kaarma-skills

Use when adding, fixing, or reviewing SAML login, SSO, SP metadata, ACS, SLO, session auth gates, or myKaarma IdP integration in a Python web app.

Use when creating a new local app, prototype, browser tool, game, demo, or greenfield project, especially when no existing repo stack is already fixed.

Design and review REST APIs following myKaarma organization standards. Use when designing new API endpoints, reviewing API changes, or ensuring API consistency across services. Covers URL patterns, HTTP methods, status codes, versioning, naming conventions, pagination, and bulk operations.

Use when reviewing code, UI screens, or features for localization compliance against myKaarma's attribute-based rendering standards. Triggers on requests like "check localization", "audit i18n", "review RTL support", or "is this locale-ready".

Deep code security audit for Java/Spring Boot and TypeScript services. Covers auth/authz, input validation, SQL injection, PII exposure, and API security. Use when preparing for a security review, before a major release, or when a security concern is raised. Also trigger when the user says things like "audit this service for security", "security review before release", "check for vulnerabilities in the code", "is this endpoint secure?", "check for SQL injection", "check for PII in logs", or "audit our auth layer". Complements the vuln-scan skill (which covers CVEs and dependency scanning) — this skill focuses on application-level code patterns.

Use when reviewing PM-built prototypes, wireframes, Figma mockups, or UI screens for usability gaps, UX issues, and UI quality. Triggers on requests like "review this design", "audit this prototype", "UX feedback", or "check this UI".

Applies myKaarma's official brand colors, typography, spacing, navigation patterns, dark mode, and interaction design to all UI output. Invoke this skill before starting any UI project — components, dashboards, forms, or AI-generated artifacts — to ensure full consistency with myKaarma's visual identity and design system.

Implement production-ready features for high-reliability systems following industry best practices. Use when building APIs, services, background workers, data pipelines, or user-facing features where performance and maintainability are critical. Covers backend, frontend, security, observability, and deployment.

Create, edit, render, verify, and export PowerPoint slide decks. Use when Codex needs to build or modify a deck, presentation deck, slide deck, slides, PowerPoint, PPT, or visually ambitious editable .pptx file.

Use this skill when a user requests to create, modify, analyze, visualize, or work with spreadsheet files (`.xlsx`, `.xls`, `.csv`, `.tsv`) with formulas, formatting, charts, tables, and recalculation.

Systematically diagnose and resolve errors in production systems. Use when facing exceptions, unexpected behavior, performance issues, or system failures. Provides structured debugging workflows, error classification, and resolution strategies for async, distributed, and database systems.

Apply myKaarma engineering standards when building features, reviewing code, designing APIs, setting up services, or checking patterns for backend (Java/Spring Boot) or frontend (TypeScript/Angular/React). Use when an engineer asks "how should I..." or "what's the pattern for..." or before implementing any backend/frontend code.

Stage, commit, and push changes with meaningful commit messages following conventional commits. Use when you need to commit code changes, create atomic commits, or push to remote. Analyzes diffs to generate descriptive messages.

Dispatch parallel investigation agents during a production incident — timeline builder, root cause analyzer, impact assessor, and mitigation finder. Use for P1/P2 incidents, production down, data integrity issues.

Dispatch parallel pre-launch check agents before releasing a feature or service — security, localization, performance, observability, and launch checklist. Produces a GO / NO-GO / CONDITIONAL GO verdict.

Applies myKaarma's attribute-based localization standards to code artifacts. Use when building UI that must support RTL, multiple currencies, metric units, date/time formats, or locale-aware rendering. References the locale attributes API as the authoritative source.

Systematically explore and understand existing codebases before making changes. Use when starting on a new project, investigating bugs, planning features, or needing to understand architectural patterns. Provides search strategies and investigation workflows.

Dispatch parallel specialized review agents simultaneously — code review, security audit, test coverage, and API contract review. Use when a feature/PR is ready for thorough review before merge.

Perform thorough code reviews for production systems focusing on reliability, security, performance, and maintainability. Use after implementing features, before merging PRs, or when auditing existing code. Provides structured checklists for distributed systems, async patterns, error handling, and observability.

Use when you have a written implementation plan and want an independent review before execution. Dispatches Codex CLI or a Claude subagent to analyze the plan for flaws, gaps, and risks. Invoke manually with /second-opinion.

Report session summary — files changed, git diff stats, context health check, and cost-awareness tips. Use to get a snapshot of what's been accomplished and whether to /compact. Trigger when the user asks for session stats, cost summary, context health, what changed this session, or how many tokens/messages have been used.

Spec-driven development loop — parses a spec into missions, executes them with test validation, loops until all acceptance criteria pass. Use when you have a written spec and want systematic implementation.

Utility reference for emitting structured JSON from skills so downstream automation (MCP tools, other skills) can parse results without scraping prose. Reference this skill from any skill that produces output consumed by another skill or tool.

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

Write comprehensive tests for production systems including unit, integration, and E2E tests. Use when implementing new features, fixing bugs, or improving test coverage. Covers async testing, mocking strategies, test organization, and CI/CD integration for high-reliability systems.

Apply first-principles thinking to break down complex production systems problems into fundamental truths. Use when facing ambiguous requirements, architectural decisions, performance bottlenecks, or when existing solutions don't fit. Helps identify root causes and build solutions from foundational understanding rather than copying patterns.

You MUST use this before any implementation work — building features, creating services, adding functionality, or modifying behavior. Validates that we are solving the right problem, aligned on the user need, and have a plan to prove success.

Run vulnerability scans during local development to find critical and high-severity issues before they reach production. Use this skill whenever the user asks to: scan for vulnerabilities, audit dependencies, check for CVEs, find security issues in their code or containers, scan a Docker image, check Kubernetes manifests for security misconfigurations, look for hardcoded secrets or leaked credentials, or run any kind of security check on their project. Also trigger when the user says things like "is this safe to deploy?", "check my dependencies", "any security issues?", or "run a security scan". Covers: Node.js/npm, Python/pip, Go, Java/Maven, Docker images, Kubernetes manifests, and secrets detection.

Use when you have a spec or requirements for a multi-step task, before touching code

Use when creating new skills, editing existing skills, or verifying skills work before deployment