Best PracticesCAUTION

Universal skill installer and package manager for AI coding agents. One command, 12+ runtimes. npx ai-agent-skills

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: best-practices
description: >-
  Transforms vague prompts into optimized Claude Code prompts. Adds verification,
  specific context, constraints, and proper phasing. Invoke with /best-practices.
version: 4.1.0
---

# Best Practices — Prompt Transformer

> Transform prompts by adding what Claude needs to succeed.

## Start Here

Based on user's request:

**User provides a prompt to transform:**
→ Ask using AskUserQuestion:
  - **Question:** "How should I improve this prompt?"
  - **Header:** "Mode"
  - **Options:**
    1. **Transform directly** — "I'll apply best practices and output an improved version"
    2. **Build context first** — "I'll gather codebase context and intent analysis first"

**User asks to learn/understand:**
→ Show the 5 Transformation Principles section

**User asks for examples:**
→ Link to references/before-after-examples.md

**User asks to evaluate a prompt:**
→ Use the Success Criteria eval rubric at the end of this document

---

## If "Transform directly"

Apply the 5 principles below and output the improved prompt immediately.

## If "Build context first"

Launch 3 parallel agents to gather context:

```
Run these agents IN PARALLEL using the Task tool:

- Task task-intent-analyzer("[user's prompt]")
- Task best-practices-referencer("[user's prompt]")
- Task codebase-context-builder("[user's prompt]")
```

### What Each Agent Returns

| Agent | Mission | Returns |
|-------|---------|---------|
| **task-intent-analyzer** | Understand what user is trying to do | Task type, gaps, edge cases, transformation guidance |
| **best-practices-referencer** | Find relevant patterns from references/ | Matching examples, anti-patterns to avoid, transformation rules |
| **codebase-context-builder** | Explore THIS codebase | Specific file paths, similar implementations, conventions |

### After Agents Return

1. **Synthesize findings** — Combine intent + best practices + codebase context
2. **Apply matching patterns** — Use examples from best-practices-referencer as templates
3. **Ground in codebase** — Add specific file paths from codebase-context-builder
4. **Transform the prompt** — Apply the 5 principles with all gathered context
5. **Output** — Show improved prompt with before/after comparison

### Agent Definitions

The agents are defined in `agents/`:
- `agents/task-intent-analyzer.md` — Analyzes intent, gaps, and edge cases
- `agents/best-practices-referencer.md` — Finds relevant examples and patterns from references/
- `agents/codebase-context-builder.md` — Explores codebase for files and conventions

---

## Transformation Workflow

When transforming (after mode selection):

1. **Identify what's missing** — Check against the 5 principles below
2. **Add missing elements** — Verification, context, constraints, phases, rich content
3. **Output the improved prompt** — In a code block, ready to copy-paste
4. **Show what changed** — Brief comparison of before/after

---

## The 5 Transformation Principles

Apply these in order of priority:

### 1. Add Verification (Highest Priority)

**The single highest-leverage improvement.** Claude performs dramatically better when it can verify its own work.

| Missing | Add |
|---------|-----|
| No success criteria | Test cases with expected inputs/outputs |
| UI changes | "take screenshot and compare to design" |
| Bug fixes | "write a failing test, then fix it" |
| Build issues | "verify the build succeeds after fixing" |
| Refactoring | "run the test suite after each change" |
| No root cause enforcement | "address root cause, don't suppress error" |
| No verification report | "summarize what you ran and what passed" |

```
BEFORE: "implement email validation"
AFTER:  "write a validateEmail function. test cases: [email protected] → true,
         invalid → false, [email protected] → false. run the tests after implementing"
```

```
BEFORE: "fix the API error"
AFTER:  "the /api/orders endpoint returns 500 for large orders. check
         OrderService.ts for the error. address the root cause, don't suppress
         the error. after fixing, run the test suite and summarize what passed
         and what you verified."
```

### 2. Provide Specific Context

Replace vague references with precise locations and details.

| Vague | Specific |
|-------|----------|
| "the code" | `src/auth/login.ts` |
| "the bug" | "users report X happens when Y" |
| "the API" | "the /api/users endpoint in routes.ts" |
| "that function" | `processPayment()` on line 142 |

**Four ways to add context:**

| Strategy | Example |
|----------|---------|
| **Scope the task** | "write a test for foo.py covering the edge case where user is logged out. avoid mocks." |
| **Point to sources** | "look through ExecutionFactory's git history and summarize how its API evolved" |
| **Reference patterns** | "look at HotDogWidget.php and follow that pattern for the calendar widget" |
| **Describe symptoms** | "users report login fails after session timeout. check src/auth/, especially token refresh" |

**Respect Project CLAUDE.md:**

If the project has a CLAUDE.md, the transformed prompt should:
- Not contradict project conventions
- Reference project-specific patterns when relevant
- Note any project constraints that apply

```
BEFORE: "add a new API endpoint"
AFTER:  "add a GET /api/products endpoint. check CLAUDE.md for API conventions
         in this project. follow the pattern in routes/users.ts. run the API
         tests after implementing."
```

```
BEFORE: "fix the login bug"
AFTER:  "users report login fails after session timeout. check the auth flow
         in src/auth/, especially token refresh. write a failing test that
         reproduces the issue, then fix it"
```

### 3. Add Constraints

Tell Claude what NOT to do. Prevents over-engineering and unwanted changes.

| Constraint Type | Examples |
|-----------------|----------|
| **Dependencies** | "no new libraries", "only use existing deps" |
| **Testing** | "avoid mocks", "use real database in tests" |
| **Sc

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (3)

also look at how we manage environment variables for secrets."

You are a senior security engineer. Review code for:

also look at how we manage environment variables for secrets.

Gates applied: no_behavioural_pass.