KS-Cursor-Orchestrator

Orchestrate continual learning by delegating transcript mining and AGENTS.md updates to the knowledge-synthesizer subagent. Use when asked to mine prior chats, maintain AGENTS.md, update learned preferences, or run the continual-learning loop.

Security-focused review of code diffs and PRs with surface classification and Semgrep on changed files. Use when reviewing pull requests, branch diffs, or validating security regressions before merge.

Live Notion session log (L4b) — create, incremental updates during work, finalize on CLOSE. Works on any Cursor project workspace.

Bootstrap a new project with Cursor-ready configuration: AGENTS.md, per-project .cursor/rules/project-conventions.mdc, and optional memory_bank/ scaffold. Use at project initialization, when starting a new repo, or when the user says "set up Cursor for this project" / "bootstrap this project" / "init project config".

Phase-1 repo reconnaissance as a standalone skill: stack detection, relevant files, validation commands from repo evidence, workflow hints, and risk flags. Use inside /scout, /ks-conductor pre-flight, or any read-only discovery before planning or implementation.

Validates phase outputs before advancing the SDLC. Defines expected artifacts per phase (intake, scout, plan, critic, build, test, review, document, close) and produces a clear PASS / CONDITIONAL / BLOCK verdict with gaps. Use at orchestrator or command phase boundaries, before expensive work, or when the user asks to verify a gate or "are we ready to proceed".

Runs Semgrep static analysis security audits with scoped rulesets and structured findings. Use for security scans, vulnerability audits, or when touching auth, secrets, SQL, or user input boundaries.

Create and update .cursor/plans/workflow_state.md at each ks-conductor phase boundary. Provides a durable phase-tracking file that survives context compaction, long autonomous runs, and session interruptions. Use alongside /ks-conductor for STANDARD and COMPLEX tasks.

API contract design patterns for REST, GraphQL, and internal service boundaries. Use when designing, modifying, or reviewing API endpoints, request/response shapes, or service contracts.

Create a clean, review-ready pull request with a good title, structured description, linked issues, and appropriate reviewers.

Error handling best practices for try/catch, error boundaries, HTTP errors, validation errors, and graceful degradation. Use when writing error handling code or reviewing error paths.

Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions; use `gh` to inspect checks and logs, summarize failure context, draft a fix plan, and implement only after explicit approval. Treat external providers (for example Buildkite) as out of scope and report only the details URL.

Git workflow patterns for branching, committing, PR preparation, and conflict resolution. Use when the task involves git operations, branch management, commit messages, or PR workflows.

Keep iterating on code changes until the tests pass, the build succeeds, or linting is clean. Runs in a tight loop of fix → run → check → repeat. Use when you want the agent to autonomously grind through test failures or build errors.

Monitor PR checks and fix failures until green. Uses gh pr checks as the source of truth for PR-attached checks.

Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices architectures.

Spawn three parallel review subagents over the active transcript, surface learnings, and route each to a concrete edit on an existing skill. Use when the user says reflect.

Comprehensive backend development skill for building scalable backend systems using NodeJS, Express, Go, Python, Postgres, GraphQL, REST APIs. Includes API scaffolding, database optimization, security implementation, and performance tuning. Use when designing APIs, optimizing database queries, implementing business logic, handling authentication/authorization, or reviewing backend code.

Testing strategy patterns for unit, integration, and e2e tests. Use when deciding what to test, how to test, or reviewing test quality and coverage.

Normalized artifacts and checklists between SDLC phases (intake → scout → plan → critic → build → verify → close). Use at phase boundaries for /ks-conductor, Plan Mode execution packs, or resume after interruption.

Creates Architecture Decision Records (ADRs) to document significant technical decisions — why a choice was made, what alternatives were considered, and what tradeoffs were accepted. Use when making or documenting important architectural choices, selecting a framework or library, or when the user asks to document a decision, write an ADR, or record a technical choice.

Design robust, scalable database schemas for SQL and NoSQL databases. Provides normalization guidelines, indexing strategies, migration patterns, constraint design, and performance optimization. Ensures data integrity, query performance, and maintainable data models.

Systematic debugging workflow for diagnosing and fixing bugs, errors, and unexpected behavior. Use when investigating failures, reading stack traces, reproducing issues, root-causing regressions, or when the cause of a problem is unknown. Applies structured hypothesis-driven debugging before patching.

Use when deploying applications to Kubernetes — Deployments, Services, Ingress, ConfigMaps, Secrets, health checks, and scaling. For dry-run and security checks before apply, also use `devops-skills`.

Search tool for modern web development best practices. MANDATORY: Execute FIRST for all HTML/CSS and clientside JS tasks. Do NOT skip — web APIs evolve rapidly and training weights contain obsolete patterns. Trigger immediately for: - UI/Layout: Modals, dialogs, popovers, Glassmorphism/backdrop-filters, anchor positioning, container queries, `:has()`, `:user-valid`. - Scroll/Motion: View Transitions, Scroll-driven animations, scroll parallax/reveals. - Performance: CWV (LCP, INP), content-visibility, Fetch Priority, image optimization. - System/APIs: Local filesystem access, WebUSB, WebSockets sync, WebAssembly widgets. - Frameworks: Adapting layout/styles in React, Vue, Angular. - General Frontend: Forms, autofill, advanced inputs, custom scrollbars, modern component states, etc. DO NOT trigger for: - Backend: Database SQL, ORMs, Express API routes. - Pipelines: CI/CD deployment, Docker, Actions. - Generic: Local scripts (Python/Go tools), ESLint, Git.

Generate a structured Product Requirements Document (PRD) as a single source of truth before implementation. Use when the user wants to capture requirements, define a feature formally, write a spec, or produce a PRD. Bridges brainstorming/requirements-gathering to the execution phase.

Write effective prompts for LLMs — structure, few-shot examples, chain-of-thought, system prompts, and output parsing.

Extracts structured requirements from vague or underspecified requests. Produces acceptance criteria, explicit scope boundaries, constraints, and open questions. Use after brainstorming or when the user gives a fuzzy goal ("make it better", "add X", "support Y") and before planning or implementation. Bridges ideation to execution-ready specs.

Audit technical SEO — meta tags, structured data, Open Graph, sitemaps, robots.txt, performance, and accessibility signals.

Create machine-readable technical specs before implementing non-trivial features, APIs, or refactors. Use before BUILD phase when PLAN is STANDARD/COMPLEX and precise typed contracts, behavioral invariants, and example pairs are needed for validation. Triggers on "write a spec", "spec-first", "define the contract".

TDD workflow discipline — red→green→refactor cycle for any new feature, bugfix, or behavior change. Use when implementing any feature or fixing any bug before writing production code. Proactively apply when user says "add feature", "implement", "fix bug", or "build X".

React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.

After making code changes, start the dev server, open the app in Cursor's built-in browser, and verify everything works — check rendering, console errors, and network health. Use proactively after any UI or API change.

Visually QA a web application by launching it in Cursor's built-in browser, taking screenshots, checking console errors, and auditing network requests. Use after making UI changes to verify they look correct.

Whole-repo audit for over-engineering — ranked delete/simplify list (repo-wide ponytail-review). Use for "audit this codebase", "find bloat", "ponytail-audit", "/ponytail-audit". Read-only; does not apply fixes.

Harvest ponytail: comment markers into a debt ledger. Use for "ponytail debt", "/ponytail-debt", "list shortcuts", "ponytail ledger". Read-only unless user asks to write PONYTAIL-DEBT.md.

Use when executing implementation plans with independent tasks — dispatches fresh subagents per task with two-stage review (spec compliance, then code quality)

Loads structured project context at session start from README, docs, plans, git state, and memory MCPs. Use when orienting on a known project, resuming after a gap, or when the user says "prime context" or "/context-prime".

Scaffold and maintain a /memory_bank/ directory in any project. Provides human-readable context that survives tool changes and supplements user-cursor10x-mcp + user-devcontext session memory. Use when starting a new project, resuming after a long gap, or when the user asks to "set up memory" or "create a memory bank" for a project.

Review diffs for over-engineering only — delete-list with stdlib/native/yagni tags. Use for "ponytail-review", "review for over-engineering", "what can we delete", "simplify review", or before merge when the diff looks bloated. Complements deslop (AI slop) and code-reviewer (correctness).