Build Skills from Scratch

Place additional SKILL.md files here for sub-agents. Useful when your skill orchestrates multiple specialised steps — for example, one agent that extracts data and another that formats a report.

Store images, icons, CSV data files, or any binary resource your skill references. Claude can read these via bash and include them in generated artifacts.

Evaluation tooling — scripts and config that let you run automated tests against your skill and view results. Particularly useful when iterating on skill quality.

Extra Markdown files with deep documentation, API schemas, style guides, or large reference tables. Claude reads these only when SKILL.md tells it to — zero context cost otherwise.

Executable Python, shell, or Node scripts that Claude runs via bash. Script code never enters the context window — only the output does. Great for deterministic operations like data validation or file conversion.

Include a licence file if you plan to share or publish your skill. Anthropic uses MIT for their open-source skills. Not required for private or internal skills.

---
name: code-review-assistant
description: >
  Reviews Python or JavaScript code for bugs, security issues,
  and style problems. Use when the user shares code and asks for
  a review, feedback, or asks to check the code.
---

# Code Review Assistant

## Goal
Identify real problems in the code — not cosmetic preferences.
Produce a structured review a developer can act on immediately.

## Output structure
1. **Summary** — one sentence on overall code quality.
2. **Issues found** — table: | # | Severity | Location | Issue | Fix |
3. **Positives** — 2-3 things done well (keep reviews balanced).
4. **Recommended next step** — single highest-priority action.

## Severity levels
- Critical — security flaw or data loss risk
- High     — likely to cause bugs in production
- Medium   — incorrect but non-critical logic
- Low      — style, naming, minor improvements

## Guidelines
- Reference the exact line or function name, not vague locations.
- Suggest a concrete fix, not just "this is wrong".
- If using a reference file, read references/patterns.md first.
- Keep the tone constructive, not critical of the author.

# Secure Coding Patterns

## Input validation
Always validate and sanitise external input before use.
- Reject unexpected types early (type checks at boundaries).
- Use allow-lists, not block-lists, for string validation.

## SQL queries
Never interpolate user input directly into queries.
Prefer parameterised queries or an ORM.

## Secrets
Never log, print, or include secrets in error messages.
Use environment variables; never hardcode credentials.

#!/usr/bin/env python3
"""
validate_syntax.py
Checks Python files for syntax errors before review.
Claude runs this via bash; only the output enters context.
"""
import ast, sys

def validate(path: str) -> None:
    with open(path) as f:
        source = f.read()
    try:
        ast.parse(source)
        print(f"OK: {path} — no syntax errors")
    except SyntaxError as e:
        print(f"ERROR: {path} — line {e.lineno}: {e.msg}")
        sys.exit(1)

if __name__ == "__main__":
    for p in sys.argv[1:]:
        validate(p)