AI red-teaming skill. Load when the project contains any LLM-powered feature — chatbots, AI assistants, prompt-based search, AI form helpers, AI content generation, or any endpoint that forwards user input to an LLM. Defines attack scenarios, test prompts, mitigations, and a structured red-team report. Load alongside…
AI test generation skill. Load when the user asks to "generate tests", "write E2E tests", "create integration tests", "test this user story", or "add Playwright / Cypress coverage". Produces integration and end-to-end tests from user stories, component files, or page interactions. Goes beyond unit tests — focuses on…
API documentation generation skill. Triggered by the /doc command or by requests like "document this file", "generate a README", "write API reference", or "create an architecture diagram". Analyses a given code file or directory and produces human-readable documentation: README, API reference, or text-based…
Storybook story generation skill. Load when the user asks to "generate stories", "add Storybook", "document this component", or "create stories for". Analyses React or Vue component files, extracts props, variants, and states, and outputs production-quality .stories.tsx / .stories.ts files using the project's design…
Automated Lighthouse performance audit skill. Load when the user asks for a performance audit, Lighthouse score, Core Web Vitals check, or "before ship" performance review. Uses Chrome DevTools MCP (or Lighthouse CLI) to run a full audit, capture CWV metrics, and output a prioritised fix plan. Load alongside…
Meta-skill: forces structured planning, constraint elicitation, and self-critique before writing any code or generating any artefact. Load this file FIRST on any non-trivial task — any request involving architecture, new features, refactoring, security decisions, or ambiguous requirements. Prevents premature code…
Threat modelling skill using the STRIDE framework. Load BEFORE writing any new feature that involves authentication, user data, payments, file uploads, API endpoints, or admin functionality. Produces a structured threat model and mitigation plan. Load alongside ai-red-teaming.md for AI-specific threats. Trigger…
Automated accessibility audit skill. Load when the user asks for an a11y audit, WCAG report, axe-core scan, or accessibility review of any page or component. Uses Chrome DevTools MCP to navigate, inject axe-core, and produce a structured WCAG violation report with prioritised fix suggestions. Load after uiux-a11y.md.