timurgaleev
- 63 skills
- 0 followers
- 4 hours ago last updated
- ▌
- ▌ QA · timurgaleev bundleSystematically QA test a web application and fix bugs found. Runs QA testing, then iteratively fixes bugs in source code, committing each fix atomically and re-verifying.
- ▌ Cso · timurgaleevChief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, live AWS account posture (IAM, CloudTrail, S3 exposure, security groups), LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs.
- ▌ Spec · timurgaleevTurn vague intent into a precise, executable spec in five phases. Files the issue, optionally spawns a Claude Code agent in a fresh worktree, and lets /ship close the source issue on merge.
- ▌ Vibe · timurgaleev bundleRouter for the vibestack skill suite — name the task and it points you at the right skill. Use when you know vibestack is installed but not which of its skills fits, or when an agent has no slash-command picker (Codex) and needs to find the pack by name.
- ▌ Codex · timurgaleevOpenAI Codex CLI wrapper — three modes. Code review: independent diff review via codex review with pass/fail gate. Challenge: adversarial mode that tries to break your code. Consult: ask codex anything with session continuity for follow-ups. The second-opinion reviewer from a completely different AI model.
- ▌ Guard · timurgaleevFull safety mode: destructive command warnings + directory-scoped edits. Combines /careful (warns before rm -rf, DROP TABLE, force-push, etc.) with /freeze (blocks edits outside a specified directory). Use for maximum safety when touching prod or debugging live systems.
- ▌ Learn · timurgaleevManage project learnings. Review, search, prune, and export what vibestack has learned across sessions.
- ▌ Retro · timurgaleevWeekly engineering retrospective. Analyzes commit history, work patterns, and code quality metrics with persistent history and trend tracking. Team-aware: breaks down per-person contributions with praise and growth areas.
- ▌ Browse · timurgaleev bundleFast headless browser for QA testing and site dogfooding. Navigate any URL, interact with elements, verify page state, diff before/after actions, take annotated screenshots, check responsive layouts, test forms and uploads, handle dialogs, and assert element states. ~100ms per command.
- ▌ Canary · timurgaleevPost-deploy canary monitoring. Watches the live app for console errors, performance regressions, and page failures using the browse daemon. Takes periodic screenshots, compares against pre-deploy baselines, and alerts on anomalies.
- ▌ Claude · timurgaleevClaude Code CLI wrapper for getting an independent second opinion. Three modes: Review (diff review via claude -p), Challenge (adversarial failure-mode review), Consult (ask Claude about the repo with read-only file tools).
- ▌ Freeze · timurgaleev bundleRestrict file edits to a specific directory for the session. Blocks Edit and Write outside the allowed path.
- ▌ Health · timurgaleevCode quality dashboard. Wraps existing project tools (type checker, linter, test runner, dead code detector, shell linter), computes a weighted composite 0-10 score, and tracks trends over time.
- ▌ Review · timurgaleev bundlePre-landing PR review. Analyzes diff against the base branch for SQL safety, LLM trust boundary violations, conditional side effects, and other structural issues.
- ▌ Scrape · timurgaleevPull structured data from a web page with the browse shim — navigate, extract, return JSON. Read-only.
- ▌ Unslop · timurgaleevFinds machine-sounding writing patterns in English prose (README, release notes, CHANGELOG, PR bodies, articles, posts, chat replies) and rewrites the text in a specific human voice while keeping every fact, number, name and claim. Use when a draft reads like a bot wrote it and it should read like the author did.
- ▌ Careful · timurgaleev bundleSafety guardrails for destructive commands. Warns before rm -rf, DROP TABLE, force-push, git reset --hard, kubectl delete, and similar destructive operations. User can override each warning; a small catastrophic set (recursive delete of / or the home directory, force-push to the default branch) is hard-denied instead.
- ▌ Diagram · timurgaleev bundleRender a Mermaid diagram to a self-contained HTML file and a PNG, using the browse shim as the renderer — no heavy diagram toolchain to install.
- ▌ QA Only · timurgaleevReport-only QA testing. Systematically tests a web application and produces a structured report with health score, screenshots, and repro steps — but never fixes anything.
- ▌ Autoplan · timurgaleevAuto-review pipeline — reads the full CEO, design, eng, and DX review skills from disk and runs them sequentially with auto-decisions using 6 decision principles. Surfaces taste decisions (close approaches, borderline scope, codex disagreements) at a final approval gate. One command, fully reviewed plan out.
- ▌ AWS Cost · timurgaleevRead-only AWS cost review for the account at hand: where the money went last month, what changed versus the month before, and the three actions worth taking. Uses the AWS billing MCP tools when the session has them, otherwise the aws CLI (ce, compute-optimizer, budgets). Use when someone asks why the AWS bill went up, wants a FinOps pass, or needs Savings Plans and RI coverage checked.
- ▌ Make PDF · timurgaleev bundleGenerate professional PDFs from code, markdown, or HTML in the current repository. Supports cover pages, tables of contents, watermarks, custom margins, and page sizes.
- ▌ Skillify · timurgaleevTurn a working browse or scrape flow into a reusable vibestack skill — codify the steps into a new SKILL.md, validate, and install it.
- ▌ Unfreeze · timurgaleevClear the freeze boundary set by /freeze, allowing edits to all directories again.
- ▌ Benchmark · timurgaleevPerformance regression detection using the browse daemon. Establishes baselines for page load times, Core Web Vitals, and resource sizes. Compares before/after on every PR. Tracks performance trends over time.
- ▌ Kb Review · timurgaleevRead-only review of a retrieval-augmented setup, Amazon Bedrock Knowledge Bases first and hand-built RAG pipelines second: sources, chunking, metadata and tenant filtering, embedding model, vector store, sync, retrieval quality and cost per query. Builds a golden question set, measures recall@5 and MRR against the live knowledge base, and leaves the eval set behind as JSONL. Use when someone asks whether the knowledge base is set up right, why answers miss the right document, or what a RAG pipeline costs to run.
- ▌ Plan Tune · timurgaleev bundleSelf-tuning question sensitivity + developer psychographic for vibestack (v1: observational). Review which AskUserQuestion prompts fire across vibestack skills, set per-question preferences (never-ask / always-ask / ask-only-for-one-way), inspect the dual-track profile (what you declared vs what your behavior suggests), and enable/disable question tuning. Conversational interface — no CLI syntax required.
- ▌ Agent Eval · timurgaleevBuild an evaluation harness for an LLM agent, prompt template, or tool-using workflow — a task set, deterministic and judge-based scoring, per-tag metrics, and a regression gate — then run it. Use it when a prompt or model change needs to be measured instead of eyeballed, or when a project ships LLM behavior with no eval set at all.
- ▌ MCP Review · timurgaleevReview an MCP server (Python FastMCP or the TypeScript SDK) for tool design, scope, auth, input validation, error shape, transport and prompt-injection exposure. Use it before publishing a server, before wiring one into an agent, or when someone asks whether an MCP server is safe to run. Produces a findings table with severities and proposed tool schema changes; never modifies the server or its credentials.
- ▌ Pair Agent · timurgaleevPair a remote AI agent with your browser. One command generates a setup key and prints instructions the other agent can follow to connect. Works with OpenClaw, Hermes, Codex, Cursor, or any agent that can make HTTP requests. The remote agent gets its own tab. Default access is read+write+admin+meta — the trust boundary is the pairing ceremony, not the scope; `--control` adds stop/restart/disconnect and `--restrict` narrows it.
- ▌
- ▌ Design HTML · timurgaleevDesign finalization: generates production-quality Pretext-native HTML/CSS. Works with approved mockups from /design-shotgun, CEO plans from /plan-ceo-review, design review context from /plan-design-review, or from scratch with a user description. Text actually reflows, heights are computed, layouts are dynamic. 30KB overhead, zero deps. Smart API routing: picks the right Pretext patterns for each design type.
- ▌ Investigate · timurgaleevSystematic debugging with root cause investigation. Four phases: investigate, analyze, hypothesize, implement. Iron Law: no fixes without root cause. Proactively invoke this skill (do NOT debug directly) when the user reports errors, 500 errors, stack traces, unexpected behavior, "it was working yesterday", or is troubleshooting why something stopped working.
- ▌ Context Save · timurgaleevSave working context. Captures git state, decisions made, and remaining work so any future session can pick up without losing a beat.
- ▌ Devex Review · timurgaleevLive developer experience audit. Uses the browse tool to actually TEST the developer experience: navigates docs, tries the getting started flow, times TTHW, screenshots error messages, evaluates CLI help text. Produces a DX scorecard with evidence. Compares against /plan-devex-review scores if they exist (the boomerang: plan said 3 minutes, reality says 8).
- ▌ Improve Arch · timurgaleev bundleFind deepening opportunities in a codebase. Surface architectural friction and propose refactors that turn shallow modules into deep ones — small interface, deep implementation. The aim is testability and AI-navigability. If your project has a domain glossary (e.g. `CONTEXT.md`) or ADRs (`docs/adr/`), the skill uses them to keep names consistent and avoid re-litigating decisions.
- ▌ Office Hours · timurgaleevOffice Hours — two modes. Startup mode: six forcing questions that expose demand reality, status quo, desperate specificity, narrowest wedge, observation, and future-fit. Builder mode: design thinking brainstorming for side projects, hackathons, learning, and open source. Saves a design doc.
- ▌ Open Browser · timurgaleev bundleLaunch vibestack Browser — AI-controlled Chromium with the sidebar extension baked in. Opens a visible browser window where you can watch every action in real time. The sidebar shows a live activity feed and chat. Anti-bot stealth built in.
- ▌ Setup Deploy · timurgaleevConfigure deployment settings for /land-and-deploy. Detects your deploy platform (Fly.io, Render, Vercel, Netlify, Heroku, GitHub Actions, custom), production URL, health check endpoints, and deploy status commands. Writes the configuration to CLAUDE.md so all future deploys are automatic.
- ▌ Vibe Upgrade · timurgaleevUpdate the installed vibestack pack to the latest release — detect the install (global git checkout or a project-local vendored copy), run the upgrade, run version migrations, and show what changed.
- ▌ AI Cost Guard · timurgaleevFind every code path that can run up a paid-inference bill without a ceiling (loops, retries, fan-out, agent steps, queues) and require a written dollar cap both in code and at the provider. Use before shipping anything that calls an LLM, speech, or image API, or when a bill was larger than expected.
- ▌ Design Review · timurgaleevDesigner's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review.
- ▌ Connect Chrome · timurgaleevReuse your real Chrome's logged-in cookies in the browse daemon, so authenticated pages work without re-logging-in.
- ▌ Connect Review · timurgaleevReview an Amazon Connect contact-center solution built on Lex bots and Bedrock-backed conversational logic: contact flows, bot design, Lambda integrations, prompts, latency budget, state handling, observability and cost per contact. Produces a severity-ranked findings report with a latency table, a cost estimate and three test calls to make next. Use when asked to review an IVR, voice bot, phone assistant or contact flow, or when a Connect solution feels slow, brittle or expensive.
- ▌ Design Shotgun · timurgaleevDesign shotgun: generate multiple AI design variants, review them side by side, collect structured feedback, and iterate. Standalone design exploration you can run anytime.
- ▌ Landing Report · timurgaleevRead-only queue dashboard for workspace-aware ship. Shows which VERSION slots are currently claimed by open PRs, which sibling Conductor workspaces have WIP work likely to ship soon, and what slot /ship would pick next. No mutations — just a snapshot.
- ▌ Context Restore · timurgaleevRestore working context saved earlier by /context-save. Loads the most recent saved state (across all branches by default) so you can pick up where you left off — even across Conductor workspace handoffs.
- ▌ Land And Deploy · timurgaleevLand and deploy workflow. Merges the PR, waits for CI and deploy, verifies production health via canary checks. Takes over after /ship creates the PR.
- ▌ Plan Ceo Review · timurgaleevCEO/founder-mode plan review. Rethink the problem, find the 10-star product, challenge premises, expand scope when it creates a better product. Four modes: SCOPE EXPANSION (dream big), SELECTIVE EXPANSION (hold scope + cherry-pick expansions), HOLD SCOPE (maximum rigor), SCOPE REDUCTION (strip to essentials).
- ▌ Plan Eng Review · timurgaleevEng manager-mode plan review. Lock in the execution plan — architecture, data flow, diagrams, edge cases, test coverage, performance. Walks through issues interactively with opinionated recommendations.
- ▌ Benchmark Models · timurgaleevCross-model benchmark for vibestack skills. Runs the same prompt through Claude, GPT (via Codex CLI), and Gemini side-by-side — compares latency, tokens, cost, and optionally quality via LLM judge. Answers "which model is actually best for this skill?" with data instead of vibes.
- ▌ Document Release · timurgaleevPost-ship documentation update. Reads all project docs, cross-references the diff, builds a Diataxis coverage map (reference/how-to/tutorial/explanation), updates README/ARCHITECTURE/CONTRIBUTING/CLAUDE.md to match what shipped, detects architecture diagram drift, polishes CHANGELOG voice with a sell-test rubric, cleans up TODOS, and optionally bumps VERSION. Surfaces documentation debt in the PR body.
- ▌ Address Pr Review · timurgaleev bundleWork a pull request's open review threads and failing CI checks to a close: read each unresolved thread, fix or explain, run the tests, commit and push, then reply on every thread and resolve the ones that were addressed. Use after a PR exists on the current branch and reviewers or CI have come back with something.
- ▌ Document Generate · timurgaleevGenerate missing documentation from scratch for a feature, module, or entire project. Uses the Diataxis framework (tutorial / how-to / reference / explanation) to produce complete, structured documentation. Can be invoked standalone or called by /document-release when it finds coverage gaps.
- ▌ Plan Devex Review · timurgaleev bundleInteractive developer experience plan review. Explores developer personas, benchmarks against competitors, designs magical moments, and traces friction points before scoring. Three modes: DX EXPANSION (competitive advantage), DX POLISH (bulletproof every touchpoint), DX TRIAGE (critical gaps only).
- ▌ Bedrock Guardrails · timurgaleevAudit the guardrail layer around Amazon Bedrock usage: region pinning and cross-region inference profiles, IAM scoping to model ARNs, Bedrock Guardrails configuration (PII, denied topics, content and word filters, grounding, versioning), invocation logging and KMS, per-tenant isolation, prompt injection boundaries, quotas and cost controls. Use before shipping an LLM feature on Bedrock, during a security or EU data residency review, or when designing the Terraform for a new Bedrock workload. Read-only; produces a PASS/FAIL/N-A control table with Terraform remediation for every FAIL.
- ▌ Plan Design Review · timurgaleevDesigner's eye plan review — interactive, like CEO and Eng review. Rates each design dimension 0-10, explains what would make it a 10, then fixes the plan to get there. Works in plan mode. For live site visual audits, use /design-review.
- ▌ Design Consultation · timurgaleevDesign consultation: understands your product, researches the landscape, proposes a complete design system (aesthetic, typography, color, layout, spacing, motion), and generates font+color preview pages. Creates DESIGN.md as your project's design source of truth. For existing sites, use /plan-design-review to infer the system instead.
- ▌ Setup Browser Cookies · timurgaleevImport cookies from your real Chromium browser into the headless browse session. Opens an interactive picker UI where you select which cookie domains to import. Use before QA testing authenticated pages.
- ▌
- ▌
- ▌