Defensive security toolkit — scan, harden, monitor, and comply for Linux endpoints. Go binary with 41 scanners, 17 external tool integrations, 20 defense playbooks, AI copilot recommendations.

Tool-orchestrated penetration testing. Coordinates free external tools (nmap, nuclei, sqlmap, ffuf, Caido, mitmproxy, ZAP, dalfox, jwt_tool, semgrep, trivy) via specialized agents. Executors never attack directly — they run tools, parse output, and chain results. Use for engagement planning, automated scanning, and manual-assisted security testing.

Use when a user wants to build, launch, grade, or schedule a Claude Managed Agent (CMA) in their own Anthropic account — "build me an agent", "launch this as a managed agent", "run this on a schedule", "grade my agent against a rubric", "set up a nightly worker". Reads the per-session goal (./my-agent/goal.json), routes deterministically to one of five phase sub-skills (interview → stage-launch → grade-iterate → run-without-you → wrap-up) via goal_router.py, and compiles the goal+phase into an execution shape (single-pass workflow / bounded grade→iterate loop / recurring cron deployment loop) via loop_compiler.py. Forks context so heavy intake (build sheets, payloads, eval cases) stays out of the parent thread. All launches are emitted as BYOK curl the user runs with their own key; no tool makes API calls. Inspired by anthropics/launch-your-agent (Apache-2.0). Distinct from engineering/agent-harness (generic domain loop) and engineering/write-a-skill (authors Claude Code skills, not CMAs).

Adversarial code review that breaks the self-review monoculture. Use when you want a genuinely critical review of recent changes, before merging a PR, or when you suspect Claude is being too agreeable about code quality. Forces perspective shifts through hostile reviewer personas that catch blind spots the author's mental model shares with the reviewer.

Accessibility audit skill for scanning, fixing, and verifying WCAG 2.2 Level A and AA compliance across React, Next.js, Vue, Angular, Svelte, and plain HTML codebases. Use when auditing accessibility, fixing a11y violations, checking color contrast, generating compliance reports, or integrating accessibility checks into CI/CD pipelines.

Start a session to write or improve a kit skill. A user-started orchestrator.

Design, build, document, and ship SDKs. Use when creating a client library, planning a breaking change, or reviewing SDK quality. It does not build a CLI (that's `devrel-tooling`) or an MCP server (that's `mcp-server-craft`).

Apply 80/20 fp-ts in TypeScript and skip FP when it hurts readability. Use when choosing pipe, Option, or Either, or deciding whether FP helps the code. It does not apply named community styles (that's `code-style-patterns`).

Design and restructure Claude Code plugins. Use when applying the five restructure principles, adding agents, or packaging a plugin. It does not write a kit SKILL.md (that's `skill-craft`).

Build MCP servers an agent can call. Use when designing tools, choosing stdio vs Streamable HTTP, or hardening an MCP server. It does not design a generic SDK (that's `sdk-craft`).

Use when testing scenario coverage in review tier 3.

Build developer CLIs and API collections. Use when adding commands, completions, or generating a Postman collection from routes. It does not design the SDK API (that's `sdk-craft`).

Use when you need a full-spec example with rich frontmatter, dynamic injection and substitutions.

Apply community code styles from shadcn, sindresorhus, or ahmadawais. Use when the user names those styles or wants a community pattern applied to code. It does not design plugins (that's `plugin-craft`).

Ask which kit skill or flow fits the situation. A router over the skills in this kit.

Use when testing doraval validate and drift commands.

Audit sidebar labels and order as a developer journey. Use when nav is alphabetical, labels are nouns, or groups need sentence case. It does not write page copy (that's `docs-writing-style`).

A skill without activation trigger phrases.

Author and review freeCodeCamp /news tutorials. Use when writing an fCC tutorial, a Hashnode draft, or a dual-submit checklist. It does not set kit house voice (that's `docs-writing-style`).

Export a docs style prompt or review a draft against the house rubric. Use when handing off voice to an agent or checking a docs draft. It does not place the page (that's `docs-contribution-router`).