200 skills · sorted by relevance
Use when the user wants to use Google Gemini for analysis, large files or codebases, sandbox execution, or brainstorming. Uses headless Gemini CLI scripts (no MCP). Triggers on "use Gemini", "analyze with Gemini", "large file", "sandbox", "brainstorm with Gemini".
The English summary is being prepared. Showing the original description.
Validate Python code quality with formatting, type checking, linting, and security analysis. Use for Python codebases to ensure PEP 8 compliance, type safety, and code quality.
The English summary is being prepared. Showing the original description.
Validate Rust code quality with rustfmt, clippy, cargo check, and security analysis. Use for Rust codebases to ensure idiomatic Rust code and best practices.
The English summary is being prepared. Showing the original description.
Validate TypeScript/JavaScript code quality with ESLint, Prettier, type checking, and security analysis. Use for TypeScript/JS codebases to ensure code quality and standards.
The English summary is being prepared. Showing the original description.
White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.
The English summary is being prepared. Showing the original description.
Full ASVS 5.0 compliance assessment against a codebase and/or architecture diagrams. Reads all 346 controls from the companion CSV, performs targeted code analysis per control, and produces a complete matrix marked COMPLIANT / NON_COMPLIANT / NOT_RELEVANT — with per-control reasoning and evidence (code snippets, file:line references, diagram observations). Outputs a reviewed CSV matrix and a self-contained HTML evidence report.
The English summary is being prepared. Showing the original description.
Synthesize project documentation and codebase into comprehensive roadmap status, gaps analysis, and blockers. Use when assessing project health, identifying blockers, tracking progress, comparing plan vs reality, documenting risks, or planning next milestones. Triggers: "roadmap", "project status", "blockers", "risks", "progress", "next milestone", "gaps", "what's done".
The English summary is being prepared. Showing the original description.
Verify code-review or security-review findings for false positives using deep codebase tracing, framework-aware analysis, and web research. Produces a .verified.md report alongside the original. Use when a review report has been generated and needs independent verification, or when user runs /verify-findings, mentions "verify review", "check false positives", or "validate findings".
The English summary is being prepared. Showing the original description.
Audit a codebase for product-market fit readiness -- evaluate startup PMF signals, core value loop tightness, feature scatter vs focus ratio, user activation funnel friction, retention hook infrastructure, pricing flexibility, analytics event coverage, CI/CD iteration speed, and growth-stage maturity for pre-seed through Series A products.
The English summary is being prepared. Showing the original description.
Analyzes infrastructure costs at 1K-100K user scales by reading the actual codebase, auto-detecting cloud providers, modeling per-action costs, and projecting total monthly spend with optimization recommendations.
The English summary is being prepared. Showing the original description.
Strategic planning consultant that produces decision-complete work plans through Socratic interview, codebase exploration, Metis gap analysis, and optional Momus high-accuracy review. MUST USE when the task has 5+ steps, scope is ambiguous, multiple modules are involved, or the user asks for a plan. Triggers: plan this, create a work plan, interview me, start planning, prometheustic, plan mode, help me plan this, break this down.
The English summary is being prepared. Showing the original description.
Architectural review workflow. Analyzes codebase organization via noun analysis and produces a target blueprint. Advisory only — does not implement changes. Always offers to cut tickets for the planned work; orchestrators receive the proposal and apply their own autonomy judgment to approve / edit / decline.
The English summary is being prepared. Showing the original description.
Proactive bug-hunting workflow. Assesses codebase risk through complexity, coverage, and structural analysis, then spawns focused investigators that write reproducing tests to validate suspected bugs. Thoroughness over speed. Advisory only — produces findings and proposes tickets; does not implement fixes.
The English summary is being prepared. Showing the original description.
Generate initial docs/ from codebase analysis when a project has none. Triggers on 'init docs', 'create/generate documentation'. NOT for updating existing docs (mk:document-release).
The English summary is being prepared. Showing the original description.
Creates structured multi-file implementation plans before build. Scope-aware: trivial tasks exit early, simple tasks get fast plans, complex tasks get full research + phase files + validation. Enforces Gate 1. Activated by /mk:plan or /mk:cook. NOT for ticket complexity analysis against an existing codebase (see mk:planning-engine); NOT for CEO-level scope review of existing plans (see mk:plan-ceo-review).
The English summary is being prepared. Showing the original description.
Pack an EXTERNAL repository into a single AI-friendly file (markdown/xml/json). Use for third-party library analysis, security audits, or handoff to external LLMs. Do NOT use to pack the current project for inbound context — the host runtime already reads files lazily. Triggers: 'pack this repo', 'snapshot of X', 'export codebase', 'repomix'.
The English summary is being prepared. Showing the original description.
Use when packaging a codebase to a single AI-friendly file for LLM analysis — local or remote, XML/Markdown/JSON, token counting, gitignore filtering, peer-side `repomix` CLI.
The English summary is being prepared. Showing the original description.
Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.
The English summary is being prepared. Showing the original description.
Measure and audit C/C++ code size, namespace distribution, function complexity, nesting, recurrence, and namespace coupling in the EMULATORS framework. Use when Codex needs codebase statistics, complexity baselines, namespace comparisons, duplication indicators, hotspots, architectural growth analysis, or before/after complexity reports while excluding third-party code.
The English summary is being prepared. Showing the original description.
Master systematic debugging techniques, profiling tools, and root cause analysis to efficiently track down bugs across any codebase or technology stack. Use when investigating bugs, performance issues, or unexpected behavior.
The English summary is being prepared. Showing the original description.
Generate comprehensive C4 architecture documentation for an existing repository/codebase using a bottom-up analysis approach.
The English summary is being prepared. Showing the original description.
Generate comprehensive C4 architecture documentation for an existing repository/codebase using a bottom-up analysis approach.
The English summary is being prepared. Showing the original description.
Perform 12-Factor App compliance analysis on any codebase. Use when evaluating application architecture, auditing SaaS applications, or reviewing cloud-native applications against the original 12-Factor methodology.
The English summary is being prepared. Showing the original description.
Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).
The English summary is being prepared. Showing the original description.