Latest Agent Skills

Restrict file edits to a specific directory for the session. (gstack)

Post-deploy canary monitoring. (gstack)

Fast headless browser for QA testing and site dogfooding. (gstack)

Persistent per-project memory for Claude Code. Auto-loads project context on session start, tracks sessions with git activity, and writes to native memory. Commands run deterministic Node.js scripts — behavior is consistent across model versions.

Weekly engineering retrospective. (gstack)

Manage project learnings.

Full safety mode: destructive command warnings + directory-scoped edits. (gstack)

Provides three modes — code review, adversarial challenge, and consult — for obtaining a second opinion on code.

Turn vague intent into a precise, executable spec in five phases. (gstack)

Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. (gstack)

Chief Security Officer mode. (gstack)

Systematically QA test a web application and fix bugs found. (gstack)

Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

Research the open web for enhancement opportunities (Layer 3 — Opus subagent with WebSearch + WebFetch). Topic-driven. Returns structured findings with hype tags + source URLs. Does NOT auto-implement.

Run a WCAG 2.1 AA accessibility audit on a design or page. Trigger with "audit accessibility", "check a11y", "is this accessible?", or when reviewing a design for color contrast, keyboard navigation, touch target size, or screen reader behavior before handoff.

Run the quarter-boundary ritual — roll the quarter-scoped project folders, archive finished projects, grade the closing quarter's GOALS/OKRs, and draft the new quarter's goals behind an approval gate. Trigger on /quarter-rollover, "quarter rollover", "roll the quarter", "close out Q2", "new quarter setup", or when tools/quarter_path.py --check reports drift. Distinct from /triage-tasks (daily gate) and /audit (repo health check).

Create distinctive, production-grade frontend interfaces with high design quality. Use only when invoked by the `design` wrapper skill, OR when working outside a known site (no `~/Sites/<name>/` repo). Otherwise prefer `design`. Generates creative, polished code that avoids generic AI aesthetics.

Use when you have a written implementation plan to execute in a separate session with review checkpoints

Get structured design feedback on usability, hierarchy, and consistency. Trigger with "review this design", "critique this mockup", "what do you think of this screen?", or when sharing a Figma link or screenshot for feedback at any stage from exploration to final polish. If the user asks specifically about accessibility, use `accessibility-review` instead.

Use when creating new skills, editing existing skills, or verifying skills work before deployment

Use when you have a spec or requirements for a multi-step task, before touching code

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

Interactive triage of the approval gate. Walks each block in inbox/tasks_pending.md and routes it — approve / reject / attach-as-follow-up / edit / skip. See workflows/task_tracking.md for the why.

Two-layer site audit (Python mechanical + Opus conceptual) — code quality and structural health. For deep SEO/performance use `analytics`; for deep accessibility use `accessibility-review`.

Website analytics audit — tracking verification, SEO check, performance metrics, conversion path analysis

Apply a named refactoring pattern to a website codebase (extract templates, centralize analytics, DRY components)

Write or review UX copy — microcopy, error messages, empty states, CTAs. Trigger with "write copy for", "what should this button say?", "review this error message", or when naming a CTA, wording a confirmation dialog, filling an empty state, or writing onboarding text.

Design and build frontend components/pages — from Figma, reference URL, or description. Wraps the official `frontend-design` skill with site-awareness.

Deploy a site — local preview, pre-flight checks, or production push. Defaults to Hostinger git auto-deploy (push to main triggers Hostinger pull) with FTP fallback for non-Hostinger sites.

System Audit — entry point

Scaffold a new page from the site's template system (e.g., new course landing page)

Trigger: marketing copy, landing text, CTA labels, value proposition, copywriting copy, conversion copy. Scope: Persuasive copy generation, conversion-focused taglines. Boundary: Excludes technical specifications or backend engineering.

Trigger: TDD, test first, unit testing, integration tests, mock assertions, test-driven dev. Scope: Writing test assertions before coding features, testing paradigms. Boundary: Excludes UX aesthetics or continuous deployment settings.

Build and improve AI or probabilistic software through evaluation-driven development. Use for LLM applications, agents, prompts, RAG, tool use, classifiers, model migrations, quality regressions, golden datasets, LLM-as-judge rubrics, benchmarks, or requests to add evals and measurable release gates. Pair with TDD for deterministic code; do not use as the primary guide for ordinary unit testing without model behavior.

Trigger: sitemap, navigation, menu structure, wayfinding, labeling, search facets, routing links. Scope: Visual hierarchies, wayfinding, navigation model, sitemaps. Boundary: Excludes backend route handlers or page performance tuning.

Creates an outcome-backed product strategy memo from an Ideal Customer Profile markdown file, pasted ICP notes, discovery artifacts, product context, or PRD context. Use when asked to create product strategy, convert an UX Discovery and ICP into strategy, define vision-to-outcome strategy, turn discovery into strategic bets, clarify target customer outcomes, evaluate roadmap strategy, or avoid feature-factory planning.

Trigger: writing style, copy editing, simple copy, prose check, text clarity. Scope: Writing clear, direct, and concise English copy. Boundary: Excludes code formatting or marketing value propositions.

Trigger: circuit breaker, exponential backoff, jitter delay, connection timeout, API retry. Scope: Client request resiliency, API retries, fault isolation. Boundary: Excludes visual state loading skeletons.

Design and implement clear, modular, resilient software and create executor-grade implementation plans with explicit scope, drift checks, verification gates, tests, STOP conditions, dependencies, and delegated-work review. Use for development, refactoring, architecture, implementation planning, safe migrations, handoffs to another engineer or agent, or verifying delegated code changes.

Review pull requests or audit repositories for correctness, security, performance, test risk, architecture, dependencies, developer experience, documentation, and grounded product direction. Use for code review, repository audits, evidence-backed findings, false-positive vetting, risk assessment, prioritization, or deciding which improvements should become implementation plans.

Trigger: press release, PM memo, PRD memo, product launch narrative, launch story. Scope: Writing press releases and future launch stories for project alignment. Boundary: Excludes writing functional code or task tracking.

Trigger: clean architecture, hexagonal architecture, domain model, state machine, boundary decoupling. Scope: Software modular design, dependency boundaries, architectural layering. Boundary: Excludes frontend aesthetic styling.

Trigger: database schema, indexing, cache asidePattern, Redis caching, ORM models, Drizzle schema. Scope: Database query tuning, indexing, and data cache designs. Boundary: Excludes user identity validation.

Trigger: form inputs, wizards, checkout forms, multistep forms, validation UI, input focus. Scope: User-friendly forms design, input constraints, progressive disclosure. Boundary: Excludes backend database schemas or server-side API validation.

Trigger: tech stack, preferred tools, SvelteKit, Bun, Drizzle, Zero Sync, Better Auth, Vite. Scope: Project tooling preferences, framework selections. Boundary: Excludes application logic or visual styling guidelines.

Trigger: empty list state, loader skeleton, error boundary layout, offline indicator, system fallback UI. Scope: UI fallback layouts, skeleton placeholders, client recovery views. Boundary: Excludes server-side API error status coding.

Trigger: REST API, GraphQL schemas, HTTP methods, RFC 7807, endpoint structure, API contracts. Scope: API schema design, error models, request/response structures. Boundary: Excludes client-side visual layouts.

Trigger: web performance, slow load, bundle size, lazy loading, LCP, CWV optimization, fetch priority. Scope: Frontend optimization, loading speeds, asset minimization. Boundary: Excludes backend database indexing or visual design systems.

Trigger: OAuth 2.1, JWT session, Secure cookies, Keychain storage, auth flow, user authentication. Scope: User authentication, session storage, authorization boundaries. Boundary: Excludes generic data caching.

Trigger: web security, XSS mitigation, secure cookies, CSRF, CSP headers, CORS policies. Scope: Frontend and browser-level security boundaries. Boundary: Excludes operating system file storage permissions.

Trigger: structured logging, tracing, telemetry, SLI metrics, SLO alerts, log formats. Scope: Performance metrics, error tracing, production telemetry. Boundary: Excludes client behavioral product funnels.

Trigger: PostHog event, Segment schema, event properties, user funnel track, track taxonomy. Scope: Product behavioral telemetry, user funnel event models. Boundary: Excludes system performance exceptions.

Creates concise early UX discovery artifacts for PRD development, customer development, new product ideas, feature bets, and redesigns. Use when the user asks to hypothesize an ideal customer profile, generate proto-personas, write customer problem or jobs-to-be-done hypotheses, create journey maps, shape value propositions, or turn product context into design-sprint-style customer insight artifacts for product and engineering teams.

Trigger: responsive layout, media queries, mobile view, desktop layout, tablet break points, thumb zone. Scope: Multi-device layouts, breakpoints, mobile touch zones. Boundary: Excludes backend API design or database scaling.

Use when task matches design-usability-rules design guidance for IA, usability, responsiveness, systems, motion, and visual QA.

Trigger: deployment pipeline, CI CD, Docker builds, DB migrations, expand contract database, Netlify. Scope: Application deployment, multi-stage builds, zero-downtime releases. Boundary: Excludes local editor settings.

Use when the user wants to negotiate a price, rate, compensation, contract, purchase, hotel, service, vendor deal, discount, upgrade, fee, renewal, refund, or other commercial terms; asks what to say to improve leverage or get a better deal; provides an offer/counteroffer and wants a response; or wants to maximize coupons, direct-booking value, bundles, competing configurations, or all-in economics. Do not trigger for ordinary writing, simple price lookup/comparison, arithmetic, generic persuasion, or conflict mediation without a concrete negotiated outcome.

Audit a repository, vet and prioritize evidence-backed findings, write drift-aware implementation plans, delegate bounded work, and independently verify results. Use when asked to improve, audit, modernize, harden, review, plan fixes for, or systematically reduce risk in a codebase. Use native isolated agents for implementation; use OpenRouter/free only for narrow advisory audit slices under its safety limits.

Trigger: security rules, credential leaks, auth tokens, input sanitization, threat model. Scope: Software security guidelines, threat prevention, secure data handling. Boundary: Excludes client-side web browser vulnerabilities.