skills

Performance and complexity audit of a web application that hunts in both directions: classic performance debt (N+1 queries, missing indexes, unbounded result sets, sync I/O in hot paths, oversized payloads, dead code) AND over-engineering — premature optimization, speculative abstraction, caching layers that cache nothing, configuration for a day that never comes, indirection with a single implementation. The goal is a system that performs the same functions cleaner, faster, and with less maintenance risk — deleting code counts as a win. Use for a performance review, 'why is this slow', a complexity/simplification pass, dead-code cleanup, 'this codebase feels over-built', or after AI agents have layered abstractions onto a codebase. Builds a characterization-test baseline first so behavior is provably preserved, then outputs prioritized, Sonnet-executable work orders where every claim is backed by evidence — measured cost or demonstrated maintenance risk, never vibes.

Defensive security audit of a web application, layer by layer: transport (login over non-HTTPS, cookie flags), authentication (backdoors and debug bypasses left open, hardcoded or default credentials, weak password policy, session/JWT handling), authorization (IDOR, missing ownership checks, privilege escalation), input handling (SQL injection, XSS, CSRF, SSRF, path traversal, uploads), data exposure (secrets in the repo, PII in logs, over-fetching APIs, verbose errors), and configuration (open CORS, debug mode on, exposed admin routes). Ranks findings by likelihood × impact so a wide-open unauthenticated hole outranks a theoretical root-only attack — 'an admin with root access could delete everything' is not a five-alarm fire. Use for a security review, security audit, pre-launch hardening pass, 'is this app safe', or after AI agents have built features fast and nobody has checked the doors. Builds a test baseline first, then outputs prioritized, Sonnet-executable work orders where every fix carries proof th

Full-stack traceability audit for a web application: trace every UI interaction (link, button, form, fetch) down through routing, authentication/authorization, business logic, models, and storage — and back up the response path — to find contract drift between layers: renamed or mismatched parameters (emp_ID vs empID), wrong argument counts or order, type drift, orphaned endpoints, phantom UI calls, fields lost on the return trip. Use when multiple agents (or people) have worked on one codebase and their assumptions may have diverged, when 'the button does nothing', when an API and its callers feel out of sync, or before a release to prove every user-facing action still connects end to end. Builds a characterization-test baseline first, then outputs a trace matrix plus prioritized, Sonnet-executable work orders with per-item verification recipes.

Audit any Claude skill, prompt, or project to decompose it for cloud productization — separating design-time AI (frontier-model judgment done once, with Claude) from runtime AI (cheap-model execution on Workers AI / Llama Scout) from deterministic code, and specifying the Resource Files that let a dumber runtime model perform like a smarter one. Use whenever someone wants to productize a skill or workflow, move something from Claude to Cloudflare (Workers, KV, D1, R2, Workers AI), ask 'what here actually needs AI', design a Resource File, plan a runtime architecture for an existing Claude-based process, or estimate what a cheap LLM can and can't carry. Produces two markdown deliverables: an Audit Report and a Forward Strategy.

Build a complete custom diagnostic assessment (a 'where am I' quiz, scorecard, or self-assessment) for a domain expert's coaching or consulting offer, end to end. This is the entry point to the Red Dot pipeline: positioning, case intake, lifecycle mapping, outcome-space and gap design, question writing, deterministic scoring, report content, and gated assembly into a working artifact. Use whenever someone wants to turn expertise into an assessment, build a lead-gen quiz, design a scorecard, map where their clients get stuck, write or score quiz questions, draft result copy, or compile and ship a diagnostic. Start here even when the request names only one part; the router sends you to the right stage and names its upstream dependencies, so you can enter the pipeline anywhere.

Author an automated evaluation rubric for any prompt or skill, apply it to real outputs, and return scores plus actionable improvement feedback — closing the loop between "what good looks like" and "how to get there." Use this whenever someone wants to grade, score, evaluate, QA, or measure the outputs of a prompt/agent/skill; build an evaluator, scorecard, rubric, or LLM-as-judge; set acceptance criteria for an agent; run the judge on a concrete output; or asks "how would I know if this is doing a good job", "score this output", "what would get this to a 4", or "evaluate this and tell me how to improve it". Trigger it even when the word "rubric" isn't used — any request to systematically judge the quality of what a prompt, agent, or skill produces, or to improve an output against such a judgment, is in scope. Handles both prompts and skills.