dotfiles

Drafts fact-based technical articles for hayao's outlets — Zenn (@hayao), Qiita (@Hayao0819), the personal blog (hayao0819.com) — matching his structural register without faking his personality. Use when writing, drafting, or rewriting a 技術記事 / blog post / Zenn / Qiita article in hayao's name about a technical topic. The LLM writes facts only: it does NOT manufacture his jokes, 毒舌, 自虐, casual throwaway closers, or first-person anecdotes — performing his personality is fabrication and he finds it offensive. Encodes the factual baseline of his writing (genre-driven 敬体/常体, direct openings, plain content-label headings, inline-code density, primary-source links) in a bundled reference.md, and composes with the natural-writing skill. Self-contained — does not depend on machine-local memory. Do NOT use for: non-hayao docs, pure code, commit messages, or chat replies.

Rewrites prose so it reads as if a human wrote it — stripping out LLM tells in both English and Japanese. Use whenever producing user-visible writing of any kind: documentation, README, markdown, blog posts, commit messages, PR descriptions, GitHub Issues, code-review comments, code comments and docstrings, replies in issue threads, professional or casual emails, Slack/Discord/chat messages, release notes, design docs, academic-style writeups and 論文. Use it even when the user did not ask for "natural" prose — any drafted text leaving Claude that a human will read should pass through this checklist first. Triggers include: any request to "write", "draft", "compose", "summarize", "explain", "describe", "review", "comment", "reply", or 「書いて」「文章作って」「まとめて」「メール作って」「返信して」「PR/Issueの説明書いて」. Do NOT use for: pure code generation with no prose, raw data transformations, or terse tool output.

Security audit of memory-safety vulnerabilities in C/C++ (userland/systems, not kernel), with confidence-gated reporting to keep false positives low. Taint-traces untrusted input (argv, env, files, network, stdin) to memory sinks (copy length, array index, allocation size, format string) and reports only when input is attacker-controlled AND reaches the sink AND bounds aren't enforced. Covers buffer overflow, use-after-free, double-free, OOB read, integer overflow into undersized alloc, format string, the dangerous-function table, hardening flags to verify, and the ASan/UBSan/MSan/fuzzing toolchain. Covers userland/systems C and the SGX enclave/host (ECALL/OCALL) pointer boundary. Use when reviewing C/C++ for memory-corruption bugs. Kernel code → auditing-kernel.

Security audit of Linux kernel code and out-of-tree modules/drivers, with confidence-gated reporting to keep false positives low. Traces attacker input from userspace entry points (syscalls, ioctl, sysfs/proc/debugfs writes, netlink, char-dev, mmap) — and, for confidential-computing guests, from the untrusted host — to memory/refcount/locking/infoleak sinks. Covers UAF via refcount imbalance, the copy_to/from_user boundary, double-fetch TOCTOU, missing capability checks, integer-overflow allocations, ioctl handler review, and the TDX/SEV-SNP/SGX threat model. Use when reviewing kernel C, a driver/ LKM, an ioctl handler, or enclave/attestation code for vulnerabilities.

Security audit of web applications — backend implementation and authentication/ authorization flows — with confidence-gated reporting to keep false positives low. Traces attacker-controlled request input (params, body, headers, cookies, path) to sinks, distinguishing server-controlled from attacker-controlled, and reports HIGH only. Leads with broken access control / IDOR (OWASP #1), then injection (and where GORM/sqlc/React are already safe), XSS, SSRF, CSRF, auth (password storage, sessions, reset), and tokens (JWT alg confusion, OAuth/OIDC PKCE). Framework-aware for Go/Gin/GORM/sqlc and Next.js Server Actions. Use when reviewing a web backend, API, route handler, Server Action, or auth flow.

Idiomatic, version-current Go review and authoring for an experienced engineer. Covers deliberate error wrapping (errors.Is/As/Join, AsType), structured concurrency (errgroup, context, the loopvar fix), modern stdlib that replaced old patterns (slices/maps/cmp, log/slog, min/max/clear, range-over-func iterators), table-driven and synctest testing, API design the linter can't check, and Gin/GORM/cobra backend patterns. Use when writing, reviewing, or refactoring Go — .go files, go.mod, goroutines, errors.Is/As, a Go backend or CLI — or before committing Go. Flags outdated pre-1.22 idioms (loopvar v:=v shadows, tools.go, hand-rolled helpers).

Idiomatic, version-current Kotlin/Android review and authoring for an experienced engineer, Compose-first on Kotlin 2.x (K2). Covers coroutines/Flow pitfalls (GlobalScope, hardcoded dispatchers, exposed MutableStateFlow, collectAsStateWithLifecycle, stateIn), Compose idioms the linter misses (state hoisting, strong skipping, effect keys, derivedStateOf, modifier order), Kotlin language idioms (!! and lateinit, sealed + exhaustive when, value classes, kotlinx.serialization over Gson), and the official UI/domain/data architecture with Hilt. Use when writing or reviewing Kotlin or Android — .kt files, Composables, ViewModels, Gradle/version catalogs, coroutines — or Jetpack Compose UI. Pairs with the android-control skill for on-device work.

Idiomatic, version-current Next.js App Router review and authoring for an experienced engineer on Next 16 / React 19. Covers the 'use client' module-graph boundary and serializable props, Server Actions treated as public unauthenticated endpoints (validate + authN + authZ inside every one), the caching model that flipped across Next 14→15→16 (the biggest footgun), async Server Component data fetching, waterfalls, streaming, after(), and metadata. Use when writing or reviewing Next.js — app/ routes, 'use client'/'use server', Server Components, route handlers, next.config, caching, revalidation — or a React Server Components question. Defers to writing-ts for pure TypeScript.

Idiomatic Nix review and authoring matched to THIS engineer's flake-parts dotfiles conventions. Covers the readDir-pipe auto-discovery module layout, the NixOS/Home Manager/Darwin module system (mkOption/mkEnableOption, mkIf/ mkMerge/mkDefault, options/config split), packaging with finalAttrs and SRI hashes, override vs overrideAttrs, the nix.dev anti-patterns, and the nixfmt/ statix/deadnix toolchain. Use when writing or reviewing Nix — flake.nix, a module default.nix, an overlay, a package, home-manager/NixOS/darwin config — in this repo or another flake. Knows to ALWAYS validate with nix flake check and format with nix fmt after a .nix change.

Idiomatic, version-current, strictly-typed Python review and authoring for an experienced engineer who insists on uv for environment/version management, explicit type hints everywhere, and thorough checking with mypy + pylint + Pylance (Pyright). Covers the modern typing surface (X | None, list[str], PEP 695 generics, Self, Protocol, TypedDict, TypeIs, assert_never, @override, avoiding Any), the uv workflow and dependency groups, pydantic-at-boundaries, pathlib/f-strings/match idioms, and the strict tool configs to ship. Use when writing or reviewing Python — .py files, pyproject.toml, type errors, uv commands — or before committing Python. Flags Optional[X], List[], os.path, %-format, and poetry/requirements.txt.

Idiomatic, version-current Rust review and authoring for an experienced engineer on edition 2024 / Rust 1.9x. Covers error handling (thiserror in libraries, anyhow in binaries, #[non_exhaustive], #[from]/transparent), API idioms the borrow checker won't catch (&str/&[T] params, From over Into, newtype, builder, sealed traits, making illegal states unrepresentable), async cancellation safety and non-Send-across-await with tokio, unsafe documentation, and the clippy/cargo-deny/[lints] tooling. Use when writing or reviewing Rust — .rs files, Cargo.toml, traits, error enums, async — or before committing Rust. Flags outdated forms (lazy_static, structopt, manual async-trait where AFIT works).

Idiomatic, version-current TypeScript review and authoring for an experienced engineer. Covers type idioms the linter can't catch (satisfies vs as, discriminated unions, branded types, unknown over any, const objects over enums), boundary validation with zod (parse vs safeParse, infer), the modern strict tsconfig baseline, and the 2026 toolchain (TS 6/7 native port, Biome vs typescript-eslint, pnpm). Encodes this engineer's actual stack — Next.js, shadcn/ui, Tailwind, jotai, react-hook-form, zod, pnpm. Use when writing, reviewing, or refactoring TypeScript — .ts/.tsx files, tsconfig, type errors, zod schemas — or before committing TS. For Next.js/React App Router specifics, see the writing-next skill.

Idiomatic, version-current Zig review and authoring for an experienced engineer, pinned to Zig 0.15.2 (with 0.16.0 deltas flagged). Covers explicit allocator passing and choosing allocators, named error sets at API boundaries with try/errdefer, the post-Writergate std.Io.Reader/Writer interface, unmanaged std.ArrayList, sparse comptime, slices-over-pointers and tagged-union idioms, and the modern build.zig/build.zig.zon module API. Use when writing or reviewing Zig — .zig files, build.zig, build.zig.zon — or hitting a version break. Flags pre-0.14/0.15 forms (managed ArrayList, getStdOut().writer(), usingnamespace, async keywords, flat addExecutable, TitleCase @typeInfo tags).

Drive an Android emulator or USB-connected device reliably from the command line without guessing pixel coordinates. Reads the UI hierarchy (uiautomator) to tap elements by resource-id, text, content-desc, or index — bounds, screenshots, and `input tap` share one coordinate space, so taps land on target. Screenshots are used only to understand the screen; pixel taps are a documented fallback for screens with no accessibility tree. Use when automating, testing, or operating an Android app over adb, when a tap "lands in the wrong place", or when the user mentions adb, an emulator, a connected Android phone, uiautomator, or UI automation. Bundles a deterministic CLI (scripts/android_ctl.py) for shot/dump/tap/text/key/swipe.

Outline-and-story-first academic paper writing with hard anti-hallucination gates. Drafts a markdown bullet outline plus a first-time-reader story, reviews it with a context-isolated agent, then converts to LaTeX following a user-provided conference template. Verifies every citation against Crossref/DBLP/Semantic Scholar before it enters the paper, blocks invented jargon and fabricated numbers, and calls natural-writing for prose. Human in the loop with confirmation stops; not autonomous. English and Japanese. Use for 論文, conference submissions, related work, rebuttals, and research-based slides.

Adds a new application to NixOS or Home Manager configuration. Researches the package, determines the appropriate installation layer, implements it, and validates.

Synchronizes current GNOME dconf settings to declarative Nix Home Manager configuration. Dumps dconf, compares with existing config, and updates dconf-generated.nix.

Performs comprehensive cleanup of the Nix codebase. Detects anti-patterns, removes dead code, fixes inconsistencies, and validates.

Removes an application from NixOS or Home Manager configuration. Locates all references, assesses impact on shared modules, and safely removes.

Use when the user needs multi-source research with citation tracking, evidence persistence, and structured report generation. Triggers on "deep research", "comprehensive analysis", "research report", "compare X vs Y", "analyze trends", or "state of the art". Not for simple lookups, debugging, or questions answerable with 1-2 searches.

Initialize a Nix flake for any project to set up a reproducible development environment with nix develop. Use when a project needs flake.nix, devShell, or Nix-based development setup.