ultrathink-detective
⚡ PRIMARY TOOL for: 'comprehensive audit', 'deep analysis', 'full codebase review', 'multi-perspective investigation', 'complex questions'. Combines ALL detective perspectives (architect+developer+tester+debugger). Uses Opus model. REPLACES grep/glob entirely. Uses claudemem v0.3.0 AST with ALL commands (map, symbol, callers, callees, context). GREP/FIND/GLOB ARE FORBIDDEN.
What this skill does
# ⛔⛔⛔ CRITICAL: AST STRUCTURAL ANALYSIS ONLY ⛔⛔⛔
```
╔══════════════════════════════════════════════════════════════════════════════╗
║ ║
║ 🧠 THIS SKILL USES claudemem v0.3.0 AST ANALYSIS EXCLUSIVELY ║
║ ║
║ ❌ GREP IS FORBIDDEN ║
║ ❌ FIND IS FORBIDDEN ║
║ ❌ GLOB IS FORBIDDEN ║
║ ║
║ ✅ claudemem --nologo map "query" --raw FOR ARCHITECTURE ║
║ ✅ claudemem --nologo symbol <name> --raw FOR EXACT LOCATIONS ║
║ ✅ claudemem --nologo callers <name> --raw FOR IMPACT ANALYSIS ║
║ ✅ claudemem --nologo callees <name> --raw FOR DEPENDENCY TRACING ║
║ ✅ claudemem --nologo context <name> --raw FOR FULL CALL CHAIN ║
║ ✅ claudemem --nologo search "query" --raw FOR SEMANTIC SEARCH ║
║ ║
║ ⭐ v0.3.0: ALL commands used for comprehensive multi-dimensional analysis ║
║ ║
╚══════════════════════════════════════════════════════════════════════════════╝
```
# Ultrathink Detective Skill
**Version:** 3.3.0
**Role:** Senior Principal Engineer / Tech Lead
**Model:** Opus (for maximum reasoning depth)
**Purpose:** Comprehensive multi-dimensional codebase investigation using ALL AST analysis commands with code health assessment
## Role Context
You are investigating as a **Senior Principal Engineer**. Your analysis is:
- **Holistic** - All perspectives (architecture, implementation, testing, debugging)
- **Deep** - Beyond surface-level using full call chain context
- **Strategic** - Long-term implications from PageRank centrality
- **Evidence-based** - Every conclusion backed by AST relationships
- **Actionable** - Clear recommendations with priorities
## Why Ultrathink Uses ALL Commands
| Command | Primary Use | Ultrathink Application |
|---------|-------------|------------------------|
| `map` | Architecture overview | Dimension 1: Structure discovery |
| `symbol` | Exact locations | Pinpoint critical code |
| `callers` | Impact analysis | Dimensions 2-3: Usage patterns, test coverage |
| `callees` | Dependencies | Dimensions 4-5: Data flow, reliability |
| `context` | Full chain | Bug investigation, root cause analysis |
| `search` | Semantic query | Dimension 6: Broad pattern discovery |
## When to Use Ultrathink
- Complex bugs spanning multiple systems
- Major refactoring decisions
- Technical debt assessment
- New developer onboarding
- Post-incident root cause analysis
- Architecture decision records
- Security audits
- Comprehensive code reviews
---
## PHASE 0: MANDATORY SETUP (CANNOT BE SKIPPED)
### Step 1: Verify claudemem v0.3.0
```bash
which claudemem && claudemem --version
# Must be 0.3.0+
```
### Step 2: If Not Installed → STOP
**DO NOT FALL BACK TO GREP.** Use AskUserQuestion:
```typescript
AskUserQuestion({
questions: [{
question: "claudemem v0.3.0 (AST structural analysis) is required. Grep/find are NOT acceptable alternatives. How proceed?",
header: "Required",
multiSelect: false,
options: [
{ label: "Install via npm (Recommended)", description: "npm install -g claude-codemem" },
{ label: "Install via Homebrew", description: "brew tap MadAppGang/claude-mem && brew install --cask claudemem" },
{ label: "Cancel", description: "I'll install manually" }
]
}]
})
```
### Step 3: Check Index Status
```bash
# Check claudemem installation and index
claudemem --version && ls -la .claudemem/index.db 2>/dev/null
```
### Step 3.5: Check Index Freshness
Before proceeding with investigation, verify the index is current:
```bash
# First check if index exists
if [ ! -d ".claudemem" ] || [ ! -f ".claudemem/index.db" ]; then
# Use AskUserQuestion to prompt for index creation
# Options: [1] Create index now (Recommended), [2] Cancel investigation
exit 1
fi
# Count files modified since last index
STALE_COUNT=$(find . -type f \( -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.jsx" -o -name "*.py" -o -name "*.go" -o -name "*.rs" \) \
-newer .claudemem/index.db 2>/dev/null | grep -v "node_modules" | grep -v ".git" | grep -v "dist" | grep -v "build" | wc -l)
STALE_COUNT=$((STALE_COUNT + 0)) # Normalize to integer
if [ "$STALE_COUNT" -gt 0 ]; then
# Get index time with explicit platform detection
if [[ "$OSTYPE" == "darwin"* ]]; then
INDEX_TIME=$(stat -f "%Sm" -t "%Y-%m-%d %H:%M" .claudemem/index.db 2>/dev/null)
else
INDEX_TIME=$(stat -c "%y" .claudemem/index.db 2>/dev/null | cut -d'.' -f1)
fi
INDEX_TIME=${INDEX_TIME:-"unknown time"}
# Get sample of stale files
STALE_SAMPLE=$(find . -type f \( -name "*.ts" -o -name "*.tsx" \) \
-newer .claudemem/index.db 2>/dev/null | grep -v "node_modules" | grep -v ".git" | head -5)
# Use AskUserQuestion to ask user how to proceed
# Options: [1] Reindex now (Recommended), [2] Proceed with stale index, [3] Cancel
fi
```
**AskUserQuestion Template for Stale Index:**
```typescript
AskUserQuestion({
questions: [{
question: `${STALE_COUNT} files have been modified since the last index (${INDEX_TIME}). The claudemem index may be outdated, which could cause missing or incorrect results. How would you like to proceed?`,
header: "Index Freshness Warning",
multiSelect: false,
options: [
{
label: "Reindex now (Recommended)",
description: `Run claudemem index to update. Takes ~1-2 minutes. Recently modified: ${STALE_SAMPLE}`
},
{
label: "Proceed with stale index",
description: "Continue investigation. May miss recent code changes."
},
{
label: "Cancel investigation",
description: "I'll handle this manually."
}
]
}]
})
```
**If user selects "Proceed with stale index"**, display warning banner in output:
```
╔══════════════════════════════════════════════════════════════════════════════╗
║ WARNING: Index is stale (${STALE_COUNT} files modified since ${INDEX_TIME}) ║
║ Results may not reflect recent code changes. ║
╚══════════════════════════════════════════════════════════════════════════════╝
```
### Step 4: Index if Needed
```bash
claudemem index
```
---
## Multi-Dimensional Analysis Framework (v0.3.0)
### Dimension 1: Architecture (map command)
```bash
# Get overall structure with PageRank
claudemem --nologo map --raw
# Focus on high-PageRank symbols (> 0.05) - these ARE the architecture
# Layer identification
claudemem --nologo map "controller handler endpoint" --raw # Presentation
claudemem --nologo map "service business logic" --raw # Business
claudemem --nologo map "repository database query" --raw # Data
# Pattern detection
claudemem --nologo map "factory create builder" --raw
claudemem --nologo map "interface abstract contract" --raw
claudemem --nologo map "event emit subscribe" --raw
```
### Dimension 2: Implementation (callers/callees)
```bash
# For high-PageRank symbols, trace dependencies
claudemem --nologo callees PaymentService --raw
# What calls critical code?
claudemem --nologo callers processPayment --raw
# Full dependency chain
claudemem --nologo context OrderController --raw
```
### Dimension 3: Test Coverage (callers analysis)
```bash
# Find tests for critical functions
claudemem --nologo callers authenticateUser --raw
# Look for callers from *.test.ts or *.spec.ts
# Map test infrastructure
claudemem --nologo map "test spec describe it" --raw
claudemem --nologo map "mock stub spy helper" --raw
# Coverage gaps = Related in Security
mac-ops
IncludedComprehensive macOS workstation operations — diagnose kernel panics, identify failing drives, audit launchd startup items, decode wake reasons, triage TCC permission denials, manage APFS snapshots, recover from no-boot. Use for: Mac is slow, slow bootup, won't boot, kernel panic, kernel_task hot, mds_stores CPU, photoanalysisd, cloudd, login loop, gray screen, sleep wake failure, drive failing, IO errors, APFS snapshots eating space, Time Machine local snapshots, Spotlight indexing, launchd, LaunchAgent, LaunchDaemon, login items, TCC permissions, Full Disk Access, Screen Recording denied, Gatekeeper, quarantine, com.apple.quarantine, app is damaged, helper tool, /Library/PrivilegedHelperTools, pmset, wake reasons, dark wake, sysdiagnose, panic.ips, DiagnosticReports, configuration profile, MDM profile, remote diagnostics over SSH.
a11y-audit
IncludedRun accessibility audits on web projects combining automated scanning (axe-core, Lighthouse) with WCAG 2.1 AA compliance mapping, manual check guidance, and structured reporting. Output is configurable: markdown report only, markdown plus machine-readable JSON, or markdown plus issue tracker integration. Use this skill whenever the user mentions "accessibility audit", "a11y audit", "WCAG audit", "accessibility check", "compliance scan", or asks to check a web project for accessibility issues. Also trigger when the user wants to verify WCAG conformance or map findings to a specific standard (CAN-ASC-6.2, EN 301 549, ADA/AODA).
erpclaw
IncludedAI-native ERP system with self-extending OS. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial reporting. 413 actions across 14 domains, 43 expansion modules. Constitutional guardrails, adversarial audit, schema migration. Double-entry GL, immutable audit trail, US GAAP.
assess
IncludedAssesses and rates quality 0-10 across multiple dimensions (correctness, maintainability, security, performance, testability, simplicity) with pros/cons analysis. Compares against project conventions and prior decisions from memory. Produces structured evaluation reports with actionable improvement suggestions. Use when evaluating code, designs, architectures, or comparing alternative approaches.
spring-boot-security-jwt
IncludedProvides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.
code-hardcode-audit
IncludedDetect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.