zebbern/claude-code-guide
Claude Code Guide - Setup, Commands, workflows, agents, skills & tips-n-tricks from beginner to power user!
ARCHETYPE
Orchestrator
A bench of specialised subagents. The main agent mostly delegates.
Copy this rig
# review before running: this installs third-party code
$ npx degit zebbern/claude-code-guide/agents/.claude ./rig-claude-code-guide # inspect, then merge into .claude/ MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.
$ npx degit zebbern/claude-code-guide/skills/academic-paper-reviewer .claude/skills/academic-paper-reviewer $ npx degit zebbern/claude-code-guide/skills/active-directory-attacks .claude/skills/active-directory-attacks $ npx degit zebbern/claude-code-guide/skills/api-fuzzing-bug-bounty .claude/skills/api-fuzzing-bug-bounty $ npx degit zebbern/claude-code-guide/skills/api-shape-explorer .claude/skills/api-shape-explorer $ npx degit zebbern/claude-code-guide/skills/audit-flow .claude/skills/audit-flow $ npx degit zebbern/claude-code-guide/skills/authentication-patterns .claude/skills/authentication-patterns $ npx degit zebbern/claude-code-guide/skills/aws-penetration-testing .claude/skills/aws-penetration-testing $ npx degit zebbern/claude-code-guide/skills/broken-authentication .claude/skills/broken-authentication $ npx degit zebbern/claude-code-guide/skills/burp-suite-testing .claude/skills/burp-suite-testing $ npx degit zebbern/claude-code-guide/skills/caching .claude/skills/caching $ npx degit zebbern/claude-code-guide/skills/chart-image .claude/skills/chart-image $ npx degit zebbern/claude-code-guide/skills/cloud-penetration-testing .claude/skills/cloud-penetration-testing $ npx degit zebbern/claude-code-guide/skills/code-documenter .claude/skills/code-documenter $ npx degit zebbern/claude-code-guide/skills/code-to-diagram .claude/skills/code-to-diagram $ npx degit zebbern/claude-code-guide/skills/code-vuln-audit .claude/skills/code-vuln-audit $ npx degit zebbern/claude-code-guide/skills/composition-patterns .claude/skills/composition-patterns $ npx degit zebbern/claude-code-guide/skills/cross-examine .claude/skills/cross-examine $ npx degit zebbern/claude-code-guide/skills/cv-tailor .claude/skills/cv-tailor $ npx degit zebbern/claude-code-guide/skills/data-viz-renderer .claude/skills/data-viz-renderer $ npx degit zebbern/claude-code-guide/skills/database-optimizer .claude/skills/database-optimizer $ npx degit zebbern/claude-code-guide/skills/database-scout .claude/skills/database-scout $ npx degit zebbern/claude-code-guide/skills/dataset-quality-audit .claude/skills/dataset-quality-audit $ npx degit zebbern/claude-code-guide/skills/deep-module-refactor .claude/skills/deep-module-refactor $ npx degit zebbern/claude-code-guide/skills/design-system-builder .claude/skills/design-system-builder $ npx degit zebbern/claude-code-guide/skills/dev-guide-generator .claude/skills/dev-guide-generator $ npx degit zebbern/claude-code-guide/skills/ethical-hacking-methodology .claude/skills/ethical-hacking-methodology $ npx degit zebbern/claude-code-guide/skills/file-path-traversal .claude/skills/file-path-traversal $ npx degit zebbern/claude-code-guide/skills/html-injection-testing .claude/skills/html-injection-testing $ npx degit zebbern/claude-code-guide/skills/http-load-profiler .claude/skills/http-load-profiler $ npx degit zebbern/claude-code-guide/skills/idor-testing .claude/skills/idor-testing $ npx degit zebbern/claude-code-guide/skills/linux-privilege-escalation .claude/skills/linux-privilege-escalation $ npx degit zebbern/claude-code-guide/skills/linux-shell-scripting .claude/skills/linux-shell-scripting $ npx degit zebbern/claude-code-guide/skills/localization-toolkit .claude/skills/localization-toolkit $ npx degit zebbern/claude-code-guide/skills/log-error-digest .claude/skills/log-error-digest $ npx degit zebbern/claude-code-guide/skills/metasploit-framework .claude/skills/metasploit-framework $ npx degit zebbern/claude-code-guide/skills/network-101 .claude/skills/network-101 $ npx degit zebbern/claude-code-guide/skills/nextjs-developer .claude/skills/nextjs-developer $ npx degit zebbern/claude-code-guide/skills/pdf .claude/skills/pdf $ npx degit zebbern/claude-code-guide/skills/pentest-checklist .claude/skills/pentest-checklist $ npx degit zebbern/claude-code-guide/skills/pentest-commands .claude/skills/pentest-commands
$ curl -fsSL --create-dirs -o .claude/agents/change-implementer.md https://raw.githubusercontent.com/zebbern/claude-code-guide/main/agents/.claude/agents/change-implementer.md $ curl -fsSL --create-dirs -o .claude/agents/code-reviewer.md https://raw.githubusercontent.com/zebbern/claude-code-guide/main/agents/.claude/agents/code-reviewer.md $ curl -fsSL --create-dirs -o .claude/agents/codebase-mapper.md https://raw.githubusercontent.com/zebbern/claude-code-guide/main/agents/.claude/agents/codebase-mapper.md $ curl -fsSL --create-dirs -o .claude/agents/official-docs-researcher.md https://raw.githubusercontent.com/zebbern/claude-code-guide/main/agents/.claude/agents/official-docs-researcher.md $ curl -fsSL --create-dirs -o .claude/agents/root-cause-debugger.md https://raw.githubusercontent.com/zebbern/claude-code-guide/main/agents/.claude/agents/root-cause-debugger.md $ curl -fsSL --create-dirs -o .claude/agents/runtime-verifier.md https://raw.githubusercontent.com/zebbern/claude-code-guide/main/agents/.claude/agents/runtime-verifier.md $ curl -fsSL --create-dirs -o .claude/agents/security-reviewer.md https://raw.githubusercontent.com/zebbern/claude-code-guide/main/agents/.claude/agents/security-reviewer.md $ curl -fsSL --create-dirs -o .claude/agents/solution-architect.md https://raw.githubusercontent.com/zebbern/claude-code-guide/main/agents/.claude/agents/solution-architect.md
This rig commits no guardrails. Here is the community baseline instead — the deny/ask rules most often found across all 7,204 rigs:
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(**/.env)",
"Read(~/.ssh/**)",
"Bash(rm -rf *)",
"Read(**/*.pem)",
"Bash(rm -rf /)",
"Bash(git push --force:*)",
"Bash(sudo *)",
"Read(.env)",
"Bash(rm -rf /*)",
"Read(./.env.*)",
"Read(~/.aws/**)",
"Bash(git push --force*)",
"Bash(rm -rf:*)",
"Read(**/*.key)",
"Read(**/.env.*)",
"Bash(sudo:*)",
"Bash(git reset --hard*)",
"Bash(git reset --hard:*)",
"Read(.env.*)"
],
"ask": [
"Bash(git push:*)",
"Bash(git push *)",
"Bash(git commit:*)",
"Bash(rm *)",
"Bash(rm:*)",
"Bash(git rebase *)",
"Bash(wget *)",
"Bash(npm publish:*)",
"Bash(git commit *)",
"Bash(gh pr merge *)"
]
}
} Skills (74)
academic-paper-revieweractive-directory-attacksapi-fuzzing-bug-bountyapi-shape-exploreraudit-flowauthentication-patternsaws-penetration-testingbroken-authenticationburp-suite-testingcachingchart-imagecloud-penetration-testingcode-documentercode-to-diagramcode-vuln-auditvercel-composition-patternscross-examinecv-tailordata-viz-rendererdatabase-optimizerdatabase-scoutdataset-quality-auditdeep-module-refactordesign-system-builderdev-guide-generatorethical-hacking-methodologyfile-path-traversalhtml-injection-testinghttp-load-profileridor-testinglinux-privilege-escalationlinux-shell-scriptinglocalization-toolkitlog-error-digestmetasploit-frameworknetwork-101nextjs-developerpdfpentest-checklistpentest-commandspipeline-blueprintplaywright-skillprivilege-escalation-methodsproject-sizing-guider2-uploadr3f-animationr3f-best-practicesvercel-react-best-practicesred-team-toolsregression-modelerregulatory-audit-generatorrepo-auditroute-to-openapiscanning-toolsscholarly-writing-refinersecure-code-reviewshodan-reconnaissancesmtp-penetration-testingsql-injection-testingsql-insightsqlmap-database-pentestingssh-penetration-testingtest-driven-devtest-suite-architectthree-best-practicestimeline-buildertop-web-vulnerabilitiestos-clause-scannertypescript-provc-industry-researchwindows-privilege-escalationwireshark-analysiswordpress-penetration-testingxss-html-injection
Subagents (8)
| change-implementer model: opus | Use when requirements, an approved design, or a root cause are clear and one scoped, complete implementation is authorized. Do not use for unresolved exploration, product decisions, diagnosis-only wor |
| code-reviewer model: opus | Use proactively after an implementation or when an existing diff needs correctness, regression, concurrency, compatibility, and meaningful verification review. Do not use for implementation or a dedic |
| codebase-mapper model: opus | Use proactively when a task needs local repository structure, entry points, ownership, data flow, or change-surface mapping before a decision. Do not use for external documentation research, implement |
| official-docs-researcher model: fable | Use proactively when a decision depends on current official documentation, release notes, schemas, supported models, APIs, or version-specific behavior. Do not use when the primary work is tracing loc |
| root-cause-debugger model: opus | Use proactively when a failure must be reproduced, isolated, and causally explained before a fix is written. Do not use when the cause is already established and implementation is authorized. |
| runtime-verifier model: opus | Use after a completed change when acceptance criteria must be exercised through the real user-facing, CLI, service, browser, filesystem, or integration boundary. Do not use to implement fixes or when |
| security-reviewer model: opus | Use proactively when attacker-controlled input, trust boundaries, authorization decisions, sensitive sinks, secrets, or security-impacting changes require exploitability analysis. Do not use for gener |
| solution-architect model: fable | Use when established requirements and evidence leave multiple viable designs or cross-component boundaries that need explicit trade-offs before implementation. Do not use for a small specified fix or |
Similar rigs
newmindsgroup/ai-agent-skills-library
Shared library of AI agent skills — works across Claude Code, Cursor, Codex, Windsurf, OpenCode, and Google Antigravity via a single universal installer.
Orchestrator 7.7k tok ·
benjchurchill1/claude-dotfiles-shared
Shareable Claude Code dotfiles: 11 agents, 11 commands, 24 skills — framework-agnostic
Orchestrator 46.9k tok ·
sahaj-b/dotfiles
Dotfiles and scripts for my Arch Linux and Hyprland setup
Pragmatist 444 tok ·
emoulson/dotfiles-claude
—
Skill Collector 17.3k tok ·