Triages a vulnerability report (Dependabot, npm audit, composer audit) — reachable or not, exploitable in this app or not, and what to do this week versus later.

Sketches a threat model for a feature from its description and data flow — assets, entry points, top threats by STRIDE, and the mitigation that exists or is missing.

Turns a draft PRD into one a team can build from — problem before solution, success metric with a number, explicit non-goals, and open questions with owners.

Writes an endpoint's reference page from its route, request validation and response shape — every field, every error, one working example.

Drafts a reply to a support ticket from the conversation and the help center — answers the actual question first, promises only what the policy allows, and escalates when it should.

Prepares a retrospective from the sprint's data — what shipped, what slipped, where time went — and turns it into three concrete questions for the team.

You own one outcome: a Notion meeting page becomes a task list that imports into a Notion database or task tool without handediting. Every row has one owner, a due date or an explicit blank, and a ver...

You own one outcome: every invoice received by email for the agreed period is saved as one correctly named file in Google Drive under /Invoices/YYYY/MM/, and each one is reconciled against the bank st...

You own one outcome: a written findings summary that tells HR what a candidate's public LinkedIn, Instagram, Facebook and TikTok presence shows about two things, jobrelevant conduct and credential acc...

Audits the branches of a git repository, ranks them by how likely they are to be dead, presents the candidates for deletion, and deletes only what the user explicitly confirms — locally, on the remote...

Read-only triage for a Linux box serving a site over nginx or Apache, with PHP-FPM, bare metal or in Docker. Separate ladders for "down" and "slow", a verbatim read-only command allowlist, the 502/504/499 split by errno, pool saturation versus memory_limit versus OOM kill, certbot renewal traps, load read against core count, and inode exhaustion. Proposes commands; never executes, never mitigates.

You own the diagnostic pass: a draft comes in, and you return a linereferenced report of every marker that makes prose read as machinegenerated — hedge stacks, ruleofthree padding, stock transitions,...

You rank files and modules in a codebase by the product of change frequency (churn) and structural complexity, producing a ranked hotspot table plus a short remediation brief. The outcome you own is a...

You turn a draft article into 10 ranked headline variants, each scored for clarity and click appeal, with a recommended pick and a designated A/B pair. You own the decisionready output: a writer or ed...

You scan a client dataset against an agreed list of required fields and produce a recordlevel audit that names every row with missing, blank, or placeholder values in those fields. You own the complet...

This skill owns a single deliverable: a defensible ranked list of topselling SKUs for a named period, ranked by both units sold and net revenue, with movement since the prior comparable period and the...

You scan support conversations and tag accounts that show cancellation warning signs, producing a ranked risk list with evidence quotes and a recommended next action for each flagged account. You own...

A design review is not a list of everything wrong with a page. Anyone can produce forty observations. The work is deciding which three matter, and showing why. This skill is built around that: evidenc...

You turn a raw commit message — or a batch of them — into one or two sentences a nondeveloper understands, written so it can drop straight into a social post, changelog blurb, or release note. You own...

This skill converts one week of raw commit history into a numbered X/Twitter thread draft that a human can review, edit, and post. You own the translation from implementation detail to uservisible ben...

Puts you under hard questioning before someone else does — one question at a time, following the weakest thing you just said, never revealing the answer before you commit. Ends with a debrief separating what you established, what you asserted without support, what you did not know, and what you knew but could not say.

Documents code so it is still true in a year. Audits what already exists and what in it is false, establishes behaviour by reading the implementation rather than the names, pushes every fact to the closest place it can live — a rename, a type, a validation message, a test — and writes prose only for what the code cannot say.

Audits a project's dependencies and produces a prioritised upgrade plan: what is a security risk, what has drifted behind, and what is not used at all. It reports and recommends — it does not install,...

This skill turns a legacy stylesheet base into a prioritized, sequenced refactor plan toward a tokendriven design system. You own the deliverable: a ranked list of refactor moves, each with scope, ris...