← all publishers

pvillega

@pvillega source repo

Report this profile Claim this profile

• 38 skills
• 0 followers
• 1 week ago last updated

1. ▌
   Fix Loop · pvillega

   Iterative review-fix cycle that eliminates all critical issues. Runs code-reviewer, fixes critical findings, verifies tests pass, and repeats until clean or max iterations reached. Use when the user says "review and fix", "find and fix bugs", "clean up the code", "fix all issues", "review then fix", or any request that combines finding problems with resolving them automatically.
   0 installs
2. ▌
   Postgres · pvillega

   Deep PostgreSQL operational intuition — MVCC, VACUUM/autovacuum, WAL/checkpoints, streaming/logical replication, PgBouncer, deadlock diagnosis, pg_stat_statements triage. Load when tuning operationally, diagnosing incidents, replication lag, vacuum issues, pool sizing, or xid wraparound. Skip for ordinary query writing, schema design, or standard indexing. Triggers on: "autovacuum lag", "table bloat", "xid wraparound", "replication lag", "WAL bloat", "pgbouncer", "deadlock diagnosis", "pg_stat_statements", "vacuum stuck".
   0 installs
3. ▌
   Research · pvillega

   Use ONLY when the user explicitly requests multi-source research synthesis with citations — e.g., "/ct:research X", "research X in depth with citations", "investigate Y across authoritative sources", "compare approaches and cite sources". Applies systematic methodology with multi-hop reasoning and evidence-based synthesis. DO NOT trigger for: simple factual questions, single-source lookups, casual "research this" one-liners, codebase exploration, or informal fact-finding. For those, use WebSearch / tavily-cli / WebFetch directly.
   0 installs
4. ▌
   Bugmagnet · pvillega bundle

   Discover edge cases and test coverage gaps through systematic analysis. Use when analysing TEST coverage, hunting for edge cases, or when code-reviewer identifies test gaps. Triggers on "find holes in my tests", "what could go wrong", "is this well tested", "what edge cases am I missing". When to pick bugmagnet vs alternatives: - find-bugs → branch-diff bug scan (uses git diff, scoped to recent changes) - security-review → OWASP-categorised vulnerability audit - code-review → PR-style review with comment threads - ct:bugmagnet → test-gap edge-case discovery (THIS one) If the question is "are my TESTS missing cases?", use bugmagnet. Otherwise pick one of the three above.
   0 installs
5. ▌
   Dast Scan · pvillega

   Dynamic Application Security Testing with two tiers: Nuclei (fast, template-based) and ZAP (deep, active scanning via Docker). Use when asked to scan for vulnerabilities, run a security scan, DAST scan, pen test the app, check for XSS/SQLi/CSRF, scan for security issues on a running app, or after deploying a local dev server. Complements threat-modeling (design-time) with runtime verification. Triggers on: vulnerability scan, security scan, DAST, pen test, penetration test, XSS, SQL injection, CSRF, "is this secure" (for running apps), "scan my app", "check for vulnerabilities", "find security issues".
   0 installs
6. ▌
   Uv Python · pvillega

   Deep uv (Astral Python packaging/runtime) operational intuition — project model, lockfile semantics, workspaces, PEP 735 dependency groups, `[tool.uv.sources]`, build-isolation, managed Python, migration from pip/poetry/pipx. Load for uv workflow choices, lockfile behaviour, workspace layout, dependency-source quirks, build-isolation, or migration. Skip for ordinary Python coding, library APIs, or generic packaging primers. Triggers on: "uv lock", "uv sync --frozen", "uv.lock universal resolution", "tool.uv.sources", "dependency-groups PEP 735", "uvx", "no-build-isolation", "UV_LINK_MODE", "PEP 723 inline script".
   0 installs
7. ▌
   C Language · pvillega

   Deep C operational intuition — undefined behavior, sanitizers (ASan/UBSan/TSan/MSan), hardening flags, atomics/memory ordering, fuzzing, ABI quirks. Load when diagnosing UB, configuring sanitizers or hardened builds, investigating data races, or debugging alignment/atomics. Skip for ordinary C coding, malloc/free, or syntax help. Triggers on: "undefined behavior", "strict aliasing", "AddressSanitizer", "UBSan", "Valgrind", "use-after-free", "_FORTIFY_SOURCE", "memory_order", "libFuzzer", "ABI".
   0 installs
8. ▌
   Kubernetes · pvillega

   Deep Kubernetes operational intuition — QoS/eviction, scheduler failures, pod lifecycle and exit-code triage, DNS/NetworkPolicy subtleties, PV/PVC lifecycle, rollout/PDB/HPA, etcd hygiene. Load for cluster-level debugging, OOM/CrashLoop triage, Pending pods, networking weirdness, stuck storage, rollout tuning, or control-plane ops. Skip for "what is a Pod/Deployment", basic kubectl, manifest authoring, or Helm chart questions. Triggers on: "OOMKilled", "CrashLoopBackOff", "ImagePullBackOff", "ephemeral container", "ndots", "PVC stuck Terminating", "PodDisruptionBudget", "preStop", "native sidecar", "etcd defrag".
   0 installs
9. ▌
   Lint Guard · pvillega

   Set up strict complexity linting for any project. Detects languages, recommends linters, configures strict rules, and installs a Stop hook to enforce them automatically. Use when prompted by the SessionStart detection message, or manually to configure/reconfigure linting.
   0 installs
10. ▌
    Sqlite Wal · pvillega

    Deep SQLite operational intuition — WAL mechanics, checkpointing, fsync semantics, multi-process locking, FTS5 internals, replication (Litestream/LiteFS/rqlite). Load when diagnosing WAL, SQLITE_BUSY, multi-writer concurrency, network-FS corruption, pragma tuning, or backup/replication. Skip for ordinary SQL, schema design, or basic indexing. Triggers on: "WAL mode", "wal_checkpoint", "SQLITE_BUSY", "busy_timeout", "BEGIN IMMEDIATE", "sqlite over NFS", "FTS5 tokenizer", "Litestream", "LiteFS".
    0 installs
11. ▌
    Wcag Audit · pvillega

    WCAG accessibility auditing with two layers: static analysis (ESLint a11y plugins) and runtime analysis (axe-core CLI). Use when asked to audit accessibility, check WCAG compliance, find a11y issues, review for accessibility, check if a page is accessible, or after frontend-design completes a UI implementation. Triggers on: accessibility, a11y, WCAG, screen reader, alt text, aria, contrast ratio, keyboard navigation, "is this accessible", "check accessibility", "audit for accessibility".
    0 installs
12. ▌
    Tls Openssl · pvillega

    Deep TLS/openssl debugging — s_client handshake forensics, chain validation, ACME mechanics, OCSP stapling, mTLS, keystore conversion (PEM/DER/PKCS#12/JKS). Load when TLS will not connect, debugging cert chains, ACME failures, OCSP stapling, mTLS setup, or keystore conversion. Skip for "what is HTTPS" or basic crypto. Triggers on: "openssl s_client", "verify error", "SNI mismatch", "OCSP stapling", "ACME challenge", "HTTP-01", "DNS-01", "PKCS12 convert", "mTLS client cert", "missing intermediate".
    0 installs
13. ▌
    Audit Skills · pvillega

    Audit installed skills for redundancy with built-in model knowledge. Use when asked to "audit skills", "review my skills", "check skill redundancy", "which skills are useful", "clean up skills", or "are my skills teaching you anything new".
    0 installs
14. ▌
    Documentation · pvillega

    Use when writing or reviewing technical documentation — READMEs, API reference, inline comments, architecture docs, runbooks, migration guides, changelogs, tutorials. Also use when user asks to "document this", "write docs", "write a README", "explain this code", "write a runbook", "improve these docs". Language- and framework-agnostic guidelines. Do NOT use for ADRs (separate pattern) or for code comments on trivial code.
    0 installs
15. ▌
    Opentelemetry · pvillega

    Deep OpenTelemetry operational intuition — propagator selection in mixed fleets, head- vs tail-based sampling, semantic-convention stability, collector pipeline ordering, OTLP pitfalls, cardinality cost control. Load when tuning OTel SDK/collector, propagator mixing, sampling design, semantic-convention migration, or OTLP port mismatches. Skip for "what is a span" or first-time Grafana/Tempo/Jaeger setup. Pairs with `grafana`. Triggers on: "OTEL_PROPAGATORS", "b3multi propagator", "tail sampling", "ParentBased", "load-balancing exporter", "tail_sampling processor", "OTLP 4317", "memory_limiter processor", "k8sattributes processor", "OTEL_SEMCONV_STABILITY_OPT_IN", "exponential histogram", "Views API cardinality", "agent vs gateway collector".
    0 installs
16. ▌
    Bash Hardening · pvillega

    Deep bash correctness — `set -euo pipefail` traps, IFS/word-splitting, trap inheritance, process substitution, array gotchas, version-gated features, ShellCheck "looks right but isn't" patterns. Load when writing or hardening non-trivial bash scripts (installers, CI, unattended ops). Skip for basic if/while/for, one-shot interactive commands, or zsh/fish/POSIX-sh work. Triggers on: "set -e not triggering", "pipefail", "trap ERR", "PIPESTATUS", "macOS bash 3.2", "shellcheck SC2086", "harden bash script", "robust bash".
    0 installs
17. ▌
    Github Actions · pvillega

    Deep GitHub Actions operational intuition — concurrency groups, OIDC federation, matrix semantics, composite vs reusable workflows, cache scope, expression injection, pull_request_target footguns, v4 artifact/cache breaking changes. Load for workflow gotchas, security hardening, OIDC setup, cache behavior, runner pinning, or reusable- vs-composite design. Skip for first-time CI workflow authoring. Triggers on: "pull_request_target", "pwn request", "expression injection", "OIDC trust", "reusable workflow", "actions/cache v4", "actions/upload-artifact v4", "GITHUB_TOKEN permissions", "id-token write", "fork PR secrets".
    0 installs
18. ▌
    Dependency Bump · pvillega

    Detect the package ecosystem, run outdated/audit commands, propose a staged bump plan (patch → minor → major), regenerate the lockfile, run tests, and summarise breaking changes. Use when the user says "update dependencies", "bump deps", "what's outdated", "cargo update", "pip outdated", "go mod tidy", or "security update deps". Touches only project-local manifests and lockfiles. Never global installs, never commits — returns the diff for user review. Toolchain upgrades (Node/Python/Rust version) are out of scope.
    0 installs
19. ▌
    Docker Buildkit · pvillega

    Deep BuildKit operational intuition — frontend pinning, RUN --mount (cache/secret/ssh), cache export/import backends, multi-platform QEMU vs native, buildx drivers, image hardening, SBOM/SLSA attestations, rootless caveats. Load for BuildKit tuning, cache miss diagnosis, multi-platform builds, build secrets, registry cache, or image hardening. Skip for basic Dockerfile syntax, `docker run`/ compose runtime, or orchestration. Triggers on: "RUN --mount", "syntax=docker/dockerfile", "cache-to registry", "cache-from gha", "buildx bake", "COPY --link", "distroless", "SLSA provenance", "rootless buildkit".
    0 installs
20. ▌
    Threat Modeling · pvillega

    Apply STRIDE with DFD trust boundaries and DREAD scoring. Use when implementing auth, file uploads, payments, webhooks, OAuth/SSO, APIs, multi-tenant, or external integrations — or when asked for a security review, audit, hardening, or vulnerability assessment. Triggers on: "is this secure", "security review", "make this secure", "harden this", "threat model", "STRIDE", "trust boundary". Use for ANY feature that handles user data, accepts external input, or crosses trust boundaries.
    0 installs
21. ▌
    Mutation Testing · pvillega bundle

    Diff-scoped mutation testing to verify test quality beyond coverage metrics. Detects language, selects the appropriate tool (Stryker, mutmut, cargo-mutants, PIT, gremlins), and runs mutations only on changed code. Use when asked to run mutation testing, check test quality, find weak tests, verify test coverage is meaningful, or "are my tests actually catching bugs?". Also use after TDD cycle completes or when bugmagnet identifies test coverage gaps. Triggers on: mutation testing, mutant, test quality, weak tests, test effectiveness, "do my tests catch bugs", "are these tests good enough", "verify test quality", "mutation score".
    0 installs
22. ▌
    CI Failure Triage · pvillega

    Diagnose a failing GitHub Actions run. Fetch the failing job's step logs, correlate with recent commits, and produce a ranked top-3 root-cause hypothesis plus a minimal fix proposal. Use when the user says "CI is failing", "why did the build break", "triage this GHA failure", "workflow failed", "what broke CI", or pastes a `gh run` URL / run ID. Read-only — does NOT apply fixes, restart the run, or tail logs. For workflow-file security audits use gha-security-review; for local test failures use fix-loop.
    0 installs
23. ▌
    Stacktrace Triage · pvillega

    Parse a pasted stack trace, identify the runtime, separate user from library frames, locate the top user frame in source, and produce a ranked top-3 hypothesis tree. Read-only — does NOT edit code, reproduce, or propose a fix. Use when the user says "here's the stack trace", "investigate this traceback", "why did this crash", "triage this error", "segfault", or pastes a panic/traceback. For the patch, dispatch `debugger` to reproduce and fix.
    0 installs
24. ▌
    Secrets Management · pvillega

    Deep secret-management operational intuition — tradeoffs across sops+age, KMS, Vault, Sealed Secrets, External Secrets Operator, k8s Secrets; rotation, threat boundaries, leak detection, workflow specifics. Load when choosing approaches, designing rotation, configuring sops/Vault/ESO/Sealed Secrets, etcd encryption, or diagnosing leak/propagation/bootstrap problems. Skip for "store this password" or trivial `kubectl create secret`. Triggers on: "sops", "age encryption", "AppRole", "sealed secrets", "ExternalSecret", "kubeseal", "etcd encryption at rest", "dynamic credentials", "gitleaks", "auto-unseal".
    0 installs
25. ▌
    Terraform Opentofu · pvillega

    Deep Terraform/OpenTofu operational intuition — state-file mechanics and locking, refactoring blocks (import/moved/removed), lifecycle gotchas, count-vs-for_each migration, backend migration, post-1.5.5 fork divergence. Load for state surgery, refactoring blocks, lifecycle interactions, backend migration, or TF vs OpenTofu choices. Skip for ordinary resource authoring, basic HCL, "what is Terraform", or first-time provider setup. Triggers on: "terraform state mv", "import block", "moved block", "removed block", "create_before_destroy", "force-unlock", "init -migrate-state", "OpenTofu vs Terraform", "tofu fork".
    0 installs
26. ▌
    Duplicate Code Detector · pvillega bundle

    Use when the user mentions duplicated code, copy-paste, code clones, repeated code, similar code across files, overlapping implementations, code quality audit, code smells, technical debt involving duplication, or refactoring preparation. Also for cross-language duplication checks, CI duplication warnings, and codebase redundancy scans. DO NOT TRIGGER for implementing refactoring (use incremental-refactoring), fixing bugs, writing tests, adding features, or code review.
    0 installs
27. ▌
    Incremental Refactoring · pvillega bundle

    Use when the user asks to refactor, clean up, restructure, extract methods, reduce complexity, or improve code structure without changing behavior. Triggers on: extract method, move function, simplify conditional, reduce nesting, split class. To FIND duplicates first, use duplicate-code-detector then return here. Not for features, bugs, or performance.
    0 installs
28. ▌
    Performance Optimization · pvillega bundle

    Use when optimizing backend, API, database, or system performance. Also use when response times are slow, queries need tuning, throughput is degraded, or someone says "just add caching." Triggers on: optimize API, backend slow, API latency, database performance, query optimization, server response time, connection pooling, N+1 queries, cache strategy, load testing. For frontend/UI performance (Core Web Vitals, Lighthouse accessibility), use frontend-production-quality instead.
    0 installs
29. ▌
    Rust · pvillega

    Deep Rust operational intuition — borrow patterns, lifetime variance, Pin/Unpin and async state machines, Send/Sync, tokio scheduler quirks, unsafe/UB, miri, build/runtime profiling, allocators, no_std. Load for borrow-checker workarounds, async pin pitfalls, unsafe diagnosis, tokio tuning, build-time triage, or no_std/embedded. Skip for ordinary Rust coding, basic ownership/Result/Option, or beginner cargo workflows. Triggers on: "lifetime variance", "self-referential future", "pin projection", "Send/Sync error", "tokio task starvation", "miri", "stacked borrows", "MaybeUninit", "global_allocator", "no_std", "Polonius".
    0 installs
30. ▌
    Redis · pvillega

    Deep Redis operational intuition — RDB/AOF persistence math, eviction policy semantics, SLOWLOG/LATENCY diagnostics, cluster vs Sentinel topology, hash slots/resharding, replication backlog, fragmentation, Valkey/KeyDB/Dragonfly variants. Load for persistence tradeoffs, eviction misbehavior, latency spikes, cluster/sentinel topology, replication lag, hot-key detection, or fork evaluation. Skip for ordinary key/value work, command syntax, or "what is Redis". Triggers on: "RDB vs AOF", "appendfsync", "maxmemory-policy", "SLOWLOG", "MOVED redirect", "failover quorum", "PSYNC full resync", "valkey", "dragonfly".
    0 installs
31. ▌
    Argocd · pvillega

    Deep ArgoCD operational intuition — sync waves and hook lifecycle, ApplicationSet generators, Sync vs Health, drift root causes, sync options, AppProject constraints, rollback, multi-cluster. Load for sync ordering, hook design, drift diagnosis, generator selection, rollback planning, or multi-cluster registration. Skip for "what is GitOps", install walkthroughs, or basic Application YAML. Triggers on: "sync wave", "presync hook", "syncfail", "applicationset generator", "matrix generator", "hpa replicas drift", "ignoreDifferences", "ServerSideApply", "Replace=true", "self-heal", "app-of-apps cascade".
    0 installs
32. ▌
    Golang · pvillega

    Deep Go operational intuition — GC tuning (GOGC/GOMEMLIMIT), GOMAXPROCS in containers, escape analysis, pprof/trace, goroutine leaks, govulncheck, memory model. Load when tuning runtime, diagnosing leaks/GC pressure, reviewing escape analysis, or hitting module/build quirks. Skip for ordinary Go coding, channel syntax, or style debates. Triggers on: "GOMEMLIMIT", "GOGC tuning", "GOMAXPROCS container", "automaxprocs", "escape analysis", "pprof mutex profile", "goroutine leak", "govulncheck", "happens-before".
    0 installs
33. ▌
    Coolify · pvillega

    Deep Coolify operational intuition — control-plane vs destination split, build-pack detection, env-var precedence, Traefik label generation, magic SERVICE_* variables, webhooks, preview deployments, backups, upgrade/rollback. Load when diagnosing a Coolify deployment, env-var/webhook misbehavior, Traefik label issues, multi-server destinations, or backup/restore. Skip for generic Docker/compose, generic Traefik tuning, or "what is a PaaS". Triggers on: "coolify deploy stuck", "coolify webhook", "coolify traefik labels", "SERVICE_FQDN", "coolify rollback", "Sentinel agent", "Nixpacks detection".
    0 installs
34. ▌
    Grafana · pvillega

    Deep Grafana stack operational intuition — Prometheus/Mimir cardinality cost, PromQL/LogQL pitfalls, alert lifecycle, provisioning + UID stability, histogram math, Tempo TraceQL, Alertmanager grouping. Load when diagnosing cardinality bombs, alert flapping, provisioning at scale, quantile correctness, or trace-to-metric correlation. Skip for panel building, basic PromQL, install, or first-time dashboards. Triggers on: "cardinality bomb", "rate vs irate", "histogram_quantile", "recording rule", "keep_firing_for", "loki cardinality", "max_global_series_per_user", "traceql", "group_wait", "group_left", "native histograms".
    0 installs
35. ▌
    Hetzner · pvillega

    Deep Hetzner operational intuition — Cloud vs Robot vs Storage Box split, server-type taxonomy, region availability, IPv4 cost model, snapshot vs backup vs image, firewall default-deny, hcloud CLI, Floating-IP aliasing, cloud-init, Terraform provider drift. Load when sizing Hetzner resources, migrating to/from Hetzner, automating with hcloud/Terraform, or diagnosing Hetzner-specific gotchas. Skip for generic IaaS, Linux admin, or non-Hetzner clouds. Triggers on: "hcloud cli", "hcloud_server", "cax11", "cpx21", "fsn1", "hetzner robot", "primary ip cost", "without-ipv4", "vswitch", "floating ip hetzner", "storage box".
    0 installs
36. ▌
    Reflect · pvillega

    CLAUDE.md + engram memory lifecycle management. Generates structured reflections, reviews and applies them to CLAUDE.md, consolidates CLAUDE.md health, and maintains engram memory hygiene. Triggers ONLY on: /reflect, /reflect review, /reflect consolidate, or explicit requests like "prune CLAUDE.md", "review my engram memories", "consolidate CLAUDE.md", "audit CLAUDE.md health", "write a session reflection for REFLECTION.md". DO NOT trigger on casual uses of "reflect on X", "let's reflect", or "what did we learn" outside the context of CLAUDE.md / REFLECTION.md / engram memory hygiene.
    0 installs
37. ▌
    Systemd · pvillega

    Deep systemd operational intuition — unit dependency semantics, Type= internals, restart-throttle math, cgroup v2 control, hardening directives, socket/timer activation, journald forensics. Load when authoring/debugging unit files, diagnosing startup failures, restart loops, cgroup limits, or sandbox tuning. Skip for plain `systemctl start|stop|status`, simple ExecStart edits, or basic boot questions. Triggers on: "stuck in activating", "Type=notify", "sd_notify", "ordering cycle", "MemoryMax", "ProtectSystem strict", "SystemCallFilter", "socket activation", "drop-in override", "loginctl enable-linger".
    0 installs
38. ▌
    Traefik · pvillega

    Deep Traefik (v2/v3) operational intuition — provider precedence, ACME challenge debugging, middleware ordering, router rule syntax, v2→v3 breaking changes, Docker/k8s label and CRD footguns, mTLS, certResolver gotchas. Load for static/dynamic config, ACME failures, middleware ordering, rule debugging, v2→v3 migration, IngressRoute CRDs, or Coolify-embedded Traefik. Skip for generic reverse-proxy concepts, basic HTTP routing, or nginx/Caddy/HAProxy. Triggers on: "traefik labels", "traefik middleware order", "acme.json", "tls challenge", "dns challenge", "ingressroute", "defaultRuleSyntax", "coolify traefik".
    0 installs