7 skills scan repo, fix 1 issue, verify, stop. No commit, no CI minutes.
Local, on-demand maintenance skills for SvelteKit + TypeScript repos. Each skill finds the single highest-priority issue in its domain, fixes it, verifies the fix, and leaves the diff in your working tree for review. No branches, no PRs, no CI minutes spent.
These skills follow the Agent Skills specification so they can be used by any skills-compatible agent.
npx skills add robcsaszar/tend
/plugin marketplace add robcsaszar/tend
/plugin install robcsaszar-tend@tend
Copy the skills/ directory into your project's .claude/skills/, or a specific skill folder for a single one. See "Installing a single skill" below.
Run tend-onboard once per repo before the others. It detects your stack (SvelteKit version, which of the 5 capability modules apply, existing off-limits conventions) and writes .claude/tend/config.yaml, which every other skill reads at Phase 0. Skipping this step isn't an error. Every skill runs at a conservative core tier with no config present, but module-specific checks (auth, realtime, data, validation, feature-flags) only activate once onboarding has run.
Re-run tend-onboard after a significant dependency or stack change; module activation is detected once at onboard time, not on every scan.
Every skill in this pack is invoked explicitly, never automatically. Run /tend-onboard, /tend-security, /tend-perf, and so on by name. This is deliberate: a full pass is running each skill in turn yourself, not an unattended sweep. See AGENTS.md for why. For scheduled runs, don't loosen the skills — opt into the external wrapper that tend-onboard offers to install (see "Unattended use" below).
| Skill | Description |
|---|---|
| tend-onboard | Detects your stack and writes .claude/tend/config.yaml: run this first |
| tend-security | Finds and fixes one exploitable security issue per run: XSS, secrets, authn/authz, CSP, plus opt-in module packs (auth, validation, realtime, data, feature-flags) |
| tend-perf | Finds one performance fix per run that's mechanically provable from code inspection alone: no profiling, no guessing |
| tend-refactor | Dead code and duplication removal, type-safety tightening, and component/markup extraction: one atomic change per run |
| tend-a11y | Accessibility and copy-tone checks: semantic markup, ARIA, async-loading and destructive-action states, tone consistency |
| tend-tests | Finds untested functions matching your repo's existing dependency-injection/mocking convention and writes the missing test |
| tend-docs | Bidirectional doc-vs-code drift audit. Dogfood-only: shipped in the pack, tuned for this project's own use rather than broad genericness |
npx skills add robcsaszar/tend --skill tend-security
Or manually, copy just that skill's directory:
cp -r skills/tend-security /path/to/project/.claude/skills/Every skill shares one shape: load config → triage → scan (stop at the first real hit) → fix (one atomic, verified change) → present the diff and stop. None of these skills commit or open a PR. You review and commit yourself. See each skill's SKILL.md for its full phase breakdown, and tend-onboard/references/config-schema.md for the config file this pack shares.
Known unverified item: whether npx skills add copies a skill's full folder (references/, scripts/) or only SKILL.md. If you install a skill and its reference files or validator script are missing, install manually instead (see above) until this is confirmed.
The skills never commit — that stays true. For scheduled runs there is an external wrapper: a GitHub Actions workflow template shipped inside the onboarding skill at skills/tend-onboard/assets/tend-sweep.yml. During /tend-onboard you're asked once whether you want it (default: no); on a yes, onboarding writes it to .github/workflows/tend-sweep.yml with your chosen cadence, and you commit it yourself. If you skipped onboarding, copy the asset there manually.
On each scheduled run the workflow invokes exactly one skill — as the same /tend-* slash command you'd type yourself — and if the skill leaves a diff, the workflow (a deterministic shell step, not the skill and not a model) commits it to a tend/<skill>-<date> branch and opens a labeled PR. The skill session's tool allowlist in the workflow contains no git commit, git push, or gh, so "stop at the diff" is enforced mechanically, not requested politely.
This is not a return to the unattended fleet this pack was built to replace. Backpressure is designed in:
- Rotation, not breadth — one skill per run, one fix per run, cycling security → perf → refactor → a11y → tests by advancing past the most recent tend PR (so any cadence works).
tend-docsis manual-dispatch only;tend-onboardnever runs unattended. - Open-PR cap — before Claude ever starts, a token-free preflight counts open
tend-labeled PRs; at the cap (default 2, repo variableTEND_PR_CAP) the run exits. An unreviewed backlog halts the machine. - Per-skill duplicate guard — while a
tend/<skill>-*PR is open, that skill doesn't run again. - Humans merge — the workflow does nothing after opening the PR.
Setup beyond the file itself: an ANTHROPIC_API_KEY (or CLAUDE_CODE_OAUTH_TOKEN) repo secret, and /tend-onboard's .claude/tend/config.yaml committed so sweeps run sharpened rather than core-tier. Note: PRs opened with the default GITHUB_TOKEN won't trigger your own PR CI — see the template header for the PAT workaround.
tend-onboard, tend-security, tend-tests, and tend-refactor ship small validator scripts. Read SAFETY.md for what each one does.
MIT © Rob Csaszar