cogine-dev-skillset

Use when a site under review requires authentication and you need to import cookies from a real browser session into your local browser automation helper. Trigger on "get-cookies", cookie import, browser session reuse, authenticated QA, or protected pages behind login.

Use when auditing AI applications, LLM features, agent workflows, RAG systems, tool-calling code, prompt pipelines, model output handling, AI API keys, cost controls, or skill/agent supply-chain risks.

Use when turning vague product requests, founder notes, GitHub issues, roadmap bullets, bug reports, or feature ideas into backlog-ready specs or executable GitHub issues.

Use when auditing a live or implemented developer experience for APIs, CLIs, SDKs, MCP servers, plugins, integration guides, getting-started docs, or developer onboarding flows.

Use when evaluating early product ideas, founder decisions, AI application concepts, wedge markets, target users, product scope, or design handoff before writing specs or architecture.

Use when reviewing a plan or spec for developer-facing API, CLI, SDK, MCP, plugin, integration guide, getting-started documentation, or developer onboarding design before implementation.

Use when reviewing a plan from a founder or product-ceo perspective and you need to challenge premises, choose scope expansion vs hold vs reduction, and push for the best product outcome.

Use when reviewing an execution plan and you need engineering scrutiny across architecture, data flow, diagrams, edge cases, test coverage, and performance.

Use when discussing early product ideas, AI or Agent product directions, market observations, MVP scope, wedge markets, non-consensus opportunities, or when the user wants direct red-team critique before architecture.

Use when the user asks to triage GitHub issues, prioritize backlog work, verify issue readiness or staleness, or generate delegation-ready issue briefs for coding agents.

Use when the user asks for a report-only browser QA pass on a web application, live site, preview URL, authenticated app flow, or release candidate without making code changes.

Use when the user explicitly asks for a deep local code review, PR review, bug hunt, pre-merge review, or Ultra Review style review with high confidence findings.

Create and run a post-PR review loop for a ready-for-review GitHub pull request. Use when the user asks Codex or Claude Code to watch, loop on, monitor, periodically check, or automatically handle PR review feedback after a PR has been opened. In Codex, the default behavior is to create a 10-minute heartbeat automation first, not to perform an ordinary one-off fix; only execute the review/fix iteration when the skill is invoked by that automation or the user explicitly asks for one immediate pass.

Route image generation to the local image2-with-codex HTTP service at http://127.0.0.1:4312, which delegates to the user's Codex CLI. Use only when the user explicitly asks for this route. Default behavior is raw prompt pass-through; do not substitute HTML layout, infographic tooling, or other image tools.

Systematic root-cause debugging. Use when: diagnosing bugs, investigating failures, debugging flaky tests, tracing unexpected behavior. Triggers on: '/investigate', 'debug this', 'why is this failing', 'find the root cause', 'flaky test'.

Independent second-opinion code review using Codex CLI. Use when: wanting an external AI reviewer's perspective, cross-validating before push, getting a second pair of eyes. Triggers on: '/peer-review', 'codex review', 'second opinion', 'peer review my changes'.

Research → Plan → Code workflow. Enforces evidence-based reasoning, codebase research, and structured planning before code modifications. Applied automatically for moderate+ tasks.

Use when releasing a Node.js package to npm, or when asked to verify release readiness, run prepublish checks, publish a new version, create/push git tags, create a GitHub Release, or close release-related issues/epics. Best for repo-agnostic npm package release work where the package is defined by package.json and the exact release checklist must be executed safely.

Use when writing, reviewing, or optimizing Supabase or Postgres queries, schema designs, indexes, row-level security policies, or database configuration for performance and correctness.

Use when exporting, importing, packaging, cloning, restoring, or moving an OpenClaw agent between machines or instances, especially when the user mentions clawpacker, .ocpkg packages, agent portability, or reusable agent templates.

Use when the user explicitly requests security best practices guidance, a security review or report, or secure-by-default coding help for Python, JavaScript or TypeScript, or Go code.

Use when auditing the live design quality of a site without changing code. Trigger on "site-design-audit", design audit, visual QA, AI slop detection, typography review, spacing review, hierarchy review, or requests to review a rendered site and optionally infer DESIGN.md.

Use when auditing a live site's design and then fixing the issues in source code. Trigger on "site-design-fix", design fix loop, visual QA with fixes, AI slop cleanup, frontend polish from screenshots, or requests to audit then repair live UI issues.

Use when writing, reviewing, or refactoring React or Next.js code and you need performance-oriented guidance for components, data fetching, rendering, or bundle size decisions.