PeculiarVentures

Use when changing adapters, adapter runtime resolution, vendor-specific token behavior, capability reporting, initialization/reset flows, or built-in adapter registration. Helps keep vendor logic in the right package and aligned with emulator-backed tests.

Use when working on cmd/piv or internal/cli/app, especially for commands, flags, formatting, JSON output, trace routing, config handling, or destructive-operation safety. Helps keep stdout/stderr contracts stable and preserves dry-run and confirmation behavior.

Use when adding or updating emulator-backed tests, APDU trace fixtures, fake reader contexts, or command tests that should avoid real hardware. Helps align new tests with the repository's existing emulator and trace patterns.

Use when the task involves preparing, reviewing, staging, or committing repository changes. Helps keep commits focused, avoids bundling unrelated diffs, and keeps commit messages consistent with the repository's expected style.

Add new APDU command decoders, status word definitions, or TLV data object definitions to the registry modules.

Add support for a new APDU log format by creating a parser module with canParse/parse methods, registering it, and adding tests.

Run the full quality check pipeline: TypeScript type checking, Biome linting/formatting, Vitest tests, and production build.

Smart card APDU trace forensic analyzer. Use this skill whenever the user uploads a smart card log file (.log), mentions APDU trace analysis, asks about PIV or GlobalPlatform card behavior, wants to debug smart card provisioning, needs to identify a card from its ATR or APDU traffic, or asks about card security (default keys, credential exposure, certificate status). Also trigger on: CardForensics, CryptoTokenKit log, eToken, YubiKey trace, SafeNet, PIV provisioning, SCP03 authentication debugging, smart card forensics, CHUID, FASC-N, card management key, APDU replay, or card compliance audit. This skill runs a full pipeline: card identification (5,100+ ATR database), protocol reconstruction, TLV annotation, certificate provisioning checks, default key brute-force, threat detection, security scoring, token identity extraction, and compliance profiling — all client-side with no data leaving the machine.

Use when code must stay aligned with a specification or standard (FIDO, CTAP, RFCs, HTML specs), when behavior is unclear, or when you need to avoid guessing and verify the normative source before changing code.