Developer Skills for Claude Code

A growing, multi-language set of opinionated, checklist-driven Claude Code skills for professional software development. It began as a Python library-development toolkit (based on the guide at mcginniscommawill.com) and now also covers Go, Swift/Apple apps, Rust, Scala, and browser extensions. Install only the languages and bundles that make sense for you.

Heads up — repo rename planned. The GitHub repository is still named wdm0006/python-skills for now and may be renamed to reflect its polyglot scope. The marketplace-add command below uses that repo path and will change when the repo is renamed; the install slug is @dev-skills.

Installation

Step 1: Add the Marketplace

First, add this repository as a plugin marketplace in Claude Code:

/plugin marketplace add wdm0006/python-skills

Step 2: Install the Bundles You Need

Install a per-language bundle:

# Python — complete library toolkit (setup, quality, testing, packaging, docs, and more)
/plugin install python-library-complete@dev-skills

# Go — project setup & a CI gate that actually gates
/plugin install go-projects@dev-skills

# Swift / Apple platforms — Xcode build & CI, signing, Keychain, CloudKit/SwiftData, TestFlight releases
/plugin install swift-apps@dev-skills

# Swift releases — TestFlight and App Store delivery
/plugin install shipping-swift-apps@dev-skills

# Rust — Cargo layout, fmt/clippy/test gate, MSRV, crates.io publishing
/plugin install rust-crates@dev-skills

# Scala — sbt build, scalafmt/scalafix gates, cross-building, Maven Central
/plugin install scala-projects@dev-skills

# Browser extensions — Manifest V3 service workers, chrome.storage safety, Jest chrome mocks
/plugin install browser-extensions@dev-skills

Or install a narrower Python bundle:

# Core skills for starting Python projects
/plugin install python-library-foundations@dev-skills

# Packaging and releasing Python libraries
/plugin install python-library-distribution@dev-skills

# Quality-focused Python skills (security, performance, API design, git hygiene)
/plugin install python-library-quality@dev-skills

# Opinionated architecture for Python web apps
/plugin install python-web-app@dev-skills

# Python MCP servers for LLM clients (FastMCP)
/plugin install python-mcp-servers@dev-skills

# LLM-backed Python features
/plugin install python-llm-features@dev-skills

Or install a language-agnostic bundle:

# Resumable batch and synchronization jobs
/plugin install resumable-sync-jobs@dev-skills

# Verify third-party libraries, APIs, build backends, and scraped documents
/plugin install verifying-external-behavior@dev-skills

# Build and verify release artifacts
/plugin install shipping-build-artifacts@dev-skills

# Reproduce CI failures locally
/plugin install reproducing-ci-locally@dev-skills

# Keep user-facing facts consistent across product surfaces
/plugin install shipping-across-surfaces@dev-skills

# Compute and report statistics, scores, and flags honestly
/plugin install reporting-derived-metrics@dev-skills

# Normalize a document before anything measures it
/plugin install normalizing-text-for-measurement@dev-skills

# Load, merge, and validate layered application configuration
/plugin install wiring-application-config@dev-skills

# Resolve conflicts across branches open against one repo at once
/plugin install merging-concurrent-branches@dev-skills

# Keep expensive resources off cheap code paths
/plugin install deferring-heavy-dependencies@dev-skills

# Guard deletes, history rewrites, and caller-supplied file paths
/plugin install guarding-destructive-operations@dev-skills

# Establish a finding before you publish it, and correct it after
/plugin install writing-defect-reports@dev-skills

Alternative: Local Installation

For project-specific installation, clone this repository and copy the skills you need:

# Clone the repository
git clone https://github.com/wdm0006/python-skills.git

# Copy skills to your project's .claude/skills/ directory
mkdir -p .claude/skills
cp -r python-skills/skills/python/* .claude/skills/       # or skills/go/*, skills/swift/*, etc.
cp -r python-skills/skills/common/* .claude/skills/       # git hygiene applies to every language

Or for global installation (available in all projects):

# Copy to your personal Claude skills directory
mkdir -p ~/.claude/skills
cp -r python-skills/skills/*/* ~/.claude/skills/

Verifying Installation

After installation, you can verify the skills are loaded by running:

/plugin list

Note: Skills require Claude Code Pro, Max, Team, or Enterprise. Free tier users do not have access to Skills.

Available Skills

Python

Skill	Description	Based On
setting-up-python-libraries	Project setup with pyproject.toml, uv, ruff, pytest, pre-commit, GitHub Actions	Defining Library Scope, Dependency Management, Licensing, pyproject.toml Explained
improving-python-code-quality	Ruff linting, mypy type checking, Pythonic idioms, refactoring	Linting & Formatting with Ruff, Understanding McCabe Complexity, Adding Type Hints
testing-python-libraries	Pytest test suites, fixtures, parametrization, Hypothesis property-based testing	Testing with Pytest, Testing Coverage, Testing with Tox, Testing with Mocking
auditing-python-security	Security audits with Bandit, pip-audit, Semgrep, detect-secrets	Avoiding Injection Flaws, Intro to Bandit, Dependency Security, Handling Sensitive Data, Secure Coding Practices
designing-python-apis	API design principles, deprecation, breaking changes, error handling	The Art of API Design, Designing for Developer Joy
documenting-python-libraries	Google-style docstrings, Sphinx setup, ReadTheDocs configuration	Writing Effective Docstrings, Getting Started with Sphinx, Automating Docs Deployment, Documenting Your Library's API
packaging-python-libraries	pyproject.toml, PyPI publishing, trusted publishing, wheel building	pyproject.toml Explained, Publishing PyGeohash
managing-python-releases	Semantic versioning, changelogs, release automation, deprecation workflows	Semantic Versioning
optimizing-python-performance	Profiling, memory analysis, benchmarking, optimization strategies	Performance Benchmarking, Profiling with PyInstrument, Memory Profiling with Memray
deferring-heavy-dependencies	Keeping ML models, dictionaries and large imports off cheap code paths — lazy fields instead of constructor work, factories split by what the path needs, per-call timing in a fresh process, one-time import vs repeated model load, and the tests that only now bite	—
building-python-clis	Click/Typer CLIs, command groups, shell completion, CLI testing	Guide to Python Libraries
building-python-communities	CONTRIBUTING.md, issue templates, PR templates, GitHub automation	Building Engaging Community, Inner Source Introduction, From Silos to Shared Libraries
reviewing-python-libraries	Comprehensive library reviews across all quality dimensions	Guide to Python Libraries
building-python-web-apps	Opinionated reference architecture for production web apps — FastAPI, async SQLAlchemy/Postgres, centralized bcrypt password limits, fail-closed distributed auth rate limiting, Stripe billing, Jinja or SPA frontends, and Dockerized deployment via Terraform	Production web app patterns
building-python-mcp-servers	Robust Python MCP servers with FastMCP — tool design, error contracts, event-loop-safe blocking work, CLI/subprocess wrapping, single-file vs packaged distribution, testing, and prompt-injection awareness	Guide to Python Libraries
building-llm-backed-features	Application features on top of an LLM API — prompt surfaces that drift apart, filtered evaluator sets that cannot silently become clean passes, config wiring validated at boot, live-model tests kept out of CI, stochastic accuracy evaluation, and output that doesn't over-claim	Guide to Python Libraries

Go

Skill	Description
building-go-projects	Go project setup with a CI gate that actually gates — module-path correctness, golangci-lint config matched to the installed major, deterministic gofmt, pinned toolchain, meaningful test/lint jobs, injectable git/gh runners, and safe outbound HTTP

Swift / Apple Platforms

Skill	Description
building-swift-apps	Native Swift/SwiftUI apps for macOS/iOS — unsigned CI builds (CODE_SIGNING_ALLOWED=NO), the hand-maintained pbxproj, SwiftPM-vs-app-target test boundaries, SourceKit false positives, gitignored base xcconfig, Keychain vs UserDefaults + OAuth state/PKCE, CloudKit/SwiftData constraints, and deterministic dates/RNG
shipping-swift-apps	Releasing to TestFlight and the App Store — one App Store Connect API key for both fastlane and xcodebuild, metadata/pricing lanes that can't submit a build, headless archive + -exportArchive destination=upload, build numbers read from the API instead of guessed, closed pre-release trains, SKIP_INSTALL for bundled helper apps, per-destination archives for multiplatform targets, and keeping .p8/.env credentials ignored

Rust

Skill	Description
building-rust-crates	Rust crate setup, testing, and publishing — Cargo layout, a fmt/clippy(-D warnings)/test CI gate, MSRV pinning, feature-flag hygiene, no-unwrap-in-libraries, and crates.io publishing with cargo-release

Scala

Skill	Description
building-scala-projects	Scala project setup, testing, and publishing — sbt build layout, scalafmt/scalafix gates, Scala 2-vs-3 cross-building, real (non-no-op) test jobs, and Maven Central publishing via sbt-ci-release

JavaScript / Browser Extensions

Skill	Description
building-browser-extensions	Manifest V3 extensions — service-worker message channels that survive teardown (return true + awaited responses), ??-based numeric settings reads (0 is a valid hour), lost-update-safe chrome.storage writes over defaults, JS-side settings validation (inert HTML min/max), and a Jest chrome mock that can actually fail

Common (language-agnostic)

Skill	Description	Based On
rendering-untrusted-content	Render stored/authored/imported content into HTML without shipping XSS — enumerating autoescape bypasses (|safe, Markup, innerHTML), sanitizing Markdown output with an allowlist (Markdown preserves raw HTML by design), keeping table-cell style so alignment survives, escaping on both the server and the DOM, and sanitization tests that assert on the rendered prose rather than the JSON-LD copy	—
keeping-git-repos-clean	Prevent, detect, and remediate committed secrets and dev artifacts — .gitignore, git rm --cached, history scrubbing, credential rotation. Bundled into every language's plugin.	Guide to Python Libraries
running-github-actions-efficiently	Build GitHub Actions workflows that gate the intended work — focused triggers, pinned toolchains, explicit permissions, reproducible local commands, and jobs that fail when their checks fail	—
verifying-external-behavior	Confirm what a third-party library, remote API, build backend, or scraped document actually does before depending on it — throwaway probes that run in seconds, permissive clients that forward a misspelled selector instead of rejecting it, status codes that differ between the collection and item forms of a resource, summary response shapes that make a "we already have it" fast path always-false, fakes that only prove your code calls the fake, and dry-runs that skip the step that fails	—
shipping-build-artifacts	Make the build step a real gate on what you distribute — build scripts that warn and exit 0 on a missing input, size checks with only an upper bound, hand-maintained file lists that drift from the entrypoints they must cover, committed bundles that go stale when only the source changes, GNU-only shell that aborts on the other OS, and verification that runs against the source tree instead of the artifact	—
running-resumable-sync-jobs	Batch/sync jobs that fail honestly — exit codes that report partial failure, checkpoints safe to resume, per-item tolerance vs. fatal abort, unknown-vs-coerced-0 in aggregated output, bounded per-page retries, dry-runs that mutate in-memory state identically, and compensating reserved quota	—
reproducing-ci-locally	Make the local check agree with the runner — deriving the command, paths, marker expression and env: from the workflow file rather than the Makefile, running each gate step separately because the first failure hides the rest, pinning the linter version CI resolves (an unpinned formatter that widens file coverage reddens every open PR), building the interpreter and extras the runner builds, fixing divergence in shared config rather than in the YAML, and confirming a run is green instead of explaining a red job away	—
reporting-derived-metrics	Compute statistics, scores, and flags from samples that may be too small to support them — undefined dispersion returned as 0.0 and tripping the minimum threshold it is compared against (the least data producing the strongest verdict), None vs 0/-1/NaN as the sentinel, threshold blocks gated on whether the value was measured, report sentences that narrate findings from absent data, nullability as a public API change, is None vs truthiness when []/0 are real results, and broad excepts that disguise a metric bug as a normal-shaped result	—
normalizing-text-for-measurement	Strip, parse, and segment a document before something else measures it — a close token that emits no separator fusing # Title into the paragraph below it so word counts drop and readability worsens with heading density, the two metric classes failing on different residue — character-based ones (reading time, size limits, token estimates) inflated by link targets and table pipes, word-based ones (word count, readability) corrupted by missing block boundaries — a sibling function that never calls the normalizer at all, a bare parser constructor whose preset reclassifies a table as a paragraph, sections keyed by heading text that collapse on repeats and double-count into an ancestor, deliberate lossiness indistinguishable from a bug, and regression tests that assert markdown-equals-plain-equivalent rather than a float from an unpinned library	—
shipping-across-surfaces	Land a change everywhere the same fact is stated — enumerating the surface inventory (landing copy, structured data, docs, llms.txt, changelog plus the version badge repeated in every page's nav, sitemap, README, descriptions embedded in code, and untyped frontend consumers of typed responses), generating a surface instead of restating it, drift tests that compare against the live registry rather than a second hand-written list, never hand-maintaining a snapshot of a surface another codebase owns, paired producer/consumer PRs for format changes, and keeping overloaded product words apart	—
wiring-application-config	Load, merge, and validate layered configuration (defaults plus a user YAML/TOML/JSON file or a stored settings object) so a mis-wired key fails loudly — sections the code reads that exist nowhere and sections nothing reads, strictness at the load boundary instead of .get(key, default) in every consumer, unknown keys and wrong types dropped with a warning naming the dotted path, bool excluded before any integer check, defaults deep-copied so a merge cannot alias them, get(key, default)/?? rather than or/`
concurrent-branches	Resolve conflicts when several branches are open against one repo at once — finding the hotspot files nearly every commit touches, additive registries unioned rather than chosen (a taken side deletes a component that is still on disk), version and sequence fields recomputed from the integration branch instead of merged, generated artifacts (minified bundles, built PDFs, compiled schemas) rebuilt from resolved sources rather than text- or binary-merged, files serialized from maps sorted by a stable key so diffs stay reviewable, shared identifiers appended and never renumbered, duplicate test names after a union merge, and re-running the real gate because neither branch's CI covered their union	—
guarding-destructive-operations	Put real preconditions on operations with no undo — irreversible bulk deletes and history rewrites that are only correct in a dedicated single-purpose target, refusing rather than warning and shipping no --force, placing the guard ahead of the first statement with an effect so a rejected run leaves everything byte-identical, structural ownership checks (p == base or p.startswith(base + "/")) instead of a bare prefix that admits base-backup/, name validation and resolved-path containment as two independent checks (only the second stops a symlink inside the directory), the deliberate dry-run gap, broad excepts upstream that turn a refusal into an ordinary result shape, and mutating each half of the guard separately	—
writing-defect-reports	Establish a finding before you publish it, and correct it after — an internal anomaly promoted one layer too far into a user-visible headline that does not reproduce, reporting a branch no entry point reaches or a script nothing invokes, guards that can only match the fixture written beside them, a caveat the project's own ledger or design notes already answered, quoted figures re-measured with version/command/date because the dependency behind them is unpinned, prior notes re-verified against the integration branch rather than against the note, the narrowest injection point that reproduces a failure instead of a blanket hook that kills the run first, probe output a harness silently swallows, red checks filed as "pre-existing" under a done claim, and withdrawing a published claim in the thread where it was published	—

Plugin Bundles

Per-language

• python-library-complete — all Python skills, plus the web-app architecture and MCP-server skills and git hygiene, for comprehensive Python development.
• go-projects — building-go-projects + keeping-git-repos-clean.
• swift-apps — building-swift-apps + shipping-swift-apps + keeping-git-repos-clean.
• shipping-swift-apps — TestFlight/App Store releases on their own (App Store Connect API key auth, fastlane metadata lanes, headless archive and upload, build-number and version-train rules) for when the build side is already sorted.
• rust-crates — building-rust-crates + keeping-git-repos-clean.
• scala-projects — building-scala-projects + keeping-git-repos-clean.
• browser-extensions — building-browser-extensions + wiring-application-config + shipping-build-artifacts + rendering-untrusted-content + keeping-git-repos-clean.

Narrower Python bundles

• python-library-foundations — project setup, code quality, testing strategy.
• python-library-distribution — packaging, release management, CLI development, build-artifact shipping.
• python-library-quality — security audit, performance, heavy-dependency deferral, API design, untrusted-content rendering, external-behavior verification, git hygiene.
• python-web-app — web-app architecture (FastAPI, async SQLAlchemy, Stripe, Docker/Terraform deployment) + untrusted-content rendering + application-config wiring.
• python-mcp-servers — MCP servers (FastMCP tool design, error contracts, event-loop-safe blocking work, packaging, testing, prompt-injection awareness) + application-config wiring.
• python-llm-features — LLM-backed features (prompt surfaces, structured outputs, context budgeting, model config wiring, accuracy evaluation).

Language-agnostic

• resumable-sync-jobs — batch/sync jobs, cron tasks, importers, and paginated fetchers (partial-failure exit codes, resumable checkpoints, bounded retries, quota compensation).
• verifying-external-behavior — integrating a dependency, endpoint, or build backend (probe the exact call, inspect outbound parameters, validate fakes against the real service, skip the dry-run shortcut).
• shipping-build-artifacts — build/package scripts, dist/ copy steps, committed compiled assets, and release workflows that upload a zip or installer (fail on missing inputs, bound size both ways, rebuild-and-diff committed bundles, verify the artifact before publishing).
• reproducing-ci-locally — running the CI gate on your machine so it agrees with the runner (workflow-derived commands and markers, short-circuiting gate steps, pinned linter versions, the runner's interpreter and extras, confirming green).
• reporting-derived-metrics — scoring and analysis pipelines, z-score/outlier checks, quality and anomaly flags, and metrics rollups (unmeasurable is not zero, gate the threshold on whether the value was measured, never narrate a finding from absent data).
• normalizing-text-for-measurement — markdown/HTML strippers, plain-text extractors, section splitters, and any reading-time, word-count, readability, dedup-key or token-budget function that consumes them (give every block close token a separator, audit character-based metrics for leftover syntax and word-based ones for fused boundaries, route every consumer through the normalizer, check the parser's active rule set, key sections by something structurally unique, assert markdown equals its plain equivalent).
• shipping-across-surfaces — landing a user-facing change everywhere the same fact is stated (surface inventory, typed-response/untyped-consumer contract tests, generated instead of restated surfaces, drift tests against the live registry, cross-repo format contracts and direction of ownership, overloaded product terms).
• wiring-application-config — config loaders, merge helpers, schemas, and stored settings objects (check both ends of every key, validate at the load boundary, drop unknown keys with a warning naming the dotted path, never alias the defaults you merged from, never persist a partial settings object).
• merging-concurrent-branches — rebasing or merging a branch into a repo taking parallel contributions (hotspot inventory, union vs. recompute vs. rebuild as three different correct resolutions, deterministic serialization, append-only identifiers, and the real gate re-run on the merged tree).
• deferring-heavy-dependencies — a cheap operation that costs hundreds of milliseconds, or adding an expensive resource to a shared constructor or factory (lazy fields, factories split by need, cold-process per-call timing, one-time import vs repeated load, and asserting the loader is never called on a model-free path).
• guarding-destructive-operations — --rebuild/--reset/--purge commands, bulk deletes, history rewrites, and any code that turns an argument into a file path (refuse instead of warn, guard before the first mutation, structural not string-prefix classification, validate the name and contain the resolved path, mutate each half separately in tests).
• writing-defect-reports — filing an issue, writing a PR or review body that asserts a defect, or triaging someone else's report (reproduce at the layer the title names, confirm the code is reachable before calling it broken, search the project's records before filing a caveat, re-measure every quoted number with its version and protocol, inject failure at the narrowest point, never file a red check as an aside, withdraw wrong claims where you published them).

Every language bundle includes keeping-git-repos-clean — committed-secret and dev-artifact hygiene applies regardless of language.

Usage

Once installed, Claude will automatically use these skills when you ask about:

• Setting up a new project (Python, Go, Rust, Scala) or a Swift/Xcode app
• Wiring a CI pipeline whose gate actually gates
• Adding tests, publishing packages, or reviewing code quality
• Shipping an Xcode app to TestFlight or the App Store
• Security scanning and keeping secrets out of git
• Architecting a Python web app or building a Python MCP server
• And more...

Contributing

Contributions are welcome! Please open an issue or PR on GitHub.

License

MIT License - see LICENSE for details.