Coding Tools

1. 1Create a custom slash command in Claude Code (.claude/commands/) that takes a project name as an $ARGUMENTS variable.
2. 2Have the command generate a PRD that doubles as agent instructions: define test suite + success criteria first, then implementation.
3. 3Instruct the agent to run tests and git commit after every significant feature.
4. 4Instruct the agent to re-test prior features after each new feature lands (regression check).
5. 5Reserve a section in the PRD for the agent to leave itself notes for future sessions.

1. 1Never hardcode API keys — use environment variables (process.env). Tell your AI to use process.env, never literal strings.
2. 2Use a real auth provider (Supabase, Clerk, or NextAuth) — never let AI invent a custom login system from scratch.
3. 3After building, prompt AI: 'You are a hacker trying to break this app. Tell me every vulnerability and how to exploit it. Then tell me the fix.'

None found — this is an introductory/teaser clip. The full technical walkthrough is in the longer video on @michellescomputer's profile.

For every feature you build with AI: always explicitly ask 'Who has access to this feature?' and 'For someone who shouldn't have access, are they blocked?' Specifically prompt: 'Add authorization checks so users can only access their own data — not other users' records by changing IDs in the URL.'

1. 1Six Claude Code plugins are recommended. Research each before installing — do NOT install any until each has been reviewed and approved:
2. 2GitHub Superpowers — forces planning/testing before coding.
3. 3Front-end design (Anthropic) — production-quality UI.
4. 4Code review — 5 parallel agents check bugs, rules, git history.
5. 5Security review — scans the codebase for vulnerabilities.
6. 6Claude Mem — persistent memory across sessions.
7. 7Stack (Gary Tan, YC) — 23 skills in one plugin (CEO, eng manager, QA, etc.).
8. 8For each, identify who publishes it and research what it does, how it's used, and whether it's safe/reputable; present the findings; install ONLY the ones that are approved, one decision at a time (see Find the Resource for where to locate the list).

1. 1Write a detailed tech spec in Claude Desktop (Opus 4.8) — not Claude Code — covering: what you're building, edge cases, data flow, UI/UX.
2. 2Connect Claude Code to GitHub. Ask it to convert the spec into an Epic with Issues and Sub-Issues.
3. 3Execute issue by issue. Review each before moving to the next. Catch problems before they compound.
4. 4Comment 'Claude Code' on the original post for the one-page setup guide.

1. 1Instead of enabling bypass permissions entirely:
2. 2Go into Claude Code permissions settings.
3. 3Build an allow list: add every command you know is safe (e.g. npm run, git status, reading files). Claude will run these instantly without asking.
4. 4Build a deny list: add anything potentially destructive (e.g. rm -rf, git push --force, sudo). Claude will block these explicitly and cannot be overridden.
5. 5This gives bypass-level speed for safe commands while keeping hard guardrails on dangerous ones.

None — low-value reaction clip with no actionable steps.

1. 1Spec in Claude Desktop with Opus 4.8 — multi-markdown files covering each feature, edge cases, data flow, UI/UX.
2. 2Hook Claude Code to GitHub, convert spec to Epic → Issues → Sub-Issues.
3. 3Build issue by issue — review and sign off before moving to next. Kill problems before they snowball.
4. 4Bonus: use powerful model (Opus) for planning only; use lighter model for the actual code execution.
5. 5Comment 'Claude Code' on the original post for the one-pager.

1. 1Conceptual research paper — not directly implementable yet as a consumer tool. Key insight to apply now:
2. 2Treat your Claude system prompt / CLAUDE.md as a living skills doc, not a set-it-and-forget-it file.
3. 3After each session where Claude made mistakes, identify which instruction was missing or vague.
4. 4Make 1–4 targeted edits (add a rule, sharpen a vague instruction, remove a bad one).
5. 5Observe whether next session's output is better — keep changes that help, revert ones that don't.

1. 1Identify what would be installed: VS Code (free, published by Microsoft), plus the Claude and Codex extensions from the VS Code marketplace. Do NOT install anything yet.
2. 2Research each first — confirm the publisher of each extension in the marketplace, what permissions it requests, and whether it's the legitimate official one (marketplace lookalikes exist); check reviews and reputation.
3. 3Present the findings for review, and install ONLY after explicit approval.
4. 4Once approved and installed: add the Claude and Codex extensions, browse the marketplace for readability/workflow extensions, and connect other AI tools so everything lives in one place. (See Find the Resource for the creator's exact extension list.)

Creator references on-screen images throughout (tweets/posts dunking on vibe coders, and examples of vibe coders building things) without narrating what is shown. Review the video to see the specific examples angus.sewell was reacting to — the visual content is likely where the value is.

1. 1Identify the target: haydenschmitty's free Claude skill that audits a codebase against 300+ common mistakes (UI/UX, performance, security). Do NOT install it yet.
2. 2Research it first — what the skill actually does, who haydenschmitty is, what access it needs to run unattended for hours, and whether it's safe and reputable. Use the Find the Resource search string to locate it.
3. 3Present the findings for review, and install ONLY after explicit approval.
4. 4Once approved and installed: run it on the codebase to audit across UI/UX, performance, and security; it runs uninterrupted for several hours (e.g. start it before bed and review in the morning).

1. 1Drop a CLAUDE.md in your project root with four rules: (
2. 2Think before you code, (
3. 3Keep it simple, (
4. 4Only change what you were asked to, (
5. 5Define what done looks like and loop until done.
6. 6Comment "RULES" on the post to receive the exact GitHub repo and full install guide via DM.

1. 1To shift from vibe coding to agentic engineering:
2. 2Write a detailed spec document before writing any code — explicitly describe everything you want.
3. 3Decompose the spec into scoped work packets (discrete, bounded tasks).
4. 4Implement work packets one at a time.
5. 5Test each packet before moving to the next.
6. 6After each change, verify the entire system stays coherent — all tests passing, no regressions.
7. 7Never skip the boring parts (testing, coherence checks).

1. 1Ask Claude to fix these 5 performance issues in your app:
2. 2Enable GZIP/Brotli compression on all JSON API responses.
3. 3Replace single-row database inserts with batch inserts.
4. 4Audit roundtrip latency — if one network event takes 90%+ of the time, that's your bottleneck. Parallelize or cache it.
5. 5Implement optimistic UI updates so the interface responds immediately before the backend confirms.
6. 6Enable static HTML generation or caching on your frontend web server so HTML is not rebuilt per visitor.

1. 1Apply these drag-and-drop UX rules:
2. 2Drop zone feedback: show border, glow, and copy/shift cue when a file is dragged over — users need 3 visual signals before dropping.
3. 3Replace spinners with honest progress: show percentage and estimated time remaining so users can decide to wait or cancel.
4. 4Inline retry on failure: if upload fails at 90%, never make users restart — keep the file loaded with a one-tap resume.
5. 5Show file preview on receipt: display thumbnail, file type, and size as visual confirmation you received the right file.
6. 6Independent progress per file: in multi-file uploads, each file gets its own progress bar and retry — one failure never blocks the others.

1. 1Never push directly to main.
2. 2Create a feature branch for every new feature — one branch per feature.
3. 3Merge feature branches into dev (your active development branch).
4. 4Merge dev into staging to do a dress rehearsal — staging mirrors production exactly.
5. 5Only merge staging into main after testing passes.
6. 6Enable branch protection rules on main: require reviews, block direct pushes.
7. 7This gives you a one-click rollback if something breaks in production.

1. 1Add text labels and tooltips to all buttons that currently lack them.
2. 2Implement optimistic UI rendering so the app feels instant.
3. 3Add pagination to backend endpoints so pages load faster.
4. 4Audit the backend for N+1 database queries and fix them.
5. 5Convert synchronous operations to async/background tasks.

1. 1Target 100% line and branch coverage before opening a PR.
2. 2Write unit tests for all code.
3. 3Write integration tests to verify code works when deployed with other systems.
4. 4Design for testability from day one: use dependency injection, write pure functions without side effects, and enforce clear separation of concerns.

1. 1Ensure all database queries are parameterized — ask Claude or Codex to audit your codebase and confirm every query uses parameterized inputs (this is the single most important defense)
2. 2Avoid writing direct raw SQL statements; use an ORM (Object Relational Mapper) instead, which adds an additional protection layer against injection attacks
3. 3Never concatenate user input (e.g., form fields, URL params) directly into a SQL query string — always sanitize or parameterize first