best-practices

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

also look at how we manage environment variables for secrets."

You are a senior security engineer. Review code for:

also look at how we manage environment variables for secrets.

Audit 0.4.1 · source sha a94ded2f83b0 · 22 Oct 2026Report an issue or request a re-scan

• Publisherskillcreatorai GitHub userOwner of the repository this skill is read from
• Source folderskillcreatorai/ai-agent-skills/skills/best-practicesThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdicta94ded2f83b0A new audit runs when the source changes
• Repository statusNot archivedLast push 30 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Transforms vague prompts into optimized Claude Code prompts. Adds verification, specific context, constraints, and proper phasing. Invoke with /best-practices.

---
name: best-practices
description: >-
  Transforms vague prompts into optimized Claude Code prompts. Adds verification,
  specific context, constraints, and proper phasing. Invoke with /best-practices.
version: 4.1.0
---

# Best Practices — Prompt Transformer

> Transform prompts by adding what Claude needs to succeed.

## Start Here

Based on user's request:

**User provides a prompt to transform:**
→ Ask using AskUserQuestion:
  - **Question:** "How should I improve this prompt?"
  - **Header:** "Mode"
  - **Options:**
    1. **Transform directly** — "I'll apply best practices and output an improved version"
    2. **Build context first** — "I'll gather codebase context and intent analysis first"

**User asks to learn/understand:**
→ Show the 5 Transformation Principles section

**User asks for examples:**
→ Link to references/before-after-examples.md

**User asks to evaluate a prompt:**
→ Use the Success Criteria eval rubric at the end of this document

---

## If "Transform directly"

Apply the 5 principles below and output the improved prompt immediately.

## If "Build context first"

Launch 3 parallel agents to gather context:

```
Run these agents IN PARALLEL using the Task tool:

- Task task-intent-analyzer("[user's prompt]")
- Task best-practices-referencer("[user's prompt]")
- Task codebase-context-builder("[user's prompt]")
```

### What Each Agent Returns

| Agent | Mission | Returns |
|-------|---------|---------|
| **task-intent-analyzer** | Understand what user is trying to do | Task type, gaps, edge cases, transformation guidance |
| **best-practices-referencer** | Find relevant patterns from references/ | Matching examples, anti-patterns to avoid, transformation rules |
| **codebase-context-builder** | Explore THIS codebase | Specific file paths, similar implementations, conventions |

### After Agents Return

1. **Synthesize findings** — Combine intent + best practices + codebase context
2. **Apply matching patterns** — Use examples from best-practices-referencer as templates
3. **Ground in codebase** — Add specific file paths from codebase-context-builder
4. **Transform the prompt** — Apply the 5 principles with all gathered context
5. **Output** — Show improved prompt with before/after comparison

### Agent Definitions

The agents are defined in `agents/`:
- `agents/task-intent-analyzer.md` — Analyzes intent, gaps, and edge cases
- `agents/best-practices-referencer.md` — Finds relevant examples and patterns from references/
- `agents/codebase-context-builder.md` — Explores codebase for files and conventions

---

## Transformation Workflow

When transforming (after mode selection):

1. **Identify what's missing** — Check against the 5 principles below
2. **Add missing elements** — Verification, context, constraints, phases, rich content
3. **Output the improved prompt** — In a code block, ready to copy-paste
4. **Show what changed** — Brief comparison of before/after

---

## The 5 Transformation Principles

Apply these in order of priority:

### 1. Add Verification (Highest Priority)

**The single highest-leverage improvement.** Claude performs dramatically better when it can verify its own work.

| Missing | Add |
|---------|-----|
| No success criteria | Test cases with expected inputs/outputs |
| UI changes | "take screenshot and compare to design" |
| Bug fixes | "write a failing test, then fix it" |
| Build issues | "verify the build succeeds after fixing" |
| Refactoring | "run the test suite after each change" |
| No root cause enforcement | "address root cause, don't suppress error" |
| No verification report | "summarize what you ran and what passed" |

```
BEFORE: "implement email validation"
AFTER:  "write a validateEmail function. test cases: [email protected] → true,
         invalid → false, [email protected] → false. run the tests after implementing"
```

```
BEFORE: "fix the API error"
AFTER:  "the /api/orders endpoint returns 500 for large orders. check
         OrderService.ts for the error. address the root cause, don't suppress
         the error. after fixing, run the test suite and summarize what passed
         and what you verified."
```

### 2. Provide Specific Context

Replace vague references with precise locations and details.

| Vague | Specific |
|-------|----------|
| "the code" | `src/auth/login.ts` |
| "the bug" | "users report X happens when Y" |
| "the API" | "the /api/users endpoint in routes.ts" |
| "that function" | `processPayment()` on line 142 |

**Four ways to add context:**

| Strategy | Example |
|----------|---------|
| **Scope the task** | "write a test for foo.py covering the edge case where user is logged out. avoid mocks." |
| **Point to sources** | "look through ExecutionFactory's git history and summarize how its API evolved" |
| **Reference patterns** | "look at HotDogWidget.php and follow that pattern for the calendar widget" |
| **Describe symptoms** | "users report login fails after session timeout. check src/auth/, especially token refresh" |

**Respect Project CLAUDE.md:**

If the project has a CLAUDE.md, the transformed prompt should:
- Not contradict project conventions
- Reference project-specific patterns when relevant
- Note any project constraints that apply

```
BEFORE: "add a new API endpoint"
AFTER:  "add a GET /api/products endpoint. check CLAUDE.md for API conventions
         in this project. follow the pattern in routes/users.ts. run the API
         tests after implementing."
```

```
BEFORE: "fix the login bug"
AFTER:  "users report login fails after session timeout. check the auth flow
         in src/auth/, especially token refresh. write a failing test that
         reproduces the issue, then fix it"
```

### 3. Add Constraints

Tell Claude what NOT to do. Prevents over-engineering and unwanted changes.

| Constraint Type | Examples |
|-----------------|----------|
| **Dependencies** | "no new libraries", "only use existing deps" |
| **Testing** | "avoid mocks", "use real database in tests" |
| **Sc

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-22
   !CAUTION B 89 / 100

   first audit · source a94ded2f83b0

Questions about best-practices

• github.com/skillcreatorai/ai-agent-skills/tree/main/skills/best- — the audited source at commit a94ded2f83b0 and every finding aboveObserved · 22 Oct 2026

Spotted something wrong? Report a correction · Methodology