skills

Rules and worked examples for writing prose that does not read like AI-generated slop. Consult before writing or editing any prose.

Louis Rossmann's writing voice for general prose: testable-number density, high sentence-length variance, claim-then-proof structure, contractions, contempt shown through precision. Consult when writing in his voice.

Audit code for security vulnerabilities across six trust boundaries — access control (IDOR, privilege escalation, mass assignment), auth & sessions (passwords, JWT, CSRF), injection (SQL, XXE, path traversal), XSS & output encoding, untrusted URLs & uploads (SSRF, open redirect, file upload), and data exposure (secrets, PII, leaky errors). Use when hardening or reviewing a feature, before shipping anything that handles untrusted input, auth, or sensitive data, or when asked to "scan for vulnerabilities", "is this secure", "check for IDOR/XSS/SQLi/SSRF", "security review". Defaults to fail-closed, least-privilege, server-side checks.

Configure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.

Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.

Build and maintain a grounded picture of the project's users before designing solutions — personas, jobs-to-be-done, as-is/to-be workflows, and the assumptions under them, each tagged evidence or assumption. Use when kicking off a project or feature, before a PRD or user stories, when the team is guessing what users "want," or when another skill needs the user's goals or mental model.

Make a screen self-evident — understood at a glance, no thinking required: clear visual hierarchy, scannable layout, conventional patterns, obvious clickability, ruthless word economy. Use when a screen feels confusing or cluttered, when simplifying copy or layout, reducing cognitive load, or asking "is this clear?"

Design and implement app screens and user flows with calm, user-first UX — obvious CTAs, feedback at the point of action, thumb-zone layout, and domain-modularized components. Use when the user asks to build or polish UI/UX, design a user flow, make a screen "feel" right, or mentions effortless/calm design, confirmations, error states, or empty states.

Evaluate a built screen or flow against UX heuristics and report what to fix — each finding with a severity and a concrete fix. Use to review or audit a UI's usability, before shipping a flow, or to turn "this feels off" into specific, rankable problems. The UX counterpart to /code-review.

Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman.

Break a plan, spec, or PRD into independently-grabbable issues on the project issue tracker using tracer-bullet vertical slices.

Turn the current conversation into a PRD and publish it to the project issue tracker — no interview, just synthesis of what you've already discussed.

Move issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.

Audit a feature implementation across four axes — label-truth (controls do exactly what their label says), fetch & query shape (every query is justified, deduplicated, and consistent with siblings), stack-native idiom (use what the stack already gives you), and misused tools (tools used against their grain — DB views as a "speed-up", effects for derived state). Use when implementing a feature, opening a PR, or asked to "verify this is justified", "does this button do what it says", "are we using X right", "is this query needed". Escalates big architectural calls to an ADR.

Surface and remove code that does not earn its keep — unnecessary memoization or caching, redundant type checks and casts, dead or unused code, over-engineered abstractions, and premature/unmeasured optimizations — in any language or framework. Use when the user wants to simplify a file or codebase, audit for cruft, cut needless memoization (useMemo/useCallback/React.memo, computed, lru_cache, hand-rolled caches), find dead code, drop redundant type guards, or asks "is this over-engineered" / "is this premature optimization".

Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions