Memoria jerárquica durable en CLAUDE.md por nivel usuario/equipo/módulo, con frontera explícita frente a la compaction transitoria del transcript.

Code review headless con claude -p output-format json validado contra schema; el humano sigue siendo gate final de merge.

This skill should be used when the user asks to 'create a slash command', 'author a Claude Code command', 'decide command vs skill', 'choose project vs user scope', 'version custom commands for my team', or 'design command frontmatter'. Covers commands/*.md authoring and the command-vs-skill decision; unifies the custom-commands kata with the extension decision tree.

This skill should be used when the user asks to build, audit, or harden a Claude Platform Messages API client-side tool execution loop, handle tool_use and tool_result messages, correlate tool_use_id values, stream partial tool JSON, enforce strict:true schemas, handle stop_reason values, or design retry/error behavior for Anthropic Messages API tools. Do not use it for Claude Code headless CLI or Agent SDK automation, prompt-cache design, MCP server design, tool catalog descriptions, or individual tool implementations.

Use this skill to design, audit, or validate Claude Platform server-tool plans for server-tools, web search, web fetch, code execution, advisor, tool search, or the mechanical server-side portion of programmatic tool calling. It owns server_tool_use/result correlation, pause_turn continuation, versioned definitions, caller/container rules, domain controls, and source-supported privacy, retention, and cost controls. It does not own the application agent loop; route loop ordering and budgets to claude-api-tool-runtime and katas-deterministic-agent-loop.

This skill should be used when the user asks to design, audit, or harden Claude Platform Files API upload/reference/lifecycle flows or PDF document requests using file_id, URL, or base64 document sources. Use it for file metadata, deletion, conditional downloadability, PDF request limits, MIME-to-content-block contracts, and source/platform compatibility. Do not use it for text-editor operations, fetching web pages, generic object storage, document authoring, or arbitrary binary processing.

Use this skill when the user asks to design, audit, or harden Claude Platform Messages API context budgets, token counting, prompt caching, cache diagnostics, context editing, server-side compaction, context-window overflow policy, or mid-conversation system-message modes around a fixed effort setting. Do not use it for tool dispatch correlation, durable memory systems, generic context-writing advice, executor implementation, or Bash ownership.

Few-shot para calibrar bordes subjetivos con 2-4 ejemplos del mismo schema; complementa, no reemplaza, al schema.

Criterios categoricos con ejemplos positivos y negativos por severidad para reducir falsos positivos; disable temporal por categoria.

This skill should be used when the user asks to implement, audit, or harden application-side handlers for Anthropic-defined Claude API client tools: memory, bash, text editor, or computer use; including sandboxing, path containment, command/action allowlists, session state, idempotency, tool_result construction, and execution evidence. Do not use it for Claude Code permissions, Anthropic server tools, MCP, Claude Code headless CLI, Agent SDK automation, or the generic Messages API tool loop.

CI/CD and release engineering: pipeline architecture, multi-environment strategy, deployment rollback (blue-green/canary), code-quality gates, dependency governance, git-hook automation. [EXPLICIT] Trigger: 'ci/cd', 'pipeline', 'rollback', 'canary', 'blue-green', 'release', 'quality gate', 'staging'.

This skill should be used when the user asks to design, configure, audit, or choose Claude Code channels, MCP channel servers, --channels startup flags, external push events, channel plugins, permission relay, or channel-vs-schedule/hook/headless decisions.

BI solution design — semantic layers, dashboard patterns, self-service analytics, KPI frameworks. Use when the user asks to 'design BI architecture', 'build a KPI framework', 'set up self-service analytics', 'design dashboard hierarchy', 'create a semantic layer', or mentions metric trees, drill-down patterns, or reporting strategy. [EXPLICIT]

Generate Gherkin BDD scenarios across all quality angles — functional, accessibility, security, performance, SEO, offline, UI, backend, data, DevSecOps, CI/CD. Runner-agnostic step definitions with traceability to requirements and constitutional principles. [EXPLICIT] Trigger: 'BDD', 'Gherkin', 'Given When Then', 'full-spectrum testing', 'acceptance scenarios'

Guides implementation of AI/GenAI architectures on AWS — Bedrock setup, SageMaker pipelines, OpenSearch vector stores, API Gateway configuration, security hardening, cost controls, and deployment automation. This skill should be used when the user asks to 'implement AI on AWS', 'set up Bedrock', 'deploy SageMaker pipeline', 'configure OpenSearch for RAG', 'implement AWS AI security', 'set up AWS AI monitoring', or mentions AWS AI deployment, Bedrock Knowledge Base setup, SageMaker endpoint deployment, AWS GenAI implementation, or AWS AI CI/CD pipeline. [EXPLICIT]

Use when controlling an agent loop by typed state and budget, including multiple tool_use coordination and Anthropic SDK Tool Runner behavior, never model prose.

Designs AWS cloud architectures for AI and GenAI workloads applying the Well-Architected Framework GenAI Lens (6 pillars: GENOPS, GENSEC, GENREL, GENPERF, GENCOST, GENSUS), AWS service selection matrices, RAG/Agent/Fine-Tuning patterns, cost optimization strategies, and enterprise reference architectures. Activated when designing, evaluating, or migrating AI systems on AWS. [EXPLICIT]

Audits AWS AI/GenAI architectures against the Well-Architected GenAI Lens — operational excellence, security, reliability, performance, cost optimization, and sustainability. This skill should be used when the user asks to 'audit AWS AI architecture', 'review Bedrock configuration', 'assess SageMaker security', 'optimize AWS AI costs', 'evaluate AWS GenAI compliance', 'review AWS Well-Architected for AI', or mentions AWS AI audit, Bedrock audit, SageMaker review, AWS GenAI security assessment, or AWS AI cost optimization review. [EXPLICIT]

This skill should be used when the user asks to publish or share Claude Code artifacts, create a visual or interactive session output, decide whether an Artifact is appropriate, validate artifact source and output contracts, handle artifact privacy, produce share links, or choose between workspace artifacts, Claude Code Artifacts, files, and output styles.

Hands-on application security: authn/authz (OAuth/SAML/IAM), RBAC, input validation and sanitization, CORS, HTTP security headers, rate limiting, and security audit/testing (SAST/DAST). [EXPLICIT] Implementation-level, complements security-architecture (strategy). Trigger: 'app security', 'rbac', 'cors', 'rate limit', 'input sanitization', 'security headers', 'xss'.