🦖Curated Cursor AI agent skills, slash commands, MCP configs, subagents & rules for full-stack dev — React 19, Next.js 16, Supabase, Tailwind v4, TypeScript
Skill Claude CodeCodex
Read-only audit of CI gate logic — silent bypass, ratchet gaming, required-but-not, duplicate gates. Use when "can CI be bypassed" or "why did a regression pass CI". Cost → audit-cicd. Consolidation → housekeep-gates. Rule content → audit-doctrine.
Skill Claude CodeCodex
Audit and fix internationalisation for any web or mobile app. Use when asked to "audit i18n", "fix translations", "add locale", "natural language", "translation quality", "hardcoded strings", "localisation", or "the Japanese feels like Google Translate".
Skill Claude CodeCodex
Read-only audit of hosting, database, storage, egress, and serverless spend (Supabase, Vercel, S3/R2, edge). Use when "hosting bill is high", "cut infra costs", or a bill jumps. CI minutes → audit-cicd. Model tokens → plan-llm-cost-guardrails. Consumes test-load numbers.
Skill Claude CodeCodex
Run a PDCA quality audit on LLM/AI features: traces, prompts, costs, evals, grounding, hallucination. Use for "audit LLM quality", "check Langfuse", "audit prompts", "check AI quality", "audit AI costs", "check traces". Jailbreak/OWASP LLM → audit-llm-security. Token caps → plan-llm-cost-guardrails.
Skill Claude CodeCodex
Read-only OWASP LLM Top 10 audit of app-facing AI: prompt injection, data leakage, unsafe output/agency, RAG risks, misinformation, and unbounded spend. Use when "audit LLM security", "prompt injection", "jailbreak my chatbot", or "is my AI safe?". General app security → audit-security.
Skill Claude CodeCodex
Read-only audit of mobile IAP and subscriptions — StoreKit 2, Play Billing, or RevenueCat — for server receipt validation, restore, lifecycle sync, grace periods, and entitlements. Use when "audit our IAP", "restore purchases broken", or before a paid app. Web Stripe/ledgers → audit-payment-system.
Skill Claude CodeCodex
Read-only audit for payment/money-movement systems, scope-gated so a Stripe-Checkout site and an in-house ledger each see only relevant findings. Use when "audit payment system", "double charge / idempotency", "ledger / reconciliation", "webhook / 3DS / PCI". Mobile IAP → audit-monetization-iap.
Skill Claude CodeCodex
Audit runtime performance (CWV, load priority). Use when "slow page", "LCP/INP/CLS", "fetchpriority", "early hints", "speculation rules", "bfcache", or "long tasks". JS payload → audit-bundle-size. Instant nav implement → enhance-web-instant-nav. Breaking point → test-load.
Skill Claude CodeCodex
Read-only full-stack conformance audit against RealWorld ("Conduit"): formal API spec, shared E2E suite, and closest-stack reference. Use when "audit against RealWorld", "Conduit conformance", or "is my full-stack app complete?". General user journeys → audit-ux-journeys.
Skill Claude CodeCodex
Read-only production-resilience audit: timeouts, bounded retries, circuit breakers, idempotency, rate limits, graceful degradation, PII. Use when "resilience audit", "will this survive real traffic?", or "audit retries/timeouts/idempotency". Feature parity → audit-realworld.
Skill Claude Code
Audit-and-fix linearized mobile layouts at every breakpoint — desktop is not a wide phone. Use when "responsive audit", desktop looks stacked/stretched, no max-width, breakpoint gaps, or 1440 looks like a phone. Distinct from design-mobile-first (touch/mobile-up) and audit-ux-journeys (cross-page IA).
Skill Claude CodeCodex
Static OWASP review of app code (injection, headers, deps). Use when "review security" or "check vulnerabilities". Session/route×gate/getSession → audit-auth-flows. Plan-only burndown → plan-security-audit. Table RLS → plan-rls-audit. LLM attacks → audit-llm-security.
Skill Claude CodeCodex
Read-only audit of an agent-skill pack for contradictory directives, overlapping triggers, stale cross-refs, and context bloat. Use when "audit my skills", "conflicting skills", "wrong skill triggered", or after adding a batch. Per-file spec → validate:skills. How to write one → meta-skill-creator.
Skill Claude CodeCodex
Read-only audit of unhappy-path UI states vibe-coding skips — empty, loading, error, offline, zero-results, permission, overflow — then plan fixes. Use when "check empty/error states", "audit loading states", or "what happens when this fails". Dead buttons → plan-stub-checker; backend timeouts → audit-resilience.
Skill Claude CodeCodex
Audit visual-system coherence: tokens, component variants, color/type/ spacing, dark mode. Use for "design drift", inconsistent UI, or duplicate primitives. Per-page usability → audit-ux. Breakpoints → audit-responsive. Empty/error states → audit-ui-states. Plan-only unification → plan-uiux-unification.
Skill Claude CodeCodex
Cross-page UX audit for user stories, task completion, and information architecture — the layer audit-ux (per-page heuristics) skips. Use when "audit user flows", "IA audit", "can users find X", "navigation audit", or "funnel drop-off". Full DS burndown → plan-uiux-unification.
Skill Claude CodeCodex
Per-page UX audit using NN/g heuristics, Intuit microcopy, and Google HEART. Use when evaluating usability, auditing microcopy, checking UX heuristics, or assessing cognitive load. Cross-page flows/IA → audit-ux-journeys. Layout/breakpoints → audit-responsive. Empty/error states → audit-ui-states.
Skill Claude CodeCodex
Optimize slow queries, indexes, and N+1s. Use when "slow query", "database performance", "add an index", or "N+1". Schema consistency → audit-db-schema. RLS access control → plan-rls-audit.
Skill Claude CodeCodex
Implement error-handling patterns (boundaries, toasts, API error shape). Use when "error boundary", "error toast", or "standardize API errors". Plan-only observability audit → plan-error-handling. Live Sentry triage → debug-sentry-monitor.
Skill Claude CodeCodex
Implement correlated errors, traces, and structured logs with PII redaction. Use when "add logging", "instrument this", "correlate error to trace", or wiring Sentry/Langfuse. Plan-only observability audit → plan-error-handling. Investigate Sentry issues → debug-sentry-monitor.
Skill Claude CodeCodex needs its repo
Apply backend patterns — queues, caching, rate limits, serverless/edge. Use when "queue jobs", "caching layer", "rate limiting", "server actions", or "edge function". Which architecture to pick → audit-backend-architecture.
Skill Claude CodeCodex
Implement real-time features using WebSockets, Supabase Realtime, Server-Sent Events, and live data. Use when user wants "real-time", "live updates", "WebSocket", "notifications", "chat", "collaborative", "presence", "live data", or "instant sync".
Skill Claude CodeCodex
Drive a planned mechanical change to 100% repo coverage when a prior run stopped early. Use when "finish the burndown", "it stopped halfway", "apply this everywhere", or "half-migrated". One approved plan plus deferrals → complete-everything. Parked inventory → housekeep-backlog.
Skill Claude CodeCodex
Explicit closure mode for one approved plan: implement unfinished items plus connected deferrals, verify every acceptance criterion, require completion-judge PASS. Use when "complete everything", "don't defer", "fix out of scope too", or a plan was falsely marked done. One repo-wide pattern → burndown-full.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: