afu-it

Set up, build, debug, review, and explain 2C2P payment integrations using official 2C2P docs, PGW v4.3/v4.5 Payment Token API with JWT HS256, hosted redirect checkout, Direct API Do Payment, Secure Pay JS, Drop-In UI, backend notifications, Payment Inquiry,…

Set up, build, debug, review, and explain Adyen payment integrations using official Adyen docs, Checkout API v72 (/sessions, /paymentMethods, /payments, /payments/details), Hosted Checkout, Web Drop-in and Components, HMAC-SHA256 signed webhooks, captures,…

Set up, build, debug, review, and explain AffanPay payment integrations using official AffanPay API docs, Bearer API tokens, Create Bill, hosted bill payment page redirect, callback_url webhooks, X-AFFANPAY-HMAC HMAC-SHA256 signatures with…

Set up, build, debug, review, and explain AhaPay payment integrations using official AhaPay docs, External API V2 (and legacy V1), X-ApiKey auth, Create Default Order hosted checkout, POS and QR POS orders, online_order_payment_link redirect, callback_url…

Set up, build, debug, review, and explain Airwallex online payment integrations for Malaysian merchants using official Airwallex docs, Payment Intents API, Hosted Payment Page, Checkout Sessions, Drop-in and Embedded Elements (Airwallex.js), Native API, FPX,…

Set up, build, debug, review, and explain Antom payment integrations using official Antom docs, One-time Payments pay and createPaymentSession APIs, hosted and embedded Checkout Page, Payment Element, API-only redirects, RSA256 request signing and response or…

Set up, build, debug, review, and explain AsiaPay (PayDollar) Malaysia payment integrations using official AsiaPay developer docs, Client Post Through Browser (payForm.jsp hosted page), Direct Client Side and Server Side Direct Connection (payComp.jsp),…

Set up, build, debug, review, and explain Atome Buy Now Pay Later (BNPL) payment integrations using official Atome Open API v2 docs, HTTP Basic auth, create payment, redirectUrl and appPaymentUrl checkout, server-to-server callbacks, X-Signature HMAC-SHA256…

Enterprise-grade access control patterns to prevent broken access control, IDOR, tenant data leaks, privilege escalation, and admin route exposure. Covers RBAC, ABAC, ownership checks, multi-tenant scoping, policy middleware, row-level security, and audit…

Add structured audit logging with immutable R2 storage to Cloudflare Workers. Creates a typed audit utility, instruments all API routes, deploys a tail worker for persistent log storage, and configures R2 bucket lock for tamper-resistance. Use when adding…

Harden authentication systems against session fixation, brute-force attacks, and weak password storage. Covers bcrypt/argon2 hashing, JWT best practices, session management, and account lockout. Use when implementing login, fixing auth vulnerabilities, or…

Add CodeQL SAST, Gitleaks secret scanning, and dependency audit to any CI/CD pipeline. Blocks deployment if vulnerabilities or secrets are detected. Covers GitHub Actions, GitLab CI, and generic pipelines. Use when setting up CI security, adding SAST,…

Configure CORS correctly to prevent credential leaks and unauthorized cross-origin access. Covers Express, Next.js, Cloudflare Workers, Laravel, and FastAPI. Use when setting up CORS, fixing preflight errors, or auditing cross-origin policies.

Encrypt personal data at rest and in transit to comply with PDPA 2024. Covers field-level encryption for PII, AES-256-GCM patterns, key management, and database column encryption for Node.js, Python, Laravel, and Cloudflare Workers. Use when storing sensitive…

Detect typosquatting, malicious packages, and lockfile tampering in npm, pip, and composer dependencies. Covers lockfile integrity verification, known-malicious package detection, and supply chain attack prevention. Use when auditing dependencies,…

Prevent information leakage through error messages. Covers sanitized error responses, structured error handling, no stack traces in production, and safe logging patterns for Express, Next.js, Cloudflare Workers, Laravel, and FastAPI. Use when fixing verbose…

Use when asked to run a full repo hygiene pass, full cleanup, or to maintain a repo in one go — and whenever the user invokes /safe-code or any wrapper of it (/skill:safe-code, /skills safe-code, $safe-code, @safe-code, or bare safe-code), including…

Build or update the codegraph code index for the current repository. Use before safe-code audits, refactors, reviews, debugging, or when the index may be stale.

Scan an entire codebase to detect and safely remove dead code such as unused functions, orphaned modules, unreferenced exports, stale configs, dead routes, and leftover workflow artifacts. Use when asked to clean up dead code, remove unused code, prune stale…

Systematically debug a symptom with a red-capable feedback loop, a minimised repro, ranked falsifiable hypotheses, tagged probes, and a regression test at the correct seam. Graph tools accelerate the search when present; they are never required.

Navigate and understand codebase structure using the codegraph index. Use for repo orientation, AGENTS.md authoring, architecture mapping, or finding relevant code.

Review working-tree, branch, or PR changes on two separate axes — Standards (repo conventions + a smell baseline) and Spec (does it do what the active feature spec asked) — with blast-radius and test-coverage checks. Graph tools accelerate when present; never…

Refactor code safely in small verified slices while keeping repo continuity docs in sync. Uses the codegraph index for callers, impact radius, and affected tests when available. Use when an agent is asked to refactor, restructure, clean up, remove or replace…

Senior engineer discipline layer for any coding task. Use when asked to make an AI agent think like a senior/master developer, improve strategy, create task lists, measure twice cut once, keep repositories clean, avoid overengineering, critique strategy…

Use when the user asks to generate or edit images (e.g., generate image, edit/inpaint/mask, background removal, transparent background, product shots, concept art, covers, or batch variants). Runs built-in image_generation_call first, then falls back to…

Create images on Codex, especially with 9Router (e.g., generate image, edit/inpaint/mask, background removal, transparent background, product shots, concept art, covers, or batch variants). Auto-patches ~/.codex/config.toml if needed. Uses built-in image…

redesign existing user interfaces, screenshots, dashboard cards, app screens, and product components into polished modern visuals. use when the user asks to redesign, improve, modernize, premiumize, clean up, or generate a better version of an existing ui.…

Sahkan ejaan Bahasa Melayu dan Jawi terhadap PRPM Dewan Bahasa dan Pustaka sebelum menghantar output. Guna apabila menulis, menyemak, atau mentransliterasi teks BM/Jawi, terutama bahan pendidikan, RPH, nota, atau apa-apa yang perlu ikut ejaan rasmi DBP.…

Repair 9Router Docker CLI tool detection by binding host home into the container and creating real symlinks from /home/node config paths to /home/user config paths. Use when 9Router is run via Docker and /dashboard/cli-tools shows Claude, Codex, OpenCode,…