HTMLGuyLLC/ClaudeSkills

Free skills for Claude Code. A skill is a command you type in Claude Code, like /audit.
Use them or fork them as you like. This repo doesn't take issues or pull requests, and it comes with no support. See Install to get started.
| Skill | In one line |
| /audit | Checks your work for problems before you ship it |
| /loop-audit | Checks your work, fixes what it finds, and repeats until it's clean |
| /personas | Builds a list of the people who use your product, and lets them debate decisions |
| /release | Takes finished work all the way from commit to live release |
| /improve-deterministic | Makes your rules-based logic more accurate, without AI in the final product |
| /cleanup | Clears out finished worktrees and branches, and asks before touching unfinished work |
## How to use each skill
### /audit
What it does: Reviews your code like a team of experts, covering security, speed, accessibility, design, legal, and more. It gives you a clear answer: Ship, Ship after fixes, or Don't ship. It doesn't change your code unless you ask.
Choose what to check:
| Command | What it checks |
| /audit | What you're working on now |
| /audit pr 123 | A pull request |
| /audit last 3 | Your last 3 commits |
| /audit src/checkout | One folder |
| /audit all | The whole repo |
Choose which topics to check. It runs all 34 unless you pick some. The list below shows what each one covers.
| Command | What it runs |
| /audit security | One topic |
| /audit security,ux | Several topics |
| /audit protect | One group of topics |
Options:
--quick looks only for serious problems, and costs less.
--fix also fixes the Critical, High, and Medium problems it finds.
text
/audit pr 123 --quick
How it stays fast
Its scanners, your lint, and your tests all run at the same time.
For anything over 3 files, several reviewers work side by side and share one set of project notes, so they don't repeat the same research.
Changes of 4 to 15 files use 3 reviewers, and bigger ones use up to 8. More reviewers means more tokens, and it tells you the estimate before it starts.
Separate agents double-check a long list of serious findings.
--fix makes unrelated fixes side by side.
#### What it checks
Every topic gets a result, so nothing is skipped silently. Click one to see what it covers.
Protect (/audit protect)
security : Can someone break in, reach other people's data, or abuse the product?
Permissions: every request checks on the server who you are and what you own, and new routes start closed.
Login and sessions: rate limits, safe password resets, MFA, OAuth checks, secure cookies, and a logout that really ends the session. Any change here gets a line-by-line read of the whole flow.
Credentials and card data: strong password hashing, secrets kept out of code and logs, keys with narrow access that can be rotated, and PCI rules that keep card numbers out of logs and databases.
File uploads: provided filenames and file types are never trusted. It checks real file content against an allowlist, random server-side names, size limits, private storage, safe serving, and malware scans for shared files.
Common attacks: the OWASP Top 10 lists for web, API, and AI apps, such as injection, XSS, SSRF, and formulas hidden in CSV exports, plus database access rules.