suno-songwriter

claude-skills

A collection of custom skills for Claude Code. Each skill is a self-contained directory containing a SKILL.md and optional supporting reference files. The repo also doubles as a Claude Code plugin marketplace — each skill is installable individually as a plugin.

Table of Contents

• Installation
• Prerequisites
• Option A — Plugin marketplace (recommended)
• Option B — Install a single skill manually
• Option C — Install from a packaged .skill release
• Skills
• github-actions-security-review
• github-doc-sync
• hand-off
• pr-comment-triage
• skill-validator
• suno-songwriter
• Skill Structure
• Development

---

Installation

Pick whichever method fits. The marketplace (Option A) is the easiest to keep updated; Options B and C install skills without registering a marketplace.

Prerequisites

• Claude Code installed and authenticated (claude on your PATH).
• git (for the marketplace and for cloning this repo).

Option A — Plugin marketplace (recommended)

This repo is a Claude Code plugin marketplace. Each skill is published as its own plugin, so you can install only the ones you want. Run these inside a Claude Code session:

# Register the marketplace (one time)
/plugin marketplace add Fyzel/claude-skills

# Install individual skills
/plugin install suno-songwriter@claude-skills
/plugin install hand-off@claude-skills
/plugin install pr-comment-triage@claude-skills
/plugin install github-doc-sync@claude-skills
/plugin install github-actions-security-review@claude-skills
/plugin install skill-validator@claude-skills

# Refresh after the marketplace updates
/plugin marketplace update claude-skills

Browse and toggle installed plugins anytime with /plugin. The marketplace catalog lives at .claude-plugin/marketplace.json; each skill carries its own plugin manifest at skills/<name>/.claude-plugin/plugin.json.

Option B — Install a single skill manually

Skills are file-based — no marketplace or settings.json registration required. Copy the skill directory to one of Claude Code's skill locations:

| Scope | Destination | |---|---| | Personal (all projects) | ~/.claude/skills/<skill-name>/ | | Project-scoped | <project>/.claude/skills/<skill-name>/ |

git clone https://github.com/Fyzel/claude-skills.git
# Personal install of one skill (Linux / macOS):
mkdir -p ~/.claude/skills
cp -r claude-skills/skills/suno-songwriter ~/.claude/skills/

# Windows (PowerShell):
# Copy-Item -Recurse claude-skills\skills\suno-songwriter $HOME\.claude\skills\

Claude Code discovers the skill on the next session — SKILL.md must sit at <skill-name>/SKILL.md.

Option C — Install from a packaged .skill release

Every merge to main publishes each skill as a <skill-name>.skill archive on the Releases page (tagged <skill-name>-v<N>). A .skill file is a flat zip of the skill directory. Download it and unzip into a skill location:

# Example: install suno-songwriter from a downloaded archive (Linux / macOS)
mkdir -p ~/.claude/skills/suno-songwriter
unzip suno-songwriter.skill -d ~/.claude/skills/suno-songwriter/

---

Skills

github-actions-security-review

Trigger phrases: "review this GitHub Actions workflow", "audit my CI/CD pipeline", "harden this workflow", mentions of .github/workflows, GITHUB_TOKEN, pull_request_target, workflow_run, self-hosted runners, action pinning, OIDC/trusted publishing, or Zizmor/CodeQL for Actions, or a request for a new workflow to be written securely.

Audits and hardens GitHub Actions workflows against the OWASP GitHub Actions Security Cheat Sheet: dangerous triggers, unpinned/impostor third-party actions, GITHUB_TOKEN over-permissioning, script injection, secrets handling, artifact/cache poisoning, self-hosted runner risk, repo hardening, AI-assistant-in-CI/CD risk, and static analysis (CodeQL, Zizmor).

How it works:

1. Locate — finds workflow files, composite actions, and dependency-update config to verify. 2. Run the Security Gate — checks every CRITICAL control (code-execution / secret-exfiltration risk) and STANDARD control (defense-in-depth hygiene) against each file, citing the OWASP section and a reference file for detection patterns and fixes. 3. Report — CRITICAL findings block certifying a workflow as safe; STANDARD findings are recommendations. Passing workflows are confirmed, not padded with manufactured findings. 4. Write securely — when scaffolding a new workflow, applies every CRITICAL control by construction, then re-runs the gate against its own output.

Location: skills/github-actions-security-review/

---

github-doc-sync

Trigger phrases: "sync the docs", "update the docs", "doc sync", "update README and wiki", "keep docs in sync", or after resolving an issue / merging a feature when docs may be stale.

Propagates a code change into every place the project documents it — the README, in-repo guides (CLAUDE.md, CONTRIBUTING, docs/), and the GitHub wiki — in one pass, so the surfaces don't drift.

How it works:

1. Detect surfaces — finds which doc surfaces the repo actually has (README, in-repo guides, wiki); skips absent ones. 2. Identify the delta — maps the diff to doc-relevant facts (CLI flag, config key, exit code, install step). 3. Update README and in-repo guides — edits affected sections in place, matching existing structure. 4. Update the wiki — clones the separate OWNER/REPO.wiki.git repo, edits matching pages, pushes. 5. Verify — cross-checks all surfaces agree on the same facts.

Requires git; the wiki step needs the repo's wiki enabled, and pushing needs gh / git push access. Wiki pushes go live immediately.

Location: skills/github-doc-sync/

---

hand-off

Trigger phrases: /hand-off, "hand off", "delegate to a subagent", "spin this off", "pass this to a fresh agent", or any mention of context exhaustion and wanting to continue elsewhere.

Delegates a defined scope of work to a fresh Claude Code subagent with full context preserved across the boundary. Each handoff is recorded under <project-root>/.handoffs/<feature>/:

| File | Purpose | |---|---| | input.md | Brief written by parent agent: scope, context, constraints, success criteria | | output.md | Results written by subagent (required completion criterion) | | baseline.txt | Git state snapshot for recovery if output.md is missing (git projects only) |

How it works:

1. Clarify — confirms scope, context needed, and "done" criteria before writing anything. 2. Set up — creates .handoffs/<feature>/, resolves .gitignore question on first use in a git repo. 3. Write input.md — captures scope, context, current state, constraints, and success criteria. 4. Spawn subagent — uses the Task tool; subagent reads input.md and must write output.md. 5. Synthesize — verifies output.md exists, then summarizes results back into the parent conversation. Offers recovery options (diff reconstruction, re-run, manual inspect) if output.md is missing.

Location: skills/hand-off/

---

pr-comment-triage

Trigger phrases: "check the Copilot comment(s) on PR N", "address the review comments", "reply to the review comments", "resolve PR feedback", "handle the PR comments", or any request to go through a reviewer's findings on a pull request.

Triages and resolves pull-request review comments end to end — works for any reviewer (Copilot, humans, bots), language, or repo.

How it works:

1. Fetch — pulls the PR's review comments (especially GitHub Copilot automated review). 2. Fix — resolves each comment in code. 3. Test — runs the project's test suite. 4. Reply — posts a threaded reply under each original comment, by its comment ID.

Requires the gh CLI to be authenticated.

Location: skills/pr-comment-triage/

---

skill-validator

Trigger phrases: "validate skill", "lint skill", "check skill", "verify SKILL.md", or any request to confirm a skill is correctly structured before publishing or importing.

Validates SKILL.md files in the skills/ directory against Anthropic's structural requirements:

| Check | Detail | |---|---| | name present | Must exist in frontmatter | | name matches directory | name: foo must be in skills/foo/ | | description present | Must exist in frontmatter | | Description length | description + when_to_use ≤ 1,536 chars | | No XML tags in description | Claude Code rejects skills with <tag> syntax in description | | Frontmatter delimited | Must open and close with --- |

Packaging simulation writes a .skill archive to skills/<name>/.test/<name>.skill for local install testing.

Location: skills/skill-validator/

---

suno-songwriter

Trigger phrases: "create a song", "write a song", "write lyrics", "create a Suno song", or any request for original lyrics — even without the word "Suno".

Composes original songs and delivers them as three copy-paste-ready blocks for the Suno AI music generator (v5.5):

| Block | Paste into | Hard limit | |---|---|---| | Lyrics + meta tags | Suno Lyrics field | 5,000 chars | | Style description | Suno Styles field | 1,000 chars | | 10–20 title options | — | 100 chars each |

How it works:

1. Interview — asks about concept, mood, genre, instrumentation, vocals, pace, time signature, and language in a single batch. Skipped if you've already provided a full brief. 2. Compose — writes the song using Suno meta tags for structure, dynamics, and vocal direction. Handles pronunciation rules (acronyms vs. initialisms), explicit content flagging, and non-English translation automatically.

Location: skills/suno-songwriter/

Credit: Tag reference and Suno documentation by stayen.

---

Skill Structure

.claude-plugin/
  marketplace.json        # Plugin marketplace catalog (lists every skill as a plugin)
skills/
  <skill-name>/
    SKILL.md              # Skill instructions with YAML frontmatter (name, description)
    .claude-plugin/
      plugin.json         # Plugin manifest — makes the skill installable via the marketplace
    scripts/              # Driver scripts bundled with the skill (optional)
    references/           # Supporting reference files (optional)
    .test/                # Local test artifacts — gitignored, not published

The description field in SKILL.md frontmatter controls when Claude Code auto-invokes the skill — write it to cover both canonical and fuzzy trigger phrases.

Development

Requires Python 3.9+ and a virtual environment:

python -m venv .venv
# Windows: .venv\Scripts\activate
# Linux / macOS: source .venv/bin/activate
python -m pip install -r requirements.txt
pre-commit install

Validate all skill files and produce local .skill packages:

# Windows
.venv/Scripts/python skills/skill-validator/scripts/validate-skills.py

# Linux / macOS
.venv/bin/python skills/skill-validator/scripts/validate-skills.py

The validator also runs automatically on every commit that touches skills/ (validation only — no packaging).

License

Licensed under the Apache License, Version 2.0.

Publishing

On every merge to main:

• Each skill directory is zipped into a <skill-name>.skill archive (.test/ excluded) and published as a GitHub Release tagged <skill-name>-v<N>.
• The GitHub wiki is auto-generated from all skills: a Home index page plus one page per skill (frontmatter stripped, reference files appended).