All Skills

Improves structure without behavior changes, using tests and focused slices; not for features unless behavior change is explicit.

Applies practical test-first and regression testing to behavior changes, bug fixes, state transitions, and public contracts.

Routes UI evidence, comparisons, critiques, references, best practices, and design research to one research workflow.

Builds a compact secret-safe repository pack for AI handoff, review, or large analysis; prefers Repomix when available.

Models threats for a service, feature, endpoint, integration, or architecture: assets, attackers, boundaries, flows, and abuse cases.

Syncs implemented UI to Figma as editable layers, Code Connect mappings, components, tokens, and handoff.

Applies safe Home Assistant rules for automations, templates, integrations, entity behavior, startup states, and validation.

Use only at validation, integration, completion, release, or drift-review boundaries. Do not load for every implementation step.

Routes ambiguous review or planning to one leaf workflow. Do not use for a clear code, security, UI, architecture, or migration review.

Routes ambiguous security work to one leaf skill. Do not use when a specific security review or fix is already clear.

Routes ambiguous or multi-domain engineering requests to the smallest ordered skill set. Do not use for clear single-skill work or same-task follow-ups.

Maps domains, ownership, dependencies, entry points, tests, services, and risks before broad changes, review, migration, or handoff.

Plans framework, API, schema, service, package, UI, build, or infrastructure migrations with slices, rollback, and validation.

Analyzes repeated agent failures or noisy routing and proposes evidence-backed changes to instructions, skills, gates, or runbooks.

Use only when simplicity, assumption checks, dead-code avoidance, or overengineering resistance is requested. Do not use by default.

Fixes one security finding with the smallest safe patch, regression coverage, and verification.

Validates rendered UI with browser or Playwright screenshots after implementation, redesign, responsive changes, or visual regressions.

Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

Runs read-only parallel review of a PR, branch, commit, or diff across bugs, security, tests, maintainability, performance, and UI.

Merges agent or review outputs into one deduplicated, evidence-linked, severity-ranked actionable report.

Reviews UI accessibility: keyboard, focus, semantics, labels, contrast, motion, forms, dialogs, tables, and screen readers.

Guides module boundaries, dependency direction, and domain structure. Do not use for local edits that leave architecture unchanged.

Extracts tokens, typography, spacing, component states, assets, layout, responsive rules, and interactions from a UI reference.

Triages CVEs and advisories for affected versions, reachability, exploitability, upgrades, and validation.

Checks desktop, tablet, and mobile UI for overflow, clipping, navigation, grid, canvas, and breakpoint regressions.

Reviews parsers, deserialization, uploads, archives, YAML/JSON/XML/pickle, paths, templates, SSRF, and unsafe loaders.

Checks how well a Linear cycle is prepared. Reports per-person load in working days against available days, tickets with no estimate, tickets nobody is assigned to, oversized tickets that need splitting, work that did not finish last cycle, on-call rotation cost, and how groomed the backlog behind the cycle is. Invoke when the user says "cyclotic", "cyclotic prep", "cyclotic prep next", "cyclotic review", "cyclotic init", "cyclotic configure", "cyclotic for" a person's name, "cyclotic show cards", "cyclotic list tickets", "cyclotic explain" a person's name, or adds "-v" or "verbose" to any of those. Also invoke when the user asks whether a cycle or sprint is ready, who is over or under capacity, what carried over from last cycle, which tickets still need estimates, how the backlog looks going into planning, what is in the cycle and at what sizes, or how one person's load adds up. Read-only against Linear.

Audits source code for observability gaps — missing telemetry, poor observability practices, and code structure that resists instrumentation — then emits a ranked, bounded finding list. Invoke when the user says "observablip this", "observablip `pkg/foo`", "audit observability", "review telemetry", "find missing spans", "audit o11y on this PR", "review my logging", or "is this instrumented well enough?". Read-only; never edits files.

当要用测试先行的方式落地一段行为改动时使用——如"用 TDD 实现这个功能、先写测试再写实现、红绿循环推进、修 bug 先写复现测试"。在约定 seam 上一次一个行为走红→绿→验证，并当场把命令与输出落盘成可核对的执行记录。composable 层能力单元，通常由 execute-task 在每个任务内调用。不要用于：给已写完的实现事后补测试、只跑测试不改代码、纯定位 bug 不改行为、代码评审、任务拆分。

Grilling

当用户已有确认过的技术设计（理想来自 make-design），要在编码前把它拆成可独立验收、带依赖与验证方式的开发任务清单时使用——如"拆任务、把技术方案拆成开发任务、生成 tasks、列实现任务清单、把设计落地成可执行任务"。不要用于：技术方案还没定（先 make-design）、行为还没钉死（先 write-spec）、想法还模糊（先 refine-idea）、写具体实现代码或逐行施工单、调试、代码评审。

当用户想测试或复盘某个 skill 的实际执行效果时使用——如“测一下这个 skill”“看看 agent 是否按 skill 执行”“生成 skill 覆盖率或溯源报告”。在隔离沙箱中发起一次 headless 盲测，逐步骤溯源并产出中文复盘报告。不要用于编写新 skill、调试业务代码、代码审查，或复盘当前会话已经发生的执行。

在要求写结构化的 spec、规格文档、行为规格或验收标准时使用。

当用户已有确认过的开发任务清单（理想来自 split-task），要把它逐个落地成实现 + 测试 + 提交，并经验收确认真的做完时使用——如"执行任务、把 tasks 做掉、按任务清单开始编码、实现这些任务、推进开发"。不要用于：任务还没拆（先 split-task）、技术方案没定（先 make-design）、行为没钉死（先 write-spec）、想法还模糊（先 refine-idea）、只做单个改动的红绿闭环（那是 tdd）、只做一次代码审查（那是 review-changes）、单纯调试某个 bug、代码评审。

当一段开发完成，要给当前分支 / worktree 收尾时使用——如"收尾、把这个分支收掉、开发完了怎么处理、合并还是留着"。通常由 execute-task 执行完后调用。先只读预检状态，再清除本次开发遗留的调试代码、跑最终测试，然后给出合并/本地保留/创建 PR/丢弃选项；提交、合并、推送、删除与移除工作树都交用户拍板。不要用于：开发还没完、建立工作区（那是 setup-worktree）。

当一段改动已经写完、要在收尾或合并前对它做一次独立审查时使用——如"审一遍这条分支、review 这次改动、这批代码有没有问题、帮我把关再合"。先把 BASE..HEAD 生成一份审查包一次读完，再按 correctness / readability / architecture / security / performance 五轴加测试质量逐项判定，输出带 file:line 的 Critical / Important / Minor 分级 findings。composable 层能力单元，通常由 execute-task 在整体验收时调用。不要用于：改动还没写完、只想跑测试、要的是动手修复而不是审查、评审需求或技术方案本身。