Browse skills

Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).

The English summary is being prepared. Showing the original description.

Scan and redact PII and sensitive data (emails, phone numbers, SSNs, API keys, IP addresses, credentials, amounts, company/person names) from repository files. Includes a pre-commit hook to block commits containing PII. Use when asked to audit code for sensitive data, sanitize files before publishing, or install PII detection hooks. For application security hardening see security-engineering.

The English summary is being prepared. Showing the original description.

AI-powered SEO operations: keyword intelligence, competitor gap analysis, Google Search Console optimization, and trend detection. Use when asked to research keywords, analyze competitor content gaps, audit GSC performance, or detect trending topics. For growth experiments see growth-engine; for content optimization see autoresearch.

The English summary is being prepared. Showing the original description.

Maintain SESSION-STATE.md, the durable within-session memory that survives context compaction. Use when a constraint, settled decision, existing-infrastructure (survey) finding, or open thread must persist across a long session so it is not re-derived or re-litigated. Triggers on /state, "remember this for the session", "record this constraint/decision", or after surveying what already exists. For cross-session/personal memory use .claude/memory/ on Claude or native memories on Codex; for repo-derivable facts, do not record at all.

The English summary is being prepared. Showing the original description.

Use when reviewing or auditing a library of Claude Code skills, agents, slash commands, and workflows — frontmatter correctness, routing quality, tool allowlists, command arg-hints, workflow meta/phase coherence, cross-reference coherence, single-responsibility, file structure, and anti-pattern detection. Triggers on mentions of "review skills", "audit agents", "skill library", "agent definition review", "review this command", "review this workflow", "is this skill right", or when iterating on `.claude/skills/`, `.claude/agents/`, `.claude/commands/`, or `.claude/workflows/` directories. For code review of source code see code-review-and-quality.

The English summary is being prepared. Showing the original description.

Internal utility for the skills library itself — opt-in, local-first, privacy-respecting usage telemetry and update checks. Provides version checking, usage logging, and usage reporting for the skills in this repo. Use only when asked to view skill usage stats, configure telemetry opt-in/out, wire a skill to log its own runs, or check for skill updates.

The English summary is being prepared. Showing the original description.

Use when implementing analytics with PostHog in a TypeScript app — capturing events, identifying users, adding feature flags, tracking errors, or wiring API lifecycle telemetry. Triggers on edits to analytics integration files, or mentions of "PostHog", "analytics", "feature flag", "event tracking", "capture", "identify", "A/B test", or "experiment".

The English summary is being prepared. Showing the original description.

Use when building data pipelines, ETL jobs, event processors, message-broker producers/consumers, application caching layers, database migrations, BigQuery queries, or event-sourcing handlers in TypeScript. Triggers on edits to indexer/ETL/migration code, Prisma or Drizzle schemas, BigQuery integration code, RabbitMQ/Kafka/SQS/BullMQ producer or consumer code, Redis cache wrappers, or mentions of "data engineering", "ETL", "pipeline", "indexer", "event sourcing", "data warehouse", "data migration", "message queue", "RabbitMQ", "Kafka", "SQS", "BullMQ", "Redis cache", or "caching".

The English summary is being prepared. Showing the original description.

Use when writing or reviewing TypeScript backend tests — Jest unit tests for services/controllers (mocked Prisma) or Supertest integration tests against a real isolated PostgreSQL test database. Triggers on edits to `*.service.test.ts`, `*.controller.test.ts`, `*.integration.test.ts`, service/controller/API test files (`.ts`, not `.tsx`) under `**/__tests__/`, or mentions of "backend test", "service test", "API test", "database test".

The English summary is being prepared. Showing the original description.

Use when writing, reviewing, or deploying Solidity smart contracts — token contracts, signature-gated claim systems, merkle-gated staking vaults, allocation modules, role-based proxies, or factory patterns. Triggers on edits to `*.sol` files, `hardhat.config.*`, `foundry.toml`, deploy scripts, or mentions of "smart contract", "Solidity", "Web3", "EVM", "Hardhat", "Foundry", "ERC20/721/1155", "merkle", "staking", or "on-chain". For security audits and adversarial review see security-engineering.

The English summary is being prepared. Showing the original description.

Tests in real browsers. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data via Chrome DevTools MCP.

The English summary is being prepared. Showing the original description.

Auto-assembles a domain-specific expert panel (7–10 experts), scores any content or strategy artifact against a typed rubric, and iterates until the aggregate hits 90+ (max 3 rounds). Use as a quality gate on copy, email sequences, landing-page drafts, strategy docs, charts, titles, or recruiting evaluations — or when another skill needs a final review gate on its output. Triggers on "expert panel this", "score this", "rate these variants", "quality check this", "panel review", "expert score", "evaluate this copy/strategy/page". For variant generation and multi-round conversion optimization see autoresearch; for live-URL CRO auditing see conversion-ops; for the scripted content-production pipeline see content-pipeline.

The English summary is being prepared. Showing the original description.

Non-interactive content-production toolkit: mine quotable moments from podcast RSS feeds and meeting notes, discover clip-worthy moments in video transcripts, repurpose long-form source into platform-native drafts (X, LinkedIn, YouTube Shorts, newsletter), and batch-score/gate those drafts before publish. Use when asked to "mine quotes from this podcast", "find clips in this video", "repurpose this into a thread / LinkedIn post / Short", "turn this transcript into posts", "extract viral moments", or "gate this batch of drafts". Runs Python scripts end to end. For interactive expert-panel scoring of a single artifact see content-ops.

The English summary is being prepared. Showing the original description.

Use when tuning the numbers in a game — economy curves, progression rates, difficulty pacing, drop tables, win/loss odds, time-to-X targets, and currency velocities. Triggers on "balance pass", "tune the economy", "progression curve", "difficulty curve", "drop rate", "XP curve", "TTK", "time-to-content", "balance the economy", "spreadsheet model", "economy sim", or a system spec from game-systems-designer with `TBD` placeholders. Produces an economy spreadsheet, balance pass plan, sim outputs, and per-system balance tables. Stops at the numbers — does not change system rules or pricing. For systems design see game-systems-designer; for store catalog see iap-manager.

The English summary is being prepared. Showing the original description.