{
  "markdown": "# CTO Toolkit\n\nThe ultimate Claude Code plugin for engineering leadership — **54 skills, 6 autonomous agents, 9 automation scripts, 9 intelligent hooks, and workflow orchestrators** covering the full software engineering lifecycle. Now with **declarative skill activation**, **model routing**, and **continuous learning**.\n\nBuilt for CTOs, VPs of Engineering, Staff Engineers, and Tech Leads who ship production software.\n\n## What's New in v3.1\n\n- **Declarative Skill Activation** — All 54 skills now declare triggers in YAML frontmatter (frameworks, anti-patterns, score thresholds, file patterns, domains, dimension thresholds). Skills self-activate based on project context\n- **Model Routing** — Skills and agents declare preferred model tier (haiku/sonnet/opus) with dynamic escalation. Security-critical tasks auto-upgrade to opus; quick scans use haiku for 10x cost savings\n- **Continuous Learning** — New `session-learning.sh` Stop hook tracks session patterns (languages, tests, security activity) and generates improvement insights every 10 sessions\n- **Auto-Activation** — New `SessionStart` hook scans the project, detects frameworks/file patterns, and suggests relevant skills automatically at the start of each session\n- **Model Routing Advisory** — New `PostToolUse` hook detects when security-critical or financial files are edited and suggests deeper analysis with opus-tier models\n- **Deploy Safety Guard** — New `PreToolUse` hook intercepts production deployment commands and verifies safety (explicit env, no --force, dry-run first)\n- **Agent Model Upgrades** — adversarial-reviewer, architecture-reviewer, security-auditor, and release-readiness agents upgraded to opus by default with escalation rules\n- **Dependency Graph** — Skills declare `depends-on` for optimal execution ordering via topological sort\n\n## What's New in v3.0\n\n- **12 New Skills** — vendor-evaluation, engineering-budget, on-call-design, tech-debt-prioritization, api-gateway-patterns, multi-tenancy, feature-flags, domain-modeling, architecture-review-board, C#/.NET review, Swift/iOS review, Elixir/Phoenix review\n- **22 New Reference Files** — deep-dive docs for security (OWASP, JWT, RBAC), observability (OTEL, SLOs), database (PostgreSQL, N+1), incident response, pentest, Flutter, Kubernetes, and LGPD compliance\n- **8 Automation Scripts** — architecture lint, dependency audit, migration check, DORA metrics, compliance scan, dead code finder, test coverage gate, API breaking changes detector\n- **4 New Hooks** — Dockerfile security, SQL migration validation, test quality check, destructive command blocker\n- **Project Infrastructure** — CONTRIBUTING.md, CHANGELOG.md, sync-skills.sh for multi-project synchronization\n- **Total: 42 reference files** across 13 skills with actionable patterns and templates\n\n## Agents\n\nAutonomous subagents that scan your codebase and produce comprehensive reports without manual guidance. Agents now declare `model-routing` with escalation rules — they start at a cost-efficient tier and upgrade to opus when critical findings are detected.\n\n| Agent | Model | What it does |\n|-------|-------|-------------|\n| `architecture-reviewer` | sonnet → opus | Scans the entire codebase and produces an Architecture Health Report with scores by dimension |\n| `security-auditor` | opus | Full security audit — secrets, OWASP Top 10, auth, injection, dependencies |\n| `adversarial-reviewer` | opus | Challenges architectural decisions — stress-tests ADRs, finds hidden risks, devil's advocate |\n| `tech-debt-analyzer` | sonnet → opus | Inventories all tech debt, prioritizes by ROI, produces a sprint reduction plan |\n| `onboarding-guide` | sonnet → opus | Explores the project and generates a complete Developer Onboarding Guide |\n| `release-readiness` | sonnet → opus | Evaluates production readiness — Go/No-Go report across 7 dimensions |\n\n## Workflow Orchestrators\n\n| Skill | What it does |\n|-------|-------------|\n| `full-review` | Orchestrates code review + security + performance + database + architecture + testing into one consolidated report |\n| `health-check` | Runs architecture, tech debt, and security analysis to produce a Project Health Dashboard with scores and roadmap |\n\n## Skills (54 total)\n\n### Code Review (12 skills)\n\n| Skill | What it does |\n|-------|-------------|\n| `code-review` | Router that detects technology context and delegates to the right specialist |\n| `backend-review` | Node.js, Java, Clean Architecture, SOLID, microservices, messaging, payments |\n| `frontend-review` | Angular, React, TypeScript, accessibility, performance, CSS |\n| `flutter-review` | Dart, BLoC/Cubit, widget architecture, platform channels, performance |\n| `python-review` | Django, FastAPI, Flask, async/await, type hints, Pythonic patterns |\n| `go-review` | Goroutines, channels, error handling, interfaces, concurrency safety |\n| `rust-review` | Ownership, lifetimes, unsafe, error handling with Result/Option, async Rust |\n| `csharp-dotnet-review` | ASP.NET Core, EF Core, Minimal APIs, CQRS, MediatR, Azure patterns |\n| `swift-review` | SwiftUI, Combine, UIKit, MVVM/TCA, App Store guidelines, iOS performance |\n| `elixir-review` | OTP, GenServer, Phoenix LiveView, fault tolerance, supervision trees |\n| `security-review` | OAuth2, JWT, RBAC, API security, LGPD/GDPR, payment security |\n| `ux-review` | Nielsen heuristics, mobile UX, accessibility, design systems |\n\n### Architecture & Patterns (8 skills)\n\n| Skill | What it does |\n|-------|-------------|\n| `design-patterns` | SOLID, Clean Architecture, DDD, GoF patterns, refactoring guidance |\n| `adr` | Architecture Decision Records (Michael Nygard format) |\n| `tech-spec` | Technical specifications / RFCs with 12-section template |\n| `event-driven-architecture` | Event Sourcing, CQRS, Saga patterns, Domain Events, Kafka architecture |\n| `api-gateway-patterns` | Rate limiting, BFF pattern, circuit breaking, API versioning, request aggregation |\n| `multi-tenancy` | Row-level, schema-level, database-level isolation, tenant routing |\n| `feature-flags` | Toggle strategies, rollout patterns (canary, %), kill switches, flag lifecycle |\n| `domain-modeling` | Event Storming, Bounded Contexts, Aggregates, Value Objects, Domain Events |\n\n### DevOps & Infrastructure (5 skills)\n\n| Skill | What it does |\n|-------|-------------|\n| `devops-infra` | Docker, AWS (ECS, Lambda, S3, RDS), CI/CD, Kafka, SQS/SNS, monitoring |\n| `terraform-iac` | Terraform modules, state management, security, CI/CD pipelines |\n| `kubernetes-review` | K8s manifests, Helm charts, pod security, RBAC, network policies, GitOps |\n| `observability` | SLOs/SLIs, alerting strategy, dashboards, OpenTelemetry, on-call |\n| `cost-optimization` | FinOps, right-sizing, pricing models, cloud waste elimination |\n\n### Data & AI (2 skills)\n\n| Skill | What it does |\n|-------|-------------|\n| `data-engineering` | Pipelines, ETL/ELT, data quality, data contracts, dbt, Airflow, governance |\n| `ai-ml-engineering` | MLOps, model serving, LLM integration, RAG, evaluation, responsible AI |\n\n### Quality & Security (4 skills)\n\n| Skill | What it does |\n|-------|-------------|\n| `testing-strategy` | TDD, BDD, unit/integration/E2E testing, coverage guidelines, QA |\n| `pentest` | OWASP Top 10, PTES methodology, vulnerability reporting, STRIDE |\n| `systematic-debugging` | Scientific debugging method, binary search, production debugging |\n| `compliance-review` | SOC2, HIPAA, PCI-DSS, ISO 27001, LGPD/GDPR checklists and controls |\n\n### Database, Performance & API (4 skills)\n\n| Skill | What it does |\n|-------|-------------|\n| `database-review` | Schema design, migrations, EXPLAIN plans, indexing, connection pools |\n| `performance-profiling` | Node.js/Java/Flutter profiling, load testing, caching strategies |\n| `api-documentation` | OpenAPI/Swagger specs, REST design, documentation quality |\n| `graphql-review` | Schema design, N+1 prevention, query complexity, federation, security |\n\n### Process & Management (13 skills)\n\n| Skill | What it does |\n|-------|-------------|\n| `sprint-planning` | User stories (INVEST), estimation, RICE prioritization, roadmaps |\n| `git-flow` | Branching strategies, Conventional Commits, PR guidelines, SemVer |\n| `pr-description` | Generates senior-level PR descriptions with risk assessment |\n| `one-on-one` | 1:1 prep, SBI feedback framework, career development, skip-levels |\n| `incident-postmortem` | Blameless postmortems, runbooks, severity classification, escalation |\n| `engineering-metrics` | DORA metrics, cycle time, developer productivity, investment allocation |\n| `team-scaling` | Org design, engineering ladder, team topologies, hiring framework |\n| `technical-interview` | Interview plans, rubrics, system design questions, scorecards |\n| `vendor-evaluation` | Build vs Buy scorecard, vendor lock-in risk, SLA negotiation |\n| `engineering-budget` | Headcount forecasting, infrastructure cost modeling, ROI analysis |\n| `on-call-design` | Rotation design, escalation tiers, burnout prevention, runbook standards |\n| `tech-debt-prioritization` | RICE scoring, Cost of Delay, sprint allocation, stakeholder communication |\n| `architecture-review-board` | RFC governance, decision log, ARB process, review criteria |\n\n### Operational Excellence (3 skills)\n\n| Skill | What it does |\n|-------|-------------|\n| `chaos-engineering` | Resilience testing, fault injection, game days, experiment design |\n| `migration-strategy` | Monolith to microservices, cloud migration, strangler fig, database migration |\n| `developer-experience` | DX audit, build times, CI/CD speed, onboarding friction, golden paths |\n\n### Cross-Cutting (1 skill)\n\n| Skill | What it does |\n|-------|-------------|\n| `quality-standard` | Protocol enforcing self-verification, edge case analysis, and quality gates across all skills |\n\n## Automation Scripts\n\nShell scripts for CI/CD integration and manual audits.\n\n| Script | What it does |\n|--------|-------------|\n| `architecture-lint.sh` | Validates Clean Architecture layer boundaries (domain → infra, HTTP leakage) |\n| `dependency-audit.sh` | Checks vulnerabilities, outdated packages, unused dependencies, lock files |\n| `migration-check.sh` | Validates migration naming, ordering, dangerous operations (DROP, TRUNCATE) |\n| `dora-collect.sh` | Collects DORA metrics from Git history (deploy frequency, lead time, failure rate) |\n| `compliance-scan.sh` | Scans for PII in logs, hardcoded secrets, AWS keys, insecure HTTP URLs |\n| `dead-code-finder.sh` | Finds unused exports, orphan files, large commented-out blocks |\n| `test-coverage-gate.sh` | Enforces coverage threshold (supports Jest, Vitest, Flutter, pytest) |\n| `api-breaking-changes.sh` | Detects removed routes, changed DTOs, OpenAPI spec diffs |\n| `sync-skills.sh` | Synchronizes skills + references from toolkit to target projects |\n\n## Hooks\n\nAutomatic event handlers that run silently in the background across 4 lifecycle phases.\n\n| Event | What it does |\n|-------|-------------|\n| `SessionStart` | **Auto-Activation** — Detects frameworks, file patterns, and project context. Suggests relevant skills |\n| `PreToolUse` (Bash) | Blocks destructive commands (rm -rf /, DROP DATABASE, fork bombs) |\n| `PreToolUse` (Bash) | **Deploy Safety Guard** — Verifies production deploy commands (kubectl, terraform, npm publish) |\n| `PostToolUse` (Write/Edit) | Scans edited files for hardcoded secrets, dangerous functions, SQL injection |\n| `PostToolUse` (Write) | Validates Dockerfile security (non-root, multi-stage, no secrets, no :latest) |\n| `PostToolUse` (Write) | Validates SQL migration naming and safety (CONCURRENTLY, NOT NULL + DEFAULT) |\n| `PostToolUse` (Write/Edit) | Checks test quality (descriptive names, edge cases, no console.log) |\n| `PostToolUse` (Write/Edit) | **Model Routing Advisory** — Suggests opus-tier analysis for security-critical/financial files |\n| `Stop` | Reviews session work for security, error handling, and naming quality |\n| `Stop` | **Session Learning** — Records session patterns for continuous improvement insights |\n\n## Features\n\n- **Declarative activation**: Skills declare triggers in YAML frontmatter — frameworks, anti-patterns, scores, file patterns, domains\n- **Model routing**: Each skill and agent declares preferred model tier (haiku/sonnet/opus) with dynamic escalation on critical findings\n- **Continuous learning**: Session patterns recorded in `.cto-toolkit/learning/` — insights generated every 10 sessions\n- **Dependency graph**: Skills declare `depends-on` for topological ordering — compliance runs after security, not before\n- **Progressive disclosure**: Lean SKILL.md files (~100-150 lines) with deep-dive `references/` loaded on demand\n- **42 reference files**: 8,000+ lines of detailed examples, patterns, and templates across 13 skills\n- **Read-only review skills**: `allowed-tools` restricts review skills to read operations only\n- **Autonomous agents**: 6 agents that analyze codebases end-to-end without user guidance\n- **Workflow orchestration**: Multi-skill coordination with consolidated reports\n- **Intelligent hooks**: 9 hooks across 4 lifecycle phases (SessionStart, PreToolUse, PostToolUse, Stop)\n- **9 automation scripts**: CI/CD-ready shell scripts for architecture, security, and quality gates\n- **Multi-project sync**: `sync-skills.sh` propagates toolkit updates to all your projects\n\n## Install\n\n```bash\n# Test locally\nclaude --plugin-dir /path/to/cto-toolkit\n\n# Or add as marketplace\n/plugin marketplace add camilooscargbaptista/cto-toolkit\n```\n\n## Sync to Projects\n\n```bash\n# Sync all skills + references to another project\n./scripts/sync-skills.sh ~/your-project .gemini/antigravity/skills\n```\n\n## Usage\n\nSkills and agents activate automatically based on context:\n\n```\n\"Review this C# controller\"               → triggers csharp-dotnet-review\n\"Do a full security audit\"                → triggers security-auditor agent\n\"How healthy is this project?\"            → triggers health-check workflow\n\"Help me evaluate this vendor\"            → triggers vendor-evaluation\n\"Plan the engineering budget\"             → triggers engineering-budget\n\"Design our on-call rotation\"            → triggers on-call-design\n\"Prioritize our tech debt\"               → triggers tech-debt-prioritization\n\"Design the multi-tenant architecture\"   → triggers multi-tenancy\n\"Set up feature flags\"                    → triggers feature-flags\n\"Model this domain\"                       → triggers domain-modeling\n\"Review this API gateway config\"          → triggers api-gateway-patterns\n\"Run an architecture review board\"       → triggers architecture-review-board\n\"Prepare for SOC2 audit\"                 → triggers compliance-review\n\"Plan the migration to microservices\"    → triggers migration-strategy\n\"Run a chaos engineering game day\"       → triggers chaos-engineering\n```\n\n## Tech Stack Coverage\n\n- **Backend**: Node.js, Java, Python, Go, Rust, C#/.NET, Elixir, NestJS, Spring Boot, Django, FastAPI, Flask, Gin, Axum, ASP.NET Core, Phoenix\n- **Frontend**: Angular, React, TypeScript\n- **Mobile**: Flutter, Dart, Swift/SwiftUI, UIKit\n- **Infrastructure**: Docker, Kubernetes, AWS, Terraform, GitHub Actions, ArgoCD\n- **Data**: PostgreSQL, MySQL, MongoDB, DynamoDB, Redis, Kafka, SQS, SNS, dbt, Airflow, Spark\n- **AI/ML**: LLM integration, RAG, MLOps, model serving, evaluation frameworks\n- **GraphQL**: Apollo, Relay, Federation, DataLoader\n- **Observability**: OpenTelemetry, Prometheus, Grafana, CloudWatch, Datadog\n- **Compliance**: SOC2, HIPAA, PCI-DSS, ISO 27001, LGPD, GDPR\n\n## License\n\nMIT License — see [LICENSE](LICENSE)\n\n## Author\n\n**Girardelli Tecnologia**\nCamilo Girardelli — [camilo.baptista@girardellitecnologia.com](mailto:camilo.baptista@girardellitecnologia.com)",
  "bytes": 15716,
  "sha": "0d6abbbf0d5b88f0b77ffc9bd163d7e074a83d5c703055ba51c9db4aff4710e0",
  "repo_slug": "camilooscargbaptista/cto-toolkit",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_camilooscargbaptista_cto_toolkit_cto_too_cd834790/readme"
}