Skills Web Dev

Use when implementing or reviewing iOS AI and ML features with Apple on-device frameworks, model evaluation, and privacy controls; use ios-architecture for general module boundaries.

Use when securing an AI/LLM-powered feature against prompt injection, cross-tenant data leakage and tenant isolation failures, jailbreaks, and adversarial inputs. Covers PII scrubbing before model calls, output validation, rate limiting, audit logging, and DPPA/GDPR compliance for AI data flows.

Use when designing or building an AI-enhanced web app with chat, RAG, MCP tools, streaming, provider abstraction, feature gates, token budgets, and output guardrails.

Use when designing AI analytics, dashboards, SaaS AI metrics, NLP analytics, predictive analytics, or executive AI insight workflows. Orchestrates the former granular AI analytics skills as references.

Use when setting up quality assurance for AI features — defining evaluation criteria, measuring output quality, using AI-as-judge, monitoring production AI, detecting drift, and building user feedback loops

Use when bootstrapping a multi-tenant SaaS Seeder Template, including environment, database, super admin, panel verification, recurring demo activity refreshes, and demo-login shortcuts.

Use when specifying one AI-powered feature end to end, including model choice, prompt and context contracts, output schema, fallbacks, human oversight, UX states, and evaluation.

Use when building features that answer questions from private data, documents, policies, or time-sensitive information — RAG architecture, chunking strategies, hybrid search, re-ranking, vector databases, evaluation, agentic RAG, multimodal RAG...

Use when designing or building an LLM gateway for provider abstraction, tenant-aware routing, fallbacks, quotas, residency, audit logging, cost capture, and kill-switch enforcement.

Use when developing Android behaviour test-first across Kotlin, Room, repositories, ViewModels, and Compose; use android-development for architecture not centred on a test workflow.

Use when building or reviewing native iOS applications with Swift, SwiftUI, structured concurrency, security, tests, and performance gates; use focused iOS skills for persistence, release, or monetisation.

Use when building Python agents with the OpenAI Agents SDK, including runners, tools, handoffs, guardrails, tracing, memory, multi-agent topology, and deterministic orchestration.

Use when defining iOS module boundaries, dependency direction, state ownership, App Intent integration, or AI provider seams; use ios-development for feature implementation details.

Use when implementing iOS purchases, subscriptions, StoreKit 2 verification, entitlement delivery, paywalls, or App Store server events; use ios-development for non-commerce features.

Use when integrating Stripe one-time payments, PaymentIntents, SetupIntents, Checkout, SCA, multi-currency, idempotency, or webhooks.

Use when integrating an LLM provider into an application with streaming, structured outputs, tool calls, embeddings, multi-model routing, retries, caching, and usage metering.

Use when designing or building AI-powered application systems — choosing architecture style, selecting components, structuring the AI stack, making build-vs-buy decisions, and planning multi-tenant AI module gating

Use when converting an approved long-running plan into self-contained execution prompts across sessions or workers. Covers dependency order, checkpoints, capability fallback and evidence handoff; use world-class-engineering for a single implementation slice.

Use when producing any human-facing artefact. Applies real-time anti-slop controls for specificity, verification, authored intent, hard cases, language, code, UI, and release quality.

Use when modeling, metering, attributing, billing, or controlling AI usage costs across tenants, plans, features, providers, and agent workloads.

Use when preventing, detecting, triaging, communicating, recovering from, or reviewing AI incidents, AI errors, RCA, and postmortems.

Use when auditing or scoring an artefact for AI slop after a major iteration or before release. Produces evidence-backed findings, severity, fixes, genericness score, and an A/B/C/F verdict.

Use when generating or repairing layered AGENTS.md project guidance from verified repository structure, technology, data, and planning conventions.

Use when creating or upgrading reusable skills, specialist-role instructions, or vendor adapters. Covers agent-versus-skill boundaries, model-neutral canonical sources, triggers, capability and output contracts, progressive disclosure, validation, and repository quality gates.

Use when producing or reviewing a Data Protection Impact Assessment (DPIA) for a new feature or for Uganda DPPA-regulated, large-scale, sensitive, monitored, or high-risk personal-data processing.

Use when discovering and ranking AI use cases for a project or module and producing an opportunity register with impact, effort, cost, risk, and evidence gaps.

Use when writing, refining, or structuring prompts for AI-powered app features — system prompts, user prompt templates, few-shot examples, chain-of-thought, prompt versioning, and defensive prompting

Use when implementing or reviewing Tailwind CSS styling, responsive layouts, state variants, theme tokens, layers, grids, or build configuration. Use a design-system skill for visual direction and accessibility-wcag for formal accessibility review.

Use when designing iOS persistence, SwiftData migrations, Keychain storage, files, offline sync, or searchable app entities; use ios-architecture for broader module design.

Use when administering ArcGIS Enterprise or building real-estate-specific GIS features — ArcGIS components, publishing services, security/roles, backup/DR, plus property search, neighbourhood analysis, catchment/isochrones, market heatmaps, and real-estate-SaaS integration.

Use when designing or reviewing iOS authentication, Keychain, App Attest, privacy manifests, permissions, RBAC, tenant isolation, or AI security; use ios-development for general implementation.

Use when designing or reviewing recurring subscription lifecycle on Stripe Billing — plans/Prices, trials, proration, upgrades/downgrades, cancel/pause, Smart Retries dunning, metered usage, automatic tax, multi-currency, and the strategy choice between subscription vs perpetual and monthly vs annual.

Use when designing, hardening, or auditing network security for self-managed SaaS infrastructure, including firewalls, WAF, VPN, TLS/PKI, IDS/IPS, SSH, segmentation, DDoS, and DNS controls.

Use when defining or reviewing SaaS revenue, growth, retention, engagement, satisfaction, unit economics, or Rule-of-40 metrics.

Use when discovering, designing, prioritizing, or auditing AI-powered products for measurable business value. Applies to AI opportunity mapping, ROI cases, product strategy, client workshops, and deciding whether an AI feature should be built.

Use when building or reviewing native Android applications with Kotlin, Compose, Hilt, and layered architecture; use android-data-persistence or android-tdd for focused data and test work.

Use when designing CI/CD pipelines, stage gates, reusable workflows, short-lived cloud authentication, caching, deployment strategies, and pipeline telemetry.

Use when planning or gating iOS tests, performance, TestFlight, App Store review, CI, device coverage, or release evidence; use ios-development for implementation before the release gate.

Use when writing or reviewing modern JavaScript for browser or PHP-backed SaaS applications, including modules, asynchronous flows, error handling, language features, and performance.

Use when designing double-entry accounting inside SaaS, including automated postings, ledgers, controls, reconciliations, and reports.

Use when designing configurable SaaS or ERP platforms with multi-step business workflows, domain modules, approvals, auditability, pricing and entitlements, operational reporting, and tenant-specific variation. Covers domain boundaries, workflow states, extension points, and control design.

Use when designing agent tool catalogs, tool schemas, action gating, human approval, and human-in-the-loop control for agentic AI systems.

Use when auditing or tuning a development machine's Claude Code or Codex setup for context, model, subagent, permission, or token efficiency. Analyse local capabilities first and apply only supported reversible changes; route runner-specific details to the linked adapters.

Use when implementing GIS maps, spatial data services, maps integrations, geocoding, spatial APIs, or PostGIS-backed geospatial platforms. Load absorbed GIS mapping, maps integration, and PostGIS backend references as needed.

Use when building or reviewing Node.js servers, APIs, CLI tools, streams, asynchronous workflows, real-time systems, tests, scaling, or production deployment.

Use when sharing Kotlin business logic across Android and iOS with Kotlin Multiplatform while retaining deliberate platform boundaries; use native development skills for platform UI and release work.

Use when designing or scaling a SaaS sales organisation — sales motions, roles (SDR/BDR/AE/CSM/SE), pipeline stages, lead-to-cash, territory design, quota/commission, sales ops fundamentals, onboarding/ramp, and hiring rubrics. Sourced from "Blueprints for a SaaS Sales Organization" (van der Kooij, Pizarro).

Use when producing, reviewing, or consolidating SDLC documentation across planning, requirements, design, testing, deployment, user rollout, post-deployment, and maintenance phases. Load absorbed SDLC phase references as needed.

Use when auditing, grading, benchmarking, or conforming an entire skills engine. Measures taxonomy, doctrine, contracts, depth, routing, safety, references, output readiness, and normalisation priorities.

Use when reviewing new, imported, or changed skills for unsafe tools, installers, credential harvesting, hidden execution, prompt injection, excessive permissions, data exfiltration, or improperly retained third-party source content.

Use when scanning a codebase before deployment for critical vulnerabilities, server-error risks, unsafe AI-generated code, dependency problems, or payment misconfiguration.

Use when designing or reviewing application, API, or multi-tenant SaaS security. Produces threat models, abuse cases, authorisation matrices, secret plans, and OWASP-aligned evidence.

Use when designing HTTP APIs with OpenAPI, versioning, authentication, rate limits, idempotency, error contracts, and observability requirements.

Use when designing or operating GraphQL APIs with schemas, resolvers, authorization, pagination, federation, code generation, and hostile-input controls.

Use when implementing or reviewing client image optimisation plus authoritative server decode, validation, resize, metadata stripping, and canonical re-encoding. Use saas-managed-visual-assets for administrative asset lifecycle and frontend-performance for page budgets.

Use when implementing or reviewing a Next.js App Router application with server and client components, route handlers, middleware, caching, authentication, streaming, or deployment. Use react-development for framework-neutral components and api-design-first for external APIs.

Use when implementing or reviewing React components, hooks, state ownership, forms, rendering performance, error boundaries, or component tests. Use nextjs-app-router for Next.js server boundaries and ux-content-strategy for product content systems.

Use when integrating iOS system capabilities such as App Intents, widgets, Spotlight, biometrics, notifications, Bluetooth, media, or PDF export; use ios-development for ordinary app features.

Use when writing or reviewing PHP 8+ applications, object-oriented domain code, Laravel services, PSR-compliant packages, secure request handling, tests, or performance-sensitive PHP.

Use when adding forecasting, classification, regression, or anomaly detection to a SaaS feature — demand/sales/cash-flow forecasting, churn and risk scoring, anomaly detection — with scikit-learn, Prophet, and statsmodels. Covers data prep, model serving, monitoring, and explainability.