supabase
Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...
spec-gathering
Requirements gathering workflow for specification creation. Use when starting a new feature, task, or project that needs structured requirements.
Full skill instructions
Gather user requirements through structured questioning and produce a validated requirements document. This skill transforms vague task descriptions into actionable, structured requirements.
Core principle: Ask smart questions, produce valid structured output. Nothing else.
Always:
Exceptions:
NO SPEC WRITING WITHOUT VALIDATED REQUIREMENTS FIRST
Requirements must be confirmed by the user before proceeding to spec creation.
Understand the project structure before engaging the user.
Steps:
# Read project structure
cat .claude/context/product.md 2>/dev/null || echo "No product context"
cat .claude/context/tech-stack.md 2>/dev/null || echo "No tech stack"
If a task description was provided, confirm it:
"I understand you want to: [task description]. Is that correct? Any clarifications?"
If no task was provided, ask:
"What would you like to build or fix? Please describe the feature, bug, or change you need."
Wait for user response.
Based on the task, determine the workflow type:
| If task sounds like... | Workflow Type |
|---|---|
| "Add feature X", "Build Y" | feature |
| "Migrate from X to Y", "Refactor Z" | refactor |
| "Fix bug where X", "Debug Y" | investigation |
| "Migrate data from X" | migration |
| Single service, small change | simple |
Ask to confirm:
"This sounds like a [workflow_type] task. Does that seem right?"
Based on the project context and task, suggest affected areas:
"Based on your task and project structure, I think this involves:
- [service1] (primary) - [why]
- [service2] (integration) - [why]
Any other services or areas involved?"
Wait for confirmation or correction.
Before gathering requirements manually, use the context-compressor skill (progressive disclosure mode) to optimize the clarification process:
Skill({
skill: 'context-compressor',
context: {
taskDescription: taskDescription,
projectContext: projectContext,
services: identifiedServices,
mode: 'progressive-disclosure',
},
});
Context-Compressor (progressive disclosure mode) performs:
Returns:
Ask only the critical clarification questions identified by context-compressor:
Budget: 3-5 clarification questions maximum
Process:
Ask CRITICAL priority questions first (security, data loss, breaking changes)
Ask HIGH priority questions if budget remains (UX, architecture, scalability)
For MEDIUM/LOW priorities, use [ASSUMES:] notation with defaults
Collect answers and document all assumptions.
Summarize what you understood, including clarified requirements and assumptions:
"Let me confirm I understand:
Task: [summary] Type: [workflow_type] Scope: [list of affected areas]
Clarified Requirements (questions asked):
- ✅ [Question] → [Answer]
- ✅ [Question] → [Answer]
- ✅ [Question] → [Answer]
Smart Defaults Applied (not asked due to budget or clarity):
[ASSUMES: X] [ASSUMES: Y] [ASSUMES: Z]
Success Criteria:
- [criterion 1]
- [criterion 2]
Is this correct?"
Wait for confirmation. If user objects to any assumption, allow them to override or request adjustment.
After confirming requirements and assumptions with user, map gathered data to template tokens:
const tokens = {
// Required tokens
FEATURE_NAME: gatheredRequirements.taskName,
VERSION: '1.0.0',
AUTHOR: 'Claude',
DATE: new Date().toISOString().split('T')[0],
STATUS: 'draft',
// Required: Acceptance criteria (minimum 1, maximum 50)
ACCEPTANCE_CRITERIA_1: gatheredRequirements.criteria[0] || '[Define acceptance criterion 1]',
ACCEPTANCE_CRITERIA_2: gatheredRequirements.criteria[1] || '[Define acceptance criterion 2]',
ACCEPTANCE_CRITERIA_3: gatheredRequirements.criteria[2] || '[Define acceptance criterion 3]',
// Optional tokens (can be empty strings if not gathered)
TERM_1: gatheredRequirements.terms?.[0] || '',
TERM_2: gatheredRequirements.terms?.[1] || '',
TERM_3: gatheredRequirements.terms?.[2] || '',
HTTP_METHOD: gatheredRequirements.httpMethod || '',
ENDPOINT_PATH: gatheredRequirements.endpointPath || '',
PROJECT_NAME: gatheredRequirements.projectName || 'Agent Studio',
// Assumptions from context-compressor (optional but recommended)
ASSUMPTIONS_MADE: gatheredRequirements.assumptions.map(a => `- ${a}`).join('\n') || '',
CLARIFICATIONS_ASKED: gatheredRequirements.clarifications || 0,
};
Validation Before Rendering:
Invoke the template-renderer skill to create the specification:
Skill({
skill: 'template-renderer',
args: {
templateName: 'specification-template',
outputPath: `.claude/context/artifacts/specifications/${featureNameSlug}-spec.md`,
tokens: tokens,
},
});
Output Location: .claude/context/artifacts/specifications/[feature-name]-spec.md
Post-Rendering Verification:
# Check file created
SPEC_FILE=".claude/context/artifacts/specifications/[feature-name]-spec.md"
test -f "$SPEC_FILE" && echo "✓ Spec created" || echo "✗ Spec creation failed"
# Check no unresolved tokens
grep -E '[{]{2}' "$SPEC_FILE" && echo "✗ Unresolved tokens found" || echo "✓ All tokens resolved"
# Check YAML frontmatter valid
YAML_COUNT=$(head -50 "$SPEC_FILE" | grep -E "^---$" | wc -l)
test "$YAML_COUNT" -eq 2 && echo "✓ YAML valid" || echo "✗ YAML invalid"
Before completing requirements gathering:
Why it's wrong: Assumptions lead to building the wrong thing.
Do this instead: Ask clarifying questions. Confirm understanding.
Why it's wrong: User may have misunderstood your summary.
Do this instead: Always summarize and wait for explicit confirmation.
Why it's wrong: "Make it better" is not actionable.
Do this instead: Get specific: What behavior? What outcome? How to verify?
This skill works well with:
Workflow Chain:
spec-gathering (→ context-compressor in Phase 4.5) → template-renderer → spec-critique → planner
Context-Compressor Integration Details (Progressive Disclosure Mode):
Input: "Add user authentication to the app"
Process:
Confirm task: "You want to add user authentication. Is this correct?"
Invoke context-compressor in progressive disclosure mode (Phase 4.5):
Skill({
skill: 'context-compressor',
context: {
taskDescription: "Add user authentication",
projectContext: {...},
mode: 'progressive-disclosure'
}
});
Context-compressor returns:
CRITICAL questions (3 asked of 5 budget):
Assumptions applied (with [ASSUMES:]):
Identify scope: "This will touch the backend API, database, and frontend login page."
Define success criteria based on clarifications and defaults
Map to tokens:
{
FEATURE_NAME: "User Authentication",
VERSION: "1.0.0",
AUTHOR: "Claude",
DATE: "2026-01-28",
STATUS: "draft",
ACCEPTANCE_CRITERIA_1: "Users can sign up with email and password",
ACCEPTANCE_CRITERIA_2: "Email verification required before login",
ACCEPTANCE_CRITERIA_3: "Users can reset password via email link",
ACCEPTANCE_CRITERIA_4: "Role-based access control working (Admin/User/Guest)",
ASSUMPTIONS_MADE: "- JWT tokens with 1-hour expiry\n- bcrypt cost factor 12\n- HTTPS required",
CLARIFICATIONS_ASKED: 3
}
Skill({
skill: 'template-renderer',
args: {
templateName: 'specification-template',
outputPath: '.claude/context/artifacts/specifications/user-authentication-spec.md',
tokens: tokens,
},
});
Output:
.claude/context/artifacts/specifications/user-authentication-spec.mdInput: "The page loads slowly"
Process:
Output: Investigation requirements with specific pages, metrics, and success criteria.
Symptoms: "Yes", "No", "That's fine" without detail.
Solution: Ask more specific questions. Provide options: "Would you prefer A, B, or C?"
Symptoms: Every answer adds new features.
Solution: Document "Out of Scope" explicitly. Confirm: "Should we include this in this task or save for later?"
| Anti-Pattern | Why It Fails | Correct Approach |
|---|---|---|
| Vague requirements ("make it fast") | Not measurable or testable | Specify exact metrics: "P95 response time <100ms" |
| Missing NFRs | Quality attributes forgotten until too late | Always capture performance, security, scalability requirements |
| No out-of-scope section | Scope creep during implementation | Explicitly document what this task does NOT include |
| Skipping user confirmation | Requirements misunderstood and implemented incorrectly | Confirm all requirements with the user before handoff |
| No edge cases documented | Error handling gaps discovered during QA | Document empty input, bad data, timeout, and concurrent access cases |
Before starting:
Read .claude/context/memory/learnings.md
After completing:
.claude/context/memory/learnings.md.claude/context/memory/issues.md.claude/context/memory/decisions.mdASSUME INTERRUPTION: If it's not in memory, it didn't happen.
Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...
Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.
Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.
Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.
Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.
Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".
Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
Send, read, and manage Gmail messages, drafts, labels, and account settings.
Comprehensive website auditing across 230+ rules in 21 categories including SEO, performance, security, and accessibility.
Shared authentication, CLI syntax, and output formatting patterns for gws Google Workspace commands.
Discover your celebrity doppelgänger with StarByFace!
GeoSpy: Pricing, Features, FAQs, and Alternatives for AI Teams
Detect AI-generated voices to protect against audio fraud.
Ensure Your Content's Originality with AI Plagiarism Checker
Upscale images by 400% without quality loss
Protect your social media from copyright disputes
Accurately Detect AI-Generated Content with TheChecker.AI
Chrome extension that detects and flags AI-generated content