Top 10 Claude Skills Every Developer Should Know

/code-review --file path/to/code.py --focus security,performance

Security Issues (High Priority):
- SQL injection vulnerability in query builder (line 45)
  Fix: Use parameterized queries instead of string interpolation

Performance Issues (Medium Priority):
- N+1 query problem in user loop (lines 123-130)
  Impact: 100 database queries instead of 1
  Fix: Use JOIN to fetch related data in single query

Style Issues (Low Priority):
- Variable naming inconsistent (line 67)
  Current: user_lst
  Suggested: user_list

Good Patterns:
- Error handling with context managers (line 89)
- Proper async/await usage (line 156)

/commit --staged --format conventional

feat(auth): add JWT token refresh mechanism

- Implement refresh token endpoint
- Add token expiration handling
- Include refresh token rotation
- Update security documentation

Closes #456
Co-Authored-By: Claude <noreply@anthropic.com>

/generate-tests --file src/utils.py --coverage 80 --framework pytest

import pytest
from utils import validate_email, calculate_total

class TestEmailValidation:
    """Test email validation function"""

    def test_valid_email(self):
        """Happy path: Valid email should return True"""
        assert validate_email("user@example.com") is True

    def test_email_with_subdomain(self):
        """Edge case: Email with subdomain"""
        assert validate_email("user@mail.example.com") is True

    def test_invalid_format(self):
        """Error case: Missing @"""
        assert validate_email("userexample.com") is False

    def test_empty_string(self):
        """Edge case: Empty string"""
        assert validate_email("") is False

    def test_none_input(self):
        """Error case: None input should raise TypeError"""
        with pytest.raises(TypeError):
            validate_email(None)

    def test_special_characters(self):
        """Edge case: Special characters in email"""
        assert validate_email("user+tag@example.co.uk") is True

    def test_very_long_email(self):
        """Edge case: Email at max length (254 chars)"""
        long_email = "a" * 243 + "@example.com"
        assert validate_email(long_email) is True

/generate-docs --source src/ --format markdown --audience developers

## API Documentation

### POST /api/users

Create a new user account.

**Authentication:** Optional (JWT Bearer token for admin)

**Request Body:**
```json
{
  "email": "user@example.com",
  "username": "johndoe",
  "password": "secure_password",
  "full_name": "John Doe"
}

{
  "id": "user_123",
  "email": "user@example.com",
  "username": "johndoe",
  "created_at": "2024-02-20T10:30:00Z"
}

**Pro tips**:
- Run after major features complete
- Supports multiple documentation formats
- Can target different audience levels
- Includes code examples and error scenarios

## 5. Pull Request Review Skill

**What it does**: Comprehensive review of pull requests including code quality, tests, documentation, and impact assessment.

**Use cases**:
- Automated PR quality checks
- Identifying missing tests or documentation
- Assessing breaking changes
- Checking for security issues
- Evaluating architectural decisions

**How to set up**:

```bash
/review-pr --number 456 --checklist standard

PR Review: Add user authentication (#456)

OVERVIEW
Changes: 15 files changed, 847 additions, 132 deletions
Complexity: Moderate (affects authentication and sessions)
Confidence: High

CODE QUALITY
✓ Style consistency maintained
✓ Type hints added where appropriate
✓ No obvious bugs detected
⚠ Consider extracting auth logic into separate module (reduces duplication)

TESTING
✓ Tests included for new functionality
✓ Edge cases covered (invalid tokens, expired sessions)
⚠ Integration tests missing - recommend testing with actual database
⚠ Performance tests missing for token validation

SECURITY
✓ Tokens properly validated
✓ CSRF protection maintained
⚠ Password validation rules could be stricter (minimum 12 chars recommended)
⚠ Rate limiting not implemented on login endpoint

DOCUMENTATION
✓ Code comments are clear
⚠ README not updated with authentication setup instructions
⚠ API documentation not updated for new endpoints

IMPACT ASSESSMENT
Scope: Moderate (affects authentication flow)
Breaking Changes: No
Database Changes: Migration included
Migration Tested: Yes

RECOMMENDATION: Approve with comments

/security-audit --target src/ --standards owasp,pci-dss

Security Audit Report

CRITICAL (Immediate Action Required)
1. SQL Injection Vulnerability
   Location: src/database.py, line 45
   Issue: User input directly interpolated in SQL query
   ```python
   query = f"SELECT * FROM users WHERE id = {user_id}"
   ```
   Fix: Use parameterized queries
   ```python
   query = "SELECT * FROM users WHERE id = ?"
   cursor.execute(query, (user_id,))
   ```

2. Hardcoded Database Credentials
   Location: src/config.py, line 12
   Issue: Database password in source code
   Fix: Use environment variables
   ```python
   DB_PASSWORD = os.getenv("DB_PASSWORD")
   ```

HIGH (Fix in Current Sprint)
3. Missing CSRF Token Validation
   Location: src/forms.py, line 88
   Impact: Forms vulnerable to cross-site request forgery
   Fix: Implement CSRF token validation middleware

4. Weak Password Validation
   Location: src/auth.py, line 134
   Current: Minimum 6 characters
   Recommended: Minimum 12 characters + complexity requirements

MEDIUM (Fix in Next Sprint)
5. Missing API Rate Limiting
   Location: src/api.py
   Risk: Brute force and DOS vulnerability
   Solution: Implement rate limiting middleware

SUMMARY
- Total Issues: 5
- Critical: 2 (Require immediate fix before deployment)
- High: 2 (Should fix before production)
- Medium: 1 (Address in regular development)

/optimize-performance --profile src/ --target latency,memory

Performance Analysis Report

CRITICAL (Immediate Attention)
1. N+1 Query Problem
   Location: src/services/user_service.py, lines 45-52
   Current Performance: 101 queries for 100 users
   Optimized Performance: 2 queries
   Expected Improvement: 50-100x faster

   Problem Code:
   ```python
   for user in users:
       posts = db.query(Post).filter(Post.user_id == user.id).all()
   ```

   Solution:
   ```python
   users_with_posts = db.query(User).options(
       joinedload(User.posts)
   ).all()
   ```

2. Unbounded JSON Array Response
   Location: src/api.py, line 234
   Current: Returns all 50,000 results
   Impact: 15MB response size
   Solution: Implement pagination (100 results/page)
   Expected Improvement: 99% smaller responses

HIGH (Fix This Sprint)
3. Missing Database Indices
   Table: `orders`, Column: `created_at`
   Current Query Time: 2.5 seconds
   Optimized Query Time: 50ms (50x improvement)
   SQL: CREATE INDEX idx_orders_created_at ON orders(created_at)

4. Inefficient String Concatenation in Loop
   Location: src/utils.py, line 123
   Current Approach: String concatenation (O(n²))
   Better Approach: Use list.join (O(n))
   Expected Improvement: 10x faster for large lists

MEMORY OPTIMIZATION
5. Unused In-Memory Cache
   Location: src/cache.py
   Issue: Cache never cleared, grows indefinitely
   Solution: Implement TTL-based eviction
   Potential Savings: 500MB+ per hour

SUMMARY
- Critical Issues: 2
- High Issues: 3
- Potential Improvement: 10-100x faster for key operations

/refactor --file src/user_handler.py --goals clarity,dry,organization

Refactoring Recommendations

DUPLICATION (HIGH PRIORITY)
1. Repeated Validation Logic
   Locations: services/user.py (line 45), services/post.py (line 78), services/comment.py (line 120)
   Pattern: Email validation duplicated 3 times
   Recommendation: Extract to shared validation module

   Consolidate into:
   ```python
   # shared/validators.py
   def validate_email(email: str) -> bool:
       """Validate email format with proper error messages"""
       # implementation
   ```

2. Similar Error Handling Patterns
   Found in: 12 different controllers
   Recommendation: Create base error handler class
   Expected Impact: 200 lines of code reduction

CODE COMPLEXITY
3. Complex Conditional (28 lines)
   Location: utils.py, function: process_payment
   Complexity: Too many nested conditions
   Recommendation: Break into smaller functions with clear names

   Before:
   ```python
   if user:
       if user.is_active:
           if user.has_payment_method:
               if payment_amount > 0:
                   # process...
   ```

   After:
   ```python
   if not is_valid_payment(user, amount):
       return error()
   process_payment(user, amount)
   ```

NAMING IMPROVEMENTS
4. Unclear Variable Names
   - `temp_list` → `filtered_results`
   - `var_x` → `user_count`
   - `calc()` → `calculate_total_price()`
   Impact: Improved readability for future maintainers

ORGANIZATION
5. Misplaced Utilities
   Several database utilities in controller module
   Recommendation: Move to dedicated utilities module
   Benefit: Better separation of concerns

SUMMARY
- Duplication opportunities: 3
- Complexity simplification: 2
- Naming improvements: 5+
- Potential code reduction: 400 lines (20% of module)

/design-api --specification src/api_design.yml --standard rest

API Design Review

CONSISTENCY ISSUES
1. Inconsistent Naming Conventions
   - GET /users (correct)
   - GET /user_profile (should be /user-profiles)
   - GET /list-posts (should be /posts)
   Recommendation: Use snake_case in URLs consistently (kebab-case preferred)

2. Inconsistent Error Responses
   Example 1: {"error": "Not found"}
   Example 2: {"message": "User not found", "code": 404}
   Recommendation: Standardize on RFC 7807 Problem Details format

3. Pagination Inconsistency
   Endpoint 1: ?page=1&limit=10
   Endpoint 2: ?offset=0&count=10
   Recommendation: Standardize on cursor-based pagination

REST PRINCIPLES
4. Non-RESTful Update Endpoint
   Current: POST /users/123/update
   RESTful: PATCH /users/123
   Benefit: Better semantics, standard tooling support

5. Redundant Endpoint
   GET /users/:id/details
   Recommendation: Remove, as details are included in GET /users/:id
   Simplifies API surface

DOCUMENTATION GAPS
6. Response Schema Not Documented
   Missing: Required fields, optional fields, field types
   Recommendation: Include OpenAPI/Swagger specification

7. Error Scenarios Not Documented
   Missing: When each error code occurs, how to recover
   Recommendation: Document error handling for each endpoint

SUMMARY
- Consistency improvements needed: 3
- REST principle violations: 1
- Documentation gaps: 2
- Recommended: Refresh API design for v2.0

/plan-deployment --version 2.5.0 --target production --checklist standard

Deployment Plan: Version 2.5.0 → Production

PRE-DEPLOYMENT CHECKLIST
✓ All tests passing
✓ Code review approved
✓ Security audit passed
✓ Database migration tested
✗ Performance testing incomplete
✗ Rollback procedure not documented

RISK ASSESSMENT
Medium Risk: Database migration affects large table
- Impact: 5-minute downtime expected
- Mitigation: Perform during maintenance window
- Rollback: Reverse migration script (tested)

New Dependencies
- Django 5.0 (major version, verify compatibility)
- postgresql 14+ (check current version: 13)

DEPLOYMENT STEPS
1. Pre-deployment
   - [ ] Schedule maintenance window (1 hour)
   - [ ] Notify stakeholders
   - [ ] Create database backup
   - [ ] Test rollback procedure

2. Deployment
   - [ ] Deploy application code (5 minutes)
   - [ ] Run database migrations (2 minutes)
   - [ ] Update caches (30 seconds)
   - [ ] Run smoke tests (2 minutes)

3. Post-deployment
   - [ ] Monitor error rates (no increase expected)
   - [ ] Check response times (should improve 5-10%)
   - [ ] Verify feature flags working
   - [ ] Update documentation

4. Rollback (if needed)
   - [ ] Rollback application code
   - [ ] Rollback database migration
   - [ ] Clear caches
   - [ ] Verify system health

ESTIMATED TIME: 10-15 minutes
EXPECTED IMPACT: 5-minute maintenance window, 10% performance improvement

ROLLBACK PLAN
If major issues occur:
1. Rollback takes 5 minutes
2. Database rollback takes 2 minutes
3. Safe to attempt up to T+30 minutes
4. If unsuccessful, escalate to engineering lead

# Using Claude Code
/install-skills --bundle developer-essentials

# Or individually
/install-skill code-review
/install-skill commit-automation
/install-skill test-generation
# ... etc

1. Write code
2. Use Code Review Skill → identify issues
3. Use Refactoring Skill → improve structure
4. Use Test Generation Skill → create tests
5. Stage changes
6. Use Commit Automation Skill → write message
7. Create pull request
8. Use PR Review Skill → check quality
9. Use Security Audit Skill → verify safety
10. Deploy using Deployment Automation Skill