All Skills

Design and run a k6/Artillery load profile that measures throughput, latency percentiles, error rate, and the breaking point under concurrent traffic. Use when "load test this", "will it handle launch traffic", or "find the breaking point". Resilience-by-reading-code → audit-resilience. Never hit prod unsigned.

Write effective unit tests with best practices for any project. Use when writing tests, creating test cases, improving test coverage, increasing confidence before release, or when the user mentions testing. Mutation score / assertion theater → test-mutation.

Release npm packages end-to-end: Changesets version bump, CHANGELOG update, GitHub Actions OIDC publish, and post-release verification. Use when the user says "release to npm", "publish this package", "ship a new version", "cut a release", "update the changelog", or combines a package name with a release verb.

Design RESTful and GraphQL APIs following current best practices for naming, versioning, error shapes, and auth patterns. Use when the user says "design an API", "create endpoints", "structure my API responses", "plan API architecture", "REST vs GraphQL", or "API contract".

Generate Product Requirements Documents through structured conversation for any project. Use when starting a new feature, documenting requirements, creating specs before implementation, or needing clarity on scope and success criteria.

Add or upgrade PWA features to any web app: service worker, offline mode, install prompt, push notifications, and background sync. Use when asked to "make it a PWA", "offline support", "install prompt", "push notifications", "service worker", "add to home screen", "background sync", "Lighthouse PWA score", "app-like.

Manage the full PR lifecycle — create, review, address bot feedback, resolve conflicts, and merge. Use when creating pull requests, managing PR reviews, addressing bot feedback, or merging PRs.

Run the rest of a /shell request as a literal shell command. Use only when the user explicitly invokes /shell and wants the following text executed directly in the terminal.

Apply cohesive visual themes to artifacts (slides, docs, landing pages). Provides 11 pre-set themes with colors/fonts. Use when user mentions "apply theme", "color palette", "brand colors", "styling slides", "presentation design", "visual identity", or wants consistent styling across artifacts.

Pass/fail health check across every Mushi Mushi pipeline component — CLI credentials, API reachability, edge functions, BYOK key pool, QA cron. Use when "is mushi working", "mushi health check", "check mushi pipeline", "mushi deploy check", "pipeline not responding", or right after setup.

A Cursor Canvas is a live React app the user opens beside the chat. MUST use a canvas for standalone analytical artifacts — quantitative analyses, billing investigations, security audits, architecture reviews, data-heavy content, timelines, charts, tables, interactive explorations, repeatable tools, or any response.

Post-deploy smoke test combining all 5 tools (Sentry + Supabase + Firecrawl MCPs, plus the Langfuse and Playwright CLIs) into one workflow. Use when asked to: "verify deploy", "post-deploy check", "smoke test production", "check if deploy is healthy", "ship or rollback", "post-release check", "verify release", "deploy.

Create museum-quality visual art in .png and .pdf formats using design philosophy. Use when user asks for poster, visual design, infographic, certificate, badge, banner, social media graphic, print design, or mentions "create artwork", "design graphic", "visual identity", or "print material".

Design and implement new isolated motion — micro-interactions, page transitions, scroll, hover — with Framer Motion, CSS, or GSAP. Use when adding one animation to a new surface. Existing-app coherent pass → enhance-motion. Do not fire for "motion pass across the app".

Audit a codebase, UI, or copy for machine-generated tells across prose, visual/UI, code, and structure/IA, then produce a phased de-slop burndown. Use when the user says "feels AI-generated", "looks like AI slop", "reads like ChatGPT", "feels generic/soulless", or wants an authenticity/voice pass before launch.

Set up and run mutation testing (StrykerJS / mutmut) to measure whether tests assert behavior, not just execute lines. Use when "add mutation testing", "are our tests real", "can our test suite be gamed", or after an agent bulk-generated tests. Coverage plan → plan-test-coverage. Writing tests → test-unit.

Adversarial red-team of a running web, React Native, or Capacitor hybrid app. Use when asked to "red team this app", "attack my app", "break it", "find all the defects", "adversarial test", "pre-launch hardening", "pentest the app", or "full app QA". Naive monkey / guest vs logged-in wander → test-exploratory.

Audit an existing app's design system and motion, then apply a coherent, performant, reduced-motion-safe pass. Use when "motion pass", "animate the app", or "add micro-interactions across the app". One new isolated animation → design-motion.

Turn a plain-text README into a visually rich showcase with a theme-aware hero image, a feature tour grid, an optional animated guided-tour GIF, and updated tech badges. Use when asked to "enhance README", "make README prettier", "add screenshots to README", "showcase the app in README", "design the README", "add hero.

Artistic, research-grounded UI enhancement for making an existing page feel intentional, spacious, and human-crafted. Use when "make this page nicer/polished/premium/editorial", less crowded, better laid out, typography, or visual hierarchy. Flows/AI-templated UX → enhance-web-ux. Layout contract → audit-responsive.

Audit documentation against actual code behavior and plan corrections — no rewrites in this pass. Use when asked to "docs drift", "sync docs with code", "audit documentation", "stale README", "onboarding docs broken", "doc sync plan", "phantom docs", or "docs out of date". Why-we-chose-X / ADRs → docs-adr.

Audit a Supabase/Postgres project for Row-Level Security and access-control gaps, then produce a phased remediation plan. Use when "RLS", "is my Supabase secure", "anyone can read my data", "lock down my tables". App-layer session/route gates → audit-auth-flows.

Read-only audit of product-analytics instrumentation: event taxonomy, funnel completeness, consent-gated firing, dead/duplicate/phantom events. Use when "audit our analytics", "are we tracking the right events", "funnel instrumentation", or before iterate-post-launch. PostHog/Amplitude/Mixpanel/GA4.

Read-only audit of unhappy-path UI states vibe-coding skips — empty, loading, error, offline, zero-results, permission, overflow — then plan fixes. Use when "check empty/error states", "audit loading states", or "what happens when this fails". Dead buttons → plan-stub-checker; backend timeouts → audit-resilience.

Create distinctive, production-grade frontend interfaces that avoid generic AI aesthetics. Use when the user says "build this UI", "design this page", "make it look good", "dashboard layout", "beautify this", or "make the UI feel premium".

Build and sharpen a project's domain model — a CONTEXT.md glossary and ubiquitous language. Use when pinning down terminology, or the agent "uses the wrong words". Repo decision-memory system (INDEX.md, rejected alternatives) → docs-adr.

Measure-don't-guess performance audit across web, mobile, backend, and data layers — produces burndown and optimization plan with no fixes in this pass. Use when asked to "performance audit plan", "perf burndown", "measure before optimize", "bundle size audit", "LCP slow", "N+1 audit plan", "plan performance.

Close the PDCA loop on this session's diff. Headed playwright-cli, fix as you go. Use when "test my changes", "PDCA this". Pixel diffs → test-visual-regression. Story CRUD → test-qa. Monkey / guest vs logged-in → test-exploratory.

Read-only audit of app-layer auth — route×gate matrix, session lifecycle, OAuth, and provider traps (getSession vs getUser, middleware-as-only-gate, CVE-2025-29927). Use when "audit our auth", "check middleware protection". RLS → plan-rls-audit. OWASP checklist → audit-security.

Read-only audit of hosting, database, storage, egress, and serverless spend (Supabase, Vercel, S3/R2, edge). Use when "hosting bill is high", "cut infra costs", or a bill jumps. CI minutes → audit-cicd. Model tokens → plan-llm-cost-guardrails. Consumes test-load numbers.

Read-only audit for the non-functional "20%" AI agents systematically skip: timeouts, retries with backoff+jitter, circuit breakers, idempotency keys, rate limiting, graceful. Use when "is this production-ready", "resilience audit", "will this survive real traffic", "audit retries/timeouts/idempotency", "reliability.

Audit-and-fix linearized mobile layouts at every breakpoint — desktop is not a wide phone. Use when "responsive audit", desktop looks stacked/stretched, no max-width, breakpoint gaps, or 1440 looks like a phone. Distinct from design-mobile-first (touch/mobile-up) and audit-ux-journeys (cross-page IA).

Apply-now consolidation of a drifted design system into one token/component SSOT. Use after an approved plan-uiux-unification pass, or when "clean up the design system now", "migrate to one button", or "resolve token conflicts". Plan-only burndown → plan-uiux-unification.

Scaffold and implement Model Context Protocol (MCP) servers that expose external services, APIs, and data sources as typed tools and resources for LLM agents. Use when the user says "build an MCP server", "give Claude access to X", "create an MCP tool", "expose my API to an agent", or "AI agent integration".

Polish an existing React Native screen to feel intentional, native, and human-crafted. Use for "this screen looks off", "feels clunky on iOS", "Android version looks wrong", "jank when scrolling", "button is unreachable", or any RN-specific UX polish pass.

Configure a custom status line in the CLI. Use when the user mentions status line, statusline, statusLine, CLI status bar, prompt footer customization, or wants to add session context above the prompt.