Web & Frontend

gabrielmoreira Skill

Use when the user wants to develop, run, preview, save, deploy, or roll back a CloudBase Web app in this conversation as a Lovable/Codex-Sites-like vibe- coding session — i.e. any request that maps to "spin up a React+Vite project, see it live in the browser, iterate, save versions, deploy". Activate ONLY for browser-rendered Web projects based on the CloudBase official React (or Vue) + Vite template. Do NOT activate for: WeChat/Alipay mini-program, React Native / Flutter / Electron, pure cloud functions / CloudRun backends, or Next.js / Nuxt / Astro / Remix / SvelteKit (those frameworks are explicitly out of scope).

gabrielmoreira Skill

文档解析技能，用于解析PDF文档和图片（jpg/png/jpeg）并将其转换为Markdown格式输出。支持标题层级、表格（HTML格式）、公式（LaTeX格式）、图片（链接形式）等复杂内容的解析。当用户提到"解析PDF"、"文档解析"、"PDF转Markdown"、"提取PDF内容"、"解析文档"、"文档内容提取"、"PDF内容识别"、"图片解析"、"图片转文字"、"识别图片内容"等场景时使用此技能。即使用户只是要求读取或查看PDF/图片文件内容，也应考虑使用此技能。

gabrielmoreira Skill

Generate an interactive, self-contained HTML dashboard displaying SFI-TI3.2.2 tenant isolation violations for a service, org, or alias -- includes filtering, sorting, severity coding, TSG links, S360 deep links.

gabrielmoreira Skill

Run accessibility audit runner operations. Auto-activating skill for Frontend Development. Triggers on: accessibility audit runner, accessibility audit runner Part of the Frontend Development skill category. Use when analyzing or auditing accessibility audit runner. Trigger with phrases like "accessibility audit runner", "accessibility runner", "accessibility".

gabrielmoreira Skill

Test keyboard navigation tester operations. Auto-activating skill for Frontend Development. Triggers on: keyboard navigation tester, keyboard navigation tester Part of the Frontend Development skill category. Use when writing or running tests. Trigger with phrases like "keyboard navigation tester", "keyboard tester", "keyboard".

gabrielmoreira Bundle

Implements Syncfusion .NET MAUI DateTimePicker (SfDateTimePicker) control. Use when implementing date and time selection, datetime pickers, or date-time input interfaces in .NET MAUI applications. Covers DateTimePicker setup, formatting dates/times, picker modes (dialog/relative), customization, date restrictions, intervals, events, localization, and accessibility.

gabrielmoreira Skill

[Deprecated] Use when building frontend Web apps that talk to CloudBase Relational Database via @cloudbase/js-sdk – provides the canonical init pattern so you can then use Supabase-style queries from the browser. New environments should use PostgreSQL with app.rdb() — see postgresql-development skill instead.

gabrielmoreira Skill

End-to-end Marp Markdown presentation workflow — create decks from topics or codebases, build to PDF/PPTX/HTML, review for quality, and customize themes. Use when asked to create slides, export presentations, review decks, or style Marp files.

gabrielmoreira Skill

Use this skill to generate a package.xml (and optionally destructiveChanges.xml, destructiveChangesPre.xml, or destructiveChangesPost.xml) from a local source directory, an explicit component list, or org introspection. Trigger when the user says "generate a package.xml from this folder", "create a manifest for these classes", "I need a deploy manifest", "build package.xml for the contacts changes", or "create both package.xml and destructiveChanges.xml for these deletions". Encodes which metadata types accept a wildcard member and which must be enumerated, avoiding the common "Wildcards are not supported for this metadata type" deploy failure. DO NOT TRIGGER for executing a deploy (use platform-metadata-deploy), performing the deletion in destructiveChanges.xml (use platform-destructive-deploy), or retrieving metadata (use platform-metadata-retrieve).

gabrielmoreira Skill

Load automatically when planning, researching, or implementing Medusa Admin dashboard UI (widgets, custom pages, forms, tables, data loading, navigation). REQUIRED for all admin UI work in ALL modes (planning, implementation, exploration). Contains design patterns, component usage, and data loading patterns that MCP servers don't provide.

gabrielmoreira Skill

Execute the destructiveChanges.xml delete-and-deploy workflow against a Salesforce org. TRIGGER when the user asks to delete/remove a custom object, field, Apex class, flow, or any metadata component FROM an org, or to perform a 'destructive deploy' / removal as part of a release. Validates first and gates production with explicit confirmation. DO NOT TRIGGER for local file deletion (use Bash), or for net-new deploys (use platform-metadata-deploy).

gabrielmoreira Skill

Manage performance lighthouse runner operations. Auto-activating skill for Frontend Development. Triggers on: performance lighthouse runner, performance lighthouse runner Part of the Frontend Development skill category. Use when working with performance lighthouse runner functionality. Trigger with phrases like "performance lighthouse runner", "performance runner", "performance".

gabrielmoreira Skill

Verify a rendered visual artifact actually says what it was supposed to say — open it, read its console errors, walk a failure catalog, and check it against the claim it was meant to carry. Works on charts, generated HTML reports, SVG, dashboards, diagrams, and any other output meant to be looked at. Use after render_chart / create_chart_view, after editing a post-Flint Vega-Lite spec, and before committing any generated HTML/SVG/PNG. Satisfied by the host's built-in browser tools or by the optional playwright MCP server.

gabrielmoreira Skill

Analyze responsive breakpoint analyzer operations. Auto-activating skill for Frontend Development. Triggers on: responsive breakpoint analyzer, responsive breakpoint analyzer Part of the Frontend Development skill category. Use when analyzing or auditing responsive breakpoint analyzer. Trigger with phrases like "responsive breakpoint analyzer", "responsive analyzer", "analyze responsive breakpoint r".

gabrielmoreira Skill

Performing XS-Search / XS-Leaks attacks that extract cross-origin information through side channels — using inclusion methods (frames, pop-ups, HTML elements, fetch) and leak techniques (event handlers, timing, error events, global limits like connection-pool and event-loop, CORB, postMessage, Performance API) to distinguish two states of a victim page and exfiltrate secrets. Activates when assessing cross-origin information disclosure, search endpoints, or state-dependent responses.

gabrielmoreira Bundle

Run the agentless, open-source ScoutSuite tool (via pip install and the `scout` CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an interactive HTML security report. Use when assessing an AWS account's overall security posture with read-only IAM credentials, such as during a cloud security audit or compliance review.

gabrielmoreira Skill

Execute behavior-preserving or intentionally scoped refactors safely. Use this for multi-file renames, component/service extraction, state-management changes, API migrations, concurrency refactors, or any request where unrelated user work and subtle contracts must be preserved.

gabrielmoreira Skill

Use when adding interactive 3D scenes from Spline.design to web projects, including React embedding and runtime control API.

gabrielmoreira Skill

With `cleanUrls: true`, nav links must NOT have `.html` extensions:

gabrielmoreira Skill

Pattern-aware code scaffolding that detects existing conventions and generates new components matching the codebase style. Use when asked to "scaffold a component", "generate boilerplate", "create a new module", "bootstrap a service", "add a new endpoint", "create a new controller", or "add a new feature module". Discovers patterns first, then replicates them.

gabrielmoreira Skill

Read any chart (image, HTML, screenshot) and extract insights, patterns, anomalies, bias, and narrative -- the reverse of visualization

gabrielmoreira Skill

Use when performing PCA principal component dimensionality reduction on tabular numeric data. Supports command-line parameter input, automatic numeric feature selection, parameter validation, result directory creation, and CSV or TXT format result export.

gabrielmoreira Skill

Execute Adobe PDF Services workflow: create PDFs from HTML/DOCX, extract text/tables, document generation from templates, and PDF-to-Markdown conversion. Use when building document automation, extracting content from PDFs, or generating dynamic reports. Trigger with phrases like "adobe pdf", "pdf services", "extract pdf", "create pdf", "document generation", "pdf to markdown".

gabrielmoreira Skill

Production-ready PostHog SDK patterns: singleton client, typed events, React hooks, Next.js App Router integration, and Python patterns. Trigger: "posthog SDK patterns", "posthog best practices", "posthog React hook", "posthog Next.js", "posthog typescript".

gabrielmoreira Skill

Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.

gabrielmoreira Skill

Microsoft Authentication Library (MSAL) patterns for React/SPA applications with Entra ID

gabrielmoreira Skill

Exploiting dangling markup / scriptless HTML injection to exfiltrate clear-text secrets, steal form data, subvert application flow, and bypass CSP when full XSS is not possible. Covers unterminated img/meta/table/link/base tags, CSS @import, form/input/textarea/option hijacking, base-tag + window.name CSP evasion, and dangling-iframe leaks. Activates when HTML injection is found but JavaScript execution is blocked or filtered.

gabrielmoreira Skill

React + Vite performance optimization — code splitting, lazy loading, bundle analysis, Web Vitals, and modern React patterns for fast web applications

gabrielmoreira Skill

Deploys remote browser isolation (RBI) as a core component of a Zero Trust architecture. Implements isolation policies with URL categorization and risk-based routing, content disarming and reconstruction (CDR) for file sanitization, data loss prevention controls within isolated sessions, and integration with Secure Web Gateway and ZTNA platforms. Based on Cloudflare Browser Isolation, Menlo Security, and Zscaler RBI approaches. Use when hardening web access against zero-day exploits, phishing, credential theft, and browser-based data exfiltration.

gabrielmoreira Skill

Exploiting Client-Side Path Traversal (CSPT, also known as On-Site Request Forgery) where attacker-controlled input is concatenated into a same-origin URL that the victim's browser fetches with their credentials, enabling CSPT-to-CSRF, cache deception/poisoning, and open-redirect-to-XSS/SSRF chains. Activates when SPA routers, fetch/XHR wrappers, or CSS/link generators build request paths from route params, stored values, or UI fragments.

gabrielmoreira Skill

Render data dashboards as self-contained HTML files using Apache ECharts v6. Single file, zero build step, interactive charts with tooltips and data zoom. Declarative JSON option config optimized for AI generation.

gabrielmoreira Skill

Deploy Algolia-powered apps to Vercel, Fly.io, and Cloud Run with proper API key management and InstantSearch frontend integration. Trigger: "deploy algolia", "algolia Vercel", "algolia production deploy", "algolia Cloud Run", "algolia Fly.io", "algolia InstantSearch".

gabrielmoreira Skill

Deploy PostHog to Vercel, Docker (self-hosted), and Cloud Run. Covers Next.js reverse proxy, server-side capture in edge functions, self-hosted PostHog setup, and platform-specific environment configuration. Trigger: "deploy posthog", "posthog Vercel", "posthog production deploy", "posthog Cloud Run", "posthog self-hosted", "posthog Docker".

gabrielmoreira Skill

Guides design and implementation of evolutionary modular-monolith platforms with DDD (strategic + tactical), flat-by-aggregate organization, an Anti-Corruption Layer for vendor independence, a transactional outbox for events, smart resilience (backoff with jitter, circuit breakers, idempotency), and a polished architecture HTML document with elegant SVG diagrams. Use when designing a platform or backend, defining bounded contexts, organizing modules and folders, choosing monolith vs microservices, decoupling from an external service (ERP, storage, AI), making calls resilient, adding real-time push, picking a 2026 TypeScript stack (Nx, NestJS, React), or producing an architecture document or diagram. Also triggers on 'modular monolith', 'bounded contexts', 'flat-by-aggregate', 'ports and adapters', 'architecture diagram'. Do NOT use for simple CRUD, NestJS-only deep implementation (use nestjs-modular-monolith), or pure domain-model review (use tactical-ddd).

gabrielmoreira Skill

Exploiting Client-Side Template Injection (CSTI) where a frontend framework (AngularJS, Vue, Mavo, Alpine.js) compiles attacker-controlled template syntax in the browser, turning a reflection into arbitrary JavaScript execution (XSS) often bypassing classic XSS filters and CSP. Activates when user input is reflected into a framework-controlled DOM and template expressions like {{7*7}} are evaluated.

gabrielmoreira Skill

Generates a CONTEXT.md file for a PrestaShop shared component inside the `.ai/Component/` folder. Trigger this skill when the user asks to "generate a context for [Component]", "document the [X] component", "fill in the CONTEXT.md for [Component]", or when working inside `.ai/Component/` directories. Components live under `src/Core/{Name}/` and/or `src/Adapter/{Name}/` — they are shared infrastructure, not business domains. Examples: Grid, Form, Hook, CQRS, Translation, Router.