Company Architect: builds a business from scratch as an OKF (Open Knowledge Format) bundle — a tree of version-controllable .md files with frontmatter type, links forming a graph, and reserved index.md/log.md, readable by humans and agents. Guides the founder through a 12-phase interview (foundation, strategy, market, financial, sales, marketing, product, operations, tech, people, legal, governance), one phase at a time, few questions per block, and generates the concepts as conformant markdown. Trigger when the user wants to create, structure, or document an entire company in folders and .md files; when they mention build my company from scratch, company as code, company knowledge base for AI to read, company wiki for agents, OKF, or knowledge bundle. In English.

/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS.

Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.

/cs:ai-act-readiness <system> — EU AI Act 6-question forcing interrogation. Use during AI-system intake, before EU deployment, or during annual compliance refresh as Article 113 obligations phase in (2025-02-02 / 2025-08-02 / 2026-08-02 / 2027-08-02).

Inter-agent communication protocol for C-suite agent teams. Defines invocation syntax, loop prevention, isolation rules, and response formats. Use when C-suite agents need to query each other, coordinate cross-functional analysis, or run board meetings with multiple agent roles.

Defensive security toolkit — scan, harden, monitor, and comply for Linux endpoints. Go binary with 41 scanners, 17 external tool integrations, 20 defense playbooks, AI copilot recommendations.

Tool-orchestrated penetration testing. Coordinates free external tools (nmap, nuclei, sqlmap, ffuf, Caido, mitmproxy, ZAP, dalfox, jwt_tool, semgrep, trivy) via specialized agents. Executors never attack directly — they run tools, parse output, and chain results. Use for engagement planning, automated scanning, and manual-assisted security testing.

Use when a user wants to build, launch, grade, or schedule a Claude Managed Agent (CMA) in their own Anthropic account — "build me an agent", "launch this as a managed agent", "run this on a schedule", "grade my agent against a rubric", "set up a nightly worker". Reads the per-session goal (./my-agent/goal.json), routes deterministically to one of five phase sub-skills (interview → stage-launch → grade-iterate → run-without-you → wrap-up) via goal_router.py, and compiles the goal+phase into an execution shape (single-pass workflow / bounded grade→iterate loop / recurring cron deployment loop) via loop_compiler.py. Forks context so heavy intake (build sheets, payloads, eval cases) stays out of the parent thread. All launches are emitted as BYOK curl the user runs with their own key; no tool makes API calls. Inspired by anthropics/launch-your-agent (Apache-2.0). Distinct from engineering/agent-harness (generic domain loop) and engineering/write-a-skill (authors Claude Code skills, not CMAs).

Adversarial code review that breaks the self-review monoculture. Use when you want a genuinely critical review of recent changes, before merging a PR, or when you suspect Claude is being too agreeable about code quality. Forces perspective shifts through hostile reviewer personas that catch blind spots the author's mental model shares with the reviewer.

Accessibility audit skill for scanning, fixing, and verifying WCAG 2.2 Level A and AA compliance across React, Next.js, Vue, Angular, Svelte, and plain HTML codebases. Use when auditing accessibility, fixing a11y violations, checking color contrast, generating compliance reports, or integrating accessibility checks into CI/CD pipelines.

Start a session to write or improve a kit skill. A user-started orchestrator.

Design, build, document, and ship SDKs. Use when creating a client library, planning a breaking change, or reviewing SDK quality. It does not build a CLI (that's `devrel-tooling`) or an MCP server (that's `mcp-server-craft`).

Apply 80/20 fp-ts in TypeScript and skip FP when it hurts readability. Use when choosing pipe, Option, or Either, or deciding whether FP helps the code. It does not apply named community styles (that's `code-style-patterns`).

Design and restructure Claude Code plugins. Use when applying the five restructure principles, adding agents, or packaging a plugin. It does not write a kit SKILL.md (that's `skill-craft`).

Build MCP servers an agent can call. Use when designing tools, choosing stdio vs Streamable HTTP, or hardening an MCP server. It does not design a generic SDK (that's `sdk-craft`).

Use when testing scenario coverage in review tier 3.

Build developer CLIs and API collections. Use when adding commands, completions, or generating a Postman collection from routes. It does not design the SDK API (that's `sdk-craft`).

Use when you need a full-spec example with rich frontmatter, dynamic injection and substitutions.

Apply community code styles from shadcn, sindresorhus, or ahmadawais. Use when the user names those styles or wants a community pattern applied to code. It does not design plugins (that's `plugin-craft`).

Ask which kit skill or flow fits the situation. A router over the skills in this kit.