skull

Build, continue, or rebuild the full Sentinel project map and its initial findings

Run the SKULL design team on this project — brief, a real design system (concrete hex/style/fonts, contrast-verified), layout, build, and an accessibility-first review (triggers on "make it look professional", "it looks generic/AI-generated", "what colors should this use", redesign, "is this accessible")

Show the current Sentinel map summary and open findings (read-only)

Review what changed since the last Sentinel run; update the map and findings

Show SKULL's team for this project — who's active, their role, and what each is for

Use proactively for UI/UX work. The DESIGNER is SKULL's design lead: it establishes who the product is for, generates a real design system from the ui-intel database (concrete hex, style, font pairing, anti-patterns — contrast-verified), persists it to .skull/design/MASTER.md so every session builds the same product, and reviews the UI front-to-back against the accessibility-first priority ladder. Read-only toward your source: it never rewrites your components — it writes only under .skull/design/ and skull.html, and hands you the system and the findings. Triggers on "make it look professional", "it looks generic / AI-generated", "what colors/font should this use", a redesign, a new frontend, "is this accessible", or a design review.

Use proactively for security review. The SECURITY AUDITOR maps a project's attack surface and audits it front-to-back for vulnerabilities — broken authorization (IDOR/BOLA/privesc), injection, auth/session/JWT flaws, secrets & crypto, and SSRF/traversal — using the SKULL security skills. It records every finding under .security/ with an OWASP/CWE id, severity, path:line evidence and a concrete fix. Read-only toward your source: it never edits your code, it only writes under .security/.

Use proactively. SENTINEL is the project cartographer: it keeps the whole repository as a live map in .sentinel/, finds gaps, bugs, missing tests, risky changes and dead code in real time, documents every finding, and cross-links related ones. Invoke it to build the initial map (first run), to sweep changes since the last review, or to report the current state. Read-only toward source — it never edits your code; it only writes under .sentinel/.

Use proactively for testing / QA. The TESTER stands up a per-project QA workspace and runs every test type — user-end, black-box, code, and stress/load — against any project, then writes a charted status dashboard to skull.html at the project root. It drives the bundled QA engine (.claude/skills/testing/engine) and reuses cap-tdd, testmedic and guardian. Read-only toward your source: it never edits your application code — it only writes test artifacts under .skull/qa/, the QA workspace, and the root skull.html. Triggers on "test everything", "QA", "no tests", "test this app", "pre-release check", "load/stress test", "is it ready to ship".

Frontend performance where users feel it — Core Web Vitals, bundle size, render cost. Triggers on "it's slow / laggy / janky", "the page jumps", a poor Lighthouse or PageSpeed score, LCP/CLS/INP problems, a large bundle, slow lists or re-renders, or before launching anything public. Diagnoses with real numbers first, then fixes the thing that actually costs — not the thing that's fun to optimize.

Know which environment you are standing in before you touch anything. Triggers on starting work on a server, "is this prod?", "which environment is this", before any deploy, migration, restart or seed, and the moment you ssh into a box you didn't just provision. Writes the verdict to `.skull/env` so every other ops skill can key off it.

The SKULL leader/conductor. Triggers on "skull", "set up skull", "mc setup", "onboard me", "build my team", "what's new", or when starting work in a new/unfamiliar project. It interviews you (grill-me), maps the project, then assembles a tailored team from the installed skills and agents — Sentinel the project cartographer plus planning, review, understanding, guardrail and security specialists — and runs it on your work. It builds the best `.claude/` workspace per project, delegates to parallel subagents (choosing the right model per agent), brainstorms hard and decides fast, keeps a complete view of every installed capability, keeps itself and you current with the newest Claude Code features, and proactively offers the right tool the moment a need shows up.

Review API security (REST & GraphQL) — broken object/function level authorization (BOLA/BFLA), mass assignment, excessive data exposure, missing rate-limiting / resource limits, weak input validation, and GraphQL introspection/depth/batching. Use when reviewing API endpoints, controllers, resolvers, or serializers.

Generate and edit Microsoft Office files — Word, Excel, PowerPoint — when the deliverable is a document, not code. Triggers on "make a Word doc", "generate an Excel report", "build a spreadsheet with formulas or charts", "create a deck or slides", "fill a docx template". Reaches for python-docx and docxtpl (templated documents), openpyxl and XlsxWriter (spreadsheets with real formulas, styling, charts), and python-pptx (slides from data). Prefers templating over hand-building; keeps numbers as live formulas, not strings.

4 hooks across 3 events