DEV Community: Samarth Bhamare

I Tested 120 Claude "Secret Codes" Over 3 Months. Here's What Actually Works (And What's Complete Nonsense)

Samarth Bhamare — Tue, 14 Apr 2026 13:22:02 +0000

If you spend any time in AI communities, you've seen the lists.

"50 secret Claude commands!" "Hidden Claude hacks!" "Use this one prefix to 10x your output!"

I got tired of guessing which ones were real. So I tested them. All of them. 120 prompt prefixes, tested on Claude Opus 4.6 and Sonnet 4.6 over 3 months. Same prompts, fresh conversations, 3 runs each, controlled before/after comparisons.

The uncomfortable result: about 70% do nothing meaningful.

They change formatting — shorter paragraphs, bullet points instead of prose — but the actual reasoning is identical. You could get the same effect by saying "use bullet points."

A few are actively harmful. And exactly 7 consistently changed what Claude thinks, not just how it writes.

The 7 That Survived Testing

1. `ULTRATHINK` — forces deeper reasoning

This is the single highest-impact code I found. Claude visibly thinks longer and catches things the default response misses.

Without:

How should I structure auth for a multi-tenant SaaS?
→ "There are several common approaches: JWT, session-based, OAuth..."
  (balanced overview, no opinion)

With:

ULTRATHINK How should I structure auth for a multi-tenant SaaS?
→ Picks JWT with row-level security, explains why sessions fail at 
  tenant boundaries, warns about the token-size trap when embedding 
  permissions, gives a specific migration path if you start wrong.

The default answer is a Wikipedia summary. The ULTRATHINK answer is what a staff engineer says after thinking about it over coffee.

2. `L99` — kills the hedging

Claude's default personality is diplomatic. "It depends." "There are trade-offs." L99 forces it to pick a side and defend it.

L99 Should I use Postgres or MongoDB for my startup?
→ "Postgres. Your data has relationships whether you admit it or not. 
   MongoDB feels faster at first but you'll rebuild half of Postgres 
   in your application layer by month 6. The only exception: if your 
   data is genuinely document-shaped AND you'll never need joins."

That's an answer you can actually act on.

3. `/ghost` — erases AI fingerprints

Not a tone adjustment. This specifically targets the patterns that make AI writing detectable: em-dashes, "I hope this helps", "It's worth noting that", perfectly balanced sentence pairs.

I ran the output through GPTZero, Originality.ai, and Sapling. Detection rate dropped from 96% to 8%.

If you're writing anything that needs to sound human — cold emails, blog posts, client deliverables — this one is real.

4. `/skeptic` — challenges your premise

Instead of answering your question, Claude first checks whether you're asking the right question.

/skeptic Help me optimize my database queries, they're slow.
→ "Before optimizing queries — are you sure the database is the 
   bottleneck? Check: 1) N+1 calls from your API? 2) Connection pool 
   sized correctly? 3) Index exists but not used due to type mismatch? 
   Run EXPLAIN ANALYZE first. 80% of 'slow database' problems are 
   application-layer problems."

This one saved me from building the wrong solution twice.

5. `PERSONA` — but only with surgical specificity

Generic personas do nothing. I tested it.

Doesn't work:

PERSONA: senior developer. Review my code.

Works:

PERSONA: Principal engineer at a fintech, 15 years experience, 
survived two failed monolith-to-microservices migrations, deeply 
skeptical of premature optimization. Review my architecture.

The difference isn't tone — it's which trade-offs Claude prioritizes, which risks it flags, and which recommendations it makes. Specificity is the unlock.

6. `/debug` — finds the bug instead of rewriting your code

Claude's default when you paste an error: rewrite your entire function "with improvements." Somewhere in those improvements the bug is fixed, but you can't tell what changed.

/debug forces it to name the line, explain the issue, and give the minimal fix.

/debug [paste code with error]
→ "Line 23: comparing user.id (string) with === to req.params.id 
   (URL-decoded string). The issue is line 31 — you're using the 
   pre-decoded version in the cache key. Fix: decodeURIComponent 
   on line 23. Don't change line 31."

7. `OODA` — military decision framework

Structures the response as Observe-Orient-Decide-Act. Originally a fighter pilot decision loop. Works remarkably well for production incidents and decisions under pressure.

OODA Our main API is returning 500s intermittently.
→ OBSERVE: Intermittent 500s = resource exhaustion, not code bugs.
  ORIENT: If correlated with traffic → capacity. If random → leak.
  DECIDE: Run netstat now. If >500 connections, pool is the bottleneck.
  ACT: Immediate — increase pool to 50. Today — add monitoring. 
  This week — circuit breaker on downstream calls.

What Doesn't Work (Skip These)

I tested all of these multiple times. None produced measurable reasoning changes:

Code	Claim	Reality
`/godmode`	Maximum capability	Longer output, identical reasoning
`BEASTMODE`	3x quality	Same as /godmode with a louder name
`/jailbreak`	Removes limits	Actually makes Claude MORE cautious
`DAN mode`	"Do Anything Now"	ChatGPT meme. Claude ignores it
`/expert` (generic)	Expert-level answers	Does nothing without a specific domain
`ALPHA`, `OMEGA`, `TURBO`	Various claims	Pattern matching only — confident tone, same analysis
"Think step by step"	Better reasoning	Already baked into Claude since Sonnet 4.5

Why These Work

None of these are official Anthropic features. They work because Claude's training data includes millions of conversations where developers used these exact prefixes. The model learned the convention from us, not from design.

This means:

They can break with model updates (I retest every 2 weeks)
New ones emerge as usage patterns change
The "secret codes" framing is wrong — they're community conventions, not hidden features

One commenter on Reddit put it better than I could: "The prefixes that actually work are all telling the model to change its decision-making process, not its output format. That's a fundamentally different thing than BEASTMODE which just asks for more."

The Broader Point

These prefixes are useful shortcuts. But they're not the paradigm shift.

The real shift is persistent instructions — markdown files that Claude reads at the start of every session. A file that says "when reviewing code, always check for N+1 queries, missing error handling, and stale closures" runs automatically without you typing anything.

That's the direction prompt engineering is heading: not cleverer one-liners, but structured instructions that DO things, not just SAY things.

Try Them

All 7 codes work right now on Claude.ai, Claude Code, and the API. No setup needed — just prefix your next prompt.

If you want a maintained, tested list: I keep one at clskills.in/prompts — 20 free with click-to-copy. The full 120 with before/after testing data is a paid reference I update biweekly.

What prefixes have you found that actually change Claude's reasoning? Genuinely curious — community-discovered codes are usually the best ones.

everything i wish someone told me before i started using claude

Samarth Bhamare — Sun, 12 Apr 2026 02:40:52 +0000

i spent the first two weeks using claude completely wrong.

i'd open it, type a vague question, get a decent answer, and think "okay, that's useful i guess." then i'd close the tab and forget about it. i wasn't getting anything close to what people were describing — the hours saved, the output quality, the feeling that you had a smart collaborator instead of a search engine.

turns out i was missing some basic things that nobody explains to beginners. here's what actually changed how i use it.

1. stop treating it like a search engine

the biggest mistake people make is asking claude one-line questions and expecting magic. claude isn't google. it doesn't just retrieve — it thinks. and the quality of its thinking depends almost entirely on the quality of your input.

compare these two:

bad: what's a good marketing strategy?

better: i run a small skincare brand targeting women aged 25-40 in india. 
we sell on instagram and our own website. our budget is tight — under ₹20k/month 
for ads. what are 3 specific things i should focus on in the next 30 days?

the second one gets you something you can actually use on monday morning. the first one gets you a wikipedia page.

the rule: give claude your situation, your constraints, and what "good" looks like for you. it can't read your mind, but it's very good at working with context.

2. use the "role + task + format" structure

this is the structure that unlocked everything for me. when you give claude three things — a role to play, a task to do, and a format to respond in — the output quality jumps noticeably.

role: act as a senior HR manager who has hired hundreds of people

task: review this job description i wrote for a marketing coordinator role 
and tell me what's weak, what's missing, and what would put off good candidates

format: give me a numbered list of issues, then a revised version of the JD

[paste your JD here]

you're not just asking for feedback. you're telling claude who to be when giving that feedback. a senior HR manager thinks differently than a general AI assistant.

this works in almost any domain — legal review, financial planning, email drafting, coding. pick the right "role" and you get thinking that's calibrated to that domain.

3. ask it to think before it answers

claude has a tendency (like most AI) to jump straight to an answer. sometimes that answer is shallow. there's a simple fix:

before you answer, think through this step by step. consider at least 3 different 
angles before giving me your recommendation.

or:

what are the weakest parts of the argument you just made?

that second one is particularly useful. ask claude to challenge its own output and it will often surface things it glossed over the first time. i use this whenever i'm about to act on something important — a business decision, a contract review, a financial projection.

4. use it for first drafts, not final drafts

people either expect claude to produce publication-ready work on the first try, or they use it for such small tasks that they're underutilizing it completely.

the right mental model: claude is your first-draft machine. your job is to edit.

here's how i write emails now:

write a short email to a client who paid late (3 weeks). 
the invoice was for ₹45,000. i want to be firm but not aggressive — 
we still want to work with them. keep it under 150 words.

that takes me 20 seconds. i get back something that's 80% of the way there. i spend 3 minutes making it sound like me and fixing anything that's off. total time: under 5 minutes. old way: 15-20 minutes of staring at a blank screen.

the same applies to blog posts, proposals, SOPs, presentation outlines, cold messages — anything where starting is the hard part.

5. have conversations, not one-off prompts

most people write one prompt, read the response, and start a new chat for their next question. this is like hiring a consultant, having one call with them, and then calling a different consultant for every follow-up.

claude gets better as a conversation continues. it builds on context. it remembers what you've said. it refines its understanding of what you're trying to do.

try this instead: when you're working on something, keep one conversation open for that entire project.

[start of project]
i'm building a pitch deck for a B2B SaaS product that helps restaurants 
manage inventory. target audience is restaurant owners, not tech people. 
i'll be asking you questions throughout the next hour as i build this.

[later in same chat]
okay what should slide 3 look like? i want to explain the problem without 
using any technical language.

by slide 8, claude knows your product, your audience, your tone, and your constraints. you don't have to re-explain anything.

6. the "documents in, intelligence out" pattern

this one is underused and genuinely impressive. you can paste a document into claude — a contract, a report, a competitor's pricing page, a job offer — and ask it to analyze, summarize, compare, or flag things.

here is a freelance contract i was sent. i'm a graphic designer.
[paste contract]

flag any clauses that:
1. limit my ability to use this work in my portfolio
2. could make me liable for things outside my control
3. are unusual compared to standard freelance contracts

explain each one in plain language, not legal language.

i've used this to review vendor agreements, summarize 60-page government reports, compare two job offers side-by-side, and pull key data out of dense financial documents. it's not a lawyer. it's not an accountant. but it's a very good first pass that tells you what to ask the actual professional.

the honest truth about where people get stuck

these techniques sound simple, but applying them consistently across different situations — writing, legal, finance, healthcare, marketing — takes practice. and most tutorials online are either too technical (written by developers) or too vague ("just write better prompts!").

i spent about three months figuring all of this out through trial and error. i compiled everything — including 114 more prompt codes across 12 specific use cases — into a 40+ page PDF guide built specifically for non-technical people.

it covers beginner through full automation, with 8 industry playbooks for marketing, legal, healthcare, finance, education, real estate, consulting, and e-commerce. if you're in any of those fields and want to actually get good at claude, it's at https://clskills.in/guide — starts at $19.

if you're in india, use code INDIA99 at checkout.

the techniques above will make you noticeably better starting today. the rest is just reps.

by samarth bhamare — clskills.in

I picked a 5ms keyword router over an LLM meta-router for my AI app. Here's the math.

Samarth Bhamare — Sat, 11 Apr 2026 20:06:37 +0000

I picked a 5ms keyword router over an LLM meta-router for my AI app. Here's the math.

short version: i was building a desktop AI sales coach where the user types a question and the system picks one of 10 "founder voices" to answer in. i prototyped two routers — a deterministic keyword one and a meta-LLM one. the deterministic one was 600x faster, free, and 85% accurate. i shipped the deterministic one. here's why and what the code looks like.

if you're building an AI app where you have to pick between multiple specialized prompts/personas/agents per request, this might save you a few weeks.

the setup

i shipped a product called the Sales Agent Pack last night (clskills.in/sales-agent-saas). it's a desktop electron app + claude code skill that has 10 "council voices" — each one built from the public writings of a SaaS founder (Collison, Benioff, Lütke, Chesky, Huang, Altman, Amodei, Levie, Butterfield, Lemkin).

the user types a sales question. the system picks ONE voice to answer in. that "pick" is the routing decision.

example questions:

"should i raise prices to $79?" → should route to Lemkin (saastr operator, pricing experiments)
"we're losing to hubspot, what's the angle?" → should route to Levie (challenger positioning)
"the deck feels generic" → should route to Chesky (identity-driven sales, design)

the "voices" aren't roleplay — each voice is a 3000-word markdown file built from the founder's actual public writing, loaded into the system prompt at chat time. so the routing decision matters: pick the wrong voice and the answer is technically correct but the style and frame is wrong.

option A: meta-LLM router

the obvious approach. before answering, ask claude (or any LLM) "which of these 10 voices should answer this question?"

async function pickVoiceLLM(message) {
  const response = await anthropic.messages.create({
    model: 'claude-sonnet-4-5',
    max_tokens: 50,
    messages: [{
      role: 'user',
      content: `Question: "${message}"\n\nWhich voice should answer? Reply with just one word from: Collison, Benioff, Lutke, Chesky, Huang, Altman, Amodei, Levie, Butterfield, Lemkin.`
    }],
  });
  return response.content[0].text.trim();
}

measured cost (over 100 sample questions):

latency p50: 1,800 ms
latency p95: 3,100 ms
cost per call: ~$0.005 (50 tokens out, ~120 tokens in)
accuracy (vs. my hand-labeled "correct" answer): 89%

option B: deterministic keyword router

less sexy. just a function with a bunch of ifs and a buyer-archetype heuristic.

function pickVoice(message, conversationType) {
  const m = message.toLowerCase();

  // Hard overrides — explicit conversation types win
  if (conversationType === 'post_mortem') {
    return { primary: 'Lemkin', voiceFile: 'council/10-lemkin.md' };
  }
  if (conversationType === 'competitive_positioning') {
    return { primary: 'Levie', voiceFile: 'council/08-levie.md' };
  }

  // Pricing keywords → Lemkin (the saastr operator)
  if (/price|pricing|raise.*price|tier|discount|annual.*contract/.test(m)) {
    return { primary: 'Lemkin', voiceFile: 'council/10-lemkin.md' };
  }

  // Developer-buyer keywords → Collison (Stripe playbook)
  if (/api|developer|sdk|docs|integration|technical.*buyer/.test(m)) {
    return { primary: 'Collison', voiceFile: 'council/01-collison.md' };
  }

  // Enterprise / trust → Benioff
  if (/enterprise|procurement|security review|legal|compliance|fortune/.test(m)) {
    return { primary: 'Benioff', voiceFile: 'council/02-benioff.md' };
  }

  // Design / identity / story → Chesky
  if (/deck|story|narrative|design|identity|brand|generic/.test(m)) {
    return { primary: 'Chesky', voiceFile: 'council/04-chesky.md' };
  }

  // Underdog / fairness / anti-incumbent → Lütke
  if (/underdog|anti|hubspot|salesforce.*alternative|david.*goliath/.test(m)) {
    return { primary: 'Lutke', voiceFile: 'council/03-lutke.md' };
  }

  // Default — Lemkin handles "general sales question"
  return { primary: 'Lemkin', voiceFile: 'council/10-lemkin.md' };
}

measured (over the same 100 questions):

latency p50: 3 ms
latency p95: 5 ms
cost per call: $0
accuracy (vs. my hand-labeled "correct"): 85%

the math

over a year of moderate use (let's say 50 questions per buyer per month, 1000 buyers = 600,000 questions/year):

	Meta-LLM router	Deterministic router
Total latency added	1,080,000 sec (~12.5 days of waiting)	1,800 sec (~30 minutes)
Total cost added	$3,000	$0
Accuracy	89%	85%
Failure mode	API outage = no routing	Code bug = obvious + fixable

the 4% accuracy delta costs $3,000 and 12.5 buyer-days of waiting. that's not worth it. especially because the 15% miss rate on the deterministic version isn't catastrophic — it picks the wrong council voice, but the answer is still useful, just framed by Lemkin when it should have been framed by Chesky.

plus there's a manual escape hatch. if the user wants a specific voice, they say "answer like Chesky would" in their question. the keyword chesky triggers an explicit override. zero ML required. infinite override-ability.

when meta-LLM routing IS worth it

i'm not saying "always use deterministic." here's when i'd flip the decision:

when the routing space is large and fluid. if i had 100 voices instead of 10, hand-coding keyword rules becomes unmaintainable. an LLM router scales linearly in cost vs my time.
when the cost of wrong is high. if mis-routing meant "user gets a totally irrelevant answer" instead of "user gets a reasonable answer in a slightly off voice," the 4% accuracy delta is worth $3,000.
when you have reliable structured outputs. with JSON mode + a constrained enum, an LLM router becomes much more reliable than free-form generation.
when latency budget is generous. for an async batch system, +2 seconds doesn't matter. for an interactive chat, it's perceptible and annoying.

the v0.3.0 plan

i'm not hard-committed to deterministic forever. the actual plan is:

v0.1.0 — deterministic router (shipped)
v0.1.x → v0.2.x — collect routing data. for every chat, log (question, deterministic_pick, user_override_if_any). let it run for ~3 months.
v0.3.0 — train a tiny classifier on the logged data. probably 100 lines of scikit-learn. inference cost: also ~5ms. accuracy estimate: ~92%.
only switch to meta-LLM router if the classifier plateaus below ~90% AND the 8% miss rate is causing real user complaints.

the "premature optimization is the root of all evil" version of this is: don't reach for an LLM call when an if statement does the job. especially when you're paying for the LLM call out of pocket and the if statement runs in single-digit milliseconds.

try it

if you want to see the deterministic router in action — the product is at clskills.in/sales-agent-saas. it's a desktop AI sales coach for SaaS founders, $299 pre-order, ships as both an Electron app and a Claude Code skill. 7-day refund.

i wrote a longer technical post about the rest of the architecture (why no BrowserWindow, the auto-update endpoint, the ELECTRON_RUN_AS_NODE trap that almost killed me) on my hashnode at clskills.hashnode.dev — go read that if this one was useful.

questions / objections / "you should have done X" — drop them in the comments. i read everything.

— samarth

Claude "Cheat Codes" — 120 Tested Prompt Prefixes That Change How Claude Responds

Samarth Bhamare — Thu, 09 Apr 2026 10:04:01 +0000

You can ask Claude the same question two different ways and get two completely different answers.

I don't mean rephrasing. I mean adding one tiny prefix in front of your prompt. The community has converged on about 120 of these "cheat codes" — none of them are official Anthropic features, but Claude consistently recognizes them.

I spent 3 months testing which ones actually work. Here's the complete breakdown.

What are Claude cheat codes?

Short commands you put at the start of your message:

Slash commands — /ghost, /skeptic, /punch, /noyap
Uppercase keywords — L99, ULTRATHINK, OODA, PERSONA, BEASTMODE

Claude sees the prefix, recognizes the intent, and adjusts its behavior.

The 5 you should learn first

L99

Forces committed opinions instead of "it depends."

L99 Should I use Postgres or MongoDB for a fintech startup?

You get a real recommendation with specific tradeoffs, not a balanced pros-and-cons essay.

PERSONA (with specificity)

Generic: "Act like a database expert" → barely moves the needle.

Specific:

PERSONA: Senior Postgres DBA at Stripe, 15 years, 
cynical about ORMs. How do I optimize this query?

The specificity gives Claude permission to have real opinions.

/ghost

Strips every "AI tell" from writing. Em-dashes, "I hope this helps", balanced sentence pairs — all gone. Output reads like a human typed it.

/ghost Rewrite this so it doesn't sound like AI.

/skeptic

Challenges your question before answering it.

/skeptic How do I A/B test 200 landing page variants?

Claude responds: "With your traffic, you'd need 6 months per variant. Want to test 5 instead?"

Catches the wrong-question problem.

ULTRATHINK

Maximum reasoning depth. 800–1200 word thesis with multiple analytical layers. Zero hedging.

ULTRATHINK Why is our retention dropping after week 2?

Reserve for the 2–3 decisions per week that earn the depth.

Codes that stack (combos)

Most prefixes get stronger combined:

Combo	Best for
`/ghost + /punch`	Cold emails — humanize + shorten
`PERSONA + L99`	Technical decisions — expert + committed
`/skeptic + ULTRATHINK`	Strategy — right question + max depth
`/punch + /trim + /raw`	Slack messages — tight, no markdown

The full 120

I organized all of them into a searchable reference with categories:

Category	Count	Examples
Writing & Style	10	/ghost, /punch, /trim, /voice
Thinking & Reasoning	10	L99, /deepthink, OODA, XRAY
Coding & Technical	10	/debug, REFACTOR, /shipit, ARCHITECT
Power Commands	10	/godmode, PERSONA, /memory, /chain
Hidden Modes	10	BEASTMODE, /nofilter, CEOMODE, OPERATOR
Output Formatting	10	/json, /yaml, /table, /checklist
Research & Analysis	10	DEEPDIVE, COMPARE, /critique, /devil
Productivity	10	/template, /recipe, /playbook, /sop
Communication	10	/email, /reply, /dm, /escalate
Experimental	10	PARETO, FINISH, /postmortem, WORSTCASE
Community Picks	20	ULTRATHINK, /noyap, HARDMODE, /skeptic

Free interactive version: clskills.in/prompts — 11 free codes, click to copy.

Individual deep dives: clskills.in/prompt/l99, /prompt/ghost, /prompt/persona, /prompt/skeptic — 120 pages, one per code.

Full cheat sheet (paid, $5–$10): clskills.in/cheat-sheet — before/after examples for every code, when-NOT-to-use warnings, combos, 10 workflow playbooks. Lifetime updates.

Do these actually work or is it placebo?

Honest answer: these are community conventions, not hardcoded features. They work because Claude has seen enough people use them that it learned to recognize the intent.

Evidence they work:

Output structure measurably changes (run the same prompt with/without L99 in fresh sessions)
Multiple people discovered the same codes independently
Anthropic hasn't denied them

Caveats:

Top 15 are very consistent. Bottom 30 are more hit-or-miss.
Future model updates could change behavior.
Some codes work better for certain task types.

Try it now

Pick one:

L99 [any question you'd normally ask Claude]
/ghost [any paragraph you want rewritten]
PERSONA: [specific expert]. [your question]

If it doesn't change anything, the rest won't either. If it does — the other 117 are waiting.

Building clskills.in — 2,300+ free Claude Code skills + the cheat sheet for prompt prefixes.

I built 10 autonomous AI agents for Claude Code — here's how they work Tags: ai, webdev, productivity, opensource

Samarth Bhamare — Thu, 26 Mar 2026 02:35:18 +0000

Most developers use Claude Code at maybe 20% of its potential.

They type "fix this bug" and expect magic. When the output is mediocre, they blame the tool.

The problem is not the tool. It is the prompt.

I spent weeks building production-grade instruction files that turn Claude Code into specialized autonomous agents. Each one combines multiple skills into a structured workflow with real bash commands, specific patterns to check, output formats, and rules to avoid false positives.

Here are all 10 agents and what they actually do:

PR Review Agent
Reviews every changed file in a branch against main. Checks for correctness (off-by-one errors, missing await, null handling), error handling (empty catch blocks, swallowed errors), naming clarity, and unused imports. Runs tsc and eslint on changed files. Outputs a structured report with exact file:line references, corrected code suggestions, and a verdict (approve, request changes, needs discussion). Always includes a "what looks good" section so it does not just criticize.

Test Writer Agent
Detects your test framework by reading package.json and existing test files. Finds every exported function without a corresponding test. For each function, it analyzes inputs, outputs, dependencies, and every branch (if, else, switch, ternary). Generates tests covering happy path, edge cases (null, empty, zero, boundary values), error conditions, and async behavior. Every test follows the AAA pattern with realistic data, not "foo" and "bar". Runs the tests after writing them to make sure they pass.

Bug Fixer Agent
Give it an error message, stack trace, or description of wrong behavior. It reads the stack trace bottom-to-top, traces the execution path through your code, and categorizes the root cause (off-by-one, null reference, async timing, type coercion, logic error, stale state). Before proposing a fix, it verifies the hypothesis explains all symptoms, checks git blame to see if a recent change introduced the bug, and looks for the same pattern elsewhere in the codebase. Fix diffs are minimal. Never modifies tests to make them pass.

Documentation Agent
Reads your actual source code to write documentation. Not guessing from function names. It checks package.json for the stack, finds entry points, reads route handlers, and builds a mental model of what the project does. Generates README with getting started, environment variables (read from .env.example), project structure, API reference (from actual route handler code), and scripts. Also generates JSDoc for undocumented exported functions with examples. Never fabricates endpoints or features that do not exist.

Security Audit Agent
Full OWASP Top 10 audit. Starts with secret detection (hardcoded API keys, AWS credentials, private keys, connection strings with passwords). Then dependency vulnerabilities via npm audit. Then injection checks: SQL injection (string concatenation in queries), command injection (user input in exec/spawn), XSS (dangerouslySetInnerHTML, innerHTML). Then auth audit: password hashing algorithm, JWT validation, rate limiting, session handling. Then CORS and security headers. Outputs a prioritized report with attack scenarios and exact code fixes.

Refactoring Agent
Only starts if tests pass. Finds the largest files, duplicate logic (files with similar imports), dead code (exports not imported anywhere), and complexity issues (deep nesting, long parameter lists, god objects). Executes one refactor at a time: dead code removal, extract shared logic, split long functions, guard clauses for nested conditions, named constants for magic numbers. Runs tests after every single change. If tests break, undoes the refactor. Never changes public APIs or behavior.

CI/CD Pipeline Agent
Reads your project structure, detects the framework and build commands, checks for existing workflow files, and generates or fixes GitHub Actions or GitLab CI configs. Knows about caching strategies for npm, pip, and Docker layers. Sets up proper job dependencies, artifacts, and environment variables. If a pipeline is failing, reads the error logs and traces the failure to the exact step and fix.

Database Migration Agent
Detects your ORM (Prisma, Drizzle, TypeORM, Knex, Django, Rails). Reads the current schema, compares it against the code that uses the database, and generates migration files for missing changes. For every migration, checks for data loss risks (dropping columns with data, changing types), generates a rollback script, estimates execution time for large tables, and suggests running during low-traffic windows if the migration locks tables.

Performance Optimizer Agent
Three-layer analysis. Frontend: runs bundle analysis, finds large dependencies, identifies components that re-render unnecessarily, checks for missing lazy loading and code splitting. Backend: finds N+1 queries, missing database indexes, API endpoints that could use caching, synchronous operations that should be async. Memory: looks for event listener leaks, growing arrays that are never cleared, unclosed connections. Every optimization includes before and after measurements.

Onboarding Agent
Maps the entire codebase. Identifies the framework, entry points, routing, data flow from request to database to response. Documents the directory structure with what each folder actually contains (not just the folder name). Finds conventions by reading existing code (naming patterns, error handling patterns, test patterns). Lists key files a new developer should read first. Identifies gotchas (unusual patterns, workarounds, things that look wrong but are intentional by checking git blame). Outputs a structured onboarding guide.

How to use them

Each agent is a .md file. You download it, put it in ~/.claude/skills/, and invoke it with /agent-name in Claude Code.

Example:

/pr-review-agent
/security-audit-agent
/test-writer-agent
That is it. No API keys, no setup, no subscriptions.

All 10 agents plus 789 additional skills are free and open source at clskills.in

GitHub: github.com/Samarth0211/claude-skills-hub

I would love feedback on which agents you find most useful and what other agents you would want built.

789 Free Skills to Supercharge Claude Code

Samarth Bhamare — Wed, 25 Mar 2026 06:44:21 +0000

If you use Claude Code, you already know it's one of the best AI coding tools out there. But most people don't know about its most powerful feature: skill files.

A skill file is a .md file you drop into ~/.claude/skills/. Claude reads it automatically and follows those instructions whenever relevant. It's like giving Claude a cheat sheet written by a senior engineer.

The problem? Writing good skill files takes time. A vague prompt gives you vague code. A detailed skill file with real commands, working examples, and specific pitfalls gives you production-ready output.

So I built CLSkills — a free, searchable library of 789 skill files across 71 categories.

How it works

1. Create the skills directory (one time)

mkdir -p ~/.claude/skills

2. Download any skill

curl -o ~/.claude/skills/docker-compose.md \
https://clskills.in/skills/docker/docker-compose.md

3. Use Claude Code normally — it reads the skill automatically

claude "set up a docker compose for my Node app with PostgreSQL and Redis"
That's it. No config, no plugins, no setup.

What's inside each skill
Every skill follows the same structure:

Expert role — Claude adopts a specific persona. Not "helpful assistant" but "senior DevOps engineer specializing in container orchestration."

What to check first — prerequisites before starting. Does the project have a Dockerfile? Is Docker installed? What version?

Step-by-step instructions — numbered steps with real commands. Not "set up the database" but "run docker compose up -d postgres and verify with docker compose ps."

Working code — 25-40 lines of copy-paste ready code. Not pseudocode, not skeleton code. Real, working implementations.

Pitfalls — things that actually go wrong with that specific technology. Not generic advice like "handle errors" but "PostgreSQL containers take 5-10 seconds to initialize — add a health check with pg_isready before starting dependent services."

Example: Two Factor Auth skill
Here's what a real skill looks like:

You are a security engineer implementing two-factor authentication.
The user wants to add 2FA/MFA to an existing auth flow using TOTP
and backup codes.

What to check first

Verify speakeasy or otplib is installed: npm list speakeasy
Confirm database has twoFactorSecret, twoFactorEnabled, backupCodes columns
Check JWT secret or session store is configured

Steps

Install packages: npm install speakeasy qrcode
Create 2FA setup endpoint using speakeasy.generateSecret() and return QR code via qrcode.toDataURL()
Create verification endpoint with speakeasy.totp.verify()
Generate 8-10 backup codes, store them hashed in the database
Add 2FA check middleware on protected routes
Create backup code redemption endpoint
Implement "remember this device" with a 30-day cookie
Add disable 2FA endpoint requiring password + valid TOTP token

Pitfalls

Never log TOTP secrets — they're equivalent to passwords
Always hash backup codes with bcrypt before storing
Use 30-second window for TOTP verification, not 60
Rate limit verification attempts to prevent brute force When Claude reads this, it doesn't just "try its best." It follows these exact steps, uses the right packages, and avoids the specific mistakes that would bite you in production.

What categories are covered
71 categories across every area of development:

Frontend: React, Vue, Angular, Svelte, Next.js, Tailwind
Backend: Node.js, Python, Go, Rust, Java, GraphQL, REST, gRPC
DevOps: Docker, Kubernetes, CI/CD, Terraform, Ansible
Cloud: AWS, GCP, Azure, Serverless, Edge Functions
Databases: PostgreSQL, MongoDB, Redis, Elasticsearch, Prisma
Testing: Unit, Integration, E2E, React Testing Library, Playwright
Security: Auth, OAuth, JWT, CORS, Secrets Management
And more: AI/ML, Mobile, Desktop, CLI Tools, Payments, Search, Monitoring...
Why this matters
I've been using Claude Code daily for months. The difference between Claude with and without skill files is massive.

Without skills: "Here's a basic Docker setup..." followed by a generic Dockerfile that works but misses health checks, multi-stage builds, non-root users, and layer caching.

With skills: Claude produces the exact same output a senior DevOps engineer would write — because it's following instructions written by one.

The skills essentially encode expert knowledge into a format Claude can follow consistently. You get senior-level output every time, not just when Claude "feels like it."

Try it
Browse all 789 skills at clskills.in

Everything is free, no login required, no paywall. Download individual .md files or grab entire collections as a ZIP.

The project is open source: GitHub

If you have skill ideas or want to contribute, join us at r/ClaudeCodeSkills.

What skills do you use with Claude Code? I'd love to hear what workflows people are building.

DEV Community: Samarth Bhamare

I Tested 120 Claude "Secret Codes" Over 3 Months. Here's What Actually Works (And What's Complete Nonsense)

The 7 That Survived Testing

1. ULTRATHINK — forces deeper reasoning

2. L99 — kills the hedging

3. /ghost — erases AI fingerprints

4. /skeptic — challenges your premise

5. PERSONA — but only with surgical specificity

6. /debug — finds the bug instead of rewriting your code

7. OODA — military decision framework

What Doesn't Work (Skip These)

Why These Work

The Broader Point

Try Them

everything i wish someone told me before i started using claude

1. stop treating it like a search engine

2. use the "role + task + format" structure

3. ask it to think before it answers

4. use it for first drafts, not final drafts

5. have conversations, not one-off prompts

6. the "documents in, intelligence out" pattern

the honest truth about where people get stuck

I picked a 5ms keyword router over an LLM meta-router for my AI app. Here's the math.

I picked a 5ms keyword router over an LLM meta-router for my AI app. Here's the math.

the setup

option A: meta-LLM router

option B: deterministic keyword router

the math

when meta-LLM routing IS worth it

the v0.3.0 plan

try it

Claude "Cheat Codes" — 120 Tested Prompt Prefixes That Change How Claude Responds

What are Claude cheat codes?

The 5 you should learn first

L99

PERSONA (with specificity)

/ghost

/skeptic

ULTRATHINK

Codes that stack (combos)

The full 120

Do these actually work or is it placebo?

Try it now

I built 10 autonomous AI agents for Claude Code — here's how they work Tags: ai, webdev, productivity, opensource

789 Free Skills to Supercharge Claude Code

1. Create the skills directory (one time)

2. Download any skill

3. Use Claude Code normally — it reads the skill automatically

What to check first

Steps

Pitfalls

1. `ULTRATHINK` — forces deeper reasoning

2. `L99` — kills the hedging

3. `/ghost` — erases AI fingerprints

4. `/skeptic` — challenges your premise

5. `PERSONA` — but only with surgical specificity

6. `/debug` — finds the bug instead of rewriting your code

7. `OODA` — military decision framework