padosoft

@padosoft source repo

44 skills
0 followers
8 hours ago last updated

▌
Padosoft Email HTML Builder · padosoft bundle
Use this skill whenever the user creates, fixes, converts or reviews an HTML email (welcome, transactional, newsletter, DEM, ESP template) or asks to test it on Mailtrap or MailUp, even when they do not explicitly say "HTML", "template" or "deliverability": it produces table-based emails with minimal inline CSS, an aligned text/plain part, one-click List-Unsubscribe, and validates them with the included linter down to 0 errors, targeting SpamAssassin spam <= 0.1 and HTML Check with no warnings outside the baseline. Do not use it for copywriting without code, for configuring DNS/SPF/DKIM or for managing lists and bulk sends.

0 installs
▌
Padosoft Environment Gating · padosoft bundle
Use this skill whenever a branch behaves differently depending on the environment — debug output, error detail, a profiler or diagnostic endpoint, a permissive security header, a seed, an auth mock, a provider in test mode, a destructive command guard, a feature flag keyed on the deployment. Also when the user reports that a development behaviour appeared on the live site, that stack traces or query dumps are visible to users, that a staging box behaves like a laptop, or that an environment check did not match. It replaces the two-valued check with the three answers that actually exist, and picks the default from what the branch does. Do not use it for CI workflow configuration, for secret management, or for choosing a deployment topology.

0 installs
▌
Padosoft Failure Visibility · padosoft bundle
Use this skill whenever code can fail and the caller has to find out — a write to disk or storage, an external call, a catch block, an endpoint that returns a body, a fetcher, a renderer, a chart that reduces an array — and whenever the user says something "silently did nothing", data disappeared without an error, a request returned 200 but the page is empty, a job later died on something that was reported as accepted, or a retry loop never fires. It covers the two halves of the same bug: an ignored return value, and a success status served over a failure. It also covers the decision trace, for when nobody can reconstruct why a user got the outcome they got. Do not use it for what goes inside a log line (padosoft-logging-discipline) or for retry and timeout policy.

0 installs
▌
Padosoft Logging Discipline · padosoft bundle
Use this skill whenever code writes to a log or builds an error message for a user — a catch block, an exception handler, a logger call, telemetry, a debug line added while hunting a bug — and whenever the user says a log is noisy or useless, an error message shows SQL or a stack trace, a support ticket contains data it should not, or asks what is safe to log. It gives what must never reach a log or a screen, what to keep so the log stays diagnosable, and where the redaction goes in each stack, which is not the same place. Do not use it to choose a logging library or to configure log shipping, retention or dashboards.

0 installs
▌
Padosoft RAG Knowledge Base · padosoft bundle
Use this skill when designing or changing the corpus a model retrieves from — the document store, the chunk table, identifiers, statuses, the promotion of knowledge into it, the graph of relations between documents. Also when the user reports that a document could not be deleted, that the same file was indexed twice, that retrieval grounds answers on an outdated or unreviewed page, that two projects collided on an identifier, or asks how a model should be allowed to write into the knowledge base. It covers the idempotency anchor, canonical typing, the human gate on promotion, trust ordering at retrieval, and the delete path. Do not use it for permissions and ingestion trust (padosoft-rag-ingestion-security) or for choosing an embedding model.

0 installs
▌
Padosoft API Security Review · padosoft bundle
Use this skill before committing or reviewing any change to an HTTP API that touches routing, auth middleware, settings or config endpoints, logging and telemetry, SQL, error handling, response shaping, client IP, rate limits or an outbound fetch — and whenever the user asks for a security review, an audit, or says an endpoint "seems public", "returns too much" or "leaks something": it runs ten checks with ready grep pre-screens (auth on every mutating route, ownership from the authenticated id, no secrets or PII in responses, bound SQL, fail-safe env gates, resource caps, redacted logs, downstream injection, no trust from caller input, supply chain) and blocks the commit on each violation. Do not use it for infrastructure hardening (WAF, DNS, firewall) or for dependency CVE triage.

0 installs
▌
Padosoft Evidence Boundaries · padosoft bundle
Use this skill when something is being declared done, safe, covered or production-ready and you need to know what actually proves it: a release or compliance gate, a security or DR claim, a "CI is green so we can ship", a "the job succeeded", a "the tests pass so it works", a coverage or mutation number, a signed artifact, an integration verified against an emulator or a mock. It names the claim, names what would prove it, and finds the gap where a cheaper artifact was accepted in place of the expensive one. Do not use it to write tests (padosoft-test-integrity), to build a CI workflow (padosoft-ci-workflow-gates), or to debug a failing check — this is about whether a passing one means anything.

0 installs
▌
Padosoft Laravel Conventions · padosoft bundle
Use this skill when writing or reviewing Laravel/PHP code — a controller, a FormRequest, a service, a job, a migration, an Eloquent query, a model event, a queued or bulk operation — and whenever a symptom shows up: a controller that grew into the business logic, an N+1 found in the logs, a bulk command that runs out of memory, a job that retries something it should not, a soft-deleted row reappearing in a count, a model event that fires on a mass update and does not. It applies to any Laravel version: the rules are about the shape of the application. Do not use it for a security review (padosoft-laravel-security-review), for what goes in a log (padosoft-logging-discipline), or for infrastructure and deployment.

0 installs
▌
Padosoft Laravel Scaffolding · padosoft bundle
Use this skill when adding something new to a Laravel application — an endpoint, a controller, a service, a CRUD backend, a queued job, a test — "make me the API for X", "add the CRUD for Y", "I need a service that does Z" — and whenever a piece added earlier is half-wired: a route that answers 404, a policy that is never called, a request class that validates nothing because the controller reads `all()`, a job that is dispatched but has no queue configured. It lists the files each piece touches, in order. Do not use it to review existing code (padosoft-laravel-conventions) or for the security review.

0 installs
▌
Padosoft Edge Worker Security · padosoft bundle
Use this skill when code runs at the edge in front of an origin — a Cloudflare Worker or equivalent that proxies, renders or caches on behalf of a backend. It covers who owns a control when two layers could implement it, cross-site request forgery validated at the edge, the two-hop client-address model, header forwarding and what must never reach the origin, private caching and key design, cross-origin policy, cookies, server-side rendering at the edge, secrets and bypass tokens, and edge rate limiting. Also when the user says a request is blocked and nobody knows by which layer, a header is being spoofed, a cached page showed another user's data, a bypass works with only a user agent, or asks whether a control is really on. Do not use it for the origin application's own review, for CDN configuration, or for edge performance tuning.

0 installs
▌
Padosoft Frontend Testability · padosoft bundle
Use this skill when writing or reviewing user-interface markup or components — a page, a form, a modal, a list, a widget, a screen — in a project that has end-to-end tests or will have them. Also when the user says a test broke after a purely visual refactor, that a test waits on a timer, that a selector depends on a generated class name, that a test cannot tell loading from empty, or asks how to make the interface testable. It gives the locator hierarchy the markup has to support, the eight contract rules, and the observable states every asynchronous action owes its test. Do not use it to write the tests themselves (padosoft-test-integrity), to design the interface, or to pick a testing framework.

0 installs
▌
Padosoft Git Commit Integrity · padosoft bundle
Use this skill right after committing, and whenever something that works locally is missing or wrong everywhere else: a file you are certain you added is not in the repository, CI cannot find a module that exists on your machine, a colleague gets a whole-file diff from a one-line change, a review shows changes nobody made, or a generated file keeps coming back modified. It verifies what git actually recorded — `git add -A` skips ignored files in silence, and without a .gitattributes the line endings of whoever committed end up in the index — and gives the correct fix for each, which is never `git add -f`. Do not use it for merge conflicts, rebasing, branch strategy, or writing commit messages.

0 installs
▌
Padosoft Hono API Conventions · padosoft bundle
Use this skill when writing or reviewing code in a Hono API on Bun — a new endpoint, a middleware, a repository or a SQL query — and whenever the user works on a controller/repository/query layer, types a Hono context, adds a paginated or localized list, or hits a symptom like "the type of c.get is any", "it returns null instead of an empty list", "page 1 skips records", "sometimes the translation is missing" or "the middleware types don't line up": it applies the three-layer architecture, the typed-context and middleware-factory patterns, and the recurring mistakes that cost the most. Do not use it for the security review of an endpoint (padosoft-api-security-review) nor for OpenAPI spec changes.

0 installs
▌
Padosoft Agent Host Boundaries · padosoft bundle
Use this skill when building or reviewing something that calls a model or hosts an agent — an LLM adapter, a tool-calling loop, an MCP server, a prompt-driven feature, a spend budget, a trajectory or replay store, a similarity or scoring threshold, an agent-generated artifact that a human is meant to approve. Also when the user reports a runaway bill, prompts or customer data ending up in logs or traces, an agent doing more than intended, a "confidence score" being treated as a decision, or generated output being accepted as evidence. Do not use it for prompt wording and model choice, for training or fine-tuning, or for building the skills themselves (padosoft-skill-creator covers that).

0 installs
▌
Padosoft Openapi Spec Workflow · padosoft bundle
Use this skill when changing a shared OpenAPI contract that other projects consume — adding or editing a field, an endpoint or a response schema in a spec package, or bumping and publishing it — and whenever the user says the mock and the real API disagree, a client method is missing a new parameter, the generated document fails to build, or a consumer broke after a spec release: it walks the places that must stay in sync (schema, mocks and per-tenant overrides, endpoint, client, tests), the changeset and version bump, and the build-and-call verification loop. Do not use it to implement the endpoint in the API that serves it (padosoft-hono-api-conventions) nor for its security review.

0 installs
▌
Padosoft Rn Screen Scaffolding · padosoft bundle
Use this skill when adding a new screen, component or data-fetching hook to a React Native / Expo app — "make me a screen for X", "add a component that shows Y", "I need the hook for this endpoint" — and whenever something added earlier is half-wired: a screen whose title shows the raw key, a route that exists in one app of the monorepo but not the other, a component not exported from its barrel. It lists every file a new piece touches, in order, so nothing is left half-registered. Do not use it to review existing code (padosoft-react-native-conventions) or for native modules and build configuration.

0 installs
▌
Padosoft Verify Before Writing · padosoft bundle
Use this skill whenever an agent is about to write something it has not verified — a call to a helper whose signature it inferred from the name, an enum case that sounds plausible, a config key, a column, a file path mentioned in a plan but never opened, a docblock explaining a mechanism nobody read, a commit message asserting what the code does. Also when the user says the agent invented an API, hallucinated a method, confidently described behaviour that does not exist, or asks how to stop it happening. It gives the rule (ask, or log the doubt — never the silent third option), what must be verified, and how autonomous mode changes the answer without removing the obligation. Do not use it for verifying facts about the outside world, for prompt engineering, or for reviewing code somebody else wrote.

0 installs
▌
Padosoft Mobile Security Review · padosoft bundle
Use this skill before committing or reviewing a change to a React Native / Expo app that touches secrets or API keys, token storage, a WebView, a deep link or an external URL, TLS and certificate pinning, a dev/mock/debug surface, or an AI/LLM call — and whenever the user asks whether something can go in the bundle, in an EXPO_PUBLIC_ variable or in MMKV, or asks for a mobile security review or an audit. It runs the checks with their pre-screens and, for a finding whose enforcement lives outside the repository, states the severity conditionally instead of guessing. Do not use it for API-side security (padosoft-api-security-review), store review rejections, or MDM and device fleet policy.

0 installs
▌
Padosoft Database Design · padosoft bundle
Use this skill when writing or reviewing a migration or a table design — adding a table or a column, choosing indexes, deciding a primary key, partitioning a large table, adding a JSON column, planning for growth. Also when the user reports a slow query blamed on a missing index, a migration that fails because a table or column already exists (or does not), an index that is never used, a table too big to purge, or asks how to index a query they are about to write. It covers index selection and redundancy, the composite-prefix rule, covered indexes, partitioning constraints, JSON columns, and the guard clauses a migration needs to be re-runnable. Do not use it for writing the queries themselves (padosoft-query-performance), for ORM conventions, or for choosing a database engine.

0 installs
▌
Padosoft Docs Match Code · padosoft bundle
Use this skill when writing or reviewing documentation that quotes the code — a README, a CLAUDE.md or AGENTS.md, a SKILL.md, an ADR, an onboarding guide, an API doc — and whenever the user reports that a documented command, column, env var or flag does not exist, that setup instructions fail on a clean machine, that the docs describe an older behaviour, or asks to document a feature. It checks the quoted facts against migrations, models, config, command signatures and routes, and prefers a generated or pointed-to source over a copied snippet. Do not use it for writing style, for choosing a docs platform, or for translating existing documentation.

0 installs
▌
Padosoft Durable Effects · padosoft bundle
Use this skill when work leaves the request and happens later — a background job, a queue, a worker, a webhook consumer, a scheduled task, a retry — and whenever the user reports that something ran twice, that a job was processed by two workers, that a retry charged or sent a second time, that a cancelled job still reported success, that a worker hung or exited with a late error, or that a job vanished. It covers lease and fencing semantics, exactly-once effects, terminal states, cancellation, and what a durable queue needs that an in-memory one does not. Do not use it to choose a queue technology, to tune throughput or worker counts, or for request-scoped transactions (padosoft-atomic-invariants covers those).

0 installs
▌
Padosoft Knowhow Harvest · padosoft bundle
Use this skill to turn what other repositories have learned into skills — a periodic harvest of their lessons files, rule folders, internal skills, decision records and security docs, deciding for each finding whether it updates an existing skill, becomes a new one, or is deliberately left alone. Also when the user says "check the repos for new rules", "harvest the know-how", "what changed since last time", asks how to keep the catalogue current, wants to know whether something was already considered, or asks what to do with the local rules a skill now duplicates. It covers the work order, the judgement that turns a finding into a rule, the promotion criterion, and the ledger that stops the same material being mined twice. Do not use it to write a single skill from scratch (padosoft-skill-creator) or to audit an existing one.

0 installs
▌
Padosoft Contract Changes · padosoft bundle
Use this skill when something other code depends on is about to change shape — a method or function signature, a parameter added, removed, reordered or retyped, a return type, an overridden method, an interface, an event payload, a schema, a response contract, a default value. Also when the user reports a signature-incompatibility error, a caller broken after a refactor, a child class that no longer matches its parent, a fixture failing after a schema was tightened, or asks how to change an API without breaking consumers. It gives the search that finds every dependent, the classification that says what is breaking, and the rule that the whole change lands together. Do not use it for designing an API from scratch, for versioning a public package, or for database migrations (padosoft-database-design covers those).

0 installs
▌
Padosoft Pr Review Triage · padosoft bundle
Use this skill when a pull request has comments from an automated reviewer — GitHub Copilot, Codex, CodeRabbit, Advanced Security — and the user wants them processed: "copilot review", "the bot comments on the PR", "address the review", "fix the Codex findings", or simply "there are 14 comments on PR 212, sort them out". It reads every bot comment, sorts them into must-fix / worth-fixing / negligible / bot-is-wrong, gets the categorisation approved before touching code, applies only the approved fixes, replies to each comment on GitHub, and proposes a new project rule when the bot found a real bug the project checks would have missed. Do not use it for a human reviewer's comments, for a single comment, or to write the code review itself.

0 installs
▌
Padosoft Tenant Isolation · padosoft bundle
Use this skill when more than one organisation, customer, workspace or project shares a system, and whenever a boundary between them is being written or reviewed: a scoped query, a list endpoint, an update or delete, a background job, a cache or storage key, an idempotency key, a provisioning or admin route. It also applies when the user reports that one account can see or overwrite another's data, that a count or a page leaks records, that a job ran for the wrong tenant, or that a legacy record is visible to everyone. It checks that the scope is carried by the key and re-checked at every boundary, not applied as a filter on the way out. Do not use it for authentication or login flows, for role and permission design inside a single tenant, or for database sharding and capacity work.

0 installs
▌
Padosoft Atomic Invariants · padosoft bundle
Use this skill whenever code enforces something that must hold only once or only so many times — a single-use code or coupon, a nonce, a rate or quota limit, "the first one wins", a stock reservation, an idempotency key, a state transition that must happen once — and whenever the user reports that two requests both succeeded where one should have failed, a coupon was redeemed twice, a job ran twice, or a counter drifted under load. It checks that the read and the write of the invariant live in one atomic step and that a constraint backs the rule where it matters. Do not use it for general transaction design, for retry policy, or for distributed consensus.

0 installs
▌
Padosoft CI Failure Triage · padosoft bundle
Use this skill when a test or a job is red in CI and somebody wants to know why — "the pipeline is red", "test X fails only in CI", "it passes locally", "the browser test is flaky", "fix the failing check on the PR". It is the procedure for collecting the complete evidence before forming a hypothesis: the full run log rather than the failed-step extract, every artifact, the application logs from the same window, and the correlation between them, ending in a classification — test defect, application defect, environment defect, or genuinely flaky — and a fix that names a file and a line. Do not use it to design the workflow (padosoft-ci-workflow-gates), to write the tests (padosoft-test-integrity), or to debug something failing in front of you locally.

0 installs
▌
Padosoft CI Workflow Gates · padosoft bundle
Use this skill when writing or reviewing a CI workflow or a gate that guards a merge — a GitHub Actions file, a required check, a validator script, a secret scan, a branch or tag ruleset — and whenever the user says a check went green without checking anything, a workflow did not start, a label does not trigger the run, CI minutes are being burned on every push, a required check cannot run before merge, or a rule can be bypassed. It covers what actually makes a gate a gate, the trigger and permission semantics that silently replace your defaults, and the cost tiering. Do not use it to design deployment pipelines, to pick a CI provider, or to debug a failing application test.

0 installs
▌
Padosoft Query Performance · padosoft bundle
Use this skill when writing or reviewing code that reads or writes the database in volume — a listing, an export, a report, a cron or queued job that walks a table, a recalculation of a denormalised table, an endpoint that got slow as the data grew. Also when the user reports N+1 queries, a job exhausting memory, a paginated page that gets slower the deeper it goes, a timeout on a large table, or asks how to process a few hundred thousand rows. It covers access patterns, the volume thresholds that change the technique, keyset pagination, existence checks, and recalculating without leaving a window of emptiness. Do not use it for index and table design (padosoft-database-design) or for tuning the server itself.

0 installs
▌
Padosoft Security Baseline · padosoft bundle
Use this skill when deciding what security an application must have — starting a new project, taking one to production, preparing for an audit, a penetration test or a customer questionnaire, planning a hardening backlog, or answering "are we secure enough?". Also when the user asks which controls are missing, what to do first, how to prove a control exists, or wants a new service to start at the same level as an existing one. It walks the control domains, separates what the framework gives you from what you must build, and turns a finding into a control that holds for future code. Do not use it to review a specific diff — the per-stack review skills do that — nor to run a scanner or write a threat model for one feature.

0 installs
▌
Padosoft Crash Triage · padosoft bundle
Use this skill when a crash, a freeze or an error from real users has to be turned into a fix — a report from a crash reporter, an application-not-responding event with a thread dump, a stack trace from a minified or bundled artifact, an exception group in an error tracker. Also when the user says an issue is back, asks which release introduced it, wants a stack symbolicated, or asks what to write in the fix when nothing could be reproduced. It gives the order of collection, how to attribute a frame honestly, how to classify from the code rather than the message, and the grade of proof every sentence in the diagnosis has to carry. Do not use it for a failing test or a red pipeline (padosoft-ci-failure-triage) or for a bug you can reproduce in front of you.

0 installs
▌
Padosoft I18N Hygiene · padosoft bundle
Use this skill when working on a translation catalogue — adding a string, auditing for unused or missing keys, replacing hardcoded text, aligning locales, checking plural forms. Also when the user says a label shows as a raw key in the interface, that a language is missing strings, that the translation files have grown full of things nobody uses, that a text was never translated, or asks to clean up the localisation. It gives the search that actually finds a key's usages, the rule for deleting one safely, what counts as user-visible text, and the invariants a catalogue has to keep across every locale. Do not use it to choose a localisation library, to translate the copy itself, or for date and number formatting performance.

0 installs
▌
Padosoft AI Evaluation · padosoft bundle
Use this skill when measuring whether a model-backed feature works — building or changing an evaluation harness, a golden dataset, a metric, a scoring report, a regression gate on prompt or model changes. Also when the user asks how to know a prompt change made things better, how to stop a model upgrade silently regressing, what to put in a test set, how to score free-form output, or wants red-team coverage. It covers datasets and reports as versioned artifacts, the isolation an evaluation run needs, cohorts, and what must never leak into a report. Do not use it to write application tests (padosoft-test-integrity), to choose a model, or to design prompts.

0 installs
▌
Padosoft Skill Creator · padosoft bundle
Use this skill when creating, editing or reviewing an Agent Skill of the padosoft/skills repository, when the user wants to turn a recurring workflow, a checklist or a set of guidelines into a reusable skill, or when they ask where a skill belongs (profile, scope, package) or why the repo CI is failing on catalog, profiles or manifests: it guides the whole creation with scaffolding, the Padosoft conventions and the automated checks. Do not use it to write the technical domain content (that is the job of the skill you are creating) nor to install existing skills (padosoft-skills-router handles that). It also keeps the provenance of the work — dates, customers, people, ids, credentials — out of anything that gets published.

0 installs
▌
Padosoft Skills Router · padosoft
Use this skill when the user asks which Padosoft skills exist, which ones to install for the current project or stack, or how to update or remove them, and also when you are about to work on a company stack (Laravel, Node/Hono/Workers, React Native/Expo, HTML email, API, payments) and no skill covering that stack is installed: it points to the right skill and gives the exact install command. It does not replace the stack skills and does not do their technical work for them.

0 installs
▌
Padosoft Auth Hardening · padosoft bundle
Use this skill when building or reviewing anything to do with who a user is and how long they stay that way — login, registration, password reset or change, email change, invitations, sessions, API tokens, second factor, logout, remember-me, a captcha on a form. Also when the user reports credential stuffing, an account enumeration finding, a session that never expires, a password change that did not log other devices out, a lockout that never fires, or asks what a new application needs before it opens to the public. It gives the control, the reason it is shaped that way, and the ways each one is commonly present but ineffective. Do not use it for authorisation and ownership (padosoft-tenant-isolation) or for the whole security posture (padosoft-security-baseline).

0 installs
▌
Padosoft Test Integrity · padosoft bundle
Use this skill when writing or reviewing a test, and whenever a suite is suspicious: a test that passes whatever the code does, one that went green without the fix, an ordering test that never fails, a suite that passes alone and fails in sequence or in a different order, a flaky test blamed on CI. It checks that the body exercises what the name promises, that ordering assertions are strict, that global state is restored, that a failure-path test actually fires the failure, and that the assertion could fail at all. Do not use it to choose a test framework, to design a test strategy or coverage targets, or to debug a failing application bug.

0 installs
▌
Padosoft Admin Interface · padosoft bundle
Use this skill when building or reviewing an admin/back-office screen with a Laravel API behind it and an interactive frontend in front — a filtered listing, a dashboard with KPI cards and charts, an expandable table, an export, an autosuggest on a foreign key — and whenever the user says a panel shows a spinner forever, an empty result is indistinguishable from a failure, a filter returns everything, an export times out, a chart redraws on top of itself, or asks for "the admin page for X". It gives the layer pipeline on the server, the data contract across the boundary, and the four states every screen owes its user. Do not use it for public storefront pages, for the security review, or for choosing a UI component library.

0 installs
▌
Padosoft RAG Ingestion Security · padosoft bundle
Use this skill when content is brought into a corpus that a model will read — a connector to a document store, a mailbox, a ticket system, a wiki, an upload, a crawl — and whenever the question is who may see what came in. Also when the user reports that an assistant surfaced a document somebody should not have seen, asks how to mirror the source's permissions, worries about content written by outsiders reaching a tool call, or needs personal data kept out of an index. It covers the ingestion contract, permission mirroring that fails closed, authorship provenance, the indirect-injection chain, and redaction before embedding. Do not use it for choosing an embedding model, for retrieval quality, or for the shape of the corpus itself (padosoft-rag-knowledge-base).

0 installs
▌
Padosoft Agent Instructions Sync · padosoft bundle
Use this skill whenever a file that instructs a coding agent is created, changed or deleted — CLAUDE.md, AGENTS.md, a rule or skill folder, a Copilot instructions file, a Gemini or Cursor or Codex configuration — in a repository where more than one agent is used. Also when the user says one agent follows a rule the others ignore, that a convention was applied by one tool and not another, that an instructions file was truncated, or asks how to keep the instruction files aligned. It gives the one-source-many-targets contract, the per-target limits that force a transformation, and the checks that catch a target left behind. Do not use it to write the content of a rule, nor to build a skill for publication (padosoft-skill-creator covers that).

0 installs
▌
Padosoft Laravel Security Review · padosoft bundle
Use this skill before committing or reviewing a change to a Laravel application that touches a model's fillable or guarded, a Blade template printing unescaped, raw SQL, a file upload, a route exempted from CSRF, a shell call, a redirect built from input, an id coming from the request, an audit trail, or an AI/LLM call — and whenever the user asks for a security review or an audit, or says an endpoint returns somebody else's data or an error shows SQL to the user. It runs ten checks with ready pre-screens plus ownership, audit integrity and error-leak rules. Do not use it for API-side (padosoft-api-security-review) or mobile (padosoft-mobile-security-review) work, nor for infrastructure hardening.

0 installs
▌
Padosoft Payments Reconciliation · padosoft bundle
Use this skill when money moves: a checkout or capture, a refund, a chargeback, a payout, a subscription renewal, a promotion or loyalty redemption, a usage or token bill. Also when the user reports that totals do not add up, that a customer was charged twice, that a refund exceeded the payment, that a payout cannot be tied to orders, that a promotion went over its cap, or that a payment request timed out and nobody knows whether it went through. It checks the state machine, the arithmetic that has to close, and the boundary between what the provider owns and what you own. Do not use it to integrate a specific provider's SDK, for PCI scope decisions, or for pricing and tax strategy.

0 installs
▌
Padosoft Cross Platform Scripting · padosoft bundle
Use this skill when writing or reviewing a script that has to run in more than one place — a developer's Windows machine and a Linux CI runner, a Makefile, a validator, a hook, a release script — and whenever the user says it works locally but fails in CI (or the reverse), a command reported success while the step failed, a path is not found on one platform only, a dotfile is invisible, a file with an accented name is skipped, or a regex misses lines on one checkout. It covers exit-code propagation, path and case semantics, interpreter discovery and how not to parse another tool's human output. Do not use it to choose a scripting language, for container or deployment configuration, or for CI workflow design.

0 installs
▌
Padosoft React Native Conventions · padosoft bundle
Use this skill when writing or reviewing React Native / Expo code — a screen, a component, a Zustand store, a React Query hook, a FlashList, a Reanimated animation, a navigation change, a tablet layout — and whenever a symptom like these shows up: "Maximum update depth exceeded", a list that jumps or overlaps while scrolling, an animation that starts but leaves the state wrong, a value that is stale right after being set, a colour that is unreadable in dark mode, a translation missing in one language only. It applies the conventions and the recurring mistakes distilled from two production apps. Do not use it for mobile security (padosoft-mobile-security-review), for what goes in a log (padosoft-logging-discipline), or for native module and build configuration.

0 installs

44 published skills