Use this skill after /slo-architect (and /slo-tla if tla_required), when the user says "write the runbook", "plan the milestones", "turn this into tasks". Authors a full v4 runbook INTERACTIVELY, one milestone at a time, confirming each contract before moving…
Use this skill after /slo-spike has filled §7, to fill §8 Curation Decision — decide honestly. Mode is convergent. Classify confidence as exploratory, confirmatory, or engineering_ready from the evidence; require ablation and failure analysis before an…
Use this skill after /slo-curate has filled §8, to fill §9 Demo Pack + §10 Handoff Contract — make the discovery communicable and emit a method-complete RecommendationPacket. Mode is communication. Preserve confidence, ablation, failures, replication,…
Use this skill after /slo-pattern has filled §5, to fill §6 Precision Model — make the invisible measurable. Mode is measurement. Convert each promising pattern into a falsifiable claim with a measurement handle, an accept threshold AND a kill threshold,…
Use this skill after /slo-precision has filled §6, to fill §7 with a bounded DiscoveryRecord and/or ValidationRecord. Discovery is exploratory and may refine a mechanism; validation cites one complete active ProtocolFreeze, uses held-out frozen arms with no…
Use this skill to drive one milestone of a v3 runbook. Invoke with the milestone number or identifier, e.g. "/slo-execute M3" or "execute milestone 3 of the runbook". Restates milestone constraints, writes BDD tests first, implements the smallest safe change,…
Use this skill when a product repo needs graph-backed codebase understanding, fast troubleshooting, or security triage. It combines Graphify knowledge graphs with semantic-provider facts from rust-analyzer / TypeScript language service and analysis-provider…
Use this skill to wire threat-model-driven SAST scanning into a target product repo. Reads docs/slo/design/<slug>-threat-model.md for CWE references, picks tuned Semgrep rule packs for the detected stack, emits a safe GitHub Actions workflow plus a baselined…
Use this skill when the user wants to pull or claim a bite-sized ticket from GitHub Issues before implementation. It normalizes issue context, applies the ticket sizing gate, creates or updates one persistent issue workpad comment, and hands off to…
Use this skill after /slo-ticket-pick, when one GitHub issue should become a bite-sized SLO ticket contract. It writes docs/slo/tickets/ticket-<issue>-<slug>.md from a v4-derived template, keeps the v4 Contract Block rigor, and escalates to /slo-plan when the…
Use this skill after /slo-execute finishes a milestone, before /slo-retro closes it. Invoke with the milestone number — "/slo-verify M3". Exercises BDD scenarios at runtime, including UI paths via Playwright if the milestone has a UI surface. For every bug…
Use this skill after /slo-plan produces a runbook, BEFORE /slo-execute runs any milestone. Orchestrates four adversarial review passes (CEO, eng-lead, security, design) against the plan. Auto-fixes mechanical issues, surfaces scope concerns for user approval,…
Use this skill at the END of every milestone, after /slo-execute and /slo-verify have finished. Writes the milestone's lessons-learned file, completion summary, and updates the runbook's Milestone Tracker. Requires a filled-in Evidence Log. Refuses to run on…
Use this skill to open or resume a creative experiment — when the user says "what if", "could we explore", "maybe there's something here", "can we play with", or "I have a weird technical hunch" but does NOT yet have a feature. Creates…
Use this skill after /slo-play has filled §4, to fill §5 Pattern Catalog — turn raw play into named reusable mechanisms (a vocabulary of tricks). Mode is convergent. Cite probe IDs for every pattern, run the next-curve check and the DICEE check, and narrow to…
Use this skill after /slo-sandbox has filled §3, to fill §4 Play Log — generate many raw probes from the sandbox's probe seeds WITHOUT premature judgment. Mode is divergent: the goal is to map possibilities and surface surprises and dead ends, not to pick a…
Use this skill after /slo-experiment has opened an Experiment Book, to fill §3 Sandbox Charter — choose the MATERIAL, not the feature. Mode is framing: name what we are playing with, why it is rich, the boundaries, the safety rails, the weirdness budget, at…
Use this skill to pick up an interrupted runbook. Invoke as "/slo-resume" (no args) and it reads the current runbook's Milestone Tracker to identify the first non-done milestone, then suggests the next skill to run for that milestone. Does not modify state —…
Use this skill when a runbook's milestones are all done and you're ready to open a PR — "ship this", "open the PR", "push and PR". Syncs main, runs the full non-parked test suite, confirms git state is clean-ish, pushes the branch, opens a PR with a…
Use this skill when a UK seed-stage founder needs PM-side artifacts: a product roadmap with RICE / Kano prioritisation, a product-metrics dashboard defining north-star + activation funnel + retention curves + feature adoption, OR a quarterly OKR set tied to…
Use this skill at the start of any new product or feature idea — when the user says "I want to build X", "I have an idea for", "let's design", "what if we", or hands you a rough pitch. Interrogates the idea YC-office-hours style with six forcing questions,…
Use this skill when /slo-architect has set tla_required=true, or when the user asks to "verify the design", "model check", "prove this is correct", "add TLA+ to this plan", or whenever a design involves concurrent actors, distributed state, ordering…
Use this skill when /slo-architect has set kani_required=true, or when the user asks to "verify this Rust code", "model-check this function", "prove this can't panic / overflow / go out of bounds", "add Kani to this", or whenever Rust code has unsafe blocks,…
Use this skill after /slo-research, when the user is ready to commit to architecture and stack decisions — "design the system", "pick the stack", "write the architecture". Produces ARCHITECTURE.md plus stack decision and interface-lock-in docs. Sets…
Use this skill to produce a scenario-driven AWS, GitHub, or Cloudflare cloud / platform threat model. Given one prebuilt scenario ID it writes a structured Markdown threat-model document plus a machine-readable companion, citing framework control identifiers…
Use this skill to wire and tune DAST for an authorized web app or web service through zaprun only. Operates OWASP ZAP via the latest approved digest-pinned ghcr.io/kerberosmansour/zaprun image, reads threat models, OpenAPI/routes/auth context, and SAST SARIF,…
Use this skill to implement one docs/slo/tickets/ticket-*.md contract. It is the ticket-sized analogue of /slo-execute: BDD tests first, exact file allow-list enforcement, smallest safe change, v4 evidence log discipline, and no scope widening without user…
Use this skill after /slo-ticket-execute. It performs ticket-sized runtime QA and security/static evidence checks against docs/slo/tickets/ticket-*.md, writes regression tests before fixes for any bug found, and updates the issue workpad. It does not…
Use this skill for authorized OWASP Nettacker vulnerability assessments, recon-to-active scanning plans, safe Nettacker CLI/API/Web UI usage, scan result triage, CI drift monitoring, and writing or reviewing custom Nettacker YAML modules ("rules") for…
Use this skill to read CycloneDX 1.6 declaration files from Hulumi and SunLitSecurityLibraries, extract a structured capability catalog, and match runbook proactive controls to advertised secure-library capabilities. M1-M2 are read-only; M3 files…
Use this skill when a UK seed-stage founder needs a brief-the-accountant memo (R&D claim narrative, VAT registration timing, MTD readiness check), needs an HMRC letter or accountant communication translated to plain English, needs to triage whether an…
Use this skill when a UK seed-stage founder needs first-cut equity artifacts (cofounder split rationale, vesting schedule with 4-year/1-year-cliff, cap-table snapshot), needs a vesting agreement / option grant translated to plain English, needs to triage…
Use this skill when a UK seed-stage founder needs a self-assessment artifact: 12-question check (stress / runway / cofounder / health / family / finances), worst-case-runway worksheet (cash + months + cut-cost levers + pivot options), optional YC application…
Use this skill when a UK seed-stage founder needs first-cut fundraising artifacts (SAFE / cap-and-discount math worksheet, pitch narrative, investor update, term-sheet redline preparation), needs an investor-supplied legal document translated to plain…
Use this skill when a UK seed-stage founder needs an artifact for a hire: sourcing playbook, interview rubric, offer cadence, onboarding checklist. Generator with mode_arg covering role shape (`swe | ae | designer | ops` in v1; founder may extend with…
Use this skill when a UK seed-stage founder needs first-cut legal documents (NDA, contractor SOW, IP assignment, T&Cs), needs a legal document received from a counterparty translated to plain English, needs to triage whether a matter requires a lawyer, or…
Use this skill after /slo-ideate produces an idea doc, when the user says "research this", "check the market", "what's out there", "is this viable", or when a design decision depends on data the codebase cannot answer. Use host-native research tools first to…
Use this skill to generate or extend a Semgrep rule pack for a Rust workspace. In bootstrap mode (no flags), seeds `.semgrep/rust/` with the top-10 Rust CWE classes (CWE-755 panic-DoS, CWE-416 UAF, CWE-697 incorrect-comparison, etc.). In extend mode…
Use this skill to verify an existing Semgrep rule pack against the deterministic `cargo xtask sast-verify gate` (validate + test + check-coverage + check-clean). Read-only — never writes, never edits, never reaches the network. Reports per-rule pass/fail.…
Use this skill when a UK seed-stage founder needs to prepare for a user interview, draft an interview script, or extract structured signal from a completed interview. Generator pattern (single-mode, no four-mode contract). Output:…