Scaffold a Kinroster React form or multi-step dialog component in the repo's house style: "use client", useState + loading flag, createClient() from @/lib/supabase/client, FormData parsing, sonner toasts, shadcn/ui components only (never native elements), semantic Tailwind colors, lucide-react icons, and the base-ui DialogTrigger render={<Button/>} pattern for dialogs. Use this skill when the user says any of: "scaffold a form", "new form component", "new dialog", "new modal", "create a component for X", "/component-scaffold". IMPORTANT: Output must follow the repo conventions exactly — shadcn/ui only (no native <button>/<input>/<select>), semantic colors (no text-gray-900/bg-white), lucide icons (no emojis), and a SheetTitle/ DialogTitle for accessibility. It scaffolds structure; the human fills in domain fields and wiring.
Scaffold a Kinroster background job + its secured cron route: a src/lib/jobs/<name>.ts module exporting an async runner (typed Options/ Result, service-role client, per-org iteration, consent gating, returns counts) and a src/app/api/cron/<name>/route.ts GET handler gated by the CRON_SECRET bearer token. Reminds where the schedule must be registered. Use this skill when the user says any of: "new cron job", "scaffold a background job", "add a scheduled task", "new cron route", "/cron-scaffold". IMPORTANT: The cron route MUST check the CRON_SECRET bearer token before doing anything. Jobs run with the service-role client (they bypass RLS) so they must scope every query by organization themselves and respect consent gates. This repo's vercel.json has NO crons block — the schedule is registered externally; don't claim it auto-runs.
Wire correct compliance logging into a Kinroster API route that touches PHI: an actor-centric audit event via logAudit() (extending the AuditEventType / AuditObjectType unions when the event/object is new) and, for any disclosure of PHI to a recipient, an append-only disclosure_events insert with the right recipient_type / legal_basis / categories_shared / source_note_ids / delivery_method. Use this skill when the user says any of: "add audit logging to this route", "wire up the audit event", "log this disclosure", "add a disclosure event", "/audit-wire". IMPORTANT: audit_events is written via the logAudit() helper (service-role, fire-and-forget, never blocks the request); disclosure_events is an awaited insert via the AUTHENTICATED client (it has an RLS INSERT policy). Never log PHI into metadata. Never double-log notes / notes_sensitive_access — DB triggers already cover those.
Draft the preamble / wrapper text for a family update — greeting, framing, and structure — in the contact's preferred language and cultural register, scoped to what that contact is authorized to receive. It produces a fill-in-the-blanks template with placeholders for the clinical specifics; it does NOT write the actual observations and does NOT send anything. Use this skill when the user says any of: "draft a family update", "help me word an update for the family", "family update preamble", "/family-update-draft". IMPORTANT: This skill NEVER fabricates clinical content or PHI. It writes tone/structure with [placeholders] the admin fills in. It respects the contact's authorization scope (won't propose categories they aren't cleared for) and defers all actual disclosure to the in-app gated send flow, which enforces authorization and logs the disclosure.
Find leads from past lead-batch outreach batches that are due a follow-up and draft the follow-up messages. Reads the batch files in docs/marketing/outreach-batches/, finds leads past their suggested follow-up date, and drafts one 5-day or 14-day follow-up each (using the follow-up sequence in docs/marketing/linkedin-cold-outreach.md), into a review file the user sends manually. Use this skill when the user says any of: "follow up on outreach", "who's due for a follow-up", "draft follow-ups", "/outreach-followup". IMPORTANT: Drafts only — like lead-batch, it NEVER sends anything to LinkedIn, never automates, and never scrapes. Follow up at most twice (one 5-day, one 14-day) then drop the lead. The user reviews and sends each message manually.
Cross-check a Kinroster HIPAA-roadmap phase against the code that's actually shipped. Reads the phase's "What was built" + "How to verify" sections plus the compliance tracker/gaps docs, then greps/reads the codebase to confirm each claimed artifact (migration, RLS policy, API route, prompt, UI page, audit/disclosure logging) really exists. Produces a ✅/⚠️/❌ checklist with file evidence. Use this skill when the user says any of: "check HIPAA phase N", "are we compliant for phase X", "verify the roadmap phase", "did phase N actually ship", "/hipaa-phase-check". IMPORTANT: READ-ONLY assessment. It verifies code against the roadmap's own claims — it does NOT trust the ✅ in the doc, edit anything, or give legal advice. It flags items needing human or legal sign-off.
Audit Kinroster's Supabase migrations for row-level-security gaps: tables created without ENABLE ROW LEVEL SECURITY, RLS tables with no policy (or a permissive USING (true) policy), policies missing org-scoping, functions whose latest definition doesn't pin SET search_path, and append-only ledgers that wrongly allow UPDATE/DELETE. Produces a severity-ranked gap report. Use this skill when the user says any of: "audit RLS", "check our row-level security", "are there any RLS gaps", "security-audit the database", "/rls-audit". IMPORTANT: This skill is READ-ONLY. It reports gaps and proposes fixes; it NEVER edits a migration (they are immutable) and never touches the database. Fixes land in a NEW forward migration via the migration-scaffold skill.
Scaffold a new Kinroster LLM prompt end-to-end: the canonical spec (prompts/<id>.md with full YAML frontmatter + the 8 required body sections), the runtime (src/lib/prompts/<name>.ts exporting SYSTEM_PROMPT, a buildUserPrompt() function, an Output interface, and a PROMPT_VERSION constant that matches the spec), a Vitest test stub, and a CHANGELOG entry — all wired to the shared cultural/language builders where relevant. Use this skill when the user says any of: "new prompt", "add an LLM prompt", "create a Claude prompt", "scaffold a prompt", "/new-prompt". IMPORTANT: This skill scaffolds structure and metadata. It writes a starter prompt body, but the human owns the final wording. It keeps the runtime PROMPT_VERSION equal to the spec version, and never invents test cases that assert behavior the prompt doesn't have — stubs are clearly marked.