x-skills

Use when the user provides an OpenAPI or Swagger spec and asks to find security issues, pentest the API, audit endpoints for OWASP API Top 10, or check for BOLA, BFLA, mass assignment, injection, or SSRF vulnerabilities in a running HTTP API

Use when the user wants to capture a brainstormed idea, feature, or solution into a durable backlog/spec doc under docs/backlog — a human-facing reference that combines context, chosen solution, key decisions (ADR-lite), scope, acceptance criteria, and optional feature/integration/contract/use-case/handoff modules. Drafts the whole doc autonomously from the current conversation and persists docs/backlog/<slug>.md; asks the user only when blocked or a decision genuinely needs their input. NOT a low-level implementation plan (that is superpowers:writing-plans / x-do).

Use when the user reports a bug, error, test failure, or unexpected behavior — routes through investigation, hypothesis testing, and verified fix with structured evidence collection

Use when the user wants to apply a visual design system to a project, references a specific brand's style (Linear-like, Stripe-like, Claude-like), asks for a DESIGN.md, or describes aesthetic intent (warm editorial, dark minimal, stark futuristic) for AI UI generation

Use when the user asks to build, implement, fix, or execute a plan — detects context (existing plan, new feature, bug, quick task, visual input) and routes through brainstorming, planning, debugging, or execution workflows

Use when the user wants a complex input (file, function, directory, PRD, plan, spec, URL, pasted prose, or vague feature name) explained step by step in a comprehension-gated walkthrough — produces a persistent .x-guide/<slug>/GUIDE.md with full TOC and walks the user one part at a time, supports resume across sessions

Use BEFORE implementation when AI has produced a plan, spec, design doc, PRD, or code-bearing proposal and you want a senior-engineer architect-review pass — walks the user through the decisions, tradeoffs, assumptions, blind spots, shape mismatches, and future-debt AI silently embedded. Surfaces "what AI did, what it picked over alternatives, what it took on, and what gets harder later" one item at a time with confirm / modify / reject / skip gates. Hard-blocks code-level details so the human stays at architectural direction.

Use when the user wants end-to-end QA testing for a feature, branch, or PR — scans the project for entry points, generates a TEST_PLAN.md with edge cases, launches the service in an isolated container, and dispatches test runners (cheap agy for simple HTTP cases, claude for complex flows). Profile-driven: `init` once, then `run` repeatedly.

Use when the user asks to research, investigate, look up, or understand something — orchestrates MCP servers (perplexity/exa/deepwiki/context7), agy-agent, and OMO agents (explore/librarian/oracle/multimodal-looker) with optional Max Mode for parallel multi-lane synthesis

Use when the user asks to review code, a plan, a PR, or a directory — auto-detects target, runs cross-model review (Claude + GPT + Gemini-3-pro). Reports bugs, security issues, false assumptions, and plan deviations only; refactor/perf/restructure are opt-in passes

Use when the user wants to evaluate x-skill alignment and improve a skill based on real session usage — searches Claude Code session history automatically

Use when the user asks for parallel team-style execution of multiple features in one project — orchestrates a team lead + N dev workers, one feature per worktree, each gated on x-qa E2E tests, with blocker escalation to human via SendMessage. Hard requires `plugin.omc` (TeamCreate/SendMessage primitives) and `.x-skills/x-qa/profile.json` (E2E gate).

Use when the user (or a sibling skill via --wt flag) wants to spin up an isolated git worktree for a task — wraps the worktrunk `wt` CLI when present, falls back to native `git worktree`, switches the Bash session cwd into the new worktree, auto-applies docker isolation when profile present (skip with --no-isolate), and emits a machine-readable result envelope

Direct Google Gemini bridge via the Antigravity (agy) CLI — uses Google Ultra subscription (no API key), opt-in Google Search grounding (via `--grounded`), and gemini-3.x models without the OpenCode layer

Use when the user runs multiple git worktrees of the same repo in parallel and hits docker-compose container_name / port / volume collisions OR has stateful singletons (Slack/Discord bots, schedulers, webhook receivers, host crontabs) that must not run concurrently across worktrees. Singleton-aware in v0.2. Wraps inspector + override emitter + worktrunk hook.

Use when the user wants to vendor or track an upstream GitHub repo as a research reference inside the current project — adds, updates, lists, or removes `research/<owner>/<repo>` git submodules pinned to the latest stable release (not main/HEAD). Invoked for upstream code reference, dependency mirroring, or research material management.

Use when user asks for non-Claude model dispatch (GPT-5, Gemini, Codex, o3) or invokes OMO agents (oracle, explore, librarian, multimodal-looker) — bridges Claude Code to OpenCode CLI, handles agent catalog, model routing flags, and prompt-block construction

Use when a long-running skill needs to check "am I done?" — runs the canonical completion cascade with mandatory fallback to prevent silent success claims