Probe a target website with Playwright, capture HAR traffic, and generate a complete buildable .NET API-wrapper project (typed client + PowerShell module + MCP server + tests + security gates). Companion to the dev-loop. Use when the user asks to 'wrap an API', 'generate a client from a website', or names a target site they want to automate.
Drive feature development with behavior-first tests via the Red -> Green -> Refactor cycle. Every behavior change ships with a test that fails for a behavioral reason when reverted. Spike clause permits deferred test-first for exploration if retro-fitted before merge. Language-aware: C#/xUnit, PowerShell/Pester, TypeScript/Vitest, and generic support.
Review and fix production and test code. Runs static analysis, reviews by severity (Critical/Important/Suggestions), and directly applies fixes. Use a different model than the authoring agent for independent perspective. Language-aware.
Verify that each dev loop phase completed correctly before proceeding to the next. Use between phases to enforce quality gates -- ensures tests pass, reviews are addressed, and no phases are skipped.
Produce a runtime artifact for every code change, then use an AI review loop to verify the artifact visibly confirms the change. Markdown for CLI/library/perf, HTML+video for UI. Hard gate -- phase cannot exit until review passes or escalation after 3 iterations.
Generate and maintain functional / integration / E2E tests that validate user-facing behavior. Explore first, test second. Verify before claiming success. Language-aware: C#/xUnit, PowerShell/Pester, TypeScript/Playwright, and generic support.
Identify and eliminate code duplication, improve design, and apply best practices after every green step. Simplicity is the primary goal -- never add behavior during refactoring. Language-aware.
AI-powered codebase security scanner that reasons about code like a security researcher -- tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.