gabriel-f-santos

@gabriel-f-santos source repo

26 skills
0 followers
15 hours ago last updated

▌
Skill Scanner · gabriel-f-santos bundle
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.

0
installs
▌
Figma · gabriel-f-santos bundle
Turn a screen spec into a real Figma frame via a connected Figma MCP server and return the shareable link. Use whenever the user (or the `ux-design` skill) wants to "create a Figma frame", "push this screen to Figma", "make a Figma mockup", "update the Figma design", "mandar pro Figma", "criar o frame no Figma", or hands over a screen spec (name, layout, components, states, content) expecting a Figma URL back. Discovers the Figma MCP at runtime instead of hardcoding tool names; reads design context, creates/updates frames, components and variables, and returns the node link. If no Figma MCP is connected it says so and emits the textual spec instead — it never fails hard. Do not use for pencil.dev designs (use the `pencil` skill), for non-Figma design tools (Sketch, Penpot, Adobe XD), for writing the screen spec itself (that is `ux-design`'s job — this skill consumes a finished spec), or for turning a Figma design into code (that is a design-to-code task, not frame authoring).

0
installs
▌
Pencil · gabriel-f-santos bundle
Turn a screen spec into a real pencil.dev design screen/frame via the Pencil MCP server, and return a reference to the produced design. Use when the user (or the `ux-design` skill) wants to "create a screen in Pencil", "generate this UI in pencil.dev", "build the login screen on the canvas", "mock this up in Pencil", "render the spec as a Pencil frame", or asks to push a screen spec to pencil.dev. It discovers the Pencil MCP at runtime (no hardcoded tool names), maps a screen spec (name, layout, components, states, content) onto Pencil design operations, and hands back the artifact (a `.pen` file / screen reference, plus a screenshot when available). If no Pencil MCP is connected it degrades gracefully and emits the textual spec instead of failing. Do NOT use for Figma — for Figma use the `figma` skill; not for other non-pencil design tools, not for writing the spec itself (that's `ux-design`), nor for turning a finished design into code.

0
installs
▌
Fix Bug · gabriel-f-santos bundle
Fix a bug the disciplined way — reproduce, write a FAILING regression test, then fix until green. Use when the user reports a bug or asks to fix/debug something — "tem um bug", "corrige esse erro", "fix this bug", "isso deveria retornar X mas retorna Y", "debug isso", "não está funcionando", "reproduz e corrige". Enforces TDD red-green for bugs: reproduce deterministically, write a regression test that asserts the CORRECT behavior and fails on the current code (confirm Red), make the smallest root-cause fix, confirm the test passes (Green), then run the full suite so nothing regressed. Hard rule: never declare it fixed without a test that reproduced the bug now passing. Runs the tests when a runner exists, else writes the test + fix and flags it unverified. Do not use to add a new feature (use implement-phase) or for pure code review (use review-*).

0
installs
▌
Research · gabriel-f-santos
Research technical options and generate a decisions document for a project phase. Use whenever the user needs to explore alternatives, understand trade-offs, or define technical paths before planning a phase — including variations like 'research options for phase X', 'what technologies to use in the phase', 'phase trade-offs', 'technical decisions for the phase', 'research the phase', or any mention of exploring alternatives before planning.

0
installs
▌
Skill Gen · gabriel-f-santos bundle
Generate AND iteratively improve production-grade Agent Skills through a guided interview. Use whenever the user wants to create, scaffold, author, or design a new skill or set of skills — "create a skill", "gera uma skill", "skill para X", "turn this workflow into a skill" — OR to improve/fix an existing one ("this skill mis-fired", "it didn't trigger", "improve this skill", "optimize the trigger"). Interviews to decide target runtimes (Claude Code, Codex, opencode), single vs multiple skills, execution shape, and tools, then writes a portable SKILL.md plus references/scripts and per-platform sidecars (Codex openai.yaml), tunes the description, and validates. Do not use to run, install, or security-review an existing skill (that's skill-scanner), or to tweak non-skill prose — only to author or improve a skill.

0
installs
▌
UX Design · gabriel-f-santos bundle
Turn a product vision into screens and user flows. Use when someone wants to design the UI from a validated product overview — "gera as telas", "desenha as telas dessa feature", "screen design", "user flows", "wireframes", "como vai ser a tela de X", "monta o protótipo de telas". Reads the product discovery brief / PRD (vision, personas, journeys, features), derives the information architecture, maps user flows, writes a screen spec per screen (layout, components, states, actions), and RENDERS them via a connected design tool — using the `pencil` or `figma` skill / a design MCP if available, else degrading to textual wireframes. Writes a findable summary to docs/design/<slug>/summary.md that the implementation plan references. Do not use to validate the problem (product-discovery) or to talk to a specific design tool directly (use the pencil/figma skill) — this orchestrates the design, the tool skills render it.

0
installs
▌
Hetzner Vm · gabriel-f-santos bundle
Provisiona VM Hetzner completa com Coolify via Terraform. Copia templates terraform para infra/hetzner/, chama /linux-vm-hardening para gerar cloud-init seguro, e executa terraform apply. Funciona em qualquer projeto — não exige estrutura pré-existente. Use para criar nova VM Hetzner com Coolify em qualquer projeto. Não usar para atualizar infra existente sem revisar o plan primeiro.

0
installs
▌
Plan Phase · gabriel-f-santos
Generate a technical implementation plan for a project phase. Use whenever the user asks to plan, detail, or generate the technical plan for a phase — including variations like 'plan phase X', 'detail the phase', 'generate phase implementation', 'create the phase-XX.md', or any mention of creating the technical document for a project phase.

0
installs
▌
Prd Creator · gabriel-f-santos bundle
Draft a Product Requirements Document that feeds the plan→execute pipeline. Use whenever the user wants to write, draft, or scope a PRD, spec out a feature/module/migration before building, or 'criar um PRD', 'escrever o PRD de X', 'spec dessa feature', 'documentar o que vamos construir'. Produces docs/prd-<slug>.md in the repo's house format — grounded in the real codebase — with the slug that carries through /research and /plan-phase. It is the front door of the pipeline: PRD → /research → /plan-phase → /implement-phase. Do not use to write the technical decisions (use /research) or the phase breakdown (use /plan-phase).

0
installs
▌
Review Phase · gabriel-f-santos bundle
Review a just-implemented phase/feature across functionality, security, and quality by fanning out three reviewers as subagents, scoped to the phase contract. Use after building something — "revisa a fase", "review phase X", "code review da feature", "revisa o que foi implementado", "revisão da phase-NN". Reads docs/phases/phase-NN-<slug>.md (acceptance criteria, deliverables) + the diff, runs review-functionality, review-security and review-quality (parallel subagents when available), de-dupes and prioritizes findings P0/P1/P2, prints a summary to screen and writes the full report to a gitignored artifacts path. Do not use for live UI/runtime smoke (use e2e-test-review) or to apply fixes (use simplify/refactor).

0
installs
▌
Example Skill · gabriel-f-santos bundle
[SUBSTITUIR] Descrição curta do que a skill faz e quando invocar. Use quando o usuário pedir X ou Y. Não usar para Z. Output: [o que gera/modifica].

0
installs
▌
Commit Message · gabriel-f-santos bundle
Generate a Conventional Commits message from staged changes. Use when the user asks to "write a commit message", "commit message", "gera a mensagem de commit", "commita isso", or right after staging with git add. Reads the staged diff, classifies it (feat/fix/docs/refactor/test/chore/...), and writes a <72-char imperative subject plus an optional body — it presents the message, it does not run the commit. Do not use for PR descriptions or changelogs — those are separate concerns.

0
installs
▌
Github Actions · gabriel-f-santos bundle
Generate and secure GitHub Actions workflows. Use to scaffold or review CI/CD — "criar workflow", "github actions", "pipeline CI/CD", "workflow de deploy", "gera o GHA", "configurar deploy no push da main", "set up CI", "revisar segurança do workflow", "audit workflows", "GHA security review". GENERATE mode interviews the pipeline shape (lint/test/build/deploy; trigger on PR/MR vs push-to-main vs tag; deploy target + approvals) and writes secure-by-default workflows (least-privilege GITHUB_TOKEN, third-party actions pinned to SHA, no ${{ }} in run: blocks, OIDC deploy, concurrency, path filters, dependency cooldown/osv). REVIEW mode audits existing .github/workflows for exploitation vulns (pwn request, expression injection, comment-triggered commands, credential escalation, supply chain) with concrete attack paths — security art adapted from Sentry's gha-security-review. Do not use for non-GitHub CI (GitLab/CircleCI) or to write app code.

0
installs
▌
Review Quality · gabriel-f-santos bundle
Review changed code for "crap" reduction — reuse, simplification, efficiency, dead code, duplication, naming, and altitude. Use to clean up what was just built — "reduz a gambiarra", "revisa qualidade do código", "tem duplicação/dead code?", "dá pra simplificar essa feature?". Reports findings only (does not apply fixes — use simplify/refactor for that), confidence-based, never security or correctness (those are review-security / review-functionality). Runs standalone or as a subagent of review-phase.

0
installs
▌
Tech Discovery · gabriel-f-santos bundle
Act as a senior technical architect running technical discovery AFTER product discovery/brainstorming. Use when a problem/product is validated and you need to design the system before building — "discovery técnico", "arquitetura da solução", "como vamos construir isso", "desenho de sistema", "technical discovery", "solution architecture", "definir a arquitetura". Reads the product discovery brief/PRD, explores architecture options with trade-offs, designs boundaries (C4/DDD), the data model, NFRs + cost, and a STRIDE threat model, surfaces the riskiest unknowns as time-boxed spikes, and writes a Tech Discovery Brief that feeds prd-creator and research. Do not use for product/market discovery (use product-discovery), for granular lib/pattern choices per phase (use research), or for the implementation plan (use plan-phase).

0
installs
▌
Celery Rabbitmq · gabriel-f-santos bundle
Implement reliable async task processing with Celery on a RabbitMQ broker — native retries, dead-letter queues (DLQ), publishing and consuming, with the broker kept as an implementation detail. Use when the user wants to "add Celery", "set up a task queue", "process events/jobs async", "configure RabbitMQ with Celery", "add retries", "set up a dead letter queue / DLQ", "handle failed tasks", "publish a message and consume it", "Celery beat / cron", or move fire-and-forget background work (asyncio.create_task, BackgroundTasks, threads) onto a durable broker. Covers the acks_late + acks_on_failure_or_timeout=False pattern that actually routes failures to the DLX, the dispatch-by-event-type handler pattern, producing tasks by name, and monitoring stuck messages. Not for Redis-only queues (arq/taskiq), raw pika/aio-pika without Celery, or Kafka.

0
installs
▌
Implement Phase · gabriel-f-santos
Execute a phase implementation plan step by step, respecting dependencies, running the relevant tests after each SI, and only advancing when tests pass. Use whenever the user asks to implement, execute, build, or deliver a planned phase — including variations like 'implement phase X', 'execute phase-02', 'build the auth phase', 'run the phase plan', 'implement the SIs', or any request to turn a phase plan document (docs/phases/phase-NN-*.md) into working code.

0
installs
▌
Lgpd Compliance · gabriel-f-santos bundle
Guide LGPD (Brazilian data-protection) compliance for a web app/SaaS — audit the codebase for gaps, implement the required features, and scaffold the legal docs. Use for "LGPD", "adequação LGPD", "privacidade / proteção de dados", "política de privacidade", "banner de cookies / consentimento", "opt-in de analytics", "direitos do titular", "exclusão / portabilidade de dados", "DPO", "DPA", or "GDPR". Audits against the ANPD checklist (privacy policy, real cookie opt-in, data-subject rights, security by design, DPA), guides implementation (consent gating for GA4/Pixel, account-deletion cascade, data-export endpoint, MFA/crypto/log hygiene, Sentry sendDefaultPii:false), and drafts a privacy-policy / DPA. Technical guidance, NOT legal advice — a DPO/lawyer signs off. Do not use for general security review unrelated to privacy (use review-security) or for app features that don't touch personal data.

0
installs
▌
Review Security · gabriel-f-santos bundle
Security review of changed code, scoped to a phase/feature diff. Use to find exploitable vulnerabilities in what was just built — "revisa segurança da fase", "tem vuln nessa feature?", "security review do diff", "checa injection/authz/IDOR". Reports HIGH-confidence, attacker-reachable issues only (injection, broken authZ / cross-tenant / IDOR, secret exposure, missing validation, SSRF, deserialization, crypto misuse) AND supply-chain gaps (unpinned deps / uncommitted lockfile / no cooldown). Read-only — reports, does not fix. Runs standalone or as a subagent of review-phase. Do not use for functional conformance (review-functionality) or style/cleanup (review-quality).

0
installs
▌
Tailscale Setup · gabriel-f-santos
Guia setup completo do Tailscale: conta, cliente na máquina local, ACL policy e geração de auth key para servidor. Invocada pelo /hetzner-vm e /linux-vm-hardening quando ssh_mode=tailscale, ou diretamente para configurar um tailnet do zero. Use quando for usar Tailscale como VPN de acesso SSH a servidores.

0
installs
▌
Product Discovery · gabriel-f-santos bundle
Turn a vague product idea into a validated discovery brief through a deep founder interview, live market research, and generated user-research instruments. Use when the user has a product/SaaS/feature idea and wants to validate the problem before building — "tenho uma ideia", "quero validar um produto", "product discovery", "pesquisa de mercado", "vamos descobrir se vale a pena", "monta uma entrevista/survey pros usuários", "TAM SAM SOM". It interviews the founder (Mom Test + JTBD framing), researches the market (TAM/SAM/SOM, competitors, demand signals) using parallel subagents when available, generates user-research instruments (interview guide, survey, screener, fake-door landing), and writes a discovery brief. Do not use to write a build spec/PRD (that comes after) or to brainstorm features without validation — use product-brainstorming for pure ideation.

0
installs
▌
Linux Vm Hardening · gabriel-f-santos bundle
Gera cloud-init.yaml com hardening completo para VM Linux. Configura: usuário não-root sudo, SSH key-only (root prohibit-password para Coolify), UFW, fail2ban com ban progressivo, Docker, Coolify e unattended-upgrades. Suporta dois modos: SSH público restrito por IP ou SSH exclusivo via Tailscale VPN. Invocada pelo /hetzner-vm ou diretamente para qualquer VPS (DigitalOcean, AWS EC2, etc.).

0
installs
▌
Greenfield Monorepo · gabriel-f-santos bundle
Bootstrap a brand-new polyglot monorepo from zero — interview for the apps and stacks, then scaffold a runnable hello-world per app with current best-practice harness, lint, tests, pre-commit, Docker Compose dev stack with seed data, dev scripts (up/down/restart/seed), root + per-app AGENTS.md, and CI. Use when the user wants to "start a new project/monorepo", "scaffold a greenfield repo", "set up frontend + backend + mobile", "iniciar um projeto do zero", "criar o monorepo", "montar o esqueleto", "configurar lint/test/pre-commit/docker do projeto novo", or hands over an architecture.md to build from. Ships two pinned stacks (Vite+React→Cloudflare Workers, FastAPI async) and a generic research-and-scaffold path (context7/web) for any other stack (LangGraph, Go realtime, Flutter, …). Do not use to add a feature to an existing app, to write a single Dockerfile/CI file in isolation, or to design product/architecture from scratch (chain to product-brainstorming / tech-discovery for that).

0
installs
▌
Review Functionality · gabriel-f-santos bundle
Review implemented code for conformance to a phase/feature contract and for correctness bugs. Use to check that what was built actually meets its acceptance criteria — "revisa se a feature faz o que devia", "conformance review", "review against the spec", "achou bug na fase?". Reads the phase contract (acceptance criteria, deliverables) + the diff and reports, confidence-based, whether each criterion is met and any correctness defects (logic, edge cases, error paths, concurrency). Read-only — reports findings, does not fix. Designed to run standalone or as a subagent of review-phase. Do not use for security (review-security) or style/cleanup (review-quality).

0
installs
▌
Product Brainstorming · gabriel-f-santos
Brainstorm product ideas, explore problem spaces, and challenge assumptions as a thinking partner. Use when exploring a new opportunity, generating solutions to a product problem, stress-testing an idea, or when a PM needs to think out loud with a sharp sparring partner before converging on a direction.

0
installs

26 published skills