arena

This skill should be used when the user asks to query Logfire logs, inspect Logfire traces, fetch SQL trace data, get spans for a trace, inspect LLM spans, inspect tool calls, or check token usage from Logfire. Also use it to triage an ARENA spawn run — diagnose why a run failed, timed out, or took too long, get per-stage turns/cost/tokens, or compare a prod trace to a local one.

This skill should be used when the user asks to spawn or generate an ARENA lab from a spec, run a spec through the pipeline, run several specs in parallel, bring up / start up a generated lab's Docker container for inspection, or find and run a finished run's image.

Add a single supporting (non-vulnerable) feature to a working ARENA skeleton app — a catalog, detail page, profile, order history, cart, etc. Triggered when the prompt contains "add-supporting-feature", "ARENA supporting feature", or a Feature block whose vuln is "none". Builds a real, reachable, working page wired into the shared nav. No vulnerability, no solution writeup.

Add a single vulnerable feature to a working ARENA skeleton app. Triggered when the prompt contains "add-vuln-feature", "ARENA feature writer", or a Feature block. Implements the feature and writes a human-readable solution writeup. A usability judge then browser-drives the feature and an exploit verifier independently reproduces the vulnerability against the running lab.

Styling for the build-capable SPA stacks (react-express, vue-fastapi): Tailwind CSS (+ shadcn/ui on React) themed per-run through CSS-variable design tokens. Invoke on these stacks to give each lab a distinctive, coherent, believable-product look that is different every run.

Styling for the server-rendered / no-build stacks (php, vanilla-flask): a token-driven CSS sheet themed per-run by editing one `:root` variable block. Invoke on these stacks to give each lab a distinctive, coherent, believable look — different every run — without a build step.

Turn an ARENA plan into per-feature implementation contracts (feature_contracts.json) so feature authors can run in parallel without colliding. Triggered by "ARENA feature planner" / "plan-features". Writes feature_contracts.json only — no code or builds.

Plan the feature breakdown for an ARENA vulnerable web app from a Spec. Triggered when the prompt contains "ARENA planner", "plan-vuln-app", or a Spec block followed by an instruction to produce plan.json. Produces plan.json only — no code, no Docker, no builds.

Final stage of the ARENA generation pipeline. Crawls the now-complete app, confirms no hint-leaking debug routes were left in, drives the UI with agent-browser, and assembles solution.md from per-feature snippets that the feature stage (or the verifier) already wrote. Then writes manifest.json. Triggered by "sanity-check-vuln-app", "ARENA sanity", or a Sanity block.

Scaffold the empty shell of an ARENA vulnerable web app — copy the stack template, fill in base config (DB connection, seed users, app theme), but DO NOT add any vulnerable features. Triggered when the prompt contains "scaffold-vuln-app", "ARENA scaffold", or a Plan block followed by a scaffold instruction.

Find and embed topically-relevant stock photos in a generated lab — product shots for a catalog, article cover images, profile/team faces, place/venue photos — using keyless, keyword-matched image URLs that resolve in the user's browser. Invoke when a page or feature needs imagery that should *match its content* (a coffee shop shows coffee), not random filler. Triggered by "stock-images", "product photos", or needing real images for a catalog/feed.

PHP (Slim) server-rendered monolith stack (stack id `php`): idiomatic structure, the per-feature fragment-file pattern (route/schema/seed/nav), where features wire in, the shared layout + HTML partials, and the token-CSS styling tool. Invoke when the lab's stack is `php`.

React SPA + Express/Node API stack (stack id `react-express`): idiomatic structure, the per-feature fragment files each feature creates, how those fragments are auto-discovered at boot/build, the multi-stage Docker build, and the Tailwind + shadcn styling tool. Invoke when the lab's stack is `react-express`.

Vanilla JS SPA + Flask stack (stack id `vanilla-flask`): idiomatic structure, the self-contained fragment files each feature creates, where features auto-discover at boot/build, the no-build static serving, and the token-CSS styling tool. Invoke when the lab's stack is `vanilla-flask`.

Vue SPA + FastAPI API stack (stack id `vue-fastapi`): idiomatic structure, the self-contained fragment files a feature drops (auto-discovered at boot/build), where features wire in, the multi-stage Docker build, and the Tailwind styling tool. Invoke when the lab's stack is `vue-fastapi`.

Banking / fintech application palette: variants, pages, entities, and flows for building a varied financial app. Use when theme_preset is banking.

Blog / CMS application palette: variants, pages, entities, and flows for building a varied content app. Use when theme_preset is blog_cms.

DevOps / infra-console palette: variants, pages, entities, and flows for building a varied operations app. Use when theme_preset is devops_dashboard.

E-commerce application palette: variants, pages, entities, and flows for building a varied online-shopping app. Use when theme_preset is ecommerce.

Education / LMS application palette: variants, pages, entities, and flows for building a varied learning app. Use when theme_preset is education_lms.

Events / ticketing application palette: variants, pages, entities, and flows for building a varied ticketing app. Use when theme_preset is events_ticketing.

Procedure for turning a free-form theme into one coherent, specific app domain when no theme_preset applies. Use when the lab's theme is free-text or generic.

Healthcare application palette: variants, pages, entities, and flows for building a varied health app. Use when theme_preset is healthcare.

HR / workforce application palette: variants, pages, entities, and flows for building a varied HR app. Use when theme_preset is hr_portal.

REST API (headless, no UI) palette: variants, resources, entities, and flows for building a varied API. Use when theme_preset is rest_api.

Multi-tenant SaaS workspace palette: variants, pages, entities, and flows for building a varied team-collaboration app. Use when theme_preset is saas_workspace.

Social-network application palette: variants, pages, entities, and flows for building a varied social app. Use when theme_preset is social_network.

Support / ticketing application palette: variants, pages, entities, and flows for building a varied helpdesk app. Use when theme_preset is support_ticketing.

Travel / booking application palette: variants, pages, entities, and flows for building a varied reservations app. Use when theme_preset is travel_booking.

Introspective self-check the ARENA feature writer runs at the end of add-vuln-feature or add-supporting-feature, before reporting done. A checklist of honest yes/no questions about usability, behavior, and hygiene (plus exploit reachability when the feature hosts a vuln) — catch the problems the usability judge and exploit verifier would bounce back, before paying for a verifier round-trip. Triggered by "validate-feature", "validate-vuln-feature", or "ARENA feature self-check".

Shared how-to for driving an ARENA lab's UI with agent-browser. Invoked by the stages that verify a running lab through a real browser — the feature usability judge (verify-feature-usability) and the final sanity sweep (sanity-check-vuln-app). Covers the snapshot/ref loop, sign-in, navigating between views and back, and what a broken or incoherent UI looks like. Triggered by "verify-browser", "drive the UI", or an agent-browser block.

Agentic exploit gate for a single ARENA vuln feature. Independently reproduces the feature's intended vulnerability against the running lab — driving the UI with agent-browser for client-side bugs and curl for server-side bugs — then writes a verdict the orchestrator feeds back to the feature writer. Triggered by "verify-feature-exploit", "ARENA exploit verifier", or an "Intended vulnerability" block.

Agentic usability gate for a single ARENA feature. Browser-drives the running lab with agent-browser to confirm one feature is reachable from the UI, works end-to-end on real data, and behaves like a real product feature — then writes a verdict the orchestrator feeds back to the feature writer. Triggered by "verify-feature-usability", "ARENA usability judge", or a "Feature under test" block.

Score a vendor vulnerability report against a challenge's ground truth. Accepts a report document (md/html/pdf/docx), the challenge solution.md (answer key), and optionally the spec.json (per-vuln difficulty / level). Matches each planted vulnerability against the report and writes a difficulty-weighted report_score.json — each vuln scores its full difficulty weight when found and zero otherwise. Triggered when the prompt sets ARENA_REPORT_TEXT and ARENA_SOLUTION_PATH.