nsheaps/maintain
plugins/sdlc-utils/skills/maintain/SKILL.md
Maintenance, bug fixes, and technical debt management. Use when the user asks about "bug fix", "tech debt", "refactoring", "maintenance", "deprecation", "migration", "upgrade dependencies", or when managing ongoing codebase health. Covers bug triage, refactoring strategy, and dependency management.
$ install --global
skillsauthnpx skillsauth add nsheaps/ai-mktpl maintainInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 22, 2026, 4:17 PM64.2s1 file scanned
SKILL.md
- name:
- maintain
- description:
- >
Maintenance
Guidelines for maintaining software after initial deployment.
Bug Fix Workflow
Step 1: Reproduce
- Reproduce the bug locally before attempting a fix
- Document exact reproduction steps
- Identify the root cause (not just the symptom)
Step 2: Fix
- Write a regression test first (that fails with the bug)
- Apply the minimal fix that addresses the root cause
- Search the codebase for the same pattern elsewhere
- Fix ALL instances, not just the one reported
Step 3: Verify
- Confirm the regression test now passes
- Run the full test suite
- Verify the fix in the same environment where the bug was found
Refactoring Strategy
- Refactor in small, focused PRs
- Separate refactoring from feature work (never mix)
- Ensure existing tests pass before and after
- Move first, improve later (see incremental operations pattern)
Technical Debt Management
- Track tech debt as issues with clear descriptions
- Prioritize based on impact (blocking future work > cosmetic)
- Address during maintenance windows, not during feature sprints
- Document why shortcuts were taken and when to fix them
Dependency Management
- Update dependencies regularly (not just when forced)
- Review changelogs before upgrading
- Run full test suite after any dependency change
- Pin versions in production; use ranges only in libraries
Anti-Patterns
| Anti-Pattern | Instead | | ------------------------- | ------------------------------------------- | | Fixing symptoms only | Find and fix root causes | | Mixing refactor + feature | Separate into distinct PRs | | Ignoring tech debt | Track and prioritize it | | Upgrading without testing | Always run full test suite after upgrades | | One-off bug fixes | Search for the same pattern across codebase |
Related Skills
nsheaps/github-app-session-env
tools
VerifiedTrustedCommunity
Manually reproduce what the github-app plugin's SessionStart hook does to make a GitHub App installation token usable in the current session — materialize the PEM, generate the token, isolate GH_CONFIG_DIR, write the runtime env file, and wire CLAUDE_ENV_FILE so every Bash call sees GH_TOKEN/GITHUB_TOKEN. Use when the hook did not run, the token is missing from the environment, or a shell/teammate needs the token wired up by hand. <example>GH_TOKEN isn't set even though github-app is configured</example> <example>the github-app SessionStart hook didn't run, set up the token manually</example> <example>wire the github app token into CLAUDE_ENV_FILE</example> <example>gh keeps falling back to the wrong account, isolate GH_CONFIG_DIR</example>
3SKILL.mdUpdated Jun 9, 2026
nsheaps/github-app-git-identity
tools
VerifiedTrustedCommunity
Manually configure the GitHub App bot git identity the way the github-app plugin's SessionStart hook does — resolve the app slug and bot user ID, build the <slug>[bot] name and noreply email, set GIT_AUTHOR_*/GIT_COMMITTER_* env vars, and write an isolated GIT_CONFIG_GLOBAL with the gh auth git-credential helper. Use when commits are attributed to the wrong account, "Author identity unknown" appears, or git identity must be set up by hand. <example>my commits are showing up as the handler, not the bot</example> <example>git says Author identity unknown after the github-app hook ran</example> <example>configure the github app bot git identity manually</example> <example>set up the gh credential helper for git push</example>
3SKILL.mdUpdated Jun 9, 2026
nsheaps/spec-management
tools
VerifiedTrustedCommunity
Manages spec files for requirements capture and validation
3SKILL.mdUpdated Jun 7, 2026
nsheaps/plugins/bash-command-rejection/skills/bash-chaining-alternatives
tools
VerifiedTrustedCommunity
# Bash Chaining Alternatives This skill teaches you how to work around the bash command chaining restriction enforced by this plugin. ## Why Chaining is Blocked The `bash-command-rejection` plugin blocks these operators: | Operator | Name | Why Blocked | | -------- | ---------- | ----------------------------------------------------------------------------------- | | `&&` | AND chain | Runs cmd2 only if cmd1 su
3SKILL.mdUpdated Jun 7, 2026