sugatoray

@sugatoray source repo

74 skills
0 followers
3 hours ago last updated

▌
Vciso · sugatoray
Virtual CISO role bundle for organizations without a full-time CISO. Orchestrates security program assessment, compliance readiness, risk management, and board-level reporting. Auto-invoked when the user asks for security program guidance, compliance assessment, risk posture evaluation, or board reporting preparation. Sequences the appropriate security skills based on engagement type.

0
installs
▌
Soc Analyst · sugatoray
SOC Analyst role bundle covering Tier 1 through Tier 3 operations. Orchestrates alert triage, threat hunting, incident investigation, and detection engineering workflows. Auto-invoked when the user needs help with security monitoring, alert analysis, threat hunting hypotheses, incident timelines, or detection rule development. Sequences the appropriate security skills based on the operational engagement type.

0
installs
▌
Appsec Engineer · sugatoray
Application Security Engineer role bundle for security design, testing, and code review of applications. Orchestrates new application reviews, PR security reviews, API security assessments, and AI feature security reviews. Auto-invoked when the user needs help with application threat modeling, secure code review, API security testing, or evaluating the security of LLM-powered application features.

0
installs
▌
Security Engineer · sugatoray
Security Engineer role bundle for building security into products and infrastructure. Orchestrates code review, pipeline hardening, vulnerability response, and infrastructure review workflows. Auto-invoked when the user needs help with secure development practices, CI/CD security, vulnerability management, or infrastructure security assessment. Sequences the appropriate security skills based on engineering engagement type.

0
installs
▌
AWS Review · sugatoray bundle
Performs an AWS security posture review against the CIS Amazon Web Services Foundations Benchmark v3.0.0. Auto-invoked when reviewing AWS infrastructure, IAM policies, S3 configurations, CloudTrail settings, VPC security groups, or RDS encryption. Walks through all five benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.

0
installs
▌
GCP Review · sugatoray bundle
Performs a GCP security posture review against the CIS Google Cloud Platform Foundation Benchmark v2.0.0. Auto-invoked when reviewing GCP infrastructure, IAM bindings, VPC firewall rules, Cloud Audit Logs, or GCS bucket security. Walks through all seven benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.

0
installs
▌
Siem Rules · sugatoray
Guides development of SIEM detection rules using KQL (Microsoft Sentinel) and SPL (Splunk) query languages, mapped to MITRE ATT&CK v16 techniques. Auto-invoked when the user needs to write SIEM queries, tune alert thresholds, build correlation rules, or manage the detection rule lifecycle. Produces production-ready queries with detection logic patterns, threshold tuning guidance, and lifecycle management.

0
installs
▌
Azure Review · sugatoray bundle
Performs an Azure security posture review against the CIS Microsoft Azure Foundations Benchmark v2.1.0. Auto-invoked when reviewing Azure infrastructure, Entra ID configurations, NSG rules, Defender for Cloud settings, or Key Vault access policies. Walks through all nine benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.

0
installs
▌
Iac Security · sugatoray bundle
Performs a security review of Infrastructure as Code templates against the OWASP IaC Security Cheat Sheet, SLSA v1.0, and CIS Benchmarks. Auto-invoked when reviewing Terraform, CloudFormation, or Pulumi configurations. Detects hardcoded secrets, public exposure patterns, encryption gaps, overly permissive IAM, and misconfigurations equivalent to Checkov, tfsec, and KICS rules. Produces a structured findings report with remediation guidance.

0
installs
▌
API Security · sugatoray bundle
Reviews REST and GraphQL APIs against the OWASP API Security Top 10:2023. Auto-invoked when reviewing OpenAPI/Swagger specs, API endpoint code, or GraphQL schemas. Covers BOLA, BFLA, authentication, rate limiting, and SSRF. Produces findings mapped to API1-API10 with remediation guidance.

0
installs
▌
Soc2 Gap · sugatoray bundle
Performs a SOC 2 Type II readiness gap analysis against AICPA Trust Services Criteria. Auto-invoked when discussing SOC 2 compliance, audit preparation, or security program maturity. Walks through all Common Criteria (CC1-CC9) plus selected additional criteria, identifies gaps, and produces a remediation roadmap with evidence requirements and 90-day action plan.

0
installs
▌
Iam Review · sugatoray
Reviews identity and access management configurations against NIST SP 800-63B, NIST SP 800-207 zero trust principles, and CIS Controls v8. Auto-invoked when reviewing IAM policies, role definitions, user provisioning workflows, or when asked to assess identity security posture. Produces findings on least privilege violations, MFA gaps, stale accounts, and service account hygiene with prioritized remediation.

0
installs
▌
Alert Triage · sugatoray
Guides structured triage of security alerts using a four-phase methodology (collect, correlate, classify, escalate) mapped to MITRE ATT&CK v16 and aligned with NIST SP 800-61 Rev 2 incident handling guidelines. Auto-invoked when the user discusses alert investigation, asks "is this a true positive?", or shares alert data requiring disposition. Produces a triage decision with priority assignment, disposition category, and escalation recommendation.

0
installs
▌
Log Analysis · sugatoray
Guides structured security log analysis across authentication, network, endpoint, and cloud audit log sources. Auto-invoked when the user shares log data, asks about suspicious events, needs help interpreting Windows Event IDs or Linux auth logs, or is establishing baselines for anomaly detection. Produces log source taxonomy, anomaly identification, baseline recommendations, and correlation findings mapped to MITRE ATT&CK v16 techniques.

0
installs
▌
Rbac Design · sugatoray
Guides the design and assessment of RBAC and ABAC authorization models against the NIST RBAC model (Sandhu et al.) and NIST SP 800-162 (ABAC guide). Auto-invoked when designing role hierarchies, evaluating permission boundaries, implementing ABAC policy patterns, performing role mining, or preventing role explosion. Produces architecture recommendations with framework-grounded rationale.

0
installs
▌
Dns Security · sugatoray
Performs a structured DNS security review against NIST SP 800-81 Rev 2 (Secure Domain Name System Deployment Guide) and CIS Controls v8 (Control 9.2 -- Use DNS Filtering Services). Auto-invoked when reviewing DNS configurations, DNSSEC deployment, or investigating DNS-based exfiltration and tunneling indicators. Produces a DNS security assessment covering DNSSEC validation, protective DNS, and exfiltration detection patterns.

0
installs
▌
Segmentation · sugatoray
Performs a structured network segmentation review against NIST SP 800-207 (Zero Trust Architecture) and CIS Controls v8 (Control 12 -- Network Infrastructure Management). Auto-invoked when reviewing network architecture, VLAN configurations, micro-segmentation policies, or DMZ designs. Produces a segmentation maturity assessment with zone mapping, trust boundary analysis, and remediation guidance.

0
installs
▌
Dast Config · sugatoray
Reviews DAST tool configurations against OWASP Top 10:2021 and OWASP Testing Guide v4.2. Auto-invoked when reviewing OWASP ZAP configurations, DAST CI/CD integration, scan policies, or authenticated scanning setups. Produces a DAST maturity assessment covering scan policy configuration, active vs passive scanning, API scanning, authentication handling, and results deduplication.

0
installs
▌
Sast Config · sugatoray
Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows. Produces a SAST maturity assessment covering rule authoring, severity tuning, custom rule development, and CI integration patterns.

0
installs
▌
Cloud Security Engineer · sugatoray
Cloud Security Engineer role bundle for cloud security posture management, IaC review, container security, and identity governance across AWS, Azure, and GCP. Orchestrates cloud-specific posture reviews and zero trust program assessments. Auto-invoked when the user needs help with cloud security configuration, IaC hardening, container orchestrator security, or identity governance in cloud environments.

0
installs
▌
LLM Top 10 · sugatoray
Reviews LLM-powered applications against the OWASP Top 10 for Large Language Model Applications (2025 edition). Auto-invoked when reviewing code that integrates LLM APIs, builds RAG pipelines, or deploys AI-powered features. Produces a structured findings report mapped to LLM01-LLM10 with severity ratings, CWE mappings, and prioritized remediation guidance.

0
installs
▌
Threat Modeling · sugatoray bundle
Runs a structured STRIDE threat model on any system design, API specification, or codebase. Auto-invoked when the user discusses architecture, shares a system diagram or design document, or asks "what could go wrong?" Produces threat actor profiles, component-threat matrix, a threat register with STRIDE classification, data-flow diagram template, trust boundary identification, and prioritized mitigations mapped to MITRE ATT&CK techniques.

0
installs
▌
Access Review · sugatoray
Conducts access review and entitlement audit against CIS Controls v8 (Controls 5, 6) and NIST SP 800-53 AC family. Auto-invoked when reviewing entitlement certifications, orphaned accounts, role explosion, segregation of duties violations, or quarterly access recertification campaigns. Produces findings with severity, framework mapping, and remediation roadmap.

0
installs
▌
Owasp Top 10 Web · sugatoray bundle
Reviews web applications against the OWASP Top 10:2021 vulnerability categories. Auto-invoked when reviewing web application code, server configurations, or when a user asks for a general security review of a web application. Produces structured findings mapped to A01-A10 with CWE references, severity ratings, and specific remediation guidance.

0
installs
▌
Hipaa Review · sugatoray
Performs a HIPAA Security Rule compliance review against all Administrative, Physical, and Technical Safeguards defined in 45 CFR Part 164, Subpart C. Auto-invoked when discussing healthcare data security, ePHI protection, HIPAA audit readiness, or business associate compliance. Evaluates required and addressable implementation specifications, identifies gaps, and produces a remediation roadmap aligned to HHS enforcement priorities.

0
installs
▌
Iso27001 Gap · sugatoray
Performs an ISO 27001:2022 gap analysis against the full ISMS requirements (Clauses 4-10) and all 93 Annex A controls reorganized into four themes. Auto-invoked when discussing ISO 27001 certification readiness, ISMS implementation, or Statement of Applicability development. Identifies control gaps, scores implementation maturity, and produces a remediation roadmap aligned to the 2022 revision structure.

0
installs
▌
Firewall Review · sugatoray
Performs a structured firewall rule base audit against CIS Controls v8 (Controls 4.4 and 4.5) and NIST SP 800-41 Rev 1 (Guidelines on Firewalls and Firewall Policy). Auto-invoked when reviewing firewall configurations, ACLs, or network security policies. Produces a prioritized findings report covering overly permissive rules, shadowed rules, logging gaps, and egress filtering deficiencies.

0
installs
▌
Container Security · sugatoray bundle
Performs a container and Kubernetes security review against the CIS Docker Benchmark v1.6.0, CIS Kubernetes Benchmark v1.9.0, and NIST SP 800-190. Auto-invoked when reviewing Dockerfiles, Kubernetes manifests, Helm charts, or container orchestration configurations. Evaluates image security, runtime hardening, RBAC, Pod Security Standards, network policies, and secrets management. Produces a prioritized findings report with remediation guidance.

0
installs
▌
Secure Code Review · sugatoray bundle
Performs a structured security code review against OWASP ASVS 4.0.3 verification requirements and CWE Top 25. Auto-invoked on pull request reviews, when code touching authentication, authorization, cryptography, or input handling is shared. Produces findings mapped to ASVS controls and CWE identifiers with severity ratings and specific remediation guidance.

0
installs
▌
Pci Dss Review · sugatoray
Performs a PCI DSS v4.0 compliance review across all 12 requirements and their sub-requirements. Auto-invoked when discussing payment card security, cardholder data protection, PCI compliance validation, or merchant/service provider assessment. Covers scope reduction strategies, SAQ vs ROC determination, compensating controls, customized approach, and the new targeted risk analysis requirements introduced in v4.0.

0
installs
▌
Agent Security · sugatoray
Reviews AI agent architectures for security risks including permission model design, least-privilege enforcement, human-in-the-loop gate placement, blast radius containment, audit trail completeness, rollback capability, and multi-agent trust boundaries. Auto-invoked when reviewing agentic AI systems where LLMs invoke tools, take autonomous actions, or operate in multi-agent configurations. Produces a structured architecture security assessment mapped to OWASP Agentic AI threats and NIST AI RMF 1.0.

0
installs
▌
Agentic Top 10 · sugatoray
Reviews agentic AI systems against the OWASP Top 10 security risks for autonomous AI agents. Auto-invoked when reviewing multi-agent architectures, AI agent deployments, or systems where LLMs have tool access and act autonomously. Covers permission models, tool security, memory integrity, trust boundaries, and human oversight. Produces a structured assessment with risk ratings and architectural recommendations.

0
installs
▌
Dependency Scanning · sugatoray bundle
Analyzes project dependencies for known vulnerabilities, license risks, and supply chain integrity. Auto-invoked when package manifests (package.json, requirements.txt, go.mod, pom.xml, Cargo.toml) are shared or when discussing dependency security. Produces an SBOM assessment with CVE findings triaged by EPSS and CISA KEV, license compliance check, and supply chain risk rating.

0
installs
▌
Privileged Access · sugatoray
Performs a Privileged Access Management (PAM) review against CIS Controls v8 (Controls 5.4, 6.5) and NIST SP 800-53 AC-6 (Least Privilege). Evaluates PAM tool effectiveness, just-in-time access patterns, break-glass procedures, session recording, and credential vaulting. Produces findings with severity, framework mapping, and remediation guidance.

0
installs
▌
Cve Triage · sugatoray
Triages and prioritizes CVEs using CVSS 4.0, SSVC 2.1 decision trees, EPSS scores, and CISA KEV catalog cross-referencing. Auto-invoked when a CVE ID is mentioned, vulnerability scan results are shared, or the user asks "should we patch this?" Produces a prioritized remediation recommendation with SLA assignment and business risk context.

0
installs
▌
AI Data Privacy · sugatoray
Reviews AI/ML systems for data privacy and governance risks including training data privacy, PII exposure in prompts and completions, data retention policies, model memorization risks, and regulatory compliance. Auto-invoked when reviewing systems that process personal data through LLMs, train or fine-tune models on user data, or deploy AI in regulated industries. Produces a structured assessment mapped to NIST AI RMF 1.0 and OWASP LLM02:2025 (Sensitive Information Disclosure).

0
installs
▌
Pipeline Security · sugatoray
Reviews CI/CD pipeline configurations against SLSA v1.0 build levels and OWASP Top 10 CI/CD Security Risks. Auto-invoked when reviewing GitHub Actions workflows, GitLab CI configs, Jenkins pipelines, or when discussing supply chain security. Produces a pipeline security assessment with SLSA level determination and CICD-SEC risk findings.

0
installs
▌
Prompt Injection · sugatoray
Tests LLM applications for prompt injection vulnerabilities per OWASP LLM01:2025. Covers direct injection (user input manipulating model behavior) and indirect injection (external content containing hidden instructions). Auto-invoked when reviewing LLM applications that process external content, build RAG pipelines, or accept user input that reaches a language model. Produces a test report with categorized findings and defense recommendations.

0
installs
▌
Secrets Management · sugatoray
Performs a structured secrets management review against OWASP Secrets Management Cheat Sheet and NIST SP 800-57 Part 1 Rev 5 (Recommendation for Key Management). Auto-invoked when reviewing secret handling patterns, vault configurations, .env files, or credential rotation policies. Produces a secrets management assessment covering detection patterns, rotation automation, vault integration, and agent-specific credential handling.

0
installs
▌
Detection Engineering · sugatoray
Guides creation of detection rules using Sigma rule specification and the Palantir Alerting and Detection Strategy (ADS) framework, mapped to MITRE ATT&CK v16 techniques. Auto-invoked when the user discusses detection logic, Sigma rules, ATT&CK coverage gaps, or asks "how do I detect this technique?" Produces Sigma-formatted detection rules, ADS documentation, and coverage heatmap methodology for systematic detection program management.

0
installs
▌
Containment · sugatoray
Provides structured incident containment strategies mapped to NIST SP 800-61 Rev 2 and MITRE ATT&CK techniques. Auto-invoked when a confirmed incident requires isolation decisions, credential revocation, network segmentation, or DNS sinkholing. Produces a containment plan with short-term and long-term actions, business impact assessment, and ATT&CK-mapped countermeasures.

0
installs
▌
Ir Playbook · sugatoray
Executes a structured incident response workflow based on NIST SP 800-61 Rev 2 and the SANS Incident Handler's Handbook. Auto-invoked when the user reports a security incident, asks how to respond to a breach, or needs help with incident classification, containment decisions, stakeholder notification, or evidence preservation. Produces an incident response plan with severity determination, containment decision tree, communication templates, and escalation criteria.

0
installs
▌
Sbom Analysis · sugatoray
Analyzes Software Bills of Materials (SBOMs) for completeness against NTIA minimum elements, interprets VEX status documents, performs transitive dependency risk analysis, and detects license conflicts. Supports CycloneDX 1.5 and SPDX 2.3 formats with CSAF-based VEX correlation. Auto-invoked when SBOM files are shared, supply chain risk questions arise, or VEX documents require interpretation.

0
installs
▌
Model Supply Chain · sugatoray
Reviews AI/ML model supply chains for security risks including model provenance verification, training data lineage, fine-tuning pipeline integrity, inference dependency review, and backdoor detection. Auto-invoked when reviewing systems that download pre-trained models, fine-tune foundation models, or deploy models from third-party sources. Produces a structured assessment mapped to OWASP LLM03:2025, SLSA v1.0 supply chain levels, and MITRE ATLAS poisoning and supply chain techniques.

0
installs
▌
Nist Csf Assessment · sugatoray
Performs a NIST Cybersecurity Framework 2.0 assessment across all six functions (Govern, Identify, Protect, Detect, Respond, Recover) and their categories and subcategories. Auto-invoked when discussing cybersecurity maturity, risk posture evaluation, or NIST CSF alignment. Develops current and target organizational profiles, assesses maturity tiers, maps informative references, and produces a prioritized improvement roadmap.

0
installs
▌
Zero Trust Assessment · sugatoray
Performs a Zero Trust Architecture maturity assessment against NIST SP 800-207 and the CISA Zero Trust Maturity Model v2. Evaluates all five CISA ZT pillars (Identity, Devices, Networks, Applications & Workloads, Data) across maturity stages. Covers microsegmentation readiness, continuous verification, and produces a pillar-by-pillar maturity scorecard with remediation roadmap.

0
installs
▌
Scanner Tuning · sugatoray
Tunes vulnerability scanners to reduce false positives, optimize scan policies, and improve result accuracy. Covers false positive identification patterns, scan policy configuration, authenticated vs unauthenticated scanning tradeoffs, severity override criteria, plugin/check selection, scan scheduling, and result correlation across multiple scanners. Uses CVSS 4.0 for severity validation and CWE for vulnerability classification.

0
installs
▌
Patch Prioritization · sugatoray
Prioritizes patches and manages remediation SLAs using SSVC 2.1 decision outcomes, EPSS v3 trend analysis, and CISA KEV catalog cross-referencing. Covers SLA frameworks by severity tier, compensating controls assessment, patch window scheduling, risk acceptance criteria, and exception management. Auto-invoked when users ask about patch scheduling, SLA compliance, risk exceptions, or remediation backlogs.

0
installs
▌
Forensics Checklist · sugatoray
Guides digital forensic evidence collection following NIST SP 800-86 and RFC 3227 order of volatility. Auto-invoked when the user needs to collect forensic evidence, preserve chain of custody, capture volatile data, create disk images, or handle cloud forensics. Produces an evidence collection plan with volatility-prioritized acquisition steps, integrity verification, and chain-of-custody documentation.

0
installs
▌
Post Incident Review · sugatoray
Conducts a structured post-incident review following NIST SP 800-61 Rev 2 Post-Incident Activity guidance. Auto-invoked when an incident has been resolved and the team needs to conduct a blameless retrospective, reconstruct the timeline, perform root cause analysis, document lessons learned, and track remediation actions. Produces a PIR report with metrics (MTTD, MTTR, MTTC), control failure mapping, and actionable improvement plan.

0
installs
▌
Postrboard · sugatoray
Apply the Postrboard design language to frontend work. Quiet CSS for loud products, code-native, restrained, non-generic.

0
installs
▌
Impeccable 2 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 3 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 4 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 5 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 6 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 7 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 8 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 9 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 10 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 11 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 12 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 13 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Impeccable 14 · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs
▌
Stata Recipes · sugatoray bundle
Turns a plain-language description of a data/statistics task into correct, runnable Stata code — a .do file or command sequence, not pseudocode. Use this whenever the user asks how to do something in Stata, wants a Stata command or .do file written or fixed, mentions Stata alongside a modeling task (regression, panel data, time series, ARDL, fixed effects, diff-in-diff, matching, etc.), or wants Stata and Python working together (running Python from inside a .do file, pulling Stata's dataset into pandas, or driving Stata from a Python script via pystata/stata_setup or batch mode). Also trigger when the user pastes Stata code that errors or gives wrong-looking results and wants it debugged, or asks 'is this good Stata style' / 'what's wrong with this command'. Covers a growing library of named recipes for common econometric workflows (ARDL modeling shipped now; more added over time) that produce a ready-to-run script, not just an explanation.

0
installs
▌
Scrolls Help · sugatoray bundle
Shows a crisp, example-driven reference for the whole scrolls skill family (/scrolls-setup, /scrolls-update, /scrolls-hide, /scrolls-unhide) — what each command does, their shared -p/-t/-l/-r/-u flags, and common usage examples (new project, monorepo, running from a subdirectory, toggling hidden/visible). Use this whenever the user runs /scrolls-help, or asks what the scrolls commands do, how to use them, what flags they take, which one they need, or seems unsure about docs/.scrolls setup — even if they only name one of the four commands rather than 'scrolls' generally. Supports -e/--online to render it as a styled page served on an OS-assigned localhost port instead of chat text, with light/dark and colorize/plain toggles. Works on macOS, Linux, and Windows (bash or PowerShell).

0
installs
▌
Scrolls Hide · sugatoray bundle
Converts an already-set-up docs/scrolls/ working-memory folder from visible (scrolls) to dotfile-hidden (.scrolls), renaming the folder and rewriting the path references inside it and in SCROLLS.md so nothing breaks. Use this whenever the user runs /scrolls-hide, or asks to hide, dot, or re-hide the scrolls folder, go back to hiding project memory / docs/.scrolls, or rename scrolls to .scrolls. This is the retrofit path for a project that was set up visible and now wants it hidden — for a brand-new project, /scrolls-setup's default (no -u/--unhide flag) already creates it hidden and this skill isn't needed. By default checks one exact location (docs/scrolls under the current directory); supports -r/--recurse to sweep an entire directory tree instead (e.g. every package in a monorepo in one run), repeatable -p/--path to target specific locations, -t/--reporoot to target the git repository's top level regardless of which subdirectory you're in, -l/--local to target the current directory explicitly, and the DEFA

0
installs
▌
Scrolls Setup · sugatoray bundle
Sets up a minimal docs/.scrolls/ working-memory system for a project — a small set of cross-session memory files (STARTER.md, SPEC.md, HANDOFF.md, GAP_ANALYSIS.md, GAP_CONTEXT.md, PLAN.md, WISDOM.md) plus a SCROLLS.md file that points future sessions at STARTER.md, a short CLAUDE.md pointer to SCROLLS.md, and a matching AGENTS.md pointer to CLAUDE.md for other agent harnesses. Use this whenever the user runs /scrolls-setup, or asks to set up 'scrolls', a project-memory system, session handoff notes, a docs/.scrolls folder, or a CLAUDE.md/AGENTS.md/SCROLLS.md that points new sessions at persistent project docs. Trigger even if the project has no docs/ folder, no CLAUDE.md, no AGENTS.md, or no SCROLLS.md yet — creating them is part of the job. Supports -p/--path for a custom docs location, -t/--reporoot to pin everything to the git repository's top level regardless of which subdirectory you're in, -l/--local to pin it explicitly to the current directory, -r/--recurse to scan recursively for an existing scrolls

0
installs
▌
Diagram Design · sugatoray bundle
Create technical and product diagrams — architecture, flowchart, sequence, state machine, ER / data model, timeline, swimlane, quadrant, nested, tree, org chart, layer stack, venn, pyramid — as standalone HTML files with inline SVG. Ships with a neutral editorial skin and a first-run gate that prompts users to customize the style guide (colors, fonts) from their own website before generating. Includes annotation-callout primitive and optional sketchy variant.

0
installs
▌
Scrolls Unhide · sugatoray bundle
Converts an already-set-up docs/.scrolls/ working-memory folder from dotfile-hidden (.scrolls) to visible (scrolls), renaming the folder and rewriting the path references inside it and in SCROLLS.md so nothing breaks. Use this whenever the user runs /scrolls-unhide, or asks to unhide, un-dot, or show the scrolls folder, stop hiding project memory / docs/.scrolls, or rename .scrolls to scrolls. This is the retrofit path for a project that was set up hidden and now wants it visible — for a brand-new project, /scrolls-setup's own -u/--unhide flag does this in one step and this skill isn't needed. By default checks one exact location (docs/.scrolls under the current directory); supports -r/--recurse to sweep an entire directory tree instead (e.g. every package in a monorepo in one run), repeatable -p/--path to target specific locations, -t/--reporoot to target the git repository's top level regardless of which subdirectory you're in, -l/--local to target the current directory explicitly, and the DEFAULT_SCROLLS_R

0
installs
▌
Scrolls Update · sugatoray bundle
Updates an existing docs/.scrolls/ project-memory system (STARTER.md, SPEC.md, HANDOFF.md, GAP_ANALYSIS.md, GAP_CONTEXT.md, PLAN.md, WISDOM.md, and any project-specific scrolls beyond that core set) to reflect what actually happened in the current session, following each file's own update rule instead of appending blindly. Also backfills SCROLLS.md/CLAUDE.md/AGENTS.md if the project predates them (idempotent — safe every run, never overwrites existing CLAUDE.md content). Use this whenever the user runs /scrolls-update, or asks to update the scrolls, refresh HANDOFF.md, write session handoff notes, record what was just done, close out or wrap up a session, log a new gap or trap, or update project memory / STARTER.md's docs. This is the counterpart to /scrolls-setup (which creates the system once) — use this one for every session afterward. Supports -p/--path for a custom docs location, -t/--reporoot to look under the git repository's top level regardless of which subdirectory you're in, -l/--local to look expl

0
installs
▌
Newsletter AI · sugatoray bundle
Generates the weekly executive AI intelligence newsletter: researches the last 7 days of AI developments (with 30-90 day context where needed) and writes them up as a 15-part executive brief — the Top 20 developments, model intelligence, open-vs-closed, talent, funding/M&A, production deployment, agents, chips/compute, data centers/energy, the global AI race, a company watchlist, key numbers, under-the-radar signals, what changed this week, and a closing synthesis. Defaults to markdown chat output; pass -o/--output yaml (or --yaml) to instead produce a sourced YAML document, and add -r/--report path/to/folder-or-report.html to render it straight into an interactive, light/dark, multi-tab HTML report (with per-tab References accordions, its source YAML fused in for single-file distribution, and a Download-data button) written next to a copy of the YAML. Use when the user runs /newsletter-ai (aliased as the shorthand /nltr-ai — treat both identically), or asks to draft, write, or update this week's AI newslette

0
installs
▌
Create Issues Update Pr · sugatoray bundle
Files GitHub issue(s) for work already done (or about to be done) on a branch/PR, grouping related issues under a parent epic when there's a genuine hierarchy — using GitHub's native parent/child issue relationship, not just labels — and then updates that pull request's title (kept short) and description so the description lists every issue in the exact format '- Closes #{{issue-number}} -- {{issue-title}}', indented to match parent-child nesting. Use this whenever the user asks to file issue(s) for a PR, 'add gh issues for this', 'track this as issues', link a PR to tracking issues, or update a PR's title/description to list the issues covering its changes — including when they invoke /create-issues-update-pr directly. Also trigger when a PR description is stale or generic relative to its actual current commits and the user wants it brought up to date alongside issue creation.

0
installs
▌
Impeccable · sugatoray bundle
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

0
installs

74 published skills