ericfitz

ericfitz/skills

Plugin Claude Code

efitz's personal Claude Code skills, commands, and tools.

ericfitz/skills

Instructions file

Instructions for ericfitz/skills, covering claude.md — efitz-skills marketplace, what this repo is, exit criteria, always — the four ci checks and derived artifacts must be updated in the same commit.

ericfitz/skills

Plugin Claude Code

Portable CATS API fuzzing toolkit: bootstrap per-repo config (init), run fuzz campaigns via config-declared hooks (run), query and render results from SQLite (report), triage true positives into a remediation plan (analyze), and manage declarative false-positive rules (fp).

ericfitz/skills

Agent

Executes a CATS fuzzing campaign end to end and returns a compact summary.

ericfitz/skills

Skill Claude CodeCodex

Triage CATS true positives into a remediation plan (real bug, spec gap, or false-positive candidate). Use after a CATS run completes, or when asked to analyze/triage CATS findings.

ericfitz/skills

Skill Claude CodeCodex

Manage CATS false-positive rules (add, review, reclassify). Use when asked to suppress a CATS finding, add a false-positive rule, audit existing rules, or reclassify a database against the current rules.

ericfitz/skills

Skill Claude CodeCodex

Bootstrap CATS fuzzing configuration for this repo. Use when setting up CATS/API fuzzing for the first time, or when .local/cats/config.yaml is missing.

ericfitz/skills

Skill Claude CodeCodex

Query and render CATS fuzzing results. Documents the CATS results SQLite schema (tables, views, worked queries) so results can be queried directly. Use when asked about CATS results, fuzzing findings, or to generate a CATS report.

ericfitz/skills

Skill Claude CodeCodex

Run a CATS fuzzing campaign against this repo's configured server and spec. Use when asked to fuzz the API, run CATS, or start a security fuzzing campaign.

ericfitz/skills

Plugin Claude Code

Dependency discovery toolkit: enumerate what a system depends on across six categories — packages (package), out-of-project services (service), configuration (config), secrets and permissions (security), OS and cloud resources (platform), and network paths (network) — each with the timeout, retry, fallback, and health.

ericfitz/skills

Skill Claude CodeCodex

Enumerate the configuration a system must be supplied with to run — environment variables, config files, flags, and remote config — with what reads each key, whether it is required, and what default it declares. Read-only. Use when documenting deployment requirements or planning test environments. Emits the…

ericfitz/skills

Skill Claude CodeCodex

Enumerate the names, hosts, and ports a system must resolve and connect to — inbound listeners, outbound endpoints, DNS, proxies, and ingress. Nothing is resolved or probed. Read-only. Use when mapping a system's network surface or planning egress policy. Emits the dependency-model:discovery contract.

ericfitz/skills

Skill Claude CodeCodex

Inventory the libraries a project ships with and at what versions — every ecosystem syft catalogues, with declared/locked/installed resolution and the dependency edges between them. Read-only. Use when auditing dependencies, planning an upgrade, or building a dependency graph. Emits the dependency-model:discovery…

ericfitz/skills

Skill Claude CodeCodex

Enumerate the OS and cloud resources a system declares a need for — CPU, memory, disk, GPU, architecture, runtime versions, and managed cloud services. Every figure is a declared one; nothing is measured. Read-only. Use when sizing an environment or planning capacity review. Emits the dependency-model:discovery…

ericfitz/skills

Skill Claude CodeCodex

Enumerate the secrets and permissions a system requires — what each credential is named, where it is read, and which policies grant what. Records names and locations only, never values. Read-only. Use when auditing a system's credential surface or planning least-privilege review. Emits the dependency-model:discovery…

ericfitz/skills

Skill Claude CodeCodex

Identify the out-of-project services a system needs — databases, caches, queues, object stores, search engines, and APIs — with the timeout, retry, fallback, and health-check declarations that bear on how each one fails. Read-only. Use when mapping a system's runtime dependencies or planning failure testing. Emits the…

ericfitz/skills

Skill Claude CodeCodex

Gather the six dependency-model discovery contracts for a repository, merge them into one graph, and derive which dependencies carry a failure-relevant health condition. Read-only. Use when a system's dependency inventory and health picture need to be assembled from the six discovery skills' output. Emits the…

ericfitz/skills

Plugin Claude Code

Update dependencies safely across Go, Python, and Node ecosystems. Use when the user asks to bump, update, or upgrade dependencies, packages, or deps; run a dependency bump/upgrade; fix Dependabot or security advisories; or refresh outdated packages. Triggers on phrasings like 'bump the deps', 'bump dependencies on…

ericfitz/skills

Skill Claude CodeCodex

Update dependencies safely across Go, Python, and Node ecosystems. Use when the user asks to bump, update, or upgrade dependencies, packages, or deps; run a dependency bump/upgrade; fix Dependabot or security advisories; or refresh outdated packages. Triggers on phrasings like 'bump the deps', 'bump dependencies on '…

ericfitz/skills

Plugin Claude Code

Developer toolkit (sem-powered): annotate code with durable SEM@ intent markers (sem-annotate), keep them maintained via a project convention (sem-auto), and find dead code + duplication and produce a ranked plan (dedupe). Uses the sem CLI entity graph. Supports Go, TypeScript/JavaScript, and Python.

ericfitz/skills

Agent

Internal worker for the dedupe skill. Given a batch of dead-code candidates (entity id, name, file, line range), tries to REFUTE that each is dead, and returns a verdict per candidate. Invoked by the dedupe orchestrator.

ericfitz/skills

Agent

Internal worker for the dedupe skill. Given candidate duplicate clusters (entities that share a normalized name across files), reads each implementation and returns a verdict with behavior differences. Invoked by the dedupe orchestrator.

ericfitz/skills

Agent

Internal worker for the sem-annotate skill. Given a batch of code entities (file, name, line range), reads each entity's source and writes a one-line intent description following the SEM description content standard. Returns a JSON array of {file, name, startline, desc}.

ericfitz/skills

Skill Claude CodeCodex

Find dead code and duplication across a codebase using the sem CLI, then produce a ranked, risk-assessed plan and optionally apply it. Use when the user asks to dedupe, find duplicate or redundant code, or find dead/unused code. Takes a path scope (e.g. /dedupe server/) to exclude unrelated tools/scripts. Supports Go…