A coding agent that produces a working API endpoint has completed one step. The endpoint still needs a contract, input validation, tests, a review against a spec, monitoring before it goes live, and a rollback path if the rollout fails. Those are not optional extras. They are the difference between a prototype and production software.

A project’s authentication module imports a JWT library, is called by three API endpoints, and was designed to satisfy a decision recorded in an architecture decision record from fourteen months ago. None of those files mentions the others by name. Reading each one individually does not tell you how they connect. A knowledge graph can.

This is the post that weakens the series thesis. Humanizer is a writing-quality skill. Its primary users are not engineers reviewing pull requests. The honest response to that is to say so, and then explain what it actually offers.

Ask a coding agent to produce an architecture diagram and the default output is a collection of rounded boxes connected by arrows. Every node the same size, every connection the same weight, no hierarchy, no focal point—nothing a reader could not have inferred from a well-organized table. Diagram Design is a skill built around the premise that output quality is a design problem, not a rendering one.

The default behavior of a coding agent given a feature request is to start coding. Superpowers is a methodology that makes stopping and asking the first mandatory step. It is a plugin maintained by Prime Radiant that installs across Claude Code, Codex, Cursor, and most other major coding agents—and the skills trigger automatically.

An agent asked to find missing authorization checks can identify an unguarded handler and report it as a vulnerability—while being wrong, because it cannot see the upstream middleware making the absent check intentional. The Security Audit Skill is a six-phase workflow for Claude Code, published by Cloudflare as the origin of their internal vulnerability harness, producing three verdict types: confirmed findings, unresolved leads, and disproved candidates.

Both responses below answer the same question about a failing authentication test. Only one can be acted on without reading it twice.

“Add role-based access to our application.”

Claude is not for you. It’s a tool for developers, by developers.

Claude is not for you. It’s a tool for developers, by developers.

Before activating crisis governance—or refusing to activate it—ask seven questions. Nine, if you count properly.

When every request arrives with URGENT, employees learn one of two behaviours: