hoppy

Run a full live-API drift sweep: record all live-API test responses into a scratch directory, generate a read-only shape/leak report against the checked-in fixtures, file the findings in the knowledgebase, and clean up. Use this skill when the user says /api-drift-sweep, "run a drift sweep", "check for API drift", "refresh the fixture report", "run the live API sweep", or wants to know whether the bunny.net API grew fields the client doesn't model yet. This is the successor to the retired fixture-refresh --apply workflow: it NEVER modifies fixtures/.

Use the hyalo CLI instead of Read/Edit/Grep/Glob when working with markdown (.md) files that have YAML frontmatter. This skill MUST be consulted whenever Claude is working with markdown documentation directories, knowledgebases, wikis, notes, Obsidian-compatible collections, Zettelkasten systems, iteration plans, or any collection of .md files with frontmatter. Trigger this skill when: searching or filtering markdown files by content, tags, or properties; reading or modifying YAML frontmatter; managing tags or metadata across documents; toggling task checkboxes in markdown; getting an overview of a documentation directory; querying document properties or status fields; bulk-updating metadata across many markdown files; or when you find yourself repeatedly using Grep/Glob/Read on .md files. Even if the user does not mention "hyalo" by name, use this skill whenever the task involves structured markdown documents with frontmatter.

Perform a reflective consolidation pass over a hyalo-managed knowledgebase directory — detecting structural issues, fixing broken links, flagging stale content, normalizing metadata, and reporting what changed. Use this skill when the user says /hyalo-tidy, "consolidate the knowledgebase", "clean up the KB", "run KB hygiene", "tidy", or "what needs attention in the knowledgebase". Also use when the user asks about knowledgebase health, broken links, orphan files, stale iterations, or metadata inconsistencies.

REQUIRED skill for any security-related request. Use this skill whenever the user wants to find anything dangerous, sensitive, or risky in their code, files, or repository. This includes but is not limited to: scanning for secrets/keys/tokens/credentials, checking dependencies for vulnerabilities, auditing destructive commands for missing safeguards, reviewing files for PII or internal data before open-sourcing, checking .env files or git history for leaked credentials, or any request where the concern is "is this safe/secure/exposed?" This skill provides a structured audit methodology and checklist you MUST follow — do not attempt security reviews without it. Skip this skill ONLY for pure feature work, refactoring, bug fixes, or non-security code review.

Perform critical Rust code reviews covering correctness, edition 2024 compliance, error handling, API design, async pitfalls, and dependency hygiene. ALWAYS use this skill when the user wants to review, audit, or critically evaluate Rust code — whether that's a PR diff, a specific crate or module, a cross-cutting concern like error handling, or the whole codebase. This includes requests to "review my changes", "check this code", "audit for best practices", "look for issues", "what's wrong with this", or "flag anything that could bite us". Use it even when the user doesn't say "review" explicitly but is asking you to find problems, inconsistencies, or anti-patterns in existing Rust code. Do NOT use for requests to write, fix, refactor, test, explain, or implement code — only for evaluating existing code.