DonaldMurillo

Adversarial review checklist for stateful Momentum CMS features (workflow, versions, scheduled publish, permissions inheritance, branches, anything that adds writeable state + access control). Use BEFORE merging a feature that introduces new mutating routes, new system-managed columns, new access functions, or new audit trails. Trigger phrases include "red-team this", "adversarial review", "security review of <feature>", "before merging <feature>", "/cms-feature-red-team".

Set up the Momentum CMS MCP server plugin and generate Claude Code MCP config for AI tool integration. Use when connecting Claude Code (or any MCP client) to a Momentum CMS instance.

Generate a new Momentum CMS collection with fields, access control, and hooks

Generate an Angular component with signals, OnPush, and host-based styling following Momentum CMS conventions. Use when creating new UI components in any library.

Write and validate Playwright E2E tests for Momentum CMS features. UI tests ALWAYS start from /admin dashboard and navigate via sidebar/dashboard — never go directly to deep URLs. Always starts the server and inspects the actual UI before writing assertions. Triggers include "write e2e tests for...", "add e2e tests", "test the admin UI for...", or "/e2e-test <feature>".

Run migrations, generate schemas, and manage code generation for Momentum CMS. Use when working with database migrations, Drizzle schema generation, type generation, or Angular schematics.

Work with Momentum API for data operations in Angular components

Run structured evaluations comparing skill vs no-skill performance. Measures assertion pass rates, timing, and output quality to systematically improve skills.

Skill chain resolver extension. Resolves `imports:` and `Read skill:` references in SKILL.md files recursively, making chained skills available to pi as first-class skills. Use /skill-chain to inspect and manage skill chains.

Independent execution pipeline. Takes any plan markdown as input, breaks it into discrete tasks with dependencies, and orchestrates specialized sub-agents to implement them. Enforces 0 lint/build errors after every task. Resumable if interrupted. Use when the user says "deep execute", "/deep-execute", or wants to implement a plan.

Launch a multi-phase planning pipeline: research the codebase AND web for best practices, create a plan, generate a user flow spec, deepen it, get critiques from specialized agents, resolve questions, and produce a finalized plan. All state saves to docs/plans/{slug}/ as committable markdown. Resumable if interrupted. Use when the user says "deep plan", "/deep-plan", or asks for a thorough implementation plan.

Protocol for preserving critical skill invariants across context compaction. Imported by orchestrator skills (deep-plan, deep-execute, deep-review, deep-auto). Uses PreCompact + PostCompact hooks to ensure non-negotiable rules survive context loss.

Fully autonomous pipeline orchestrator. Chains deep-plan (with auto-resolved Q&A), deep-execute, deep-review, and optionally deep-complete into a single unattended run. All critic questions are resolved using codebase evidence and codified best practices. Resumable if interrupted. Use when the user says "deep auto", "/deep-auto", or wants to run the full pipeline autonomously.

Structured bug-fix pipeline. Reproduce → validate intent → write red test → fix → verify → regression review → complete. Never fixes without a failing test first. Resumable. Use when the user says "deep bug", "/deep-bug", or provides a bug report.

Completion phase. Commits code, generates documentation, and produces a final summary. Run after deep-review passes. Use when the user says "deep complete", "/deep-complete", or wants to finalize the pipeline.

Post-pipeline fix-up skill. Root cause analysis for every issue, TDD fixes, and spec/doc amendments. Never patches without understanding why. Resumable.

Write GoFastr-facing copy in plain, concrete words. Auto-load before writing or editing ANY user-facing sentence — taglines, README prose, site/UI text, headlines, docs, changelogs, marketing. Kills jargon, marketing adjectives, abstract nouns, and AI-slop phrasing. Triggers on writing/editing copy, tagline, hero, headline, lede, positioning, README prose, landing page, UI microcopy.

Auto-loads when working on a *host application* that imports the GoFastr framework (not the framework itself). Encodes the "don't reinvent — reach for the battery first" rule and the import paths an agent needs. Triggers on edits to Go files in repos that import `github.com/DonaldMurillo/gofastr/...`, on `main.go` files calling `framework.NewApp`, and on phrases like "login", "signup", "session", "user table", "log out", "magic link", "forgot password", "reset password", "add admin page", "back office", "audit log", "audit trail", "compliance log", "send email", "transactional email", "welcome email", "send a notification", "notify the user", "background job", "async task", "schedule", "cron", "run every hour", "retry on failure", "upload", "store images", "store files", "S3", "MinIO", "attachments", "avatar", "full-text search", "find records containing", "outbound webhook", "signed callback", "POST to a customer URL", "cache", "memoize", "remember for N seconds", "CSRF", "RBAC", "require admin", "roles", "r

Inspect a running GoFastr app's shape via MCP introspection tools. Use when the user asks "what routes exist", "is the app ready", "what plugins are loaded", "what's the current config", "what batteries depend on what", "what does this framework doc say", or any "describe the running server" question where the app was built with framework.WithMCPIntrospection().

Live debug a running GoFastr app via its MCP endpoint — combined entry point covering both the log_* tools (battery/log) and the app_* introspection tools (framework). Use when the user wants to "debug the live app", "see what's going on right now", "tell me about the running server", or any general "go look at the running app" prompt.

Auto-loads when adding, changing, or removing any GoFastr feature or exported API. Encodes the doc topology (README + ARCHITECTURE + framework/docs/content/*.md) and the change→doc mapping. Docs are embedded in the gofastr binary at build time — `gofastr docs` browses them and the MCP `framework_docs_*` tools expose them to agents. Triggers on edits to framework/*.go, core/, battery/, cmd/, kiln/, core-ui/ — and on phrases like "add", "implement", "build", "refactor", "rename", "remove", "deprecate", "new feature", "new endpoint", "new field type", "API change", "expose", "wire up". Goal: docs ship in the same commit as the code, not "later".

Build a GoFastr web app live by calling Kiln over HTTP. Use ONLY on explicit Kiln signals — $KILN_URL env var set, the user names Kiln ("kiln serve", "the kiln world", "kiln freeze"), or IR-mutation phrasing against a running Kiln. Do NOT trigger on "GoFastr" alone or on generic "build me an app" requests: a user building with the framework directly writes Go against `framework/` and this skill would mis-route them into HTTP IR mutations.

How to run (or commission) an adversarial security-test pass against this codebase without producing 3000 lines of repetitive matrix tests. Auto-loads when the user mentions "red tests", "adversarial tests", "security test pass", "find security gaps", or is about to spawn a sub-agent to author *_security_test.go files. Encodes the "property × surface, not case × file" rule, the naming + triage policy, and a ready-to-paste prompt template for the next pass.

Auto-loads when building, adding, or extending a UI component, widget, island, or any surface in the GoFastr framework — including modals, drawers, dropdowns, toasts, sidebars, banners, popovers, and any other interactive primitive. Encodes the "minimal-register + SSR-inline + hydrate" contract every component must follow. Triggers on phrases like "add a widget", "build a component", "new modal", "create dropdown", "add island", "wire a surface", or whenever the work touches core-ui/widget/, core-ui/widget/preset/, framework/ui/, or registers a widget.Definition.

Build, test, or debug a statico plugin. Use when the user wants to write a project-specific rule, scaffold a plugin, or investigate plugin behavior.

Reclaim disk space by cleaning build artifacts, dependency caches, and benchmark repos. Auto-invokes before merges, releases, and after big branch switches — or whenever the user asks to clean up, free space, or trim the repo.

Keep statico's user-facing documentation in lockstep with code changes. Auto-invoke proactively whenever the user adds, removes, or modifies CLI flags, subcommands, config keys (`.statico.toml` / `StaticoConfig`), output formats, plugin hooks, plugin protocol fields, the public Rust API (`src/lib.rs` re-exports), template content (`templates/`), or framework profiles. Also invoke when bumping `Cargo.toml` `version`, `rust-version`, or dependency versions that change behavior, and when the user mentions "ship", "release", "publish", or "the docs are stale". Verifies README.md, CHANGELOG.md, the files under `docs/`, the templates under `templates/`, and the example plugin under `examples/plugins/`. Default action is to AUDIT and report drift; only edit when the user confirms or the drift is mechanically obvious (e.g., the README CLI table is missing a flag we just merged).

Run a statico code health analysis on the current project. Presents a human-readable summary of dead code, unused exports, circular dependencies, and overall health score. Use when asked to check code health, find dead code, or review code quality.

Interactive dead code cleanup using statico analysis. Identifies dead files, presents them with context, and helps safely remove them one by one. Use when asked to clean up dead code, remove unused files, or reduce codebase size.

Measure the impact of refactoring using statico before/after analysis. Snapshots code health before changes and compares after. Use when planning or completing a refactoring, measuring code quality improvements, or verifying cleanup effectiveness.

Develop, test, and debug statico plugins. Use when creating plugins, modifying plugin code, or running the plugin development workflow (init, build, run, doctor).

Rust CLI static analyzer for TypeScript and Rust projects. Detects dead code, unused exports/types/dependencies, circular dependencies, code duplication, and framework-specific issues. Supports AI-optimized output formats, auto-fix suggestions, and Mermaid dependency graphs. Use when analyzing code health, measuring refactoring impact, setting up CI code-quality gates, or exploring unfamiliar codebases.

Drive interactive terminal sessions for AI agents. Start a virtual terminal, send commands, read streamed output, and detect when a program is ready for input. Use when an agent needs to run an interactive CLI, REPL, TUI, or shell (e.g. open a terminal to drive another tool like Codex) and respond to prompts in a loop. Backed by a PTY with event-sourced, hash-chained output.