Cursor Kenji

Exploratory ("monkey") QA of a live app as GUEST then LOGGED-IN, then diff. Headed playwright-cli, junk inputs, nav abuse. Use when "monkey test the app", "exploratory QA", "wander like a confused user", or "guest vs logged in". Story CRUD → test-qa. Hostile sweep → test-red-team. This-diff PDCA → test-playwright.

First-contact orientation for an unfamiliar codebase. Use when "I'm new to this repo", "orient me", "explain this codebase", "what does this do?", "onboard me", "first day on this project", or "catch me up on the codebase".

Analyse and shrink JavaScript bundle size for any web app. Use when asked to "reduce bundle size", "analyse bundle", "tree shaking", "lazy loading", "code splitting", "slow initial load", "large JS", "chunk size", "build performance", "LCP caused by JS", "why is the bundle so big", or "first load JS too large".

Review this PR or diff for quality, security, and maintainability. Use when reviewing pull requests, examining a named change set, or the user asks for a code review of current work. Repo-wide anti-patterns → audit-code-quality. Bulk transform semantics → audit-codemod-safety.

Audit and optimize application runtime performance (Core Web Vitals, slow code, load time). Use when "slow page", "LCP/INP/CLS", or "optimize performance". JS payload → audit-bundle-size. Concurrent breaking point → test-load. Timeouts/retries → audit-resilience.

Cross-page UX audit for user stories, task completion, and information architecture — the layer audit-ux (per-page heuristics) skips. Use when "audit user flows", "IA audit", "can users find X", "navigation audit", or "funnel drop-off". Full DS burndown → plan-uiux-unification.

Build or upgrade web forms to production quality: accessible structure, schema-driven validation, client↔server parity. Use when "improve this form", "form validation", "accessible form", "multi-step form", "form error handling", or "the form UX is bad".

Add 3D and scroll-driven motion to an existing website or web app — Three.js / React Three Fiber for the scene, GSAP ScrollTrigger for scroll-driven choreography, and Motion /. Use when the user asks to "add 3D", "add a WebGL hero", "make it cinematic", "scroll-driven 3D", "three.js scene", "React Three Fiber", "GSAP.

Full end-to-end Mushi Mushi integration smoke test: bug capture → AI triage → story mapping → TDD test generation → approval → execution → PDCA cycle. Use when "test mushi integration", "verify full pipeline", "mushi e2e check", "does mushi work end-to-end", "smoke test mushi", or after deploying changes.

Exhaustive audit for stubs, dead buttons, fake components, unwired handlers, and dead links — then a wiring plan, no implementation. Use when "find dead buttons", "stub checker", "fake components", "unwired handlers", or "dead links". Live QA → test-qa.

Guide for refactoring code to improve quality without changing behavior. Use when refactoring, cleaning up code, reducing duplication, improving readability, or restructuring code. Integrates Firecrawl for researching modern patterns before refactoring, and codebase-aware dependency analysis to avoid breaking changes.

Stop vibe-coding with a spec → plan → TDD loop before writing a line. Use for any non-trivial feature, refactor, or bug fix on web, React Native, or Capacitor. Use when asked to "build", "implement", "add a feature", "this keeps breaking", "do it properly", or when LLM output keeps being wrong.

Detect and fix repo-wide anti-patterns and consistency drift (naming, organisation, repeated smells). Use when "code smell", "anti-pattern", "technical debt", or "standardize the codebase". This PR/diff review → audit-code-review.

Run a PDCA quality audit on LLM/AI features: traces, prompts, costs, evals, grounding, hallucination. Use for "audit LLM quality", "check Langfuse", "audit prompts", "check AI quality", "audit AI costs", "check traces". Jailbreak/OWASP LLM → audit-llm-security. Token caps → plan-llm-cost-guardrails.

Read-only OWASP LLM Top 10 audit of app-facing AI features: prompt injection, data leak, supply chain, poisoning, unsafe output, excessive agency, system-prompt leak, RAG/embedding risks, misinformation, unbounded consumption. Use when "audit LLM security", "prompt injection", "jailbreak my chatbot", "is my AI safe".

Build interactive, accessible charts, graphs, and data dashboards using Recharts, D3, or Victory. Use when the user says "chart", "graph", "data visualization", "analytics dashboard", "metrics display", "D3", "Recharts", "time-series", or "data display".

Create or update Cursor agent skills (SKILL.md). Use when authoring a new skill, updating an existing skill, or asking about SKILL.md structure and best practices.

Audit a site for answer-engine / GEO citation readiness (ChatGPT, Perplexity, AI Overviews), then a phased plan. Use when "AEO", "GEO", "show up in ChatGPT/Perplexity", "AI search visibility", "llms.txt", or "am I blocking AI crawlers". Classic SEO meta/sitemap → enhance-web-seo.

Audit the working tree and git history for exposed credentials and mis-scoped keys, then a rotate-vs-relocate plan. Use when "hardcoded secrets", "did I commit a key", "secret scan", "is my .env safe", or "rotate keys". Do not fire for "RLS audit" or generic "security burndown".

User-story-driven test coverage audit and plan — no test writing in this pass. Use when "test coverage plan", "coverage audit", "traceability matrix", "fake-green tests", "uncovered user stories", "plan tests for critical flows", or "whats not tested". Mutation score / assertion theater → test-mutation.

Repo housekeeping: sync READMEs to match current architecture, remove dead files (logs, screenshots, deprecated code, build artifacts), update npm/pip/cargo dependencies to latest. Use when asked to: "housekeep", "clean up repo", "update README", "update dependencies", "fix vulnerabilities", "remove dead code", "tidy.

Automated WCAG 2.2 accessibility audit using playwright-cli to crawl every page, inject axe-core via eval, test keyboard navigation, check color contrast, ARIA labels, and heading order. Use when "audit accessibility", "check a11y", "WCAG audit", "check keyboard nav", or "test screen reader".

Close an approved plan with zero plan-related deferrals: implement every unfinished item, absorb every connected out-of-scope/follow-up/nice-to-have item parked by prior runs, fix. Use when a plan was marked done with work deferred, or the user says "complete everything", "don't defer", "fix out of scope too", "finish.

Design mobile-first UIs: touch targets, safe areas, gestures, then enhance up. Use when building for small screens, touch, swipe, PWA, or tablet. Linearized desktop / responsive audit → audit-responsive.

Build landing pages, portfolios, and marketing sites that don't look AI-generated. Use when asked for "landing page", "portfolio", "marketing site", "anti-slop", "Awwwards-style", "premium frontend", or when design needs a strong point of view.

Close the post-launch improvement loop for any shipped app. Use when asked to "improve the app after launch", "fix the top issues", "post-launch polish", "what should I fix next", "production issues", "iterate on feedback", "post-release improvements", "what is broken in prod", "ship a polish pass", or "make it better.

Audit a project for destructive-operation and migration safety gaps, then produce a phased safeguard plan. Use when "is my migration safe", "could I lose data", "my agent might delete prod", or "safe schema changes". Restore drills and RPO/RTO belong to plan-backup-dr. Source transforms → audit-codemod-safety.

Audit a codebase for silent failures, swallowed exceptions, and observability gaps across Sentry and Langfuse, then produce a phased fix plan. Use when the user says "errors aren't showing in Sentry", "things fail silently", "empty catch blocks", "add error handling", "check my Langfuse tracing", or is hardening.

OWASP Top 10 + Supabase-first hardening burndown. Use when "security audit plan", "OWASP audit", "hardening plan", or "security burndown". App-layer auth flows → audit-auth-flows. Table RLS → plan-rls-audit. Key rotation → plan-secrets-audit. App LLM attacks → audit-llm-security.

Generate clear, descriptive commit messages following conventional commits format. Use when committing code, writing commit messages, or when the user asks for help with git commits.

Drive an entire repository to a fully green baseline — typecheck, lint, tests, and build all passing from a clean checkout — when the user has explicitly authorized fixing. Use when "make the repo green", "get CI passing", "fix all the failing tests". Ratchet integrity → audit-gate-logic.

Read-only audit of a codemod or bulk mechanical transform for behavior-preservation — compiles/lints is not same-behavior. Use when "did this codemod break anything", "audit this bulk refactor", or before merging a mass find-replace. Diff quality → audit-code-review. SQL → plan-data-integrity.