Development skills

Extend dev-software-engineer with .NET/C# backend specialization for Clean Architecture, CQRS, EF Core, and production-ready API practices. Use when tasks involve ASP.NET endpoints, handlers, services, dependency injection, MediatR, migrations, or backend performance/resilience and should follow the base implementation workflow.

The English summary is being prepared. Showing the original description.

Perform repository-aware code reviews focused on bugs, regressions, architectural violations, missing tests, and operational risks. Use when the user asks for review of diffs, pull requests, patches, or implementation quality.

The English summary is being prepared. Showing the original description.

Sync shared repo assets into local ~/.github, ~/.codex, and ~/.claude, and apply MCP settings from the shared canonical runtime catalog. Use when runtime assets are stale or after onboarding a new machine.

The English summary is being prepared. Showing the original description.

Git commit, branch, and pull request conventions for create-vue-dsfr. Use before creating commits, branches, issues, or PRs. This skill has priority over other project skills for commit and PR work.

The English summary is being prepared. Showing the original description.

Code implementation, refactoring, and bugfixes for create-vue-dsfr. Use for implementing features, refactoring code, or fixing bugs. Read the shared project skill before acting.

The English summary is being prepared. Showing the original description.

Code implementation, refactoring, and bugfixes. USE FOR: implementing features; refactoring code; fixing bugs; modifying existing code. DO NOT USE FOR: writing tests (separate skill); documentation (separate skill); commit conventions (separate skill).

The English summary is being prepared. Showing the original description.

Use when reading or changing example.com content, settings, products or pricing through the MCP API at /api/mcp — the 27 JSON-RPC tools, how to authenticate, which changes need a redeploy and which are live immediately, and the commercial scope rule that the product tools enforce.

The English summary is being prepared. Showing the original description.

Use when writing or applying a migration in site-os, adding a table or column, storing files, or when a migration fails with "must be owner of table" — covers the apply procedure, the postgres-ownership rule, money/rate units, and where files belong.

The English summary is being prepared. Showing the original description.

Safe git revert. Roll back phase or plan commits using the phase manifest with dependency checks.

The English summary is being prepared. Showing the original description.

Rapid codebase assessment — lightweight alternative to $gsd-map-codebase

The English summary is being prepared. Showing the original description.

Review source files changed during a phase for bugs, security issues, and code quality problems

The English summary is being prepared. Showing the original description.

Systematic debugging with persistent state across context resets

The English summary is being prepared. Showing the original description.

Query, inspect, or refresh codebase intelligence files in .planning/intel/

The English summary is being prepared. Showing the original description.

Create a clean PR branch by filtering out .planning/ commits — ready for code review

The English summary is being prepared. Showing the original description.

Analyze codebase with parallel mapper agents to produce .planning/codebase/ documents

The English summary is being prepared. Showing the original description.

Auto-fix issues found by code review in REVIEW.md. Spawns fixer agent, commits each fix atomically, produces REVIEW-FIX.md summary.

The English summary is being prepared. Showing the original description.

Discover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis, code scanning, and API discovery platforms.

The English summary is being prepared. Showing the original description.

Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.

The English summary is being prepared. Showing the original description.

Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.

The English summary is being prepared. Showing the original description.

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

The English summary is being prepared. Showing the original description.

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

The English summary is being prepared. Showing the original description.

Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.

The English summary is being prepared. Showing the original description.

Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token

The English summary is being prepared. Showing the original description.

Configure microsegmentation policies to enforce least-privilege workload-to-workload access using tools like VMware NSX, Illumio, and Calico, preventing lateral movement in zero trust architectures.

The English summary is being prepared. Showing the original description.