backend-skills

Generate an entity-relationship diagram (Mermaid erDiagram) from rfc-to-schema's IR, a live SQLite file, static SQL/migration files, or a Postgres/MySQL database (only with explicit connection details). Use when the user asks to diagram, visualize, or draw an ER diagram of a schema or database — not tied to any RFC.

Turn an RFC/design doc's described behavior into a concrete API design (OpenAPI REST spec and/or GraphQL SDL) via a protocol-neutral intermediate representation. Optionally grounds request/response bodies in entities from rfc-to-schema's IR. Use when the user asks to derive an API design, endpoints, or a GraphQL schema from an RFC or proposal.

Turn an RFC/design doc into a concrete data schema (SQL DDL, JSON Schema, or a matched target detected from the repo) via a neutral intermediate representation. Use when the user asks to derive a database schema, data model, or entity definitions from an RFC or proposal.

Generate human-readable API reference documentation (Markdown) from an rfc-to-api IR, an existing OpenAPI/GraphQL spec, or (as a fallback) implemented route/handler source code. Use whenever the user asks to document an API or endpoints, generate API reference docs or a README for an API, or write developer-facing docs for a service.

Review an existing codebase's architecture for structural health — layering violations, circular dependencies, coupling/cohesion problems, and deviation from a stated architecture pattern. Use whenever the user asks to review architecture, check module boundaries or dependencies, find circular imports, assess tech debt or code structure, or asks "is this codebase well structured" — even without the word "architecture".

Review a codebase for performance issues — N+1 queries, algorithmic complexity, unbounded reads, blocking I/O in hot/async paths, missing caching, connection-pool misuse, and redundant work — like a senior engineer's performance audit. Use whenever the user asks why code is slow, whether it will scale, to find bottlenecks or hot paths, or to review/audit for performance or scalability — even without the word "review".

Review a codebase for security vulnerabilities — injection, broken access control, XSS, SSRF, path traversal, CSRF, mass assignment, insecure deserialization, crypto misuse, and hardcoded secrets — like a senior security engineer's audit pass. Use whenever the user asks to review or audit code for security, asks "is this code safe", mentions OWASP, pentest prep, or vulnerabilities, or asks to check for leaked secrets/credentials — even if they don't say "security review" explicitly.

Interactively reconstruct a post-incident narrative (timeline, root cause, impact, resolution, action items) from logs, human notes, and/or Slack/incident-channel excerpts, following standard postmortem conventions. Use when the user wants to write up a postmortem, document an incident, or reconstruct what happened during an outage.

Interactively triage messy, mixed-format logs — asks clarifying questions when the input is ambiguous (multiple services, wide time range, unclear intent) before producing a ranked, explained report, then supports drilling into specific clusters. Use when the user wants to investigate logs conversationally rather than get a single report dump.

Organize messy, mixed-format logs into ranked error clusters with plain-English explanations. Use when the user pastes a log dump, points at a log file, or asks to debug/triage/analyze logs, errors, stack traces, or a crash from any source (file, command output, or pasted text).

Interrogate a pre-design requirements doc, stakeholder brief, epic, or freeform notes for missing information — before any solution has been proposed. Use whenever the user asks what's missing from requirements, wants help scoping a feature before writing an RFC or design doc, shares a rough feature idea and asks what to consider, or asks "what should I ask before we design/build this".

Review an RFC, design proposal, or ADR for completeness, ambiguity, risk, and feasibility before it's approved — like a senior engineer's review pass. Use when the user asks to review, critique, or sanity-check an RFC/proposal/design doc, or asks "is this ready to approve."