Expert-level rules for producing and auditing production .NET. The runtime is memory-safe, so risk concentrates in **injection, deserialization, async correctness, and dependency supply chain**. Baseline: **.NET 10 LTS** (released Nov 2025, supported to Nov 2028) and **C# 14** (records, nullable ref

Expert rules for building and auditing **production machine-learning systems** — the lifecycle that turns a model into a reliable, monitored, governed service. This is **classical/predictive ML** (tabular, ranking, vision, forecasting, recommendation): training pipelines, feature stores, model reg

Expert-level rules for building new mobile apps and auditing existing ones. Mobile is unlike web or backend in three load-bearing ways, and every rule in this skill flows from them:

State-of-the-art C and C++ engineering rules (2026 baseline) that Claude applies when writing or auditing C/C++. Covers modern idioms (RAII, value semantics, smart pointers, C++23), memory safety (lifetimes, bounds, sanitizers, hardening flags), undefined behavior, security (SEI CERT C/C++, MISRA, integer/buffer/format-string, injection), concurrency (C/C++ memory model, atomics, data races), build/tooling/CI (CMake, clang-tidy, cppcheck, ASan/UBSan/TSan, vcpkg/Conan, supply chain), and performance. Trigger keywords - C, C++, cpp, RAII, smart pointer, unique_ptr, shared_ptr, undefined behavior, UB, buffer overflow, use-after-free, double-free, sanitizer, ASan, UBSan, TSan, valgrind, CMake, clang-tidy, clang-format, cppcheck, MISRA, CERT C, memory safety, std::thread, atomics, std::move. Use for BOTH building C/C++ libraries/systems and reviewing or auditing them.

State-of-the-art data engineering rules (2026) for building and auditing data pipelines and analytics infrastructure. Covers architecture and modeling (ELT, lakehouse vs warehouse, dimensional models, medallion layering), pipeline and orchestration discipline (idempotency, incremental loads, backfills, dbt-style transformations), streaming and CDC (Kafka, exactly-once reality, schema evolution, Debezium-style capture), data quality and contracts, columnar storage and table-format performance (Parquet, Iceberg, Delta), and pipeline operations/governance. Use when designing, implementing, reviewing, or auditing batch/streaming pipelines, warehouses, or lakehouses. Trigger keywords: data pipeline, ETL, ELT, Kafka, streaming, data warehouse, dbt, Airflow, orchestration, data quality, lakehouse, Iceberg, Delta, CDC, Parquet, backfill, watermark, Spark, DuckDB, data contract, medallion, dimensional model.

State-of-the-art database engineering rules (2026) for designing, building, and auditing data layers. Covers engine selection, schema modeling, migrations, query and index craft, transactions and concurrency, reliability and scale, security, and vector/AI workloads. Use when designing a new data layer, writing or reviewing schemas/migrations/queries, debugging slow or contended database workloads, or auditing an existing database for correctness, performance, and security. Trigger keywords: database, SQL, Postgres, schema, migration, index, query, ORM, transaction, NoSQL, Redis, vector DB, pgvector, replication, partitioning, connection pool, RLS, EXPLAIN, deadlock, sharding, caching, SurrealDB, SurrealQL, Qdrant, multi-model, graph database.

State-of-the-art DevSecOps and software supply chain security (2026). Applies when building or auditing CI/CD pipelines, GitHub Actions workflows, supply chain controls, SBOM generation, SAST/secret-scanning gates, dependency management, container builds, container/artifact registries, IaC (Terraform), GitOps, and deployment strategy. Trigger keywords: CI/CD, pipeline, GitHub Actions, supply chain, SBOM, SAST, dependency, container build, container registry, registry security, Zot, Harbor, ECR, GAR, ACR, GHCR, immutable tags, pull-through cache, IaC, Terraform, deployment, provenance, SLSA, cosign, dependabot, renovate. Use for BOTH setting up new pipelines and auditing existing ones.

State-of-the-art documentation and engineering-collaboration guidance (2026) covering documentation architecture (Diátaxis, docs-as-code, READMEs, runbooks, onboarding, AI-readable docs), API/reference docs and changelogs, and the team workflow around code: pull requests, code review conduct, commit discipline, branching, and releases. Use when writing or structuring any documentation AND when auditing docs quality, and when designing or auditing collaboration workflow. Trigger keywords: documentation, docs, README, API docs, docstring, changelog, release notes, migration guide, code review, pull request, PR description, commit messages, conventional commits, branching, semver, onboarding, runbook, AGENTS.md, llms.txt, spec-driven development, SDD, Spec Kit, Kiro, specification, acceptance criteria, steering files.

State-of-the-art web design, UI/UX, and motion engineering standards (2026). Use when building OR auditing/reviewing user interfaces: components, pages, design systems, stylesheets, themes, forms, navigation, animations, or accessibility. Covers typography, color (OKLCH, dark mode), spacing/layout (grid, container queries, subgrid), design tokens and component APIs, UX patterns (forms, loading/empty/error states, destructive actions), WCAG 2.2 AA accessibility, motion design, and responsive/modern CSS. Trigger keywords: UI, UX, web design, CSS, component, accessibility, a11y, responsive, animation, motion design, design system, layout, typography, dark mode, design tokens, frontend review, WCAG.

State-of-the-art Go engineering rules (2026 baseline, Go 1.25+) that Claude applies when writing new Go code or auditing existing Go code. Covers error handling, interface/package design, goroutine and channel correctness, net/http hardening, security (SQL, exec, path traversal, CSPRNG, TLS, supply chain), performance (pprof, allocations, GC, PGO), and tooling/CI. Trigger keywords - Go, golang, goroutine, channel, go.mod, errgroup, context.Context, pprof, govulncheck, net/http, slog. Use for BOTH building Go services/libraries/CLIs and reviewing or auditing Go codebases.

State-of-the-art JavaScript and TypeScript engineering (2026) for both writing and auditing code. Covers strict TypeScript configuration and type design, language idioms and pitfalls, async patterns, Node.js backends, JS/TS-specific security (XSS, prototype pollution, supply chain, injection), frontend/React and Node performance, and testing/tooling. Use whenever building, reviewing, refactoring, or security-auditing code involving JavaScript, TypeScript, Node, npm, React, frontend code, tsconfig, package.json, vitest, or any .ts/.tsx/.js/.mjs files.

State-of-the-art JVM engineering rules (2026 baseline) for Java and Kotlin that Claude applies when writing or auditing JVM code. Baseline Java 25 LTS (virtual threads final since 21; structured concurrency still preview), Kotlin 2.x. Covers modern idioms (records, sealed types, pattern matching, Kotlin null-safety/coroutines), API/null/immutability design, concurrency (virtual threads, JMM, java.util.concurrent, coroutines), security (deserialization/gadget chains, XXE, JNDI/Log4Shell-class, injection, JCA crypto; SEI CERT Oracle Java + OWASP), performance (G1/ZGC, JFR, GraalVM), and build/tooling/CI (Maven/Gradle, dependency-check, Error Prone/NullAway, SpotBugs, ktlint/detekt). Trigger keywords - Java, Kotlin, JVM, JDK, Spring, record, sealed, virtual thread, Loom, coroutine, suspend, ObjectInputStream, deserialization, XXE, JNDI, Log4Shell, Maven, Gradle, G1, ZGC, GraalVM, JMH, Optional, null-safety. Use for BOTH building JVM services/libraries and reviewing or auditing them.