A collection of AI agent skills for software engineering workflows — code quality reviews, living documentation, and security audits. Built for developers and engineering teams who want Claude Code to apply expert-level analysis to their codebases.
Skills are Markdown files that give AI agents specialized knowledge, workflows, and output templates for specific tasks. When installed, Claude Code recognizes relevant requests and applies the skill automatically — no manual prompting required.
These skills form a continuous improvement loop for your codebase:
graph LR
Diagnose["🔍 Diagnose<br/>software-evaluation<br/>vulnerability-scan<br/>data-validation"]
Visualize["📊 Visualize<br/>progress-dashboard"]
Register["📋 Register Issues<br/>report-to-issues"]
Draft["✍️ Draft Issue<br/>gh-issue-drafter"]
Plan["🧠 Plan<br/>gh-issue-planner"]
Resolve["🛠️ Resolve + Verify<br/>gh-issue-resolver"]
Idea["💡 Rough idea<br/>(hand-written)"] -- "Loose 'what I want'" --> Draft
Diagnose -- "Reports + JSON" --> Visualize
Diagnose -- "Reports" --> Register
Register -- "GitHub Issues" --> Plan
Draft -- "Scoped GitHub Issue" --> Plan
Plan -- "Agreed plan comment" --> Resolve
Resolve -- "Re-run diagnosis on the diff" --> Diagnose
Diagnose -- "Regressions only" --> Resolve
Resolve -- "PR + Code Changes" --> Done["✅ Verified PR"]
Visualize -. "Track trends" .-> Done
The Resolve ⇄ Diagnose arrows are the autonomous verification loop: gh-issue-resolver
re-runs the diagnosis on its own diff, fixes the findings it caused, and re-checks — up to
3 iterations, never outside the agreed plan's impact scope. Findings that predate the change
are handed to report-to-issues instead of being fixed in the same PR.
| Step | Skill | What happens |
|---|---|---|
| Diagnose | software-evaluation, vulnerability-scan, data-validation |
Evaluate code quality, security, and data correctness. The first two produce reports + JSON summaries; data-validation is session-output only by design |
| Visualize | progress-dashboard |
Generate an interactive HTML dashboard from JSON summaries to track improvement trends |
| Register | report-to-issues |
Parse reports, deduplicate against existing issues, create GitHub Issues |
| Draft | gh-issue-drafter |
Turn a rough, hand-written intent into a scoped Issue (Done / Out of scope / Design constraints) — the human-authored entry point into the cycle |
| Plan | gh-issue-planner |
Investigate the issue, propose a structured response plan, post the agreed plan as an issue comment |
| Resolve | gh-issue-resolver |
Pick up the agreed plan comment, create a branch, implement, run tests, open a PR |
| Verify | gh-issue-resolver (Step 8) |
Re-run the triggered diagnoses on the diff, attribute each finding, autonomously fix the regressions this change caused, and hand pre-existing findings to report-to-issues. Bounded to 3 iterations and the agreed plan's impact scope |
Note:
spec-docis independent of this cycle — use it anytime to generate or sync living documentation.
| Skill | Description |
|---|---|
| spec-doc | Generate or sync a "Living Specification" from source code to eliminate doc-code drift. Use when creating, updating, or reviewing architecture documentation for a directory or module. |
| software-evaluation | Evaluate code quality across five pillars (Architecture, Reliability, Observability, Security, DX) and produce a 1–10 scorecard with a strategic improvement roadmap. |
| vulnerability-scan | Run an OWASP-based offensive security audit using Semgrep and produce a read-only vulnerability report with severity ratings and remediation recommendations. |
| data-validation | Validate data read from the project's own fixtures or an explicitly configured non-production connection — record counts, NULL rates, distribution, uniqueness, referential integrity, and format validity — with sampled evidence rows and regression attribution. Read-only; produces no JSON. |
| report-to-issues | Parse reports from software-evaluation or vulnerability-scan, interactively select tasks, and register them as GitHub Issues using the gh CLI. |
| gh-issue-drafter | Turn a rough, hand-written intent into a well-scoped GitHub Issue. Proposes the missing Done definition, Out of scope, and Design constraints for user approval, then files the Issue with a scoped-issue marker that gh-issue-planner recognizes. |
| gh-issue-planner | Fetch a GitHub Issue by ID, investigate related code, propose a structured response plan (approach, impact scope, implementation steps), and post the agreed plan as an issue comment. Implementation is out of scope. |
| gh-issue-resolver | Implement and verify a fix for a GitHub Issue whose response plan has already been posted as a comment by gh-issue-planner. Creates a branch, applies the agreed plan, runs tests, opens a Pull Request, then re-runs the diagnosis and autonomously fixes the regressions its own change caused. |
| progress-dashboard | Generate an interactive HTML dashboard that visualizes quality scores and security findings over time from JSON summaries. |
npx skills add ymd38/dev-skillsThis automatically installs all skills to your project's .claude/skills/ directory.
To install a single skill:
npx skills add ymd38/dev-skills --skill spec-docCopy any skill directory into your project:
cp -r skills/spec-doc .claude/skills/spec-docOr copy all skills at once:
cp -r skills/* .claude/skills/Add as a submodule to keep skills up to date with upstream changes:
git submodule add https://github.com/ymd38/dev-skills.git .claude/dev-skillsThen reference skills from .claude/dev-skills/skills/.
Once installed, describe your task naturally and the relevant skill is applied automatically:
"Generate a spec for src/api/"
→ Uses spec-doc skill
"Review the code quality of src/backend/"
→ Uses software-evaluation skill
"Scan src/ for security vulnerabilities"
→ Uses vulnerability-scan skill
"Check the data quality of db/" / "データ検証して" / "NULL率を調べて"
→ Uses data-validation skill
"Create GitHub Issues from docs/evaluation/myapp.20260406.md"
→ Uses report-to-issues skill
"Turn this into an issue" / "ざっくり書くのでIssueにして"
→ Uses gh-issue-drafter skill
"Plan issue #42" / "Issue #42の対応方針を立てて"
→ Uses gh-issue-planner skill
"Implement issue #42" / "Issue #42を実装して"
→ Uses gh-issue-resolver skill (requires an agreed plan comment from gh-issue-planner)
"Generate a progress dashboard" / "Show improvement trends"
→ Uses progress-dashboard skill
You can also invoke skills directly:
/spec-doc src/
/software-evaluation src/backend/
/vulnerability-scan src/
/data-validation db/
/report-to-issues docs/evaluation/myapp.20260406.md
/gh-issue-drafter
/gh-issue-planner
/gh-issue-resolver
/progress-dashboard
spec-doc— Generates a machine-readable "Living Specification" (docs/spec.md) from source code. Covers architecture, interfaces, data models, state transitions, and development constraints. Syncs with existing specs rather than replacing them.
software-evaluation— Scores a codebase across five pillars with evidence-based findings (file:line citations required). Produces a prioritized roadmap with P0–P3 action items.
vulnerability-scan— Combines automated Semgrep scanning with a manual review checklist covering OWASP Top 10. Triages true positives from false positives and includes a dependency CVE audit.
data-validation— Checks record counts, NULL rates (including empty strings, zero values, and sentinels), value distribution, uniqueness, referential integrity, and format validity. Reads only from the project's own fixtures/seeds or an explicitly configured non-production connection — never a guessed or production source. Every finding carries up to 5 sampled rows with PII masked, and every expectation is traced back to a schema constraint, type definition, or test assertion. Classifies each finding asregression/pre-existing/environmentalsogh-issue-resolverknows what it is allowed to fix. Writes no JSON and, by default, no file at all — routine validation should not grow the commit target.
progress-dashboard— Reads JSON summaries fromsoftware-evaluationandvulnerability-scan, then generates a self-contained HTML dashboard with quality score trends, radar charts, security findings trends, roadmap progress, and dependency risk panels.
report-to-issues— Decomposes evaluation or security-audit reports into actionable tasks, presents them for user selection, and registers the chosen items as GitHub Issues with appropriate labels and priority.gh-issue-drafter— Takes a loose, hand-written "what I want" and drafts the structure it almost always lacks (machine-checkable 完了条件, 触らない範囲, optional 設計方針). After author approval, files the Issue tagged with<!-- gh-issue-drafter:scoped-issue -->sogh-issue-plannertreats the scope as binding. The human-authored counterpart toreport-to-issues.gh-issue-planner— Fetches a GitHub Issue viaghCLI, classifies it (bug/feature/refactor/docs), searches related code, and presents a structured plan (approach, impact scope, steps, open questions). Posts the agreed plan as an issue comment tagged with<!-- gh-issue-planner:agreed-plan -->.gh-issue-resolver— Picks up the agreed plan comment posted bygh-issue-planner, creates a feature branch, applies the changes, runs tests, opens a Pull Request, and verifies the fix against the original issue. Verification is autonomous: it re-runs whichever diagnoses the diff triggers, attributes each finding against the base branch, and fixes theregression-class findings itself — bounded to 3 iterations and to the agreed plan's impact scope, returning togh-issue-plannerwhen it hits either wall.pre-existingfindings are never fixed in the same PR; they are offered toreport-to-issues.
Sample dashboard generated from 3 months of evaluation and security scan data. Open
examples/progress-dashboard/dashboard.htmlin a browser to try it interactively.
The examples/progress-dashboard/ directory contains working sample data:
| File | Description |
|---|---|
evaluation/my-app.*.json |
3 months of software-evaluation JSON summaries (Feb–Apr 2026) |
security-audit/my-app.*.json |
3 months of vulnerability-scan JSON summaries (Feb–Apr 2026) |
dashboard.html |
Self-contained HTML dashboard with Chart.js — open in any browser |