swing-skills

Swing — AI Agent Guardrails for Claude Code

English · 한국어 (Korean)

Your AI is not swinging at all.

It picks the safe default, agrees when it should push back, cites no sources, hides its reasoning, and assumes everything will work. Six cognitive failures. Six firewalls. Make it swing.

npx skills add thestack-ai/swing-skills --all

Built for Claude Code | Compatible with AI agents via Agent Skills open standard Created by @thestack_ai

---

See the Difference

Before: Default AI Research

You: Is SQLite viable for an app with 1000 concurrent users?

AI: No, SQLite is not suitable for high-concurrency applications. Use PostgreSQL or MySQL instead for production workloads.

After: With swing-research

You: /swing-research Is SQLite viable for an app with 1000 concurrent users?

AI: Yes, with caveats. 1000 concurrent users ≠ 1000 concurrent writes. Typical web apps generate ~30 concurrent write transactions at this scale. SQLite handles ~120 write transactions/sec in WAL mode (verified: sqlite.org benchmarks + Expensify production case study serving 10M+ users on SQLite). The real constraint is write contention above ~100 concurrent writers, not user count.

Sources: 🏛️ sqlite.org WAL documentation, 🛡️ Expensify engineering blog (2024), ⚠️ HN discussion (corroborated)

The baseline gave a wrong answer confidently. The skill forced source verification and reached the opposite — correct — conclusion.

Before: Default AI Code Review

You: Review this JWT auth module

AI: The code looks well-structured. Consider adding more comments and using TypeScript for better type safety. Variable naming could be improved in some places.

After: With swing-review

You: /swing-review Review this JWT auth module

AI: Steel-man: JWT-based stateless auth was chosen for horizontal scaling. The 15-min access + 7-day refresh split balances security and UX.

🔴 Critical: No refresh token rotation. A stolen token grants persistent 7-day access with no detection. Fix: implement token family chain rotation.

🟠 Major: Rate limiting uses in-memory Map(). Resets on restart, bypassed in multi-instance deploys. Fix: move to Redis with TTL.

Verdict: PASS WITH CONDITIONS — must fix token rotation before deploy.

The baseline found nothing. The skill found a Critical security vulnerability.

---

Six Failures, Six Firewalls