Claude Code Skills and SDLC

Claude Code Skills and SDLC Integration

ADEPT ships 27 Claude Code skills that map to every phase of the software development lifecycle.

---

SDLC Phase Map

Phase	Name	Skills	Purpose
0	Orient	/start-session, /start-feature	Bootstrap session, load context
1	Plan	/start-feature, /start-sprint, /mcp-plan	Implementation plans, GitHub issues
2	Discover	/start-feature, /mcp-plan	Find analogous patterns, audit API surfaces
3	Branch	/start-feature	Create and push feature branch
4	Implement	/mcp-scaffold, /mcp-add-tool, /connect-adept, /start-stack, /deploy-cloud	Code, scaffold, deploy
5	Test	/validate-tests, /mcp-test, /promptfoo-check	Required test tiers, red-team probes
6	Document	/write-session-report, /update-tracking-docs	Session reports, CHANGELOG
7	Commit	/prepare-commit	Conventional Commits with doc references
8	Audit	/audit-hygiene, /pre-push-review	Code hygiene, semantic self-review
9	Close	/close-task, /prepare-pr, /mcp-register, /end-session	Push, PR, review
10	Release	/prepare-release, /scan-release, /scan-path, /asopb-evaluate	ASOPB scan, publish gate

---

Skill Categories

Session Management

Skill	Description
/start-session	Pre-flight checks, orientation context, conversation history backup
/end-session	Archive conversation, summarize work, optional tmux detach
/start-feature	Master conductor -- walks through all 10 phases with gate checks
/start-sprint	Multi-day sprint initialization -- GitHub issues, testing strategy
/close-task	Composite closure -- test, document, commit, audit, push in sequence

Planning and Discovery

Skill	Description
/mcp-plan	Analyze a Python library's API, map to MCP tools, classify dependencies

Implementation

Skill	Description
/mcp-scaffold	Create new external MCP server from canonical template
/mcp-add-tool	Add tool to existing MCP server following register(mcp) + Pydantic pattern
/connect-adept	Configure Claude Code to connect to an ADEPT instance, generate .mcp.json
/start-stack	Launch ADEPT stack on any deployment target
/deploy-cloud	Guided cloud deployment (AWS/Azure/GCP)

Testing and Security

Skill	Description
/validate-tests	Determine required test tiers, verify timestamped evidence
/mcp-test	4-tier MCP test strategy: unit, integration, registration, E2E
/promptfoo-check	LLM adversarial red-team evaluation (OWASP LLM Top 10)
/triage-cve	CVE lookup, reachability analysis, remediation
/token-utilization	Aggregate LLM token consumption, classify traffic, compute costs

Documentation

Skill	Description
/write-session-report	Draft implementation report following project templates
/update-tracking-docs	Sync CHANGELOG, ROADMAP, KNOWN_ISSUES

Commit and Review

Skill	Description
/prepare-commit	Build Conventional Commit message with Related Documentation footer
/audit-hygiene	Walk full Code Hygiene Quick Reference Card checklist
/pre-push-review	5 semantic audits: pattern consistency, dead code, doc-code divergence
/prepare-pr	Create PR, monitor review, address findings, resolve conversations

Release and Scanning

Skill	Description
/prepare-release	Full pre-publish workflow: ASOPB scan, staging, dry-run (NEVER publishes)
/scan-release	Run 7-pass ASOPB scan on staged release tree
/scan-path	Run ASOPB scan on arbitrary directory with ASPI scoring
/asopb-evaluate	Full 8-domain ASPI evaluation

---

CI/CD Workflows

ADEPT uses 10 GitHub Actions workflows:

Continuous Integration (Push/PR Triggered)

Workflow	Trigger	Purpose
Continuous Integration (ci.yml)	push, PR	Orchestrator
Lint and Test (lint-and-test.yml)	push, PR	Black, ruff, mypy, pytest
RAGFlow Tests (ragflow-tests.yml)	push, PR	RAGFlow integration tests
Infrastructure Linting (test-infrastructure.yml)	push, PR	Helm lint, Terraform validate, CDK synth

Security Scanning

Workflow	Trigger	Purpose
ASOPB Pre-Release Scan (asopb-pre-release-scan.yml)	push, PR, manual	Two-phase parallel security pipeline

Build and Deploy

Workflow	Trigger	Purpose
Build and Push (build-and-push.yml)	manual	Build Docker images, push to GHCR
Deploy to AWS EKS (deploy-aws.yml)	manual	Helm deploy to EKS
Deploy to Azure AKS (deploy-azure.yml)	manual	Helm deploy to AKS
Deploy to GCP GKE (deploy-gcp.yml)	manual	Helm deploy to GKE
Publish Public Release (publish-public-release.yml)	manual	Stage, scan, publish

---

ASOPB Security Pipeline

The ASOPB Pre-Release Scan implements a two-phase parallel pipeline:

Phase 1: Lightweight SAST (Blocking, ~30s)
  regex-scan -- pure Python, no Docker needed, blocks PR on failure

Phase 2: Full Pipeline (Parallel, 5-60 min)
  SAST:  regex-scan, ml-fast (secrets + trufflehog)
  SCA:   grype-scan (CVE), version-parity (drift)
  DAST:  promptfoo-redteam (LLM adversarial)
  DLP:   ml-toxicity, ml-ner, ml-pii (content safety)
  Infra: ml-image-check (scanner self-test)
  Report: ml-aggregate, report (ASPI scoring)

ASPI Scoring

• Formula: domain_score = max(0, 100 - SUM(weight * ln(1 + count)))
• Composite: ASPI = D5 * 0.4 + D8 * 0.4 + D7 * 0.2
• Gate: Pipeline ASPI >= 90 required for release (S4 Hardened)
• Stages: S4 >= 90, S3 >= 70, S2 >= 50, S1 < 50

---

Invoking Skills

Skills are invoked by typing the skill name (with / prefix) in Claude Code:

> /start-feature bugfix
> /validate-tests
> /prepare-commit
> /scan-release

Skills are defined in .claude/skills/ with YAML frontmatter specifying allowed tools and permissions. Each skill enforces project conventions without requiring the developer to remember every convention.