skillfoo

Threat-models a system, feature, or attack surface from first principles — assets, actors, and the paths from untrusted input to consequential action — then ranks risks and recommends controls worst-first, pushing each catastrophic outcome toward impossible-by-construction. Strongest where a failure is hard to reverse: moving money or value, handling keys/secrets, granting access, taking autonomous/agent actions, deleting or publishing. Use when designing something sensitive, evaluating a new attack surface, hardening a consequential flow, or asked "what could go wrong and who could cause it."

Vertical-slice planning pipeline that turns rough requirements into slice-local discovery, decisions, UAT, PRD, follow-ups, and a bootstrap prompt before implementation. Use when starting feature work, shaping a vertical slice, converting rough requirements into acceptance criteria, or preparing a fresh-context agent to implement from durable artifacts.

Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.

Write a human-readable PR title and description from the final diff (never from the conversation), open or update the pull request, and triage review feedback into address / defer / dismiss. Use when opening a PR, shipping a branch, tightening a PR title or description, or responding to review comments from humans or bots.

Create a PRD through user interview, codebase exploration, and module design, then output as a markdown file. Use when user wants to write a PRD, create a product requirements document, plan a new feature, or scope out work before implementation. Triggers on "write a prd", "create a prd", "let's plan this feature", "scope this out", "product requirements", or any request to formalize feature planning into a document.

Review a branch, pull request, commit range, working-tree diff, or selected files for correctness, architecture, security, performance, maintainability, and testing risks. Use when asked for a code review, final review, merge-readiness check, quality pass, risk assessment, or "anything else before merge?". Report findings without implementing fixes.

Build, migrate, or review reliable Node.js command-line applications in TypeScript. Use when creating a CLI, converting a JavaScript CLI to TypeScript, choosing a parser/build/test stack, designing flags and output, hardening subprocess or filesystem behavior, packaging an npm executable, or checking a CLI for release readiness and cross-platform automation safety.

Create concise, executable manual user-acceptance test plans from requirements, planning artifacts, a diff, branch, pull request, or working implementation. Use when asked for UAT, a manual QA script, demo validation, smoke testing, acceptance testing, or "how should I test this?". Focus on observable user behavior, durable side effects, guardrails, environment setup, and one demo-ready pass criterion.