michaelalber/ubiquitous-language
skills/ubiquitous-language/SKILL.md
Extracts and formalizes the ubiquitous language from a conversation or codebase. Flags ambiguous terms, resolves contradictions, and saves the glossary to UBIQUITOUS_LANGUAGE.md. Use when establishing shared vocabulary for a domain, after a domain-model session, or asked to "extract the ubiquitous language", "build a glossary", or "document the domain terms". Ported from https://github.com/mattpocock/skills (Matt Pocock).
development
Updated Apr 26, 2026
$ install --global
skillsauthnpx skillsauth add michaelalber/ai-toolkit ubiquitous-languageInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 27, 2026, 2:58 PM1.7s1 file scanned
SKILL.md
- name:
- ubiquitous-language
- description:
- >
- Ported from https:
- //github.com/mattpocock/skills (Matt Pocock).
- disable-model-invocation:
- true
Extract and formalize the domain's ubiquitous language from the current context.
Steps
1. Scan — collect domain terms from:
- This conversation (nouns, verbs, role names, event names, state transitions)
- Class names, method names, variable names in the codebase (if accessible)
- Existing
CONTEXT.mdif present
2. Classify each term as:
| Type | Definition | |------|-----------| | Entity | Has identity, persists over time | | Value Object | Defined by attributes, no identity | | Aggregate | Cluster of objects with one root entity | | Domain Event | Something that happened — past tense noun | | Service | Stateless domain operation | | Command | Intent to change state — imperative verb phrase | | Policy | Business rule that reacts to an event |
See references/term-classification.md for examples of each type.
3. Flag ambiguities — surface:
- Terms used inconsistently across the codebase
- Overloaded words (same word, different meanings in different contexts)
- Synonyms for the same concept (pick one, deprecate the rest)
4. Resolve — for each ambiguity, ask the user: "Which term should be canonical?"
5. Save — write to UBIQUITOUS_LANGUAGE.md:
# Ubiquitous Language
| Term | Type | Definition | Synonyms to Avoid |
|------|------|-----------|-------------------|
| [Term] | [Type] | [one-sentence definition] | [deprecated synonyms] |
6. Update CONTEXT.md — if it exists, sync any new or changed terms.
Report: terms added, ambiguities resolved, terms still open.
Related Skills
michaelalber/security-review-federal
development
VerifiedTrustedCommunity
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
SKILL.mdUpdated Jun 4, 2026
michaelalber/react-security-review
tools
VerifiedTrustedCommunity
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
SKILL.mdUpdated Jun 4, 2026
michaelalber/react-modernization-analyzer
tools
VerifiedTrustedCommunity
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
SKILL.mdUpdated Jun 4, 2026
michaelalber/react-feature-slice
development
VerifiedTrustedCommunity
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".
SKILL.mdUpdated Jun 4, 2026