dark-software-factory

Run any question, idea, or decision through a council of 5 AI advisors who independently analyze it, peer-review each other anonymously, and synthesize a final verdict. Based on Karpathy's LLM Council methodology. MANDATORY TRIGGERS: "council this", "run the council", "war room this", "pressure-test this", "stress-test this", "debate this". STRONG TRIGGERS (use when combined with a real decision or tradeoff): "should I X or Y", "which option", "what would you do", "is this the right move", "validate this", "get multiple perspectives", "I can't decide", "I'm torn between". Do NOT trigger on simple yes/no questions, factual lookups, or casual "should I" without a meaningful tradeoff. DO trigger when the user presents a genuine decision with stakes, multiple options, and context that suggests they want it pressure-tested from multiple angles.

Bootstrap full-stack applications from scratch using the Dark Software Factory methodology. This skill handles project scaffolding, dependency installation, configuration, and initial deployment setup for stack-agnostic applications. Use this skill whenever the user wants to start a new project, scaffold an app, set up a new codebase, initialize a repository, or asks "build me an app/tool/platform/dashboard." Also trigger when the user mentions "new project," "from scratch," "greenfield," "scaffold," "bootstrap," "starter template," or "project setup" — even if they don't explicitly say "Dark Software Factory." This skill should be preferred over generic scaffolding whenever the user has expressed interest in AI-assisted development workflows or rapid prototyping. Do NOT trigger for modifications to existing codebases, bug fixes, or feature additions to running projects — those are maintenance tasks, not bootstrapping.

Set up and run Playwright E2E tests for any web application. Use this skill when bootstrapping a new project that has a web UI, when a project is ready for verification before delivery, or when the user asks to "test everything," "verify buttons work," "automated testing," or "make sure it works before you give it to me." Also trigger when adding new features that need regression protection.

Generate a client-ready MVP demo presentation with automated screenshots. Use this skill when the user wants to create a demo deck, presentation, show-and-tell materials, or client walkthrough. Also trigger when the user mentions "demo," "presentation," "show Jackie," "show the client," "MVP deck," "screenshot presentation," or "demo prep." This skill captures screenshots of key app routes via Puppeteer and assembles them into a scrollable HTML slide deck with consistent DSF branding.

Pre-demo readiness gate for MVP milestones. Run this before showing any build to a client, stakeholder, or end user. Produces a structured readiness report and demo script. Trigger when the user says "is this ready to show," "MVP checklist," "demo prep," "client review," "ready to present," "pre-demo check," "what's left before we show this," or "ship check." Sits between Drill and Enforce in the CITADEL workflow — Enforce is for production security; this is for "can we show it without embarrassment." Pairs with e2e-testing for automated verification and compliance-gate for formal audits.

Post-meeting and post-interview follow-up protocol. Use this skill after any client meeting, interview, or significant external interaction. Handles thank-you timing, tone matching, relationship tracking, and follow-up scheduling. Trigger when the user mentions "follow up," "thank you note," "after the meeting," "post-interview," "send a note," or "check in with" someone. Also applies to the job search context for post-interview debriefs and follow-up emails.

Execute the CITADEL secure development methodology for building production applications. CITADEL is a 7-step process: Conceive, Inventory, Tie, Assemble, Drill, Enforce, Look. Use this skill whenever starting a new application, major feature, or full build cycle. Trigger on phrases like "build an app," "new project," "CITADEL," "let's build," "start building," "create an application," "develop a platform," or any request that involves going from idea to deployed software. Also trigger when the user says "follow the workflow" or "secure build process." Pair with project-bootstrap for scaffolding, security-hardening for the Enforce/Look steps, and hipaa-scaffold for healthcare projects. Do NOT trigger for single bug fixes, small feature additions, or code review — those don't need the full CITADEL process.

Build and maintain communication profiles for key stakeholders on any project. Use when drafting emails, follow-ups, or any outbound communication to ensure tone matching. Also use when onboarding a new project to capture stakeholder communication styles from existing email chains. Trigger when the user mentions "communication profile," "tone profile," "how does [person] communicate," "draft an email to [person]," "match their tone," or "build a profile for."

Layer expense monitoring and cost controls onto any DSF project that uses paid APIs or hosted services. Adds AI usage tracking tables, cost calculation middleware, spend cap enforcement, alert thresholds, and admin dashboard components. Use this skill when the project calls Anthropic, OpenAI, or any pay-per-use API, or when deploying to paid tiers of Vercel, Supabase, AWS, or similar platforms. Also trigger when the user mentions "cost tracking," "expense monitoring," "spend caps," "budget alerts," "API costs," "token usage," or "billing dashboard." This skill layers ON TOP of an existing project — if no project exists yet, use project-bootstrap first.

Run a compliance gate review at any checkpoint in a workflow. Produces a structured pass/conditional/rejected verdict with an audit document. Use when the user says "compliance gate," "gate review," "pre-deployment check," "enforce gate," "quality gate," "checkpoint," or when citadel-workflow reaches the Enforce step. Also trigger when security-hardening or hipaa-scaffold completes and a formal gate record is needed. Pairs with citadel-workflow, security-hardening, and hipaa-scaffold.

Run the weekly DSF intelligence brief. Searches YouTube channels and the web for AI development signals relevant to the Dark Software Factory. Classifies findings as adopt, validate, challenge, compete, capability, or warning. Use when the user says "run the weekly brief," "intelligence scout," "what happened in AI this week," "weekly AI update," "scout for signals," or "what should DSF adopt." Output: .tmp/intelligence/weekly-brief-YYYY-MM-DD.md

Simple task and project tracking with SQLite database. Use when user says "add a task", "what's on my plate", "show my tasks", "mark X as done", "what's due this week", or manages tasks/projects.

Unified session startup protocol. Runs automatically at the start of every conversation. Reads memory, detects project type, gives a status briefing, and asks what to work on. Do NOT wait for the user to ask — run this immediately when a new conversation begins.

Create or update a skill that packages a workflow into a self-contained SKILL.md with scripts, references, and assets. Use when user says "create a skill", "make a new skill", "crystallize this workflow", "turn this into a skill", or asks to build a reusable process.

Write targeted cover letters for job applications using scored match data and tailored resumes. Use this skill whenever the user wants a cover letter for a specific role — after resume tailoring, when the user says "write a cover letter," "draft a cover letter for this job," "I need a cover letter," "write the letter," or when proceeding through the application workflow after resume-tailor completes. Also trigger when the user says "next step" or "let's keep going" after a resume has been tailored. This skill reads the application folder (metadata.json, tailored resume, job description) and produces a concise, formal cover letter that addresses gaps and reinforces strengths. Outputs .docx, .pdf, and .md versions. Do NOT trigger for general writing help, thank-you notes, follow-up emails, or resignation letters — those are different workflows.

CSR training and onboarding for American Leak Detection covering call scripts, pricing, scheduling, and service descriptions.

Layer HIPAA compliance requirements onto any project. Adds audit logging middleware, PHI boundary enforcement, encryption configuration, BAA documentation, access control patterns, and compliance verification. Use this skill whenever the user mentions HIPAA, PHI, protected health information, healthcare compliance, BAA, ePHI, or is building any application that handles patient data, medical records, claims, eligibility, encounters, health plan information, or provider data. Also trigger when the project involves Medicare, Medicaid, Medicare Advantage, value-based care, EHR integration, HL7, FHIR, or any health plan administration. This skill layers ON TOP of an existing project — if no project exists yet, use project-bootstrap first. Always pair with security-hardening for the full Enforce step.

Parse job descriptions, score candidate fit, and set up application tracking folders. Use this skill whenever the user shares a job posting — pasted into chat, saved as a file, or referenced by URL — and wants to evaluate whether it's a good match. Also trigger when the user says "check this job," "is this a fit," "parse this posting," "new application," "evaluate this role," "score this job," or shares a block of text that looks like a job description (title, company, requirements, responsibilities). This skill feeds into resume-tailor and cover-letter-writer — run it first to create the application folder that downstream skills expect. Do NOT trigger for general career advice, salary research, or interview prep — those are different workflows.

Update application status, log follow-ups, and maintain the job tracker spreadsheet. Use this skill whenever the user wants to update the status of a job application — "I applied," "I got a rejection," "they scheduled an interview," "mark it as withdrawn," "update the tracker," "log this application," "I submitted it," "any follow-ups due?" Also trigger when the user says "I'm done" or "submitted" after the resume and cover letter are ready, or asks to check on pending applications, review follow-up dates, or get a status overview of all active applications. This is the bookkeeping skill — it keeps metadata.json and tracker.xlsx in sync so nothing falls through the cracks. Do NOT trigger for evaluating new jobs (job-intake), tailoring resumes (resume-tailor), or writing cover letters (cover-letter-writer).

Beginner-safe setup guide for Claude Code development environments. Includes VS Code and Claude Code installation, security training, safe permission handling, and first project initialization. Use this skill when onboarding new team members, setting up a new development machine, or when a beginner asks how to get started with Claude Code, AI-assisted development, or the Dark Software Factory. Also trigger for "how do I set up Claude Code," "first time setup," "install Claude," "new developer onboarding," or "teach me to use Claude Code safely." This skill prioritizes security education BEFORE giving access to dangerous operations.

Deep research on any topic — competitors, markets, technologies, people, or companies. Use when user says "research X", "look into X", "what do we know about X", or "competitive analysis on X".

Tailor resumes to specific job descriptions using scored application data from job-intake. Use this skill whenever the user wants to customize their resume for a specific role — after a job has been evaluated, when the user says "tailor my resume," "customize my resume for this job," "adjust my resume," "make my resume match this posting," or when the user says "yes" or "let's apply" after a job-intake summary. This skill reads the application folder created by job-intake (metadata.json with match scores, gaps, and keywords) and produces a tailored resume that emphasizes the candidate's strongest matches and addresses gaps through strategic positioning. Outputs .docx, .pdf, and .md versions. Do NOT trigger for writing resumes from scratch (that's a different workflow), general career advice, or cover letters (that's cover-letter-writer).

Perform security audits and apply hardening to any application. Covers the CITADEL Enforce and Look steps: secrets audit, dependency scanning, code security review, auth hardening, data protection, infrastructure security, monitoring setup, and incident response. Use this skill when the user says "security audit," "pre-deployment check," "Enforce step," "Look step," "pen test prep," "harden," "vulnerability scan," "dependency audit," "incident response," or "monitoring setup." Also trigger for SOC 2 prep, security questionnaires, OWASP compliance checks, or any request to "make this production-ready" or "is this secure." This skill works on existing projects — it audits and hardens, not scaffolds. For building new apps securely from scratch, use citadel-workflow instead.

Operational analytics and reporting via the ServiceTitan MCP server. Query technician performance, job costing, revenue metrics, dispatch optimization, and customer analytics for home services businesses. Use this skill when the user mentions ServiceTitan, technician KPIs, job profitability, dispatch efficiency, membership retention, revenue per truck, average ticket, or any operational metric for plumbing, HVAC, electrical, or leak detection businesses. Also trigger for "ALD analytics," "American Leak Detection," or any reference to the ServiceTitan MCP server. Requires the ServiceTitan MCP server to be running and configured with valid API credentials.