2.4.0 — schema-diagram

Added

• schema-diagram skill — generates a self-contained interactive ERD from a Laravel
  project's live database: one standalone HTML file with domain-coloured table cards,
  foreign-key edges anchored to the actual column rows, a per-table inspector showing both
  directions of every relation, and a committed JSON payload that makes schema drift
  reviewable as a diff rather than as a 1 MB generated file
• /erd command — init, generate, build, refresh, check, domains, verify
• database-engineer agent now loads schema-diagram for schema documentation work

Notes

Distilled from a production ERD build, so the references carry the findings rather than only
the code. The failures worth naming, all of which render successfully and are wrong:

• Read the database, never the migrations. Migrations are the instructions; only the
  database is the result, and a mature project's column changes, index swaps and drops are
  exactly what a parser gets wrong — silently
• Filter tables on getCurrentSchemaName(), not getDatabaseName(). The two disagree on
  SQLite, where the schema is main and the database name is the file path: the wrong filter
  matches nothing, so the test suite passes against an empty schema instead of failing
• Domain assignment is a hand-written map with a two-way coverage gate. A name-prefix
  heuristic mis-files tables and gives no sign that it did. The command refuses to write and
  the Pest suite fails when a table is unaccounted for
• Giving a React Flow node width/height makes it skip measurement, so handle bounds
  never exist and every edge is dropped with no error at all — every card draws perfectly and
  all relations vanish. Use initialWidth/initialHeight
• An unpainted Chrome tab throttles ResizeObserver and rAF, producing exactly those
  symptoms on a healthy page. Screenshot first — that forces a frame — then trust the DOM

2.3.0

Two new skills, and the production lessons behind them folded into the existing ones.

Added

• project-status — TLDR + table status report that cross-checks a project's planning tree against live GitHub issues and the code, on the rule that a planning document's claim is never status until the code confirms it. An open issue is very often already built.
• deploy-app — deploy a Kickoff app via bin/deploy over SSH: the verification checklist, a recovery path per failure mode, and the production traps (DB-backed settings overriding .env, host SMTP port blocks, unattended prompts exiting 0, APP_KEY rotation).
• docs/02-development/06-laravel-boost-coexistence.md — which skill names Laravel Boost owns, why a collision between the two is silent, and how to check a project for one.

Changed

• pest-testing renamed to kickoff-pest-testing (migration entry included, so install.sh cleans up the old ~/.claude/skills/pest-testing). Boost's boost:install --skills writes its own pest-testing into the same directory and had already overwritten the toolkit's copy in a live project, undetected. The two are complementary — Boost covers Pest syntax; this covers scaffolding, the Kickoff arch-test baseline and suite performance. The installer only ever touches $HOME, so a project-level Boost skill is never removed by a migration.
• kickoff-pest-testing — new sections on what a green suite does not prove (Alpine, Flux custom elements, deferred wire:model) and on suite performance: seeder placement in $seeder rather than beforeEach (96s → 43s on a 1400-test suite), XDEBUG_MODE pinning, and Test Impact Analysis with pcov.
• livewire-flux — client-side gotchas that ship green: Flux renders <ui-checkbox> not a native input (so every input[type=checkbox] selector matches zero), x-cloak is inert without its CSS rule, a double quote anywhere in an Alpine attribute un-Alpines the whole subtree, and description:trailing for field help text.
• project-laravel — access-control.md gains a tenancy section (a passing policy is not proof of row ownership; scoped finders; per-tenant uniqueness resets; pinning the guard on non-web surfaces). database-conventions.md gains engine portability (MySQL leading-column FK indexes, non-transactional DDL, unreliable hasIndex(), the migrate → rollback → migrate round trip). model-conventions.md gains silent failure modes (undefined relations resolving to null, Traitify's user_id auto-fill, seeder unguarded(), factory visibility branches).
• code-quality — Larastan blind spots: a class docblock must sit above the PHP attributes or it is silently ignored, casts declared via casts() are invisible to it, and generic relation annotations churn the baseline.
• project-conventions — lessons belong in CLAUDE.md and tracking on GitHub, never in a local tasks/todo.md or lessons.md; the multi-repo workspace two-CLAUDE.md pattern; and the repository housekeeping Claude depends on (/.claude/worktrees/ in .gitignore).
• kickoff-patch — records the Kickoff 1.38.0 composer-script change (TIA no longer the default test), the new build/php-ini test tooling, PASSKEYS_USER_HANDLE_SECRET, and the worktrees ignore rule; restores laravel/doctor in the package baseline.

Roster is now 31 skills, 20 agents, 10 commands.

Full Changelog: 2.2.0...2.3.0

2.2.0 — Full role coverage + generalised toolkit

Highlights

• 4 new agents complete the role coverage → 20 agents: database-engineer (DBA), project-manager (PM), api-engineer, and penetration-tester (authorized, scoped, local/staging only)
• Generalised the whole toolkit — personal names, private product names and machine-specific paths removed from all agents, skills, docs and manifests. It now reads as a general-purpose Kickoff-based Laravel toolkit anyone can adopt. The Kickoff baseline is kept as the core value.

See CHANGELOG.md.

2.1.0 — Full SDLC agent coverage

Highlights

• 3 new agents complete the SDLC: software-architect (design, DDD, ADRs), laravel-developer (build-phase implementer), performance-engineer (measure-first optimisation) — 16 agents total
• qa-engineer now covers test strategy (QA) alongside test writing (QC)
• New docs: Using Agents with the SDLC coverage map, plus agent and command format contracts
• Product spec, requirements, roadmap, FAQ and architecture docs refreshed for the toolkit era

See CHANGELOG.md.

2.0.0 — Claude Toolkit

The repo is now the Claude Toolkit — skills, agents and commands in one place.

Highlights

• Repo renamed agent-skills → claude (old URLs redirect; update remotes to https://github.com/nasrulhazim/claude.git)
• 13 role agents (agents/) — thin personas that load the skills as their playbook
• 10 slash commands (commands/)
• Installer v2.0.0 installs all three types to ~/.claude/{skills,agents,commands}; new --dry-run and --only <name> flags
• Plugin marketplace support: /plugin marketplace add nasrulhazim/claude → /plugin install claude-toolkit@claude
• Type-prefixed manifest.txt (breaking for pre-2.0 installers) and type-aware migrations.txt

See CHANGELOG.md for details.

1.16.0 — kickoff-patch skill

kickoff-patch — /kickoff patch

New skill: bring a Laravel project scaffolded from CleaniqueCoders Kickoff up to the latest Kickoff baseline.

How it works

• Latest = local install — requires cleaniquecoders/kickoff installed globally (composer global require cleaniquecoders/kickoff); reads its stubs/ + StartCommand.php as latest.
• 3-way merge (base = original version, theirs = latest, mine = your files); 2-way fallback when the original-version base can't be obtained.
• Baseline detection via feature fingerprint + git-date heuristic with user confirmation; stamps .kickoff-version for deterministic future runs.
• Preview-first, approve-per-category; protects .env, app domain code, product config, and custom routes.

Commands

• /kickoff status — is this a Kickoff project + how far behind
• /kickoff check — dry-run drift report (writes nothing)
• /kickoff patch — preview → approve per category → apply → stamp → verify

Works on any Kickoff-based Laravel project.

1.15.0 — SOC Analyst: Stack-Agnostic Refactor

SOC Analyst — Now Stack-Agnostic

The soc-analyst skill is no longer Laravel/PHP-only. It now auto-detects the project stack and applies the appropriate security patterns, fixes, and hardening checks.

Supported Stacks

Stack	Detection	Dependency Audit
Laravel/PHP	composer.json + artisan	composer audit
Node.js/Express	package.json	npm audit / yarn audit
Python/Django/Flask	requirements.txt / pyproject.toml	pip audit / safety check
Ruby/Rails	Gemfile	bundle audit
Go	go.mod	govulncheck ./...
Java/Spring	pom.xml / build.gradle	mvn dependency-check:check
Rust	Cargo.toml	cargo audit
.NET	*.csproj / *.sln	dotnet list package --vulnerable

What Changed

• SKILL.md — Stack detection pre-flight, agnostic command workflows, test framework selection table
• vulnerability-patterns.md — Grep patterns and vulnerable code examples for 6 stacks × 14 vulnerability classes
• remediation-playbooks.md — Before/after fixes with regression tests for Laravel, Express, Django/Flask, and Rails
• hardening-checklist.md — 65 checks with collapsible stack-specific verification/fix notes for 4 stacks
• mitre-attack-mapping.md — Stack-specific exposure points, shell patterns, and credential locations
• incident-report-templates.md — Generic code blocks, stack field in templates

Install

curl -fsSL https://raw.githubusercontent.com/nasrulhazim/agent-skills/main/install.sh | bash

1.14.0 — Senior SOC Analyst Skill

New Skill: soc-analyst

Senior SOC Analyst for Laravel/PHP projects — triages, investigates, and actively fixes security vulnerabilities.

6 Commands

Command	Description
/soc triage	Scan codebase, assess severity (P1-P4), categorize with MITRE ATT&CK
/soc investigate	Deep-dive a finding — trace attack paths, correlate events, identify root cause
/soc respond	Contain active incidents, eradicate threats, recover operations
/soc remediate	Fix vulnerabilities in code — patch files with before/after diffs and Pest tests
/soc harden	65-point hardening checklist across 10 categories with scorecard
/soc report	Generate security audit reports, incident reports, and post-mortems

Key Differentiator

Unlike traditional security scanners that only report, /soc remediate writes the fix — patching SQL injection, XSS, CSRF, mass assignment, command injection, file upload flaws, and 8 more vulnerability classes with Laravel-idiomatic code and regression tests.

Reference Files (5)

• vulnerability-patterns.md — 14 vulnerability classes with grep detection patterns and MITRE ATT&CK mapping
• remediation-playbooks.md — Before/after code fixes with Pest tests for each vulnerability
• mitre-attack-mapping.md — Web application ATT&CK techniques mapped to Laravel scenarios
• hardening-checklist.md — 65 checks across 10 categories (env, headers, auth, validation, dependencies, etc.)
• incident-report-templates.md — 4 templates: security audit, incident report, post-mortem, vulnerability report

Install

curl -fsSL https://raw.githubusercontent.com/nasrulhazim/agent-skills/main/install.sh | bash

1.13.0

New Skill: Business Card Designer

SVG business card designer with a four-phase workflow: interview, concept exploration, selection/refinement, and production export.

Features

• 12 front concepts with optional back designs per session
• 6 layout styles: minimal, corporate, creative, elegant, bold, tech
• Interactive HTML gallery with 7:4 aspect ratio card grid and click-to-select
• Card showcase with CSS 3D flip animation for front/back preview (spacebar/click to flip)
• Print-ready SVG export with 0.125" bleed area and crop marks
• Horizontal & vertical card orientations supported
• Special elements: QR code placeholders, social media icons, logo integration
• Bilingual triggers: English and Bahasa Malaysia

Entry Points

• /card design — full flow with interview
• /card quick — minimal interview, smart defaults
• /card back — design back of card only
• /card export — production export from chosen design

Files

• skills/business-card/SKILL.md
• skills/business-card/references/card-gallery-template.md
• skills/business-card/references/card-showcase-template.md
• skills/business-card/references/card-design-patterns.md

1.12.0

What's New

Added

• project-ddd — Pragmatic DDD skill for Laravel domain restructuring with domain discovery, migration planning, scaffolding, service provider wiring, architecture tests, and boundary auditing
• MIT License file
• Skill migration system — migrations.txt + installer detects deprecated skills, cleans them up, and notifies users of renames

Changed

• Skill renames — 4 skills renamed with project- prefix for consistent grouping:
  • api-lifecycle → project-api
  • faq-generator → project-faq
  • roadmap-generator → project-roadmap
  • self-update → project-conventions
• Project Management category now has 9 skills (was split across Project Lifecycle + Meta)
• README updated to reflect all 26 skills across 5 categories
• Installer bumped to v1.1.0 with migration support
• CLAUDE.md updated with skill rename conventions and gotchas

Skill Categories

Category	Count
Development & Quality	6
Project Management	9
Deployment & Ops	5
Research & Analytics	2
Business & Design	4
Total	26

Full Changelog: 1.11.0...1.12.0