LeonMelamud

Use when deploying, operating, or migrating AI agents on Amazon Bedrock AgentCore — creating harnesses or runtime agents, adding skills/tools/gateways/memory/credentials, exporting a harness to code, or migrating AI assistant configurations (.github/agents, .claude/skills, .cursor/rules, MCP configs, hooks) from coding assistants. Triggers: 'migrate to AgentCore', 'agentcore migration', 'deploy to agentcore', 'create harness', 'export harness', 'add skill to harness', 'convert MCP to gateway', 'export agents to AWS', 'move agents to bedrock', 'agentcore harness', 'invoke agent runtime', 'agentcore deploy fails'.

Use when authoring, validating, or debugging standalone AWS CloudFormation templates (YAML/JSON) — writing or editing resources with secure defaults, running cfn-lint / cfn-guard / change-set validation before deploy, or diagnosing a failed or rolled-back stack via CloudFormation events and CloudTrail. Triggers: 'write a CloudFormation template', 'validate my template', 'cfn-lint', 'cfn-guard', 'change set', 'CREATE_FAILED', 'ROLLBACK_COMPLETE', 'stack stuck in UPDATE_ROLLBACK_FAILED'. For SAM/serverless-specific templates use aws-serverless; for end-to-end architecture design that emits IaC use aws-solution-architect.

Use when working with core AWS services outside the serverless and IaC specialist skills — EC2, S3, VPC/networking, IAM policies, RDS, ECS, CloudWatch, Secrets Manager — via the AWS CLI/console/boto3. Triggers - "launch an EC2 instance", "S3 bucket policy", "create a VPC", "IAM role/policy", "RDS setup", "ECS service", "CloudWatch alarm". For CloudFormation templates use aws-cloudformation; for Lambda/API-Gateway serverless code use aws-serverless; for architecture design + cost optimization use aws-solution-architect.

Use when implementing production serverless workloads on AWS — writing Lambda handler code, wiring API Gateway / DynamoDB Streams / SQS / SNS event-driven flows, SAM or CDK deployment, or fixing cold starts. Triggers: 'write a Lambda function', 'SAM template', 'API Gateway + Lambda', 'SQS consumer', 'DynamoDB stream processor', 'cold start optimization'. For standalone CloudFormation authoring use aws-cloudformation; for architecture selection + cost design use aws-solution-architect.

Use when asked to design serverless architecture, create CloudFormation templates, optimize AWS costs, set up CI/CD pipelines, or migrate to AWS. Design AWS architectures for startups using serverless patterns and IaC templates. Covers Lambda, API Gateway, DynamoDB, ECS, Aurora, and cost optimization. For editing/validating an existing raw CloudFormation stack use aws-cloudformation; for writing Lambda/event handler code use aws-serverless.

Scoring rubric for prioritizing CVEs by severity, exploitability, and exposure

Scan websites, UI code, copy, or e-commerce pages for dark patterns (deceptive design). Use when the user says "scan for dark patterns," "check for deceptive design," "dark pattern audit," "UI manipulation check," "check for confirmshaming," "detect urgency tricks," "scan for sneaking," or asks to review any webpage, component, or copy for manipulative UX tactics. Covers all 7 categories from academic research: Forced Action, Misdirection, Obstruction, Scarcity, Sneaking, Social Proof, and Urgency.

MANDATORY when ANY of these appear: (1) writing/editing/refactoring code that calls any third-party SDK, API, or library method, (2) debugging ANY issue where an API call succeeds (200/201) but the expected side-effect doesn't happen (email not sent, record not created, webhook not fired), (3) installing or importing external packages, (4) user reports something 'doesn't work' and the code involves an external service. This skill MUST be loaded BEFORE proposing any fix — never diagnose from memory.

React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.

This skill should be used when the user asks to "audit for AI visibility", "optimize for ChatGPT", "check GEO readiness", "analyze hedge density", "generate agentfacts", "check if my site works with AI search", "test LLM crawlability", "check discovery gap", or mentions Generative Engine Optimization, AI crawlers, Perplexity discoverability, or NANDA protocol.

Perform security audits on code changes, diffs, or branches to find high-confidence exploitable vulnerabilities. Use when asked to "audit security", "review for vulnerabilities", "security scan", "check for security issues", "audit this PR", "review these changes for security", or "find vulnerabilities in diff". Distinct from security-review (which provides secure coding patterns/checklists) — this skill actively audits code changes using a structured methodology with false positive filtering. Includes Python scripts for GitHub Action CI integration and PR evaluation.

Create, update, or validate SKILL.md files and skill packages. Use this skill when users ask to "create a skill", "make a new skill", "add a skill", "write a skill", "update a skill", "validate skill", "check skill quality", "review skill", "audit skills", or work with .claude/skills/ directory contents. Supports three operations: (1) CREATE - new skill from scratch, (2) UPDATE - modify existing skill, (3) VALIDATE - audit skill against SkillsBench best practices. NOT for UI/frontend design work - only for authoring skill definition files that extend Claude's capabilities.

Fetch real, current API docs and verify package versions before installing packages, calling external APIs, using SDKs, or integrating any third-party library. Triggers on npm install, pip install, package.json changes, import statements for external packages, API calls (fetch, axios, SDK methods), "integrate with", "connect to", "use X library", or debugging silent API failures where code returns 200 but produces no effect.

Israeli emergency alerts via Pikud HaOref. Use when asked about missile alerts, rocket alerts, emergency alerts in Israel, "are there alerts in [city]?", Pikud HaOref status, or real-time SSE alert streaming. Provides MCP tools, REST API, SSE pub-sub, and OpenClaw webhook integration.

Use when writing, editing, or refactoring code that calls any third-party SDK, API, or library; installing or importing external packages; debugging when an API call returns success but the expected side-effect doesn't happen; hitting 4xx errors from an external API; or when something 'doesn't work' and the code involves an external service.