Results for “sui”

Stripe payment processing. Covers Checkout Sessions, Payment Intents, Subscriptions, Webhooks, idempotency, and Stripe.js frontend integration. USE WHEN: user mentions "stripe", "payment", "checkout", "subscription billing", "payment intent", "payment gateway", "credit card", "invoice", "Stripe.js" DO NOT USE FOR: PayPal-only integration; cryptocurrency payments; accounting software

Flutter cross-platform development with Dart. Widgets, state management (Riverpod, BLoC), navigation, platform channels, and production patterns. USE WHEN: user mentions "Flutter", "Dart", "flutter widget", "Riverpod", "BLoC", "flutter build", "pubspec.yaml" DO NOT USE FOR: React Native - use `react-native`; Expo - use `expo`; native iOS/Android

Radix UI unstyled accessible React components. Headless primitives. USE WHEN: user mentions "Radix", "Radix UI", "headless components", "unstyled primitives", asks about "accessible components", "Radix primitives" DO NOT USE FOR: shadcn/ui (use shadcn-ui skill), styled component libraries (Material-UI, Chakra), Vue/Svelte (use Headless UI)

Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. Maps to OWASP API3:2023 Broken Object Property Level Authorization.

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

Reflected XSS occurs when user-supplied input is echoed in an HTTP response without sanitization, allowing script execution in the victim's browser. Detect via injecting `<script>alert(1)</script>`, event handlers like `onfocus`, HTML entity bypass, and encoding variants. Tools: Burp Suite, OWASP ZAP, PHP Charset Encoder (PCE), Hackvertor, XSS-Proxy, ratproxy.

API backend test generation for Nick's stack, especially Next.js App Router APIs with Supabase-aware auth assumptions. Use when testing backend routes, generating API test suites, validating authenticated vs unauthenticated access, checking malformed inputs, or building route-by-route backend coverage for projects that use /app/api or /pages/api.

Zod TypeScript schema validation library for runtime type checking. USE WHEN: user mentions "Zod", "schema validation", "form validation", "API validation", "type-safe validation", asks about "runtime validation", "React Hook Form validation" DO NOT USE FOR: Yup projects (use yup skill), class-validator/NestJS DTOs (use class-validator skill), PropTypes, compile-time only validation

Use when a feature's screens and flows are drafted and the design phase needs a navigable wireframe — a multi-screen greyscale Astro prototype where buttons and links actually work, suitable for the design gate and moderated user testing. In the A-Team pipeline it is conducted by ateam-design and consumes design.md's

Expo framework for React Native. Managed and bare workflows, Expo Router, EAS Build/Submit/Update, config plugins, and Expo SDK modules. USE WHEN: user mentions "Expo", "expo-router", "EAS Build", "expo-cli", "app.json", "expo-config-plugin", "Expo Go" DO NOT USE FOR: bare React Native without Expo - use `react-native`; Flutter - use `flutter`

Vite frontend build tool and dev server. Fast HMR and optimized builds. USE WHEN: user mentions "Vite", "vite config", "vite.config", asks about "Vite setup", "Vite dev server", "Vite build", "fast HMR" DO NOT USE FOR: Webpack projects (use webpack skill), Next.js (uses its own bundler), Create React App (uses Webpack), library builds with Rollup only

Jest testing framework. Covers unit tests, mocking, and snapshots. Use for testing React and Node.js projects. USE WHEN: user mentions "jest", "jest test", "snapshot test", asks about "jest.fn", "jest.mock", "toMatchSnapshot", "React testing" DO NOT USE FOR: E2E tests - use `playwright` or `cypress`; Vite projects - use `vitest` instead; React component testing alone - combine with `testing-library`

Yup schema validation library. Popular with Formik for form validation. Use when building forms with React/Formik or needing schema-based validation. USE WHEN: user mentions "Yup", "Formik validation", asks about "yup schema", "Formik setup", "form validation library" DO NOT USE FOR: Zod projects (use zod skill), NestJS/class-validator (use class-validator skill), new projects (prefer Zod)

Electron framework for building cross-platform desktop applications with JavaScript, HTML, and CSS. Covers architecture, IPC, security, packaging, auto-updates, and backend integration patterns. USE WHEN: user mentions "Electron", "desktop app", "cross-platform application", asks about "IPC", "main process", "renderer process", "Electron packaging", "auto-updates", "code signing", "Electron security" DO NOT USE FOR: Tauri applications - use `tauri` skill instead

Vitest testing framework. Covers unit tests, mocking, and coverage. Use for testing Vite-based and Node.js projects. USE WHEN: user mentions "vitest", "vite test", "unit test", asks about "vi.fn", "vi.mock", "test coverage", "mock functions", "test vite project" DO NOT USE FOR: E2E tests - use `playwright` instead; React component testing - combine with `testing-library`; Jest projects - use `jest` instead

Build SwiftUI views and components with best practices, navigation patterns, state management, and reusable component references.

Tauri framework for building cross-platform desktop applications with Rust backend and web frontend. Covers architecture, IPC commands, plugins, bundling, code signing, and security best practices. USE WHEN: user mentions "Tauri", "Rust desktop app", asks about "Tauri commands", "Tauri plugins", "Tauri IPC", "Rust + Svelte/React", "lightweight desktop app", "Tauri bundling", "Tauri security" DO NOT USE FOR: Electron applications - use `electron` skill instead

Generates a complete, production-ready SaaS project boilerplate with Next.js 14+, TypeScript, Tailwind CSS, shadcn/ui, Drizzle ORM, and Stripe, including authentication, database schemas, billing integration, API routes, and a working dashboard.

Researches authoritative APIs and data sources for a project, producing per-API docs, a data catalog, and an integration blueprint for a React + Supabase + Vercel + AI stack.

Reviews SwiftUI code for best practices on modern APIs, maintainability, and performance. This skill should be used when the user asks to review SwiftUI code, check for deprecated iOS/macOS APIs, validate data flow patterns, or audit accessibility compliance in Swift projects.

Deep Supabase reference — auth flows, RLS patterns, edge functions, realtime, storage, Next.js SSR integration.

Cypress E2E testing framework. Covers commands, assertions, and component testing. Use for end-to-end testing. USE WHEN: user mentions "cypress", "e2e test", "cy.get", "cy.visit", asks about "cypress intercept", "component testing", "cypress commands" DO NOT USE FOR: Unit tests - use `vitest` or `jest`; Multi-tab scenarios - Cypress doesn't support; Native mobile apps - use Appium; Performance testing - use dedicated tools

Giskard RAGET (RAG Evaluation Toolkit): automatic testset generation (simple / complex / distracting / conversational), component-level scoring (retriever / generator / rewriter), hallucination and bias tests, CI integration. Compared to RAGAS and DeepEval. USE WHEN: user mentions "Giskard", "RAGET", "Giskard RAG toolkit", "automatic testset generation", "component-level RAG scoring", "hallucination test Giskard" DO NOT USE FOR: general RAGAS usage - use `rag-evaluation`; Stanford ARES - use `ares-framework`; CI/CD wiring - use `continuous-evaluation`

tRPC for type-safe APIs. Covers routers, procedures, and React Query integration. Use for end-to-end type-safe APIs. USE WHEN: user mentions "tRPC", "type-safe API", "end-to-end types", "procedures", "tRPC router", "tRPC React Query", asks about "how to build type-safe API", "tRPC with Next.js", "tRPC middleware", "tRPC context" DO NOT USE FOR: REST APIs - use `rest-api` instead; GraphQL - use `graphql` instead; OpenAPI specs - use `openapi` instead; Non-TypeScript projects

Agent-driven RAG patterns. Self-RAG, Corrective RAG (CRAG) with web fallback, Adaptive RAG with routing classifier, ReAct with retrieval tool, multi-hop retrieval, plan-and-execute, LangGraph state machines for RAG. USE WHEN: user mentions "agentic RAG", "Self-RAG", "Corrective RAG", "CRAG", "Adaptive RAG", "multi-hop retrieval", "LangGraph RAG", "ReAct RAG", "plan and execute RAG" DO NOT USE FOR: static retrieval pipelines - use `rag-architecture`; query rewriting only - use `query-transformations`; evaluation - use `rag-evaluation`

Builds INTERACTIVE charts with the Plotly Python library (plotly.express / graph_objects) — hover tooltips, zoom/pan, animations, rangesliders, 3D rotation, and standalone HTML/web-embeddable output. Use when a chart must be interactive or web-embedded, for dashboards (incl. Dash), exploratory data analysis, or rotatable 3D plots. For static publication figures defer to alterlab-matplotlib; for static statistical charts (heatmaps, distributions) defer to alterlab-seaborn; for diagrams/schematics defer to alterlab-scientific-viz. Part of the AlterLab Academic Skills suite.

Kotlin language fundamentals. Covers null safety, coroutines, flow, sealed classes, data classes, scope functions, and Kotlin 2.x features (K2 compiler, context parameters). Use for Kotlin/JVM, Kotlin/Native, Kotlin/JS work. USE WHEN: user mentions "Kotlin", "coroutines", "suspend", "Flow", "sealed class", "data class", "scope functions", "K2 compiler", "ksp", "Kotlin 2.x" DO NOT USE FOR: Kotlin Multiplatform setup - use `mobile/kotlin-multiplatform` DO NOT USE FOR: Compose UI - use `frontend-frameworks/compose-multiplatform` DO NOT USE FOR: Spring Boot Kotlin - use `spring-boot` framework skill

Swift language fundamentals (5.10+ / 6.x). Covers optionals, value vs reference semantics, protocols & generics, Swift Concurrency (async/await, actors, Sendable, structured tasks), Result Builders, and Apple platform interop. USE WHEN: user mentions "Swift", "SwiftUI", "async/await Swift", "actor", "Sendable", "Codable", "Combine", "Result Builder", "Apple Keychain", "Secure Enclave", "iOS native" DO NOT USE FOR: SwiftUI screen layouts in depth - use SwiftUI-specific skill if exists DO NOT USE FOR: Compose iOS via Skia - use `frontend-frameworks/compose-multiplatform` DO NOT USE FOR: Kotlin/Native ↔ Swift bridging - use `languages/uniffi`

Operate Playwright for browser automation end to end: author and debug E2E test suites (robust locators, network interception and mocking, parallel workers, accessibility snapshot checks), wire them into CI, and drive headless browsing and scraping with an extract -> validate -> save loop. Use when writing, running, fixing, or scraping with Playwright, when a Playwright CI failure or JSON report needs triage, or when the bundled pwrun script should analyze a run. Do not use for QA strategy or test framework selection (route to qa-methodology), for frontend component or architecture design (route to frontend-engineering), or for Cloudflare/DDoS-GUARD challenge bypass (use flaresolverr).

Maestro — declarative E2E mobile UI testing framework by mobile.dev. YAML-based flow files, single tool for Android + iOS (and Compose Multiplatform / Flutter / React Native). Built-in cloud runner, recording mode, JS scripting for complex assertions, screen state diffing, no flakiness from explicit waits. USE WHEN: user mentions "Maestro", "maestro test", "mobile E2E", "cross-platform UI test", "maestro studio", "mobile.dev cloud", ".maestro" folder, "launchApp" YAML DO NOT USE FOR: web E2E - use `testing/playwright` DO NOT USE FOR: unit tests - use `testing/kotest`, `testing/vitest`, etc. DO NOT USE FOR: instrumented Android tests - use Espresso/Compose Test DO NOT USE FOR: snapshot tests - use `testing/compose-snapshot`