ohnotnow

User's conventions and patterns for native macOS Swift apps. Use when working on a Swift or macOS app project

Streamlined workflow for implementing features with ait issue tracking. Handles: reading project context, checking outstanding work, planning new features, creating ait issues, and implementing with proper acceptance criteria checking. Use when starting a new session or beginning work on a feature.

One-stop review after feature work, or for a whole codebase. Runs deterministic checks (section ordering, arch conventions) free of charge, then fresh-eyes reviewer agents. Covers team conventions, test quality, complexity, security, and Livewire/Flux patterns - plus runtime checks (a11y, cold UX probe) when UI changed. Also has a quick mid-session sanity-check mode ("this seem ok?").

Turn a settled feature discussion or plan document into consultant-ready ait issues — an initiative/epic vision document plus implementation specs a fresh agent could pick up cold, tomorrow. Use towards the end of a feature conversation ("let's get this into ait"), or when converting a plan file. Also the knowledge base for the plan-to-ait agent. For driving the ait CLI itself, see the ait skill.

Flesh out a terse ait issue into a detailed plan. Takes a vague "reminder to self" issue and explores the codebase to produce a proper plan document ready for plan-to-ait.

Conversational 'second pair of eyes' that finds reachable-but-dormant code in long-lived codebases — jobs, mailables, listeners, routes, commands that are still wired up but probably defunct — gathers concrete grep/git/telemetry evidence, and asks the developer 'cruft or keep?'. The developer is the oracle; the skill never deletes. Use when asked to audit or find dead/unused/dormant/defunct code, to 'cruft or keep', to spring-clean a codebase, or to check whether a specific mailable/job/route/command is still used.

Survey any codebase as a senior advisor and produce prioritized, self-contained implementation plans for OTHER models/agents to execute. Strictly read-only on source code — never implements, fixes, or refactors anything itself. Use when asked to audit a codebase, find improvement opportunities (bugs, security, performance, test coverage, tech debt, migrations, DX), suggest features or where to take the project next (roadmap, product direction), or generate handoff plans for another agent to implement.

Capture faithful, full-page reference screenshots of an existing web app's UI before or during a frontend migration (for example Bulma/Bootstrap + Vue to Livewire/Flux + Tailwind), so the rebuilt UI can keep a familiar 1:1 mapping for end users who treat the app as a tool. Use this whenever the user wants to screenshot or snapshot the current UI, capture every admin/staff/student page for reference, grab login-only or role-gated pages (including via impersonation), or says things like "screenshot the old UI", "capture the current pages", or "reference shots for the migration". Drives a real browser with Playwright rather than the in-browser Chrome screenshot tool, which only captures the viewport and cannot save full pages to disk. Tuned for Laravel apps but the capture technique applies to any web app.

Explore a Linux server's security posture to provide reporting to IT security staff. Use this to find vulnerabilities, misconfigurations, and other issues when asked.

Batch server audit — runs server-explore and security-explore for every server in a list, generates all reports. No prompting, no questions.

Explore a Linux server's security posture to provide reporting to IT security staff. Use this to find vulnerabilities, misconfigurations, and other issues when asked.

Explore a Linux server's configuration, set up, oddities for IT security staff. Use this to find out about a server, what's running on it, and "what's weird about it"

Batch server audit — runs server-explore and security-explore for every server in a list, generates all reports. No prompting, no questions.

Explore a Linux server's configuration, set up, oddities for IT security staff. Use this to find out about a server, what's running on it, and "what's weird about it"

Local-first issue tracker for coding agents. Use when planning work, tracking multi-step tasks, modelling dependencies, coordinating between agents, or resuming after session loss or conversation compaction. You must use this skill if the user mentions `ait`.

Pre-flight check before cutting an ait release. Reports the state of the working tree, the latest tag, and CHANGELOG.md, then flags anything that looks off. Does NOT run git, gh, or any release commands — just reports findings and hands back to the maintainer. Use when the user says "tag a release", "ship a release", "pre-flight check", "tag-release", or asks to look over the repo before they cut a tag.

Multi-repo orchestration for `ait`. Use when a project spans more than one git repository (e.g. separate frontend and backend repos) and you need to plan, track, or coordinate work across them. Triggers on mentions of "ait fleet", "across repos", "multi-repo ait", "frontend and backend ait", or any request to set up or use ait across more than one repo.

Generate a friendly markdown recap of recent `ait` activity for the current project, or scan a directory of projects. Use when the user asks "what have I been doing this week?", "what shipped recently?", wants an aide-mémoire before a status update with a manager, or asks for a summary of recent activity across their projects.

Refresh the supply-chain pins that already exist in a repo — bump pinned GitHub Action SHAs to newer releases via pinact, re-resolve Docker image digest pins (Dockerfile, docker-compose and Swarm stack files, .gitlab-ci.yml, workflow services) to the tag's current digest, refresh the dated pin comments, and finish with a report-only docker scout CVE pass over the pinned images. Use whenever the user wants to update, bump, or refresh existing pins — "bump the node pin", "the security patch landed, update the pin", "refresh the digests", "update the pinned actions", "are our pins stale?", mentions pinact, or a security advisory lands for a pinned image or action. Creating *new* pins in an unhardened repo belongs to the sibling moat-repo-fixer skill; this skill keeps already-pinned repos current.

Apply in-repo security hardening fixes that Laravel's `moat` CLI flags for the current repository — pin GitHub Actions to commit SHAs, add a Dependabot config tailored to the repo's ecosystems, drop in a `SECURITY.md`, and restrict per-workflow token permissions. Also applies proactive supply-chain hardening beyond moat's own findings, tailored per ecosystem — npm/Bun install-script and release-age cooldowns, Composer `allow-plugins`, Python (pip/uv) wheels-only installs and hash-pinning, Go checksum and `govulncheck` checks, plus pinning Docker image tags to digests and catching stale pinned versions across Dockerfiles, compose/Swarm stack files and CI config. Use when the user is inside a repo and wants to action moat findings, or asks to "harden this repo", "fix moat issues here", "apply moat fixes", "harden npm/composer/python/go/bun", or "protect against supply-chain attacks". Can optionally deliver the applied fixes as a GitLab merge request via `glab` when the repo's primary remote is an on-prem/self-m

Apply settings-level security hardening fixes that Laravel's `moat` CLI flags at the org or repo-settings level — org-wide workflow token defaults, secret scanning / push protection / dependabot defaults, branch protection or repository rulesets, per-repo workflow permissions, direct collaborator cleanup. Use when the user has a moat report (or wants to run one) covering an organization and wants to action the settings findings. Prefers `gh api` over Chrome automation for safety and auditability; falls back to chrome-devtools-mcp for UI-only items. File-level fixes inside individual repos belong to the sibling `moat-repo-fixer` skill.

Answer the user's questions about their shopping — both what they've already bought and what they could buy — by querying the shopping.db store. Use this whenever the user wants to recall a past purchase ("what was that nice gochujang I bought?", "did I get a fancy soy sauce last year — was it Japanese or Korean?"), asks what / when / how much they've bought, wants recommendations or to explore a cuisine or ingredient ("I'm in the mood for Malay food, what do you suggest?"), or asks whether a shop stocks something or what a good substitute would be for an unstocked item ("they don't have Camargue rice — what's close?"). Reach for it even when the question is vague or chatty. NOT for onboarding or removing shops (that's the manage-shops skill) or refreshing a catalogue.

How to add a new shop to this shopping project's data store, or remove an existing one. Use this whenever the user wants to onboard / add / import a new shop or store, remove / delete one, or asks how to handle a shop that isn't Shopify (a small, bespoke, or hand-built website). Covers detecting and ingesting a Shopify shop, a decision ladder for non-Shopify shops, the db.upsert_product / db.ingest_order extension contract, and remove_store.py. Reach for this even if the user just says something like "I started buying from <some shop>, can we add it?" or "get rid of the Acme Foods data". Not for shops already in the store — querying purchases, comparing prices, exporting, counting shops, refreshing a catalogue, or fixing an existing parser are different tasks.

Use this skill when working with the Simple Spout package or when you need straightforward Excel import/export functionality.

Principles for writing simple, maintainable Laravel/Livewire code. Use when writing Livewire components, tests, or Blade views. Focuses on avoiding over-engineering.

Read reviewer comments created by the Differ macOS diff viewer. Use when working in a repository that may have Differ reviewer comments, when the user asks to check review comments from Differ, or when an agent needs to discover actionable feedback without copy/paste from the diff UI.

Local-first notebook for *why* — design decisions, alternatives rejected, pivots taken, the conversational nuance that gets lost when an issue closes. Sibling to ait. Use when the user asks to record/note a decision, after a load-bearing choice between options, after a library swap or refactor of direction, or to recall prior decisions in an area.

Guide for using the Sentry CLI to interact with Sentry from the command line. Use when the user asks about viewing issues, events, projects, organizations, making API calls, or authenticating with Sentry via CLI.

Stand up a tiny LAN-only mail server (maddy) on a Linux box — typically a Raspberry Pi — so that local AI agents and the user's mail client can send email to each other without ever touching the public internet. No Gmail account, no Protonmail, no MX records. Just `claude@yourbox.local` and friends, reachable from anywhere on the LAN. Use when the user wants their agent to be able to "send me an email", asks about a self-hosted mail server for an agent, mentions setting up postfix/dovecot/maddy/stalwart, or wants `hello@<hostname>` style internal addresses. Works on any Debian/ Ubuntu/Raspberry Pi OS host reachable over SSH.

Use this skill when asked to work with LDAP.