Claude Code Skills and slash commands

The 8 engineering skills and 6 slash commands shipped in .claude/: what they do, when they trigger, and a concrete example per skill.

HeartCo ships with ready-to-use Claude Code skills. These aren't logo or image generators: they are engineering skills that already know the boilerplate's architecture (multi-tenant, RBAC matrix, tRPC and Prisma conventions) and produce production code from the very first prompt.

They live in .claude/skills/ (one skill per folder) and the commands in .claude/commands/. Claude Code, Cursor and Windsurf detect them automatically as soon as you clone the repo. You can edit, extend or delete them: it's your code.

How they trigger

Each skill has a description that captures its purpose and use cases. Claude Code reads these descriptions and automatically activates the relevant skill when your message matches. You can also mention it explicitly by name ("use tenant-security-audit").

So there is nothing to configure: describe your intent in natural language and the right skill takes care of the rest while respecting the boilerplate's patterns.

The 8 skills

feature-factory

Generates a full module, not a file. You describe the feature and the skill scaffolds everything end to end in your conventions: org-scoped Prisma model, RBAC permissions, type-safe tRPC router, App Router dashboard page, components, tests and a freemium quota.

Add a vehicle management module with a per-plan quota

This is the most-used skill: it turns a single sentence into a business module wired into the existing architecture.

tenant-security-audit

Hunts down cross-tenant leaks. It scans every router, detects IDORs and mutations without organizationId, ranks the findings by severity and proposes the exact fix code. Run it before every deployment.

Audit multi-tenant isolation before deployment

heartco-debugger

From symptom to root cause. It classifies the error (tRPC, Prisma scope, auth, freemium, multi-tenant), traces it back to the file and line, and proposes a fix that respects the boilerplate's patterns. Ideal for an unexpected 500/403/401.

I'm getting an unexpected 403 on /dashboard/factures

prisma-migration

Migrations without breakage. It analyzes the impact before any schema change and ranks it SAFE / CAUTION / DANGEROUS, with rollback SQL for the risky cases. You change your schema knowing what it implies.

Rename the status field to state on the Devis model

prisma-performance

Hunts N+1 queries and full scans. It spots unbounded findMany calls, N+1 loops and missing indexes, then proposes the right Prisma optimization. Use it before a scalability audit or when a page drags.

Why is the accounting dashboard slow?

safe-refactor

Rename without breaking anything. It maps the blast radius across all layers (Prisma schema, tRPC routers, pages, tests, permissions), applies the changes in the right order and verifies zero regression.

Rename the crm router to contacts everywhere

docs-generator

Docs that don't lie. It reads the actual code before writing and generates publish-ready MDX user guides. Its anti-hallucination rule: only document what really exists in the code.

Write the user documentation for the invoicing module

pre-deploy-checklist

Blocks risky deployments. It checks git, schema, types, tests, security scan, freemium consistency and environment variables, then returns a PASS or BLOCKED verdict before prod crashes.

Can we merge to main?

The 6 slash commands

Slash commands are instant scaffolding. Type the command in Claude Code to generate the base, then refine.

Editing them or adding your own

Skills are plain Markdown files with frontmatter (name, description) in .claude/skills/<name>/. To adapt a skill to your business, edit its file. To create one, copy an existing folder and change the description: that's what drives the automatic triggering.

Like the rest of the boilerplate, these skills ship with no DRM and no dependency on a HeartCo server. You own them.