← all publishers

ahtishamshahzad

@ahtishamshahzad source repo

Report this profile Claim this profile

• 177 skills
• 0 followers
• 2 days ago last updated

1. ▌
   AI Output Review · ahtishamshahzad

   Use to critically review AI-generated output (plans, code, docs, decisions) for the failure modes AI agents are prone to — unsupported assumptions, invented facts, conflicting architecture, unnecessary dependencies, security risks, missing tests, over-engineering, scope expansion, outdated patterns, incomplete validation, and false claims of completion.
   0 installs
2. ▌
   Webhooks · ahtishamshahzad

   Use to design webhooks in both directions — inbound (verify signatures, respond fast, process async, dedupe, handle out-of-order) and outbound (signing, retries with backoff, delivery tracking, consumer docs).
   0 installs
3. ▌
   Dependency Audit · ahtishamshahzad

   Use to inventory and assess a project's dependencies — versions, known vulnerabilities, unused/duplicate packages, license and maintenance risk, and heavy additions. Recommends changes with justification; never bloats the tree "to be safe."
   0 installs
4. ▌
   Feature Planning · ahtishamshahzad

   Use to plan a feature work item — scoping new capability within existing (or planned) architecture, defining its phases, tasks, tests, and acceptance criteria without expanding scope. Delegates general phase/task mechanics to task-planning.
   0 installs
5. ▌
   Release Planning · ahtishamshahzad

   Use to validate release readiness and plan a release — tests green, docs and changelog updated, versioning handled, git workflow followed, and any publish/deploy explicitly approved. Enforces Gate 7; never ships on a failed gate.
   0 installs
6. ▌
   Testing Strategy · ahtishamshahzad

   Use to choose testing levels and tools per application and change, proportional to risk, and to define what "tested" means for the work. Aligns with the approved stack; every bug fix gets a regression test. Honest about what was actually run.
   0 installs
7. ▌
   Bug Investigation · ahtishamshahzad

   Use to diagnose and plan the fix for a defect — audit, reproduce, find root cause, fix minimally, add a regression test, and validate. Fixes the cause, not the symptom, and pins it so it can't return.
   0 installs
8. ▌
   Indexing · ahtishamshahzad

   Use to design indexes from actual query patterns — composite column order, covering/partial/unique indexes, foreign-key and tenant-key coverage, MongoDB compound/ESR ordering, verification via query plans, and write-cost awareness.
   0 installs
9. ▌
   Environment Audit · ahtishamshahzad

   Use to assess environment and configuration health — env-var usage and fail-fast, config/secrets handling, build/runtime settings, and parity across dev/staging/prod. Flags exposure and missing validation without printing secret values.
   0 installs
10. ▌
    Github Repository · ahtishamshahzad

    Use to plan and (only with explicit approval) perform GitHub repository operations — creation, visibility, remotes, topics, PRs, protections. Repository creation and any outward-facing action require explicit user approval and least-privilege tool access.
    0 installs
11. ▌
    Refactor Planning · ahtishamshahzad

    Use to plan a behavior-preserving structural improvement — audit the target, ensure test coverage exists, plan small reversible steps, and verify behavior is unchanged. Any intended behavior change is a feature, not a refactor.
    0 installs
12. ▌
    Seed Data · ahtishamshahzad

    Use to plan seed data — reference data the app requires (idempotent, environment-aware), development fixtures via factories, deterministic test seeds, and the hard rule that production seeding is limited, reviewed reference data only.
    0 installs
13. ▌
    Migration Planning · ahtishamshahzad

    Use to plan a move from one state to another (framework/version/data/schema/infra) safely and incrementally, with a compatibility strategy, per-step verification, a rollback path, and an explicit cutover. Production migrations require approval.
    2 installs
14. ▌
    Performance Review · ahtishamshahzad

    Use to find and plan fixes for real performance bottlenecks — measured, not guessed. Covers rendering/re-renders, data access, network, memory, and startup. Recommends safe, measurable improvements over risky rewrites and validates in a representative build.
    0 installs
15. ▌
    Playwright E2e · ahtishamshahzad

    Use to plan Playwright end-to-end tests for critical web journeys — authentication and authorization, forms, dashboards, reports, checkout — with visual regression only when justified, deterministic test data, environment isolation (never prod), CI execution with traces, and regression coverage for fixed bugs. Cover the critical path, not every page.
    0 installs
16. ▌
    Web Deployment · ahtishamshahzad

    Use to plan web deployment — platform selection driven by framework needs (Next.js server/edge features vs Vite static output with SPA fallback), per-environment config and secrets, preview deployments, CDN/caching headers, domains/TLS, and rollback. Deploying/publishing requires explicit approval.
    0 installs
17. ▌
    Architecture Design · ahtishamshahzad

    Use after the stack is approved to define module boundaries, data flow, integration points, and cross-cutting concerns (auth, config, error handling). Produces the architecture that phases and tasks are generated from. Proportional to the request.
    0 installs
18. ▌
    Final Quality Audit · ahtishamshahzad

    Use as the last gate before release to confirm the work is genuinely complete, correct, tested, secure, documented, and in scope. Aggregates the specialist reviews into one go/no-go verdict; blocks on any failed gate.
    0 installs
19. ▌
    Mobile Fonts · ahtishamshahzad

    Use to plan custom font integration — font loading, weights/variants, and typography wiring into the design system — with correct async loading and fallbacks per runtime.
    0 installs
20. ▌
    Mobile Forms · ahtishamshahzad

    Use to plan form state and UX — React Hook Form (or equivalent) for form state, controlled inputs, submission, and error display — keeping form state out of global stores. Pairs with mobile-validation.
    0 installs
21. ▌
    Mobile Theme · ahtishamshahzad

    Use to plan theming — light/dark modes, theme tokens, and runtime switching — built on the design system's tokens. Ensures consistent, switchable appearance without hard-coded values.
    0 installs
22. ▌
    Maestro E2e · ahtishamshahzad

    Use to plan mobile end-to-end and smoke tests with Maestro — critical device flows on emulator/simulator, resilient to timing, covering happy path plus key error and authorization-denied variants. Reserved for critical mobile journeys; coordinates with the mobile pack.
    0 installs
23. ▌
    Web Performance · ahtishamshahzad

    Use to plan and fix web performance from measurements — Core Web Vitals (LCP/CLS/INP) budgets, code splitting, image/font loading, bundle analysis, caching/CDN, rendering-strategy impact, and dashboard-specific costs (tables, charts). Measure first; fix the measured bottleneck; validate in a production build.
    0 installs
24. ▌
    Auth Form Validation · ahtishamshahzad

    Use to define the credential input contract for login, signup, password reset, and change-password forms — one schema for email and password rules, wired into React Hook Form on the client and re-enforced identically on the server. Client validation is UX; the server is the authority. Error copy must not reveal whether an account exists.
    0 installs
25. ▌
    File Storage · ahtishamshahzad

    Use to plan file upload and storage — object storage vs disk, upload paths (direct vs presigned), server-side validation (type/size/content), key naming, access control on files, and serving (signed URLs, CDN).
    0 installs
26. ▌
    Concurrency · ahtishamshahzad

    Use to handle concurrent access to shared data — finding read-modify-write races, atomic updates, optimistic versioning vs pessimistic locks, unique constraints over check-then-insert, idempotency keys for retried operations, and lost-update protection.
    0 installs
27. ▌
    IOS Readiness · ahtishamshahzad

    Use to validate iOS release readiness — bundle identifier, signing/provisioning, entitlements/capabilities, Info.plist permission strings, privacy manifest, and App Store guidelines. Read-and-verify; flags gaps before submission.
    0 installs
28. ▌
    Mobile Builds · ahtishamshahzad

    Use to plan mobile builds — dev/preview/production builds via EAS Build (Expo) or Fastlane/native tooling (CLI), signing, and native build validation. Coordinates iOS/Android readiness.
    0 installs
29. ▌
    Project Orchestrator · ahtishamshahzad

    Use as the lead skill for any non-trivial request. It drives the full request→approval pipeline (classify, audit, requirements, applications, stack, architecture, phases, tasks) and coordinates specialist skills. It plans and delegates; it does not implement every domain itself, and it stops before implementation until gates are approved.
    0 installs
30. ▌
    Stack Recommendation · ahtishamshahzad

    Use after applications are selected to recommend a technology stack per area (mobile, web, backend, database + data layer, testing) with justification and alternatives. Pairs databases with data layers correctly; never compares a database against an ORM. Requires user approval before any code.
    0 installs
31. ▌
    Unit Testing · ahtishamshahzad

    Use to plan and write unit tests for pure logic — functions, services, reducers, hooks — with Jest or Vitest, isolated from I/O, covering happy path, invalid input, and error path deterministically. Risk-driven, not coverage-percentage-driven.
    0 installs
32. ▌
    Dashboard Tables · ahtishamshahzad

    Use to plan dashboard data tables — server-side vs client-side pagination/sorting/filtering by data size, column architecture, virtualization for large sets, row selection for bulk operations, URL-carried table state, and library evaluation (e.g., TanStack Table).
    0 installs
33. ▌
    Web Server State · ahtishamshahzad

    Use to plan the server-data layer — TanStack Query / RTK Query / SWR selection, query keys, caching, invalidation, retries, optimistic updates, and pagination; on Next.js, how server components and fetch caching split read paths from client queries. Server data lives here, not in a global store.
    0 installs
34. ▌
    Web Unit Testing · ahtishamshahzad

    Use to plan web unit tests — Vitest (default with Vite, also fine for Next.js) or Jest for pure logic, hooks, utilities, and schema validation; fast, deterministic, colocated. Coverage goes where the logic is; DOM-heavy behavior belongs to component tests.
    0 installs
35. ▌
    Application Selection · ahtishamshahzad

    Use to decide which applications a project actually needs (mobile, public web, admin dashboard, marketing site, backend, worker, real-time service, database, file storage, shared packages). Each is evaluated independently with justification; nothing is auto-scaffolded.
    0 installs
36. ▌
    API Contracts · ahtishamshahzad

    Use to define and maintain the API contract between backend and clients — OpenAPI/GraphQL schema as source of truth, shared/generated types, breaking-change policy, and contract-first workflow for new endpoints.
    0 installs
37. ▌
    Rate Limiting · ahtishamshahzad

    Use to plan rate limiting per endpoint class — signup, login, password reset, OTP, contact forms, public search, and expensive endpoints — with keys (IP/account/session), algorithms, stores, and 429 behavior. Abuse prevention, not authorization.
    0 installs
38. ▌
    Transactions · ahtishamshahzad

    Use to define transaction boundaries — which multi-write invariants must be atomic, where the boundary lives (service layer), isolation levels and retry handling, keeping external calls out of transactions, and the outbox pattern for commit-coupled side effects.
    0 installs
39. ▌
    Github Actions · ahtishamshahzad

    Use to implement the designed CI/CD pipeline as GitHub Actions workflows — jobs/matrices, dependency + build caching, pinned action versions, least-privilege GITHUB_TOKEN, secrets from the store, environment protection rules for approval-gated deploys. Implements the ci-cd design; adds no jobs for nonexistent apps.
    0 installs
40. ▌
    NPM Workspaces · ahtishamshahzad

    Use to plan an npm-workspaces monorepo — workspace layout, internal package linking, shared-dependency and versioning policy, and lockfile/CI discipline — when npm is the standardized package manager and simplicity is preferred over pnpm.
    0 installs
41. ▌
    Mobile Logging · ahtishamshahzad

    Use to plan logging — structured, level-based logging, dev vs production behavior, and strict exclusion of secrets/PII. Logs aid debugging without leaking sensitive data or bloating production.
    0 installs
42. ▌
    Mobile Release · ahtishamshahzad

    Use to plan mobile release — store submission (EAS Submit / native), versioning, OTA updates (Expo), staged rollout, and release validation. Publishing to stores requires explicit approval; coordinates readiness.
    0 installs
43. ▌
    Requirements Analysis · ahtishamshahzad

    Use after classification to extract goals, constraints, users, and success criteria from a request, and to separate confirmed facts from assumptions and open questions. Produces the requirement baseline the rest of the plan depends on.
    0 installs
44. ▌
    API Security · ahtishamshahzad

    Use to review API security — input validation/injection, broken object/function-level authorization, mass assignment, resource exhaustion, information leakage in errors, and public-endpoint abuse. Aligns with the OWASP API risks; drives fixes and negative tests.
    0 installs
45. ▌
    Web Security · ahtishamshahzad

    Use to review web/browser security — XSS (output encoding, CSP), CSRF for cookie auth, secure cookie flags, security headers, clickjacking, open redirects, and no secrets in client bundles. The browser-facing security lens; API-layer concerns are api-security.
    0 installs
46. ▌
    Smoke Testing · ahtishamshahzad

    Use to define a minimal, fast smoke suite that proves a build/deploy is fundamentally alive — app starts, health checks pass, auth works, primary flows load — run after every build and post-deploy as a go/no-go gate, distinct from full regression.
    0 installs
47. ▌
    Nextjs Foundation · ahtishamshahzad

    Use to plan a Next.js foundation after Next.js is chosen — App Router structure, server vs client components, per-route rendering strategy (static/ISR/dynamic), TypeScript, linting, env config, and metadata baseline. Plans only; scaffolds and installs nothing without approval.
    0 installs
48. ▌
    Web Accessibility · ahtishamshahzad

    Use to plan and validate web accessibility — semantic HTML first, landmarks, keyboard operability, focus management on route changes and modals, labeled forms, contrast in every theme, ARIA only where semantics fall short, and automated (axe) plus manual checks. Applies to dashboards as much as public pages.
    0 installs
49. ▌
    Web Authorization · ahtishamshahzad

    Use to plan web authorization — the role/permission model, server-side enforcement on every request and action, route guards and UI hiding as UX conveniences, and tenant scoping. UI hiding is never access control; the server verifies everything.
    0 installs
50. ▌
    Web Design System · ahtishamshahzad

    Use to plan the web design system — tokens (color/spacing/typography/radius), scales, reusable primitives, the styling approach (Tailwind, CSS Modules, CSS-in-JS), and component-library evaluation. Also decides how UI is shared across web apps and the dashboard.
    0 installs
51. ▌
    Scheduled Jobs · ahtishamshahzad

    Use to plan time-triggered work — cron schedules, single-execution across multiple instances (distributed locks/leader), missed-run and overlap policy, timezone/DST handling, and monitoring that detects jobs that silently stop running.
    0 installs
52. ▌
    Pnpm Workspaces · ahtishamshahzad

    Use to plan a pnpm-workspaces monorepo — workspace layout, internal package linking (workspace protocol), dependency hoisting/isolation policy, versioning of shared packages, and lockfile/CI discipline. Configuration planning; does not scaffold apps.
    0 installs
53. ▌
    Existing Project Audit · ahtishamshahzad

    Use when a codebase already exists, before proposing any changes. It inventories structure, stack, applications present, tests, security posture, and implementation state so planning is grounded in reality rather than assumptions.
    0 installs
54. ▌
    Expo Foundation · ahtishamshahzad

    Use to plan an Expo mobile foundation after Expo is chosen — development builds vs Expo Go, EAS Build/Submit, OTA updates, TypeScript, navigation, safe-area, linting, and config plugins. Evaluates each option against need; installs nothing without approval.
    0 installs
55. ▌
    Request Classification · ahtishamshahzad

    Use at the very start of every request to classify it into one of the system's request types. The classification selects the workflow variant, gates, and which specialist skills apply. Run before requirements analysis or any planning.
    0 installs
56. ▌
    Secrets Audit · ahtishamshahzad

    Use to audit for exposed secrets — scanning code, config, git history, logs, images, and client bundles for credentials/keys/tokens; confirming exposure; and driving rotation (not just deletion). Auditing existing exposure; secrets-management is the design/build skill.
    0 installs
57. ▌
    Existing Web Audit · ahtishamshahzad

    Use to audit an existing web application before changing it — framework/version, rendering model, routing, state, styling, auth, API layer, tests, build/deploy, and performance/SEO/accessibility baselines. Read-only inventory that feeds planning; fixes nothing during the audit.
    0 installs
58. ▌
    Web Authentication · ahtishamshahzad

    Use to plan web authentication — session vs token model, httpOnly cookies vs localStorage risks, CSRF, SSR/middleware auth on Next.js, OAuth/managed-provider evaluation, refresh flow, and logout. The server enforces authentication; client auth state is a UX hint.
    0 installs
59. ▌
    Web Error Handling · ahtishamshahzad

    Use to plan web error handling — route-level error boundaries (Next.js error.tsx / router errorElement), async and server-state error surfacing, 404/500 pages, PII-safe error reporting, actionable user-facing messages, and retry paths. Users never see raw stack traces.
    0 installs
60. ▌
    Background Jobs · ahtishamshahzad

    Use to decide what work leaves the request path and to design background job execution — job boundaries, payloads, idempotency, retries with backoff, failure handling, and result/status reporting. Queue infrastructure itself is the queues skill.
    0 installs
61. ▌
    REST API Design · ahtishamshahzad

    Use to design a REST API surface — resource naming, HTTP methods and status codes, pagination, filtering, versioning, idempotency, and consistent response shapes. Produces an endpoint design, not code.
    0 installs
62. ▌
    Data Migration · ahtishamshahzad

    Use to plan data movement/transformation — backfills for schema change, reshaping documents, moving between stores — batched and resumable, idempotent, verified by counts/checksums, with dual-write/dual-read cutover for live systems and a real rollback path.
    0 installs
63. ▌
    Repository Architecture · ahtishamshahzad

    Use after architecture design to define the on-disk repository layout — single-repo vs monorepo, app/package boundaries, directory conventions, and shared-code placement. Translates the logical architecture into a concrete, navigable structure. No application code.
    0 installs
64. ▌
    Privacy Review · ahtishamshahzad

    Use to review how personal data is handled — data classification and minimization, lawful/consented use, retention and deletion (right to erasure), no PII in logs/analytics/seeds, third-party data sharing, and cross-border/compliance constraints. Privacy risk, distinct from pure security.
    0 installs
65. ▌
    Dashboard Reporting · ahtishamshahzad

    Use to plan dashboard reports and charts — server-side aggregation, date-range/filter state in the URL, chart library evaluation, CSV/PDF export, scheduled reports, and handling slow queries (async generation, caching). Numbers must be verifiably correct before charts get pretty.
    0 installs
66. ▌
    Web API Integration · ahtishamshahzad

    Use to plan the API transport layer — fetch vs Axios, per-environment base URLs, auth headers and refresh interception, typed error mapping, and CORS with a separate backend; on Next.js, when route handlers / server actions act as the backend-for-frontend. No secrets in client code.
    0 installs
67. ▌
    Web Stack Selection · ahtishamshahzad

    Use to decide between Next.js and Vite + React for each selected web application, with justification. Next.js tends to fit SEO, SSR/SSG, public content, server components, and integrated server features; Vite tends to fit authenticated SPAs, internal dashboards, separate backends, and no-SEO lightweight clients. Tendencies, not absolute rules — each web app is decided separately.
    0 installs
68. ▌
    Backend Security · ahtishamshahzad

    Use to plan backend security hardening — secrets handling, security headers, CORS, injection defenses, dependency risk, request limits, and audit logging. Coordinates the specialist skills (validation, authz, rate limiting) and feeds security-review.
    0 installs
69. ▌
    Backup Recovery · ahtishamshahzad

    Use to plan backups and recovery — RPO/RTO targets, automated backups with point-in-time recovery where needed, off-site/cross-account copies, retention, encryption, and above all restore drills: an untested backup is a hope, not a plan.
    0 installs
70. ▌
    Docker Foundation · ahtishamshahzad

    Use to plan Docker images for services — multi-stage builds, small trusted base images, layer caching, non-root runtime, no secrets baked in, .dockerignore, and reproducible tags. For local dev orchestration or production images; does not scaffold application code.
    2 installs
71. ▌
    Rollback Planning · ahtishamshahzad

    Use to plan how to undo a bad deploy fast — previous-artifact redeploy, migration reversibility rulings (roll-forward vs down), feature-flag kill switches, data-safety on revert, clear triggers, and rehearsal. An untested rollback is a hope, not a plan.
    0 installs
72. ▌
    Android Readiness · ahtishamshahzad

    Use to validate Android release readiness — application id, signing (keystore/Play signing), permissions and manifest, target/compile SDK, 16KB page-size support, and Play policy fit. Read-and-verify; flags gaps before submission.
    0 installs
73. ▌
    Mobile Navigation · ahtishamshahzad

    Use to plan mobile navigation — choose Expo Router or React Navigation, define the navigator structure (stacks/tabs/drawers), route params, and deep-link surface. Evaluates the option against need; keeps navigation state in the navigator.
    0 installs
74. ▌
    Mobile Validation · ahtishamshahzad

    Use to plan input/schema validation — Zod (or equivalent) schemas shared across forms and API boundaries, with clear error messages. Validate at the edges; reuse schemas. Client validation is UX, not security.
    0 installs
75. ▌
    Mobile Security · ahtishamshahzad

    Use to review mobile app security — secure storage of tokens/secrets, no secrets in the bundle, secure transport/pinning where warranted, deep-link and IPC validation, platform permissions, and the rule that the server enforces all authorization. The security lens on the mobile pack.
    0 installs
76. ▌
    Threat Modeling · ahtishamshahzad

    Use to identify what could go wrong before building — assets, trust boundaries, attackers, and threats (STRIDE-style) across the system — producing prioritized, testable mitigations that drive the specialist security skills. Structured thinking, not a scan.
    0 installs
77. ▌
    Contract Testing · ahtishamshahzad

    Use to verify that independently deployed clients and services agree on their API contract — schema/consumer-driven checks in CI that fail when a provider change would break a consumer, catching integration breakage before deploy rather than in production.
    0 installs