Create a structured feature specification with self-contained task files organized into parallel execution waves. Use this skill when the user says "create a spec", "plan this feature", "write up an implementation plan", "break this into tasks", or after any planning conversation where the user wants to capture decisions as actionable spec files. Also use when the user says "/create-spec" or wants to decompose a feature into work items that agents can implement independently. This skill produces local spec files under specs/{feature}/ — no GitHub integration.
Scaffold and fully configure a new Agentic Coding Starter Kit project — a Next.js 16 + TypeScript + Better Auth + Drizzle + PostgreSQL + AI SDK boilerplate. Use this skill whenever the user asks to set up, scaffold, create, initialize, or bootstrap an "agentic coding starter kit", "agentic app", "agentic boilerplate", a "Next.js app with auth and db", or mentions `create-agentic-app` / `npx create-agentic-app`. Walks the user through folder strategy, package-manager choice, Postgres setup (Docker / Neon / Vercel / BYO), OpenRouter AI configuration, migrations, a build check, and dev-server verification — ending with a working http://localhost:3000.
Create a comprehensive checkpoint commit with detailed analysis of all changes. Use this skill when the user says "checkpoint", "commit everything", "save my progress", "create a commit", or wants to stage and commit all current changes with a well-crafted message. Also use when the user says "/checkpoint" or asks to snapshot current work. This skill stages all changes and creates a descriptive commit — it does not push.
Push the current branch to GitHub and create a pull request. Use this skill when the user says "ship it", "ship this", "push to github", "create a pr", "open a pull request", "send for review", "get this reviewed", or wants to push their work and open a PR. Also use when the user says "/ship-it". This skill handles prerequisites, branching, pushing, and PR creation — it does not commit or run quality checks (use checkpoint for that first).
Performs comprehensive OWASP Top 10:2025 security vulnerability analysis on any codebase. Use this skill whenever the user asks to: review code for security, perform a security audit, scan for vulnerabilities, find security issues, improve application security, check for OWASP compliance, do a penetration test review, assess security posture, look for security flaws, scan for security risks, harden an application, or check code for exploits. Also trigger when the user mentions OWASP, CVEs, CWEs, security hardening, vulnerability assessment, or asks for a security report — even if they don't explicitly say "security scan." This skill works on any codebase in any language (JavaScript, TypeScript, Python, Java, Go, Ruby, C#, PHP, etc.).
Orchestrate parallel implementation of a feature specification by dispatching coder agents wave-by-wave with code review gates between waves. Use this skill when the user says "implement this feature", "start implementing", "run the spec", "execute the plan", "continue implementing", or wants to begin coding a previously planned feature from a specs/{feature}/ folder. Also use when the user says "/implement-feature" or drags a spec folder into the conversation and asks to implement it. This skill does NOT write code itself — it orchestrates coder subagents that work in parallel.
Review pull requests with complexity-adaptive depth — spawning deep-dive agents for medium and complex PRs. Use this skill when the user says "review this PR", "review PR #123", "check this pull request", "give me a code review", or wants feedback on a PR before merging. Also use when the user says "/review-pr" or pastes a GitHub PR URL. Requires the GitHub CLI (gh).