ai-agent-workflows

Run a full audit of a GitHub user's personal repos. Inventories every repo, deep-analyzes each one for problem/goal/state/completion, clusters duplicates, drafts new READMEs for keeps, and emits PowerShell scripts that stage draft PRs and archives. Use when the user says "audit my GitHub", "audit my repos", "review my GitHub projects", "find duplicate repos", "consolidate my projects", "clean up my GitHub", "what should I archive", "deep-clean my repos", "I have too many incomplete projects", or otherwise describes wanting to triage a personal GitHub account with sprawl.

Draft a structured README for a single GitHub repo following a problem/goal/approach/features format. Use when the user says "draft a README for X", "regenerate the README for [repo]", "write a problem statement README", "give me a real README for this", "write a proper README", or wants README content for one specific repo (as opposed to a full multi-repo audit, which is the audit-repos skill). Pulls source-of-truth from the repo's own files — does not invent details.

Application security audit combining static analysis, STRIDE threat modeling, OWASP-aware code review, container/deployment review, and vulnerability intelligence from authoritative sources. USE FOR: security audit after implementation, threat modeling, OWASP compliance check, CVE intelligence gathering. DO NOT USE FOR: code quality review (use code-review), UI/UX review (use ui-ux-review), implementation (use impl-* skills).

Create architecture documents, design documents, and implementable task backlogs from an idea, feature, or system request. Produces system overview, component breakdown, deployment topology, API contracts, data model, ADRs, threat model, observability architecture, and backlog with acceptance criteria. USE FOR: architecture design, feature decomposition, backlog generation, system planning. DO NOT USE FOR: implementation (use impl-* skills), requirements clarification (use requirements-clarification), code review (use code-review).

Review a request, plan, PBI, ADR, architecture doc, proposal, or decision for hidden assumptions, unknowns, logical gaps, missing sections, stakeholder omissions, and risk. Produces severity-tagged findings with specific questions. USE FOR: reviewing plans, specs, proposals, design docs before work starts. DO NOT USE FOR: code review (use code-review), UI review (use ui-ux-review), turning vague requests into specs (use requirements-clarification).

Interrogate a product or business idea across problem-solution fit, target audience, market analysis, business model, and growth strategy. Produces a structured validation report with MVP definition and risk assessment. USE FOR: product idea validation, business model analysis, MVP scoping, market assessment. DO NOT USE FOR: technical architecture (use architecture-planning), requirements specification (use requirements-clarification), implementation (use impl-* skills).

Add or improve in-code documentation for public symbols using language-native formats (JSDoc, Python docstrings, C# XML docs, GoDoc, Javadoc, Rust doc comments). Produces IntelliSense-ready documentation with examples. USE FOR: documenting exported functions, classes, interfaces, types, modules. DO NOT USE FOR: non-code docs like README or config files (use docs-config-authoring), code review (use code-review), implementation (use impl-* skills).

Review changed code for completeness, correctness, conciseness, readability, regressions, missing tests, and standards compliance. Scores across four pillars and produces actionable findings with severity. USE FOR: code review after implementation, quality gate before merge, standards compliance check. DO NOT USE FOR: UI/UX design review (use ui-ux-review), security audit (use appsec-audit), requirements clarification (use requirements-clarification).

Analyze a project and create containerization assets: Dockerfiles, Docker Compose, dev containers, .devcontainer config, environment variable extraction, multi-stage builds, and deployment configurations. USE FOR: Docker setup, Docker Compose, dev containers, environment inventory, deployment config. DO NOT USE FOR: application code implementation (use impl-* skills), architecture planning (use architecture-planning), CI/CD pipeline design.

GraphQL schema design, resolver architecture, DataLoader batching, Relay-style pagination, auth patterns, federation, and query complexity management. USE FOR: GraphQL schema design, resolvers, N+1 problems, pagination, federation, query optimization. DO NOT USE FOR: SQL queries (data-sql), MongoDB queries (data-mongodb), Redis caching (data-redis), full backend implementation (impl-* skills).

MongoDB schema design, aggregation pipelines, index strategy, TTL indexes, explain plan analysis, and performance diagnosis for document databases. USE FOR: MongoDB queries, aggregation pipelines, schema design (embed vs reference), index strategy, performance tuning. DO NOT USE FOR: SQL queries (data-sql), GraphQL APIs (data-graphql), Redis caching (data-redis), full backend implementation (impl-* skills).

Redis data structures, caching patterns (cache-aside, write-through), rate limiting, distributed locks, pub/sub, key naming conventions, TTL strategy, and SLOWLOG/MEMORY performance diagnosis. USE FOR: Redis caching, data structures, rate limiting, distributed locks, pub/sub, session management, key schema design. DO NOT USE FOR: SQL queries (data-sql), GraphQL APIs (data-graphql), MongoDB queries (data-mongodb), full backend implementation (impl-* skills).

SQL query design, optimization, EXPLAIN analysis, index strategy, pagination, upserts, and N+1 prevention for relational databases (PostgreSQL, MySQL, SQL Server, SQLite, Oracle). USE FOR: SQL queries, schema review, performance tuning, index strategy, query optimization, EXPLAIN plan analysis. DO NOT USE FOR: GraphQL APIs (data-graphql), MongoDB queries (data-mongodb), Redis caching (data-redis), full backend implementation (impl-* skills).

Write or edit non-code documentation and configuration files: Markdown, YAML, JSON, TOML, INI, agent files, README, CONTRIBUTING, workflow docs, config schemas, .env templates. USE FOR: README, CONTRIBUTING, workflow docs, config files, agent definitions, non-code documentation. DO NOT USE FOR: in-code documentation like JSDoc/docstrings (use code-documentation), code review (use code-review), implementation (use impl-* skills).

Implement or refactor Angular frontend features. Covers standalone components, Signals, control flow, Angular Material theming, Tailwind integration, version migration, and Material-to-Tailwind style conversion. USE FOR: Angular feature implementation, version migration, Material theming, Tailwind conversion, component development with modern Angular patterns. DO NOT USE FOR: Next.js (use impl-nextjs), SvelteKit (use impl-sveltekit), generic React/Vue (use impl-typescript-frontend), backend (use impl-typescript-backend).

Implement or refactor C# / .NET backend code from a spec, task, or architecture document. Covers ASP.NET Core, Blazor, Entity Framework Core, and MediatR with full production standards inline (Serilog structured logging, EF Core connection management, health checks, Polly retry, seeding, graceful shutdown, config validation). USE FOR: C# spec-to-code, .NET refactoring, production-hardening ASP.NET Core services, Blazor, EF Core data access. DO NOT USE FOR: frontend UI (use impl-nextjs, impl-sveltekit, impl-angular, impl-typescript-frontend), other languages (use impl-python, impl-typescript-backend, impl-rust, impl-go, impl-java).

Implement or refactor Go backend code from a spec, task, or architecture document. Covers net/http, Gin, Fiber, Echo, and GORM with full production standards inline (slog/zerolog structured logging, database/sql connection pooling, health endpoints, retry with backoff, seeding, graceful shutdown, config validation). USE FOR: Go spec-to-code, refactoring, production-hardening Go services, Gin/Fiber/Echo web backends, GORM/sqlx data access. DO NOT USE FOR: frontend UI (use impl-nextjs, impl-sveltekit, impl-angular, impl-typescript-frontend), other languages (use impl-python, impl-typescript-backend, impl-csharp, impl-rust, impl-java).

Implement or refactor Java backend code from a spec, task, or architecture document. Covers Spring Boot, Jakarta EE, Maven, and Gradle with full production standards inline (SLF4J/Logback structured logging, HikariCP connection pooling, Spring Actuator health endpoints, Spring Retry, seeding, graceful shutdown, config validation). USE FOR: Java spec-to-code, refactoring, production-hardening Spring Boot services, Jakarta EE backends, JPA/Spring Data repositories. DO NOT USE FOR: frontend UI (use impl-nextjs, impl-sveltekit, impl-angular, impl-typescript-frontend), other languages (use impl-python, impl-typescript-backend, impl-csharp, impl-rust, impl-go).

Implement or refactor Next.js frontend features with Tailwind and Skeleton UI. Covers App Router, Server Components, Server Actions, Skeleton themes and components, layout patterns, and theme token compliance. USE FOR: Next.js + Skeleton UI setup, feature implementation, theming, component development with App Router patterns. DO NOT USE FOR: SvelteKit (use impl-sveltekit), Angular (use impl-angular), generic React/Vue (use impl-typescript-frontend), backend (use impl-typescript-backend).

Implement or refactor Python backend code from a spec, task, or architecture document. Covers Django, FastAPI, Flask, and Celery with full production standards inline (structured logging, DB connection management, health endpoints, retry logic, seeding, graceful shutdown, config validation). USE FOR: Python spec-to-code, refactoring, backend feature implementation, production-hardening Python services. DO NOT USE FOR: frontend UI work (use impl-nextjs, impl-sveltekit, impl-angular, or impl-typescript-frontend), routing decisions (use implementation-routing), architecture planning (use architecture-planning), other languages (use impl-typescript-backend, impl-csharp, impl-rust, impl-go, impl-java).

Implement or refactor Rust backend code from a spec, task, or architecture document. Covers Actix, Axum, Rocket, and tokio with full production standards inline (tracing structured logging, sqlx connection management, health endpoints, tokio-retry, seeding, graceful shutdown, config validation with envy). USE FOR: Rust spec-to-code, refactoring, production-hardening Rust services, Actix/Axum/Rocket web backends. DO NOT USE FOR: frontend UI (use impl-nextjs, impl-sveltekit, impl-angular, impl-typescript-frontend), other languages (use impl-python, impl-typescript-backend, impl-csharp, impl-go, impl-java).

Implement or refactor SvelteKit frontend features with Tailwind and Skeleton UI. Covers file-based routing, load functions, form actions, SSR/CSR, Skeleton Svelte components and themes, and layout patterns. USE FOR: SvelteKit + Skeleton UI setup, feature implementation, theming, component development with SvelteKit patterns. DO NOT USE FOR: Next.js (use impl-nextjs), Angular (use impl-angular), generic React/Vue (use impl-typescript-frontend), backend (use impl-typescript-backend).

Implement or refactor TypeScript/Node.js backend code from a spec, task, or architecture document. Covers NestJS (preferred), Fastify, and Express with full production standards inline (structured logging with pino, DB connection lifecycle, health endpoints, retry logic, seeding, graceful shutdown, config validation). USE FOR: TypeScript backend spec-to-code, refactoring, production-hardening Node.js services, NestJS/Fastify/Express backend work. DO NOT USE FOR: frontend UI (use impl-nextjs, impl-sveltekit, impl-angular, impl-typescript-frontend), routing decisions (use implementation-routing), architecture planning (use architecture-planning), other languages (use impl-python, impl-csharp, impl-rust, impl-go, impl-java).

Implement or refactor TypeScript frontend features for React, Vue, Nuxt, and general client-side work. Covers components, hooks, stores, routing, data fetching, state management, accessibility, and required UI states (loading, error, empty, populated). USE FOR: React, Vue, Nuxt frontend implementation, component development, client-side state management, generic TypeScript frontend work. DO NOT USE FOR: Next.js + Skeleton (use impl-nextjs), SvelteKit + Skeleton (use impl-sveltekit), Angular (use impl-angular), backend (use impl-typescript-backend).

Route TypeScript and mixed-scope implementation tasks to the correct specialist skill or agent. Classifies backend vs frontend vs full-stack scope, identifies framework, and delegates to the right implementer. USE FOR: routing mixed TypeScript work, splitting full-stack tasks, choosing between frontend framework specialists. DO NOT USE FOR: actual implementation (use impl-* skills), architecture (use architecture-planning), requirements (use requirements-clarification).

Produce a structured implementation specification before coding begins. Takes refined PBIs and architecture context and produces delta specs (ADDED/MODIFIED/REMOVED requirements with WHEN/THEN scenarios), design decisions (rationale and trade-offs), and a numbered task breakdown the implementer works through. USE FOR: bridging PBI clarification to implementation, producing testable specs, creating implementation task breakdowns. DO NOT USE FOR: requirements clarification (use requirements-clarification), architecture planning (use architecture-planning), actual implementation (use impl-* skills).

Turn a vague feature request, user story, backlog item, or PBI into a precise specification with functional AC (Given/When/Then), technical AC, test criteria, implementation steps, and explicit out-of-scope boundary. USE FOR: PBI clarification, user story refinement, spec writing from vague requirements. DO NOT USE FOR: assumption review (use assumption-review), architecture planning (use architecture-planning), implementation (use impl-* skills).

Reverse engineer an existing codebase into a complete, reconstruction-ready specification. Produces stable artifacts: system overview, architecture, features and rules, APIs, data model, diagrams, environment/config, technology analysis, improvements, and assumptions. USE FOR: understanding unfamiliar codebases, producing system documentation, reconstruction-ready specs for legacy systems. DO NOT USE FOR: implementation (use impl-* skills), architecture planning for new systems (use architecture-planning), code review (use code-review).

Backend unit and integration testing for controllers, services, repositories, middleware, and server-side logic. Covers test generation, mocking strategies, database mocking, external API mocking, and coverage expectations across Node.js, Python, C#, Go, and Java. USE FOR: backend unit tests, integration tests, API endpoint tests, service tests, repository tests, middleware tests. DO NOT USE FOR: frontend component tests (test-frontend-unit), E2E/UI tests (test-e2e-ui), Playwright BDD scenarios (test-e2e-ui).

End-to-end and UI testing with Playwright BDD (Gherkin/Cucumber), visual regression via screenshot comparison, and user workflow verification for modern web applications. USE FOR: end-to-end tests, Playwright BDD scenarios, visual regression testing, user flow testing, acceptance tests. DO NOT USE FOR: backend unit tests (test-backend-unit), frontend component tests (test-frontend-unit).

Frontend unit and component testing for React, Vue, Svelte, Angular, and similar frameworks. Covers component rendering, props, events, hooks, composables, stores, utilities, mocking, and snapshot/visual testing. USE FOR: component tests, hook tests, store tests, utility tests, client-side routing tests, API client mocking. DO NOT USE FOR: backend unit tests (test-backend-unit), E2E/UI tests (test-e2e-ui), Playwright BDD scenarios (test-e2e-ui).

Review frontend code for design-system compliance and UX quality. Covers theme-token compliance, hardcoded color detection, accessibility audit, visual hierarchy, spacing consistency, feedback states, and responsive behavior. USE FOR: UI/UX quality gate after frontend implementation, theme compliance check, accessibility review. DO NOT USE FOR: code review (use code-review), security audit (use appsec-audit), implementation (use impl-* skills).

Generate or skip a user-facing wiki update artifact after a completed task. Applies deterministic eligibility rules, host-scope checks, and produces PR-ready documentation including changelog entries and how-to guides. USE FOR: post-task wiki/docs generation, changelog entries, user-facing documentation updates. DO NOT USE FOR: in-code documentation (use code-documentation), non-code config docs (use docs-config-authoring), code review (use code-review).