Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings.
Pre-write audit for skill violations: checks planned code against loaded skill anti-patterns before any file write. Use when writing Flutter/Dart/TS code or editing SKILL.md files with active project skills. Load as composite; on auto-fixed violation, also load +common/common-learning-log.
Analyze conversation corrections to detect skill gaps and prepare targeted skill-library maintenance tasks. Use after any session with user corrections, rework, or retrospective requests. After finding correction loops, also load +common/common-learning-log to persist mistake entries to AGENTSLEARNING.md.
Use when adding or changing an endpoint, a controller handler, a request or response DTO, a Zod schema, Swagger/OpenAPI annotations, or pagination in safe-client-gateway. Covers the ValidationPipe(ZodSchema)-on-every-input rule, the DTO pairing (Zod schema plus an @ApiProperty class declared implements z.infer), the…
Use when writing a commit message, a PR title, or a PR body in safe-client-gateway, or when deciding whether a change is too large for one PR. Covers the Conventional Commits shape this repo uses, the nine allowed types and when each applies, module-name scopes, the fact that main is squash-merged so the PR title…
Use when adding or changing an environment variable, a feature flag, or any configuration read in safe-client-gateway. Covers the rule that every env var is declared in configuration.ts AND validated in RootConfigurationSchema with no fallback default for a secret, reading config via IConfigurationService.getOrThrow…
Master enterprise-grade TypeScript development with type-safe patterns, modern tooling, and framework integration. This skill provides comprehensive guidance for TypeScript 5.9+, covering type system fundamentals (generics, mapped types, conditional types, satisfies operator), enterprise patterns (error handling…
Master enterprise-grade TypeScript development with type-safe patterns, modern tooling, and framework integration. This skill provides comprehensive guidance for TypeScript 5.9+, covering type system fundamentals (generics, mapped types, conditional types, satisfies operator), enterprise patterns (error handling…
Regenerate the coverage report and badges, or diagnose a wrong percentage, a 404ing badge, or a package showing 0%. Use after adding a package, when coverage numbers look implausible, or when the GitHub Pages coverage site is stale or broken.
Revise one documentation file so it states facts instead of performing insight, and get it under the budgets in scripts/no-slop.test.ts. Use when writing a new guide or README, when a reader reports the docs read like AI output, or when bun test scripts/no-slop.test.ts fails.
Write or refresh HANDOFF.md - a compact resume point holding completed objectives, live file paths, approaches already tried and rejected, and the exact next steps, placed against the roadmap in docs/ROADMAP.md. Use before /compact or /clear, at the end of a task block, when the context window crosses 50%, or when…
Coordinate multiple parallel subagents using stigmergic pheromone trails and/or explicit task queues in the code graph. Use when you need to parallelize work across multiple files or modules, run a swarm of agents, coordinate agents without direct messaging, or manage complex multi-step workflows. Triggers on "swarm"…
Turn scope documents (data model/UML, functional proposal, execution plan) into structured ClickUp tasks — modules as parent tasks, subtasks with "how to" descriptions, dependencies and CSV import. Use whenever you need to create tasks, break scope into activities, organize a backlog, plan a sprint or structure an…
House pattern for building complete CRUD domains in NestJS with Prisma — controller/service/repository with dependency inversion, validated DTOs and multi-tenant isolation. Use whenever creating a new module, entity, CRUD route or domain in a NestJS backend, even if the request is just "create the X route" or "add the…
Data modeling conventions for Prisma + PostgreSQL in multi-tenant systems — workspace isolation, numeric criticality, idempotent recurrence, document versioning by lineage and decoupled audit via a queue in Postgres itself. Use whenever creating or changing schema.prisma, designing new entities, planning migrations or…
Full security inventory of every HTTP route in a backend project — each route marked clean or carrying findings, with the exploitation path and the mitigation, written in the user's language (pt-BR by default). Use when the user runs /api-secure-report, or asks for a security report, audit or inventory of the…
Language-agnostic OWASP Top 10:2025 rules for writing and reviewing backend/API code, plus per-stack idiom files for NestJS, Laravel and Spring Boot. Use before writing or modifying any route handler, controller, guard/policy, query, auth flow, app config, or dependency — in any language. Also use when the user asks…
Run Evolith architecture validation and report a coverage-honest verdict. Use when asked to validate architecture, check ADR compliance, run architecture or governance rules, check an SDLC phase gate, or answer "does this repo pass architecture review". Also before merging, releasing or promoting a phase. Reports…