agentic-skills

Audit any product surface against accessibility standards: WCAG 2.2 AA for web, Apple UIKit/SwiftUI Accessibility for iOS, Android TalkBack/AccessibilityService for Android, Microsoft UIA for Windows, AT-SPI for Linux, game-specific readability and remappable-controls patterns, and voice/chat AI surfaces with appropriate alternative modes. Produces a per-criterion status, automated test suggestions, manual test scripts, screen-reader transcripts, contrast measurements, and a release-gate verdict that names the fixed and outstanding findings. Use after ux-design and before release on every surface with user interaction.

Design or review the operational harness around single-agent, multi-agent, and tool-using AI systems. Use when building agent platforms, routing layers, tool interfaces, memory systems, evaluation harnesses, human checkpoints, permission boundaries, cost controls, or agent-computer interfaces that must remain observable, testable, and safe under real project work.

Run an AI-augmented Product Development Lifecycle that treats every phase as a hypothesis to test, not a deliverable to push: research, hypothesis, plan-by-phases, prototype, validate, implement under TDD, harden against the matching security track (OWASP/MASVS) and CVE risk, and ship with rollback and post-launch evaluation. Use as the strategic spine when a project is greenfield, a brownfield refactor, an experiment, or a feature whose value is not yet proven; cooperates with sdlc-orchestrator (operational chain) and hypothesis-validator (evidence).

Analyze an existing repository in read-only mode to reconstruct current behavior, architecture, dependency clusters, build and test health, hotspots, tech debt, ownership boundaries, integration points, and current-vs-target gaps. Use for existing-product improvement, migration planning, code archaeology, risky refactors, unfamiliar repositories, or artifacts `80-current-state-scan.md` through `85-migration-plan.md` before writing code.

Design or review software architecture using system context, container, component, runtime, deployment, data, API, integration, crosscutting concepts, and ADR artifacts. Use before large implementation, service-boundary changes, infrastructure changes, API or data contract changes, migrations, reliability work, security-sensitive design, or architecture artifacts `14-system-context.md` through `22-adr-index.md`.

Use for CI/CD, pipeline automation, GitHub Actions, GitLab CI, Jenkins, Argo, Azure DevOps, build-test-scan-package-deploy flows, release orchestration, protected environments, approvals, and rollback.

Use for cloud architecture and operations across AWS, GCP, Azure, Cloudflare, DigitalOcean, Yandex Cloud, VK Cloud, Selectel, SberCloud, MTS Web Services, IAM, networking, HA/DR, managed services, migration, and cost/risk control.

Run competitive, adjacent-market, or alternative-solution analysis for product planning. Use when the project needs competitor scan, substitute workflow analysis, feature matrix, pricing or packaging comparison, positioning, wedge selection, blind-spot discovery, opportunity mapping, or `06-competitor-analysis.md` before product scope is locked.

Map the product against applicable regulatory, contractual, and platform compliance frameworks: GDPR, CCPA/CPRA, HIPAA, SOC 2, ISO 27001, PCI DSS, COPPA, FedRAMP, DPDP (India), LGPD (Brazil), KVKK (Türkiye), PDPL (Saudi/UAE), ePrivacy, AI Act (EU), NIST AI RMF, store-platform legal terms (App Store, Google Play, Steam), open-source license obligations, accessibility law (ADA, EAA, Section 508, AODA), and any product-domain-specific rules (FinTech, HealthTech, EdTech, kids). Produces an applicability matrix, per-framework gap analysis, data-processing register, DPIA/AIPIA when triggered, vendor sub-processor list, and a release-gate verdict that names the binding constraints. Use early in init for products entering regulated markets, and as a recurring gate before any release that adds regions, data types, integrations, or AI capabilities.

Use for Docker, BuildKit, Podman, Compose, OCI image builds, runtime behavior, registries, multi-stage Dockerfiles, image optimization, healthchecks, non-root execution, supply chain safety, and container troubleshooting.

Create or update user-defined skills for Codex, Claude Code, and local agent workspaces. Use when the user wants a new reusable skill, a project-specific skill, a team workflow skill, a tool-integration skill, a domain-knowledge skill, or a revision of an existing skill with proper frontmatter, concise instructions, references, agent metadata, routing integration, and validation.

Run a directed CVE and zero-day risk pass against the project's dependency graph, container base images, infrastructure providers, and known exploit chains relevant to the detected stack and platform matrix. Verify advisory-source documentation with Context7 MCP, then query live sources such as CISA KEV, NVD, GitHub Security Advisories, distro trackers, vendor PSIRTs, and ecosystem registries with recorded timestamps, parameters, and evidence. Produces a prioritized vulnerability register with exploitability, blast radius, mitigation, owner, patch plan, and a release-gate verdict. Use before any release, after any dependency or base-image bump, and on schedule for long-lived services.

Design and operate data and ML pipelines for any product: data sourcing, ingestion, schema management, transformation (batch and streaming), feature stores, dataset versioning, model training, evaluation, deployment, drift monitoring, retraining triggers, lineage, and reproducibility. Covers analytical data warehouses, lakehouse architectures, real-time streaming, embeddings/vector stores, and LLM fine-tune/RAG pipelines. Produces architecture, data contracts, validation plan, evaluation harness, deployment plan, and monitoring posture. Use whenever the product depends on data products, ML models, or LLM augmentation.

Break approved product scope and architecture artifacts into epics, user stories, implementation tasks, dependency graph, critical path, ownership map, validation packs, merge order, and parallelization plan. Use after requirements and architecture are approved and before assigning implementation agents, opening parallel work, or writing artifacts `24-epics.md` through `29-agent-role-matrix.md`.

Use for broad DevOps, infrastructure, deployment, automation, operations, security, incident, cloud, Kubernetes, CI/CD, container, IaC, scripting, observability, or network/VPN requests that need safe routing before implementation.

Maintain project documentation and Obsidian-first knowledge graph using Markdown notes, wikilinks, ADRs, artifact indexes, Mermaid diagrams as visual layer, change logs, and graph hygiene. Use when syncing docs after code changes, creating a project vault skeleton, updating project memory, linking requirements to architecture and tasks, cleaning stale notes, or making sure agents can navigate the project without confusion.

Convert a design choice, architecture option, market assumption, or feature bet into a falsifiable hypothesis with a measurable kill criterion, the cheapest useful test to settle it, and a clear record of what was supported, disproved, or deferred. Use whenever the agent is tempted to commit to a stack, a pattern, a vendor, a model, a UX flow, or a scope without evidence, and as the core supporting skill for ai-pdlc and architecture-review.

Set up and operate the localization pipeline for any product: source-string extraction, translation memory, locale matrix selection, RTL/CJK support, plural rules, ICU MessageFormat, cultural adaptation, voice-over recording where relevant, locale-specific QA, and store-listing translation. Produces locale plan, string-table source-of-truth, translator brief, glossary, locale-specific test plan, and release-gate verdict on missing or low-quality translations. Use whenever the product ships in more than one language, before any visible string is hardcoded, and as a recurring gate before release.

Use for incidents, outages, degradation, failed deployments, performance regressions, emergency diagnostics, stabilization, timelines, hypotheses, recovery plans, rollback, evidence capture, root cause notes, and prevention actions.

Use for Terraform, OpenTofu, Pulumi, CloudFormation, Bicep, ARM, Crossplane, provider constraints, remote state, imports, moved blocks, plan review, drift, policy checks, modular infrastructure, and safe resource changes.

Initialize a project for AI-agent development. Detects existing codebase architecture, language, framework, platform, runtime, package manager, test runner, CI, secrets backend, and existing documentation, or scaffolds a fresh project from a one-line intent like web app, iOS app, Android app, desktop app, game, CLI, or AI agent. Produces a working agent configuration, CLAUDE.md/AGENTS.md overlay, Obsidian project skeleton seed, and the next-step skill chain so the user can immediately give a normal product prompt without first explaining stack, layout, or conventions.

Clarify and scope incoming product or engineering requests before research, architecture, or coding starts. Use when the request is broad, emotionally urgent, ambiguous, risky, multi-phase, missing success criteria, missing constraints, missing non-goals, or likely to create rework if the agent starts implementation too early.

Use for Kubernetes deployment, manifests, Helm, Kustomize, operations, scaling, storage, networking, RBAC, NetworkPolicy, Pod Security, rollout planning, rollback, and cluster troubleshooting.

Use for VPC/VNet/subnet design, VPN, routing, DNS, firewall rules, ACLs, security groups, private endpoints, bastions, hybrid or multi-cloud connectivity, zero trust access, Kubernetes network policies, MTU, latency, and secure network troubleshooting.

Use for metrics, logs, traces, dashboards, alerting, SLI/SLO design, OpenTelemetry, Prometheus, Grafana, Loki, ELK, OpenSearch, Tempo, Jaeger, production diagnostics, and alert noise reduction.

Navigate the project's Obsidian knowledge graph efficiently so the agent loads the smallest correct context instead of re-reading the whole vault. Uses wikilink topology, MOC (map of content) pages, frontmatter metadata, and tag/property queries to answer 'what do I need to read for this task' in a token-economical way. Use whenever a skill is about to load notes from the project vault, before architecture decisions, before scope clarification, before security review, and any time the agent risks rereading the same artifacts.

Review or plan performance, memory, allocation, concurrency, caching, latency, throughput, profiling, benchmark, capacity, and language-runtime work. Use when a task mentions speed, memory, scale, load, p95/p99 latency, CPU, heap, allocations, async/concurrency, streaming, database query cost, caching, or artifacts `30-language-profiles.md` and performance-related quality scenarios.

Detect the target platforms a project is being built for (web, mobile iOS, mobile Android, desktop, console, embedded, server, edge, browser extension, game engine, AI agent, CLI, library), the runtime environments behind them, the store or distribution policy that applies, and the platform-specific quality constraints that must shape architecture and security. Use after init-project when the stack must be matched to the right testing matrix, accessibility floor, store-policy gate, performance budget, and security track (OWASP web/LLM/agentic or mobile MASVS) before architecture or implementation work begins.

Review pull requests or local diffs for correctness, regressions, missing tests, security, data safety, API compatibility, migration safety, performance risk, accessibility issues, operational hazards, and documentation drift. Use before merge, push, release, or whenever the user asks for code review, risk review, pre-landing review, or final check.

Enforce a clean project-activity contract for any repository the agent works on: coherent project structure, no root clutter, temporary/test/debug scripts isolated in a dedicated workspace, one canonical documentation/runbook entrypoint, and a clear cleanup/checklist before handoff. Use during init, planning, implementation, QA, review, release, documentation sync, scaffolding, migrations, and any task that creates files, scripts, docs, runbooks, examples, fixtures, screenshots, or experiments.

Plan and run verification gates for unit, integration, browser, contract, migration, security, performance, accessibility, smoke, acceptance, and eval scenarios. Use before merge or release, after implementation, when validation evidence is missing, when quality scenarios need proof, or when artifacts `32-test-strategy.md`, `33-evaluation-plan.md`, and release readiness notes must be produced.

Coordinate the release pipeline end to end: version numbering, release notes (internal and user-facing), changelog, build provenance, store/registry submission, certification checklists per platform (App Store, Google Play, Microsoft Store, Steam, consoles, npm/pypi/crates/Maven, container registries), staged rollout plan, post-release monitoring, and rollback. Produces a release plan, store-listing checklist, certification dossier, go/no-go report, and a post-release verification log. Use before any release and as the spine that pulls together TDD evidence, QA verdict, OWASP/CVE status, accessibility, localization, and DevOps deploy.

Convert product scope into functional requirements, nonfunctional requirements, measurable quality scenarios, acceptance criteria, and traceable requirement links. Use before architecture or implementation when FR/NFR lists, reliability, security, observability, performance, maintainability, compatibility, accessibility, data-safety, or artifacts `11-functional-requirements.md` through `13-quality-scenarios.md` are needed.

Research domain context, users, jobs-to-be-done, constraints, terminology, workflows, risks, and decision pressure before requirements or architecture. Use when creating a new product, entering an unfamiliar domain, validating product assumptions, preparing `05-domain-research.md`, or deciding what the system must respect before design or implementation begins.

Use for Bash, Python, PowerShell, operational tooling, CLI helpers, migration scripts, diagnostics, glue logic, safe automation, argument parsing, idempotency, dry-run modes, retries, timeouts, and error handling.

Orchestrate full software-development lifecycle work from first request to release readiness. Use when the user asks to build a product, improve an existing product, rebuild a messy system, coordinate several skills, choose between greenfield and migration work, or move a broad task through intake, research, requirements, architecture, decomposition, implementation, verification, and documentation gates.

Review native iOS and Android applications against OWASP MASVS and MASTG-aligned mobile security controls: local storage, cryptography, authentication, network communication, platform interaction, WebViews, code quality, app signing, anti-tampering, privacy, root/jailbreak assumptions, and release-store constraints. Use before any native mobile release, after changes to authentication, storage, networking, WebView, deep links, permissions, signing, or SDK dependencies, and alongside security-owasp-web for mobile backend/API surfaces.

Review an agentic AI system against the current OWASP Top 10 for Agentic Applications categories, including ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, and ASI10 Rogue Agents. Produces per-category status, autonomy budget, tool inventory with least-privilege scope, abuse-case eval results, kill-switch verification, and a release-gate verdict. Use for any system where an LLM-driven agent reads, writes, calls tools, plans, or coordinates other agents.

Review an LLM-powered feature against the OWASP Top 10 for Large Language Model Applications: prompt injection, sensitive information disclosure, supply-chain risk for models and data, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, unbounded consumption. Produces a per-category status, threat model for the LLM data flow, abuse-case test plan, and release verdict. Use whenever the product surface includes any LLM call, retrieval augmentation, fine-tune, embedding store, or model-routed automation.

Review or design a web, API, or mobile-backend system against the current OWASP Top 10 risk categories, including the 2025 order: broken access control, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software or data integrity failures, security logging and alerting failures, and mishandling of exceptional conditions. Produces a per-category status table, evidence list, residual risks, and a remediation plan that maps each finding to a code or configuration owner. Use before any web/API/mobile-backend release, on every major change to auth, data flows, third-party integrations, exception handling, or supply chain, and as a recurring gate alongside qa-eval and pr-review.