ai-core

Push the current branch to the remote under a speaking branch name derived from the last conventional commit (<type>/<scope>-<description>). Use when the user asks to push their branch, publish their work, push before opening a PR, or push with a meaningful branch name. Hard guard: NEVER pushes the default branch (detected dynamically from origin/HEAD — main, develop, etc.) — if HEAD is on it, a speaking feature branch is carved and switched to first. Sets upstream with -u. Triggers on: "push", "push my branch", "push this", "publish my branch", "push with a good branch name", "push before PR".

End-to-end "send my work to GitHub": commit the current changes as a Conventional Commit, rebase onto the default branch, push under a speaking branch name, and open a GitHub pull request — in one flow. Use when the user wants to ship their work, send changes to GitHub, open a PR from their current changes, "commit push and PR", finalize a feature, or go from dirty working tree to an open PR. Composes the git-commit, git-rebase-branch, git-push-branch, and github-open-pr skills. Absolute invariant: NEVER pushes to the default branch (main, develop, etc.) — always a feature branch and a PR. Triggers on: "send to github", "ship it", "ship this", "open a PR for my changes", "commit push and open a PR", "finalize this feature", "create a PR from my work", "/github-publish".

Update the current branch with its remote counterpart using a rebase (git pull --rebase), keeping history linear and avoiding merge commits. Fetches the branch upstream, replays local commits on top, and handles conflicts (safe automatic resolution for trivial overlaps, asks the user to arbitrate genuine logic conflicts). Use when the user asks to pull with rebase, get the latest remote commits on their branch, update/sync the current branch with its remote, resolve a "your branch is behind" state without a merge commit, or catch up before continuing work. Refuses to run on a dirty working tree (stops and asks to commit or stash first), never force-pushes, never touches git config, and prefers `git rebase --abort` over leaving a broken state. Triggers on: "pull rebase", "git pull --rebase", "get the latest commits", "update my branch from remote", "sync with the remote", "my branch is behind origin", "catch up before I continue".

Generate robust Playwright + TypeScript end-to-end tests for Club Med B2C sites. Use when the user asks to write E2E tests, add coverage for a user journey, or harden a flaky suite. Qualifies the test intent (including reading the repo's docs/ for PRDs and glossaries), then orchestrates five phases — ground selectors on the live site, plan scenarios, write from the grounded contract reusing existing code, prove non-flakiness by repeated cross-browser runs, and review with independent critics.

Rebase the current branch onto the latest default branch (detected dynamically from the remote — main, develop, or whatever origin/HEAD points to), safely. Use when the user asks to rebase, update their branch with the default branch, sync with the default branch, resolve a "branch is behind" state, or before pushing/opening a PR. Protects the default branch: if HEAD is on it, it carves a speaking feature branch from the last commit FIRST and never rebases the default branch itself. Attempts safe automatic conflict resolution and only asks the user to arbitrate genuine conflicts. Triggers on: "rebase", "rebase on main", "update my branch", "sync with main", "my branch is behind", "rebase before pushing".

Generates, validates, and persists a GitHub personal access token (PAT) to .claude/settings.local.json (Claude Code local settings). Use this skill whenever a GitHub token is needed, missing, expired, or must be refreshed — before any task that calls the GitHub API or connects the GitHub MCP server. Triggers on: "generate github token", "create github token", "set up github token", "update github token", "GITHUB_TOKEN missing", "GITHUB_TOKEN not set", "GITHUB_TOKEN expired", "github token invalid", "github authentication", "connect github mcp", "configure github access", or any task that requires GitHub API access and the token is absent or invalid. Works by checking for an existing valid token first, then manual browser login (the primary path — GitHub enforces 2FA), with optional best-effort auto-login if GITHUB_USERNAME/GITHUB_PASSWORD are available. Token is stored in .claude/settings.local.json and auto-injected by Claude Code into every shell session. Browser automation uses the Playwright MCP.

Open a GitHub pull request for the current branch via the GitHub MCP server (mcp__github__create_pull_request). Use when the user asks to open a PR, create a pull request, or submit their branch for review. Derives owner/repo from the git remote, uses the current branch as head and the default branch as base, and builds a title/body from the last commit. If GITHUB_TOKEN is missing or the GitHub MCP is not connected, it invokes the github-authentication skill first, then retries. Never targets main as head. Triggers on: "open a PR", "create a pull request", "open pull request", "submit for review", "PR this branch", "raise a PR".

Renders a validated plan.json into Excel, Markdown, and/or PDF. Replicates the Club Med legacy tracking plan Excel layout with improvements (embedded screenshots, origin/confidence column, target anchor). Triggers: '/tracking-plan-render', 'generate excel from plan', 'exporter le plan de tracking', 'render tracking plan', 'générer le fichier excel du plan'.

GA4 tracking-plan engine. From a Figma link, a DRD (Design Requirement Details), or a live URL, infers trackable moments via the 13 interaction patterns, auto-approves every event with a confidence score, and emits a validated plan.json plus a review markdown. Triggers: '/tracking-plan', 'create a tracking plan', 'plan de marquage', 'plan de tracking', 'GA4 plan for this figma', 'tracking plan from this DRD', 'plan de tracking depuis un DRD', 'what should we track on this page', 'tracking plan for this figma'.

Generate developer-ready specs (US enrichies) from a PRD document. Reads docs/specs/prd/ and cross-references docs/specs/drd/ design files to produce structured markdown specs in docs/specs/. Each spec is sized for an AI developer to implement in under 2 hours and contains: description, context & objectives, user story (AS A / I WANT / IN ORDER TO), exhaustive business rules, Figma links + screenshots, feature flag, data contract placeholder, and open questions. Use this skill whenever the user says: "/spec", "generate specs", "create specs from PRD", "découper en specs", "créer des specs", "générer des specs", "spec from PRD", or starts work on a PRD file. Also triggers when the user mentions a specific PRD by name or number (e.g. "PRD01", "le PRD des activités") and wants to turn it into actionable developer specs.

Figma REST client — fetches node metadata, auto-layout with css_hints, sub-frame hierarchy, INSTANCE children (variants, visual_signatures, designer_notes), texts with font_class, image fills with local_path, icon SVGs, hidden layers, carousel signals, list item shapes, interactions, and component descriptions.

Generates, validates, and persists a Figma personal access token to .claude/settings.local.json (Claude Code local settings). Use this skill whenever a Figma token is needed, missing, expired, or must be refreshed — before any task that calls the Figma API. Triggers on: "generate figma token", "create figma token", "set up figma token", "update figma token", "FIGMA_TOKEN missing", "FIGMA_TOKEN not set", "FIGMA_TOKEN expired", "figma token invalid", "figma authentication", "configure figma access", or any task that requires Figma API access and the token is absent or invalid. Works by checking for an existing valid token first, then auto-login with FIGMA_USERNAME/FIGMA_PASSWORD if available, otherwise falls back to manual login — no manual copy-paste required. Token is stored in .claude/settings.local.json and auto-injected by Claude Code into every shell session.

Fetch a Jira ticket and write its full structured content to disk (.jira/<KEY>/). Extracts all standard fields, all custom fields present on the issue, attachments, and linked assets (Figma URLs, images, files). Use this skill whenever the user mentions a Jira ticket key (e.g. SHOP-123, LBE-456, LCA-789), pastes a Jira URL (atlassian.net/browse/...), says "fetch the ticket", "pull the Jira issue", "get the ticket", "show me the ticket", "read the Jira", or needs to start working on a ticket. Also triggers when the user mentions ticket context like "the acceptance criteria", "the business rules from the ticket", "the Figma from the ticket", "what does the ticket say about X", or any phrase that implies reading a Jira issue.

API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Comprehensive guidance for implementing asynchronous Python applications using asyncio, concurrent programming patterns, and async/await for building high-performance, non-blocking systems.

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls. Use for Dockerfile security reviews, container CVEs, image scanning, distroless images, or production hardening.

Master database schema and data migrations across ORMs (Sequelize, TypeORM, Prisma), including rollback strategies and zero-downtime deployments.

Master Django 5.x with async views, DRF, Celery, and Django Channels. Build scalable web applications with proper architecture, testing, and deployment.

Build resilient applications with robust error handling strategies that gracefully handle failures and provide excellent debugging experiences.

Build high-performance async APIs with FastAPI, SQLAlchemy 2.0, and Pydantic V2. Master microservices, WebSockets, and modern Python async patterns.

GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper controls, clients can craft queries that bring down your server.

Master Java 21+ with modern features like virtual threads, pattern matching, and Spring Boot 3.x. Expert in the latest Java ecosystem including GraalVM, Project Loom, and cloud-native patterns.

Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes.

Next.js App Router principles. Server Components, data fetching, routing patterns.

Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying.

Build production-ready monitoring, logging, and tracing systems. Implements comprehensive observability strategies, SLI/SLO management, and incident response workflows.

PostgreSQL database optimization workflow for query tuning, indexing strategies, performance analysis, and production database management.

You are an expert in Prisma ORM with deep knowledge of schema design, migrations, query optimization, relations modeling, and database operations across PostgreSQL, MySQL, and SQLite.

Diagnose slow React components and suggest targeted performance fixes.

Modern React patterns and principles. Hooks, composition, performance, TypeScript best practices.

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.

Static Application Security Testing (SAST) for code vulnerability analysis across multiple languages and frameworks

Expert Terraform/OpenTofu specialist mastering advanced IaC automation, state management, and enterprise infrastructure patterns.

Jest testing patterns, factory functions, mocking strategies, and TDD workflow. Use when writing unit tests, creating test factories, or following TDD red-green-refactor cycle.

TypeScript and JavaScript expert with deep knowledge of type-level programming, performance optimization, monorepo management, migration strategies, and modern tooling.

Install and configure Trident UI component library for Vite and Next.js projects

Find and use icons from the @clubmed/trident-icons library. Use when a user asks which icon to use for a given concept, writes <Icon name= without knowing the right name, mentions "@clubmed/trident-icons", asks "quelle icône pour X", "which icon for Y", "find me an icon", "what icon represents Z", "liste les icônes de transport", or needs import code for Trident icons. Also triggers when writing or reviewing a component that should display an icon from the Club Med design system.

Audit RGAA 4.1.2 accessibility on live pages using a sitemap or URL list. Uses Playwright to render each page, injects axe-core for automated checks, and runs custom DOM queries for RGAA-specific criteria. Triggers on: "audit the site accessibility", "check a11y on production", "run RGAA audit", "accessibility audit from sitemap", "check deployed pages for WCAG", "audit live site", "run axe on the site", or when the user provides a sitemap URL or a list of URLs to audit. Complements a11y-web (static) with runtime checks: real contrast ratios, rendered landmarks, focus order, dynamic content.