security-audit

Cross-language software craftsmanship principles — refactoring, DDD, OOP, TDD, testing, code style — that complement language-specific example skills (php-*, ts-*, etc.)

Transverse git & PR discipline — ref freshness (fetch first), branch/commit/PR conventions, force-push and worktree guardrails. Merges the former PR-creation skill.

NestJS architectural conventions, DDD with NestJS

Runtime security hooks: CLAUDE.md injection scanner (SessionStart) + Bash prompt injection detector (PreToolUse)

PHPUnit testing discipline for PHP projects — TDD workflow (red-green-refactor with cross-layer iterations), test writing conventions (DAMP, AAA, Prophecy, factories). Layers on craft:tdd-workflow-principles and craft:testing-principles for the cross-language baseline; PHPUnit-specific commands and Prophecy examples live here.

Docker, Drizzle ORM, pnpm workspaces, Zod schemas, Claude Code plugin conventions, npx skills conventions

Marketing analytics — tracking setup (GA4/GTM/UTM/tracking plan), Google Analytics Data API reporting, Google Search Console reporting.

Cherry-picked obra/superpowers skills: verification-before-completion (evidence before claims), systematic-debugging (root-cause-first)

TypeScript conventions, typing, DDD events, functional programming, OOP, refactoring

Reverse-engineer an unfamiliar or legacy codebase into a versioned knowledge base (shared brain): recon + git archaeology, architecture map, use cases aggregated by actor goal, entity model, risk register. Two depths: onboarding (dev) and audit-prep (security-surface dossier feeding the security-audit skills). Run via the legacy:discovery skill.