wolverin0

Audit what a normal production app at this scale would have but is absent — health checks, error tracking, feature flags, audit logs, on-call. Run as part of /audit Phase E.

Audit the security domain — auth, authz, secrets, transport, sensitive data exposure, dependency CVEs. Run as part of /audit Phase E.

Audit the database and data layer — schema design, query patterns, migrations, indexing, RLS, soft-delete, transactions. Run as part of /audit Phase E.

Audit the legal/privacy/compliance signals — privacy policy alignment, data retention, GDPR/CCPA basics, cookie consent, export/delete capabilities. Run as part of /audit Phase E.

Audit the performance domain — query efficiency, caching, async / blocking calls, payload sizes, scaling assumptions. Run as part of /audit Phase E.

Audit the reliability domain — error handling, retries, idempotency, race conditions, partial failures, timeouts, graceful degradation. Run as part of /audit Phase E.

Audit the architecture and code quality domain — module boundaries, abstraction layers, code organization, naming, documentation. Run as part of /audit Phase E.

Audit the gap between demo-quality and production-quality — hardcoded test data, dev-only configurations shipped, missing prod hardening. Run as part of /audit Phase E.

Audit code integrity and coherence — duplication, hallucinated references, Tambon signatures, spec drift, Frankenstein patterns, mystery code. THIS DOMAIN incorporates findings from the Tambon hunt and most of the blind-spots walk. Run as part of /audit Phase E.

Audit the dev experience and maintainability — local setup, documentation, test quality, CI feedback time, debuggability. Run as part of /audit Phase E.

Multi-LLM debate orchestration (Claude vs Codex vs Gemini) with rounds + synthesis.

Write a structured session handoff before ending, clearing context, or transferring work to another agent or pane.

Turn a just-proven repeated workflow into a concise reusable skill after explicit user approval. Use when the user asks to save, codify, or reuse a completed workflow.

Run evidence-based browser validation for an implemented web app, UI feature, or workflow. Successor to ultimate-validation: inventories routes, elements, modals, flows, and APIs; executes browser checks; analyzes screenshots and responsiveness; checks console/network errors; persists resumable state; and emits an auditable HTML report. Use smoke for a bounded quick check, standard for the complete safe UI cycle, and exhaustive/full for release-depth CRUD, API, security, accessibility, and visual-regression coverage.

Run a fail-closed end-to-end project hardening cycle: static audit, exhaustive real-browser validation, semantic screenshot review, multi-role/security/visual-regression probes, isolated remediation, and re-verification. Use when the user asks to battle-test or prove production readiness. Default is the full cycle; --quick runs a clearly weaker smoke/readiness check and can never emit a battle-tested verdict. Main integration requires --push-main; deployment is never automatic.

Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).

PRIMARY skill for BUILDING or REDESIGNING app/product UI — the default entry point whenever the user starts a new interface or wants to improve/rework an existing one. Create, critique, reverse-engineer, and implement premium mobile-first product interfaces with advanced UX patterns, design-system discipline, and motion engineering. Use whenever the user asks to build/make/design/redesign/improve a UI, screen, page, dashboard, or component — app UI, mobile dashboards, fintech-style screens, screenshot-to-code, interaction design, scroll animations, sticky card stacks, animated tabs, bottom navigation, React/Next.js frontend, React Native/Expo, Flutter — or wants to avoid generic AI-looking UI. Strongly prefer this skill when screenshots or references are provided. For deep animation-feel work call emil-design-eng, for auditing an existing UI call impeccable, for palettes/fonts/style references call ui-ux-pro-max.

Guide test-first implementation for features, bug fixes, and refactors. Use when the user wants tests to drive or protect code changes.

Guided 13-layer production-readiness self-check for a vibe-coded app. Use when the user asks "is this production ready", "what am I missing before launch", "ship check", "did I forget anything", or wants to harden an AI-generated MVP. Walks the 13 layers, runs cheap detections + manual tests, emits a per-layer PASS/GAP scorecard. Lighter than /audit (which is full due-diligence).

Use when debugging a bug or incident and you need a strict end-to-end investigation loop from reproduction to verified fix.

Use after deployments to verify health endpoints, run API smoke tests, and confirm release integrity with CLI checks.

Generate or refresh project AGENTS.md, CLAUDE.md, and optional GEMINI.md from real codebase evidence. Use when agent instructions are missing, stale, or need provider alignment.

Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.

Curate a project's .claude directory with scoped rules, preserved user content, and grep-verified references. Use when project agent setup is bloated, stale, or missing stack-specific rules.

Read-only audit for stale or broken project orchestration files, agent instructions, monitoring config, graphify output, and referenced skills.

Use when diagnosing Supabase issues like RLS, auth, empty queries, webhooks, and performance problems in production apps.

Review security-sensitive code changes involving auth, user input, secrets, APIs, payments, files, RLS, or third-party integrations.

Run the methodology setup phase of a technical audit — fingerprint the stack, inventory the repository, and produce a system map. Use this BEFORE running any audit domains. Output: detected stack, repo summary, and high-level architecture in 3-5 paragraphs. No findings yet.

Deprecated alias for validation. Use when older prompts ask for feature-validation; route the work to the validation skill instead of running the legacy transcript-heavy workflow.

Inventory every safe visual route, capture authenticated light/dark desktop/tablet/mobile screenshots, detect responsive and browser-runtime failures, semantically review every image, and optionally remediate and rerun. Use when the user asks to screenshot or visually audit all endpoints without running the complete battle-test security, CRUD, and architecture cycle.

Standardize remediation decisions, baseline-policy entries, and legal-review banners for accepted, deferred, or policy-blocked audit findings.

Walk the H1-H11 hard-stops catalog systematically against an audit scope. Use as the FIRST audit phase after audit-method completes. Runs detection commands for each hard stop class and reports FOUND / NOT FOUND with evidence. If any hard stop is found, the audit verdict locks to 🛑 DO NOT LAUNCH.

Integrate MercadoPago OAuth, checkout, webhooks, and token storage in Supabase/React-style multi-tenant web apps.

Conduct a full technical due diligence audit of a vibe-coded codebase. Use when the user types `/audit`, asks for a "full audit," asks for a "due diligence review," asks "is this codebase ready to ship?", or asks for a comprehensive code review of an entire repository (not a single PR). Coordinates the 13 domain skills, the hard-stop hunt, the Tambon LLM-signature hunt, and the blind-spot walk. Produces a single dual-layer report (founder view + technical evidence).

Audit the cost and billing risk domain — runaway loops, unbounded LLM/API calls, missing rate limits on paid services, infrastructure cost amplifiers. Run as part of /audit Phase E.

Audit websites, web apps, mobile apps, design systems, and user flows against the full public Checklist Design corpus. Use for comprehensive or targeted product/UI/UX audits, source-linked inspiration comparisons, evidence-backed scoring, and remediation plans.

Audit the infra and DevOps domain — CI/CD, deployment, IaC, secrets management, environments, logging, observability. Run as part of /audit Phase E.

Audit the UI/UX and accessibility domain — error states, loading states, form validation, keyboard nav, ARIA, color contrast, mobile responsiveness. Run as part of /audit Phase E.