply-verify, roll back on failure.
dependency-audit	Dependency risk assessment, read-only: known CVEs, deprecated packages, licence compliance, maintenance status, lockfile integrity, and a justification for every new dependency.
dependency-upgrade	Bring dependencies current without breaking the build: find what is vulnerable, deprecated or behind, classify each target version by risk, apply what is safe, verify, and roll back what is not.
deploy	Ship a build reversibly — to a host you manage or a platform that manages it.
docs-writer	Keeps documentation in sync with the code: README, usage and related docs when a public API or behavior changes.
eval-grader	Measure output quality, don’t vibe it: score a generative task with a two-layer grader — deterministic code metrics + per-dimension LLM-as-judge — over a fixed task set, as signed deltas vs a pinned baseline.
frontend	Use when writing or changing client code for web, mobile or desktop: a screen or component, its state and data loading, or a bug in the UI.
frontend-design	Use when a screen should look more considered: polishing a UI, setting up or following a design system, or fixing a layout whose spacing, type or colour feels off.
frontend-flutter	OPTIONAL, stack-specific: Flutter.
frontend-rn-expo	OPTIONAL, stack-specific: React Native + Expo (prebuild).
handoff	Session handover: when context fills, a phase closes, or the topic changes, write an action-oriented handover to docs/SESSION_STATE.md, then recommend /clear.
i18n-integrity	Translation integrity: every key present in every language, no hardcoded strings, consistent placeholders and plurals.
incident-runbook	Use when production is degraded or broken, an outage keeps recurring, or for the postmortem and the runbook after an incident.
iterate	Refine-to-Done loop: repeat until tests green + review clean + nothing deferred; bounded.
mcp-builder	Use when an API, a database or a service should be exposed to Claude or another AI client as tools, and when building or fixing an MCP server.
observability	Use when adding a log line, an error path, a metric, or when an incident could not be traced.
performance	Use when something is slow, before optimising anything, and when a change touches a hot path.
privacy-compliance	Use when code collects or stores personal data, when consent, retention or deleting a person’s data comes up, and for a KVKK or GDPR review.
red-team	Attacker’s-eye test of LLM/agent defenses: instruction hijacking, data exfiltration and tool abuse through untrusted content; verifies whether the defense actually holds.
reflect	Retrospective self-audit after nontrivial work: unverified assumptions, skipped items, is-this-the-right- approach — findings, not code.
release	Use when cutting a version: bumping it, writing the CHANGELOG entry, or tagging.
security-scan	Stack-agnostic security audit: map the attack surface, trace untrusted input to dangerous calls, surface dependency and configuration flaws.
sonarqube-check	SonarQube quality gate, any language, no company server needed: run SonarQube Community Build locally (Docker), read the real gate + issues, fix by rule id, re-scan and diff.
spec-planning	Use when work needs a plan before code: the user asks how to split it into tasks or what the acceptance criteria are, or the scope spans more than one change.
systematic-debugging	Use when a bug’s cause is unknown: something is broken, crashes, or fails only sometimes, or a few fixes have already been tried.
testing	Use when writing or changing tests, when asked whether the tests are green after a change, or when a suite is flaky, slow, or green for the wrong reason.
threat-model	Scope a security audit BEFORE scanning, to cut false positives: map assets, entry points, trust boundaries and 5-8 domain-specific attack classes into a parseable THREAT_MODEL.md.
token-budget	Use when the context is filling up or a token budget comes up, before a large read or a long delegated task, and when a skill or prompt grows too long.
trace-scan	Trace scan (§4.1/§4.2): before a commit, scans the staged changes and the message for AI traces (co-author trailers, footers, robot emoji, tool names) and vendor template names.
worktree	Isolate risky or parallel file-mutating work in a git worktree so the main tree’s uncommitted changes are never clobbered.