Web & Frontend

the-notorious-avengers Bundle

Icon-system specialist for React/Next.js — library selection (Lucide, Heroicons, Tabler, Phosphor, Iconify), tree-shake-vs-SVG-sprite trade-off, dynamic-import-by-name pattern, custom SVG component authoring, and the accessibility contract (aria-hidden for decorative icons, aria-label for semantic icons, accessible name for icon buttons). Use when choosing an icon library, debugging bundle-size regressions from icon imports, wiring a dynamic icon loader, building a custom SVG wrapper, or auditing icon accessibility. Paired with `icon-system-guardian`.

the-notorious-avengers Bundle

Kanban method specialist — WIP limit design and enforcement, flow-metric calculation (cycle time, lead time, throughput, flow efficiency), Little's Law diagnostics, visual-board design, class-of-service policies, cumulative-flow-diagram interpretation, and tool-specific implementation (Linear, Jira, GitHub Projects). Use when the user says "set up WIP limits", "calculate cycle time", "apply Little's Law", "design our Kanban board", "Kanban vs Scrum", "our WIP is always exceeded", "why is our cycle time so long", or when `kanban-flow-guardian` is invoked. Do NOT use for sprint ceremonies / velocity (Scrum domain, no peer Angel yet), CI/CD pipeline design (devops-guardian), database schema for a custom metrics store (db-guardian), or building custom Kanban tooling in code (react-guardian / python-guardian).

the-notorious-avengers Bundle

Public status page specialist for React/Next.js and SaaS products — platform selection (Statuspage/Atlassian, Better Stack, Instatus, Cachet OSS), component tree architecture, incident communication templates (initial/update/resolution), subscriber notification setup (email, SMS, webhook, Slack), GDPR/CAN-SPAM compliance for notification lists, post-incident update discipline, and API-driven automation integration. Use when the user says "set up a status page", "which status page tool should we use", "write an incident communication template", "configure subscriber notifications", "migrate from Statuspage", "audit our incident communication", "post-mortem cross-link", "maintenance window announcement", or when `status-page-guardian` is invoked. Do NOT use for configuring monitoring/alerting infrastructure (devops-guardian), on-call rotation setup (devops-guardian), observability dashboards (devops-guardian), or operational runbook authorship (runbook-writing-guardian).

the-notorious-avengers Bundle

Audits React, Next.js, TypeScript, and Node.js codebases for vulnerabilities and remediates every Critical and High finding in-session. Encodes pre-researched 2025–2026 vulnerability intelligence across three catalogs — vibe-coding AI-generated code patterns, OWASP Top 10 (2025) manifestations in this stack, and PII / financial data exposure — plus canonical remediation playbooks and deterministic scan scripts. Use this skill whenever the user says "security audit this branch", "scan for vulnerabilities", "check the payment flow for PCI issues", "verify CVE-2025-29927 patch status", "run security-guardian", or when the `security-guardian` Angel is invoked in the plan's penultimate step (immediately before `quality-guardian`). Do NOT use for verifying implementation-matches-plan (that is `quality-guardian`'s job) or for drafting new architecture (that is `library-guardian`).

the-notorious-avengers Bundle

Repository hygiene auditor for GitHub repos — branching strategy, branch protection rulesets, PR culture, commit history (Conventional Commits), CI workflow density, README/docs presence, .gitignore coverage, CODEOWNERS, issue/PR templates, and repo settings (merge strategy, secret scanning, auto-delete). Use when the user says "audit this repo", "repo health check", "review our branching strategy", "check branch protection", "CODEOWNERS audit", "are our CI checks configured correctly", "check PR templates", or "GitHub repo settings review". Do NOT use for deep CI/CD architecture (devops-guardian), code correctness (security-guardian, react-guardian), or database schema (db-guardian).

the-notorious-avengers Bundle

Image optimization specialist for React/Next.js and HTML contexts — AVIF/WebP format selection (AVIF is the 2026 production default), responsive srcset/sizes calculus, blur placeholders (LQIP via Sharp, BlurHash-as-CSS-gradient, ThumbHash), next/image remote patterns and the Next.js 16 priority→preload shift, and CLI tooling (Sharp Node API, Squoosh CLI for one-offs). Use when the user says "optimize my images", "convert to AVIF", "set up srcset", "add blur placeholders", "next/image remote patterns", "LCP image is slow", "fix layout shift from images", "AVIF vs WebP", or when auditing a codebase for unoptimized image delivery. Do NOT use for SVG icon systems (icon-system-guardian), general Lighthouse audits beyond image-specific findings (lighthouse-pagespeed-guardian), CDN/caching architecture beyond image Cache-Control (devops-guardian), or CSS animation performance (ux-ui-guardian).

the-notorious-avengers Bundle

Telegram Bot specialist — Bot API (up to 10.0 / May 2026 including guest mode and managed bots), grammY v1.x (TypeScript, recommended) and aiogram 3.x (Python), webhook vs long-polling decision with quantitative thresholds, Telegram Mini Apps initData validation (HMAC-SHA256 + Ed25519), Telegram Stars payments (mandatory for digital goods in 2026), inline mode, and MTProto escalation via Telethon/TDLib. Invoke when building a new bot, debugging webhook delivery, wiring Mini Apps, implementing payments, or deciding between frameworks. Do NOT invoke for the Mini App frontend UI (react-guardian), hosting/CI beyond bot-specific concerns (devops-guardian), or external payment processor integrations beyond Telegram Payments (payments-guardian).

the-notorious-avengers Bundle

Accessible overlay specialist for React — primitive selection (Radix Dialog, AlertDialog, Vaul Drawer, Sonner toast, cmdk command menu, Headless UI), the six-point accessible-modal contract (focus trap, escape, scroll lock, aria-modal, aria-labelledby, focus return), and the four-tier toast-vs-notification taxonomy. Use when choosing an overlay primitive, debugging focus trap regressions, implementing a drawer/sheet, wiring Sonner toasts into a React app, building a command palette, or auditing overlay stacking behavior. Paired with `modal-toast-dialog-guardian`.

the-notorious-avengers Bundle

App store submission specialist for iOS (App Store Connect + TestFlight) and Android (Google Play Console). Covers App Store Optimization (keywords, screenshots, preview assets), submission workflow, privacy compliance (Apple nutrition labels, PrivacyInfo.xcprivacy, Google data safety forms), rejection diagnosis and remediation, age rating questionnaires, In-App Purchase setup (StoreKit 2, Google Play Billing Library), and realistic timeline expectations. Invoke when the user says "submit my app", "App Store rejection", "ASO strategy", "privacy nutrition label", "set up IAP", "Google Play review", "expedited review", or when preparing any mobile app for store publication. Do NOT invoke for UI design of the app itself (ux-ui-guardian), client-side StoreKit / billing implementation code (react-guardian / python-guardian), or app security audits (security-guardian).

the-notorious-avengers Bundle

The "upload your spreadsheet" implementation arsenal for React/Next.js products. Covers library selection (papaparse, SheetJS, exceljs), streaming-parse for 100MB+ files, the column-mapping UX wizard, managed importers (OneSchema, Flatfile, dromo) vs self-hosted (react-spreadsheet-import), Zod row validation, CSV injection prevention, encoding edge cases, and styled XLSX export. Use when the user says "build a CSV import", "add XLSX upload", "spreadsheet import feature", "column-mapping wizard", "export to Excel", "streaming parse large file", "CSV injection safety", or when csv-xlsx-import-export-guardian is invoked. Do NOT use for file drop-zone UI (ux-ui-guardian), database bulk-insert tuning (db-guardian), or upload endpoint security audit (security-guardian).

the-notorious-avengers Bundle

CRM connectivity specialist for HubSpot, Salesforce, Pipedrive, Attio, Folk, Close, and Copper -- bi-directional sync design, the contact-vs-lead-vs-account taxonomy, merge/dedupe, and the native-vs-Zapier-vs-Merge.dev architecture trade-off. Use when the user says "integrate with HubSpot", "bi-directional CRM sync", "CRM field mapping", "Merge.dev or native API?", "dedup contacts in our CRM", "lead enrichment strategy", "sync conflict resolution", "Salesforce Lead vs Contact", "Attio API production-ready?", or "audit our CRM sync code". Do NOT use for cold email sequence design (cold-outreach-guardian), product database schema (db-guardian), sync implementation code (python-guardian), or frontend CRM widgets (react-guardian).

the-notorious-avengers Bundle

Discord bot and application specialist for discord.js (v14/v15), discord.py 2.x, and Serenity (Rust). Covers slash commands, interactive components (buttons, select menus, modals), voice pipeline (Lavalink 4 + DAVE-compliant clients), gateway-vs-HTTP-endpoint architecture, rate-limit handling, shard management, and the bot verification path past 100 servers. Use when building, reviewing, or debugging any Discord bot or application — SDK selection, command registration, component flows, voice queues, scaling, or the bot-verification checklist. Do NOT use for general Python packaging (python-guardian), container/CI shapes (devops-guardian), credential vault integration (security-guardian), or database schema design for bot state (db-guardian).

mdadul Bundle

Installs and configures NativeWind v4 (Tailwind CSS for React Native) in an Expo project, covering package installation, Tailwind config, Babel preset, Metro config, global CSS import, and app.json bundler switch. Use when the user asks to add NativeWind, set up Tailwind CSS in Expo, configure nativewind, or integrate Tailwind with a React Native / Expo project.

mdadul Bundle

Teach and apply the Mediator pattern to centralize collaboration rules among tightly coupled components and eliminate direct component-to-component dependencies. Use when users ask about Mediator, Intermediary, Controller, UI dialog coordination, reusable components, or comparing Mediator with Observer, Facade, or Chain of Responsibility.

the-notorious-avengers Bundle

Audits and implements the full dark-mode theming surface for React/Next.js applications — CSS variable token architecture (semantic vs. primitive), next-themes wiring (ThemeProvider, storageKey, enableSystem), FOWT (flash-of-wrong-theme) prevention via blocking inline script, SSR hydration safety (suppressHydrationWarning, typeof window guards, mounted guard pattern), Tailwind v4 dark-mode configuration (@custom-variant, selector strategy), and multi-brand/white-label runtime theme swapping via CSS variable overrides. Use when the user says "set up dark mode", "next-themes keeps flashing", "dark mode on SSR", "multi-brand theming", "CSS variable token layer", "Tailwind v4 dark mode", "prefers-color-scheme in Next.js", "white-label theme runtime swap", or when dark-mode-theming-guardian is invoked. Do NOT use for palette creation or source-of-truth token file authorship (design-system-guardian), per-component visual deltas (ux-ui-guardian), or persisted-preference schema design (db-guardian).

dibmaster Skill

Review a web page for UX and design quality. Checks layout, mobile responsiveness, above-the-fold content, CTAs, accessibility, visual hierarchy, and touch targets. Use when the user asks for a UX review, design review, layout check, or mobile review.

the-notorious-avengers Bundle

Markdown/MDX processing specialist - MDX 3/compiler selection, remark/rehype plugin pipelines, Shiki v4/expressive-code/starry-night syntax highlighting, GFM, AST manipulation, custom directive plugins, math/Mermaid diagram embedding, and XSS sanitization. Use when building or auditing any content processing pipeline that takes .md/.mdx source to HTML/JSX output.

ellaliu0401 Skill

Implement and modify role-based access control for Aetheron Connect V2. Covers backend route guards, frontend tab/section visibility, integration test patterns, and role hierarchy. Use when changing who can access a feature, adding role restrictions, reviewing RBAC, or when the user mentions roles, permissions, admin-only, superuser-only, or access control.

ellaliu0401 Skill

Pre-submission checks for Aetheron Connect V2 frontend code in apps/web. Captures recurring reviewer feedback (HTML semantics, img hygiene, silent catch, utility reuse, DS prop conventions, visual state single-source-of-truth, React Query retry/staleTime/suppressGlobalError defaults, timezone-safe date rendering, status-enum forward-compat, mutation error three-thing rule, single-record API lookup over listX(limit:100), shared hook test coverage) so the agent surfaces these issues before the PR is opened. Use whenever writing or editing code under apps/web, adding a useQuery/useMutation, rendering a date-only string, branching on a backend status enum, looking up a single entity by id, extracting a shared hook, or before marking a frontend task complete.

ellaliu0401 Skill

Global frontend error-handling patterns for Aetheron Connect V2 (apps/web): classifying errors before defaulting to unknown, narrowing transient network detection (TypeError / DOMException), toast cooldown for simultaneous failures, and threading server-resolved feature flags through client Providers. Use when: (a) editing `QueryProvider.tsx`, any `useActionErrorHandler`-style hook, React Query `MutationCache.onError` / `QueryCache.onError` wiring, or global toast handlers; (b) adding `isTransientNetworkError` / network-error detection logic, toast deduplication, or server→client feature-flag context plumbing; (c) the user pastes a runtime error stack trace, a "Failed to fetch" / "Load failed" / "TypeError" / "Network connection failed" report, or a reproduction of unexpected toast spam; (d) investigating "why is the user seeing five identical toasts", "real bug got swallowed as a generic toast", or "client and server defaults diverged" questions.

jiangyangcreate Skill

Word (.docx) text replace and image extraction, Excel format copying, Markdown to docx/HTML/Excel conversion, and Jupyter notebook merging or Markdown export via the etool CLI. Use when the user works with .docx, .xlsx, .md, or .ipynb files — replacing text, extracting images, converting Markdown, or merging notebooks.

arcdodo Bundle

Build reusable mobile-friendly HTML demos where swiping between ordered images scrubs through adjacent transition videos converted into image-frame sequences. Use when a user provides images such as d1/d2/d3 and videos such as d1d2/d2d3, asks for smooth bidirectional swipe transitions, wants to avoid MP4 seek black screens or flicker, wants an interactive artwork/product/story demo, or wants a shareable static HTML demo.

mamamou Skill

React frontend security best practices for building secure, production-grade applications. Use when writing or reviewing security-sensitive React code, configuring authentication, handling user input, setting up CSP, securing Server Components/Actions, or hardening a React/Next.js application. Covers OWASP 2025, XSS prevention, CSRF, auth patterns, token storage, Server Components security (CVE-2025-55182), Next.js middleware/proxy hardening, supply chain security, CSP with Vite 6/Next.js 16, Zustand/ TanStack Query security, DOMPurify sanitization, and deployment hardening. Keywords: React security, XSS, CSRF, CSP, authentication, authorization, Server Actions, Server Components, OWASP, supply chain, npm audit, DOMPurify, Content-Security-Policy, HttpOnly cookies. (updated 2026-03-28)

mamamou Skill

React enterprise architecture guidelines for structuring scalable, production-grade applications. Use when scaffolding a new React project, reviewing project structure, setting up feature slices, choosing state management, configuring data fetching, or making architectural decisions in a React/TypeScript codebase. Covers folder structure, routing (TanStack Router, React Router v7, Next.js App Router), TanStack Query v5, Zustand, React Compiler, Vite 6, Turbopack, Vitest, Playwright, Tailwind v4, and Server Components. Keywords: React architecture, project structure, feature slices, DDD, enterprise React, folder layout, monorepo, Nx, Turborepo. (updated 2026-03-28)

mamamou Skill

Angular frontend security best practices for building secure, production-grade applications. Use when writing or reviewing security-sensitive Angular code, configuring authentication, handling user input, setting up CSP, securing Angular SSR, or hardening an Angular application. Covers OWASP 2025, XSS prevention, DomSanitizer, template injection, CSRF/XSRF, HttpClient security, Angular SSR vulnerabilities (CVE-2025-59052), XSRF token leakage (CVE-2025-66035), stored XSS via SVG (CVE-2025-66412), AutoCSP, Trusted Types, zoneless Angular, functional guards/interceptors, NgRx security, supply chain, and deployment hardening. Keywords: Angular security, XSS, CSRF, CSP, DomSanitizer, bypassSecurityTrust, template injection, AOT, Angular SSR, HttpClient, XSRF, route guards, NgRx, signals, zoneless. (updated 2026-03-28)

mamamou Skill

Angular enterprise architecture guidelines for structuring scalable, production-grade applications. Use when scaffolding a new Angular project, reviewing project structure, setting up feature slices, choosing state management, configuring data fetching, or making architectural decisions in an Angular/TypeScript codebase. Covers folder structure, signals, standalone components, new control flow, deferrable views, zoneless change detection, NgRx SignalStore, httpResource, functional guards/interceptors, typed reactive forms, esbuild + Vite, Vitest, Playwright, Tailwind v4, SSR with incremental hydration, and Nx monorepos. Keywords: Angular architecture, project structure, feature slices, DDD, enterprise Angular, folder layout, monorepo, Nx, signals, standalone, zoneless. (updated 2026-03-30)

mamamou Skill

Node.js/Express/TypeScript-specific code review overlay. Extends the universal code-reviewer skill with Node.js version-aware rules. Trigger when reviewing Express route handlers, middleware, REST controllers, GraphQL resolvers, Apollo Server setup, JWT/OAuth middleware, Bull/BullMQ job processors, or any .ts/.js file in a Node.js backend project. Keywords: Express, REST API, GraphQL, Apollo, JWT, OAuth, BullMQ, Bull, queue, middleware, TypeScript strict, tsconfig, req, res, next, router. Do NOT trigger for frontend React/Vue/Angular code in the same repo (use code-reviewer-react for those) or for infrastructure/IaC files. (updated 2026-03-28)

mamamou Skill

React/TypeScript-specific code review overlay. Extends the universal code-reviewer skill with React version-aware rules. Trigger when reviewing React components, hooks, context, Suspense boundaries, Server Components, Client Components, React Router, TanStack Query, Zustand, Redux, React Hook Form, or any .tsx/.jsx file in a React project. Keywords: React, useState, useEffect, useCallback, useMemo, useRef, useContext, useReducer, useTransition, Suspense, memo, RSC, Server Component, Client Component, TanStack Query, Zustand, React Hook Form, Next.js, Vite, prop drilling, key prop. Do NOT trigger for Angular or Vue files in the same monorepo. (updated 2026-03-28)

mamamou Skill

Django/Python-specific code review overlay. Extends the universal code-reviewer skill with Django and Python version-aware rules. Trigger when reviewing Django views, models, serializers, forms, URLs, settings, migrations, Celery tasks, or any .py file in a Django project. Keywords: Django, DRF, ORM, QuerySet, serializer, viewset, model, migration, WSGI, ASGI, Celery, pytest-django. Do NOT trigger for pure Python scripts unrelated to Django, or for frontend code in the same project (use code-reviewer-react or code-reviewer-node for those). (updated 2026-03-28)

mamamou Skill

Angular/TypeScript-specific code review overlay. Extends the universal code-reviewer skill with Angular version-aware rules. Trigger when reviewing Angular components, services, directives, pipes, guards, resolvers, NgRx stores/effects, RxJS streams, Apollo Angular GraphQL, HttpClient calls, SSR (Angular Universal), or any .ts/.html file in an Angular project. Keywords: Angular, standalone, component, NgRx, signal, computed, effect, RxJS, Observable, HttpClient, inject(), OnPush, @if, @for, router, guard, resolver, lazy loading, Angular Material, SSR, hydration. Do NOT trigger for Node.js backend code in the same monorepo (use code-reviewer-node for that) or for plain TypeScript utilities with no Angular imports. (updated 2026-03-28)

pizzzhama-alt Bundle

Build safe HTML, CSS, and vanilla JavaScript modifications for Tilda websites. Use when Codex needs to customize standard Tilda blocks, Zero Block, product catalogs, product cards, product popups, forms, menus, popups, animations, scoped CSS, dynamic DOM updates, MutationObserver behavior, or explain exactly where to paste code in Tilda.

nikoxkx Skill

Implements client-side and server-side form validation with accessible error messaging. Use when adding validation to any HTML or React form.

nikoxkx Skill

Generates formatted data reports in PDF, Excel, or HTML from structured data. Use when producing recurring business reports, dashboards, or data summaries.

nikoxkx Skill

Designs and implements RESTful or tRPC API routes with input validation, error handling, and OpenAPI documentation. Use when building backend routes in Next.js, Express, Fastify, or similar.

ralfnick Bundle

Use when the user needs AI-optimized headless browser automation with semantic element targeting, accessibility-first snapshots, or intelligent page understanding. Triggers on agent browser, smart browse, semantic scrape, AI browser, headless automation, accessibility tree, find by role, find by label.

johannesrabauer Skill

Build HUD, menus, dialogs, overlays, and scenes in FXGL — add UI nodes to the HUD, create custom main and game menus via SceneFactory, open modal dialogs (message, confirm, input, error, progress), push in-game notifications, implement GameSubScene overlays, bind text to game variables, control viewport and camera-follow, integrate FXML layouts, apply custom CSS, use nine-slice scaling images, add scrolling backgrounds, and add a minimap. Use this skill for anything related to game UI, HUD, screen transitions, or in-game menus.