← all publishers

ahtishamshahzad

@ahtishamshahzad source repo

Report this profile Claim this profile

• 177 skills
• 0 followers
• 13 hours ago last updated

1. ▌
   Playwright E2e 2 · ahtishamshahzad

   Use to plan web/dashboard end-to-end tests with Playwright — a small set of critical user journeys against a real browser and running app, resilient to timing (auto-wait, no sleeps), covering happy path plus key invalid/error/authorization-denied flows. Reserved for flows that justify E2E cost.
   0
   installs
2. ▌
   Database Security 2 · ahtishamshahzad

   Use to review database security from an audit/threat lens — least-privilege access, network exposure, injection surface, encryption of sensitive data, tenant isolation depth, and PII handling — verifying the data-layer hardening holds. The security-review lens; the database pack owns the build-side design.
   0
   installs
3. ▌
   Flaky Test Audit · ahtishamshahzad

   Use to find, diagnose, and fix flaky tests — nondeterministic passes/failures from timing, shared state, ordering, real time/randomness, or live externals. Fix the root cause; quarantine only temporarily. A trusted suite is the goal, not a green-by-retry one.
   0
   installs
4. ▌
   Web State Management · ahtishamshahzad

   Use to decide where each piece of web app state lives — local component, form, shared client, server cache, URL, or persisted — before picking any state library. URL state is first-class on the web; server data belongs to the server-state layer, not a global store.
   0
   installs
5. ▌
   Application Documentation · ahtishamshahzad

   Use to place and maintain the documentation of the applications being built — the `docs/` tree, one folder per app, indexed at every level, with a file per screen, page, endpoint, or job. Distinct from `.ai/`, which holds plans and system rules, not product documentation. Docs ship with the change that causes them.
   0
   installs
6. ▌
   Nestjs Foundation · ahtishamshahzad

   Use to plan a NestJS foundation after NestJS is approved — module boundaries, dependency injection, providers, pipes/guards/interceptors/filters, config module, conventions for a multi-developer codebase. Plans only; scaffolds nothing without task approval.
   0
   installs
7. ▌
   Mongoose Mongodb · ahtishamshahzad

   Use to plan Mongoose over MongoDB — expressing the approved document design as schemas with real validation, indexes declared and built deliberately, lean queries, middleware discipline, and transactions only where the design demands them.
   0
   installs
8. ▌
   Incident Readiness · ahtishamshahzad

   Use to prepare for production incidents — on-call and escalation, severity levels, runbooks for likely failures, alert-to-response wiring, communication paths, and blameless postmortems that feed regression tests. Preparation before incidents, not response during one.
   0
   installs
9. ▌
   Monitoring Logging · ahtishamshahzad

   Use to plan production monitoring and logging at the ops level — centralized structured logs, key metrics/dashboards, health checks, symptom-based alerting with ownership, uptime/synthetic checks, and cost/retention — so failures are seen fast. Application instrumentation is backend-observability.
   0
   installs
10. ▌
    Monorepo Selection · ahtishamshahzad

    Use when a monorepo is chosen to pick the workspace/tooling — pnpm/npm workspaces alone vs adding Turborepo for task orchestration and caching — based on app count, build complexity, and CI needs. Evaluates rather than defaulting to the heaviest option.
    0
    installs
11. ▌
    Secrets Management · ahtishamshahzad

    Use to plan secret storage and handling — a secret store (not git), per-environment separation, least-privilege access, rotation, injection at runtime/CI, and keeping secrets out of code, logs, images, and client bundles. Auditing existing secret exposure is secrets-audit.
    0
    installs
12. ▌
    Mobile File Upload · ahtishamshahzad

    Use to plan file uploads from mobile — picking files/images, size/type limits, progress, retries, and secure transfer to storage/backend. Validate on the server; keep uploads off executable paths.
    0
    installs
13. ▌
    Mobile Maestro E2e · ahtishamshahzad

    Use to plan Maestro end-to-end tests for critical mobile flows on real device/emulator. Select Maestro when critical mobile E2E flows exist; cover the critical path (auth, checkout, core journeys) rather than every screen.
    0
    installs
14. ▌
    Mobile Performance · ahtishamshahzad

    Use to plan and diagnose mobile performance — list rendering, re-renders, image/memory usage, startup, and jank — measured on a representative build. Prefer measured, safe fixes over rewrites. The mobile arm of performance-review.
    0
    installs
15. ▌
    Abuse Prevention · ahtishamshahzad

    Use to review whether public and expensive endpoints are protected against automated abuse — rate limiting, CAPTCHA/bot defenses, and cost controls on signup, login, reset, OTP, contact, search, and expensive operations. Verifies abuse defenses hold; distinct from authorization.
    0
    installs
16. ▌
    Testing Selection · ahtishamshahzad

    Use to choose which test types and tools a project needs — Playwright (web/dashboard E2E), Maestro (mobile E2E/smoke), Supertest (backend API integration), Testing Library (components), Jest/Vitest (unit + integration logic). Selects only what the project's applications and risks justify; does not adopt every tool by default.
    0
    installs
17. ▌
    Visual Regression · ahtishamshahzad

    Use to decide whether visual regression testing is warranted and, if so, plan it — baseline snapshots of key screens/components, deterministic rendering, review-gated diffs, and scoped coverage — without turning it into a flaky, noise-generating burden.
    0
    installs
18. ▌
    Dashboard Permissions · ahtishamshahzad

    Use to plan admin-dashboard permissions — admin role granularity, a permission matrix per admin action, server-side enforcement, audit logging of admin actions, impersonation safeguards, and least-privilege defaults. Builds on web-authorization for the admin surface.
    0
    installs
19. ▌
    Vite React Foundation · ahtishamshahzad

    Use to plan a Vite + React SPA foundation after Vite is chosen — TypeScript, project structure, client router selection, env handling (VITE_ exposure, no secrets), build/preview, linting, and SPA host fallback. Plans only; scaffolds and installs nothing without approval.
    0
    installs
20. ▌
    Web Component Testing · ahtishamshahzad

    Use to plan component tests — React Testing Library with user-event, accessible queries (getByRole first), MSW for network boundaries, testing behavior not implementation, and knowing jsdom's limits (real-browser behavior belongs to Playwright). Avoid snapshot overuse.
    0
    installs
21. ▌
    Backend Deployment · ahtishamshahzad

    Use to plan backend deployment — target selection, environment config/secrets, build artifact (container) discipline, migration-on-deploy ordering, zero-downtime rollout with health checks, worker/scheduler deployment, and rollback. Deploys require approval.
    0
    installs
22. ▌
    Backend Validation · ahtishamshahzad

    Use to plan server-side input validation — schema validation at every entry point (body, params, query, headers, files, webhooks, jobs), unknown-field stripping, and type-safe validated output. The server is authoritative; client validation is UX only.
    0
    installs
23. ▌
    Express Foundation · ahtishamshahzad

    Use to plan an Express API foundation after Express is approved — layered structure (routes/controllers/services/data), middleware order, config, error handler, baseline security middleware. Plans only; scaffolds nothing without task approval.
    0
    installs
24. ▌
    GRAPHQL API Design · ahtishamshahzad

    Use to decide whether GraphQL fits and to design a GraphQL API — schema/type design, resolvers, N+1 protection (dataloaders), pagination (connections), mutations/errors, query cost limits, and field-level authorization.
    0
    installs
25. ▌
    Database Security · ahtishamshahzad

    Use to plan database security — least-privilege credentials, network isolation, injection prevention (parameterized-only), encryption at rest/in transit, PII classification and minimization, tenant isolation at the data layer, and access auditing.
    0
    installs
26. ▌
    Prisma Relational · ahtishamshahzad

    Use to plan Prisma over PostgreSQL/MySQL — expressing the approved schema in the Prisma schema, migration workflow, client usage patterns (select scope, N+1 avoidance, transactions), and where Prisma's abstractions end (raw SQL escape hatch).
    0
    installs
27. ▌
    Repository Strategy · ahtishamshahzad

    Use to decide how a project's applications are organized into repositories — single repo, monorepo, or multiple repos — based on shared code, coupling, team boundaries, and release cadence. A decision, not a default; feeds monorepo-selection when a monorepo is chosen.
    0
    installs
28. ▌
    Staging Environment · ahtishamshahzad

    Use to plan a staging environment that meaningfully mirrors production — same artifact, production-parity config/data-shape, isolated from production data, exercising migrations and integrations before prod, and running smoke/E2E as a pre-production gate.
    0
    installs
29. ▌
    Mobile Camera Media · ahtishamshahzad

    Use to plan camera and media capture — permissions, capture/pick flows, image/video handling, and resizing/compression before upload. Requires native support (dev build or CLI).
    0
    installs
30. ▌
    Mobile Deep Linking · ahtishamshahzad

    Use to plan deep links and universal/app links — URL scheme, link config, route resolution, and handling cold vs warm starts. Coordinates with navigation and notifications.
    0
    installs
31. ▌
    Mobile Server State · ahtishamshahzad

    Use to plan server-state caching for mobile — RTK Query or TanStack Query — for fetching, caching, invalidation, retries, and offline behavior. Keeps server data out of client stores.
    0
    installs
32. ▌
    Mobile Unit Testing · ahtishamshahzad

    Use to plan unit tests for mobile logic — Jest (or Vitest where supported) for pure functions, hooks, reducers, and utilities. Test behavior, not implementation; align with the approved stack.
    0
    installs
33. ▌
    Mobile Vector Icons · ahtishamshahzad

    Use to plan icon usage — an icon set/library choice, sizing/color via theme, and lean bundling — avoiding shipping entire icon fonts unnecessarily.
    0
    installs
34. ▌
    Regression Testing · ahtishamshahzad

    Use to ensure every fixed bug and every critical behavior stays fixed — a failing-first test per bug at the lowest level that reproduces it, plus a maintained regression suite gating CI so old breakage can't silently return.
    0
    installs
35. ▌
    Dashboard Architecture · ahtishamshahzad

    Use to decide where an admin dashboard lives — inside the customer web app, as a route group, as a separate application, or in a separate repository — weighing user roles, deployment boundaries, security boundaries, team ownership, UI system sharing, and release cadence. Placement is a decision, not a default.
    0
    installs
36. ▌
    Backend Performance · ahtishamshahzad

    Use to diagnose and fix measured backend performance problems — profiling first, then N+1 and query work (with the database pack), caching with explicit invalidation, connection pooling, payload size, and event-loop health. No speculative optimization.
    0
    installs
37. ▌
    Email Notifications · ahtishamshahzad

    Use to plan transactional email and notification delivery — provider choice, template management, sending via background jobs, deliverability (SPF/DKIM/DMARC), bounce/complaint handling, and abuse-safe triggering.
    0
    installs
38. ▌
    Database Selection · ahtishamshahzad

    Use to choose the database (PostgreSQL, MySQL, MongoDB) and — separately — the data layer (Prisma, Drizzle, Mongoose, native driver). Relational is usually right for payments, orders, inventory, reporting, financial data, transactions, strong relations; MongoDB fits highly variable documents with embedded access patterns.
    0
    installs
39. ▌
    Drizzle Relational · ahtishamshahzad

    Use to plan Drizzle over PostgreSQL/MySQL — TypeScript table definitions expressing the approved schema, drizzle-kit migration workflow, SQL-proximate query patterns (joins, prepared statements, transactions), and type flow to the app boundary.
    0
    installs
40. ▌
    Deployment Selection · ahtishamshahzad

    Use to choose deployment targets per application — managed PaaS, container platform, serverless, static/edge hosting, mobile stores — based on app type, ops capacity, scaling, and cost. Evaluates rather than defaulting; a stack decision requiring approval. Does not provision infrastructure.
    0
    installs
41. ▌
    Production Readiness · ahtishamshahzad

    Use as the pre-launch go/no-go checklist — confirming tests/security passed, config/secrets/migrations/backups/monitoring/rollback/incident-response are all in place before a production deploy. Aggregates readiness signals; the release gate. Approval required to ship.
    0
    installs
42. ▌
    Turborepo Foundation · ahtishamshahzad

    Use to plan a Turborepo setup after it's chosen — task pipeline definition (dependsOn), input/output declarations for correct caching, affected-only execution, and CI integration. Plans configuration; does not scaffold apps.
    0
    installs
43. ▌
    Mobile Accessibility · ahtishamshahzad

    Use to plan mobile accessibility — screen-reader labels/roles, focus order, touch target sizes, contrast, and dynamic type — so the app is usable with assistive tech. Bakes accessibility into components, not bolts it on.
    0
    installs
44. ▌
    Mobile Authorization · ahtishamshahzad

    Use to plan authorization — role/permission gating of screens and actions, protected navigation, and server-verified access. Roles are enforced server-side; the client hides UI only as a convenience.
    0
    installs
45. ▌
    Mobile Design System · ahtishamshahzad

    Use to plan a mobile design system — tokens, spacing, typography scale, color palette, and reusable component primitives — before building screens. Establishes consistency; coordinates with theme, fonts, and accessibility.
    0
    installs
46. ▌
    Mobile Location Maps · ahtishamshahzad

    Use to plan location and maps — foreground/background location permissions, a maps provider, markers/regions, and battery-aware location usage. Requires native support (dev build or CLI).
    0
    installs
47. ▌
    Mobile Notifications · ahtishamshahzad

    Use to plan push/local notifications — provider (Expo push / FCM / APNs), permissions, token registration, handling foreground/background, and deep-link routing from taps. Requires native support (dev build or CLI).
    0
    installs
48. ▌
    Mobile Project Audit · ahtishamshahzad

    Use when a mobile app already exists, before changing it — inventory the runtime (Expo vs CLI), navigation, state, native modules, build config, and iOS/Android readiness. Read-only; grounds mobile planning in reality. Delegates deep security/performance to their skills.
    0
    installs
49. ▌
    Integration Testing · ahtishamshahzad

    Use to plan integration tests across module and I/O boundaries — real database, real wiring, faked externals — covering happy path, invalid input, error path, and authorization denial. For HTTP API specifics use api-integration-testing.
    0
    installs
50. ▌
    Test Coverage Audit · ahtishamshahzad

    Use to assess test coverage by risk, not by percentage — find untested critical paths (auth, money, data integrity, error/denial paths) and missing required cases, and recommend targeted tests. Never chase a coverage number without risk justification.
    0
    installs
51. ▌
    Backend Unit Testing · ahtishamshahzad

    Use to plan backend unit tests — services and pure business logic tested in isolation with focused test doubles, fast and deterministic, covering edge and failure paths. Route/database/HTTP coverage belongs to integration testing.
    0
    installs
52. ▌
    Database Migrations · ahtishamshahzad

    Use to plan schema-migration discipline — versioned immutable migration files, review of generated SQL, deploy-time ordering, zero-downtime expand/contract changes, rollback reality, and environment drift prevention. Data backfills are the data-migration skill.
    0
    installs
53. ▌
    Mobile Authentication · ahtishamshahzad

    Use to plan mobile authentication — login/signup, token/session handling, secure token storage, refresh, and logout — coordinating with secure storage, API integration, and the auth provider. Client auth is UX; the server enforces.
    0
    installs
54. ▌
    Mobile Error Handling · ahtishamshahzad

    Use to plan error handling — error boundaries, async/network error handling, user-facing fallback UI, and crash reporting (e.g. Sentry) — so failures degrade gracefully and are observed.
    0
    installs
55. ▌
    Mobile Native Modules · ahtishamshahzad

    Use to plan native module usage or authoring — evaluating existing packages/config plugins first, and planning custom native modules (iOS/Android) only when needed. Prefer Expo config plugins/dev builds before ejecting.
    0
    installs
56. ▌
    Mobile Secure Storage · ahtishamshahzad

    Use to plan secure on-device storage — Keychain/Keystore for tokens and sensitive data vs async storage for non-sensitive data — with clear rules on what may be persisted where. No secrets in plain storage or logs.
    0
    installs
57. ▌
    Dependency Security · ahtishamshahzad

    Use to assess third-party dependency risk from a security angle — known vulnerabilities, supply-chain integrity (lockfiles, pinning, provenance), typosquats/malicious packages, and CI enforcement — driving prioritized upgrades. The security lens on dependencies; dependency-audit is the general inventory.
    0
    installs
58. ▌
    Test Data Management · ahtishamshahzad

    Use to plan test data — factories over fixtures, per-test isolation, deterministic personas (users, roles, tenants) for authorization tests, and strict separation from production data. No real PII in tests; data is owned per test, not shared and mutated.
    0
    installs
59. ▌
    Backend Authorization · ahtishamshahzad

    Use to plan backend authorization — who may do what. Distinguishes authentication, role authorization, permission authorization, ownership authorization, organization/tenant scope, and object-level authorization; enforces centrally per endpoint and requires negative tests.
    0
    installs
60. ▌
    Backend Observability · ahtishamshahzad

    Use to plan backend observability — structured PII-safe logging with request correlation, metrics (rate/errors/duration, queues, jobs), health checks, alerting on symptoms, and tracing when the topology earns it.
    0
    installs
61. ▌
    Database Performance · ahtishamshahzad

    Use to diagnose and fix measured database performance problems — slow-query identification, EXPLAIN analysis, N+1 elimination, pagination of unbounded reads, connection-pool sizing, and lock-contention diagnosis. Evidence first; indexes via the indexing skill.
    0
    installs
62. ▌
    Environment Management · ahtishamshahzad

    Use to plan environment configuration across dev/staging/production — one immutable artifact configured by environment, validated typed env vars (fail fast at boot), no secrets in client bundles, and parity so behavior differs only by config. Secret storage itself is secrets-management.
    0
    installs
63. ▌
    Mobile API Integration · ahtishamshahzad

    Use to plan the HTTP transport layer — fetch vs Axios, base client, interceptors, auth headers, error mapping, and timeouts. Underpins server-state; does not itself cache.
    0
    installs
64. ▌
    Mobile Stack Selection · ahtishamshahzad

    Use to decide between Expo and React Native CLI for a mobile app, with justification. Evaluates Expo (Go, dev builds, EAS Build/Submit, OTA, common native packages) against React Native CLI (native ownership, custom modules, specialized SDKs, background behavior, CallKit/PushKit, BLE/NFC, existing native projects). Does not default to CLI.
    0
    installs
65. ▌
    Dashboard Bulk Operations · ahtishamshahzad

    Use to plan dashboard bulk operations — selection scope (page vs all-matching-filter), explicit confirmation with counts, server-side batch endpoints, per-item permission checks, progress and partial-failure reporting, idempotency, undo where feasible, and audit logging.
    0
    installs
66. ▌
    Backend Authentication · ahtishamshahzad

    Use to plan backend authentication (who the caller is) — credential storage (hashing), sessions vs JWT, token lifecycle/refresh/revocation, logout, and account flows (signup, password reset, OTP). Authentication is not authorization.
    0
    installs
67. ▌
    Backend Error Handling · ahtishamshahzad

    Use to plan backend error handling — an error taxonomy (operational vs programmer errors), one central handler, a single safe response shape, correct status mapping, and logging with correlation IDs. Internals never leak to clients.
    0
    installs
68. ▌
    Existing Backend Audit · ahtishamshahzad

    Use to inventory an existing backend before changing it — framework, structure, API surface, auth/authorization model, data layer, jobs, integrations, tests, security posture. Produces findings that feed planning; changes nothing.
    0
    installs
69. ▌
    Realtime Communication · ahtishamshahzad

    Use to decide whether realtime is needed and design it — SSE vs WebSockets vs polling, authentication on connect, room/channel authorization, reconnection with missed-event recovery, and multi-instance fan-out.
    0
    installs
70. ▌
    Role Permission Design · ahtishamshahzad

    Use to design the role and permission model — role set, permission granularity, role→permission mapping, storage/claims, admin surfaces, and evolution. Roles gate action classes; ownership/tenant checks remain separate.
    0
    installs
71. ▌
    Mobile Background Tasks · ahtishamshahzad

    Use to plan background execution — background fetch, location, audio, or task runners — within OS constraints, with battery and lifecycle awareness. Requires native support (dev build or CLI).
    0
    installs
72. ▌
    Mobile State Management · ahtishamshahzad

    Use to decide where each piece of state lives — local component state, form state, shared client state, server state, persisted state, or navigation state. Prevents dumping everything into Redux/Zustand. Chooses the lightest tool that fits each category.
    0
    installs
73. ▌
    Gherkin Specifications · ahtishamshahzad

    Use to write and review behavior specifications as Gherkin scenarios — acceptance criteria, required cases, and *.feature files — so one behavior per scenario, domain-level steps, and observable outcomes. Applies the canonical contract in system/GHERKIN_RULES.md; a Cucumber-family runner is a stack decision, the scenario format is not optional.
    0
    installs
74. ▌
    Backend Stack Selection · ahtishamshahzad

    Use to decide between Express and NestJS (or flag another fit) for a backend API, with justification. Evaluates Express (small/medium APIs, lightweight architecture, fast delivery, limited modules) against NestJS (large modular systems, multiple developers, dependency injection, queues, WebSockets, many domains, strong conventions). No universal default.
    0
    installs
75. ▌
    Ownership Authorization · ahtishamshahzad

    Use to design ownership, organization/tenant-scope, and object-level authorization — the caller may touch only their own or their tenant's resources. Scope derives from the session, never from client-supplied IDs; requires cross-user and cross-tenant negative tests.
    0
    installs
76. ▌
    Document Schema Design · ahtishamshahzad

    Use to design MongoDB document schemas — embed vs reference decided per access pattern, document identity and shape per collection, growth-bounded arrays, duplication with consistency ownership, and schema validation despite "schemaless."
    0
    installs
77. ▌
    Mobile Component Testing · ahtishamshahzad

    Use to plan component tests — React Native Testing Library for rendering, interaction, and accessibility queries — testing components as users interact with them. Complements unit and E2E tests.
    0
    installs
78. ▌
    Authorization Security · ahtishamshahzad

    Use to review authorization for security holes — IDOR/BOLA, missing ownership/tenant checks, privilege escalation, trusting client-supplied IDs/roles, and function-level access gaps — verified with negative tests. The security-review lens; backend-authorization is the design/build skill.
    0
    installs
79. ▌
    API Integration Testing · ahtishamshahzad

    Use to plan backend API integration tests with Supertest — real HTTP requests through the full middleware stack against a real database, covering happy path, invalid input, error path, and the authorization-denial negative suite (cross-user, non-admin, cross-tenant, untrusted IDs).
    0
    installs
80. ▌
    Backend API Architecture · ahtishamshahzad

    Use to define the internal architecture of a backend API — layering (transport/controllers/services/data), domain boundaries, where cross-cutting concerns live, and how modules communicate. Framework-agnostic; foundations apply it per framework.
    0
    installs
81. ▌
    Captcha Abuse Prevention · ahtishamshahzad

    Use to plan CAPTCHA and bot-abuse prevention for public endpoints — signup, login, password reset, OTP, contact forms, public search, expensive endpoints. Server-side verification, layered with rate limiting; never a substitute for authorization.
    0
    installs
82. ▌
    Third Party Integrations · ahtishamshahzad

    Use to plan integrations with external APIs — client isolation behind an interface, credential handling, timeouts/retries/circuit breaking, error mapping, sandbox vs production, and testing without live calls.
    0
    installs
83. ▌
    Mobile Environment Config · ahtishamshahzad

    Use to plan mobile environment configuration — dev/staging/prod separation, env-var handling, base URLs and keys via config (not hard-coded), and safe client exposure. No secrets in the client bundle.
    0
    installs
84. ▌
    Authentication Security · ahtishamshahzad

    Use to review authentication for security weaknesses — credential storage, session/token handling, brute-force and enumeration resistance, reset/OTP/MFA flows, and logout/revocation. The security-review lens on identity; backend-authentication is the design/build skill.
    0
    installs
85. ▌
    Relational Schema Design · ahtishamshahzad

    Use to design a relational schema — entities to tables, keys, relationship modeling (1:1/1:N/M:N), constraints as integrity enforcement, appropriate types, normalization with justified denormalization, and soft-delete/audit/money conventions.
    0
    installs
86. ▌
    React Native CLI Foundation · ahtishamshahzad

    Use to plan a React Native CLI mobile foundation after CLI is chosen — native project ownership (iOS/Android), TypeScript, navigation, safe-area, linting, and native tooling. Evaluates each baseline option against need; installs nothing without approval.
    0
    installs
87. ▌
    Backend Integration Testing · ahtishamshahzad

    Use to plan backend integration tests — real HTTP requests against the app with a real (containerized) database, covering auth flows, authorization negative tests (cross-user/cross-tenant/role), validation rejection, and webhook/job paths. External providers stay faked.
    0
    installs
88. ▌
    Test Environment Management · ahtishamshahzad

    Use to provision test environments — real production-engine datastores (containerized), faked externals, isolated per-run state, and critical environment/config validation so tests catch environment failures. Covers local, CI, and ephemeral E2E targets.
    0
    installs
89. ▌
    Security Regression Testing · ahtishamshahzad

    Use to turn security findings and threats into automated tests that stay green — negative tests for authorization/injection/abuse, a test per fixed vulnerability, and CI enforcement so security regressions can't silently return. Security's regression discipline.
    0
    installs
90. ▌
    Code Review · ahtishamshahzad

    Use to review a change or diff for correctness, clarity, maintainability, and convention-fit before it advances. Reports findings with severity, separating confirmed defects from suggestions; does not rubber-stamp.
    0
    installs
91. ▌
    Web SEO · ahtishamshahzad

    Use to plan SEO for web apps where search visibility matters — per-page metadata, Open Graph/Twitter cards, sitemap, robots, canonical URLs, structured data (JSON-LD), and rendering strategy for indexable content. Applies to public/marketing surfaces; skip for authenticated dashboards.
    0
    installs
92. ▌
    CI CD · ahtishamshahzad

    Use to design the CI/CD pipeline generated from the project's selected applications and test selection — jobs like install, lint, typecheck, unit, API, Playwright, mobile, build, security checks, deployment. Only generate jobs for applications that exist; deploys are approval-gated. Does not scaffold infrastructure.
    0
    installs
93. ▌
    Git Workflow · ahtishamshahzad

    Use to plan and perform branching, commits, and PRs safely. Branches off the default branch, never commits/pushes without being asked, keeps secrets out of history, and gates git actions behind the relevant hooks and quality gates.
    0
    installs
94. ▌
    Documentation · ahtishamshahzad

    Use to write or update documentation of the work inside `.ai/` — decisions, project state, work items, knowledge, generated reports — concisely and in its canonical place. For the applications' own documentation (the `docs/` tree), use `application-documentation` instead.
    0
    installs
95. ▌
    Task Planning · ahtishamshahzad

    Use to generate dynamic phases and break them into concrete, verifiable tasks with inputs, outputs, acceptance criteria, and dependencies. Produces the implementation plan approved at Gate 4. Phases are derived from real work, never a fixed template.
    0
    installs
96. ▌
    Web Forms · ahtishamshahzad

    Use to plan web forms — React Hook Form (or framework-native alternatives), Zod schema validation at the edges, accessible inline error UX, submit states, and multi-step flows; on Next.js, whether server actions handle submission. Client validation is UX; the server enforces.
    0
    installs
97. ▌
    Web Theme · ahtishamshahzad

    Use to plan light/dark theming on top of design tokens — system preference detection, manual override with persistence, SSR flash avoidance on Next.js, and contrast validation in both themes. Themes switch token values; components never hardcode colors.
    0
    installs
98. ▌
    Queues · ahtishamshahzad

    Use to select and design queue infrastructure — broker choice (e.g. BullMQ/Redis, SQS, RabbitMQ), queue topology, workers/concurrency, delivery semantics, dead-letter queues, and monitoring. Job behavior itself is the background-jobs skill.
    0
    installs
99. ▌
    Security Review · ahtishamshahzad

    Use to assess a change or codebase for security weaknesses — secrets, auth, authorization/IDOR, injection, PII handling, transport/errors, payments, and production hardening. Reports findings by severity, separates confirmed from potential, never prints secret values, and never claims "secure."
    0
    installs
100. ▌
     Web Routing · ahtishamshahzad

     Use to plan web app routing — route tree, layouts, nested routes, dynamic segments, route groups, protected routes, and URL-carried state. Covers Next.js App Router conventions and client router selection (React Router / TanStack Router) for Vite apps. Client-side protection is UX; the server enforces.
     0
     installs