Custom Claude Code toolkit: security scanning, E2E testing patterns, and Python code review
Code style guide for JavaScript, TypeScript (Strict Mode), React 19+, and Tailwind CSS. Use this skill whenever writing, reviewing, or refactoring any JS/TS file, React component, or Tailwind UI. Trigger on: "how should I name this?", "is this clean?", "review my component", "refactor this", "best practices", any new function/hook/component creation, or any code that feels inconsistent. Apply proactively — don't wait to be asked.
Testing guide for Vitest, React Testing Library, and Supabase mocks. Use this when writing unit or integration tests, setting up test infrastructure, mocking Supabase, testing hooks/components, or deciding what to test first. Trigger on: "add tests", "how do I test this?", "mock supabase", any new feature/hook/service.
DevOps and CI/CD best practices for TypeScript/Node projects using pnpm and GitHub Actions. Use this when setting up CI pipelines, configuring GitHub Actions, designing deploy workflows, caching dependencies, gating merges, or troubleshooting CI failures. Trigger on: "set up CI", "GitHub Actions", "why is CI failing", "add lint step", "deploy workflow", any new repo bootstrapping, or any pipeline change. Apply proactively — never merge red.
Playwright E2E testing patterns, Page Object Model, configuration, CI/CD integration, artifact management, and flaky test strategies.
End-to-end testing with Playwright for TypeScript/React applications. Use this when setting up Playwright, writing E2E specs, building Page Object Models, choosing selectors, configuring projects (Chromium/Firefox/WebKit), or wiring E2E into CI. Trigger on: "add E2E test", "Playwright setup", "test the login flow", "POM", "data-testid", any critical user-flow test (login/signup/checkout/payment), or any flaky-E2E investigation.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Custom Claude Code plugin — canonical skill set encoding my TypeScript/React/Supabase coding style.
All skills assume this stack unless noted otherwise:
| Skill | What it covers |
|---|---|
code-errors | Error handling patterns, typed errors, Result type, boundary strategy |
code-git | Conventional commits, GitHub Flow, Husky + commitlint, branch protection |
code-logging | pino event-name-first, redact paths, requestId via child(), PostHog masking |
code-security | OWASP Top 10, input validation, auth guards, secrets management |
code-style | TS strict, naming conventions, JSDoc, Tailwind cn(), React 19 components |
code-test | Vitest unit/integration, mocking strategy, coverage thresholds |
maintain | File headers, comment rules, config management, Zod env validation |
| Skill | What it covers |
|---|---|
devops | GitHub Actions CI, pnpm frozen lockfile, branch protection, failure triage |
e2etesting | Playwright storageState auth reuse, POM, flake triage, Supabase test isolation |
nodejs-backend | Hono/Fastify/NestJS decision, layered arch, JWT middleware, rate limiting |
performance | Core Web Vitals, React render optimization, Supabase query performance |
scalability | Supavisor pooling (port 6543), pgmq queues, time-based partitioning |
structure | Feature-first folder layout, barrel exports, Vitest alias config |
| Skill | What it covers |
|---|---|
accessibility | WCAG 2.2 AA, ARIA roles, focus/keyboard patterns, color contrast |
frontend-design | Bold aesthetic direction, typography, color tokens, motion/composition |
react-best | Vercel 70 rules + React 19, Promise.all waterfalls, memoization, composition |
seo | robots.txt, JSON-LD structured data, hreflang, XML sitemap, meta tags |
| Skill | What it covers |
|---|---|
supabase-pg | Index patterns, RLS performance, connection pooling, 34 optimization rules |
vite | vite.config.ts, env vars, import.meta.glob, Rolldown migration |
| Skill | What it covers |
|---|---|
e2e-testing | Original Playwright skill (pre-merge) |
python-review | Python code review: PEP 8, type hints, security, performance |
security-scan | Scan .claude/ config for vulnerabilities via AgentShield |
These skills keep SKILL.md lean and load deep content on demand from references/ or rules/ subdirs:
| Skill | Bundled resources |
|---|---|
accessibility | references/A11Y-PATTERNS.md, references/WCAG.md |
code-style | references/tailwind-deep.md, references/typescript-advanced.md |
code-test | references/ — 16 Vitest API files |
e2etesting | references/ — 58 Playwright files across 8 subdirs |
nodejs-backend | references/advanced-patterns.md, references/best-practices.md |
react-best | rules/ — 50+ Vercel rule files; references/composition-rules/ |
supabase-pg | references/ — 34 Postgres optimization rules |
vite | references/ — 6 deep-dive files including Rolldown migration |
# Add marketplace
/plugin marketplace add https://github.com/jjmendezrodriguez/jm-claude-plugin
# Install
/install-plugin jm-claude-plugin@jm-claude-plugin
ecc-agentshield (for security-scan): pnpm add -g ecc-agentshielde2e-testing, python-review, security-scan sourced from Everything Claude Code (MIT license)skills_my/npx claudepluginhub jjmendezrodriguez/jm-claude-plugin --plugin jm-claude-pluginAutomated security vulnerability testing covering OWASP Top 10, SQL injection, XSS, CSRF, and authentication issues
Agentic-Security is a powerful Claude Code plugin that automatically performs Application Security Testing (SAST, SCA, secrets detection, and more). Think of it as the easy button for making your Claude-generated code safe and secure.
Perform security audit on codebase
Security best practices advisor with vulnerability detection and fixes
Testing, security, and code quality experts - code review, penetration testing, QA automation
Agents for code review, security audits, debugging, and quality assurance