heaptrace-skills

Design RESTful APIs — endpoints, request/response schemas, error codes, versioning. Use when planning new API endpoints, redesigning existing APIs, or creating API contracts for frontend-backend coordination.

Estimate infrastructure cost for a feature or system — compute, storage, bandwidth, managed services. Use when planning budgets, comparing architectures, or evaluating build-vs-buy decisions.

Design database schema — tables, relations, indexes, migration strategy. Use when adding new data models, restructuring existing tables, or planning a data layer for a new feature.

Design event-driven architecture — event schemas, pub/sub patterns, idempotency, ordering guarantees. Use when decoupling services, building notification systems, audit trails, or real-time features.

Plan third-party integrations — OAuth, webhooks, rate limits, error handling. Use when integrating with external services like Stripe, Google, Slack, or any API-based service.

Plan data and system migrations — zero-downtime strategy, rollback procedures, validation checks. Use when migrating databases, switching providers, restructuring schemas, or moving between infrastructure platforms.

Review a system for scaling bottlenecks — caching, queues, read replicas, CDN, load balancing. Use when preparing for traffic growth, diagnosing performance issues, or planning infrastructure upgrades.

Design a system from scratch — components, data flow, API contracts, scaling strategy. Use when starting a new product, service, or major feature that needs architectural planning before implementation.

Set up test automation in CI/CD pipelines with parallel test runs, flaky test handling, test splitting, retry logic, artifact collection, coverage reporting, and failure notifications. Produces pipelines that catch real bugs fast without slowing down deploys.

Write contract tests between services using Pact or schema validation to ensure API compatibility. Covers consumer-driven contracts, provider verification, schema evolution strategies, breaking change detection, and integration with CI/CD. Prevents integration failures before deployment.

Write robust Cypress or Playwright end-to-end tests with page object pattern, custom commands, auth handling, selector strategies, waiting patterns, and test isolation. Produces tests that are stable in CI and catch real regressions.

Create mock APIs and services for testing using MSW, Nock, or custom mock servers. Covers when to mock vs use real services, mock data factories, network request interception, test reset patterns, and TypeScript-safe mocking. Produces reliable, maintainable test doubles.

Analyze and improve test coverage by identifying untested code paths, prioritizing coverage gaps by risk, setting meaningful thresholds, distinguishing vanity metrics from real quality, and integrating coverage reports into CI/CD. Produces a coverage strategy that catches bugs, not just hits line count targets.

Set up visual regression testing with screenshot comparison, pixel threshold configuration, baseline management, CI integration, dynamic content handling, and responsive viewport testing. Catches unintended UI changes before they ship.

Write a professional feature proposal for a client engagement. Produces executive summary, problem analysis, proposed solution, technical approach, phased timeline with milestones, cost breakdown, and ROI projection. Output is polished and ready for client-facing delivery.

Analyze competitor products and features systematically. Produces feature matrices, SWOT analysis per competitor, gap analysis, pricing comparisons, market positioning maps, and actionable differentiation opportunities. Output is ready for executive presentations and product strategy discussions.

Prioritize features and backlog items using proven frameworks — RICE scoring, MoSCoW method, impact/effort matrix, and weighted scoring. Produces a ranked backlog with stakeholder-aligned rationale. Turns a messy list of ideas into a data-driven roadmap.

Define KPIs and success metrics for a feature or product. Covers what to measure, how to instrument, dashboard layout, success thresholds, leading vs lagging indicators, and A/B test design. Produces a complete measurement plan that connects feature work to business outcomes.

Write a complete Product Requirements Document (PRD) from an idea, feature request, or business need. Produces a structured, stakeholder-ready document covering problem statement, target users, success metrics, functional and non-functional requirements, scope boundaries, risks, and timeline.

Negotiate and manage project scope with stakeholders and clients. Produces must-have vs nice-to-have analysis, MVP definition, phased delivery plans, trade-off matrices, timeline impact assessments, and stakeholder communication templates. Turns scope disagreements into aligned, documented decisions.

Write professional status updates for stakeholders, clients, and leadership. Produces progress summaries, metric highlights, blocker analysis with mitigations, decisions needed, next steps, risk register updates, and timeline confidence assessments. Turns project chaos into clear, actionable communication.

Write well-structured user stories with persona identification, goal mapping, Given/When/Then acceptance criteria, edge cases, dependencies, and story splitting techniques. Produces stories that are ready for sprint planning and development.

Build production-grade CI/CD pipelines using GitHub Actions for AWS deployments, covering ECR image builds, ECS deployments, rollback strategies, environment promotion, secrets management, and multi-stage workflows.

Plan cloud infrastructure work at any scope — task (one change), feature (1-3 weeks), or roadmap (1-3 months). Multi-cloud aware (AWS, Azure, GCP). On first run, asks 7 setup questions and saves your project profile (cloud provider, region, compliance scope, budget tier, security posture, environments, existing infra) to .heaptrace/cloud-plan.json. On every run, asks scope (Task/Feature/Roadmap) and produces a plan adapted to that scope — task plan, feature plan with phases and rollback, or strategic roadmap with executive summary. Defaults to mid-market budget tier (cost-effective + reliable, not cheapest) and balanced security (secrets in vault, encryption everywhere, least-privilege IAM). Names the next cloud skills to run for execution.

Audit and optimize AWS costs through right-sizing, reserved instances, savings plans, unused resource cleanup, S3 lifecycle policies, Compute Optimizer recommendations, cost allocation tags, and budget alerts.

Configure the full lifecycle of cloud credentials — rotation policies, access key audits, token TTL strategy, JWT signing keys, third-party API key management, and revocation procedures. Multi-cloud aware (AWS, Azure, GCP). Eliminates long-lived access keys in favor of IAM roles + STS, sets up automated rotation via Secrets Manager / Key Vault / Secret Manager, defines short-TTL tokens with refresh rotation, and configures detection alerts on credential misuse. Distinct from secrets-manage (which stores secrets) and from Compliance Pack's secrets-scan (which finds leaks) — this skill defines the ROTATION POLICY and audits long-lived credentials. Names exact services, exact rotation cadences, exact verification commands.

Plan and implement disaster recovery strategies for AWS workloads, covering RTO/RPO definitions, backup strategies, cross-region replication, failover testing, runbook creation, and multi-tier DR architectures.

Deploy containerized applications to AWS ECS with Fargate or EC2 launch types, covering task definitions, services, ALB integration, auto-scaling policies, rolling updates, blue/green deployments, and production-grade service configuration.

Write least-privilege IAM policies for AWS services, covering roles, policies, trust relationships, cross-account access, service-linked roles, policy evaluation logic, and condition keys for production-grade access control.

Harden the identity layer of cloud environments — root account lockdown, MFA enforcement, SSO / federated identity (Okta, Entra ID, Auth0, Google Workspace), role-trust hardening with External IDs, just-in-time privileged access, and detection / alerting on identity events. Multi-cloud aware (AWS, Azure, GCP). DISTINCT from iam-policy (which authors least-privilege policies) and from access-audit (which verifies access controls after the fact) — this skill configures the IDENTITY itself so that the policies you write actually mean something. Reads .heaptrace/cloud-plan.json for project context. Defaults to federated SSO, no local IAM users for humans, hardware MFA on root, and External-ID-required cross-account trust.

Set up comprehensive CloudWatch monitoring with custom metrics, alarms, dashboards, log groups, log insights queries, SNS alerts, composite alarms, and actionable alerting strategies for production workloads.

Configure cloud network security as the operator — security groups, NACLs, port policies, bastion replacement, and private networking. Multi-cloud aware (AWS, Azure, GCP). Sets up defense-in-depth network controls correctly from the start, or remediates specific gaps surfaced by a network audit. Distinct from /network-audit (which finds gaps) — this skill BUILDS and FIXES. Covers per-tier security group baselines, SG-to-SG references inside VPC/VNet, NACL stateless filtering, SSH-bastion replacement (AWS SSM Session Manager, Azure Bastion, GCP IAP-TCP), private connectivity (VPC Endpoints, PrivateLink, Private Endpoint, Private Service Connect), default-deny egress, and concrete verification commands. Reads project profile from .heaptrace/cloud-plan.json. Outputs production-ready Terraform snippets and CLI commands.

Set up production-grade Amazon RDS PostgreSQL instances with proper sizing, multi-AZ deployments, read replicas, automated backups, parameter groups, performance insights, monitoring alerts, and security hardening.

Manage application secrets and configuration using AWS SSM Parameter Store and Secrets Manager, covering rotation policies, access control, environment variable injection into ECS tasks, audit logging, and secret lifecycle management.

Write production-grade Terraform modules with proper input variables, outputs, state management using S3 and DynamoDB, workspaces, module composition, versioning, and infrastructure-as-code best practices.

Design and implement production-grade AWS VPC architectures with proper subnet tiers, NAT gateways, security groups, NACLs, VPC peering, flow logs, and CIDR planning for multi-AZ high-availability deployments.

Audit access controls across application and infrastructure — RBAC/ABAC models, permission enforcement, MFA, user lifecycle, service accounts, least privilege, and break-glass procedures. Maps findings to SOC 2 CC6, HIPAA §164.312(d), PCI-DSS Req 7-8. Use during quarterly access reviews, before compliance audits, or when onboarding new roles and services.

Review audit logging implementation for completeness, integrity, and compliance — event taxonomy, log schema design, immutable storage, SIEM integration, retention policies, and regulatory mapping (HIPAA, PCI-DSS, SOC 2, GDPR). Use before compliance audits, when designing new audit systems, or when adding security-relevant features.

Audit and harden cloud infrastructure security posture across AWS, Azure, and GCP — IAM misconfigurations, public storage, unencrypted resources, missing logging, IaC scanning, and CIS benchmark compliance. Use before any production deployment or as a periodic cloud security review.

Generate auditor-ready compliance reports with multi-framework control mapping, automated evidence collection strategies, gap analysis, and structured report packages for SOC 2, HIPAA, GDPR, PCI-DSS, and ISO 27001. Reduces audit prep from weeks to days.