Results for “audit”

Technical architecture guide for building a multi-purpose consent preference center. Covers per-purpose granularity, easy withdrawal under Article 7(3), version history, audit trails, and IAB Transparency and Consent Framework v2.2 integration. Includes database schema, API design, and UI component specifications.

Detect and exploit DOM-based XSS vulnerabilities by auditing JavaScript for tainted data flow from controllable sources to dangerous sinks, with payloads and bypass techniques for client-side testing.

Runs a comprehensive mobile QA audit covering permissions, deep links, push notifications, offline mode, background/foreground transitions, memory leaks, network conditions, accessibility, and platform edge cases for Flutter, React Native, and native iOS/Android apps.

Use when designing or auditing the evaluation of an ASE (IEEE/ACM Automated Software Engineering) paper, covering real subject systems, fair runnable tool baselines, task-matched effectiveness metrics, ablations that isolate a learned component, oracle and correctness validation, contamination-aware LLM handling, and provenance for mining.

any input (code, docs, papers, images) → knowledge graph → clustered communities → HTML + JSON + audit report. Use when user asks any question about a codebase, project content, architecture, or file relationships — especially if graphify-out/ exists. Provides persistent graph with god nodes, community detection, and BFS/DFS query tools.

Audits and fixes technical SEO, on-page metadata, structured data, Core Web Vitals, llms.txt, and AI-search optimization for ChatGPT, Perplexity, and AI Overviews, including E-E-A-T signals and programmatic SEO.

Audit images across AEM Edge Delivery Services pages for SEO and performance, checking alt text quality, dimensions, lazy loading, fetch priority, file naming, and decorative image handling, and generate per-page reports with fix instructions.

Make the agent solve coding tasks with the least code that remains correct. Before writing code, walk the Ponytail ladder: skip what need not exist, then prefer stdlib, native platform features, already-installed dependencies, one line, and only then the minimum custom code. Use when the user asks for ponytail mode, less code, YAGNI, anti-bloat, minimal code, an over-engineering review, a current-diff delete-list, a whole-repo bloat audit, or a `ponytail:` tech-debt harvest. Keep validation, data-loss handling, security, and accessibility. Mark shortcuts with `ponytail:` plus the upgrade path. Triggers on: ponytail, /ponytail, /ponytail-review, /ponytail-audit, /ponytail-debt, write less code, YAGNI, over-engineering, anti-bloat, minimal code, do I need this, lazy dev.

This skill should be used when setting up, auditing, or enforcing internationalization/localization in UI codebases (React/TS, i18next or similar, JSON locales), including installing/configuring the i18n framework, replacing hard-coded strings, ensuring en-US/zh-CN coverage, mapping error codes to localized messages, and validating key parity, pluralization, and formatting.

Detects all languages used on a webpage — both declared (html@lang, hreflang, nested lang=, meta content-language) and actually present in the body text using Google CLD3 WASM. Reconciles the two signal sets and flags mismatches for i18n audits, hreflang validation, and multilingual content verification.

Composite skill — design, scaffold, build, and verify a UI in one workflow. Chains ui-ux-pro-max or web-design-guidelines (audit/principles) → shadcn or tailwind-design-system (component scaffold) → impeccable or frontend-design (build) → webapp-testing (verify). Use when the task is "build this page", "design and implement X", or any new UI surface.

Use to decide which support channels to offer, add, or retire, and to audit channel mix against accessibility obligations and cost to serve. Trigger for "should we add chat", "which channels should we offer", channel strategy, cost to serve by channel, accessibility requirements for support, opening a new contact route, or retiring phone or email.

Analyzes web performance using Chrome DevTools MCP. Measures Core Web Vitals (LCP, INP, CLS) and supplementary metrics (FCP, TBT, Speed Index), identifies render-blocking resources, network dependency chains, layout shifts, caching issues, and accessibility gaps. Use when asked to audit, profile, debug, or optimize page load performance, Lighthouse scores, or site speed. Biases towards retrieval from current documentation over pre-trained knowledge.

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector).

Analyzes web performance using Chrome DevTools MCP. Measures Core Web Vitals (LCP, INP, CLS) and supplementary metrics (FCP, TBT, Speed Index), identifies render-blocking resources, network dependency chains, layout shifts, caching issues, and accessibility gaps. Use when asked to audit, profile, debug, or optimize page load performance, Lighthouse scores, or site speed. Biases towards retrieval from current documentation over pre-trained knowledge.

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector).

Shipley-methodology federal proposal outline and section drafter. USE WHEN the user asks to draft a proposal volume, build an outline from the proposal_instruction ↔ evaluation_factor traceability (UCF Section L/M or equivalent for non-UCF — FAR 16 task orders, FOPRs, BPA calls, OTAs, agency-specific formats), generate a compliance matrix, write win themes, draft an executive summary, propose FAB (Feature → Advantage → Benefit) chains, identify discriminators, or 'respond to this RFP'. Pulls requirements, evaluation factors, instructions, customer priorities, and pain points from the active Theseus workspace KG and produces an evidence-cited draft. Also ships govcon HTML render templates under assets/ — hand the rendered content off to the `huashu-design` skill for PPTX / PDF / animation export. Format-agnostic — never assumes UCF section labels are present. DO NOT USE FOR clause compliance auditing only (use compliance-auditor) or extracting new entities (use govcon-ontology + the Theseus pipeline).

Modern authentication implementation for 2026 - passkeys (WebAuthn), OAuth (Google, Apple), magic links, and cross-device sync. Use for passwordless-first authentication, social login setup, Supabase Auth, Next.js auth flows, and multi-factor authentication. Activate on "passkeys", "WebAuthn", "Google Sign-In", "Apple Sign-In", "magic link", "passwordless", "authentication", "login", "OAuth", "social login". NOT for session management without auth (use standard JWT docs), authorization/RBAC (use security-auditor), or API key management (use api-architect).

Build an animation from scratch, making the decisions in the order that determines whether it feels right — should it animate at all, what purpose, which tool, which properties, which curve and duration, how it interrupts, how it exits. Writes the implementation. Use when asked to animate something, add motion, make a component feel alive, or build a transition. For critiquing existing motion use `review-animations`; for auditing a whole codebase use `improve-animations`. Source: github.com/emilkowalski/skills.

WordPress performance optimization: performance, slow query, N+1 query, Query Monitor, autoload audit, autoload options, object cache, Redis, wp_cache, transient, cache invalidation, Core Web Vitals, LCP, CLS, INP, FID, profiling, Xdebug, microtime, pre_get_posts, database query optimization, TTFB, page load, Vite bundle, lazy loading, critical CSS — benchmark before/after, never optimize blind. Invoke for: slow page load, N+1 query problem, caching strategy, transient API, dequeue unused scripts, performance profiling, Core Web Vitals improvement.

Encodes Emil Kowalski's design engineering philosophy — UI polish, component design, animation decisions, and the invisible details that make software feel great. Use as the reference/philosophy layer for interaction craft. For the narrower, task-specific pieces of this same philosophy, see `animate` (build one animation), `review-animations` (review a diff), `improve-animations` (audit a codebase), `find-animation-opportunities` (find what's missing motion), `animation-vocabulary` (name an effect), `apple-design` (gesture/spring physics), `ask-sonner` (the Sonner toast library). Source: github.com/emilkowalski/skills.

HTML Forms + Sage integration — log1x/sage-html-forms, hf_get_form, addPostObject html-form, Blade form views, x-form.* shared components, hf-validation JS module, hf-success hf-error hf-submitted events, Constraint Validation API, form traps pattern escaping type-tel ValidityState non-enumerable — stateless contact forms with progressive JS validation on top of the HTML Forms WordPress plugin. Invoke for: contact form with HTML Forms plugin, hf_get_form usage, form validation with Constraint API, pattern escaping trap, type=tel Chrome bug, form audit.

Set up, run, and contribute to TokHub (github.com/yaojingang/TokHub) — an open-source AI API relay monitoring, recommendation, and OpenAI-compatible gateway system with L1/L2/L3 channel health probing, usage metering, alerts, audit, and Docker self-hosting. Use when the user asks about TokHub, "AI API 中转站监控", cloning/running the Go + React monorepo (TOKHUB_ROLE, sqlc, TimescaleDB, NATS), the L1/L2/L3 probe algorithm, the OpenAI-compatible `/gateway/v1/*` endpoint, or contributing a PR to TokHub. Do not use for connecting a running agent to a live TokHub instance's own API (that is covered by the project's own bundled `agent-skills/tokhub` skill inside the TokHub repo, not this one).

Capture exact React element context from a live browser UI and hand it to an AI coding agent as component name, source file path, line number, and HTML. Use when the user wants `react-grab`, element-context copy, component-source lookup from the browser, clipboard-to-agent React debugging, or MCP-backed element selection for React apps. Not for generic browser automation or login/session reuse (`browser-harness`, `playwriter`), broad UI annotation/review (`agentation`), React performance audits (`react-best-practices`), or general design-system work (`design-system`). Triggers on: react-grab, grab element context, copy component to AI, browser component picker, React component inspector, clipboard component source, get element context from browser, grab UI element.

Audits an EXISTING UI/codebase for generic AI patterns and applies targeted craft fixes — layout, interactivity, content, iconography, and code quality — without discarding the project's own identity. Use when a UI looks flat, generic, or "AI-slop" and there is code to improve, not build from scratch. Triggers on: "improve the design", "looks generic", "not polished enough", "redesign this", "elevate the UI", "it looks boring", "make it better looking", "apply taste", "design review". Works with any CSS framework. For designing a NEW project's identity from a brief, use `taste-skill` instead — this skill only upgrades what's already built. Source: github.com/Leonxlnx/taste-skill (redesign-skill), restored to the full checklist + the project-identity rule the earlier port had dropped.

A Cursor Canvas is a live React app that the user can open beside the chat. You MUST use a canvas when the agent produces a standalone analytical artifact — quantitative analyses, billing investigations, security audits, architecture reviews, data-heavy content, timelines, charts, tables, interactive explorations, repeatable tools, or any response that benefits from visual layout. Especially prefer a canvas when presenting results from MCP tools (Datadog, Databricks, Linear, Sentry, Slack, etc.) where the data is the deliverable — render it in a rich canvas rather than dumping it into a markdown table or code block. If you catch yourself about to write a markdown table, stop and use a canvas instead. You MUST also read this skill whenever you create, edit, or debug any .canvas.tsx file.

Analyze a website page's UI for obvious oddities: the same information repeated multiple times (a phone number shown three times in the header, a '24/7' badge in two places, a bullet list restating the paragraph above it), duplicated or near-duplicate copy and sections, stray/orphaned text near CTAs, copy that doesn't match the business or section subject, placeholder text, overcrowded heroes, misaligned elements, and imagery that doesn't fit the business. Use this whenever the user asks to check, audit, review, sanity-check, QA, or 'look over' a web page, landing page, or UI — whether they give a live URL, a localhost/dev-server URL, a screenshot, or HTML/JSX/template files — even if they only say something casual like 'does this page look right?', 'find anything weird on this page', or 'anything off about my landing page?'.

Anti-slop frontend design skill for building NEW landing pages, portfolios, and UI from a brief. Reads the brief and existing brand context first, infers a design direction from three configurable dials (variance, motion, density), and ships interfaces that don't look templated or default-AI. Use when starting a new page/UI with no existing identity to preserve, or when asked to design something "that doesn't look like every other AI landing page." For auditing and upgrading an EXISTING UI, use `taste-redesign` instead — this skill is for the moment before code exists. Triggers on: "build a landing page", "design a portfolio", "make this not look generic/templated/AI-generated", "anti-slop", starting UI work with a brief but no established identity yet. Also owns component-library selection (which package for toasts, dropdowns, charts, drag-and-drop, state, etc.) — use this instead of hand-rolling a component or guessing at a dependency. Source: github.com/Leonxlnx/taste-skill (taste-skill, the main v2 varian