TravisBumgarner/ralph-refactor
skills/ralph-refactor/SKILL.md
Use this skill after a ralph-code phase has completed but before marking the task as complete in SCOPES.yml
development
Updated Apr 20, 2026
$ install --global
skillsauthnpx skillsauth add TravisBumgarner/claude-brain ralph-refactorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 20, 2026, 9:19 AM5.5s1 file scanned
SKILL.md
- name:
- ralph-refactor
- description:
- Use this skill after a ralph-code phase has completed but before marking the task as complete in SCOPES.yml
Your job is to review the tests and the code that were written for this task, perform a security audit, and look for any needed rework.
IMPORTANT: Do NOT use superpowers:code-reviewer or superpowers:requesting-code-review for this skill. Follow the phases below directly.
Phase 1: Code Quality Review
Analyze the completed code and look for needed refactors. Don't be overly critical or nit-pick, look for changes that are worth putting extra effort into.
Code Smells
- Duplication - Repeated logic or similar code blocks
- Long functions - Functions trying to do too much
- Complex conditionals - Deeply nested ifs or complex boolean expressions
- Magic numbers/strings - Hardcoded values without clear meaning
- Poor naming - Unclear variable, function, or type names
Design Issues
- Violation of project standards - Code doesn't follow established conventions
- High coupling - Functions/modules with too many dependencies
- Low cohesion - Functions doing unrelated things
- Temporary hacks - Quick-fix code written just to make tests pass
- Hard to test code - Indicates poor separation of concerns
Phase 2: Security Audit
CRITICAL: Before marking any task as complete, you MUST invoke the security-review skill using the Skill tool:
Skill tool call:
skill: "security-review"
Do NOT skip this step. Do NOT use superpowers:code-reviewer as a substitute.
The security review should cover:
- New code security - Audit the code written for this task
- Integration security - How the new code fits with existing code and potential attack vectors
If the security review identifies issues:
- Critical/High severity: MUST be fixed before completing the task
- Medium severity: Should be fixed, document if deferring with justification
- Low severity: Fix if trivial, otherwise note for future improvement
When to Loop Back
CRITICAL If code quality OR security issues are found:
- If the issue impacts function signatures or behavior, call the
ralph-testskill to go back to the "Red" TDD phase - If the issue is implementation quality or security fix that doesn't change behavior, call the
ralph-codeskill to go back to the "Green" TDD phase - Do NOT update the status in SCOPES.yml - the called skill will handle status updates
When to Complete
If NO issues are found (code is clean AND security audit passes):
- Ensure there are no uncommitted workspace changes (all modified code should be committed)
- Ensure you are NOT on main or master — all work must be done on a feature branch
- Update the current task in the SCOPES.yml file to assign a status of "completed"
- Commit the status update to VCS
- Call the
ralph-prskill using the Skill tool with the same arguments that were passed to this skill
Notes
- The refactor phase is about improving code quality without changing behavior - all tests should remain passing throughout
- Security is not optional - every task must pass security review before completion
- When in doubt about a security concern, err on the side of caution and fix it
Related Skills
TravisBumgarner/ui-designer
development
VerifiedTrustedCommunity
Use this agent when designing visual interfaces, creating design systems, building component libraries, or refining user-facing aesthetics requiring expert visual design, interaction patterns, and accessibility considerations. Specifically: <example> Context: Product team needs a complete design system for a new fintech application with dark mode, multiple device sizes, and strict accessibility requirements. user: "We need to create a comprehensive design system for our fintech app. Include component library, design tokens, typography scale, color palette, interactive patterns, and dark mode support. Must meet WCAG 2.1 AA." assistant: "I'll create a complete design system starting with understanding your brand guidelines and user base through the context-manager. I'll build a modular component library with documented specs, design tokens in multiple formats (CSS, JSON, Figma), responsive patterns across web and mobile, dark mode variants, and comprehensive accessibility annotations. I'll deliver Figma files, design documentation, and developer handoff specifications." <commentary> Use ui-designer when you need to establish or refine a complete design system, including component libraries, design tokens, and comprehensive visual standards. This agent excels at creating reusable design assets and documentation that scale across teams and platforms. </commentary> </example> <example> Context: A frontend team is building a new feature but needs UI design and interaction patterns before development. user: "Design the booking flow for our travel app. Need 3 screen variations, empty/loading/error states, mobile and desktop layouts, and clear interaction patterns for each step." assistant: "I'll design a complete booking flow with wireframes, visual mockups, and interaction specifications. First, let me check the context-manager for your existing design system and style guide. Then I'll create all screen states, document interaction patterns, provide motion design specifications, and ensure alignment with your design language and accessibility standards." <commentary> Invoke ui-designer when your frontend developers need detailed visual designs, interaction specifications, and asset files before implementation. The agent provides a clear handoff package that developers can build from. </commentary> </example> <example> Context: A redesign initiative is underway and you need UI improvements to an existing product. user: "Our dashboard needs a visual refresh. The functionality is fine but the UX feels dated. Improve the visual hierarchy, modernize colors and typography, add micro-interactions, and ensure it works on mobile." assistant: "I'll analyze your current dashboard using the context-manager, identify visual improvement opportunities, redesign layouts for better hierarchy and scannability, update colors and typography to modern standards, add meaningful micro-interactions, and ensure responsive design. I'll provide before/after comparisons, design rationale, and implementation specifications for your developers." <commentary> Use ui-designer for visual refinements, redesigns, and aesthetic improvements to existing interfaces. This agent modernizes dated UIs while respecting existing functionality and providing clear upgrade paths. </commentary> </example>
SKILL.mdUpdated Apr 20, 2026
TravisBumgarner/typescript-pro
development
VerifiedTrustedCommunity
Expert TypeScript developer specializing in advanced type system usage, full-stack development, and build optimization. Masters type-safe patterns for both frontend and backend with emphasis on developer experience and runtime safety.
SKILL.mdUpdated Apr 20, 2026
TravisBumgarner/tb-route-builder
development
VerifiedTrustedCommunity
Scaffold a full CRUD route — prompts for resource name, HTTP methods, and access level, then generates backend routes, shared schemas, frontend API functions, react-query hooks, and query keys.
SKILL.mdUpdated Apr 20, 2026
TravisBumgarner/tb-10-status-check
development
VerifiedTrustedCommunity
Audit the codebase against all setup skills (00-09). Reports what is done, partial, not started, or N/A for every checklist item with a summary table.
SKILL.mdUpdated Apr 20, 2026