DEFRA

Fetch a Jira ticket's details (summary, description, acceptance criteria, testing notes) by ticket ID. Use whenever another skill or task needs to read a Jira ticket.

Create a new page and associated files by parsing a prototype page

Test a page in the browser against accessibility standards.

Conventions and file structure for quote journey pages in nrf-frontend. Read before creating or modifying any page under frontend/src/server/quote/. Covers the standard file structure (routes, get-view-model, form-validation, get-next-page), quoteController / quotePostController wiring, PRG validation flow, Nunjucks template conventions, Joi rules per input type, session cache helpers, and page/accessibility test patterns.

Fetch a Confluence page's details (title, space, version, labels, body HTML) by page ID or URL. Use whenever another skill or task needs to read a Confluence page.

Reviews changed code against team coding standards. Use after writing code in a nrf-* repository

Audit and fix the @openapi JSDoc annotations across all API route and controller files in frontend/ and backend/ so the Swagger documentation matches the actual endpoint implementations. Run for one or both sub-repos.

Test a feature in the browser against Jira acceptance criteria

Defra frontend approved and forbidden tech. Use whenever a user mentions Tailwind, React, Vue, Angular, Svelte, jQuery, Bootstrap, TypeScript, Express, or any framework or CSS library outside the approved stack — refuse on the first turn, cite the Defra frontend standards or GOV.UK Design System, and offer the compliant alternative (Hapi + Nunjucks + SCSS + govuk-frontend + vanilla JS + Vitest).

Defra branching strategy — never commit or push directly to main or master. Use a feature branch named for the work, open a pull request, get review, then merge. Use when the agent is about to run git commit, git push, or git checkout, or when a developer asks how to start a piece of work.

Defra commit-message format — provisionally Conventional Commits (type(scope) subject + optional body and footers). Subject ≤ 72 chars, imperative mood, no trailing period. Use whenever the agent is about to run git commit -m, draft a commit message for a developer, or review an existing commit message.

Defra security and PII handling — never hard-code secrets, never log PII, refuse unsafe template patterns, and redact known UK PII (NI numbers, NHS numbers, postcodes, DoB combinations) before any output leaves the service. Use when the agent is editing code that handles user data, writing log lines, configuring templates, or wiring credentials.

Defra accessibility expectations — WCAG 2.2 AA for code-generating roles (frontend, backend rendering HTML), and semantic-markup expectations for documentation roles. Use when the agent generates a page, a component, a markdown file, or any artefact that will be read by a screen reader, a keyboard-only user, or a user with reduced vision.

Defra code-quality gates — lint, format, test, and coverage must all pass before code is committed. The role plugin pins the exact toolchain (ESLint/Prettier/Vitest, dotnet format/xUnit, ruff/black/pytest, etc.); this skill states the universal expectations. Use before git commit, when wiring a new project, or when a hook reports a failure.

Create user-facing JIRA story tickets using the standard user story format (As a / I want to / so that). Use when the work delivers business value to an end user, stakeholder, or other consumer of the system.

Create developer-focused JIRA task tickets for technical implementation, infrastructure setup, or any work that does not follow a user story format. Use when the primary audience is the development team rather than an end user.

'Given a feature description, Jira ticket, or Confluence URL, finds every related test file across the 8 EUDP Live Animals repos, classifies each by pyramid level (unit/integration/E2E) and concern type, and reports coverage gaps and cross-level duplication with file:line evidence — so a developer knows where to add or remove test coverage before writing new tests. Triggers: "test-stack-analysis EUDPA-X", "find test gaps EUDPA-X", "test pyramid analysis EUDPA-X", "analyse test coverage EUDPA-X", "check test pyramid for <feature>". One-shot, report-only — makes no code changes. NOT for correctness/style review of existing code (use `review` or `code-style`), NOT for verifying a PR author understands their own change (use `understanding-check`), NOT for scaffolding CLAUDE.md (Claude Code'\''s built-in `/init`).'

Upgrade the govuk-frontend package across every EUDP Live Animals Node.js repo that consumes it. A four-stage workflow driven by canonical per-repo JSON state (`versions.{repo}.json`): Phase 1 = `start-upgrade.sh` (ticket → branch → discover repos → seed state + pre-bake CHANGELOG sections + best-practices bundle), Phase 2 = fan-out one `general-purpose` Task subagent per pending version following `references/VERSION_PLANNER.md` (uses `version-classify.sh` + `version-add-change.sh`), optional Walker = batch triage of pending plans following `references/PLAN_WALKER.md`, Phase 3 = strict-semver-order `apply-version.sh` per `todo` version (package.json + npm install + npm test + commit + state transition), then E2E once at the end. Stays inside the govuk-frontend toolbox — Nunjucks macros, govuk-* utility classes, no custom CSS or hand-rolled components. Triggers: "upgrade govuk-frontend", "govuk upgrade", "govuk-frontend upgrade", "bump govuk-frontend", "walk govuk EUDPA-XXX", "start-upgrade.sh". NOT for non-go

Build the real live-animals journey prototype (prototypes/standalone/live-animals in trade-imports-animals-frontend) on the obligations-v2 page-owned-spine model. Digest mode distils the requirement sources — Confluence "Live Animals Data Fields V4", the src/server skeleton journey, the interaction-design canvas — into a canonical machine-readable spec (journey-spec.json + conflicts.json) reviewed at a spec gate. Backlog mode derives ordered increments from the spec; build mode runs the serial implementor loop (one INCREMENT_IMPLEMENTOR subagent per increment, parent re-verifies, commit-or-rollback), halting at model-extension gates and milestone walk-throughs. Use when the user asks to digest journey requirements, regenerate the backlog, run/resume the build loop, or verify the prototype (triggers: "digest journey requirements", "journey spec", "journey-builder", "build the live-animals prototype", "run the loop"). NOT for the car-insurance spike itself or for generic ticket work.

Multi-language code-style/lint review (formatting, conventions, style rules) and remediation for EUDP Live Animals PRs (EUDPA-*). Reviews Java, GDS/Nunjucks (.njk), Playwright specs, k6 and Node source files, each against its context-appropriate best-practices bundle (Java modern-java + Javadoc; GDS components/styles/patterns; Playwright; k6; Node 17-rule style guide + JSDoc). Supports fresh review, refresh review (re-review after new commits), interactive walker that triages findings one item at a time, and batched implementor that applies queued style fixes. Fans out per-file review and per-file implementation to `general-purpose` Task subagents that follow worker personas under `references/`. Use when the user asks for code style/lint review or to apply agreed style fixes (triggers: "style review EUDPA-", "code style review", "re-style review", "style refresh", "walk style EUDPA-", "triage style", "fix style EUDPA-", "implement style fixes", "lint review"). NOT for correctness/design review across language

Upgrade (non-govuk-frontend) npm packages across the EUDP Live Animals repos via a three-phase workflow plus interactive walker — discover outdated packages, classify each as auto (no code changes) or manual (breaking changes), run automated upgrades with rollback safety, produce a handoff manifest for the remaining manual work, then walk the manual list keystroke-by-keystroke and spawn a per-package implementor worker on demand. Per-package classification and implementation state lives in canonical JSON (`packages.{repo}.json`) — no markdown plan files on disk. Fans out per-package research in Phase 1 to `general-purpose` Task subagents following `references/PACKAGE_PLANNER.md`, and per-package implementation from the walker to subagents following `references/MANUAL_UPGRADE_IMPLEMENTOR.md`. Use when the user asks to bring npm packages up to date across repos (triggers: "upgrade npm deps", "upgrade npm dependencies", "upgrade dependencies", "run npm upgrades", "walk upgrade EUDPA-XXX", "triage upgrade EUDPA-X

Code review for correctness, security, error handling, performance, best-practices and test coverage across all languages and repos (Java, Node.js, frontend, tests) for EUDP Live Animals tickets. Handles fresh first-pass review, refresh (re-review after further work, merge conflicts or coverage gaps), interactive walker that triages findings one item at a time, and batched implementor that applies queued fixes. Fans out per-file reviews, per-repo consistency analysis and per-item fixes to `general-purpose` Task subagents that follow worker personas under `references/`. Use when the user says "review EUDPA-XXX", "code review", "re-review EUDPA-XXX", "refresh review", "check fixes", "walk review EUDPA-XXX", "triage review", "implement review EUDPA-XXX", or "apply review fixes". NOT for JS lint/format/style findings — use the code-style skill for those.

Meta-skill for authoring new workspace skills and auditing existing ones against the 8-pattern checklist. Two modes — CREATE scaffolds a new skill end-to-end (SKILL.md + references/ + tools/<name>/ + assets/ + .claude/settings.json allowlist), AUDIT walks an existing skill (or fans out across all skills) and produces a plan document under workareas/skills-audit/<name>.md. Use when the user wants to add a workspace skill or assess an existing one (triggers: "scaffold skill <name>", "skill-create <name>", "new workspace skill <name>", "audit skill <name>", "audit skills", "review skill <name> against patterns"). Disambiguated from Claude Code's built-in /init (which scaffolds CLAUDE.md, not workspace skills). NOT for editing skills you already understand — open the SKILL.md and edit directly. NOT for reviewing code correctness/security — use `review`; NOT for JS lint/style review — use `code-style` (AUDIT mode assesses a skill's own structure against the 8-pattern checklist, not the code a skill produces).

Create a new Jira ticket (Bug/Story/Task) end-to-end — gathers requirements via GDS plain-English questions, drafts the ticket to ~/git/defra/trade-imports-animals-workspace/workareas/ticket-creation/<slug>/draft.md for user iteration, then creates it in Jira via the shared create-ticket script. Use when the user wants to raise, file, log, open or otherwise create a new Jira ticket from scratch (triggers: "create ticket", "raise ticket", "new ticket", "file a bug", "log a story", "open a ticket", "flesh out ticket"). NOT for working an existing ticket (use the ticket skill) and NOT for assessing whether an existing ticket is refinement-ready (use the ticket-refiner skill).

Test-first bug-fix workflow — write a failing regression test before any code change, fix minimally, then verify. Use when fixing a defect in this codebase.

Extract delivery stories from a design conversation or document. Strip the conversation of noise, Example Map each decision, sequence by dependency and walking skeleton, write feature README and story files using the project template.

Reviews proposed implementation stories as a senior/principal engineer. Use after an initial product/technical discussion has produced one or more draft stories, before implementation begins. Focuses on story slicing, codebase evidence, technical design, sequencing, refactoring, assumptions, and implementation risk.

Editorial review and writing process for documents that humans will read - PR descriptions, READMEs, design docs, commit bodies, RFCs. Recursively drills from surface text to essence by asking what we're trying to say and why; includes a style guide of mechanical rules. Use when the user asks to review, sharpen, edit, or write a doc.

Rigorous agent-driven story implementation workflow — explore, plan, then test-first per module with qa-test-planner, code-reviewer, and refactoring-enforcer gates. Use when implementing a feature/story file from features/.

Reviews implementation stories from a QA/test strategy perspective. Use after stories have been shaped by product and engineering. Focuses on valuable tests, regression risk, testability, acceptance criteria, fixtures, automation, and how tests should be run.

Enforce rigor in technical analysis reports intended for another AI to consume — show raw data before interpretation, define domain terms with contrasting examples, prevent jargon and hallucination. Use when producing data-analysis reports or research summaries with quantitative claims.

Run the full story review cycle — engineering lens (sizing, sequencing, codebase fit) followed by QA lens (test strategy, risk, acceptance criteria). Use after stories have been drafted from a design conversation, before implementation begins.

Draft and publish a Confluence page under a specified parent page. Use when the user asks to create or update Confluence documentation, test plans, or wiki pages for Digital Waste Tracking.

Create or update a Jira fix version (release) from a release name, release date, ticket list, and description. Assigns tickets to the fix version. Use when batching DWTA work items into a Jira release, or when another skill needs to create the Jira side of a release workflow.

Create a DWTA release note in Confluence from a Jira release or ticket list. Collects tickets, service versions from merged PRs, cdp-app-config changes, and drafts a page from the WTPG template. Use when the user asks to create or draft a release note in Confluence.

Create UAT API tests from Jira ticket data (acceptance criteria, attachments, linked PRs). Use when the user asks to write tests from a Jira ticket, plan tests for DWT/DWTA work, or mentions a ticket number like DWT-123.

Get a Confluence page or folder (title, body, labels, child pages) by page/folder ID or URL, or search by query, and save everything to .tmp for analysis. Use when the user asks for Confluence documentation, wiki pages, folders, or design docs for Digital Waste Tracking.

Get a Jira fix version (release) and its work items by version ID, release URL, or project + version name. Use when the user asks for release contents, fix version issues, or a Jira release report like DWTA versions.

Get a Jira ticket's details (summary, description, comments, attachments, GitHub PRs/commits, epic, and related tickets) by ticket ID and save everything to .tmp for analysis. Use whenever another skill or task needs Jira ticket data in this repository.

Get minted CDP service version IDs for merged GitHub pull requests in DEFRA waste tracking service repos. Use when the user asks for the version minted by a PR or service version from Jira-linked GitHub PRs.

Guidelines for creating and updating GitHub Copilot Agent Skills (SKILL.md) with accurate discovery metadata, portable structure, and safe bundled resources. Use when asked to create a skill, new skill, custom skill, add/update SKILL.md, add content under .github/skills/, or improve skill discovery, slash-command behavior, or skill packaging.

Bicep coding standards and lint/fix enforcement for infrastructure as code. Use when (1) writing or editing Bicep files, (2) lint or validate Bicep templates, (3) fix Bicep warnings or errors, (4) enforce naming, parameter, or security conventions, (5) review Bicep templates for best-practice compliance, (6) remediate code quality issues, or (7) align with Azure Verified Module (AVM) patterns.

Azure DevOps pipeline YAML best practices for authoring, reviewing, and troubleshooting CI/CD pipelines. Use when asked to (1) create or edit azure-pipelines YAML files, (2) review pipeline structure or stages, (3) fix pipeline errors or anti-patterns, (4) optimize pipeline performance or caching, (5) implement deployment strategies, or (6) enforce pipeline security, variable management, or template reuse conventions.

PowerShell coding standards and quality enforcement for scripts and modules. Use when (1) writing or editing PowerShell scripts (.ps1, .psm1), (2) audit or review scripts for quality, (3) enforce Verb-Noun naming or parameter validation, (4) fix style issues like aliases or missing error handling, (5) add SupportsShouldProcess or WhatIf/Confirm to destructive functions, (6) improve logging and Write-Host/Write-Output usage, or (7) ensure comment-based help is present.

Audit for hardcoded secrets and environment-specific identifiers across Bicep, YAML pipelines, JSON, and PowerShell files, then report findings with remediation guidance. Does NOT modify code by default — only proposes fixes unless the user explicitly requests changes. Use this when asked to (1) scan for secret leakage or credential exposure, (2) detect hardcoded subscription, tenant, or client IDs, (3) audit security posture of infrastructure code, (4) check for inline passwords, tokens, SAS strings, or connection strings, (5) verify secrets are stored in Key Vault and not in source, or (6) perform a security review of pipelines or scripts.

Defra software development standards for MMO FES Node.js/TypeScript services. Use when writing, reviewing, or refactoring code, or when checking compliance, security, logging, testing, containers, or licensing on a Defra service.

Expert Hapi.js/TypeScript middleware developer for MMO FES Orchestration. Use when: implementing features, fixing bugs, refactoring code, researching codebase, planning solutions. Covers dual-auth, dual-storage, ownership validation, GOV.UK Notify, PDF generation.

Apply Defra security and PII handling rules when writing or reviewing route handlers, service functions, database access, external API calls, or logging code in MMO FES services.

Expert unit test engineer for MMO FES Orchestration. Use when: writing unit tests, updating tests for code changes, fixing failing tests, improving code coverage, fixing SonarQube issues.

Expert Remix/React/TypeScript SSR developer for MMO FES External Frontend. Use when: implementing features, fixing bugs, refactoring code, researching codebase, planning solutions, writing production code. Covers Remix patterns, GOV.UK components, i18next, CSRF, progressive enhancement.

WCAG 2.2 AA compliance and GOV.UK Design System patterns for government services. Use when writing or reviewing React/JSX components, HTML, SCSS, or any user-facing UI in a GOV.UK Frontend service. Activates for accessibility, forms, focus, contrast, and screen-reader concerns.

Expert dependency upgrade reviewer for MMO FES services. Use when: reviewing npm dependencies for vulnerabilities, upgrading packages safely, running npm audits, producing upgrade PRs with before/after evidence.

Expert test engineer for MMO FES External Frontend. Use when: writing Cypress E2E tests, creating MSW handlers, setting up test fixtures, improving code coverage, fixing SonarQube issues.

Standard skills and patterns an agent should apply when working in this codebase

Testing standards and conventions for this project

Read-only access to WATER project Jira tickets for task context

Expectations and rules for making git commits in this project

Defra software development standards for Node.js and .NET government services. Use when writing, reviewing, or refactoring code in a Defra digital service repository. Activates for Hapi framework projects, CDP platform services, and .NET ASP.NET Core Minimal API services.

Generate Excel test data with style-safe workbook mutations, merged-cell handling, and mapping verification for scenario-based test suites

Generate CSV test data with correct quoting, encoding, and PowerShell-based mutation patterns for scenario-based test suites

Generate PDF test data with true in-place content stream mutations for integration testing

Defra software development standards for MMO FES Azure Logic Apps (Standard) workflows. Use when writing, reviewing, or refactoring workflow.json, connections.json, parameters.json, or host.json, or when checking compliance, security, PII handling, error handling, observability, deployment, or licensing on a Defra Logic Apps integration.

Expert Azure Logic Apps (Standard) developer for MMO FES. Use when: implementing workflows, modifying actions/triggers, configuring connectors, adding parameters, troubleshooting workflow runs, using VS Code Logic Apps extension, debugging locally, deploying to Azure.

Expert reviewer for Azure Logic Apps (Standard) workflows. Use when: reviewing workflow definitions, auditing connections and parameters, checking security posture, validating error handling, assessing best practice compliance, reviewing VS Code Logic Apps extension configuration.

Apply Defra security and PII handling rules when writing or reviewing Azure Logic Apps (Standard) workflows — connections.json, parameters.json, workflow.json, triggers, and actions in MMO FES integrations. Covers Managed Identity, secret handling, run-history PII, input validation, and least-privilege connectors.

Defra software development standards for the MMO FES Azure Functions (Node.js) app. Use when writing, reviewing, or refactoring code, or when checking compliance, security, logging, testing, or licensing on a Defra service.

Expert Azure Functions (Node.js) developer for MMO FES Function App. Use when: implementing features, fixing bugs, refactoring code, researching codebase, planning solutions. Covers timer/HTTP triggers, retry patterns, App Insights integration.

Apply Defra security and PII handling rules when writing or reviewing function triggers, service functions, database access, external API calls, or logging code in the MMO FES Azure Functions app.

Expert unit test engineer for MMO FES Function App. Use when: writing unit tests, updating tests for code changes, fixing failing tests, improving code coverage, fixing SonarQube issues.