skills-web-dev

Top-level router for the Chwezi Core Systems web-development and software-engineering skills engine. Use for AI systems, SaaS, architecture, APIs, databases, security, frontend engineering, mobile, DevOps, reliability, product engineering, SDLC documentation, catalog maintenance, delivery evidence packs, routing fixtures, and world-class engineering quality gates.

iOS AI/ML standards for WWDC26 Apple intelligence work, including Foundation Models, Language Model providers, Dynamic Profiles, Core AI, Evaluations, Core ML, Vision, NaturalLanguage, Speech, SoundAnalysis, and privacy-first on-device inference.

iOS architecture orchestration for production apps, modular codebases, Swift patterns, App Intents, Foundation Models/Core AI provider boundaries, scale practices, and release-ready implementation boundaries.

iOS data persistence standards with SwiftData, Keychain, files, offline sync, Core Spotlight semantic indexing, App Entity data exposure, and AI cache/privacy boundaries.

iOS development standards for AI agent implementation. Swift-first, SwiftUI, MVVM + Clean Architecture, async/await, comprehensive security, testing, and performance patterns. Use when building or reviewing iOS applications, generating Swift...

StoreKit 2 in-app purchases, subscriptions, App Store Server API, group and organization subscription watch items, Unity StoreKit plugin routing, paywall UI, transaction verification, and App Store Connect configuration.

iOS platform capability orchestration for App Intents, Siri, Spotlight semantic indexing, widgets, biometrics, Bluetooth printing, push notifications, native PDF export, networking, media, and Apple framework entitlements.

iOS quality and release orchestration for Swift Testing 6.4, Device Hub, Xcode 27 agents, Xcode Cloud, AI Evaluations, Instruments, TestFlight, App Store review, stability, and release evidence.

iOS security and authorization orchestration for Keychain, Secure Enclave, App Attest, Trust Insights watch items, privacy manifests, agentic AI, App Intents, tamper resistance, permissions, RBAC, and tenant-safe mobile access.

Kotlin Multiplatform shared module development standards for sharing business logic across Android and iOS while keeping native UI. Covers project structure (shared/composeApp/iosApp), source sets, targets, expect/actual, DI (Koin)...

Cross-platform mobile operations orchestration for app icons, mobile RBAC, SaaS planning, Play Store review, Apple Xcode 27/TestFlight/Xcode Cloud evidence, and operational mobile delivery assets.

Use when building offline-first Progressive Web Apps — Service Worker lifecycle, Workbox caching strategies, IndexedDB via Dexie.js, Background Sync for queued writes, Web Push notifications, Lighthouse gates, and Next.js PWA integration. Default for apps that must work on EDGE/2G or intermittent connectivity.

Check whether this machine can generate and validate Word, PDF, Excel, DOCX, XLSX, spreadsheet, workbook, application register, scoring matrix, price schedule, budget, dashboard, report, proposal, or annex files before promising them.

Audit a whole skills engine (a repo of routed SKILL.md files such as design-system-skills, chwezi-accounting-doctrine, srs-skills, business-plan-skills, social-media-skills, linux-skills, digital-research-engine) against a world-class bar. Ranks EVERY aspect out of 100 — taxonomy, doctrine, skill depth, worked examples, standards currency, coverage, redundancy, discovery/routing, safety — plus per-output-type readiness (web, iOS, Android, web apps, cross-platform, websites, documents, presentations, brand, data products). Produces a comprehensive multi-file report with a strict scorecard and a prioritized roadmap. Use when asked to audit, grade, benchmark, or find gaps in a skills engine/catalog and plan how to make it world-class.

Use when coordinating multi-workstream consulting bids or delivery programmes with deadlines, owners, RACI, RAID, deliverables registers, decision logs, quality gates, and client/donor reporting cadence.

Use as the final quality gate for high-stakes bids, donor submissions, consulting deliverables, score predictions, compliance knockout scans, evidence audits, spreadsheet reviews, and delivery-feasibility checks.

Use when scoping or specifying an e-commerce platform, payment, API, security, AI, data protection, integration, and remediation audit for SMEs or cross-border digital trade programmes.

Use when specifying application intake, eligibility screening, selection scoring, beneficiary registers, diagnostics tracking, expert deployment, monitoring dashboards, RBAC, audit trails, and donor reporting for BDS programmes.

Analyse, evaluate, and audit any artefact for AI slop and score it. Runs after EACH major iteration of work and AUTO-RUNS whenever the user asks to analyse, review, evaluate, audit, critique, or de-slop any project, app, website, business plan, SRS or spec, proposal, blog post, social post, document, image, or codebase, or asks whether something looks AI-generated. Produces a graded slop report giving per-marker findings with severity, evidence, and a concrete fix. Pairs with anti-ai-slop, which prevents slop during production.

NON-NEGOTIABLE real-time guardrail. Apply on EVERY generated output (text, document, UI, code, image brief, social post) continuously as you generate AND before it is delivered, so the output cannot be recognised as "AI slop". Carries the verified definition, the seven universal slop markers each paired with an avoidance rule, the banned-vocabulary list, and a ship-gate checklist. Load first; it overrides stylistic preferences.

Use when designing the runtime that hosts agentic LLM features in a multi-tenant SaaS — the agent loop as a control-plane service, formal state machine (PERCEIVE → PLAN → ACT → OBSERVE), retries, idempotency, max-step caps, deterministic resumability, and the "agent vs workflow vs cron" decision. Distinct from `ai-agents-tools` (agent fundamentals) and `ai-on-saas-architecture` (overall AI architecture).

Use when designing or building AI-powered application systems — choosing architecture style, selecting components, structuring the AI stack, making build-vs-buy decisions, and planning multi-tenant AI module gating

Use when writing, refining, or structuring prompts for AI-powered app features — system prompts, user prompt templates, few-shot examples, chain-of-thought, prompt versioning, and defensive prompting

Building cross-platform .NET desktop apps with Avalonia UI (Windows/macOS/Linux). Use when working with Avalonia, AXAML/XAML UI, MVVM in Avalonia (CommunityToolkit.Mvvm or ReactiveUI), compiled bindings (x:DataType), styling/control themes/Fluent theming, data binding, DataTemplates and virtualization for large lists, asset/PNG image bundling (avares://), localization, accessibility, hosting a WebView (WebView2/WKWebView) in Avalonia, headless testing, or packaging an Avalonia app for Windows and macOS.

Use when building, reviewing, modernizing, or debugging C# and .NET applications across .NET 8/9/10, C# 12/13/14, ASP.NET Core APIs, EF Core data access, background services, concurrency, .NET MAUI, Azure-integrated services, testing, packaging, or .NET AI integration. Covers project structure, language idioms, runtime choices, secure service design, performance, observability, and release readiness.

Generate world-class, professionally designed Microsoft Word (.docx) documents that look like a designer and communications specialist worked on them together — not AI output. Use when producing any .docx file: reports, proposals, manuals...

Detect project type, recommend documentation methodology (Waterfall/Agile/Hybrid), and generate documentation roadmap. Use this as the FIRST skill when starting documentation for any project.

Use when securing an AI/LLM-powered feature against prompt injection, cross-tenant data leakage and tenant isolation failures, jailbreaks, and adversarial inputs. Covers PII scrubbing before model calls, output validation, rate limiting, audit logging, and DPPA/GDPR compliance for AI data flows.

Android development standards for AI agent implementation. Kotlin-first, Jetpack Compose UI, MVVM + Clean Architecture, Hilt DI, comprehensive security, testing, and performance patterns. Use when building or reviewing Android applications...

Use when designing or building HTTP APIs — spec-first OpenAPI workflow, REST conventions, versioning, auth model, rate limiting, idempotency keys, error envelope, and observability notes. Produces the OpenAPI contract plus error/auth/idempotency/observability artifacts that frontend, mobile, security, and reliability skills consume. For endpoint-level security review load `vibe-security-skill`; for GraphQL-specific hardening load `graphql-patterns`.

Use when designing, building, or operating GraphQL APIs with Apollo Server + TypeScript — covers schema-first SDL design, resolver architecture, DataLoader, JWT and directive-based authz, Relay cursor pagination, typed error payloads, federation v2, graphql-codegen, and production hardening (depth/complexity limits, timeouts, persisted queries). Load references/graphql-security.md for hostile-input defence.

Use when designing or implementing a CI/CD pipeline — stage gates, GitHub Actions production patterns (matrix, reusable workflows, environments), OIDC federation to AWS/GCP/Vault, dependency and Docker-layer caching, fan-out/fan-in orchestration, blue/green and canary deployment, pipeline observability (DORA metrics, queue time), and choosing between GitHub Actions and GitLab CI.

Use when running Kubernetes as a platform team — bootstrapping self-managed clusters on Debian/Ubuntu, designing multi-tenant RBAC, enforcing Pod Security and resource quotas, and operating cluster lifecycle (upgrades, certs, etcd, ingress, cert-manager, metrics-server). Self-managed first, cloud-managed second.

Use when administering ArcGIS Enterprise or building real-estate-specific GIS features — ArcGIS components, publishing services, security/roles, backup/DR, plus property search, neighbourhood analysis, catchment/isochrones, market heatmaps, and real-estate-SaaS integration.

Use when designing, building, pricing, packaging, or reviewing premium software products, SaaS systems, ERP/POS tools, dashboards, websites, or agency-built applications for executive, enterprise, affluent, high-ticket, or elite buyers. Converts premium marketing, selling, product, UX, pricing, proof, onboarding, and delivery principles into concrete software requirements and quality gates.

Frameworks for defining a compelling product vision and a focused product strategy. Covers the 10 principles of product vision, product strategy principles, OKR technique for product teams, outcome-based roadmaps, product principles, and product...

Pricing strategy for software products and SaaS. Covers value-based pricing, the 3 pricing principles, B2B vs B2C differences, pricing models (per-seat, usage, freemium, tiered, flat-rate), packaging strategy, negotiation frameworks, discounting...

Use when designing the internal admin / back-office console of a multi-tenant SaaS — tenant impersonation (audited, time-boxed), tenant lifecycle controls (suspend/restore/archive/hard-delete), billing operations (refunds, credits, plan overrides), feature-flag overrides per tenant, bulk actions (mass invite, plan migration, region migration), and the audit-log spine that backs all of it. Distinct from the customer-facing super-admin panel in `multi-tenant-saas-architecture`.

Use when designing the entitlements engine that enforces what each plan/tier/tenant can do — feature flags vs entitlements distinction, limits enforcement (seats, API calls, storage, projects, AI tokens), gate placement (UI, API, worker), upgrade-discovery UX, override mechanisms for enterprise contracts, and the runtime that resolves "can this tenant do X right now?" in a few milliseconds.

Use when designing the six core lifecycle email sequences (welcome/onboarding, behavioral/feature-discovery, upgrade/upsell, retention, reactivation, referral) — trigger contracts, branched automation, suppression rules, PQL/churn-risk triggers, and revenue attribution. Built on top of `saas-transactional-email-infrastructure`. Distinct from `tabler-email-templates` (HTML) and `subscription-billing` (raw billing events).