Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not display but the API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving API data leakage testing, excessive data exposure, response filtering bypass, or API over-fetching.

Builds comprehensive identity governance and lifecycle management processes including joiner-mover-leaver automation, role mining, access request workflows, periodic recertification, and orphaned account remediation using IGA platforms. Activates for requests involving identity lifecycle management, JML processes, role-based access provisioning, or identity governance program design.

Designs and documents structured incident response playbooks that define step-by-step procedures for specific incident types aligned with NIST SP 800-61r3 and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation criteria, RACI matrices, and integration with SOAR platforms. Activates for requests involving IR playbook creation, incident response procedure documentation, response runbook development, or SOAR playbook design.

Design and implement network segmentation using firewall security zones, VLANs, ACLs, and microsegmentation policies to restrict lateral movement and enforce least-privilege network access.

Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.

Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.

# TUI Builder - Senior Terminal UI Designer & Developer

Design and implement authentication and authorization systems. Use when setting up user login, JWT tokens, OAuth, session management, or role-based access control. Handles password security, token management, SSO integration.

Build scalable design systems with Tailwind CSS v4, design tokens, component libraries, and responsive patterns. Use when creating component libraries, implementing design systems, or standardizing UI patterns.

Design and configure Looker Studio dashboards with BigQuery data sources. Use when creating analytics dashboards, connecting BigQuery to visualization tools, or optimizing data pipeline performance. Handles BigQuery connections, custom SQL queries, scheduled queries, dashboard design, and performance optimization.

Use when the user wants to design a mobile app, create screens, build UI, or interact with their Sleek projects. Covers high-level requests ("design an app that does X") and specific ones ("list my projects", "create a new project", "screenshot that screen").

Expert guide for building command-line interfaces with Node.js (Commander, Inquirer, Ora) or Python (Click, Typer, Rich). Use when creating CLI tools, terminal UX, argument parsing, or interactive prompts.

Design and implement comprehensive evaluation systems for AI agents. Use when building evals for coding agents, conversational agents, research agents, or computer-use agents. Covers grader types, benchmarks, 8-step roadmap, and production integration.

Build reusable, maintainable UI components following modern design patterns. Use when creating component libraries, implementing design systems, or building scalable frontend architectures. Handles React patterns, composition, prop design, TypeScript, and component best practices.

Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.

Simplify and refactor code while preserving behavior, improving clarity, and reducing complexity. Use when simplifying complex code, removing duplication, or applying design patterns. Handles Extract Method, DRY principle, SOLID principles, behavior validation, and refactoring patterns.

Render videos from React/Remotion component code via inference.sh. Pass TSX code, get MP4. Supports all Remotion APIs: useCurrentFrame, useVideoConfig, spring, interpolate, AbsoluteFill, Sequence. Configurable resolution, FPS, duration, codec. Use for: programmatic video generation, animated graphics, motion design, data-driven videos, React animations to video. Triggers: remotion, render video from code, tsx to video, react video, programmatic video, remotion render, code to video, animated video, motion graphics code, react animation video

Build responsive, mobile-first layouts using fluid containers, flexible units, media queries, and touch-friendly design that works across all screen sizes. Use this skill when creating or modifying UI layouts, responsive grids, breakpoint styles, mobile navigation, or any interface that needs to adapt to different screen sizes. Apply when working with responsive CSS, media queries, viewport settings, flexbox/grid layouts, mobile-first styling, breakpoint definitions (mobile, tablet, desktop), touch target sizing, relative units (rem, em, %), image optimization for different screens, or testing layouts across multiple devices. Use for any task involving multi-device support, responsive design patterns, or adaptive layouts.

Write clear, comprehensive technical documentation. Use when creating specs, architecture docs, runbooks, or API documentation. Handles technical specifications, system design docs, operational guides, and developer documentation with industry best practices.

Expert guide for building beautiful, responsive UI with React, Tailwind CSS, Shadcn/ui, and modern design patterns. Use when creating components, layouts, animations, or styling.

Generate AI images with FLUX, Gemini, Grok, Seedream, Reve and 50+ models via inference.sh CLI. Models: FLUX Dev LoRA, FLUX.2 Klein LoRA, Gemini 3 Pro Image, Grok Imagine, Seedream 4.5, Reve, ImagineArt. Capabilities: text-to-image, image-to-image, inpainting, LoRA, image editing, upscaling, text rendering. Use for: AI art, product mockups, concept art, social media graphics, marketing visuals, illustrations. Triggers: flux, image generation, ai image, text to image, stable diffusion, generate image, ai art, midjourney alternative, dall-e alternative, text2img, t2i, image generator, ai picture, create image with ai, generative ai, ai illustration, grok image, gemini image

Create responsive web designs that work across all devices and screen sizes. Use when building mobile-first layouts, implementing breakpoints, or optimizing for different viewports. Handles CSS Grid, Flexbox, media queries, viewport units, and responsive images.

Complete guide for building beautiful apps with Expo Router. Covers fundamentals, styling, components, navigation, animations, patterns, and native tabs.

Teaches agents to iteratively build websites using Stitch with an autonomous baton-passing loop pattern

Design RESTful and GraphQL APIs following best practices. Use when creating new APIs, refactoring existing endpoints, or documenting API specifications. Handles OpenAPI, REST, GraphQL, versioning.

Analyze Stitch projects and synthesize a semantic design system into DESIGN.md files

Transforms vague UI ideas into polished, Stitch-optimized prompts. Enhances specificity, adds UI/UX keywords, injects design system context, and structures output for better generation results.

Android root: SDK, activity/fragment lifecycle, permissions model, Material Design, Play Store

Database schema design patterns for SQL and NoSQL databases

RESTful API design patterns, error handling, and documentation

Designs interactive AR/VR experiences using 3D modeling, spatial computing, and user interface optimization.

Root SE architecture: system design, ADRs, trade-off analysis, tech stack selection

API architecture: REST design, versioning, HATEOAS, auth patterns, OpenAPI docs, gateway patterns

DB architecture: relational vs document vs graph vs vector, schema design, indexing, replication, sharding

Design patterns: GoF 23 patterns, SOLID, DRY/YAGNI/KISS, composition vs inheritance, functional

Design and implement data lakehouse architectures for scalable big data storage and analytics.

Design and implement ETL pipelines for extracting, transforming, and loading data in data engineering workflows.

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.

UIKit: UIViewController, UITableView/CollectionView, Auto Layout, programmatic UI, UIHostingController bridge

Root mobile: native vs cross-platform decisions, app store guidelines, mobile UX principles

Tailwind CSS v4 patterns, component styling, and responsive design

React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.

Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components - not for simple single-file HTML/JSX artifacts.

WebAssembly: Rust/Go/C to WASM, wasm-bindgen, Emscripten, WASM Component Model

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

Root A/B testing: experiment design, statistical significance, sample size power analysis, launch criteria

Hypothesis formation, null/alternative, control/variant setup, randomization hash-based, stratification

Screen capture, AI vision analysis, and GUI automation for macOS. Use when you need to see what's on screen, analyze UI state, detect changes, or automate mouse/keyboard actions.

REST + GraphQL + tRPC API design: OpenAPI 3.1, auth JWT/OAuth2, rate limiting, pagination

Tailwind CSS 4: utility classes, config, JIT, arbitrary values, darkMode, plugins, shadcn/ui

Converts Stitch designs into modular Vite and React components using system-level networking and AST-based validation.

Create comprehensive, phased implementation plans with sprints and atomic tasks. Use when user says: "make a plan", "create a plan", "plan this out", "plan the implementation", "help me plan", "design a plan", "draft a plan", "write a plan", "outline the steps", "break this down into tasks", "what's the plan for", or any similar planning request. Also triggers on explicit "/planner" or "/plan" commands.

Modern React component patterns with hooks, composition, and TypeScript

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

macOS UI capture: screenshot, accessibility tree inspection, window listing, UI automation targeting

Invoke before any creative or architectural work — feature design, component creation, or behavioral changes. A streamlined brainstorming process optimized for fast, focused decision-making.

Build and run Gemini 2.5 Computer Use browser-control agents with Playwright. Use when a user wants to automate web browser tasks via the Gemini Computer Use model, needs an agent loop (screenshot → function_call → action → function_response), or asks to integrate safety confirmation for risky UI actions.

Creates Model Context Protocol (MCP) servers enabling LLMs to interact with external services through well-designed tools, resources, and prompts. Use when asked to "build an MCP server", "create MCP integration", "implement MCP tools", "connect to external API via MCP", or "develop MCP SDK server". Guides through research, design, implementation, and testing phases for Python (FastMCP) or TypeScript (MCP SDK) servers. Covers tool naming, schema design, error handling, testing, and workflow optimization. Works with MCP protocol, FastMCP framework, and MCP TypeScript SDK.

Creates visual design philosophies and expresses them as static art in PNG and PDF formats using composition, color theory, typography, and graphic design principles. Use when asked to "create a poster", "design artwork", "make a visual design", "create static art", or "design a graphic piece". Develops aesthetic movements through form, space, color, and minimal text as visual accents. Works with PDF and PNG output files plus markdown design manifestos. Produces original visual designs using design philosophy methodology rather than copying existing artists.

Captures screenshots at multiple viewport breakpoints for responsive design validation and documentation. Use when you need to test responsive layouts, validate mobile/tablet/desktop views, document design system breakpoints, or create visual regression test baselines. Triggers on "test responsive design", "screenshot at breakpoints", "capture mobile and desktop views", "responsive design testing", or "multi-device screenshots". Works with Playwright MCP tools (browser_navigate, browser_resize, browser_take_screenshot).

Builds elaborate multi-component claude.ai HTML artifacts using React 18, TypeScript, Vite, Tailwind CSS, and shadcn/ui bundled into single-file deliverables. Use when asked to "create complex artifact", "build React artifact with routing", "use shadcn/ui components", "create stateful web app artifact", or "build multi-component frontend". Provides initialization scripts, development workflow, and Parcel bundling to create sophisticated single-HTML artifacts with state management and modern components. Works with React/TypeScript stack for claude.ai artifacts requiring complexity beyond simple HTML/JSX.

This skill should be used when the user asks to "create a plugin", "scaffold a plugin", "understand plugin structure", "organize plugin components", "set up plugin.json", "use ${CLAUDE_PLUGIN_ROOT}", "add commands/agents/skills/hooks", "configure auto-discovery", or needs guidance on plugin directory layout, manifest configuration, component organization, file naming conventions, or Claude Code plugin architecture best practices.

Provides Svelte 5 runes guidance for reactive state, props, derived values, effects, and attachments. Use when implementing reactivity, managing component props, computing derived state, handling side effects, or migrating from Svelte 4. Triggers on "reactive state", "component props", "computed value", "$state", "$derived", "$effect", "$props", or "Svelte 5 migration". Works with .svelte files using $state, $derived, $effect, $props, $bindable runes and prevents common reactivity mistakes and Svelte 4/5 syntax mixing.

Optimizes ClickHouse queries for speed and efficiency. Helps with primary key design, sparse indexes, data skipping indexes (minmax, set, bloom filter, ngrambf_v1), partitioning strategies, projections, PREWHERE optimization, approximate functions, and query profiling with EXPLAIN. Use when writing ClickHouse queries, designing table schemas, analyzing slow queries, or implementing analytical aggregations. Works with columnar OLAP workloads.

Provides Comprehensive guide to the Svelte 5 Showcase component library with 49 production-ready components organized into 7 categories. Use when you need to discover available components, understand component usage patterns, integrate components into new projects, or reference best practices for Svelte 5 development. Triggers on "what components are available", "how to use [component name]", "integrate showcase components", "copy component from showcase", "Svelte 5 component examples", or "showcase component library". Works with shadcn-svelte, Bits UI, TailwindCSS v4, sveltekit-superforms, and Svelte 5 runes.

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

Design and manage Kafka message schemas with type safety and schema evolution. Use when defining event schemas, creating schema validators, managing versions, and generating type-safe Pydantic/msgspec models from schema definitions. Supports schema registry patterns and backward/forward compatibility.

Creates animated GIFs optimized for Slack with proper dimensions (128x128 emoji, 480x480 message), FPS control, color optimization, and file size constraints. Use when asked to "make a GIF for Slack", "create an animated emoji", "design a Slack GIF", or "animate this for Slack". Provides GIFBuilder utilities, frame management, color palette reduction, and validation tools ensuring GIFs meet Slack requirements. Works with Python Pillow (PIL) for frame generation, color quantization, and GIF export with FPS 10-30 and duration under 3 seconds for emoji.

Extracts reusable Svelte components from existing code to improve modularity and reduce duplication. Use when refactoring large Svelte files, creating shared UI components, or improving code reusability. Triggers on "extract component", "refactor Svelte file", "create reusable component", "too much code in one file", or "split up component". Works with .svelte files using Svelte 5 runes ($state, $props, $derived), proper prop interfaces, and component file organization patterns.

TODO: Complete and informative explanation of what the skill does and when to use it. Include WHEN to use this skill - specific scenarios, file types, or tasks that trigger it.

Evaluates and prevents unnecessary abstractions by analyzing interfaces, layers, and patterns against concrete requirements. Use when evaluating new abstractions, reviewing architecture proposals, detecting over-engineering, or simplifying existing code. Triggers on "is this abstraction necessary", "too many layers", "simplify architecture", "reduce complexity", "over-engineered", "do we need this interface", or when reviewing design patterns.

SvelteKit structure guidance. Use for routing, layouts, error handling, SSR, or svelte:boundary. Covers file naming, nested layouts, error boundaries, pending UI, and hydration.

Refactors legacy Java code to modern patterns and best practices. Use when modernizing old Java code, converting to Java 8+ features, refactoring legacy applications, applying design patterns, improving error handling, extracting methods/classes, converting to streams/Optional/records, or migrating from old Java versions. Works with pre-Java 8 code, procedural Java, legacy frameworks, and outdated patterns.

Builds browser-based 2D layout editors with FastAPI backend and vanilla JS + SVG frontend. Use when creating: (1) Visual editors for 2D arrangements (cut lists, floor plans, diagrams), (2) Drag-and-drop interfaces with multiple containers/sheets, (3) Single-file browser UIs served from Python, (4) Real-time position editing with validation. Triggers: "layout editor", "drag between", "visual editor", "browser UI for editing", "SVG editor".

Designs and implements state transition analysis systems for tracking time spent in different states. Use when analyzing workflows with state changes (Jira, GitHub PRs, deployments, support tickets, etc.). Covers state machine fundamentals, temporal calculations, bottleneck detection, and business metrics. Trigger keywords: "state analysis", "duration tracking", "workflow metrics", "bottleneck", "cycle time", "state transitions", "time in status", "how long", "state duration", "workflow performance", "state machine", "changelog analysis", "SLA tracking", "process metrics".

Style and layout Textual widgets using CSS-like syntax for responsive design. Use when implementing responsive layouts, CSS styling, color schemes, spacing, sizing, alignment, grid layouts, flexbox-like containers, and theme customization. Covers Textual's CSS pseudo-language and theming system.

Guides users through structured three-stage collaborative documentation workflow including context gathering, iterative refinement, and reader testing. Use when asked to "write a doc", "draft a proposal", "create a spec", "write technical documentation", "create a PRD", or "draft an RFC". Implements systematic approach for PRDs, design docs, decision docs, technical specs, and proposals through clarifying questions, section-by-section iteration, and fresh-eye validation. Works with markdown documentation, technical specifications, and structured writing projects.

Analyzes Java code against industry best practices and evaluates design principles including SOLID, exception handling, thread safety, and resource management. Reviews naming conventions, Stream API usage, Optional patterns, and general code quality. Use when reviewing Java files, checking code quality, evaluating exception handling, or auditing resource management.

Svelte component patterns. Use for web components, component libraries (Bits UI, Ark UI, Melt UI), form patterns, or third-party integration.

Designs and builds reusable Terraform modules. Use when creating reusable infrastructure patterns, encapsulating complex resource groups, standardizing configurations across projects, or organizing code for maintainability. Covers module structure, versioning, composition, and best practices for production modules.

Enforces the discipline of thinking about tests, features, and maintainability BEFORE writing implementation code. Use when starting new classes/methods, refactoring existing code, or when asked to "think about tests first", "design for testability", "what tests do I need", "test-first approach", or "TDD thinking". Promotes simple, maintainable designs by considering testability upfront. Works with any codebase requiring test coverage and quality standards.

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.

Adds production-safe Motion for React or Framer Motion animations to Next.js apps, including reveal, hover and tap micro-interactions, whileInView, stagger, AnimatePresence, layout and layoutId transitions, reorder, scroll-linked UI, and lightweight route-content transitions. Use when the user asks to add, refactor, or debug Motion or Framer Motion in App Router or Pages Router codebases, especially around server/client boundaries, reduced motion, LazyMotion, bundle size, hydration, or route transitions. Avoid for GSAP-style timelines, WebGL or 3D scenes, heavy scroll storytelling, or CSS-only effects unless Motion is explicitly requested.

Use this skill when the user needs to design, critique, redesign, audit, generate, code, or explain quantitative graphics: charts, dashboards, tables, maps, scientific/statistical figures, visual evidence, or chart specifications. It helps choose display forms, avoid misleading encodings, compute lie factors, inspect CSV structure, generate simple SVG charts, check color contrast, and produce Tufte-informed but non-formulaic recommendations. Do not use for decorative illustration or general data cleaning unless a quantitative display is involved.

User-triggered analysis of how a system gets deployed and recovered — across local (Docker Compose) and cloud (Kubernetes / Eve) release surfaces. Produces mermaid diagrams plus cited reports for promotion paths, environment topology, configuration provenance, and recovery procedures under docs/release/<date>/. Layers on top of architectural-analysis: when a recent docs/architecture/<date>/ report exists, this skill ingests its control-flow, integrations, and failure-modes findings rather than re-deriving them. When verifying cloud-side claims, prefers eve-mcp tools (ShowEnvironments, GetManifest, ShowChannels, ShowDeploymentCrons) over reading manifest YAML by hand. Trigger on "map our release," "trace the promotion path," "where does this config come from," "what's the rollback story," "diagram the environments," "show how a version reaches prod," or any release-shaped question whose deliverable is a diagram plus a cited report. Not for new architectural snapshots (use architectural-analysis), CI pipeline correctness review (use code review), or designing a release process from scratch (use system-design).

Build, refactor, debug, test, and package Python terminal user interfaces with Textual. Use when the user wants a TUI, terminal dashboard, admin console, multi-screen workflow, keyboard-first tool, data explorer, file browser, markdown or log viewer, editor, command palette, browser-served console app, or a migration from curses/Rich-only UI to Textual—even if they never say “Textual”. Covers TCSS and themes, built-in widgets, screens and modes, reactive state, workers, browser delivery APIs, and pytest Pilot or snapshot testing.

Full-power feature implementation using parallel subagents for backend, frontend, testing, and security. Coordinates architecture design, code generation, test coverage, and quality verification in a single workflow with worktree isolation. Chains with /ork:cover for test generation and /ork:verify for validation. Use when implementing features, building new capabilities, or creating full-stack functionality.

Guides a founder through the full Y Combinator batch application end-to-end. A 10-phase workflow that captures the live YC form, profiles the founders, stress-tests the idea via an embedded grill loop, runs a mandatory 5-agent parallel external research pass on the startup, drafts every form field with anti-pattern and accepted-example checks, produces founder-video bullet notes (no script), runs a final adversarial gate, generates paste-ready submission answers, unlocks an interview-prep simulator after invite, and supports reapplicant delta tracking and post-decision post-mortems. Writes a documented markdown trail under a user-chosen workspace. Use when a founder wants to prepare a YC batch application, build their founder video, drill mock YC interview questions, or reapply with delta evidence. Don't use for pitch-deck design unrelated to YC, generic startup advice without applying, or post-funding work.

API design patterns for REST/GraphQL framework design, versioning strategies, and RFC 9457 error handling. Use when designing API endpoints, choosing versioning schemes, implementing Problem Details errors, or building OpenAPI specifications.

AI-powered image generation for Salesforce visuals via Nano Banana Pro. Use this skill when the user needs rendered PNG/SVG output such as visual ERDs (Entity Relationship Diagrams), UI mockups, wireframes, or architecture illustrations. TRIGGER when: user asks for PNG/SVG output, UI mockups, wireframes, visual ERDs, or says "generate image" / "create mockup". DO NOT TRIGGER when: text-based Mermaid diagrams (use generating-mermaid-diagrams), or non-visual documentation tasks.

Multi-angle codebase exploration spawning 3-5 parallel agents for code structure, data flow, architecture patterns, and health assessment. Generates ASCII visualizations, import graphs, and design pattern detection with cross-session memory storage. Use when exploring a repo, discovering architecture, onboarding to a new codebase, or analyzing design patterns.

Build slide decks and presentations for research talks. Use this for making PowerPoint slides, conference presentations, seminar talks, research presentations, thesis defense slides, or any scientific talk. Provides slide structure, design templates, timing guidance, and visual validation. Works with PowerPoint and LaTeX Beamer.

Alibaba Cloud EMR Serverless StarRocks development & operations assistant. Covers five scenarios: cluster connection, schema design, data ingestion, SQL development & tuning, and cluster health diagnostics. Use this Skill when users ask about StarRocks table design, writing SQL, choosing an ingestion method, query execution plans, materialized views, cluster health checks, FE/BE/CN node status, tablet health, or compaction. Typical scenarios: table design, Stream Load / Routine Load / Broker Load selection, SQL optimization, window functions, CTEs, JOIN tuning, materialized view design, cluster health inspection, node-down diagnosis. Not applicable for: StarRocks instance lifecycle management (create / scale / restart / config change / version upgrade — these are control-plane operations, please use the EMR Serverless console or the corresponding OpenAPI), or other Alibaba Cloud products (EMR Cluster, Spark, Milvus, ClickHouse, Doris, RDS, ECS).

Builds AI chat interfaces and conversational UI with streaming responses, context management, and multi-modal support. Use when creating ChatGPT-style interfaces, AI assistants, code copilots, or conversational agents. Handles streaming text, token limits, regeneration, feedback loops, tool usage visualization, and AI-specific error patterns. Provides battle-tested components from leading AI products with accessibility and performance built in.

Project-focused specification and task management system. Run /speckit.init to install 8 project-local commands: /plan, /tasks, /design, /analyze, /clarify, /implement, /revert, /lint. Each command MUST be invoked separately and requires user approval before proceeding. NEVER chain commands automatically - each produces output that requires user review. Use /plan when user wants to create plans from specs. Use /tasks only AFTER user has approved plans. Git checkpoints enable safe revert.