Llm Skills

Evidence-based pre-flight release gate that passes or blocks a branch or pull request. Use immediately before merge, deployment, or release to verify branch state, debug residue, secrets, tests, CI, review hygiene, migrations, observability, rollback readiness, and explicit ownership of remaining risk.

Evidence-backed engineering retrospective grounded in delivery artifacts. Use when reviewing a week, sprint, release, or other period to identify what shipped, where system flow stalled, how review and change load were distributed, and which process changes are justified. Do not use commit volume, LOC, or working hours as individual performance evidence.

Implement settled work with the smallest correct production-grade change. Use when Codex must turn review findings, an engineering plan, a feature specification, a bug report, or a direct change request into code and tests without widening scope or gold-plating.

Diagnose and fix broken, flaky, or failing tests without weakening assertions or hiding failures behind retries. Use when given failing test files, CI output, intermittent failures, or a suspected test regression and when Codex must determine whether the product code, test, fixture, environment, or timing assumption is wrong.

Zero-assumption dependency audit. Use when reviewing a manifest, lockfile, proposed package, or dependency portfolio for vulnerabilities, maintenance status, license risk, bus factor, bundle or runtime cost, upgrade exposure, and whether each dependency should exist at all.

Systematic technical-debt inventory with an operational cost model. Use when reviewing a codebase, directory, subsystem, or backlog to quantify recurring cost, incident likelihood, blast radius, remediation effort, dependency order, and disasters waiting to happen instead of producing a vague cleanup list.

Zero-assumption accessibility audit against WCAG 2.2 AA or higher. Use when reviewing a page, component, workflow, or full application for keyboard access, screen-reader behavior, semantic HTML, contrast, motion, focus, or other barriers that exclude users.

Zero-assumption API design review from the consumer's perspective. Use when reviewing API routes, controller code, SDK contracts, or an OpenAPI specification for usability, error shapes, authentication, pagination, versioning, idempotency, compatibility, and rate limiting.

Evidence-backed, blameless incident postmortem. Use after an outage, security event, failed deployment, data incident, or material near miss to reconstruct the timeline from git, deploys, metrics, and logs; identify technical and control failures; and define owned corrective actions.

Zero-assumption test-suite audit focused on real confidence rather than coverage percentage. Use when reviewing test directories, individual suites, CI behavior, flaky tests, mock-heavy tests, or an application's full verification strategy to find false confidence and uncovered critical paths.

Write missing high-signal tests that verify behavior and catch realistic bugs. Use when given source files, functions, review findings, regressions, acceptance criteria, or coverage gaps that require focused unit, integration, contract, or end-to-end tests, especially for failure and boundary paths.

Highly opinionated user interface designer that produces design direction, not implementation. Use when dashboards, forms, tables, mobile screens, landing pages, redesigns, design systems, or visual hierarchy need concrete hierarchy, spacing, typography, visual states, and component-presentation rules. Use ux-designer for workflow meaning and a11y-audit for conformance.

Highly opinionated user experience designer that produces workflow direction, not implementation. Use when onboarding, checkout, dashboards, forms, navigation, information architecture, state meaning, recovery, or feature flows need less friction and clearer time-to-value. Use ui-designer for visual presentation and a11y-audit for conformance.

Zero-assumption developer-experience audit. Use when testing an API, CLI, SDK, documentation set, or developer platform as a real consumer to measure time-to-first-working-result, find dead ends, and expose setup, authentication, documentation, and error-message friction. Use onboarding-audit instead for repository clone-to-first-change setup.

Evidence-based provider release gate for Apple, AWS, Azure, Cloudflare, Google Cloud, Supabase, and Vercel. Use immediately before a platform deployment, App Store submission, production promotion, or provider configuration change to verify identity, environment, runtime configuration, rollout, observability, and rollback using the matching provider reference.

First-principles review of a named codebase or product section, calibrated to project stage. Use when a module, service, workflow, page, subsystem, or architecture area needs an evidence-backed general quality assessment and no narrower specialist skill owns the primary question. Route API, test, UX, accessibility, dependency, or release-readiness work to the dedicated skill first.

Orchestrate multiple specialist reviews against one target and synthesize a prioritized, deduplicated verdict. Use when a pre-merge review, deep audit, project-health check, post-incident review, test overhaul, design audit, or operational-risk review genuinely needs several independent review skills or subagents.

Paranoid staff-engineer code review for production risk that ordinary CI misses. Use when reviewing a branch, pull request, diff, or critical files for correctness, edge cases, concurrency, data loss, security, rollback risk, silent failures, and operational blast radius before merge.

Engineering plan review before code is written. Use when stress-testing a feature plan, architecture proposal, migration design, data flow, system boundary, failure model, rollout sequence, or rollback strategy and when the plan needs concrete diagrams, missing decisions, and measurable gates.

Evidence-backed security review that traces concrete exploit and abuse paths across trust boundaries. Use when reviewing authentication, authorization, admin actions, uploads, parsers, webhooks, secrets, sensitive data, exposed APIs, background jobs, or other surfaces where an attacker or careless operator could gain access, escalate privilege, alter data, or cause material harm.

Evidence-backed transition review for database schemas, stored data, APIs, events, queues, files, and cross-service contracts. Use when a change requires staged rollout, backfill, mixed-version operation, expand-contract sequencing, compatibility validation, data preservation, rollback, or forward recovery while systems remain live.

Zero-knowledge repository onboarding audit. Use when testing whether a new developer can clone, configure, understand, run, test, and safely change a project without tribal knowledge, undocumented credentials, external searches, or hidden setup steps.

Developer-experience plan review before implementation. Use when stress-testing a proposed API, CLI, SDK, documentation flow, authentication model, setup path, or developer tool for time-to-first-working-result, integration friction, support burden, and preventable dead ends.

Evidence-backed reliability and operability review for services, distributed workflows, queues, scheduled jobs, integrations, and critical user paths. Use when evaluating timeouts, retries, backpressure, partial failure, degradation, alerting, recovery, capacity limits, or silent data and processing failures under real production conditions.

Product-value review before implementation. Use when deciding whether a feature, workflow, integration, or product proposal should exist, what user problem it actually solves, what the constrained MVP is, and which scope should be removed before engineering begins.