Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings.
Pre-write audit for skill violations: checks planned code against loaded skill anti-patterns before any file write. Use when writing Flutter/Dart/TS code or editing SKILL.md files with active project skills. Load as composite; on auto-fixed violation, also load +common/common-learning-log.
Analyze conversation corrections to detect skill gaps and prepare targeted skill-library maintenance tasks. Use after any session with user corrections, rework, or retrospective requests. After finding correction loops, also load +common/common-learning-log to persist mistake entries to AGENTSLEARNING.md.
A guide to organising project documentation and deciding what it should contain, including README files, contribution guides, architecture notes, and API documentation. A README is the main introduction to a project.
Go coding standards, clean code, and security rules. Use when writing, reviewing, or refactoring Go code. Covers error handling (wrapping with %w), package organization (internal/pkg split), concurrency safety (sync.RWMutex, goroutine lifecycle), Gin handler patterns, input validation, structured logging with zerolog…
The operating system for elite software engineering in TypeScript, React, and Next.js. Enforces the cognitive models, architecture laws, type-level patterns, component design, visual standards, and performance mandates that separate exceptional software from the ordinary — grounded in named sources (Torvalds…
Use when generating, reviewing, or refactoring Android Kotlin code for financial apps that require BigDecimal/String precision, RTL/i18n safety, Kotlin style discipline, and "do not reinvent existing project patterns" constraints.
Use when setting up deployment scripts, configuring auto-deploy, creating cron jobs, or deploying Laravel and Inertia applications to production servers. Generates deploy-pull.sh and auto-deploy.sh scripts with proper deployment sequence, logging, error handling, and cron configuration.
Fix all guardrail findings (make lint, make test, make sast) across repositories. Use when the user asks to fix linting errors, test failures, SAST findings, or run the full guardrail remediation workflow.
Scaffold a new frontend project with 5-layer Clean Architecture (Domain, Service, Infrastructure, Presentation, Main). Use when the user asks to create, scaffold, or bootstrap a new frontend or React project.
Scaffold a new Go backend project with Clean Architecture, Dig DI, and testify. Use when the user asks to create, scaffold, or bootstrap a new Go project.
A system-wide check that tests software from a real user’s point of view. It reviews whether important actions work end to end, including security, operations, performance, scheduled jobs, configuration, and paths that can lead to revenue.
A project-governance method for taking a new or existing product toward a production-ready minimum viable product (MVP). It provides planning levels, decision records, risk tracking, audits, and reusable templates for solo developers or small teams.