user-skills

Build or refactor reusable Node.js APIs using Express, express.Router, ESM imports, named exports, entity classes in model/, helpers for non-endpoint logic, middleware for auth and other pre-route concerns, and route handlers that talk to model instances. Use when creating CRUD APIs, JWT auth flows, bcrypt password login, route modules, or starter API structures.

Deliver behavior changes, bug fixes, refactors, and feature work in any project with tests or explicit validation. Use when changing application behavior, updating existing tests, writing tests, reviewing missing coverage, choosing between automated and manual validation, or documenting testing gaps across backend, frontend, CLI, and database migrations.

Build or refactor reusable server-rendered web frontends using Express, render middleware, template variables, page entry files in src/js root, DOM-related component classes in components/, support helpers in helpers/, and API-backed entity classes in models/. Use when scaffolding or reorganizing frontend projects that consume an API through frontend model methods.

Codebase Search & Intelligence using SocratiCode. Use when exploring code structure, searching concepts, finding symbol usages, inspecting impact/blast radius before refactoring, tracing execution flows, checking circular dependencies, or searching non-code context artifacts. Automatically checks index status and triggers indexing if the project is not yet indexed.

Enforce reusable, brand-aware CSS architecture for public web apps by owning shared tokens in a common stylesheet, importing page entrypoints first, keeping component partials scoped, and using consistent media-query and color-token conventions.

Maintain and query the developer's persistent Obsidian vault memory, component registry, architecture decision records (ADRs), and dev changelog graph. Automatically invoke whenever creating or modifying relevant code (features, fixes, refactors, shared components), making architectural decisions, capturing technical brainstorming, or when the user references past work or component versions across projects.

Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

Deeply review frontend code for rendering regressions, interaction bugs, state and URL sync defects, auth and redirect issues, accessibility gaps, date/time problems, bundle or template contract drift, and missing regression coverage. Use when auditing UI code, investigating user-facing bugs, or pairing findings with deterministic frontend tests and honest browser validation.

Guidelines for secure-by-default coding, bot/malicious actor protection, secure authentication/sessions, security headers, and input validation/escaping. Use this skill when: (1) implementing security/defense features, (2) adding bot defense (honeypots, rate-limiting, CAPTCHA), (3) configuring authentication/authorization/OAuth/tokens/passwords, (4) configuring CORS or security headers (CSP, HSTS, XSS protection), (5) implementing or refactoring any client-facing input form/endpoint where validation and escaping are required to prevent attacks (SQLi, XSS, SSRF).

Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Agent's capabilities with specialized knowledge, workflows, or tool integrations.

Optimizes, refactors, and updates an existing agent skill (SKILL.md) using a production prompt, candidate mutations, evaluator verdicts, and skill-local mutation memory. You MUST trigger this skill whenever the user requests to optimize a skill, run a skill evolution/optimization loop, improve a skill's performance on previous prompts, or update/apply mutation results and mutation memory files, even if they do not explicitly name this skill.

Auto-detect when generated code, prompts, or repeated agent behavior indicate a reusable workflow or durable rule. Update README, SKILL.md files, prompts, Copilot instructions, or durable coding conventions to reflect those lessons. Auto-invoke when user or agent text contains the exact phrases: "update docs", "update the skill", "fix Copilot instructions", "create new skill", "update skill", "document recurring pattern", "capture reusable workflow", or "this should be a skill".

Audit, verify, update, or clean docs, prompts, skills, agents, instructions, README files, and other markdown/MD files against the current project codebase. Use when documentation or agent context may be stale, inaccurate, inconsistent, or aspirational and must be aligned with the real implementation.

Deeply review backend, API, service, worker, and data-layer code for logic bugs, contract mismatches, authorization gaps, state-transition defects, time/date bugs, side-effect failures, and missing regression coverage. Use when auditing server-side code for real defects or pairing bug-finding with deterministic regression tests.

Document touched code with JSDoc, method comments, and focused section comments as the default behavior whenever implementing a new feature, refactoring, changing a body of code, writing tests, or improving maintainability. Apply this by default for all code-writing tasks; if the user explicitly requests no comments, respect that. For non-JavaScript code, use the ecosystem's native doc-comment format with the same standard.

Keep project documentation, agent guidance, comments, and validation instructions synchronized with the real implementation. Use after any feature, refactor, bug fix, test change, dependency/config/runtime update, API or UI contract change, file-layout change, environment variable change, build/deploy workflow change, or durable project convention update that could make README files, docs, AGENTS.md, .github/copilot-instructions.md, .agents skills/prompts, comments, JSDoc/docstrings, or checked-in guidance stale.

Model API entities as classes inside model/, including base model inheritance, relation helpers, model-to-model composition, and route-to-model instance flows. Use when creating entities, join-table relations, persistence methods, or routes that should coordinate model instances through a shared database driver helper.

Migrate, port, rewrite, or update docs, prompts, skills, agents, instructions, README files, and other markdown/MD context from a source project into a target project. Use when copied .github/.agents/.claude/docs/tasks context must be audited against the target codebase, stale source-project claims removed, and files rewritten to match the destination project.

Build or refactor MySQL access layers that expose public helper methods such as find, get, insert, update, delete, and dump; keep any raw executor private inside the helper; and ensure only model classes use the driver. Use when adding database access, CRUD methods, filter handling, or base model infrastructure.

Analyze, audit, and implement search engine optimization (SEO) best practices in a project. Use when the user requests to improve site indexing, fix Google Lighthouse SEO issues, add or modify meta tags, construct dynamic title and description templates, configure Open Graph (OG) or Twitter cards, implement JSON-LD structured data (schemas), fix heading hierarchy (h1-h6), ensure semantic HTML compliance, generate or configure sitemap.xml and robots.txt, or resolve layout shifts and asset optimization impacting Core Web Vitals.

End-to-end browser-based UI and UX auditing for any product. Use when a user asks to test a page, feature, journey, release candidate, or interface as a real user would; when validating what existing automated tests cover plus requested scenarios plus adjacent UI breakage risks; or when producing a consultant-style Markdown audit report with findings, evidence, and prioritized UX improvements.