Menu
SkillsMP has collected 45 skills from bpmforge/attest. Open a skill to review its source and details.
Showing 40 of 45 collected skills.
Doc-driven implementation engineer. Reads SDLC design docs first, verifies all library APIs via Context7, then writes clean production code. Enforces anti-slop rules — no over-engineering, no defensive bloat, no hallucinated APIs. Use after design docs exist.
Gauntlet loop — multi-agent quality harness: a lead sets a real reference bar (a named product, test suite, or baseline to match or beat), splits the goal into gradeable units, builders produce artifacts in clean context, and blind fresh-per-round critics…
Image-quality gating and single-annotation tooling for captured screenshots (img-gate.mjs, annotate.mjs). Placeholder skill front door — T21.2 scope only.
Claude-Design-style visual iteration loop — render the running UI, screenshot at 375/768/1440, critique against docs/design/tokens.json and design principles, apply fixes, re-capture until clean (cap 3 iterations). Also extracts a token baseline from an…
Ralph Wiggum deep-onboard: Step D4 — re-run focused HANDOFFs for rows flagged by /onboard-verify. Does NOT re-run the full DISCOVER phase.
OWASP audit, threat modeling, CVE/dependency scanning. Supports --quick (default, ~10 min) and --deep (Ralph Wiggum: exhaustive OWASP x SAST rules x iterative attack chain, ~45-90 min). SAST runs on Opengrep + in-house bpm-rulepacks (never license-restricted…
Reflow the module-ticket graph so a newcomer can pick up work. Reads plan.json + completed artifacts, marks done modules, recomputes the claimable (ready + unclaimed) set, flags write-scope collisions, and emits a HANDOFF for a claimed module. Read-mostly and…
Project intelligence steward — audits CLAUDE.md / AGENTS.md alignment with actual codebase, captures session learnings, updates project docs. Use after major sessions or when docs feel stale.
Ground the agent in a library's real API before writing code against it — generate a version-pinned reference from the installed package, not from training data. Use before adopting a library, after a major upgrade, or when generated code keeps calling…
SDLC phase gate — runs the automated validators for the current phase and reports gaps. Use after completing all deliverables for a phase. Wraps ~/.config/opencode/scripts/validators/validate-phase-gate.sh.
Ralph Wiggum deep-onboard: Step D1 — enumerate every unit in the codebase (ROUTE / TABLE / SERVICE / FLOW / ENTRY) into docs/onboard/INVENTORY.md. Triggered by /sdlc onboard --deep or invoked directly for inventory refresh.
Ralph Wiggum deep-onboard: Step D3 — run all onboard validators and report uncovered inventory rows. Thin wrapper over ~/.config/opencode/scripts/validators/validate-phase-gate.sh onboard-deep.
Query, ingest into, and lint the agent-brain-vault (compiled project wiki at ~/Code/agent-brain-vault) — teaches any agent the three vault ops so a project question gets answered from compiled, cited pages instead of re-reading raw sources. Also the…
Pre-flight checklist before writing code in an existing codebase — project standards, surrounding patterns, existing utilities, library APIs, tests alongside. Run before the first edit, not after. Use when starting any implementation task in a codebase you…
Multi-pass cross-expert review with per-pass confidence scoring — coordinates code-reviewer + security-auditor + performance-engineer in parallel, only delivers a verdict when all 3 score ≥ 7.
Runtime-aware container ops (Docker/Podman/Rancher-nerdctl/Finch) — builds, Dockerfiles, compose, networking, rootless debugging, image optimization, multi-arch, and cloud-portable images for GCP/AWS. Use for container build/run failures, image tuning, or…
Codebase archaeology — trace a feature end-to-end before modifying it. Maps entry points, call chains, data flow, and every file that needs to change. Use before /sdlc feature or any time you need to understand how something works.
Senior git & forge expert — repo bootstrap, feature branches, releases, recovery, forensics, multi-remote sync. Six modes: --init (bootstrap repo + remotes + hooks), --feature (branch + atomic commits + draft PR), --release (semver + changelog + signed tag),…
Deterministic post-process tooling for generated pixel-art sprite batches: lattice/pixel-snapper cleanup, transparency de-fringing, sprite-sheet packing with a portable atlas manifest. Pairs with agents/game/game-asset-pipeline.md, which owns generation +…
Design direction, UX workflows, component architecture, WCAG 2.2 accessibility, live-environment design review. Use when designing new interfaces, reviewing PR UI changes, or auditing accessibility.
Code-health audit — complexity, duplication, error handling, type invariants, patterns, naming, comment accuracy, dead/unutilized code. Four modes: --review (full pass), --debt (tech-debt catalog), --consolidate (DRY + error-handling consolidation),…
SDLC orchestrator — new projects (/sdlc init), codebase onboarding (/sdlc onboard), feature addition (/sdlc feature), audit & improvement (/sdlc improve). Runs Discovery Interview before producing any documents. Route here whenever the user asks to review,…
Veracity challenger — adversarially challenges factual claims in high-stakes artifacts (security findings, research reports, design docs, gate decisions) with evidence-only verdicts: CONFIRMED / CONTRADICTED / UNVERIFIABLE. Every challenge cites file:line,…
Release manager — coordinates shipping a release: version bump, changelog assembly, tag, deploy-gate checklist, both-remotes push. Sequences git-expert + changelog-writer + validators so version metadata never drifts. For the raw git release mechanics alone,…
Live browser verification using playwright-mcp — navigate a running app, screenshot key flows, check accessibility snapshots, verify against use cases. Works with any LLM (no vision required). Use after implementation or for regression checks.
End-user simulation specialist — persona-driven true UAT. Walks the live app like a first-time human user with NO spec knowledge: only the persona, a goal, and what is on screen. Produces friction logs, first-run-experience reports, and task-completion…
LLM integration engineer — design-side expert for building LLM features: prompt architecture, eval harnesses, model routing and fallback chains, token budgeting, structured-output contracts, RAG shape. Use when a project adds or changes LLM-powered…
Documentation gap finder — scans source exports against existing docs, lists undocumented public functions/classes/API endpoints, stale doc references, and coverage percentage. Proactive: before a public release or when onboarding new contributors.
Frontend design — visual polish, typography, color systems, spacing, motion. Makes UI look intentional rather than AI-generated. Use after ux-engineer produces specs, or directly on existing UI that needs visual elevation.
Database migration planner — compares two schema states (files or git refs), produces ordered migration steps with rollback plan per step. Proactive: before any schema change that touches existing tables.
Accessibility & compliance audit — WCAG 2.2 AA/AAA, EN 301 549 / EAA, Section 508. Automated (axe/pa11y/Lighthouse) + manual checklist, findings with criterion + file:line + fix. Use after UX design (audit the spec) and after implementation (audit the DOM).…
Telemetry/instrumentation design — RED/USE/golden-signals selection, metrics catalog, event taxonomy, SLO-derived alerts, dashboard design. Use at Phase 3 or when nobody can answer "is it working?" in production. NOT for deploying the stack (/devops) or spend…
Cloud + LLM spend audit, right-sizing, unit economics. Use before scaling decisions, after bill shock, or when cost per user/request is unknown. RULE: every recommendation quantified in $/month — never "cheaper". NOT for performance — use /perf.
Data governance — PII classification, GDPR/CCPA/PIPEDA obligations, retention schedules, erasure paths, processor inventory. Use at Phase 3 to classify the schema before it ships, or on any feature touching personal data. NOT for vulnerability scanning…
Load testing & resilience — what breaks under stress and what happens then. Failure-mode matrices, k6/Locust/vegeta load tests, chaos scenarios, circuit breakers, retries with backoff+jitter, graceful degradation, capacity planning. Use at Phase 3 (resilience…
Expert-system concierge / front door. Describe any goal in plain English and it routes you to the right expert and drives the workflow — SDLC, security (find + fix), code health, dead code, performance, database, UX, tests, releases, research. Use when you do…
Module design and infrastructure topology. Derives business-domain modules from SRS and user stories. Produces MODULE_DESIGN.md (boundaries, interfaces, dependency rules, enforcement config) and INFRASTRUCTURE.md (env matrix, compute, data, networking…
Architecture decision tool — generates 2-3 alternative approaches with explicit trade-offs before committing. Use during Phase 3 design or any time you face a "how should we build this?" decision.
Quick code review of recent changes — spot reuse opportunities, quality gaps, over-engineering. Use on git diff after any edit. Faster than /review-code — scoped to what just changed.
API design expert — REST/GraphQL endpoints, contracts, versioning, OpenAPI docs. Use when adding/changing routes or request/response shapes. NOT for implementation — design only.