Web & Frontend

daemon-blockint-tech Bundle

Guides senior front-end software engineering—TypeScript/React/Next.js architecture, component design, client and server rendering, state and data fetching, styling and design systems, accessibility (WCAG), performance (Core Web Vitals), testing, and senior-level UI code review. Use when building or refactoring complex UIs, designing component APIs, optimizing LCP/INP/CLS, implementing accessible interactions, integrating design tokens, or reviewing front-end PRs—not for backend APIs or databases (fullstack-software-engineer, senior-fullstack-developer), design-only critiques without implementation, CI/CD (devops), or cross-service system RFCs (senior-software-engineer). For implementing screens from design specs, component states, and visual QA, use ui-software-engineer. Deep perf investigations and load/RUM analysis: performance-engineer.

ghosteken Skill

Build React components, implement responsive layouts, and handle client-side state management. Masters React 19, Next.js 15, and modern frontend architecture.

ghosteken Skill

Builds production-quality UIs. Use when building or modifying user-facing interfaces. Use when creating components, implementing layouts, managing state, or when the output needs to look and feel production-quality rather than AI-generated.

ghosteken Skill

Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface. Use when creating REST or GraphQL endpoints, defining type contracts between modules, or establishing boundaries between frontend and backend.

ghosteken Skill

Audits and strips Lovable scaffolding from Vite + React projects — removes lovable-tagger, swaps placeholder assets, prunes unused Radix deps, and cleans generated docs so the codebase ships as yours.

unboundcompute Skill

Audit how a mobile app handles a deep link, app link, or custom-scheme URL, so an attacker-supplied URL cannot drive a sensitive action or reach a trusted WebView context. Covers a custom scheme any app can register and hijack, an app link whose domain association is unverified so the link is not exclusively the app's, a deep-link parameter that flows unvalidated into a sensitive action, an attacker-controlled URL loaded into a WebView, and a JavaScript bridge exposed to a WebView that can load untrusted content. Use when reviewing deep-link routing, URL handling, and WebView configuration, not the manifest export state of the component that receives the link (that is the component-exposure skill). The attacker-supplied URL is the source, a sensitive action or a trusted WebView bridge acting on it is the sink, and a link parameter trusted without validation is the bug.

unboundcompute Skill

Hunt local privilege escalation and code execution through the dynamic loader: a preload environment variable honored across a privilege boundary, a writable directory on the runtime library search path, an embedded run-path that points at a writable or origin-relative location, and libraries loaded by an unqualified name. Covers preload variables that survive a privilege transition through a service manager or delegation rule, world- or group-writable library directories a privileged binary searches, run-path entries relative to a writable component, and dynamic loads of a short name. Use when auditing a privileged binary, service, or image for loader-based hijacking. The attacker-controlled library or variable is the source, the loader mapping it into the privileged process is the sink, and the unstripped or writable search path is the bug.

unboundcompute Skill

Hunt reflected and stored cross-site scripting in server-rendered responses, where untrusted request or stored data is placed into an HTML response in a context whose encoding is missing or wrong, so the value becomes markup or script that runs in the victim's session. Covers the output context that decides the correct encoding, HTML body versus quoted or unquoted attribute versus inline script versus URL versus CSS, a template raw or safe marker that disables autoescaping, JSON embedded in a page, and the reflected versus stored delivery paths. Use when reviewing server-side templates or string-built HTML that include request or database data; DOM-based sinks are a separate skill. The untrusted data rendered into the page is the source, the HTML output context is the sink, and script execution in the victim's session is the bug.

inbharatai Skill

Generate pure CSS art and illustrations — portraits, landscapes, UI elements, and interactive CSS-only animations.

inbharatai Skill

Create high-fidelity UI mockups in HTML/CSS — dashboards, mobile screens, landing pages, and component previews.

inbharatai Skill

Automatically fill PDF and HTML forms from structured data — applications, registrations, and government forms.

inbharatai Skill

Create animated SVGs with GSAP or CSS — loaders, illustrations, icon animations, and micro-interactions.

inbharatai Skill

Build harmonious color palettes — complementary, analogous, triadic schemes with WCAG contrast checks and CSS variable exports.

daemon-blockint-tech Bundle

Designs, builds, and maintains client SDKs for HTTP/REST, GraphQL, gRPC, and RPC-style APIs— OpenAPI-first contract alignment, resource modeling, authentication (API keys, OAuth, signing), retries/timeouts/idempotency, pagination and streaming, error taxonomy, versioning and deprecation, multi-language packaging and naming, developer experience (quickstarts, examples), and SDK testing (contract and integration) with documentation aligned to API reference. Use when the user says SDK engineer, client SDK, build an SDK, API client library, OpenAPI SDK, SDK design, SDK versioning, retry policy SDK, pagination client, SDK authentication, or developer SDK—not backend API design only (api-development), end-user app UI (senior-frontend-software-engineer), generic integration platform patterns (platform-engineer), technical writing without SDK implementation (tech-writer-researcher), or pre-flight architecture go/no-go without SDK work (build-validator).

daemon-blockint-tech Bundle

Guides data visualization design—chart type selection for message and audience, honest scales and labeling, color and accessibility, executive and operational dashboard layout, actuarial and insurance charts (loss triangles, trends, distributions), ethics and misleading-viz avoidance, and visualization specs for engineers versus slides. Tool-agnostic patterns (matplotlib, plotly, Tableau concepts). Use when the user says "data visualization", "chart type", "dashboard design", "visualize this data", "which chart should I use", "misleading chart", "accessible chart", "executive dashboard", "loss triangle chart", or "data viz spec"—not full statistical analysis, BI platform admin, ETL pipelines, narrative-only storytelling, or hands-on warehouse or dbt modeling.

daemon-blockint-tech Bundle

Guides performance engineering—profiling (CPU, memory, I/O), distributed tracing, latency and throughput analysis, load/soak/stress testing, capacity models, performance budgets, database query tuning, and regression detection in CI. Use when investigating slow endpoints, p99 regressions, memory leaks, saturation, flaky load tests, defining latency SLOs, or producing optimization reports with evidence—not for CI/CD pipeline build (devops), rollout cutover strategy (deployment-strategist), warehouse dimensional modeling (data-warehouse-engineer), React/UI implementation (senior-frontend-software-engineer), facility compute utilization (data-center-compute-supply-efficiency), or LLM token/cost research (research-engineer-scientist-tokens).

daemon-blockint-tech Bundle

Guides web application development—browser-based products spanning UI, HTTP APIs, sessions and cookies, routing (SPA and SSR), forms, file uploads, and web-specific security (CSRF, CORS, CSP, XSS prevention) on stacks such as React/Next.js, Vue, or similar with Node/Python/Ruby backends. Use when building or maintaining a web app, implementing login flows, server-rendered or hybrid pages, REST/GraphQL consumption, or debugging browser–server issues—not for mobile native apps, CLI tools, or data pipelines. For generic full-stack feature delivery use fullstack-software-engineer; for front-end-only work use senior-frontend-software-engineer; for deploy/CI use devops. For design-to-code UI implementation (tokens, states, Storybook) without auth/CORS focus, use ui-software-engineer.

daemon-blockint-tech Bundle

Guides senior full-stack delivery across TypeScript/React/Next.js frontends, Node or Python APIs, relational databases, authentication, testing, performance, and pragmatic system design for product features. Use when implementing end-to-end features, designing REST/GraphQL contracts, refactoring UI and backend, debugging production issues in app code, or reviewing PRs for maintainability—not for standard full-stack IC delivery without senior scope (fullstack-software-engineer), CI/CD platform work (devops), security program design (cybersecurity), ML modeling (data-scientist), or LLM prompt/agent design (ai-engineer, prompt-engineer).

daemon-blockint-tech Bundle

Guides full-stack software engineering—end-to-end product features across web frontends (React/Next.js or similar), backend APIs (Node/TypeScript or Python), databases, auth, testing, and production debugging for maintainable application code. Use when building or fixing user-facing features, designing REST/GraphQL/tRPC contracts, implementing forms and API routes, writing migrations, adding tests, or reviewing application PRs—not for CI/CD platforms (devops), cloud VPC/IaC (infrastructure-engineer), data warehouse modeling (data-warehouse-engineer), LLM/RAG features (ai-engineer), or org security/compliance programs (cybersecurity, compliance-engineer). For browser web-app patterns (sessions, CSRF, CORS, CSP, SSR/SPA routing), use web-application-developer. For senior-level system design and mentorship-style review, also use senior-fullstack-developer. UI-only from design: ui-software-engineer. Ticket repro without code: support-engineer.

unboundcompute Skill

Audit an Android app for components another app on the device can reach and drive, after the manifest export flags and permission gates are resolved. Covers an activity, service, broadcast receiver, or content provider exported without a permission gate, an intent filter that makes a component implicitly exported, a provider that grants URI access or exposes files across the app boundary, a permission declared with a weak protection level, and a component that trusts intent extras from an untrusted caller for a sensitive action. Use when reviewing the manifest and the component code that handles an inbound intent, not the deep-link URL trust that a WebView loads (that is the deep-link skill). A cross-app caller is the source, a reachable exported component acting on the intent is the sink, and a sensitive component another app can invoke unguarded is the bug.

unboundcompute Skill

Audit a file-upload and content-handling path for an attacker-supplied file whose bytes, declared type, name, or embedded content reach a sink that stores it in a served or executable location or feeds it to a parser that acts on its content, after the type-decision layer and the serve behavior are resolved. Covers an extension or content-type trusted for a type decision that a second layer contradicts, an SVG, HTML, or XML file stored and served inline as active content, image or document parser exploitation, a polyglot file passing one content check yet executing in another context, an upload path writing outside the intended directory, and an archive expanding to a write primitive. Use when reviewing upload validation, storage, and serving, not the client-side DOM sink or the archive-extraction write primitive their own skills own. An uploaded file is the source, a serve or parse sink acting on its content is the sink, and a type decision one layer contradicts is the bug.

unboundcompute Skill

Hunt content-type sniffing and parser confusion where untrusted content is served or consumed with an ambiguous or attacker-influenced type, so a browser sniffs a response as HTML, a backend picks a different interpretation than the sender intended, or two parsers on one path disagree. Use when user content is echoed with a missing, wrong, or user-controlled content type, when uploads are typed by extension or by the client, or when a request body can be parsed more than one way. Covers response sniffing, upload-filter bypass, polyglot files, charset-driven scripting, and multipart differentials. The ambiguously typed content is the source, the sniffer or parser that resolves the type is the sink, and the interpretation the attacker forces is the bug.

unboundcompute Skill

Hunt mobile interface redressing, where another app draws over or intercepts a sensitive screen so the user acts on the attacker's terms without knowing it, approving a permission, confirming a transaction, or entering a secret while an overlay hides or fakes what they are really touching, because the sensitive screen does not detect that it is obscured, does not filter touches passed through an overlay, or does not bind the confirmation to what the user actually saw. Use when a mobile app presents consent, confirmation, or credential-entry screens that another app could overlay or intercept. Covers tap hijacking through overlays, obscured-touch acceptance, accessibility-driven interaction, and confirmations not bound to the displayed action. The overlaying or intercepting app is the source, the sensitive screen accepting the redirected interaction is the sink, and the user approving what they did not intend is the bug.

unboundcompute Skill

Hunt at-rest exposure of secrets on iOS, where a credential, token, or sensitive value is stored with a keychain accessibility class or a data-protection class weaker than it needs, so it is readable when the device is locked, survives into a device backup, or is reachable by another app or after theft, because the item is marked always-accessible, is not restricted to this device, or the file protection lets it be read outside an unlocked session. Use when reviewing how an app stores secrets and files and which protection class each carries. Covers over-permissive keychain accessibility, missing this-device-only restriction, backup-included secrets, and weak file data-protection classes. The secret stored under a weak protection class is the source, the read outside the intended unlocked and on-device context is the sink, and recovering a usable secret in that weaker context is the bug.

unboundcompute Skill

Hunt abuse of server-side renderers of user-supplied markup, such as headless-browser PDF or screenshot generation, SVG rasterization, thumbnailers, and chart or document renderers, where the renderer fetches remote or local resources, follows redirects, executes embedded script, or reads local files while producing output. Use when untrusted HTML, SVG, or a URL is handed to a rendering component server-side. Covers server-side request forgery including to cloud metadata, local file disclosure through file schemes or external entities, blind out-of-band interaction, and script execution inside the generated document. The untrusted markup or URL is the source, the resolving renderer is the sink, and the fetch, file read, or script execution it performs is the bug.

unboundcompute Skill

Audit Android privilege and access leaks through intent redirection and mutable pending intents, where a privileged component receives an intent carrying a nested intent it then launches, or hands out a pending intent an untrusted app can fill in, so the untrusted caller reaches a protected component or acts with the privileged app's identity, because the component forwards an attacker-supplied intent without constraint or the pending intent is mutable and under-specified. Use when an Android app forwards intents extracted from input or shares pending intents with other apps. Covers nested-intent redirection to protected components, mutable pending intents, implicit pending-intent delivery, and forwarding that carries the app's permissions. The attacker-supplied nested or fillable intent is the source, the privileged component launching or sending it is the sink, and reaching a protected target with the app's identity is the bug.

quantumquirkxyz Skill

Model astrophysical systems — stellar structure, orbital dynamics, cosmology, gravitational waves — with physical scales, order-of-magnitude estimates, and scaling laws.

quantumquirkxyz Skill

Design React component structure and state seams — with composability, testability, and clear data flow.

quantumquirkxyz Skill

Shape mobile projects around device constraints, offline behavior, and platform seams — with explicit performance and resilience boundaries.

quantumquirkxyz Skill

Shape Next.js projects around routes, server/client seams, and data flow that stay deep rather than tangled.

inbharatai Skill

Create Vue 3 components with Composition API — composables, Pinia store integration, TypeScript, and unit tests.

inbharatai Skill

Design pixel-perfect frontend UIs with HTML/CSS/Tailwind — responsive layouts, component libraries, and design-to-code workflows.

inbharatai Skill

Build production-ready React components — hooks, context, accessibility, TypeScript types, and Storybook stories.

inbharatai Skill

Build Svelte 5 components — runes, stores, SvelteKit routing, and server-side rendering.

inbharatai Skill

Develop Angular components — services, pipes, directives, reactive forms, RxJS, and Angular Material.

inbharatai Skill

Build data-rich infographics as SVG or HTML — timelines, process flows, comparison charts, and statistical summaries.