Security vulnerability detection and remediation specialist. Use PROACTIVELY after writing code that handles user input, authentication, API endpoints, or sensitive data. Flags secrets, SSRF, injection, unsafe crypto, and OWASP Top 10 vulnerabilities.
Test-Driven Development specialist enforcing write-tests-first methodology. Use PROACTIVELY when writing new features, fixing bugs, or refactoring code. Ensures 80%+ test coverage.
Operate as an agentic engineer using eval-first execution, decomposition, and cost-aware model routing. Use when AI agents perform most implementation work and humans enforce quality and risk controls.
Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Django, TypeORM, golang-migrate). Use when planning or implementing database schema changes.
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications. Use when setting up deployment infrastructure or planning releases.
Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. Use when setting up containerized development environments or reviewing Docker configurations.
Go-specific design patterns and best practices including functional options, small interfaces, dependency injection, concurrency patterns, error handling, and package organization. Use when working with Go code to apply idiomatic Go patterns.
Go testing best practices including table-driven tests, test helpers, benchmarking, race detection, coverage analysis, and integration testing patterns. Use when writing or improving Go tests.
PostgreSQL database patterns for query optimization, schema design, indexing, and security. Quick reference for common patterns, index types, data types, and anti-pattern detection. Based on Supabase best practices.
Python-specific design patterns and best practices including protocols, dataclasses, context managers, decorators, async/await, type hints, and package organization. Use when working with Python code to apply Pythonic patterns.
Python testing best practices using pytest including fixtures, parametrization, mocking, coverage analysis, async testing, and test organization. Use when writing or improving Python tests.
Research-before-coding workflow. Search for existing tools, libraries, and patterns before writing custom code. Systematizes the "search for existing solutions before implementing" approach. Use when starting new features or adding functionality.
Audit system prompts, agent prompts, router prompts, tool/function-call prompts, and coding-agent instructions as executable contracts. Use before writing or seeding prompts; blocks vague "fix this / write code" tasks missing ownership and verification. Works with Hermes, Claude Code, Codex, OpenCode, OpenClaw.
Interactive code simulation engine that spawns ghost personas to review your code before it ships. Each ghost walks through your code line-by-line from a different failure perspective: The Adversary (race conditions, double-submit, idempotency), The Enterprise Edge (business logic gaps, multi-currency, B2B tax…
Designs composable recommendation, ranking, and feed pipelines using the six-stage Source→Hydrator→Filter→Scorer→Selector→SideEffect framework popularized by X's open-sourced For You algorithm. Use this skill when the user wants to build any system that picks "the top K items for a user/context" — content feeds…
Designs and implements APIs: REST, GraphQL, gRPC, and WebSocket. Produces OpenAPI 3.1 specs, GraphQL SDL schemas, Protocol Buffer definitions, and working server implementations. Use this skill when the user asks about API design, endpoint structure, schema definition, versioning strategy, pagination, authentication…
Designs and implements authentication and identity systems. Covers OAuth2 and OIDC flows including authorization code, PKCE, and client credentials; JWT design including RS256 vs HS256, key rotation, token blacklisting, and refresh token strategy; RBAC and ABAC modeling; SSO with Google, GitHub, and SAML 2.0; session…
Diagnoses and improves application-layer databases: Postgres, MySQL, SQLite, and MongoDB. Covers EXPLAIN ANALYZE, slow query detection, index strategy, N+1 detection, schema migrations with up/down scripts, connection pooling, replication setup, and vacuum/analyze operations. Use this skill when the user says "this…
Handles zero-downtime deployments: blue-green, canary releases, rolling updates, and feature flag rollouts. Covers Kubernetes, Docker, Cloudflare Workers, Terraform, and CI/CD pipeline setup. Use this skill when the user wants to deploy an application, set up a deployment pipeline, implement canary releases, configure…