Internal reference · Claude Code
The skills worth reaching for while a project is under construction, laid out in the order a project actually meets them. Everything here is installed and callable today.
Three commands, in this order, every time.
/diff-review
Bugs only. Every finding arrives with the input that breaks it.
/simplify
Now make it clean. Applies its own fixes, no bug hunting.
git commit
Freshest context, cheapest fix. Two minutes, not two days.
Order matters. A bug found before you tidy is a small fix; reverse the two and you refactor around a defect. Add /security-review to the chain whenever the diff touches auth, payments, uploads, or anything that accepts user input.
Before the first real commit
Reads the codebase and writes a CLAUDE.md — the instructions every future session in this repo loads automatically.
When First thing in any repo you'll return to. Re-run it after a big architectural shift.
Builds and sharpens the project's vocabulary — a CONTEXT.md, agreed terminology, and ADRs recording why a decision went the way it did.
When The same concept has three names across the codebase, or you're about to make a decision you'll be asked to justify in six months.
Interrogates a plan or an idea relentlessly instead of agreeing with it. Adversarial by design.
When Before you build the thing, not after. Cheapest possible moment to find out the approach is wrong.
Scans your transcripts for the read-only commands you keep approving, then writes an allowlist into the project's .claude/settings.json.
When A week into a project, once the approval fatigue is real and the pattern is obvious.
Your deepest bench — pick by job, not by name
The reference library: 79 styles, 192 product palettes, 74 font pairings, 119 UX guidelines, 25 chart types, 22 stacks. Searchable local data, not vibes.
When You need a decision grounded in something — a palette for a fintech dashboard, a font pairing that isn't Inter, a stack-specific implementation pattern.
Critique and polish for an interface that already exists — hierarchy, cognitive load, spacing, motion, empty states, error copy, accessibility.
When The screen works but feels off, or it's too loud and should get quieter, or too bland and should get bolder.
Anti-slop frontend for landing pages, portfolios and redesigns. Audits first on a redesign, then ships something that doesn't look templated.
When The page is public-facing and the generic-AI-website look would cost you the client.
The implementation layer — shadcn/ui on Radix + Tailwind, accessible dialogs, dropdowns, forms, tables, theming and dark mode.
When The direction is settled and you're writing the actual components.
Three-layer token architecture (primitive → semantic → component), CSS variables, spacing and type scales, component specs.
When The project has more than a handful of screens and the hex codes have started drifting.
Read before writing the first line of chart code, in any medium — Recharts, D3, matplotlib, inline SVG. Covers form heuristics, an accessible colour formula with a validator, and dashboard layout.
When Any chart, KPI tile, sparkline or dashboard. Especially the CRM and trading work.
The umbrella identity skill — logos (55 styles), full corporate identity programs, mockups, banners, icons, social images, HTML slide decks.
When A project needs an identity rather than an interface. brand, banner-design and slides sit underneath it for narrower jobs.
Read these before the code, not after the bug
Current model IDs, pricing, params, streaming, tool use, MCP, prompt caching. Loads the real numbers instead of trusting a training cutoff.
When Anything LLM-shaped — agents, MCP servers, tool definitions, RAG, summarising, classification. Never answer a pricing or model-choice question from memory.
Platform-wide entry point: Workers, Pages, KV, D1, R2, Vectorize, WAF, Terraform. Retrieves live docs rather than recalling them.
When You don't yet know which Cloudflare primitive the problem wants.
Audits Worker code against production practice — streaming, floating promises, global state, secrets, bindings, observability.
When Any Worker you intend to deploy. Pairs naturally with wrangler for the CLI side.
Stateful coordination — rooms, sessions, bookings, alarms, SQLite storage, WebSockets — and the Agents SDK layer for durable agents and workflows on top.
When Two clients need to see the same state, or a job has to survive a restart.
End-to-end CAPTCHA: scans the project, creates the widget via API, embeds it, and wires server-side siteverify into your existing backend.
When A public form, signup or comment box starts attracting bots.
Launches the actual app and drives it, so a change is confirmed in the real thing rather than in a passing test.
When You want to see it work. Screenshots included.
Four tools, four different jobs
Correctness bugs only — off-by-one, null gaps, missing await, races, swallowed errors, leaks. Nothing reported without a reproducible failure scenario. Reports; never edits.
When Right before every commit. The strictest, shortest review you have.
Bugs and reuse/simplification/efficiency, at a chosen effort level — low and medium for fewer high-confidence findings, high and max for wider coverage. Takes a PR number, branch or path. --fix applies findings, --comment posts them inline on the PR.
When Reviewing a PR, or sweeping wider than a single commit's diff.
Quality only — reuse, simplification, efficiency, altitude — and it applies the fixes rather than listing them. Explicitly does not hunt bugs.
When It works, but it's messy. Always after the bug pass, never before.
A dedicated security pass over the branch's pending changes — auth, injection, secrets, data exposure.
When The diff touches authentication, payments, file uploads, or any untrusted input.
Deep multi-agent review running in the cloud, on the branch or a GitHub PR. Billed separately, and only you can launch it.
When The change is large or high-stakes enough to justify the spend. Not a routine pass.
After the first deploy
Real Core Web Vitals via Chrome DevTools — LCP, INP, CLS, render-blocking resources, network dependency chains, layout shifts, caching, accessibility gaps.
When The site is live and something feels slow. Measures rather than guesses.
Creates cloud agents that run on a cron schedule, or a single run at a set time. Survives your laptop being shut.
When A nightly check, a morning digest, a recurring audit.
Re-runs a prompt or slash command on an interval inside the current session. Drop the interval and it paces itself.
When Watching a deploy or a long build. Not for one-off tasks.
Edits settings.json — permissions, env vars, and hooks. Anything phrased "from now on, whenever X" needs a hook, because the harness runs those, not the model.
When You want automatic behaviour rather than a remembered preference.
Tallies dev, design, PM and QA hours with NZD value, across every project. A global command rather than a skill.
When Invoicing, or working out what a build actually cost.