Skill & Command Catalog
August 4, 2026 · View on GitHub
Skill and command index with trigger phrases.
Skill Taxonomy
Every skill carries a family (the prefix) and belongs to a lifecycle stage (when in a project you reach for it). New here? The Getting Started guide explains skills in plain language first.
| Prefix | Stage | Purpose |
|---|---|---|
audit- | Assess | Read-only assessment that produces a structured report |
plan- | Assess | Audit + phased burndown you approve before any code changes |
enhance- | Change | Improve existing web UI/UX, motion, forms, SEO, PWA |
design- | Change | Create something new (UI, system, API, spec, art) |
backend- | Change | Server / data-layer engineering patterns |
mobile- | Change | Native / React Native / emulator / Capacitor |
data- | Change | Data visualization & pipeline correctness |
docs- | Change | Documentation authoring |
housekeep- | Change | Consolidate a drifted design system to one source of truth |
test- | Prove | Write/run tests & QA |
deploy- | Ship | Release & post-deploy verification |
debug- | Operate | Diagnose & fix a specific failure |
workflow- | Spans stages | Dev process (git, PR, refactor, spec-TDD, housekeep) |
meta- | Author | Authoring skills & MCP servers |
protocol- | Guardrail | Session-level protocols used by other skills |
Skills (114)
Enhance
enhance-web-ui
Triggers: "make this page nicer", "more polished", "more beautiful", "less crowded", "less AI-generated", "better laid out", "typography", "visual hierarchy", "empty/dead space", "fades", "microinteractions", "density"
What it does: Composition before decoration — fix hierarchy, grouping, alignment, rhythm. Subtract clutter, group related items, soften scroll cuts, animate purposefully. Generic across web stacks.
Related: enhance-web-ux, audit-uiux-design-system, design-frontend
enhance-web-ux
Triggers: "enhance this page", "make /xxx better", "this page feels AI-generated", "fix UX of /xxx", "improve information density", "icons all look the same", "buttons wrap to 2 lines", "empty columns"
What it does: Replaces generic / "stacked" UI with semantic data wired to real backend state. Maps every pain point to an NN/g heuristic, fixes at the helper / token level. Verified live at multiple viewports via playwright-cli.
Related: enhance-web-ui, audit-ux, audit-uiux-design-system
enhance-web-landing
Triggers: "build a landing page", "portfolio", "marketing site", "anti-slop", "Awwwards-style", "premium frontend", "make it not look AI-generated", "taste"
What it does: Anti-slop frontend skill for landing pages, portfolios, and marketing sites. Tunes variance / motion / density dials. Hard em-dash ban, canonical motion skeletons, strict pre-flight check.
Related: enhance-web-redesign, design-frontend, enhance-web-ui
enhance-web-redesign
Triggers: "redesign this site", "upgrade UI to premium", "remove AI slop patterns", "redesign audit", "make this existing site feel premium"
What it does: Audit-first upgrade of an existing web project. Starts with a 60-second AI-tell triage, then scans codebase and applies targeted fixes — no rewrites.
Related: enhance-web-landing, enhance-web-ui, audit-uiux-design-system
enhance-web-web3d
Triggers: "add 3D", "add a WebGL hero", "make it cinematic", "scroll-driven 3D", "three.js scene", "React Three Fiber", "GSAP scroll animation", "product configurator", "3D model viewer", "pinned scroll storytelling", "wow factor"
What it does: Audit-first elevation of an existing web app with 3D + cinematic motion (Three.js / R3F + GSAP ScrollTrigger + Motion). Ships with performance budget, mobile + no-WebGL fallbacks, reduced-motion support, SSR safety.
Related: enhance-web-redesign, enhance-web-landing, design-motion, audit-performance
enhance-capacitor-ui
Triggers: "improved one surface and broke the other", "looks great on web but cramped on mobile", "ad-hoc useIsMobile branches", "Capacitor / Tauri / Expo Web cross-surface issues", "hover-only affordances on touch"
What it does: Cross-surface UIUX separation for hybrid PWA + iOS + Android. Establishes three orthogonal axes — form factor, platform, pointer capability — and a three-layer architecture (context hook, mode tokens, container-query primitives).
Related: enhance-web-ui, enhance-web-ux, design-mobile-first
enhance-readme
Triggers: "enhance README", "make README prettier", "add screenshots to README", "add hero image", "make README more fun", "add animated demo to README", "record a tour GIF"
What it does: Theme-aware hero + tour grid + optional autoplay GIF via playwright-cli. Captures live screenshots at 1600×1000 in dark and light mode with <picture> auto theme-swap.
Related: docs-writer, test-playwright
enhance-web-seo
Triggers: "improve SEO", "add meta tags", "fix search ranking", "add structured data", "sitemap", "canonical URLs", "Open Graph", "Google indexing", "rich results", "SEO audit", "why is my site not ranking"
What it does: Full SEO audit and fix for any web app. Checks meta tags, OG/Twitter Card, JSON-LD structured data, robots.txt, sitemap, canonical URLs, heading hierarchy, image alt text, and Core Web Vitals (LCP, CLS) via Playwright. Researches current Google guidelines, applies fixes, verifies with Playwright.
Related: audit-performance, audit-bundle-size, enhance-web-ui
enhance-pwa
Triggers: "make it a PWA", "offline support", "install prompt", "push notifications", "service worker", "add to home screen", "background sync", "Lighthouse PWA score", "app-like experience", "installable", "works offline"
What it does: Adds or upgrades PWA features: Web App Manifest, Workbox service worker with per-asset caching strategies (CacheFirst / NetworkFirst / StaleWhileRevalidate), install prompt, push notifications, offline page. Capacitor-compatible. Lighthouse PWA audit before and after.
Related: enhance-capacitor-ui, mobile-capacitor-platform, audit-performance
enhance-motion
Triggers: "add motion", "animate the app", "make it feel alive", "motion pass", "add micro-interactions across the app", "enhance-motion"
What it does: Audits the existing design system + current motion, then applies coherent, reduced-motion-safe, 60fps motion using the right-sized 2026 stack — CSS/tw-animate-css for utility transitions, Auto-Animate for zero-config list/layout changes, Motion (motion.dev) for component transitions/gestures/presence, GSAP only for complex timelines. Defines a motion-token SSOT (durations/easings). Distinct from design-motion (from-scratch cookbook). Applies changes and verifies via playwright-cli.
Related: design-motion, audit-uiux-design-system, audit-performance, audit-accessibility, housekeep-design
housekeep-design
Triggers: "clean up the design system", "resolve design conflicts", "our UI is inconsistent across pages", "consolidate tokens/components", "streamline the design system", "keep the design SSOT", "housekeep-design"
What it does: Consolidates a design system that has drifted across many sessions/devs into one source of truth. Detects competing tokens, duplicate components, naming drift, mixed icon libraries, and arbitrary values; reconciles each conflict to a best-of-both canonical form; migrates all usages via mechanical codemod; and installs lint guardrails so drift can't recur. Establishes a 3-layer W3C token taxonomy. The execution arm of plan-uiux-unification; the design counterpart of workflow-housekeep.
Related: plan-uiux-unification, audit-uiux-design-system, enhance-agent-guardrails, burndown-full, enhance-motion, design-system
enhance-web-forms
Triggers: "improve this form", "form validation", "accessible form", "multi-step form", "form error handling", "the form UX is bad", "enhance-web-forms"
What it does: Builds/upgrades web forms to production quality: accessible structure (labels, fieldsets, autocomplete, input types), schema-driven validation with client↔server parity, screen-reader-associated inline errors, complete interaction states (loading/disabled/success/error/empty), multi-step flows, unsaved-changes guards, and optimistic submit feedback. Auto-detects the form + validation stack. Applies changes and verifies via playwright-cli.
Related: audit-accessibility, audit-ux, audit-fe-api, backend-error-handling, design-motion, enhance-web-ux
enhance-agent-guardrails
Triggers: "set up guardrails", "stop vibe-coding regressions", "add pre-commit security checks", "protect the repo from AI mistakes", "add CI security gates", "governance for AI code", "enhance-agent-guardrails"
What it does: Installs guardrails-as-code so AI/vibe-coding can't keep reintroducing the same problem classes (leaked secrets, injection, off-system styles, untested code, vulnerable deps, destructive ops). Audits existing protection, then sets up agent policy files (.cursor/rules + AGENTS.md), a pre-commit hook (secret scan + SAST + lint/typecheck), a CI gate that treats agent output as untrusted, and lint-as-policy rules. Verifies the guards actually block a planted bad pattern; flags merge-blocking CI changes for human review.
Related: audit-security, plan-security-audit, plan-secrets-audit, plan-dependency-provenance, plan-data-integrity, housekeep-design
Design
design-frontend
Triggers: "make it look good", "beautify", "style this", "redesign", "modern UI", "professional look", "improve the design"
What it does: Production-grade frontend interfaces avoiding generic AI aesthetics. Enforces bold design thinking with intentional typography, color, motion, and spatial composition.
Related: design-system, design-motion, design-theme
design-system
Triggers: "design system", "component library", "tokens", "variants", "consistent styling", "reusable components"
What it does: Build scalable design systems with CSS custom properties, CVA variants, compound components, and Radix primitives.
Related: design-frontend, audit-uiux-design-system
design-api
Triggers: "API", "endpoint", "REST", "GraphQL", "route handler", "request/response", "HTTP methods"
What it does: RESTful resource design, request/response schemas, HTTP status codes, pagination (offset/cursor), filtering/sorting, versioning, authentication patterns, Server Actions vs Route Handlers decision matrix.
Related: backend-patterns, backend-error-handling
design-prd
Triggers: "PRD", "product requirements", "write a spec", "new feature spec", "feature requirements", "scope a feature"
What it does: Generate PRDs via structured conversation. Auto-detects tech stack, features, data model. Uses Firecrawl for competitive research, Context7 for feasibility, Supabase MCP for data model verification.
Related: docs-coauthor, workflow-spec-tdd
grilling (adapted from mattpocock/skills, MIT)
Triggers: "grill me", "stress-test this plan", "interview me about this", "poke holes in this", "challenge my thinking"
What it does: Relentless one-question-at-a-time interview until shared understanding is reached. Recommends an answer with each question, looks up facts itself, puts every decision to the user, and writes no code until confirmed. Ends with a compact decision log to feed design-prd or /plan.
Related: domain-modeling, design-prd, workflow-spec-tdd
domain-modeling (adapted from mattpocock/skills, MIT)
Triggers: "pin down terminology", "ubiquitous language", "glossary", "record an architectural decision", "ADR", "the agent uses the wrong words"
What it does: Actively build and sharpen the project's domain model: a CONTEXT.md glossary plus sparing ADRs (only for hard-to-reverse, surprising, real-trade-off decisions). Challenges conflicting terms, sharpens fuzzy language, stress-tests boundaries with concrete scenarios, and cross-references claims against the code.
Related: grilling, design-prd, docs-coauthor
plan-uiux-unification
Triggers: "UI/UX unification plan", "design system audit plan", "UI burndown", "unify the design system", "plan UI overhaul", "design system consolidation", "IA audit before redesign", "audit UI without fixing", "UI/UX unification"
What it does: Exhaustive, non-destructive UI/UX + design-system audit that produces a burndown and unification plan — no code changes in this pass. IA-first (hierarchy before layout), preservation contract, full surface inventory, violation log, prioritized burndown with risk column, phased roadmap, guardrails. Enhances existing DS; does not replace it. Optional playwright-cli for evidence; Firecrawl for current-year best practices.
Related: audit-uiux-design-system, audit-ux, enhance-web-ux, enhance-web-ui, design-system
plan-antislop
Triggers: "feels AI-generated", "AI slop", "de-slop", "reads like ChatGPT", "generic/templated/soulless", "every component looks the same", "voice pass", "authenticity pass", "strip the AI smell"
What it does: Audit-and-plan for machine-generated tells across four surfaces — prose (cadence, filler vocab, hedge-and-pad), visual/UI (default palette, card-grid monotony, centered-everything), code (placeholder residue, comment slop, over-abstraction), structure/IA (listicle-brain, symmetrical scaffolding, README slop). Scores findings by recognizability × effort; emits plan-antislop.md phased burndown — no rewrites until each phase is approved. Recommends directions, never ghost-written replacements.
Related: enhance-web-ux, enhance-web-ui, enhance-web-landing, design-frontend, audit-i18n, docs-writer, plan-uiux-unification
plan-rls-audit
Triggers: "RLS", "row level security", "is my Supabase secure", "anyone can read my data", "check my database policies", "lock down my tables", "service_role key", "Supabase security advisor"
What it does: Table-by-table Supabase/Postgres RLS audit — relrowsecurity, permissive/inverted policies (CVE-2025-48757 class), service_role client-side, auth.uid() perf. Produces access matrix + plan-rls-audit.md — no SQL until approved.
Related: plan-secrets-audit, plan-security-audit, audit-db-schema, db-migrator
plan-error-handling
Triggers: "errors aren't showing in Sentry", "fail silently", "empty catch blocks", "observability", "check my Langfuse", "LLM tracing"
What it does: Audits silent failures across Sentry (swallowed catches, PII in events, coverage holes) and Langfuse (untraced calls, missing evals, prompt versioning). Emits plan-error-handling.md — no code until approved.
Related: backend-observability, audit-langfuse-llm, debug-sentry-monitor, plan-test-coverage
plan-input-validation
Triggers: "validate my inputs", "XSS", "dangerouslySetInnerHTML", "Stripe webhook", "forge requests", "injection-safe", "sanitize user content"
What it does: Trust-boundary audit — forms/API (Zod gaps, mass assignment), rendered content (XSS), webhooks (CVE-2026-41432, raw-body, idempotency), uploads. Emits plan-input-validation.md — no hardening until approved.
Related: plan-rls-audit, plan-secrets-audit, plan-security-audit, audit-fe-api
plan-secrets-audit
Triggers: "hardcoded secrets", "did I commit a key", "secret scan", "rotate keys", "are my API keys exposed", "is my .env safe"
What it does: Credential scan + rotate vs relocate judgment (git-history permanence trap). Classifies anon vs service_role, NEXT_PUBLIC_ leaks, Vercel/AWS env. Emits plan-secrets-audit.md — no rotation until approved.
Related: plan-rls-audit, create-hook, audit-security
plan-data-integrity
Triggers: "is my migration safe", "could I lose data", "check my backups", "agent might delete prod", "destructive operations", "disaster recovery"
What it does: Destructive-op and migration safety audit — unguarded DELETE/DROP, backfill-before-drop, backup blast radius (PocketOS Apr 2026), overprivileged agent/CI tokens, confirmation gates. Emits plan-data-integrity.md — no migrations/tokens until approved.
Related: plan-secrets-audit, plan-rls-audit, audit-db-schema, db-migrator
plan-dependency-provenance
Triggers: "check my dependencies", "slopsquatting", "is this package real", "supply chain audit", "license check", "SBOM", "did the AI hallucinate a package"
What it does: Supply-chain audit — existence/slopsquatting (CSA 2026 ~20% hallucinated deps), lockfile integrity, license/provenance, transitive bloat. Provenance table + plan-dependency-provenance.md — never install suspect packages to verify.
Related: plan-secrets-audit, create-hook, workflow-housekeep, /update-deps
plan-llm-cost-guardrails
Triggers: "cap my AI costs", "LLM bill could blow up", "token budget", "runaway agent loop", "per-user AI limits", "drain my API quota"
What it does: 3-layer guardrail audit — token-bucket limits, cost-velocity circuit breakers, fallback chain (cheaper model → cache → 503). Complements Langfuse observability. Emits plan-llm-cost-guardrails.md.
Related: audit-langfuse-llm, plan-input-validation, backend-patterns
plan-aeo-readiness
Triggers: "AEO", "GEO", "do AI engines cite me", "llms.txt", "blocking AI crawlers", "ChatGPT/Perplexity visibility"
What it does: Answer-engine citation audit — crawler access (Cloudflare AI-bot defaults), SSR/extractability, schema, Princeton GEO levers (quotes +41%, stats +30%). Google/AI overlap <20%. Emits plan-aeo-readiness.md.
Related: enhance-web-seo, docs-writer, plan-antislop
plan-mobile-readiness
Triggers: "App Store ready", "Google Play reject", "privacy manifest", "data safety form", "pre-submission", "Guideline 2.5.2"
What it does: Store submission audit — privacy manifests, Data Safety ↔ permissions, IAP via billing, demo account, 2.5.2 thin-app risk, Android closed-test gate. Emits plan-mobile-readiness.md.
Related: mobile-capacitor-platform, enhance-capacitor-ui, plan-stub-checker, plan-capacitor-hardening
plan-capacitor-hardening
Triggers: "Capacitor app secure", "harden hybrid app", "WebView security", "secure storage tokens", "deep link OAuth", "cleartext traffic", "allowNavigation", "exported activity", "OTA update safe"
What it does: Capacitor four-pillar native audit (Data, Auth/Deep-Link, Network, WebView) + OTA store-policy — Keychain vs localStorage, PKCE, App/Universal Links, dev config in prod. Invisible to web-only review. Emits plan-capacitor-hardening.md.
Related: plan-secrets-audit, plan-input-validation, plan-mobile-readiness, mobile-capacitor-platform
plan-stub-checker
Triggers: "find dead buttons", "stub checker", "fake components", "unwired handlers", "dead links", "orphaned components", "plan stub wiring", "what's not connected", "mock data in prod", "buttons that do nothing", "stub audit"
What it does: Exhaustive audit for stubs, dead buttons, fake/placeholder components, unwired handlers, dead links, orphans, and severed integrations. Traces intended backend, Supabase, Sentry, and pipeline targets; conservative false-positive filtering. Burndown + phased wiring plan — no implementation until user approves. Optional Playwright, Sentry, and Supabase MCP.
Related: debug-fe-be-integration, audit-fe-api, test-qa, debug-sentry-monitor, workflow-fix-and-ship
plan-perf-audit
Triggers: "performance audit plan", "perf burndown", "measure before optimize", "bundle size audit plan", "LCP slow plan", "N+1 audit plan", "plan performance improvements", "Core Web Vitals audit"
What it does: Measure-don't-guess performance audit across web, mobile, backend, and data. Burndown + optimization plan — no fixes in this pass. No fabricated metrics; baselines or [NEEDS PROFILING]. Research-backed proposals: React code-split/memo/virtualization, RN Hermes/JSI/cold start, EXPLAIN-verified indexes, Lighthouse CI budgets + RUM. Mobile thresholds stricter than web CWV.
Related: audit-performance, audit-bundle-size, backend-db-performance, mobile-rn-performance
plan-security-audit
Triggers: "security audit plan", "OWASP audit plan", "RLS audit", "Supabase security review", "hardening plan", "secrets scan plan", "plan security fixes", "security burndown"
What it does: OWASP Top 10 audit with Supabase-first methodology (RLS pass, service_role bundle scan, auth-path trace, CVE deps). Plan only — no patches, no destructive testing. Never pastes secret values. Top classes: tables without RLS, service_role in client, permissive policies.
Related: audit-security, audit-db-schema, test-red-team, plan-stub-checker
plan-docs-sync
Triggers: "docs drift", "sync docs with code", "audit documentation", "stale README", "onboarding docs broken", "doc sync plan", "phantom docs", "docs out of date"
What it does: Audit docs vs actual code behavior. Drift taxonomy (stale/missing/phantom/contradictory/onboarding-breaking/inline-rot/API-contract). Code-as-source-of-truth; onboarding-drift check vs .env.example + CLI --help. Docs-as-code guardrails. Plan only — no rewrites until approved. Never aspirational or invented behavior.
Related: docs-writer, workflow-housekeep, plan-stub-checker
plan-test-coverage
Triggers: "test coverage plan", "coverage audit", "traceability matrix", "fake-green tests", "uncovered user stories", "plan tests for critical flows", "mutation testing plan", "what's not tested"
What it does: User-story-driven coverage audit from real code — traceability matrix, multi-lens coverage (branch/path/risk/integration), fake-green detection, mutation-testing recommendations. Plan only — no test writing until approved. Natural lock-in after stub-wiring.
Related: test-unit, workflow-spec-tdd, test-playwright, plan-stub-checker
design-motion
Triggers: "animation", "transition", "micro-interaction", "motion", "animate", "hover effect", "scroll animation", "page transition", "make it interactive", "fun interactions", "playful UI", "gamification", "delightful", "Easter eggs"
What it does: Framer Motion, CSS animations, GSAP. Covers entrance/exit, staggered lists, scroll-triggered effects, layout animations. Includes delight patterns (bouncy buttons, magnetic elements, confetti, Konami code). Always respects prefers-reduced-motion.
Related: design-frontend, enhance-web-web3d
design-mobile-first
Triggers: "mobile", "responsive", "touch", "PWA", "mobile-first", "small screen", "tablet", "swipe", "gesture"
What it does: Touch-optimized navigation, bottom sheets, swipe-to-delete, pull-to-refresh, responsive tables/grids, 44px touch targets, safe area handling, PWA install prompts.
Related: design-frontend, audit-performance
design-theme
Triggers: "apply theme", "color palette", "brand colors", "styling slides", "presentation design", "visual identity"
What it does: Pre-set visual themes with curated colors and fonts. Apply cohesive styling across artifacts.
Related: design-system, design-frontend
design-email
Triggers: "build an email template", "transactional email", "welcome email", "password reset email", "email design", "React Email", "MJML", "dark mode email", "deliverability", "SPF DKIM", "email copy review", "why is my email in spam"
What it does: Full-stack transactional and marketing email. Detects React Email / MJML / plain HTML and Resend / SendGrid / Postmark / SES. Builds mobile-first templates (600px, inline styles, dark mode), reviews copy for natural conversational tone (no jargon, one action per email), checks SPF/DKIM/DMARC deliverability, and wires Supabase Edge Function triggers.
Related: design-frontend, backend-patterns, workflow-feature-flag
design-generative-art (Apache-2.0, adapted from Anthropic)
Triggers: "generative art", "procedural art", "flow fields", "particle systems", "creative coding", "noise patterns", "mathematical visualizations", "art from code", "generate visuals", "interactive animation"
What it does: Seeded randomness, flow fields, recursive subdivision, circle packing, L-systems, animation loops. React component pattern with controllable parameters and PNG/SVG export.
Related: enhance-web-web3d, design-motion
design-canvas (Apache-2.0, adapted from Anthropic)
Triggers: "poster", "visual design", "infographic", "certificate", "badge", "banner", "social media graphic", "print design", "create artwork", "design graphic"
What it does: Museum-quality visual design through named design philosophies ("Brutalist Joy", "Chromatic Silence"). Creates .md philosophy files and .pdf/.png visual artifacts.
Related: design-frontend, design-theme
Backend
backend-patterns
Triggers: "API design", "database schema", "authentication", "caching", "queues", "background jobs", "microservices", "serverless", "backend architecture"
What it does: Server Actions (Next.js), tRPC routers, Supabase Edge Functions, database patterns (optimistic locking, soft deletes, audit logging), caching (Next.js cache, Redis), background jobs (Inngest, Trigger.dev), rate limiting.
Related: design-api, backend-db-performance, backend-error-handling
backend-db-performance
Triggers: "slow query", "database performance", "timeout", "index", "query optimization", "Prisma", "Supabase", "PostgreSQL"
What it does: N+1 query detection and fixes, index strategy (single, composite, partial, GIN), EXPLAIN ANALYZE interpretation, Prisma/Supabase query patterns, pagination (offset vs cursor), batch operations, RLS performance.
Related: backend-patterns, audit-db-schema, audit-performance
backend-realtime
Triggers: "real-time", "live updates", "WebSocket", "notifications", "chat", "collaborative", "presence", "live data", "instant sync"
What it does: Supabase Realtime subscriptions, Server-Sent Events, WebSocket patterns, presence tracking, live data synchronization.
Related: backend-patterns, data-visualization
backend-error-handling
Triggers: "error boundary", "try/catch", "error state", "toast notification", "form validation error", "API error handling"
What it does: Standard error types, Server Action error patterns, form error display (React 19 useActionState), error boundaries, API route error handling, TanStack Query error handling, monitoring/logging.
Related: design-api, backend-patterns
backend-observability
Triggers: "add logging", "instrument this", "why can't I debug prod", "no observability", "correlate the error to the trace", "redact PII from logs", "set up alerts/SLOs", wiring Sentry / Langfuse / structured logs
What it does: Build-time observability — shared request/trace ID across every log line, Sentry scope, and Langfuse trace. Structured logging, PII redaction, OTel-conventional span design, LLM trace capture, symptom-based alerts/SLOs. Vendor-neutral.
Related: debug-sentry-monitor, audit-langfuse-llm, debug-error
data-pipeline
Triggers: "build an ingestion pipeline", "sync X into Y", "nightly aggregation", "process this queue", "backfill", "this cron double-counts", "dedupe", "the numbers are wrong after a retry"
What it does: Build-time correctness for ETL / ingestion / edge-function workers / cron / queue consumers. Bakes in idempotency, atomicity, data contracts, delivery semantics, observability, and a 4-layer staging architecture.
Related: audit-db-schema, backend-observability, workflow-spec-tdd
data-visualization
Triggers: "chart", "graph", "visualization", "dashboard", "analytics", "D3", "Recharts", "data display", "metrics", "statistics"
What it does: Recharts (line, bar, area, pie/donut), sparklines, stat cards with trends, real-time chart updates, D3.js custom visualizations. Includes accessibility patterns for charts.
Related: design-frontend, design-system
Audit
audit-code-quality
Triggers: "code smell", "anti-pattern", "technical debt", "inconsistent", "standardize", "conventions", "cleanup codebase", "why different patterns", "cleanup", "why is this slow/broken"
What it does: Two-in-one: (1) detect and fix React/TypeScript/state anti-patterns that cause bugs and performance issues; (2) audit codebase for naming, organisation, and pattern consistency. Produces a structured coherency report.
Related: workflow-refactor, audit-code-review
audit-code-review
Triggers: "code review", "review this PR", "review this code", "review changes"
What it does: Thorough code review — correctness, security, performance, a11y, maintainability. Uses Sentry MCP for production error context, Firecrawl for current best practices.
Related: audit-code-quality, workflow-pr
audit-cicd
Triggers: "CI/CD cost", "GitHub Actions bill", "Actions minutes", "runner cost", "workflow cost", "CI is expensive", "slow CI", "audit my workflows", "artifact/cache storage", "reduce Actions spend"
What it does: Audits GitHub Actions workflows for cost, speed, and safety via the gh CLI (live billing, run volume, runner types, artifact/cache storage). Flags double-billing triggers, missing concurrency, macOS/large runners on push, missing path filters, doomed jobs, and long artifact retention — then proposes fixes (concurrency, dispatch-gated runners, retention limits, caching, storage cleanup) that never delete tests or break deploys. Includes account-level backstops (retention default, spending budget).
Related: audit-security, deploy-verify, workflow-pr, create-hook
audit-performance
Triggers: "slow", "performance", "LCP", "INP", "CLS", "bundle size", "loading time", "optimize", "Web Vitals", "lighthouse score"
What it does: Core Web Vitals assessment (LCP, INP, CLS), bundle analysis, network optimization, JavaScript/CSS performance, React 19+ optimizations, image optimization.
Related: backend-db-performance, design-mobile-first
audit-security
Triggers: "security", "vulnerability", "XSS", "CSRF", "SQL injection", "auth", "RLS", "secrets", "security headers"
What it does: OWASP Top 10 review, authentication flow audit, RLS policy verification, secrets management, CSP headers, input validation, rate limiting assessment.
Related: backend-patterns, design-api
audit-accessibility
Triggers: "accessible", "WCAG", "ADA", "a11y", "screen reader", "disability"
What it does: WCAG 2.1 AA compliance audit — WCAG 2.2 automated via axe. Form labels, color contrast, keyboard navigation, focus management, alt text, dynamic content announcements, skip links, accessible modals/tables/forms.
Related: design-frontend, audit-uiux-design-system
audit-db-schema
Triggers: "schema review", "database audit", "naming conventions", "RLS audit", "migration check", "index audit", "constraint check"
What it does: Audit database schema for consistency, validation, and industry standards. Auto-detects database type, ORM, migration tool. Uses Supabase MCP for live inspection, Firecrawl for best practices, Context7 for ORM docs.
Related: backend-db-performance, audit-security
audit-fe-api
Triggers: "API audit", "frontend API", "API mismatch", "request optimization", "API contract", "network requests"
What it does: Audit frontend API calls against backend implementation. Validates endpoints exist, parameters match, types align, caching configured, error handling present. Uses Sentry MCP for production API errors.
Related: debug-fe-be-integration, design-api
audit-realworld
Triggers: "audit against realworld", "compare my app to realworld", "conduit conformance", "is my full-stack app complete", "full-stack gap check", "what's missing to reach production"
What it does: Audits a full-stack app against the RealWorld ("Conduit") reference — its formal API spec, shared Bruno/Hurl E2E suite, and closest-stack reference implementation. Auto-detects strict spec conformance (repo is a RealWorld build) vs benchmarking the repo's own domain against RealWorld's production-relevant patterns, and bows out on non-CRUD/non-web repos. Read-only: produces a prioritized Implemented/Partial/Missing/Diverges gap report across FE/BE/data, then delegates real production hardening to audit-security / plan-*. RealWorld is a completeness/pattern reference, not a production bar.
Related: audit-fe-api, debug-fe-be-integration, audit-security, plan-perf-audit, plan-rls-audit, complete-everything, full-stack-ship-discipline
audit-resilience
Triggers: "is this production-ready", "resilience audit", "will this survive real traffic", "audit retries/timeouts/idempotency", "reliability review", "the 80% problem"
What it does: Read-only audit for the non-functional "20%" agents skip: timeouts, retries with backoff+jitter, circuit breakers, idempotency keys, rate limiting, graceful degradation, cancellation, audit logging, and PII handling in logs. Inventories every external call, mutation, webhook, and payment path and marks each concern Implemented/Partial/Missing with file:line, severity, and the exact fix skill. Delegates remediation to backend-* and plan-* skills.
Related: backend-error-handling, backend-patterns, backend-observability, plan-llm-cost-guardrails, plan-input-validation, complete-everything
audit-backend-architecture
Triggers: "audit backend architecture", "which pattern should I use", "is my backend production-grade", "am I over-engineering", "sync vs event-driven", "cache-aside/CQRS/saga/db-per-service", "microservices resilience review", "lift the backend to production"
What it does: Read-only audit and decision advisor for backend/distributed-systems architecture. Topology-gated so a serverless/monolith and a Kubernetes fleet each see only relevant findings. Two lenses: (1) conformance — marks each pattern Implemented/Partial/Missing/N-A with file:line; (2) fit/decision — following "start simple, earn every pattern" (modular-monolith-first), recommends which to adopt now / adopt-when-[trigger] / defer as premature, with a maturity ladder + symptom→pattern table, flagging over-engineering and the distributed-monolith anti-pattern just as loudly as real gaps. Covers communication style (sync request/response vs async event-driven, per interaction), cache-aside, database-per-service, API gateway, BFF / API composition / GraphQL federation, circuit breaker, bulkhead, backpressure/load-shedding, outbox + CDC, saga (compensation + saga-pivot), CQRS + event sourcing, hexagonal / ports-and-adapters, anti-corruption layer, strangler-fig, sidecar / service mesh (incl. ambient/sidecarless), cell-based, zero-trust/mTLS, distributed tracing + SLOs, and contract testing. Defers per-call runtime resilience to audit-resilience (no overlap); delegates fixes to backend-patterns (see its references/architecture-patterns.md).
Related: audit-resilience, backend-patterns, design-api, audit-security, backend-observability, audit-db-schema, workflow-refactor, complete-everything
audit-payment-system
Triggers: "audit payment system", "payment gateway audit", "double charge / idempotency", "double-entry ledger", "reconciliation / settlement", "webhook signature / 3DS / SCA", "PCI DSS", "is my payment flow safe", "audit-payment-system"
What it does: Read-only audit for payment/money-movement systems — the code that fails differently from normal CRUD (a retried charge is a double-charge, a lost ledger write is vanished money, a logged PAN is PCI liability, an unverified webhook is a spoofed "payment succeeded"). Scope-gated (P0 merchant integrator / P1 platform-marketplace / P2 gateway-PSP-fintech) so a simple Stripe-Checkout site and an in-house ledger each see only relevant findings — never flags "no double-entry ledger" on a shop that offloads it to Stripe. Checks the 2026 pillars (idempotency + double-entry ledger + reconciliation, with PCI DSS v4.0.1 as the floor and webhooks as source of truth) across seven groups: A money-movement correctness (idempotency on every mutation + DB unique constraint, dedup, payment state machine / no double-capture, integer minor units, multi-currency+FX); B ledger & data integrity (double-entry balanced/sum-zero, append-only immutable, derived balance snapshots, auditability, date partitioning); C async & webhooks (sync-auth vs async-everything, HMAC verify, event-id dedup + 200-then-process, atomic state+ledger+outbox, pull-based recovery for stuck payments, refund/dispute/payout saga); D reconciliation & settlement (daily 3-way match ledger↔PSP↔bank, break report, discrepancy handling, halt-on-unreconciled brake); E fraud/risk/SCA (velocity/geo/device + rules/ML score, 3DS2/SCA + exemptions, fraud-service fail policy, chargeback/VAMP monitoring, AML); F PCI/compliance (never store/log PAN or CVV, tokens-only, key rotation, access audit); G resilience (PSP/bank timeout + breaker, bulkhead, partial-write safety, graceful degradation). Uses the Stripe MCP (search_stripe_documentation + stripe_api_search/stripe_api_details) for version-anchored provider checks when the PSP is Stripe. Every finding cites file:line; no severity below Critical for a double-charge, lost-money, or PAN-exposure gap. Read-only and payment code is a STOP-and-confirm surface — findings feed a human-reviewed remediation, not an unattended edit.
Related: audit-resilience, audit-security, audit-db-schema, audit-backend-architecture, plan-data-integrity, plan-secrets-audit, backend-patterns, data-pipeline, complete-everything
audit-langfuse-llm
Triggers: "audit LLM", "check Langfuse", "audit prompts", "check AI quality", "LLM PDCA", "audit AI costs", "check traces", "audit eval scores", "check hallucination"
What it does: PDCA quality audit for LLM/AI features via Langfuse CLI, Sentry, Supabase, Playwright, and Firecrawl. Audits traces, prompts, costs, evals. Performs live verification and grounding/hallucination checks.
Related: deploy-verify, debug-sentry-monitor, backend-observability
audit-uiux-design-system
Triggers: "design system audit", "UI consistency", "token compliance", "design drift", "component audit", "visual coherency"
What it does: Audit UI/UX coherency against design system. Auto-detects CSS framework, component library, icon library. Checks token compliance, component modularity, live visual verification via playwright-cli, Nielsen's 10 heuristics.
Related: design-system, audit-accessibility, audit-ux
audit-ux
Triggers: "UX audit", "usability review", "heuristic evaluation", "content audit", "interaction design review", "user flow analysis", "UX quality", "check cognitive load", "audit microcopy"
What it does: Research-driven UX audit — Nielsen Norman Group's 10 heuristics, Laws of UX, Intuit Content Design, Google HEART metrics. playwright-cli for live walkthrough, Firecrawl for research, Sequential Thinking for complex flow analysis. Per-page experience lens — for cross-page journeys, user-story completion, and IA structure use audit-ux-journeys.
Related: audit-ux-journeys, audit-uiux-design-system, audit-accessibility, enhance-web-ux
audit-ux-journeys
Triggers: "audit user flows", "user story audit", "information architecture audit", "IA audit", "can users find X", "users get lost", "navigation audit", "funnel drop-off", "task completion", "audit-ux-journeys"
What it does: Cross-page UX audit for user stories, task completion, and information architecture — the layer audit-ux (per-page heuristics) doesn't cover. A site can pass every per-page heuristic and still fail because users can't find the feature or finish the story. Phase 0 derives 5–10 real user stories from routes/nav/CTAs (reusing design-prd / plan-test-coverage inventories — never invented personas) and scopes depth by audit trigger (KPIs dropping → targeted funnel; complaints → thematic; redesign → comprehensive; pre-launch → qualitative walkthroughs labeled as assumptions). Phase 1 audits IA structurally: click depth per story target (money pages ≤2–3), orphan pages, dead ends, label consistency (nav ≈ title ≈ H1, one concept = one word), grouping vs user mental model (not DB schema), first-click logic, wayfinding (breadcrumbs, aria-current), search/filter presence, URL sanity. Phase 2 walks every story end-to-end in a headed browser (desktop + 390px mobile) producing a task-completion matrix: steps-to-goal, friction log (hesitation/mislabel/backtrack/surprise/stall), error-recovery probes (invalid input, Back, refresh mid-flow), success-moment clarity — a BLOCKED story is automatically a Blocker finding. Phase 3 enforces evidence discipline: every finding tagged [data] (analytics/funnels/drop-offs from GA4/PostHog/Clarity/etc.), [observed] (reproduced), or [judgment] (assumption to validate) — never presents taste as data; with no analytics, recommends minimal funnel instrumentation as a roadmap item. Phase 4 reports impact×effort: quick wins vs roadmap vs deprioritized, neutral behavior-grounded language, always names what works. Delegates per-page fixes to enhance-web-ux, forms to enhance-web-forms, WCAG to audit-accessibility, heuristics depth to audit-ux.
Related: audit-ux, enhance-web-ux, enhance-web-forms, audit-accessibility, audit-performance, audit-realworld, plan-test-coverage, design-prd, test-playwright
audit-bundle-size
Triggers: "reduce bundle size", "analyse bundle", "tree shaking", "lazy loading", "code splitting", "slow initial load", "large JS", "chunk size", "why is the bundle so big", "first load JS too large", "LCP caused by JS"
What it does: Finds and eliminates JS bundle bloat. Detects bundler (Vite/Webpack/Next.js/Rollup). Runs production build with analysis (rollup-plugin-visualizer, @next/bundle-analyzer), identifies largest chunks, duplicate deps, non-tree-shakeable imports, missing code-splitting. Maps every finding to a specific file and import with before/after size estimates.
Related: audit-performance, enhance-web-seo, workflow-refactor
audit-i18n
Triggers: "audit i18n", "fix translations", "add locale", "natural language", "translation quality", "hardcoded strings", "localisation", "the Japanese feels like Google Translate", "translations sound robotic", "add language support"
What it does: i18n audit with emphasis on natural, human-sounding copy — not machine-translated jargon. Finds hardcoded strings, checks translation completeness across all locales, rewrites stiff/literal copy to sound like a real person, fixes date/number/currency locale formatting, walks the live app in each locale via Playwright. Works with react-i18next, next-intl, vue-i18n, lingui, and any other library.
Related: audit-ux, audit-code-quality, enhance-web-ux
Debug
debug-error
Triggers: "debug", "error", "bug", "broken", "not working", "exception", "crash", "investigate"
What it does: Systematic debugging: reproduce → isolate → research → identify root cause → fix → verify → prevent. Integrates Sentry MCP for production context, Firecrawl for fix patterns, Context7 for library docs.
Related: debug-fe-be-integration, debug-sentry-monitor
debug-fe-be-integration
Triggers: "API error", "4xx error", "5xx error", "validation error", "integration issue", "backend error", "FE-BE mismatch"
What it does: Debug frontend-backend integration by analyzing backend logs, production errors (Sentry), and source code. Auto-detects FE/BE frameworks, API style, validation library. Generates both FE and BE fixes.
Related: audit-fe-api, debug-error
debug-sentry-monitor
Triggers: "check Sentry", "fix Sentry errors", "triage errors", "production errors", "monitoring", "error tracking", "run sentry check"
What it does: Monitor, triage, fix, and enhance Sentry error monitoring. Auto-detects org, project, framework, config. Seer AI root cause analysis, code fixes, noise filters, monitoring architecture audit.
Related: debug-error, deploy-verify, backend-observability
Test
test-unit
Triggers: "write tests", "test coverage", "unit test", "test this", "add tests", "testing", "Jest", "Vitest", "pytest"
What it does: Write effective unit tests. Auto-detects framework (Vitest/Jest/pytest/Go/etc.), researches patterns via Firecrawl, fetches docs via Context7. Uses Sentry MCP to identify production errors lacking test coverage.
Related: workflow-spec-tdd, test-qa
test-qa
Triggers: "QA the app", "test the app", "find bugs", "test before release", "run QA", "test CRUD", "test data pipeline", "check for dead buttons", "pre-release testing", "smoke test"
What it does: Full-app QA via playwright-cli. Auto-discovers pages, features, data entities, auth patterns. Performs real CRUD with data pipeline verification (FE → API → DB → FE), audits UX quality, tests edge cases.
Related: test-unit, test-playwright, protocol-browser-anti-stall
test-playwright
Triggers: "test this with playwright", "test my changes", "test on localhost like a user", "PDCA this", "did you actually test it", "red-team this feature", "verify the work end-to-end"
What it does: Closes the PDCA loop after an implementation. Scopes to the current session's diff, drives the live localhost app through playwright-cli manually like a real user, and fixes pain points — full-stack (UI/UX + API + DB).
Related: test-qa, protocol-browser-anti-stall, debug-fe-be-integration
test-red-team
Triggers: "red team this app", "attack my app", "break it", "find all the defects", "adversarial test", "pre-launch hardening", "pentest the app", "full app QA", "security + perf + UX sweep", "try to break it"
What it does: Adversarial full-app sweep driven by a feature-first coverage matrix: each feature decomposed to surfaces, sub-pages, components, and states, attacked across 4 dimensions — UI/UX, data pipeline, security (OWASP Top 10 + MASVS), and performance. Drives playwright-cli (web), Playwright Android WebView attach (Capacitor), or adb tap-walk (native chrome). Cross-references Sentry + Supabase + Firecrawl. Produces a severity-ranked defect list with repro evidence and a launch-readiness verdict.
Related: test-playwright, test-qa, audit-security, iterate-post-launch
protocol-browser-anti-stall
Triggers: (protocol — used by other skills before browser automation sessions); also "parallel browser agents", "playwright session", "browser keeps stalling"
What it does: Standardizes browser work on playwright-cli (npx --yes @playwright/cli@latest) with named sessions (-s=<name>) so parallel agents each get an isolated browser instead of fighting over the single-instance Playwright MCP. Prevents freezing: navigation guards with snapshot verification, max 3-second waits, incremental wait pattern, max 4 attempts per goal, SPA rules, fresh refs after state changes. Ships an MCP→CLI command map and persistent-login setup (including the Google/CDP sign-in workaround).
Related: test-qa, test-playwright, deploy-verify
Mobile
mobile-rn-screen
Triggers: "this screen looks off", "feels clunky on iOS", "Android version looks wrong", "jank when scrolling", "button is unreachable", "polish this React Native screen", "safe area", "keyboard covers input", "FlatList re-renders"
What it does: Polishes an existing React Native screen to feel intentional and native. Catches safe-area violations, sub-minimum touch targets, keyboard occlusion, JS-thread animation jank, gesture conflicts, FlatList re-render storms.
Related: enhance-capacitor-ui, mobile-emulator-start, mobile-emulator-test
mobile-rn-performance
Triggers: "janky scroll", "slow startup", "huge bundle", "memory leak", "frame drops", "FlashList", "upgrade React Native", "bump Expo SDK"
What it does: React Native / Expo performance, build, and upgrade depth — FPS & re-renders, Hermes, TTI/startup, bundle & app size, FlashList, memory, Reanimated UI-thread animation, Turbo Modules, Android 16KB page alignment.
Related: mobile-rn-screen, mobile-emulator-start, mobile-emulator-test
mobile-capacitor-platform
Triggers: "add push notifications", "deep linking", "ship an OTA update", "set up native build CI", "submit to the App Store", "fix an App Store rejection", "make the app work offline", "migrate my web app to Capacitor"
What it does: Capacitor platform + pipeline depth — plugin selection, OTA/live updates, deep/universal links, push (FCM/APNs), offline-first, safe-area, native build CI/CD, App Store/Play Store submission, Capsec security scan.
Related: enhance-capacitor-ui, workflow-spec-tdd
mobile-emulator-start
Triggers: "start emulator", "start Metro", "restart dev loop", "fix Cannot connect to Expo", "spin up new terminal instance", "stuck bundler", "align emulator geometry"
What it does: Boots Metro + Android emulator in the right order — kills duplicate ports, picks fresh-cache vs fast-iteration, defaults to a 1080×2400 display (1080×4000 opt-in for scroll-QA with a matching tall skin), polls /status before deeplink to avoid connection races.
Related: mobile-emulator-test, mobile-rn-screen
mobile-emulator-test
Triggers: "test on emulator", "QA Android build", "verify native build", "white screen", "cache rehydration", "RN sync empty state", "Expo dev-client QA"
What it does: Native build QA on Android emulator — three-layer CRUD verification (UI / API / DB), build-freshness + dual-auth phases, fixes for white-screen / cache-rehydration / sync-empty-state. Pairs Metro/adb walk with Supabase + Sentry MCPs.
Related: mobile-emulator-start, test-qa, debug-fe-be-integration
Deploy
deploy-verify
Triggers: "verify deploy", "post-deploy check", "smoke test production", "ship or rollback", "deploy health check", "post-release check"
What it does: Post-deploy smoke test combining Sentry + Supabase + Langfuse + Playwright + Firecrawl. Checks for new errors, verifies migration health, confirms trace pipeline, runs browser smoke test. Binary SHIP/ROLLBACK/MONITOR verdict.
Related: debug-sentry-monitor, audit-langfuse-llm
iterate-post-launch
Triggers: "improve the app after launch", "fix the top issues", "post-launch polish", "what should I fix next", "production issues", "iterate on feedback", "post-release improvements", "what is broken in prod", "ship a polish pass", "make it better based on real usage"
What it does: Closes the post-ship improvement loop. Pulls Sentry top errors (with Seer AI root-cause), Supabase slow-query and API logs, advisor warnings, and a live Playwright walkthrough into a ranked improvement backlog (impact × effort). Implements the approved fixes full-stack and verifies each one live. Resolves confirmed Sentry issues.
Related: test-red-team, deploy-verify, debug-sentry-monitor, test-playwright
deploy-npm
Triggers: "release", "publish to npm", "ship a new version", "cut a release", "deploy to production", "update the changelog and publish"
What it does: End-to-end release workflow for a Changesets + GitHub Actions + npm Trusted Publisher (OIDC) monorepo with per-package GitHub Releases.
Related: deploy-verify, workflow-pr
workflow-ship-and-observe
Triggers: "ship it", "deploy to production", "release this", "go live", "roll this out", "promote to prod", "cut a release", "/ship-and-observe"
What it does: Take merged, green code to a verified, monitored production release for any app stack. Confirms the target and exact source revision, deploys the intended revision (with backend dependencies), proves the deployed build equals that revision (not just a 200), smoke-tests critical flows against production, watches error/latency signals through a defined stability window, then confirms stable or executes an explicit rollback/hotfix. Completion is deployed-verified after the live check and observed-stable only after the window passes.
Related: deploy-verify, deploy-npm, full-stack-ship-discipline, iterate-post-launch, workflow-feedback-to-closure, verification-before-completion
Workflow
workflow-spec-tdd
Triggers: "build X", "implement", "add a feature", "do it properly", "this keeps breaking", "make it right", any non-trivial feature/refactor/bug
What it does: Anti-vibe-coding spine: brainstorm → spec (the contract) → plan (file-mapped) → TDD (RED failing test → GREEN minimal code → REFACTOR) → self-review gate before declaring done. Stack-agnostic.
Related: workflow-coding-discipline, test-unit, test-playwright
workflow-refactor
Triggers: "refactor", "split file", "extract", "cleanup", "reorganize", "too big", "technical debt"
What it does: Safe, incremental code transformations. Extract to utils/hooks/components/types/services. Barrel files, separation of concerns, performance patterns (memoization, code splitting), clean code patterns.
Related: audit-code-quality, workflow-spec-tdd
workflow-git-commit
Triggers: "git", "commit message", "branch", "PR", "pull request", "merge", "rebase", "release", "changelog"
What it does: GitHub Flow/GitFlow branching, conventional commits, PR templates, code review checklists, merge strategies, semantic versioning, release workflow, conflict resolution, git hooks.
Related: workflow-pr
workflow-pr
Triggers: "create PR", "pull request", "merge PR", "PR review", "PR checks", "merge criteria"
What it does: PR lifecycle from creation to merge. Runs validations, security scans, creates PR with template. Monitors checks (polls status), addresses bot feedback, ensures all threads resolved.
Related: workflow-git-commit, audit-code-review
burndown-full
Triggers: "finish the burndown", "it stopped halfway", "apply this everywhere", "complete the refactor across all files", "make sure nothing was missed", "ran out of steam", "half-migrated repo", "/burndown-full"
What it does: Drive a planned change to 100% coverage when a prior agent run stopped early. Defines MATCH/DONE searchable patterns, enumerates the full repo-wide worklist (not the plan's file list), executes in small batches with persistent .cursor/burndown-state.md, and loops a verification gate (fresh grep → zero hits, typecheck, lint, test, build) until provably complete. Framework-agnostic — discovers project verification commands from package.json/Makefile/AGENTS.md.
Related: complete-everything, composer-2.5-execution, plan-* skills (audit-only), workflow-refactor
complete-everything
Triggers: "complete everything", "don't defer", "fix out of scope too", "finish the whole plan", "close every TODO", "finish all follow-ups", "no deferrals", "/complete-everything"
What it does: Close an approved plan's intent, behavior, and verification gaps. Recovers unfinished plan items plus connected work parked as out of scope/follow-up/optional, writes observable acceptance criteria and durable progress to .cursor/complete-everything-state.md, implements in independently verifiable milestones, routes API/FE-BE/performance/UI work to the matching skills, and loops the full applicable verification ladder until every closure item has fresh evidence. The packaged Cursor stop hook continues actionable unchecked state; Claude Code 2.1.139+ can use /goal. Final closure requires an independent completion-judge PASS at the claimed evidence level.
Related: completion-judge, verification-before-completion, burndown-full, test-unit, audit-fe-api, debug-fe-be-integration, audit-performance, test-playwright
workflow-green-repo
Triggers: "make the repo green", "get CI passing", "fix all the failing tests", "clear the typecheck errors", "zero lint errors", "make the build pass", "clean up the baseline", "/green-repo"
What it does: Drive an entire repository to a verified-green baseline — typecheck, lint, tests, and build all passing from a clean run — when fixing pre-existing debt is explicitly authorized. Discovers the real gate commands, captures the baseline, enumerates every failure into .cursor/green-repo-state.md, fixes root causes in batches (never skip/.only/@ts-ignore/blanket-snapshot to force green), and proves green with a fresh from-scratch run. Distinct from complete-everything (one plan's scope) and burndown-full (one searchable pattern).
Related: complete-everything, burndown-full, verification-before-completion, completion-judge, debug-error
workflow-feedback-to-closure
Triggers: "triage this feedback", "turn these reports into tickets", "process the bug backlog", "handle these review comments", "close the loop on QA findings", "manage incoming issues", "/feedback-to-closure"
What it does: Turn raw feedback — bug reports, complaints, review comments, Sentry issues, QA/audit findings — into deduplicated, durable, trackable tickets and drive each to production-verified closure. Normalizes and clusters signals, dedupes against existing issues, writes reproducible tickets to .cursor/feedback-closure-state.md (and the tracker), prioritizes by impact, fixes via the right skill with a regression test, and closes only after the fix is verified where the user hit it — not when a PR merges.
Related: workflow-fix-and-ship, complete-everything, iterate-post-launch, workflow-ship-and-observe, debug-sentry-monitor, verification-before-completion
workflow-environment-ready
Triggers: "set up the environment", "is this ready to run", "before we start the big task", "preflight the repo", "why won't the tests run", start of any long/autonomous run
What it does: Prove the working environment is actually runnable before a long or autonomous task, so a multi-hour run doesn't fail at the finish line on a missing tool, dependency, service, or credential. Detects the stack, verifies runtimes and reproducible installs, confirms required services are reachable and every .env.example variable is present (names only — never printing secrets), and confirms each verification command executes. Emits a READY / READY WITH NOTES / BLOCKED verdict.
Related: workflow-green-repo, complete-everything, burndown-full, workflow-onboard, debug-error
iterate-agent-harness
Triggers: "the agent stopped early again", "it said done but wasn't", "it gamed the test", "improve the skills so this doesn't recur", "add a guard for this", "close the loop on that failure"
What it does: Turn an agent's own failure — premature stop, false "done", reward-hacked check, missed file, broken handoff — into a durable improvement to the harness (skills, rules, hooks, subagents, verification scripts) plus a regression check that would have caught it. Classifies the failure mode, locates the harness gap, adds a guard that fails before the fix, makes the smallest durable fix, validates, and records the lesson. Operates on this toolkit itself.
Related: verification-before-completion, completion-judge, complete-everything, burndown-full, create-skill, create-rule, create-hook, meta-skill-creator
workflow-housekeep
Triggers: "housekeep", "clean up repo", "update README", "update dependencies", "fix vulnerabilities", "remove dead code", "tidy up", "repo maintenance", "spring clean", "declutter"
What it does: Full-cycle repository maintenance: README sync, dead file cleanup (logs, screenshots, deprecated code), dependency updates (audit, classify, update with research), config/script/env audit.
Related: workflow-refactor, docs-writer, audit-code-review
workflow-parallel-agents
Triggers: "run agents in parallel", "parallel worktrees", "multi-model", "best-of-N", "compare approaches"
What it does: Run agents in parallel via git worktrees, cloud agents, or multi-model comparison. Covers isolation, merge strategies, result evaluation.
Related: workflow-spec-tdd
workflow-coding-discipline
Triggers: "coding guidelines", "LLM discipline", "avoid vibe-coding", "think before coding", "simplicity first", "Karpathy guidelines"
What it does: Behavioral guardrails for writing, editing, refactoring, debugging, or reviewing code. Reduces LLM mistakes — overcomplication, drive-by edits, hidden assumptions, weak success criteria. Adapted from Karpathy's observations.
Related: workflow-spec-tdd, audit-code-quality
workflow-feature-flag
Triggers: "add a feature flag", "gradual rollout", "staged release", "kill switch", "dark launch", "flag cleanup", "canary release", "rollback plan", "safe feature release", "deploy without switching on", "LaunchDarkly", "PostHog flags", "GrowthBook"
What it does: Disciplined feature-flag rollout. Detects existing flag infrastructure (LaunchDarkly, Flagsmith, GrowthBook, Unleash, PostHog, or env-var gates). Designs flag contract (name, targeting, kill-switch path), implements the gate, stages rollout (0% → internal → 5% → 100%), monitors Sentry error rate + Supabase logs at each stage, promotes or rolls back, then schedules cleanup from code.
Related: workflow-spec-tdd, deploy-verify, iterate-post-launch
workflow-onboard
Triggers: "I'm new to this repo", "orient me", "explain this codebase", "what does this do?", "onboard me", "first day on this project", "catch me up on the codebase", "help me understand this project"
What it does: First-contact orientation for any codebase. Reads package manifests, entry points, routing, data layer, auth, env vars, and recent git history. Produces a concise briefing: what the app does, how it's structured, how to run it, and the top 3 areas to understand first.
Related: workflow-build-feature, docs-writer
workflow-merge-conflicts (adapted from mattpocock/skills, MIT)
Triggers: "resolve the conflicts", "fix this merge", "the rebase is stuck", conflict markers left in the tree
What it does: Resolve an in-progress merge/rebase by tracing each conflicting hunk back to its original intent (commits, PRs, issues), preserving both intents where possible, then running the repo's real checks before finishing the operation. Never resolves on textual appearance alone; never aborts without instruction.
Related: workflow-git-commit, workflow-pr
handoff (adapted from mattpocock/skills, MIT; user-invoked via /handoff)
Triggers: /handoff only — disable-model-invocation: true, so it costs zero always-on context
What it does: Compact the current conversation into a handoff document (state, ordered next steps, suggested skills, gotchas) saved to the OS temp directory, with secrets redacted, artifacts referenced by path instead of copied, and verification claims held to the verification-before-completion ladder.
Related: verification-before-completion, workflow-parallel-agents
Bundled Workflows
Orchestrator skills that sequence multiple individual skills into a tracked, phase-gated loop. Use these first — they eliminate the need to manually chain skills.
workflow-build-feature
Triggers: "build a feature", "implement this", "add X", "ship a new capability", "build this end to end", "implement from scratch"
What it does: End-to-end feature build: spec (workflow-spec-tdd) → implement → unit tests (test-unit) → smoke test (test-playwright) → PR (workflow-pr). Enforces spec-before-code discipline and full-stack verification. Done criteria: spec written, RED test was failing, GREEN after implementation, smoke test passed, PR open with evidence.
Chain: workflow-spec-tdd → test-unit → test-playwright → workflow-pr
Related: workflow-spec-tdd, test-unit, test-playwright, workflow-pr
workflow-fix-and-ship
Triggers: "fix this bug and ship it", "patch this and close the ticket", "fix this Sentry issue", "bug report from user", "fix and deploy", "triage and fix"
What it does: Complete bug-fix lifecycle: triage Sentry/logs → reproduce locally → root cause (debug-error) → surgical fix + regression test → smoke test (test-playwright) → PR (workflow-pr) → optional post-deploy smoke (deploy-verify) → resolve Sentry issue. Leaves evidence at every step.
Chain: debug-error → test-playwright → workflow-pr → deploy-verify
Related: debug-error, debug-sentry-monitor, test-playwright, workflow-pr, deploy-verify
workflow-quality-gate
Triggers: "is this ready to ship?", "quality gate", "pre-release checklist", "what do I need to fix before launch?", "ship-readiness check", "run the quality gate"
What it does: Pre-release go/no-go. Sequences: adversarial red team (test-red-team) → static security review (audit-security) → bundle size (audit-bundle-size) → Core Web Vitals (audit-performance) → unit test coverage (test-unit). Produces a single GO / NO-GO / GO WITH CONDITIONS verdict with a ranked defect list.
Chain: test-red-team → audit-security → audit-bundle-size → audit-performance → test-unit
Related: test-red-team, audit-security, audit-bundle-size, audit-performance, test-unit
workflow-launch-ready
Triggers: "prepare for launch", "launch week", "everything before going live", "is the app launch-ready?", "pre-launch sweep", "ship it to the world", "launch prep"
What it does: Full launch preparation sweep. Sequences: SEO (enhance-web-seo) → PWA (enhance-pwa) → bundle (audit-bundle-size) → i18n (audit-i18n) → quality gate (workflow-quality-gate) → deploy smoke (deploy-verify) → day-1 iteration (iterate-post-launch). Produces a launch checklist with go/no-go verdict.
Chain: enhance-web-seo → enhance-pwa → audit-bundle-size → audit-i18n → workflow-quality-gate → deploy-verify → iterate-post-launch
Related: workflow-quality-gate, iterate-post-launch, deploy-verify
Docs
docs-writer
Triggers: "write documentation", "README", "API docs", "document this", "create docs", "architecture docs"
What it does: Write clear documentation. Templates for READMEs, API docs, code comments, architecture docs. Includes Mermaid diagram patterns.
Related: docs-coauthor, design-prd
docs-coauthor
Triggers: "write a doc", "draft proposal", "help me document", "create spec", "design document", "PRD", "RFC", "ADR"
What it does: Three-stage workflow: Context Gathering (questions, info dump), Refinement & Structure (brainstorm, curate, draft per section), Reader Testing (predict questions, verify answers, fix gaps).
Related: docs-writer, design-prd
Meta
meta-skill-creator (Apache-2.0, adapted from Anthropic)
Triggers: "create skill", "SKILL.md format", "skill structure", "skill best practices" What it does: Guide for creating effective AI agent skills with proper frontmatter, descriptions, progressive disclosure structure, and concise body.
meta-mcp-builder
Triggers: "MCP", "Model Context Protocol", "AI tools", "LLM integration", "agent tools", "build MCP server" What it does: Four-phase MCP server development: Research & Planning, Implementation (TypeScript/Python SDK), Review & Test, Create Evaluations.
Subagents (6)
| Agent | Trigger | Output |
|---|---|---|
code-reviewer | Code changes, review request | Severity-ranked quality/security/type findings |
completion-judge | Approved-plan, burndown, or wide-change completion claim | PASS, CONTINUE, or BLOCKED after reconciling outcome, state, diff, and fresh evidence |
db-migrator | Migration, schema, new table | SQL/RLS/index guidance |
debugger | Error, exception, unexpected behavior | Root cause and verified fix |
deploy-checker | Deploy, ship, production | Pre-deploy readiness verdict |
perf-monitor | Slow, laggy, optimize | Performance findings and priorities |
Commands (38)
Commands fall into two groups: standalone (full playbook in the file) and pointer (thin slash entry delegating to a skill).
Standalone
| Command | File | Quick Reference |
|---|---|---|
/plan | plan.md | Plan Mode — research codebase, clarify, produce approved plan before coding |
/research | research.md | Three-phase Firecrawl deep research → gap analysis → implementation plan |
/fix-issue | fix-issue.md | Fetch GitHub issue → find code → implement fix → open PR |
/mcp-guide | mcp-guide.md | MCP-powered dev workflow reference (renamed from /mcp to avoid Claude Code's built-in /mcp) |
Pointer (delegates to skill)
| Command | Points to | Notes |
|---|---|---|
/burndown-full | burndown-full | Finish a partial refactor/migration to 100% repo coverage (MATCH/DONE + verification gate) |
/complete-everything | complete-everything | Close connected deferrals and prove the whole approved outcome with fresh tests |
/green-repo | workflow-green-repo | Drive the whole repo to green (typecheck/lint/test/build) — authorized debt cleanup |
/ship-and-observe | workflow-ship-and-observe | Deploy, verify the live revision, observe the stability window, roll back if needed |
/feedback-to-closure | workflow-feedback-to-closure | Feedback → deduped durable tickets → fix → production-verified closure |
/commit | workflow-git-commit | Pre-commit pipeline: lint, Sentry, build, scope, conventional commit, push |
/debug-issue | debug-error | Hypothesis-driven debugging with runtime evidence (renamed from /debug to avoid Claude Code's bundled /debug) |
/pr | workflow-pr | Pre-flight → commit → push → open PR |
/readme | enhance-readme, docs-writer | Visual showcase + content sync |
/refactor | workflow-refactor | Analyze → split → extract → verify behavior |
/review-code | audit-code-review | Agent review + manual checklist (renamed from /review to avoid Claude Code's built-in /review) |
/test | test-unit, test-qa, mobile-emulator-test | Type check → unit → integration → E2E |
/uiux | audit-uiux-design-system, audit-ux, enhance-web-ui, enhance-web-ux | Audit + enhance UI/UX |
/uiux-plan | plan-uiux-unification | Full UI/UX unification plan (audit only, no fixes) |
/grill-me | grilling | One-question-at-a-time interview to align before building |
/handoff | handoff | Compact the conversation into a handoff doc for a fresh session |
/slop-plan | plan-antislop | AI slop / authenticity audit + de-slop burndown (plan only) |
/rls-plan | plan-rls-audit | Supabase RLS + access-control audit (plan only) |
/secrets-plan | plan-secrets-audit | Secrets scan + rotate-vs-relocate plan (plan only) |
/validation-plan | plan-input-validation | Input-validation + trust-boundary audit (plan only) |
/integrity-plan | plan-data-integrity | Data-integrity + destructive-op safeguard plan (plan only) |
/error-plan | plan-error-handling | Error-handling + observability audit (plan only) |
/deps-plan | plan-dependency-provenance | Dependency provenance + slopsquatting audit (plan only) |
/cost-plan | plan-llm-cost-guardrails | LLM cost guardrails audit (plan only) |
/aeo-plan | plan-aeo-readiness | Answer-engine / AEO readiness audit (plan only) |
/mobile-plan | plan-mobile-readiness | App Store / Play submission audit (plan only) |
/capacitor-plan | plan-capacitor-hardening | Capacitor native-layer security audit (plan only) |
/stub-plan | plan-stub-checker | Stub/dead-link/fake-component audit + wiring plan (no fixes) |
/perf-plan | plan-perf-audit | Performance audit + optimization plan (no fixes) |
/security-plan | plan-security-audit | Security/OWASP/RLS audit + hardening plan (no fixes) |
/docs-plan | plan-docs-sync | Docs drift audit + sync plan (no rewrites) |
/test-plan | plan-test-coverage | User-story test coverage audit + plan (no tests written) |
/update-deps | workflow-housekeep (Phase 3) | Audit and update dependencies safely |
Skill Composition Patterns
Prefer bundled workflows (
workflow-build-feature,workflow-fix-and-ship,workflow-quality-gate,workflow-launch-ready) for multi-phase tasks. Use individual skills when the request is scoped to one phase.
Bundled workflows (start here)
| Intent | Bundled skill | What it chains |
|---|---|---|
| Close a plan with no connected deferrals | complete-everything | durable closure set → conditional specialists → full verification → completion judge |
| Build a feature end-to-end | workflow-build-feature | spec → TDD → unit tests → smoke → PR |
| Fix a bug and ship it | workflow-fix-and-ship | debug → fix → smoke → PR → deploy |
| Pre-release quality check | workflow-quality-gate | red-team → security → bundle → perf → unit tests |
| Full launch preparation | workflow-launch-ready | SEO + PWA + bundle + i18n + quality gate + deploy + iterate |
| Green the whole repository (authorized) | workflow-green-repo | discover gates → enumerate failures → batch fix → prove green from scratch |
| Deploy to production and observe | workflow-ship-and-observe | preflight → deploy → verify live revision → observe → stable/rollback |
| Feedback → tracked → verified closed | workflow-feedback-to-closure | gather → dedupe → tickets → fix → verify live → close |
Chaining diagram
workflow-build-feature
└─ workflow-spec-tdd → test-unit → test-playwright → workflow-pr
workflow-fix-and-ship
└─ debug-error → test-playwright → workflow-pr → deploy-verify
workflow-quality-gate
└─ test-red-team → audit-security → audit-bundle-size → audit-performance → test-unit
workflow-launch-ready
└─ enhance-web-seo → enhance-pwa → audit-bundle-size → audit-i18n
→ workflow-quality-gate → deploy-verify → iterate-post-launch
workflow-ship-and-observe
└─ preflight (green) → deploy → verify live revision → observe window
→ stable OR rollback/hotfix
workflow-feedback-to-closure
└─ gather → dedupe → durable tickets → fix (workflow-fix-and-ship /
complete-everything) → verify live → close
Specialist compositions (individual skills)
Full Feature Build (manual)
workflow-spec-tdd → backend-patterns + design-api + backend-error-handling + audit-security
Six-Skill Plan Loop (audit → approve → execute)
See docs/PLAN-LOOPS.md for diagrams, prompts, and execution mapping.
plan-uiux-unification → plan-antislop (optional) → plan-stub-checker → plan-test-coverage
→ plan-perf-audit ∥ plan-security-audit → plan-docs-sync
After approval: enhance-web-ux, docs-writer, audit-i18n, debug-fe-be-integration, test-unit, audit-performance, audit-security, docs-writer, test-playwright
Anti-Slop / Authenticity Pass
plan-antislop → user approval per phase → docs-writer / audit-i18n (copy) → enhance-web-ui (visual) → enhance-web-ux (IA) → test-playwright → re-run plan-antislop
Security Spine (layered pre-launch)
See docs/PLAN-LOOPS.md — five layers with cross-hand references:
plan-input-validation → plan-secrets-audit → plan-rls-audit → plan-data-integrity → plan-error-handling
After approval: backend-patterns, db-migrator, backend-observability, provider rotation, infra gates → test-playwright + test-red-team
Observability & Spend Loop
plan-error-handling + plan-llm-cost-guardrails → approval → backend-observability, audit-langfuse-llm, backend-patterns
Launch Gates
plan-capacitor-hardening → plan-mobile-readiness (Capacitor pre-store) · plan-aeo-readiness → enhance-web-seo / docs-writer
Stub & Wiring Audit
plan-stub-checker → user approval → debug-fe-be-integration → workflow-fix-and-ship → test-playwright
Performance Fix
audit-performance → backend-db-performance + audit-code-quality + workflow-refactor
Design System Sprint
plan-uiux-unification → user approval → enhance-web-ux + enhance-web-ui → audit-accessibility + design-mobile-first + design-theme
LLM Quality Cycle
audit-langfuse-llm → debug-sentry-monitor → deploy-verify
UX Polish
audit-ux → enhance-web-ux → enhance-web-ui → /commit
Native RN Ship Loop
mobile-emulator-start → mobile-emulator-test → workflow-pr → deploy-verify
Cross-Surface UI Architecture
enhance-capacitor-ui → enhance-web-ui → enhance-web-ux
Repo Maintenance
workflow-housekeep → docs-writer + workflow-refactor + audit-code-review
Third-Party UI Pipeline
thirdparty-ui-ux-pro-max (design system) → implement → thirdparty-emil-design-eng (motion) → thirdparty-web-interface-guidelines (Vercel compliance) → /commit
See THIRD-PARTY-SKILLS.md for attribution and update policy.
Third-Party Skills (Adapted)
Upstream-maintained skills vendored with thirdparty- prefix. Each includes ATTRIBUTION.md. See CONTRIBUTING.md for update policy.
thirdparty-emil-design-eng
Triggers: "animation craft", "emil design", "micro-interactions", "Sonner-style", "design engineering", "thirdparty-emil-design-eng"
What it does: Emil Kowalski's design engineering philosophy — animation decision framework, component polish, performance rules, review checklist with Before/After tables.
Upstream: emilkowalski/skills
Related: thirdparty-web-interface-guidelines, motion-design, enhance-page-ui
thirdparty-ui-ux-pro-max
Triggers: "ui ux pro max", "design system generator", "landing page design", "color palette", "typography pairing", "thirdparty-ui-ux-pro-max"
What it does: Generates tailored design systems via Python search scripts (scripts/search.py). 67 styles, palettes, typography, stack-specific guidelines.
Upstream: nextlevelbuilder/ui-ux-pro-max-skill
Related: design-system, design-frontend, thirdparty-web-interface-guidelines
thirdparty-web-interface-guidelines
Triggers: "Vercel guidelines", "web interface guidelines", "review UI compliance", "thirdparty-web-interface-guidelines"
What it does: Reviews UI code against Vercel Web Interface Guidelines — accessibility, focus, forms, animation, performance, navigation, copy. Terse file:line output.
Upstream: vercel-labs/web-interface-guidelines · vercel.com/design/guidelines
Related: audit-accessibility, audit-uiux-design-system, thirdparty-emil-design-eng
Slash command: /thirdparty-web-interface-guidelines <file> — installed by ./install.sh to ~/.cursor/commands/.
Cursor-Specific Skills (12)
These extend Cursor itself — stored in ~/.cursor/skills-cursor/.
| Skill | What it does |
|---|---|
babysit | Keep a PR merge-ready — triage comments, resolve conflicts, fix CI in a loop |
canvas | Live React canvas beside chat — rich data visualizations, interactive tools |
create-hook | Create Cursor hooks — scripts/prompts for before/after agent events |
create-rule | Create .cursor/rules/ files for persistent AI guidance |
create-skill | Create new Agent Skills in ~/.cursor/skills/ |
create-subagent | Create custom subagents in .cursor/agents/ |
migrate-to-skills | Convert rules/commands to Skills format |
shell | Direct shell execution without interpretation |
split-to-prs | Slice one pile of work into small reviewable PRs — safe snapshot, no destructive git ops |
statusline | Configure CLI status line — model, context, git info |
update-cli-config | Modify CLI settings — permissions, sandbox, vim mode |
update-cursor-settings | Modify Cursor/VSCode settings.json |