VincentChuWaiChow
- 760 skills
- 0 followers
- 1 day ago last updated
- ▌ Python Ml AI Production · vincentchuwaichow bundleUse this skill to statically review Python ML/AI production correctness: training-serving skew, feature/data leakage, model-artifact serialization safety, reproducibility, evaluation-deployment match, batch-vs-online consistency, and model/prompt provenance. Reads training/serving source, configuration, and evaluation artifacts only; it never trains, loads, or serves a model.
- ▌ LLM AI Pipeline Test Review · vincentchuwaichow bundleUse this skill when reviewing how an LLM or AI pipeline is evaluated — metric selection, golden datasets, threshold governance, adversarial coverage, and regression gating — to determine whether low-quality or unsafe model outputs can ship undetected. Trigger when a user provides evaluation configuration files, DeepEval or RAGAS test scripts, eval CI steps, or asks whether their AI pipeline actually prevents a bad model from reaching production. This skill reviews evaluation setup statically; it does not call LLM APIs, run evaluations, or contact inference endpoints.
- ▌ Playwright E2e Suite Review · vincentchuwaichow bundleUse this skill when reviewing a Playwright end-to-end test suite for flakiness, selector brittleness, isolation defects, and CI reliability. Trigger when a user provides Playwright spec files, a playwright.config.ts/js, a CI workflow that runs Playwright, or asks why their E2E suite is flaky, slow, or fails intermittently in CI but passes locally. This skill reviews test artifacts statically; it does not execute the suite or launch browsers.
- ▌ Sap Clean Core Debt Review · vincentchuwaichow bundleReview SAP custom code, modifications, and extensibility debt against the SAP Clean Core standard. Use when assessing custom ABAP, implicit enhancements, customer modifications, or legacy Z/Y code for remediation toward released APIs, ABAP Cloud, RAP objects, key-user extensibility, or developer extensibility on BTP. Does not touch live systems.
- ▌ Fixed Assets Advisor · vincentchuwaichow bundleMulti-jurisdiction fixed assets, depreciation, and impairment reference framework covering PP&E, intangibles, right-of-use assets, and goodwill under US GAAP and IFRS.
- ▌ Alibaba Polardb Rds Dba · vincentchuwaichow bundleOperate PolarDB (MySQL/PG/Oracle) clusters and RDS instances — DAS diagnostics, database proxy, Global Database Network, backup strategy, and performance tuning.
- ▌ AWS Generative AI Developer · vincentchuwaichow bundleBuild Amazon Bedrock and serverless generative AI applications using Lambda, API Gateway, Step Functions, EventBridge, S3, DynamoDB, SQS, Guardrails, and IAM. Prefer this for serverless GenAI app design and implementation; prefer aws-agentcore for AgentCore runtime, aws-bedrock-agent-security-governor for deep Bedrock security, and aws-serverless-production-readiness for final operational hardening.
- ▌
- ▌
- ▌ Add Educational Comments · vincentchuwaichow bundleAdd educational comments to code files to transform them into effective learning resources. Explains the "why" behind syntax, idioms, and design choices, aligned with the learner's knowledge level and educational goals.
- ▌ Fpa Forecasting Advisor · vincentchuwaichow bundleReference framework for financial planning and analysis (FP&A) covering driver-based budgeting, rolling forecasts, zero-based budgeting (ZBB), scenario and sensitivity analysis, budget-versus-actual variance analysis, long-range planning (LRP), integrated P&L/balance sheet/cash flow modeling, xP&A (extended planning and analysis), FP&A technology platforms (Anaplan, Adaptive Insights/Workday Adaptive Planning, OneStream, Vena, IBM TM1/Planning Analytics), and MD&A narrative support. Applicable across US GAAP, IFRS, and UK FRS 102 reporting contexts. Advisory only — never writes to any planning system, ERP, or GL, and never accepts confidential forecast figures, MNPI, or company-identifying budget data.
- ▌ Working Capital Advisor · vincentchuwaichow bundleMulti-jurisdiction reference framework for working capital management — cash conversion cycle (CCC) optimization, accounts receivable management (collections, credit policy, aging analysis, factoring, invoice discounting, AR securitization, ASC 860 / IFRS 9 SPPI derecognition), accounts payable optimization (payment term extension, dynamic discounting, supply chain finance / reverse factoring, IAS 7.44A / ASU 2022-04 classification), inventory management (EOQ, JIT, safety stock, ABC analysis, IAS 2 vs. ASC 330), 13-week rolling cash forecasting (IAS 7 direct method), and working capital financing (ABL, receivables financing, SCF platforms, trade finance). Advisory only — never writes to ERP, AR/AP systems, or any system of record.
- ▌ Rightsize Recommendation · vincentchuwaichow bundleEmit pod CPU and memory request/limit recommendations from user-pasted p50, p95, and p99 utilization metrics over a 7-14 day window. Outputs recommended requests at p95 plus 20% headroom, limits at p99 plus 30%, estimated monthly savings, and Karpenter consolidation eligibility flag. Read-only, no kubectl.
- ▌ Core Web Vitals Triage · vincentchuwaichow bundleDecomposes LCP, INP, and CLS regressions into their documented sub-phases using lab and field evidence, and refuses to declare a metric fixed without a field-data or CI-budget verification path.
- ▌ GCP Compute Engine Operator · vincentchuwaichow bundleOperate GCE instances, manage Managed Instance Groups (MIGs), configure OS patch management via VM Manager, design preemptible/spot VM strategies, and manage startup/shutdown scripts.
- ▌ Huawei Network Architect · vincentchuwaichow bundleDesign Huawei Cloud network architecture — VPC, ELB type selection (dedicated/shared), VPN and DC Gateway (Direct Connect), Cloud Connect for inter-VPC, CFW (Cloud Firewall), Anti-DDoS, DNS. Covers Dedicated vs Shared ELB trade-offs, DC Gateway VBC connectivity, Cloud Connect cross-region/cross-account peering, and CFW east-west firewall policy.
- ▌ Istio Ambient Mesh Review · vincentchuwaichow bundleUse this skill for Istio service mesh review across both sidecar mode and ambient mode (ztunnel L4 + optional waypoint L7). Covers PeerAuthentication, AuthorizationPolicy, RequestAuthentication, Gateway, VirtualService, DestinationRule, Sidecar, and waypoint placement. Trigger when the user asks whether an Istio policy is correct, whether mTLS is strict, whether L7 AuthorizationPolicy will actually be enforced in ambient mode, or whether a mesh-wide PeerAuthentication change is safe.
- ▌ Kotlin Test Architecture · vincentchuwaichow bundleUse this skill to statically review Kotlin/coroutine/Compose/Android/KMP test architecture and determinism: `runTest` and virtual-time usage, `StandardTestDispatcher` vs `UnconfinedTestDispatcher` choice and advance-call discipline, `Dispatchers.setMain`/`resetMain` hygiene and dispatcher injection, Turbine Flow-testing idioms, Compose UI semantics-based testing, and the Robolectric-vs-instrumented boundary. Reads test source and build config only; it never runs the suite or a device/emulator.
- ▌
- ▌ Python Observability Sre · vincentchuwaichow bundleUse this skill to statically review in-application Python observability: structured logs, metrics, traces, context propagation and correlation, error taxonomy, metric/label cardinality, PII exposure, and SLO-supporting instrumentation. Reads application instrumentation code only; it routes collector, exporter, and dashboard infrastructure to the platform boards.
- ▌ Playwright E2e Execution Run · vincentchuwaichow bundleUse this skill when an operator wants to actually execute an existing Playwright end-to-end suite against a confirmed non-production target and receive a structured, attested run report — pass/fail counts, flaky tests, durations, and trace artifacts. Trigger when the user asks to "run the e2e suite", "execute the Playwright tests against staging", or hands the agent a Playwright project plus a target base URL. This is the live-execution counterpart to the static-review skill `playwright-e2e-suite-review`. Default mode is static and runs nothing; runtime execution is a per-session opt-in that requires explicit target confirmation.
- ▌ Test Coverage Quality Review · vincentchuwaichow bundleUse this skill when reviewing a test suite for assertion quality rather than coverage percentage — detecting coverage theater, where line/branch coverage is high but the tests would not catch a regression. Trigger when a user provides test files, a coverage report, or asks whether their tests are actually meaningful, why bugs ship despite high coverage, or how to set a coverage gate. This skill reviews test artifacts statically; it does not execute tests or run a coverage tool.
- ▌ Sap Cap Architecture Review · vincentchuwaichow bundleReview SAP Cloud Application Programming Model (CAP) applications for CDS data modeling quality, service layer design, authorization correctness (@requires/@restrict), multitenancy architecture, draft handling, and test coverage. Use when assessing CAP Node.js or Java projects for architectural compliance, security posture, and clean service design. Does not touch live systems.
- ▌ Sap Guarded Role Assignment · vincentchuwaichow bundleAssign or revoke SAP role collections and authorizations using a mandatory 17-step guarded mutation sequence covering classification, target tenant/system confirmation, criticality, requester, approver, ticket, scope, read-only current state, SoD pre-check, diff of effective permissions, blast radius, rollback plan, approval gate, execute approved changes only, verify, audit, and report. Refuses if any step is missing, if an SoD conflict is detected, or if self-approval is attempted. Use when a confirmed and approved role assignment or revocation in a non-development SAP system must be executed under traceable controls.
- ▌ Tax Provision Advisor · vincentchuwaichow bundleMulti-jurisdiction corporate income tax provision reference framework covering ASC 740 (US GAAP) and IAS 12 (IFRS). Covers current vs. deferred tax, temporary and permanent differences, deferred tax asset/liability recognition and measurement, valuation allowance (more-likely-than-not), uncertain tax positions (FIN 48 / ASC 740-10 two-step vs. IFRIC 23), OECD Pillar Two GloBE (IAS 12.4A mandatory temporary exception vs. ASC 740 no equivalent exception), enacted vs. substantively enacted tax rates, effective tax rate reconciliation, APB 23 / ASC 740-30 indefinite reinvestment assertion, intraperiod tax allocation, interim provision (estimated annual ETR method), and local GAAP variations (HGB, JGAAP/ASBJ, CAS 18, Ind AS 12). Advisory only — all outputs require verification by qualified tax counsel and external auditors.
- ▌ Alibaba China Compliance · vincentchuwaichow bundleAdvise on MLPS 2.0 grading and technical controls, DSL Article 31 cross-border data transfer, CSL network operator obligations, PIPL personal data requirements, and ICP Beian filing for mainland China CN-* region workloads.
- ▌ AWS API Edge Delivery Review · vincentchuwaichow bundleReview AWS API and edge delivery posture across API Gateway, CloudFront, AWS WAF, Shield, ALB, custom domains, TLS policies, authentication, authorization, throttling, quotas, caching, origin protection, logging, and abuse controls. Use when public APIs, web entry points, or edge delivery can affect security and availability.
- ▌ AWS Iac Change Safety Review · vincentchuwaichow bundleReview AWS infrastructure-as-code changes across CDK, CloudFormation, SAM, Terraform, Serverless Framework, generated templates, plans, stack updates, change sets, and drift. Use when the user asks whether an AWS IaC deployment is safe, what a change set will do, why a resource replacement will happen, or how to validate before production.
- ▌ AWS Private Ca Issuer Review · vincentchuwaichow bundleUse this skill when reviewing AWS ACM Private CA (Private Certificate Authority) issuer configurations for cert-manager. Trigger on any request to audit AWSPCAIssuer, AWSPCAClusterIssuer, IRSA policy for cert-manager, certificate template ARNs, CRL configuration, or cross-account PCA usage.
- ▌ Contabo Capacity Planner · vincentchuwaichow bundleAdvisory skill for Contabo resource planning across regions (EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND), instance tiers (VPS, VDS, Storage VPS), and add-ons (Private Networking, Additional IPs, Extra Storage, Custom Images). Includes Cloud-Init userData strategy and SSH key management via secret IDs. Use when the user needs to plan new deployments, evaluate region coverage, or compare instance tiers.
- ▌ Vue Ssr Security Review · vincentchuwaichow bundleStatically review Vue 3 SSR entry points and templates for cross-request state pollution (module-scope reactive state, non-per-request app/store creation) and injection via unsanitized v-html or unvalidated dynamic href/src bindings, grounded in Vue's own SSR and security-best-practices guidance.
- ▌ GCP Iac Change Safety Review · vincentchuwaichow bundleReview Terraform and Deployment Manager changes targeting GCP — blast radius analysis, destroy-operation detection, cross-project impact, state file conflicts, org policy drift, and rollback plan completeness.
- ▌ GCP Networking Observability · vincentchuwaichow bundleInvestigate GCP network issues by analyzing VPC Flow Logs, firewall logs, Cloud NAT logs, threat logs, and networking metrics. Diagnose connectivity, packet loss, top talkers, and firewall block events using BigQuery-first methodology and Cloud Monitoring fallback. Use when investigating VPC traffic anomalies, firewall DENY events, NAT port exhaustion, latency spikes, or running Connectivity Tests for path diagnostics.
- ▌ GCP Vertex AI Mlops Engineer · vincentchuwaichow bundleManage Vertex AI Training jobs (GPU/TPU cost governance), Vertex AI Pipelines, Model Registry, Feature Store, Endpoints, and Gemini API integration for production MLOps.
- ▌ Hetzner Capacity Planner · vincentchuwaichow bundlePlan Hetzner Cloud capacity across resource limits (servers, Volumes, Networks, Load Balancers, Floating IPs per project), region distribution across fsn1, nbg1, and hel1, quota exhaustion risk, growth trajectory, and server type upgrade paths from shared to dedicated compute. Use when the user asks about Hetzner resource limits, quota, or growth planning.
- ▌ Huawei Solution Architect · vincentchuwaichow bundleDesign Huawei Cloud solutions — product selection, enterprise-project model design, region selection for MLPS/sovereignty requirements, architecture patterns, multi-zone and multi-region HA. Covers region mapping (China and international), GaussDB vs RDS selection, ModelArts/Ascend NPU considerations, and the six-pillar Huawei Cloud Architecture Framework including the Trusted pillar.
- ▌
- ▌ M365 Tenant Governance · vincentchuwaichow bundleReview Microsoft 365 tenant governance posture — admin role and RBAC sprawl, service change and release governance via Message Center, organization-wide settings, Microsoft Secure Score governance actions, delegated admin and GDAP least-privilege configuration, and multi-workload policy coordination. Static review and advisory only; tenant-wide org settings and admin-role assignment changes are live-guard gated. Aligned to MS-102 governance domain.
- ▌ Power Platform Maestro · vincentchuwaichow bundleRoute Power Platform tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know the specialist. Not for direct Power Platform answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any production environment deployment or tenant-wide DLP policy change.
- ▌ Nvidia AI Operations Day2 · vincentchuwaichow bundleUse this skill when reviewing day-2 operations of NVIDIA GPU fleets — DCGM exporter and DCGM-Diag posture, GPU telemetry into Prometheus/Grafana, MIG partitioning lifecycle, GPU health and Xid error response, fleet upgrade paths, and incident response for GPU-failure modes. Trigger when the user asks how a GPU fleet is monitored, whether DCGM is wired, whether Xid signatures map to runbooks, or whether the deployment meets NCP-AIO certification expectations.
- ▌
- ▌ Python Performance Memory · vincentchuwaichow bundleUse this skill to statically review Python performance and memory claims: CPU profiling vs benchmarking rigor, memory growth and allocation patterns, GC pressure, algorithmic complexity, and serialization/import/startup cost. Reads source, profiles, and benchmark artifacts only; it never runs the profiler or benchmark itself.
- ▌ Sap Audit Evidence Packaging · vincentchuwaichow bundlePackage and structure audit evidence for SAP controls covering Segregation of Duties, change management, access management, and financial controls. Defines evidence taxonomy, maps controls to evidence artifacts, establishes chain-of-custody and redaction requirements, and aligns evidence packages to SOC 2, ISO 27001, SOX, and GxP frameworks. Does not touch live systems and never includes secrets, credentials, or personal identifiable information in evidence packages.
- ▌ Sap Guarded Transport Import · vincentchuwaichow bundleExecute SAP transport request imports using a mandatory 17-step guarded mutation sequence covering classification, target confirmation, criticality, requester, approver, ticket, scope, read-only current state, diff and dry-run, blast radius, rollback plan, segregation of duties, approval gate, execute approved imports only, verify, audit, and report. Refuse if any step is missing. Use when a confirmed and approved transport import into a non-development SAP system (quality, pre-production, or production) must be executed under traceable controls.
- ▌
- ▌ Scaleway Cost Optimizer · vincentchuwaichow bundleReview and optimize Scaleway cost posture across Instance type rightsizing, reserved instance utilization, idle Object Storage buckets and SBS block volumes, Serverless function invocation cost, RDB instance sizing, and Cockpit observability spend. Use when the user asks to reduce Scaleway spend, audit bill composition, identify idle resources, or evaluate reserved instance commitments.
- ▌ Fx Translation Advisor · vincentchuwaichow bundleMulti-jurisdiction reference framework for foreign currency translation and remeasurement covering functional currency determination, ASC 830 / IAS 21 method selection, CTA in OCI, highly inflationary economy treatment, net investment hedge interactions, and multi-GAAP comparison across US GAAP, IFRS, German HGB, JGAAP, CAS 19, and Ind AS 21.
- ▌ Procure To Pay Advisor · vincentchuwaichow bundleMulti-jurisdiction procure-to-pay accounting reference covering PO matching, AP accruals, vendor management, and related compliance.
- ▌ Alibaba Network Architect · vincentchuwaichow bundleDesign Alibaba Cloud network topology — VPC peering, CEN for multi-VPC/multi-region connectivity, Express Connect for private circuits, SLB/ALB/NLB/CLB load balancer selection, and Smart Access Gateway for branch offices.
- ▌
- ▌ Databricks AI Bi Genie · vincentchuwaichow bundleUse this skill to statically review AI/BI Genie agent and dashboard design: agent scoping (30-table limit), instructions and trusted assets, metric-view correctness, dashboard limits and rendering, benchmark design and honest accuracy reading, and the critical 'Individual data' versus 'Share data' permission decision. Reads agent and dashboard configuration, schema, metric definitions, and benchmark results only; it never executes any agent query and never runs a dashboard. Highest consequence: the 'Share data' permission completely bypasses row-level security.
- ▌ Databricks Finops Cost · vincentchuwaichow bundleUse this skill to statically review Databricks cost and cost-attribution: system.billing.usage and system.billing.list_prices for correct joins, custom-tag-based attribution with coverage-confidence reporting, DBU uptime charging semantics, serverless versus classic cost comparison validity, budgets and their non-enforcing nature, compute policies and idle controls, and instance-pool cost floors. Reads billing system tables, compute config, and policies only; it never executes queries and never recommends cost-cutting actions without explicit approval. Cost analysis is as good as the custom-tag coverage; the skill reports attribution confidence explicitly (tagged vs untagged %).
- ▌ Dotnet Supply Chain Review · vincentchuwaichow bundleUse this skill when reviewing .NET CI/CD and NuGet supply-chain integrity — SDK pinning via global.json, package version pinning and lock files, Central Package Management, NuGet feed trust, fork-PR secret exposure, vulnerability scanning, and build reproducibility. Trigger when a user provides a .NET CI workflow file, a global.json, a Directory.Packages.props, a NuGet.config, a packages.lock.json, or a .csproj/.pubxml, asks whether their .NET build is reproducible and tamper-resistant, or wants to know whether their NuGet supply chain blocks a malicious or vulnerable dependency. This skill reviews workflow and project configuration statically; it does not trigger a pipeline or restore packages.
- ▌ Variance Analysis Advisor · vincentchuwaichow bundleVariance decomposition framework and SEC Regulation S-K Item 303 MD&A commentary guidance for FP&A and corporate finance teams. Provides driver decomposition methodology (Volume/Price/Rate/Mix/One-Time), MD&A structural requirements with regulatory citations, restatement-risk trigger catalog, sensitivity analysis templates, and materiality threshold guidance. Advisory only — all draft commentary requires CFO certification and legal review before filing.
- ▌ Finops Cloud Price Advisor · vincentchuwaichow bundleFetch live public prices and build cost estimates for AWS, Azure, OCI, Scaleway, Gandi, Alibaba Cloud, and Tencent Cloud using each provider's public pricing API or official documentation. Supports live-environment cost analysis and prototype cost planning. Currency defaults to USD; EUR and CNY supported natively.
- ▌ Huawei Cost Finops Analyst · vincentchuwaichow bundleAnalyze Huawei Cloud CBC (Customer Business Console) spend, optimize Reserved Instance and CUD (Committed Use Discount) coverage, manage Cost Center allocation tags, and govern budget alert thresholds.
- ▌ Huawei Migration Architect · vincentchuwaichow bundlePlan migrations to Huawei Cloud via MgC (Migration Center), SMS (Server Migration Service) for P2V/V2V, DRS for database replication, and OMS (Object Migration Service) for object storage, with cutover sequencing and rollback design.
- ▌ Huawei Obs Storage Steward · vincentchuwaichow bundleManage Huawei OBS lifecycle policies, bucket ACL and policy governance, SFS (Scalable File Service) NFS shares, EVS (Elastic Volume Service) block storage, and CBR (Cloud Backup and Recovery) backup strategy for data protection compliance.
- ▌ Huawei Waf Security Review · vincentchuwaichow bundleAssess Huawei Cloud workload security using the Well-Architected Framework Security pillar: IAM SCP governance, VPC isolation, DEW key management, SecMaster SIEM/SOAR, and MLPS 2.0 technical controls for China-resident workloads.
- ▌
- ▌ Alibaba Mse Microservice Engine · vincentchuwaichow bundleConfigure and operate Alibaba MSE (Microservice Engine) — Nacos service discovery and configuration management, Sentinel rate limiting and circuit breaking, Seata distributed transactions, and ARMS APM for microservices observability.
- ▌ AWS Bedrock Agent Security Governor · vincentchuwaichow bundleReview Amazon Bedrock agents, AgentCore, Guardrails, knowledge bases, action groups, memory, MCP/tool integrations, prompt-injection and prompt-leakage defenses, PII handling, encryption, logging, observability, and least-privilege IAM. Use for AWS-native GenAI and agent security posture.
- ▌ AWS Live Pipeline Approval Operator · vincentchuwaichow bundleHandle live CodePipeline approval and gated resume decisions with pipeline, stage, approver, SNS, approval, blast radius, and rollback checks. Use only when a real pipeline execution is paused or about to be approved.
- ▌ AWS Serverless Production Readiness · vincentchuwaichow bundleReview AWS Lambda-centered serverless workloads for production readiness across execution roles, event sources, retries, DLQs/destinations, concurrency, idempotency, observability, deployment safety, performance, cost, and rollback. Prefer event-driven architecture for EventBridge/SNS/SQS/Step Functions system design, and DynamoDB/RDS skills for data-store performance.
- ▌ Legal Hr Risk Taxonomy · vincentchuwaichow bundleUse this skill to assign consistent risk labels to a Legal or HR matter — severity ratings, privilege and privacy sensitivity labels, retaliation and discrimination risk labels, matter-type classes, escalation-gate triggers, and the audit-log schema. It standardizes the vocabulary every Legal and HR agent and case capsule uses so risk is rated the same way across the ecosystem. It does not give legal or HR advice and never concludes that a matter is safe or compliant.
- ▌ Order To Cash Protocol · vincentchuwaichow bundleUse this skill to coordinate the order-to-cash process across Dynamics 365 Supply Chain Management, Finance, and Sales, covering confirmed order through fulfillment, invoicing, accounts receivable, and cash collection. It defines stage ownership, gate conditions, agent handoff rules, and escalation triggers for the post-order revenue cycle. The skill does not execute system transactions, approve credit changes, post invoices, or make collection decisions; all production-impacting steps are escalated to the relevant specialist agent or human owner.
- ▌ Databricks Value Realization · vincentchuwaichow bundleUse this skill to decide whether a claimed Databricks business outcome is measurable, and only then to size it. Builds a value case from a named pain, a named executive owner, a pre-change baseline, a leading metric, a lagging business KPI, the required data, explicit attribution limits, an economic range, a measurement window, a kill condition, and a post-production re-measurement. Refuses to produce a benefit figure when the baseline does not exist, and never presents a benchmark, analyst estimate, or vendor multiplier as this organisation's number.
- ▌ Dotnet Efcore Data Access Review · vincentchuwaichow bundleUse this skill when statically reviewing EF Core data access — DbContext lifetime and registration, N+1 query patterns, unbounded result sets, raw SQL injection surface, optimistic concurrency tokens, migration discipline, multi-tenant global query filters, and connection resiliency. Trigger when a user provides EF Core source (a DbContext class, entity configuration, migrations, repository or query code), asks why queries are slow or why tenants can see each other's data, or wants to know whether their data access layer is correct, performant, and isolated. This skill reads source only; it never runs migrations, opens a database connection, or executes SQL.
- ▌ Dotnet Observability Otel Review · vincentchuwaichow bundleUse this skill when reviewing in-application OpenTelemetry wiring in an ASP.NET Core service — OpenTelemetry SDK registration, trace context propagation across service boundaries, structured logging, correlation and trace identifiers in logs, metrics instrumentation, trace sampling, the health-vs-readiness check distinction, and PII leakage into span attributes or log messages. Trigger when a user provides ASP.NET Core source (Program.cs, telemetry registration, logging configuration, instrumentation code) or sanitized appsettings, asks whether their telemetry is wired correctly, or wants to know why traces are missing or logs are uncorrelated. This skill reviews source and sanitized configuration statically; it never runs the app or contacts a telemetry backend.
- ▌ Falco Runtime Threat Rules Review · vincentchuwaichow bundleUse this skill when reviewing Falco rules files, falco.yaml configuration, or runtime security posture for a Kubernetes workload. Trigger when a user provides Falco rules YAML, asks whether their Falco setup covers a specific threat, questions rule exception scope, or wants to validate that Falco alert output reaches their SIEM or incident response pipeline.
- ▌ Critical Rendering Path Review · vincentchuwaichow bundleReview page-load resource sequencing, render-blocking CSS/JS, layout-shift sources, and Core Web Vitals (LCP/CLS/INP) budget adherence against the critical rendering path model, explicitly separating lab/synthetic measurement (Lighthouse) from field/real-user measurement (CrUX/RUM) so performance claims are evidence-graded rather than asserted from a single synthetic run.
- ▌ Design Token Governance Review · vincentchuwaichow bundleReviews design-token source of truth and build pipelines for hardcoded-value drift and resolved WCAG 1.4.3/1.4.11 contrast compliance across theme variants (light, dark, high-contrast), grounded in the W3C Design Tokens format and current WCAG success criteria.
- ▌ GRAPHQL Client Security Review · vincentchuwaichow bundleStatically review GraphQL client configuration (Apollo Client, and urql/similar clients by analogy) for production-enabled devtools/introspection exposure, a normalized cache left uncleared across user sessions, missing persisted-query allowlisting against client-driven query abuse, auth headers attached with no CSRF protection, and sensitive fields cached unmasked -- grounded in Apollo Client's own configuration and security-relevant documentation.
- ▌ Nuxt Fullstack Security Review · vincentchuwaichow bundleStatically review Nuxt 3/4 full-stack code for private secrets exposed via runtimeConfig.public/NUXT_PUBLIC_* env vars, useState/module-scope cross-request state pollution in Nitro, server-route SSRF via $fetch/ofetch with blind useRequestHeaders/credential forwarding, NuxtPayload/useState serialization reaching an XSS sink, and missing security response headers (routeRules headers, nuxt-security), grounded in Nuxt's own documentation via Context7.
- ▌ Pci Payment UI Security Review · vincentchuwaichow bundleStatically review payment-page frontend code for PCI-DSS-relevant defects in the browser/DOM slice only — raw PAN collection in self-controlled inputs instead of Stripe hosted fields, card data persisted client-side or to analytics, raw card data POSTed to a first-party endpoint, and third-party scripts loaded without Subresource Integrity — grounded in Stripe's own tokenization docs and PCI-DSS v4 script-security requirements.
- ▌ React Rsc Data Boundary Review · vincentchuwaichow bundleStatically review React Server Components code for data leaks across the server-to-client serialization boundary — secrets passed as props to Client Components, server-only modules missing the `server-only` guard, `use server` actions with no authorization check, non-public environment variables read in `use client` modules, and tainted values crossing the boundary unnarrowed — grounded in React's and Next.js's own documentation.
- ▌ GCP Cloudbuild Deploy Cicd Operator · vincentchuwaichow bundleBuild and operate CI/CD pipelines using Cloud Build, Cloud Deploy delivery pipelines, Artifact Registry, SLSA provenance generation, and release gating with approval workflows.
- ▌ GCP Serverless Production Readiness · vincentchuwaichow bundleReview Cloud Run and Cloud Functions gen2 for production readiness — min-instances cold start, memory and CPU allocation, VPC connector configuration, Secret Manager injection, CMEK encryption, concurrency limits, and traffic splitting safety.
- ▌ Hetzner Infrastructure Reviewer · vincentchuwaichow bundleReview Hetzner Cloud infrastructure posture including Firewall inbound and outbound rules and server attachment, Load Balancer health check configuration and target pool design, private Network topology, Floating IP and Primary IP exposure, and region distribution across fsn1, nbg1, and hel1. Use when the user asks to audit or improve Hetzner Cloud network security or architecture.
- ▌ Huawei Dew Kms Lifecycle Steward · vincentchuwaichow bundleManage Huawei DEW (Data Encryption Workshop) — KMS key lifecycle and rotation, CSMS secret rotation automation, CBH (Cloud Bastion Host) privileged access session management, and DBSS database encryption and SQL audit.
- ▌ D365 Live Security Role Guard · vincentchuwaichow bundleLive read-only Dataverse security posture discovery — enumerate security roles, team and business-unit assignments, application users, over-privileged System Administrator assignments, and SoD-relevant privilege combinations — then propose least-privilege role design with rollback plan. Phase A read-only-runtime only; no mutation. Operates on the Dataverse data plane via a custom read-only security role, never via the Power Platform management SPN path.
- ▌ D365 Sales Revenue Operations · vincentchuwaichow bundleReview and advise on Dynamics 365 Sales revenue operations — pipeline and opportunity management, sales forecasting, lead qualification, sales accelerator configuration, CRM data hygiene, and sales insights. Detects pipeline trust gaps, forecast inaccuracy, CRM hygiene failures, and revenue leakage patterns. Refuses to approve live production forecast configuration or sales-process changes without live-guard escalation. Static review and advisory only.
- ▌ Netsuite Suitefoundation Skill · vincentchuwaichow bundleFlashlight skill for reviewing NetSuite platform foundation configurations aligned to the SuiteFoundation Specialist certification (N16300GC10). T0 static review — no live account connection required. TRIGGER when: user asks to review record form layouts, saved search criteria or results columns, dashboard portlet configuration, custom field definitions, custom list or segment setup, subsidiary hierarchy, or basic role and permission baselines in NetSuite. Trigger phrases: review my saved search, check my record form, audit our custom fields, validate subsidiary setup, review role permissions, inspect dashboard configuration, SuiteFoundation review. DO NOT TRIGGER when: request involves SuiteScript code analysis (use netsuite-application-developer-agent), OAuth or TBA authentication setup (use netsuite-sso-oauth-tba-agent), financial close controls or posting periods (use netsuite-financial-foundations-agent), SDF project deployment pipeline (use netsuite-sdf-devops-release-agent), or any live account mutatio
- ▌
- ▌
- ▌ Python Data Pipeline Reliability · vincentchuwaichow bundleUse this skill to statically review Python data-pipeline reliability (Airflow, Dagster, Prefect, PySpark): task idempotency and safe backfills, partitioning and late-data handling, schema evolution and data contracts, checkpointing, retry policy, and data-quality gates. Reads DAG/pipeline source and configuration only; it never runs a pipeline, triggers a backfill, or connects to a warehouse.
- ▌ Python Language Contracts Typing · vincentchuwaichow bundleUse this skill to statically review Python type contracts and gradual typing: Any propagation across public boundaries, Protocol and structural typing, generics and variance soundness, overload consistency, TypedDict and dataclass contracts, and the separation of static typing from runtime validation. Reads source and type-checker config only; it never runs the checker or the code.
- ▌ Python Live Exception Governance · vincentchuwaichow bundleUse this skill to record and review a policy exception: confirm a named owner distinct from the requester, an explicit scope, an expiration date, compensating controls, and a review date, refuse to approve its own exception, and automatically flag expired or incomplete exceptions as findings.
- ▌ Sap Guarded Integration Flow Change · vincentchuwaichow bundleDeploy or modify SAP Cloud Integration iFlows and integration artifacts using a mandatory 17-step guarded mutation sequence covering classification, target tenant confirmation, criticality, requester, approver (integration-owner required), ticket, scope, read-only current state, diff of artifact changes, blast radius (downstream partners and throughput), rollback (previous version redeploy), post-change verification via message monitoring, and audit evidence. Refuses if any step is missing, if integration-owner approval is absent, or if a diff has not been produced. Use when a confirmed and approved iFlow deployment or integration artifact change in a non-development Cloud Integration tenant must be executed under traceable controls.
- ▌ Sap Release Change Collision Review · vincentchuwaichow bundleSAP Release and Change Collision Review
- ▌ Typescript MCP Tool Contract · vincentchuwaichow bundleUse this skill to statically review MCP tool-contract fidelity in TypeScript servers against the 2026-07-28 specification revision: `inputSchema`/`outputSchema` fidelity against handler behavior, JSON Schema dialect correctness, `structuredContent` vs `content`, protocol-version negotiation and the `-32022` mismatch error, `server/discover`, and protocol vs tool-execution error classification. Reads tool definitions, handler source, and SDK/package metadata only; it never hosts or contacts a live server.
- ▌ Business Combinations Advisor · vincentchuwaichow bundleMulti-jurisdiction business combinations reference framework covering acquisition accounting, purchase price allocation, goodwill, and post-combination integration under ASC 805 and IFRS 3.
- ▌ Alibaba Iac Change Safety Review · vincentchuwaichow bundleReview Terraform and ROS (Resource Orchestration Service) changes targeting Alibaba Cloud — blast radius analysis, resource deletion detection, cross-stack dependency impact, Resource Directory scope, and rollback plan completeness.
- ▌ AWS Ecs Service Remediation Operator · vincentchuwaichow bundleCorrect AWS ECS and Fargate service definitions, task definition config, deployment parameters, health checks, environment settings, and rollout wiring in-repo. Use for non-destructive repo fixes only; do not force deployments or mutate live services from this role.
- ▌ AWS Event Driven Architecture Review · vincentchuwaichow bundleReview AWS event-driven system design across EventBridge, event buses, Pipes, SQS, SNS, Step Functions, event schemas, filtering, cross-account routing, retries, DLQs, replay, idempotency, monitoring, and event-loop risk. Prefer serverless production readiness for Lambda runtime/deployment readiness.
- ▌ AWS Live Deployment Guarded Operator · vincentchuwaichow bundleOperate guarded live AWS deployment changes with explicit account, region, profile, approval, dry-run, rollback, and verification gates. Use only when the target environment is confirmed and a live deployment action is intentionally requested.
- ▌ AWS Observability Incident Responder · vincentchuwaichow bundleInvestigate broad AWS incidents and observability gaps using CloudWatch metrics, logs, alarms, traces, EventBridge events, service health, runbooks, timelines, blast radius, root-cause discipline, and post-incident actions. Prefer RDS/Aurora investigator for database-specific performance incidents.
- ▌
- ▌
- ▌