Latest Agent Skills

Read-only audit of hosting, database, storage, egress, and serverless spend (Supabase, Vercel, S3/R2, edge). Use when "hosting bill is high", "cut infra costs", or a bill jumps. CI minutes → audit-cicd. Model tokens → plan-llm-cost-guardrails. Consumes test-load numbers.

Read-only audit of CI gate logic — silent bypass, ratchet gaming, conflicting conditions, required checks that are not, and accreted duplicate gates. Use when "can CI be bypassed", "why did a regression pass CI", "we have too many overlapping checks". Cost/speed → audit-cicd. Consolidation → housekeep-gates.

Read-only audit of config/env parity across dev, staging, and prod — missing or misnamed vars, drifted flags, hardcoded values, secrets reused across environments. Use when "works locally but not in prod", "audit our environments", or "config drift". Local runnability → workflow-environment-ready.

Read-only audit of app-layer auth — route×gate matrix, session lifecycle, OAuth, and provider traps (getSession vs getUser, middleware-as-only-gate, CVE-2025-29927). Use when "audit our auth", "check middleware protection". RLS → plan-rls-audit. OWASP checklist → audit-security.

Close the PDCA loop on this session's diff. Headed playwright-cli, fix as you go. Use when "test my changes", "PDCA this". Pixel diffs → test-visual-regression. Story CRUD → test-qa. Monkey / guest vs logged-in → test-exploratory.

Measure-don't-guess performance audit across web, mobile, backend, and data layers — produces burndown and optimization plan with no fixes in this pass. Use when asked to "performance audit plan", "perf burndown", "measure before optimize", "bundle size audit", "LCP slow", "N+1 audit plan", "plan performance.

Apply-now consolidation of accreted CI gates, ratchets, and hooks into one aggregator required check. Use after audit-gate-logic, or when "clean up our CI checks", "we have three lint jobs", "make one quality gate". Audit-only → audit-gate-logic. Pipeline cost → audit-cicd.

Audit and fix SEO for any web app. Use when asked to "improve SEO", "add meta tags", "fix search ranking", "add structured data", "sitemap", "canonical URLs", "Open Graph", "Google indexing", "rich results", "SEO audit", or "why is my site not ranking".

Build and sharpen a project's domain model — a CONTEXT.md glossary and ubiquitous language. Use when pinning down terminology, or the agent "uses the wrong words". Repo decision-memory system (INDEX.md, rejected alternatives) → docs-adr.

Create distinctive, production-grade frontend interfaces that avoid generic AI aesthetics. Use when the user says "build this UI", "design this page", "make it look good", "dashboard layout", "beautify this", or "make the UI feel premium".

Read-only audit of unhappy-path UI states vibe-coding skips — empty, loading, error, offline, zero-results, permission, overflow — then plan fixes. Use when "check empty/error states", "audit loading states", or "what happens when this fails". Dead buttons → plan-stub-checker; backend timeouts → audit-resilience.

Audit a full-stack app against the RealWorld ("Conduit") reference — its formal API spec, shared Bruno/Hurl E2E suite, and closest-stack reference implementation — to find what is. Use when "audit against realworld", "compare my app to realworld", "conduit conformance", "is my full-stack app complete", "full-stack gap.

Audit database schema for consistency, validation, and industry standards. Use when reviewing schema design, naming conventions, constraints, indexes, or migrations. Destructive-op gates → plan-data-integrity. Who-can-read-what RLS → plan-rls-audit. Restore/RPO → plan-backup-dr.

Read-only audit of product-analytics instrumentation: event taxonomy, funnel completeness, consent-gated firing, dead/duplicate/phantom events. Use when "audit our analytics", "are we tracking the right events", "funnel instrumentation", or before iterate-post-launch. PostHog/Amplitude/Mixpanel/GA4.

Audit a Supabase/Postgres project for Row-Level Security and access-control gaps, then produce a phased remediation plan. Use when "RLS", "is my Supabase secure", "anyone can read my data", "lock down my tables". App-layer session/route gates → audit-auth-flows.

Audit documentation against actual code behavior and plan corrections — no rewrites in this pass. Use when asked to "docs drift", "sync docs with code", "audit documentation", "stale README", "onboarding docs broken", "doc sync plan", "phantom docs", or "docs out of date". Why-we-chose-X / ADRs → docs-adr.

Audit whether a project can actually recover from data loss — not just whether backups exist — then emit a phased DR plan. Use when "can we recover if the DB dies", "audit our backups", "what's our RPO/RTO", or "disaster recovery". Plan only. Destructive-op gates stay on plan-data-integrity.

NN/g-grounded page enhancement for flows and semantic data wiring — not visual polish. Use when "this page feels AI-generated", "fix UX of /xxx", "improve information density", or "icons all look the same". Composition/type → enhance-web-ui. Heuristics-only → audit-ux.

Artistic, research-grounded UI enhancement for making an existing page feel intentional, spacious, and human-crafted. Use when "make this page nicer/polished/premium/editorial", less crowded, better laid out, typography, or visual hierarchy. Flows/AI-templated UX → enhance-web-ux. Layout contract → audit-responsive.

Turn a plain-text README into a visually rich showcase with a theme-aware hero image, a feature tour grid, an optional animated guided-tour GIF, and updated tech badges. Use when asked to "enhance README", "make README prettier", "add screenshots to README", "showcase the app in README", "design the README", "add hero.

Audit an existing app's design system and motion, then apply a coherent, performant, reduced-motion-safe pass. Use when "motion pass", "animate the app", or "add micro-interactions across the app". One new isolated animation → design-motion.

Static OWASP review of app code (injection, headers, deps). Use when "review security" or "check vulnerabilities". Session/route×gate/getSession → audit-auth-flows. Plan-only burndown → plan-security-audit. Table RLS → plan-rls-audit. LLM attacks → audit-llm-security.

Keep a PR merge-ready by triaging comments, resolving clear conflicts, and fixing CI in a loop.

Adversarial red-team of a running web, React Native, or Capacitor hybrid app. Use when asked to "red team this app", "attack my app", "break it", "find all the defects", "adversarial test", "pre-launch hardening", "pentest the app", or "full app QA". Naive monkey / guest vs logged-in wander → test-exploratory.

Set up and run mutation testing (StrykerJS / mutmut) to measure whether tests assert behavior, not just execute lines. Use when "add mutation testing", "are our tests real", "can our test suite be gamed", or after an agent bulk-generated tests. Coverage plan → plan-test-coverage. Writing tests → test-unit.

Audit a codebase, UI, or copy for machine-generated tells across prose, visual/UI, code, and structure/IA, then produce a phased de-slop burndown. Use when the user says "feels AI-generated", "looks like AI slop", "reads like ChatGPT", "feels generic/soulless", or wants an authenticity/voice pass before launch.

Co-author structured documents (specs, PRDs, RFCs) through a 3-stage workflow: context gathering, drafting, and reader testing. Use when writing proposals, technical specs, or similar structured content. Repo decision-memory system (INDEX.md, rejected alternatives, agent rules) → docs-adr.

Build and maintain cohesive design systems and component libraries with tokens, theming, and documented variants. Use when the user says "design system", "component library", "design tokens", "theming", "consistent styling", "reusable components", or "variant props".

Design and implement new isolated motion — micro-interactions, page transitions, scroll, hover — with Framer Motion, CSS, or GSAP. Use when adding one animation to a new surface. Existing-app coherent pass → enhance-motion. Do not fire for "motion pass across the app".

Create museum-quality visual art in .png and .pdf formats using design philosophy. Use when user asks for poster, visual design, infographic, certificate, badge, banner, social media graphic, print design, or mentions "create artwork", "design graphic", "visual identity", or "print material".

Post-deploy smoke test combining all 5 tools (Sentry + Supabase + Firecrawl MCPs, plus the Langfuse and Playwright CLIs) into one workflow. Use when asked to: "verify deploy", "post-deploy check", "smoke test production", "check if deploy is healthy", "ship or rollback", "post-release check", "verify release", "deploy.

Wire ETL, ingestion, cron, edge-function, and queue jobs correctly. Use for "build a pipeline", "sync X into Y", "nightly aggregation", "cron double-counts", "dedupe", "backfill", "the numbers are wrong after a retry". Bakes in idempotency, atomic writes, data contracts, dead-letter, and observability.

Drive a planned change to 100% coverage across an entire codebase when a prior agent run stopped early. Use whenever a refactor, migration, rename, rule-application, or sweeping edit was planned and partially executed but left incomplete — i.e.

A Cursor Canvas is a live React app the user opens beside the chat. MUST use a canvas for standalone analytical artifacts — quantitative analyses, billing investigations, security audits, architecture reviews, data-heavy content, timelines, charts, tables, interactive explorations, repeatable tools, or any response.

Pass/fail health check across every Mushi Mushi pipeline component — CLI credentials, API reachability, edge functions, BYOK key pool, QA cron. Use when "is mushi working", "mushi health check", "check mushi pipeline", "mushi deploy check", "pipeline not responding", or right after setup.

Apply cohesive visual themes to artifacts (slides, docs, landing pages). Provides 11 pre-set themes with colors/fonts. Use when user mentions "apply theme", "color palette", "brand colors", "styling slides", "presentation design", "visual identity", or wants consistent styling across artifacts.

Design and implement transactional and marketing email templates. Use when asked to "build an email template", "transactional email", "welcome email", "password reset email", "email design", "React Email", "MJML", "dark mode email", or "email copy review". Inbox / SPF / spam → enhance-email-deliverability.

Audit frontend API calls against backend implementation for contract alignment and network shape. Use when "API audit", "FE-BE contract", or "review frontend API integration". Live 4xx/5xx reproduction → debug-fe-be-integration.

Run the rest of a /shell request as a literal shell command. Use only when the user explicitly invokes /shell and wants the following text executed directly in the terminal.

Manage the full PR lifecycle — create, review, address bot feedback, resolve conflicts, and merge. Use when creating pull requests, managing PR reviews, addressing bot feedback, or merging PRs.

Add or upgrade PWA features to any web app: service worker, offline mode, install prompt, push notifications, and background sync. Use when asked to "make it a PWA", "offline support", "install prompt", "push notifications", "service worker", "add to home screen", "background sync", "Lighthouse PWA score", "app-like.

Write clear, developer-friendly documentation — READMEs, API references, code comments, and changelog entries — tailored to the audience and the project's voice. Use when the user says "write docs", "document this API", "update the README", "add code comments", "changelog entry", or "explain this for contributors".

Systematic debugging workflow for errors and bugs. Use when debugging errors, investigating bugs, troubleshooting issues, or when something isn't working as expected. Integrates Sentry MCP for production error context, Firecrawl for researching fix patterns, and Sequential Thinking for complex multi-step diagnosis.

Generate Product Requirements Documents through structured conversation for any project. Use when starting a new feature, documenting requirements, creating specs before implementation, or needing clarity on scope and success criteria.

Design RESTful and GraphQL APIs following current best practices for naming, versioning, error shapes, and auth patterns. Use when the user says "design an API", "create endpoints", "structure my API responses", "plan API architecture", "REST vs GraphQL", or "API contract".

Release npm packages end-to-end: Changesets version bump, CHANGELOG update, GitHub Actions OIDC publish, and post-release verification. Use when the user says "release to npm", "publish this package", "ship a new version", "cut a release", "update the changelog", or combines a package name with a release verb.

Audit and fix internationalisation for any web or mobile app. Use when asked to "audit i18n", "fix translations", "add locale", "natural language", "translation quality", "hardcoded strings", "localisation", or "the Japanese feels like Google Translate".

Audit CI/CD pipelines (GitHub Actions) for cost, speed, and safety. Use when the Actions bill is high, Actions minutes, runner cost, slow CI, artifact/cache storage, or "CI/CD / workflow audit". Gate logic (bypass, ratchet gaming, required-but-not) → audit-gate-logic.

Write effective unit tests with best practices for any project. Use when writing tests, creating test cases, improving test coverage, increasing confidence before release, or when the user mentions testing. Mutation score / assertion theater → test-mutation.

Design and run a k6/Artillery load profile that measures throughput, latency percentiles, error rate, and the breaking point under concurrent traffic. Use when "load test this", "will it handle launch traffic", or "find the breaking point". Resilience-by-reading-code → audit-resilience. Never hit prod unsigned.

Audit App Store and Google Play listings for discoverability and conversion — keywords, localized metadata, screenshots, ratings prompts — then emit a prioritized ASO plan. Use when "optimize our store listing", "improve app downloads", or "ASO". Submission mechanics → plan-mobile-readiness. Plan only.

Grill the user relentlessly about a plan, decision, or idea — one question at a time — until shared understanding is reached. Use when the user says "grill me", "stress-test this plan", "interview me about this", "poke holes in this", "challenge my thinking", or before committing to a non-trivial design.

Create and maintain lightweight Architecture Decision Records as agent-readable decision memory — what was decided, why, and which alternatives were rejected. Use when "record this decision", "set up ADRs", "the agent keeps suggesting Y again". Docs vs code drift → plan-docs-sync. Session state → handoff.

Per-page UX audit using NN/g heuristics, Intuit microcopy, and Google HEART. Use when evaluating usability, auditing microcopy, checking UX heuristics, or assessing cognitive load. Cross-page flows/IA → audit-ux-journeys. Layout/breakpoints → audit-responsive. Empty/error states → audit-ui-states.

Generic webapp QA fallback — use only when no project-specific QA skill applies (project-local QA wins; native builds → mobile-emulator-test). Use when "QA the app", "test CRUD", or "smoke test". Monkey / guest vs logged-in → test-exploratory. Dead buttons → plan-stub-checker. Pixel diffs → test-visual-regression.

Compact the current conversation into a handoff document a fresh agent can pick up. User-invoked via /handoff; an optional argument describes what the next session will focus on.

Tworzenie i konfiguracja definicji elementów wynagrodzenia na platformie Soneta przez MCP soneta_ui. Algorytmy naliczania (kreator, edytor C#, wbudowane), wzorce algorytmiczne, receptury kodu C# dla elementów płacowych, konfiguracja PIT/ZUS/nieobecności. Używaj gdy użytkownik: (1) chce utworzyć/skonfigurować definicję elementu wynagrodzenia (zakładki Ogólne, Deklaracje, Nieobecności, Algorytm); (2) pyta o algorytm naliczania (kreator, edytor, kod C#); (3) potrzebuje kodu C# do edytora algorytmu (_Param, _Wylicz, _Wartość1h); (4) pyta o wzorce dla dodatków, nieobecności, zasiłków; (5) wspomina 'definicja elementu', 'element wynagrodzenia', 'algorytm płacowy', 'WypSkladnik', 'WypElement', 'premia procentowa', 'dodatek stażowy', 'zasiłek chorobowy', 'ekwiwalent za urlop'; (6) pisze recepturę kodu płacowego (staż pracy, wymiar etatu, czas pracy, wskaźniki, cechy pracownika).

Planowanie projektów dodatków dla platformy Soneta (enova365, Triva) — interaktywny, etapowy proces od wizji biznesowej po specyfikację implementacyjną, zasilającą skille /soneta-business-xml, /soneta-form-xml i /soneta-programming. Używaj, gdy użytkownik chce zaplanować nowy moduł lub dodatek (założenia, specyfikacja funkcjonalna, struktura danych i interfejsu użytkownika).

Generator plików business.xml dla platformy Soneta (enova365, Soneta Enterprise). Tworzy definicje obiektów biznesowych (tabel, kolumn, relacji, indeksów) zgodne ze schematem XSD. Używaj gdy użytkownik prosi o stworzenie nowego modułu biznesowego, zdefiniowanie obiektów lub encji do przechowywania w bazie danych, utworzenie relacji między obiektami, lub generowanie plików business.xml dla platformy Soneta.

Klasy ORM i wzorce kodu biznesowego platformy Soneta (enova365, Soneta Enterprise, Triva). Używaj gdy użytkownik: (1) pisze, modyfikuje lub refaktoruje kod biznesowy enova365/Soneta/Triva (Row/Table/Module, sesje i transakcje, selector, typy wierszy); (2) pyta o konkretny mechanizm ORM — Session, Commit/Save, optimistic lock, Context, RowCondition, Datapack, ViewInfo, Features, thread-safety; (3) prosi o code review kodu biznesowego Soneta (safe-code); (4) pisze worker, extender, akcję w menu Czynności, folder/listę; (5) chce zinwentaryzować moduły, pola, workery lub formularze/zakładki (pola, sekcje, kolejność wprowadzania) z bibliotek DLL; (6) chce rozpocząć nowy dodatek/rozszerzenie Soneta — wygenerować szkielet źródeł z CLI (`dotnet new soneta-addon`, Soneta.MsBuild.SDK, szablony Soneta Platform Developer). Sięgnij też, gdy inny skill potrzebuje warstwy ORM/kodu biznesowego Soneta.