{
  "markdown": "<div align=\"center\">\n\n<!-- Replace with your actual logo: add .github/assets/logo.png to the repo -->\n<img src=\".github/assets/banner2.png\" alt=\"Enpitech\" width=\"\" />\n\n<br />\n<br />\n\n# AI Tools\n\n**We've distilled 10+ years of frontend and fullstack engineering into a structured AI toolkit —<br />a skills repository purpose-built for AI agents and LLMs.**\n\n[![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)\n[![Claude Code Plugin](https://img.shields.io/badge/Claude%20Code-Plugin-7C3AED)](https://code.claude.com/docs/en/plugins)\n[![GitHub Actions](https://img.shields.io/badge/CI-GitHub%20Actions-2088FF)](https://github.com/enpitech/ai-tools/actions)\n\n[What's Inside](#whats-inside) · [Code Review](#code-review) · [Implementation Skills](#implementation-skills) · [All Skills](#available-skills) · [Installation](#installation) · [CI Setup](#ci-setup)\n\n</div>\n\n<br />\n\n> **Built by [Enpitech](https://enpitech.dev)** | a comprehensive AI engineering toolkit for [Claude Code](https://docs.anthropic.com/en/docs/claude-code), VS Code Copilot, Cursor, and more. Multi-pass code review, Figma-to-code implementation, and growing. Works in CI and locally. Supports React, Node.js, Python, and any language.\n\n<br />\n\n## Install\n\nIn Claude Code, run these one by one:\n\n```\n/plugin marketplace add enpitech/ai-tools\n```\n\n```\n/plugin install enpitech@enpitech\n```\n\nThen `/reload-plugins` to activate. Skills will be available under `/enpitech:<skill-name>`.\n\n<br />\n\n## What's Inside\n\nThis toolkit packages Enpitech's 10+ years of frontend and fullstack expertise into structured AI skills. Each skill gives your agent a **deterministic, repeatable process** — not a vague prompt, but a step-by-step system.\n\n<table>\n<tr>\n<td width=\"50%\">\n\n### 🔬 Code Review\nMulti-pass review system: 5–7 sequential passes per language. Bugs → Security → Architecture → Performance → Quality. CI-ready.\n\n### 🎨 Figma → Code\nPixel-perfect implementation from Figma designs via MCP. Auto breakpoints, design tokens, asset export, visual verification.\n\n### 🔄 Two review scopes\n`cr-*` reviews PR diffs (CI + local).<br />`cra-*` audits the full codebase (local, includes deps).\n\n</td>\n<td width=\"50%\">\n\n### 🧠 Auto-detection\nFullstack and general skills detect your language and framework automatically.\n\n### ⚡ CI-ready\nShips with a GitHub Actions workflow. Comment `/cr-react` on a PR → threaded review comments with `/fix` autofix support.\n\n### 🛠 Customizable\nAll criteria live in plain markdown files. Add passes, change thresholds, adapt to your stack. More skills coming.\n\n</td>\n</tr>\n</table>\n\n<br />\n\n## Example Use Cases\n\n<table>\n<tr>\n<td>\n\n#### 💬 PR review in CI\nA developer opens a PR with React changes. A teammate comments `/cr-react`. Claude runs 7 review passes on the diff and posts a threaded comment with findings. Each finding ends with \"reply `/fix`\" and the summary ends with \"reply `/fix-all`\".\n\n</td>\n<td>\n\n#### 🔍 Pre-merge local check\nBefore pushing a Node.js branch, run `/enpitech:cr-node` locally. Get a findings report, then choose: save to file, fix step by step (approve each change), or fix all at once.\n\n</td>\n</tr>\n<tr>\n<td>\n\n#### 🏗 Full codebase audit\nA tech lead assesses a Python project before a refactor. `/enpitech:cra-python` scans every file + system-level checks (dead code, circular imports, config drift) + full dependency audit.\n\n</td>\n<td>\n\n#### 🎨 Figma to production code\nA designer hands off a Figma section. `/enpitech:figma-to-code` pulls the design via MCP, classifies nodes as assets or UI elements, uses your design tokens, and screenshots every breakpoint until it matches.\n\n</td>\n</tr>\n<tr>\n<td>\n\n#### 🌐 Fullstack cross-layer review\nA PR touches React frontend and Express backend. `/enpitech:cr-fullstack` auto-detects the stack, applies the right passes per layer, and checks cross-layer issues like API mismatches and auth flow gaps.\n\n</td>\n<td>\n\n#### 📦 Dependency health check\nBefore a release, `/enpitech:cr-deps` checks for CVEs, outdated packages, deprecated deps, license issues, unused packages, and lockfile integrity.\n\n</td>\n</tr>\n</table>\n\n<br />\n\n---\n\n## Available Skills\n\n### Code Review\n\nTwo scope prefixes, applied uniformly across all languages:\n\n| Prefix | Scope | Where | Includes deps? |\n|--------|-------|-------|:---:|\n| `cr-` | PR diff + affected files | CI + Local | ✗ |\n| `cra-` | Full codebase audit | Local only | ✓ |\n\n<br />\n\n| Skill | Scope | What it does | CI Trigger |\n|:------|:-----:|:-------------|:----------:|\n| `cr-react` | Diff | 7-pass React/Next.js review | `/cr-react` |\n| `cra-react` | Full | React audit + system checks + dep audit | — |\n| `cr-node` | Diff | 7-pass Node.js review | `/cr-node` |\n| `cra-node` | Full | Node.js audit + system checks + dep audit | — |\n| `cr-python` | Diff | 7-pass Python review | `/cr-python` |\n| `cra-python` | Full | Python audit + system checks + dep audit | — |\n| `cr-general` | Diff | 5-pass language-agnostic review | `/cr-general` |\n| `cra-general` | Full | General audit + system checks + dep audit | — |\n| `cr-deps` | Deps | 6-pass dependency health audit | `/cr-deps` |\n| `cr-fullstack` | Diff | Auto-detect stack + cross-layer checks | `/cr-fullstack` |\n| `cra-fullstack` | Full | Full audit per layer + cross-layer + dep audit | — |\n\n> All review skills report only **CRITICAL** and **WARNING** findings at **8/10+ confidence**.\n\n<br />\n\n### Implementation Skills\n\n| Skill | What it does | Requirements |\n|:------|:-------------|:-------------|\n| `figma-to-code` | Pixel-perfect Figma → responsive production code. Auto breakpoints, DS tokens, asset export, visual verification loop. | Figma MCP + Playwright MCP |\n\n<br />\n\n---\n\n## Detailed Review Passes\n\n<details>\n<summary><strong>React/Next.js</strong> — 7 passes</summary>\n\n<br />\n\n| Pass | Focus | Examples |\n|:-----|:------|:--------|\n| 1. BUGS | Logic errors | null access, race conditions, wrong conditionals |\n| 2. SECURITY | Vulnerabilities | XSS, exposed secrets, unauthenticated Server Actions |\n| 3. COMPONENT ARCHITECTURE | Structure | God components, prop drilling, cross-feature imports |\n| 4. HOOKS & STATE | React patterns | Derived state in useEffect, stale closures, joinable hooks |\n| 5. PERFORMANCE | Speed | Sequential awaits, missing dynamic imports, barrel file imports |\n| 6. CODE QUALITY | React-specific | Array mutation, missing error boundaries, duplicated logic |\n| 7. INTENT CHECK | PR scope | Unrelated changes that snuck into the diff |\n\n**Context-aware**: React Compiler, Next.js SSR/RSC, design systems (`@radix-ui`, `shadcn`).\n\n```\n/enpitech:cr-react          # PR diff review\n/enpitech:cra-react         # Full codebase audit + system checks + dep audit\n```\n\n</details>\n\n<details>\n<summary><strong>Node.js</strong> — 7 passes (OWASP + eslint-plugin-security)</summary>\n\n<br />\n\n| Pass | Focus | Examples |\n|:-----|:------|:--------|\n| 1. BUGS | Logic errors | Unhandled promise rejections, race conditions, event loop blocking |\n| 2. SECURITY | Vulnerabilities | eval/exec injection, prototype pollution, ReDoS, SSRF, missing helmet/CSRF |\n| 3. ASYNC PATTERNS | Event loop | Blocking calls in async, missing Promise.all, stream backpressure |\n| 4. ERROR HANDLING | Resilience | Bare catch, missing error events, uncaughtException without exit |\n| 5. API DESIGN | Express/Fastify | Missing request size limits, rate limiting, input validation, permissive CORS |\n| 6. PERFORMANCE | Runtime | Sync fs/crypto ops, missing connection pooling, N+1 queries, memory leaks |\n| 7. CODE QUALITY | Node-specific | `require(variable)`, `new Buffer()`, deprecated APIs, missing graceful shutdown |\n\n**Context-aware**: Express, Fastify, Koa; TypeScript; Prisma, Sequelize, TypeORM, Mongoose.\n\n```\n/enpitech:cr-node            # PR diff review\n/enpitech:cra-node           # Full codebase audit + system checks + dep audit\n```\n\n</details>\n\n<details>\n<summary><strong>Python</strong> — 7 passes (Bandit + Ruff + Pylint)</summary>\n\n<br />\n\n| Pass | Focus | Examples |\n|:-----|:------|:--------|\n| 1. BUGS | Logic errors | Mutable default arguments, loop variable closures, unreachable code |\n| 2. SECURITY | Vulnerabilities | eval/exec, pickle, subprocess shell=True, SQL injection, unsafe YAML, XML attacks |\n| 3. TYPE SAFETY | Type correctness | Missing annotations, inconsistent returns, overly broad `Any` |\n| 4. ASYNC PATTERNS | asyncio/threading | Blocking in async, missing await, sync sleep, thread safety |\n| 5. API DESIGN | Django/Flask/FastAPI | Missing auth decorators, debug mode, insecure uploads, rate limiting |\n| 6. PERFORMANCE | Efficiency | Generator vs list comprehension, quadratic string concat, inefficient loops |\n| 7. CODE QUALITY | Pythonic | Bare except, mutable defaults, unused imports, missing context managers |\n\n**Context-aware**: Django, Flask, FastAPI, SQLAlchemy, Pydantic, pytest, mypy/pyright.\n\n```\n/enpitech:cr-python          # PR diff review\n/enpitech:cra-python         # Full codebase audit + system checks + dep audit\n```\n\n</details>\n\n<details>\n<summary><strong>General — Any Language</strong> — 5 passes</summary>\n\n<br />\n\nWorks with Vue.js, Angular, Svelte, Go, Rust, Ruby, PHP, Java, Kotlin, Swift, C#, and more.\n\n| Pass | Focus | Examples |\n|:-----|:------|:--------|\n| 1. BUGS | Logic errors | Null access, resource leaks, concurrency issues, off-by-one |\n| 2. SECURITY | Vulnerabilities | Injection, hardcoded secrets, insecure crypto, SSRF, XSS, CSRF |\n| 3. ERROR HANDLING | Resilience | Silent failures, bare exception catching, missing cleanup |\n| 4. PERFORMANCE | Efficiency | Blocking I/O, N+1 queries, quadratic algorithms, memory issues |\n| 5. CODE QUALITY | Maintainability | Dead code, duplication, overly complex functions, deprecated APIs |\n\n**Auto-detects** language and framework, then applies framework-specific checks (Vue `v-html` XSS, Go unchecked errors, Rails mass assignment, Laravel raw queries, Spring injection, etc.).\n\n```\n/enpitech:cr-general         # PR diff review\n/enpitech:cra-general        # Full codebase audit + system checks + dep audit\n```\n\n</details>\n\n<details>\n<summary><strong>Dependencies</strong> — 6 audit passes</summary>\n\n<br />\n\n| Pass | Focus | What It Checks |\n|:-----|:------|:---------------|\n| 1. VULNERABILITIES | Security | `npm audit` / `pip-audit` — CVEs by severity |\n| 2. OUTDATED | Freshness | Major version lag, security-related updates |\n| 3. DEPRECATIONS | Lifecycle | Deprecated packages, suggested replacements |\n| 4. LICENSE | Compliance | Copyleft in permissive projects, missing licenses |\n| 5. UNUSED | Bloat | Declared but never imported dependencies |\n| 6. LOCKFILE | Integrity | Missing lockfile, unpinned versions, sync issues |\n\nAuto-detects npm, yarn, pnpm, pip, poetry, uv, pipenv.\n\n```\n/enpitech:cr-deps\n```\n\n> Runs standalone, or automatically as part of any `cra-*` full audit. Not included in `cr-*` diff reviews.\n\n</details>\n\n<details>\n<summary><strong>Fullstack — Cross-Layer</strong> (Auto-Detect)</summary>\n\n<br />\n\n**Dynamically detects** which languages are in the project and applies the right criteria per layer:\n\n| Detected | Criteria applied |\n|:---------|:-----------------|\n| React/Next.js | `rules/react.md` |\n| Express/Fastify/Koa | `rules/node.md` |\n| Django/Flask/FastAPI | `rules/python.md` |\n| Vue, Angular, Svelte, Go, Rust, Ruby, PHP, Java, etc. | `rules/general.md` |\n| Monorepo | Reads each workspace's config to classify |\n\n**Stack examples:**\n- React + Express → React passes on frontend, Node passes on backend\n- Vue + Go → General passes on both (auto-adapted)\n- React + FastAPI → React passes on frontend, Python passes on backend\n\n**Cross-layer checks** (always applied):\n1. API contract validation\n2. Shared type drift\n3. Environment variable hygiene\n4. Authentication flow consistency\n5. Error contract matching\n6. Data flow security\n7. API versioning & deprecation\n\n```\n/enpitech:cr-fullstack       # PR diff + cross-layer checks\n/enpitech:cra-fullstack      # Full audit per layer + cross-layer + system checks + dep audit\n```\n\n</details>\n\n<details>\n<summary><strong>Figma → Code</strong> — Implementation Skill</summary>\n\n<br />\n\nConverts Figma designs into pixel-perfect, responsive, production-ready code using MCP tools.\n\n| Step | What it does |\n|:-----|:-------------|\n| 1. Variables | Collects section name, Figma URL, node IDs, route, selector from user |\n| 2. Baselines | Pulls mobile/tablet/desktop images via Figma MCP |\n| 3. Token mapping | Auto-discovers breakpoints, maps design values to existing DS tokens |\n| 4. Asset classification | Classifies each node as ASSET (export as-is) or UI ELEMENT (build with code) |\n| 5. Scaffold | Generates responsive code using DS primitives and tokens |\n| 6. Visual verification | Screenshots via Playwright MCP, compares to Figma baseline, iterates |\n\n**Requires**: Figma MCP server + Playwright MCP server running.\n\n**Policies**: No invented content/styles. No new breakpoints. No custom sizes outside token scale. Assets used as-is (never recreated with CSS).\n\n```\n/enpitech:figma-to-code      # Interactive — asks for Figma URL and section details\n```\n\n</details>\n\n<br />\n\n---\n\n## Installation\n\nThe skills and rules are structured markdown files. They work natively as a **Claude Code plugin**, but can also be used with **any AI coding assistant** that reads instructions from your repo — including VS Code with GitHub Copilot, Cursor, Windsurf, and others.\n\n### Option A: Claude Code Plugin\n\n**From a marketplace** search for \"Enpitech\" and install the \"AI Tools\" plugin. or in claude code, run:\n\n```\n/plugins install enpitech\n```\n\n**From a local directory:**\n\n```bash\ngit clone https://github.com/enpitech/ai-tools.git\nclaude --plugin-dir ./ai-tools\n```\n\nOr add it permanently to your project's `.claude/plugins.json`.\n\nSkills become `/enpitech:cr-react`, `/enpitech:cra-react`, `/enpitech:cr-node`, etc.\n\n> **Note:** Plugins don't install workflow files. Copy the CI workflow manually:\n> ```bash\n> cp -r ai-tools/.github your-project/\n> ```\n\n### Option B: Copy into your project (works with any AI tool)\n\n```bash\n# Clone this repo\ngit clone https://github.com/enpitech/ai-tools.git\n\n# Copy into your project\ncp -r ai-tools/rules your-project/rules\ncp -r ai-tools/skills your-project/skills\ncp -r ai-tools/.github your-project/        # CI workflow (optional)\n```\n\nOnce the files are in your repo, any AI coding assistant can use them:\n\n| Tool | How it picks up the skills |\n|:-----|:---------------------------|\n| **Claude Code** | Reads `skills/` and `rules/` automatically. Invoke with `/cr-react`, `/cra-node`, etc. |\n| **GitHub Copilot (VS Code)** | Reference the rules files as context in chat, or add them to `.github/copilot-instructions.md` |\n| **Cursor** | Add rules files to `.cursor/rules/` or reference them in chat context |\n| **Windsurf** | Reference the criteria markdown files as project context |\n| **Other AI assistants** | Point the agent to the relevant `rules/*.md` file — they're self-contained review criteria |\n\n> The `rules/*.md` files are the core value — they contain all the review criteria and work with any LLM. The `skills/*/SKILL.md` files add agent-specific automation (diff collection, file scanning, output formatting, MCP orchestration).\n\n<details>\n<summary><strong>Cherry-pick what you need</strong></summary>\n\n<br />\n\n**Rules** (review criteria — pick by language):\n\n| File | Purpose |\n|:-----|:--------|\n| `rules/react.md` | React/Next.js 7-pass review criteria |\n| `rules/node.md` | Node.js 7-pass review criteria |\n| `rules/python.md` | Python 7-pass review criteria |\n| `rules/general.md` | Language-agnostic 5-pass review criteria |\n| `rules/deps.md` | Dependency audit criteria |\n| `rules/fullstack.md` | Cross-layer check criteria |\n| `rules/autofix.md` | Autofix workflow (local options + CI comment format) |\n\n**Skills** (pick by language + scope):\n\n| File | Skill |\n|:-----|:------|\n| `skills/cr-react/SKILL.md` | PR diff React review |\n| `skills/cra-react/SKILL.md` | Full codebase React audit |\n| `skills/cr-node/SKILL.md` | PR diff Node.js review |\n| `skills/cra-node/SKILL.md` | Full codebase Node.js audit |\n| `skills/cr-python/SKILL.md` | PR diff Python review |\n| `skills/cra-python/SKILL.md` | Full codebase Python audit |\n| `skills/cr-general/SKILL.md` | PR diff general review |\n| `skills/cra-general/SKILL.md` | Full codebase general audit |\n| `skills/cr-deps/SKILL.md` | Dependency health audit |\n| `skills/cr-fullstack/SKILL.md` | PR diff fullstack review |\n| `skills/cra-fullstack/SKILL.md` | Full codebase fullstack audit |\n| `skills/figma-to-code/SKILL.md` | Figma → pixel-perfect production code |\n\n</details>\n\n<br />\n\n---\n\n## CI Setup\n\n1. Copy `.github/workflows/claude-code-review.yml` into your repo\n2. Add `ANTHROPIC_API_KEY` to your repo secrets (Settings → Secrets → Actions)\n3. Comment one of these on any PR:\n\n### Review Commands\n\n| Trigger | Review Type |\n|:--------|:------------|\n| `/cr-react` | React/Next.js code review |\n| `/cr-node` | Node.js code review |\n| `/cr-python` | Python code review |\n| `/cr-general` | Language-agnostic code review |\n| `/cr-deps` | Dependency health audit |\n| `/cr-fullstack` | Fullstack auto-detect + cross-layer |\n\n> `cra-*` skills (full audits) are local-only and not triggered in CI.\n\n### Autofix Commands\n\nAfter a review posts findings, reply to apply fixes:\n\n| Command | What it does | Reply to |\n|:--------|:-------------|:---------|\n| `/fix` | Apply the fix for a single finding | An individual finding comment |\n| `/fix-all` | Apply all suggested fixes at once | The main review summary comment |\n\nThe autofix job checks out the PR branch, applies the fix(es), commits, and pushes automatically.\n\n### How it works\n\nThe workflow:\n- Detects the trigger keyword and selects the appropriate review criteria\n- Only runs for repo collaborators (OWNER/MEMBER/COLLABORATOR)\n- Posts a summary comment with all findings, each linking to `/fix`\n- Posts individual finding replies with full details and suggested code changes\n- `/fix` and `/fix-all` replies trigger a separate job that applies fixes and pushes\n\n<details>\n<summary><strong>Optional: Auto-trigger on PR</strong></summary>\n\n<br />\n\nUncomment the `pull_request` trigger in the workflow:\n\n```yaml\non:\n  pull_request:\n    types: [opened, synchronize]\n  issue_comment:\n    types: [created]\n```\n\n</details>\n\n<br />\n\n---\n\n## Security\n\n- Trigger restricted to repo OWNER/MEMBER/COLLABORATOR only\n- Autofix only applies changes suggested in review findings — no arbitrary modifications\n- Fix job requires explicit `/fix` or `/fix-all` reply from an authorized collaborator\n- All commits are attributed to `github-actions[bot]`\n\n## Customization\n\nEdit the criteria files in `rules/` to add/remove review passes, adjust confidence thresholds, change severity levels, or add framework-specific checks.\n\n| File | Controls |\n|:-----|:---------|\n| `rules/react.md` | React/Next.js review rules |\n| `rules/node.md` | Node.js review rules |\n| `rules/python.md` | Python review rules |\n| `rules/general.md` | Language-agnostic review rules |\n| `rules/deps.md` | Dependency audit rules |\n| `rules/fullstack.md` | Cross-layer check rules |\n| `rules/autofix.md` | Autofix workflow (local + CI) |\n\nAll review skills reference these files — single source of truth per concern.\n\nImplementation skills like `figma-to-code` are self-contained in their `SKILL.md` — no separate rules file needed.\n\n<br />\n\n---\n\n<div align=\"center\">\n\n**Built with ❤️ by [Enpitech](https://enpitech.com)**\n\nMIT License\n\n</div>\n\n## Contributors\n\n<a href=\"https://github.com/lirankor\">\n  <img src=\"https://github.com/lirankor.png\" width=\"60\" height=\"60\" style=\"border-radius:50%\" alt=\"lirankor\" />\n</a>\n&nbsp;&nbsp;\n<a href=\"https://github.com/nir2002\">\n  <img src=\"https://github.com/nir2002.png\" width=\"60\" height=\"60\" style=\"border-radius:50%\" alt=\"nir2002\" />\n</a>\n\n## License\n\nMIT\n",
  "bytes": 19847,
  "sha": "0662389219334050ee089234dcd0355b3815b8654f96796ac4d49a2f9a568699",
  "repo_slug": "enpitech/ai-tools",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_enpitech_ai_tools_enpitech_ai_tools_f31a6e51/readme"
}