
Forces the agent to act with a Claude-like product mindset, prioritizing user journey, UX states, and visual quality before coding.
Enforce and manage DESIGN.md specifications, extract design systems from URLs, and combine design reasoning with token roles to prevent drift.
Create, optimize, critique, and structure prompts for AI systems. Use this skill whenever the user is designing or improving a prompt, system prompt, coding prompt, image prompt, evaluation rubric, agent prompt, workflow prompt, or MCP-oriented prompt package. Also use it when the user asks to turn vague AI behavior into a precise instruction set, tool policy, agent spec, or prompt architecture.
Assumption-first architecture review skill to stress-test project plans and expose hidden risks.
Analyzes existing queries and schema to detect missing indexes. Suggests covering and composite indexes to optimize slow queries.
Analyze multi-step tasks to identify which steps can run in parallel, build dependency graphs, detect conflicts (write-write, read-write, resource contention), and produce optimized execution plans. Triggers on 3+ independent steps, 'speed up', 'run simultaneously', 'parallelize', 'optimize' or any task where sequential execution wastes time.
Designs and configures PgBouncer connection pooling for PostgreSQL based on actual workload analysis. Calculates optimal pool sizes using server capacity formulas, selects the correct pooling mode (session/transaction/statement) based on ORM compatibility, generates production-ready pgbouncer.ini and docker-compose.yml, audits active CVEs, and validates ORM-specific constraints. Trigger when: pgbouncer setup, connection pooling, too many connections, max_connections exceeded, connection pool sizing, pgbouncer config, database connections scaling, pool mode selection, or any mention of PgBouncer in a PostgreSQL context. Part of database-ecosystem.
Defines and enforces query resource limits. Detects which queries scan too many rows, inflate memory usage, or exceed execution budgets.
Translates execution plans (EXPLAIN ANALYZE) into human-readable language. Explains why Seq Scan is bad and when Hash Join is optimal.
Detects schema differences between environments (dev vs staging vs prod). Generates actionable migration paths instead of just diff lists.
Create and resume from session handoff documents for seamless AI agent session transfers. Triggers on save state, create handoff, I need to pause, context is getting full, load handoff, continue where we left off. Solves long-running agent context exhaustion by preserving complete context across sessions.
Break down large, complex, or ambiguous tasks into independent subtasks with dependency maps, execution order, and success criteria. Plan first, then execute step by step. Triggers on 'how should I do this', 'where do I start', 'plan the project', 'break it down', 'implement' or whenever a task involves multiple phases.
Architects the provider side of the webhook infrastructure. Not only sends data but designs event schemas and robust delivery mechanisms.
Expert Coolify management skill for self-hosted infrastructure. Deploy, manage, provision, and debug services, handle environment variables, and automate workflows with or without MCP.
Designs and implements row-level security (RLS), column-level masking, and role-based access control policies (RBAC/ABAC).
Protects LLM agent systems in real-time with a 5-tier filter (hash cache, rule engine, ML classifier, LLM judge, human approval) and an async learning engine. Synthesizes new rules from every detected attack, adding less than 50ms latency. Trigger on 'add security layer', 'prevent prompt injection', 'adaptive guard', 'runtime protection', or 'agent security'.
After an agentic task completes, perform a retrospective analysis across 6 dimensions (goal alignment, efficiency, decision quality, error handling, communication, reusability). Score performance, identify inefficiency patterns, evaluate skill usage, and produce actionable improvement recommendations. Triggers on 'how did it go', 'retrospective', 'review performance', 'what could be better', or after any long agentic task completes.
Overrides the agent's behavior to enter an interactive, consulting mode. Instead of guessing or immediately executing a task, the agent will analyze the request and ask guiding, targeted questions to clarify intent, constraints, and requirements first.
Determines whether to use API keys, JWT, OAuth2, or mTLS. Designs token lifespans, refresh token strategies, and secure session management.
Analyzes commit history, PR descriptions, and spec changes to automatically generate developer-friendly API changelogs.
Automatic risk assessment before every critical action in agentic workflows. Detects irreversible operations (file deletion, database writes, deployments, payments), classifies risk level, and requires confirmation before proceeding. Triggers on destructive keywords like deploy, delete, send, publish, update database, process payment.
Compress long conversation histories, large code files, research results, and documents by 70% without losing critical information. Triggers when context window fills up, when summarizing previous steps in multi-step tasks, before loading large files into context, or on 'summarize', 'compress', 'reduce context', 'save tokens'.
Masks production data for test and development environments (Data Masking). Detects PII (email, SSN, credit cards) and obfuscates them safely.
Design and implement Universal Links (iOS) and App Links (Android) architectures. Plan URL schemas, manifest/entitlement configurations, domain validation, fallback strategies, and test scenarios.
Comprehensive map and workflows for the Mobile domain. Triggers when users ask to 'design a mobile app', 'mobile architecture', 'audit the app before launch', 'prepare for release', or 'view the mobile ecosystem'.
Comprehensive map for multi-brain, orchestration, and agent governance. Triggers when users ask to 'view the orchestration ecosystem', 'how do agents work together?', 'multi-brain workflows', or 'give agents access'.
Three-layer security ecosystem for Agent Platforms covering pre-deployment skill auditing, real-time message protection (adaptive-guard), and continuous adaptive defense. Coordinates security-auditor and adaptive-guard. Trigger on 'security ecosystem', 'agent security', 'skill protection', or 'runtime defense'.
When a step fails during an agentic task, classify the error (transient, configuration, logic, or permanent), apply the right recovery strategy, and escalate to the user when all strategies are exhausted. Triggers on error messages, exceptions, tracebacks, 'failed', 'not working', 'retry', or when 2 consecutive steps fail.
Compiles and extracts session knowledge into a living, interconnected LLM-Wiki. Instead of writing isolated logs, it identifies key entities, updates cross-referenced topic files in docs/knowledgelib/, and maintains an index and chronological log. Use this to ensure persistent, compounding project knowledge.
Maintain a structured ledger of decisions, discovered bugs and fixes, user preferences, constraints, current status, and failed approaches throughout multi-step agentic tasks. Auto-update after every significant step. Triggers on 'where were we', 'continue', 'summarize status', 'remember', or when a new agent instance takes over a task.
Manages major schema changes with zero-downtime using the expand-contract pattern, rather than writing unstable from-scratch migrations.
Evaluate mobile app performance holistically across cold start time, FPS drops, memory leaks, battery drain, and bundle size. Interpret profiling data and pinpoint platform-specific bottlenecks.
Design local-first architectures and offline sync strategies. Determine conflict resolution policies, implement optimistic UI updates, and architect robust background data synchronization.
Derives the database schema from business requirements. Selects optimal normalization levels (1NF->3NF->BCNF) and prevents God tables.
Evaluate every produced output (code, report, plan, data, API response) against type-specific quality criteria, score 1-10, make accept/reject decisions, and provide actionable improvement suggestions. Triggers on 'evaluate', 'check', 'review', 'quality control', 'is this good enough', 'score it', or before passing output to the next step in an agentic workflow.
--- name: proje-analizcisi description: 'Mevcut bir yazılım projesini derinlemesine analiz eder ve docs/analyze/ klasörüne 3-4 adet kapsamlı rapor üretir. 'Projeyi analiz et', 'kod analizi yap', 'proje inceleme', 'mimari rapor', 'teknik borç', 'proje değerlendirme', 'codebase analiz' gibi ifadeler geçtiğinde tetikle. Proje dizini veya repo URL'i verildiğinde çalışır. API endpoint'leri tespit edilirse otomatik olarak 4. raporu da üretir.' --- # Proje Analizcisi Skill **Çıktılar:** - `docs/analy
Selects the most suitable API protocol (REST, GraphQL, gRPC) based on project requirements like latency, payload size, and real-time needs.
Plan end-to-end push notification strategies using APNs and FCM. Design payloads, define permission request timing, architect silent pushes vs. rich notifications, and structure analytics tracking.
Selects the optimal rate limiting strategy (sliding window, token bucket, leaky bucket) for per-user, per-IP, or global levels.
Generates an idiomatic SDK skeleton for Python, TypeScript, Go, or Kotlin from an OpenAPI spec file. Rather than auto-generated machine code, it designs client code with built-in features like retry/timeout/pagination, at the quality level a real developer would write.
Audits skills or the entire ecosystem for security vulnerabilities, enforces runtime guard rules, and assigns trust scores. Three modes: Audit (static analysis), Guard (runtime protection), Trust (permission mapping). Trigger on skill security, audit skill, is this skill safe, skill trust score, or ecosystem security scan.
Analyzes and enforces security protocols on the skill ecosystem. Operates via Audit, Guard, and Trust modes to prevent malicious commands, PII leakage, and excessive permissions.
Traces the data source (Data Lineage) of any column or table. Identifies views, triggers, stored procedures, and ETL pipelines involved.
Designs realistic API mock servers. Goes beyond happy paths by designing stateful mocks (create order -> get order) for complex integrations.
Architects which metrics to collect, how logs should be formatted, and how distributed tracing should be implemented across boundaries.
Analyze App Store and Play Store rejection reasons, detect guideline violations before submission, and optimize metadata (title, screenshots, description) for store review policies.
Compares two OpenAPI/API specification versions (V1 vs V2) to detect breaking changes and backward compatibility issues.
Design and review web interfaces with trend-aware, performance-conscious, accessible rules. Triggers on design a page, build UI, review my site, audit this page, create a landing page, check my dashboard.
Parse and analyze crash reports from tools like Crashlytics or Sentry. Interpret iOS symbolication and Android ProGuard/R8 mappings, trace stack execution to find the root cause, and propose code-level fixes.
Comprehensive map and workflows for the API domain. Triggers when users ask to 'design an API', 'secure the APIs', 'update endpoints', 'view the API ecosystem', or want to see all available API orchestration skills.
Comprehensive map and workflows for the Database domain. Triggers when users ask to 'design a database', 'optimize query', 'schema architecture', 'database ecosystem', or migrate data.
Two-round debate protocol where perspectives challenge each other before consensus. Round 1 presents independent positions, Round 2 allows counter-arguments and rebuttals. Produces battle-tested decisions for high-stakes choices.
Evaluates mobile app security against the OWASP Mobile Top 10. Implements certificate pinning, secure storage, and reverse-engineering protections.
Replace generic perspectives with domain-specific expert roles selected dynamically per request. Automatically picks the 3 most relevant experts from a role pool (Security, Performance, UX, Cost, DX, Architecture, etc.) based on the task context.
Confidence scoring overlay for multi-brain decisions. Each perspective rates its own confidence (1-10) with justification. Consensus uses scores as weights, flags low-confidence areas, and surfaces uncertainty explicitly.
Evaluate complex requests from 3 independent perspectives (Creative, Pragmatic, Comprehensive), reach consensus, then produce complete outputs. Use for architecture decisions, creative content, analysis, and any task where multiple valid approaches exist.
Design the first-run experience (FRE) for mobile apps. Sequence permission requests, define feature discovery flows, plan empty states, and create retention-focused day 1-3 scenarios.
--- name: project-analyzer description: 'Deeply analyzes an existing software project and generates 3-4 comprehensive reports in the docs/analyze/ folder. Trigger when phrases like 'analyze the project', 'do code analysis', 'project review', 'architecture report', 'technical debt', 'project evaluation', 'codebase analysis' occur. Works when a project directory or repo URL is provided. If API endpoints are detected, it automatically generates a 4th report.' --- # Project Analyzer Skill **Output
Analyze, repair, migrate, and scaffold @xyflow/react codebases. Use when users ask to debug React Flow behavior, fix node/edge state wiring, improve type safety or performance, upgrade legacy React Flow APIs, preserve persisted graph compatibility, or generate a complete React Flow starter from scratch.
Manage the mobile release lifecycle. Produce version bumps, changelog generation, TestFlight/Internal Track submission strategies, and staged rollout plans. Focuses on release management decisions, not CI/CD pipeline setup.
Orchestrates the Security Ecosystem by running security-auditor and adaptive-guard in the correct order. Manages audit phases, trust scoring, guard activation, incident response, and calibration. Trigger on 'security orchestrator', 'run security', 'audit and guard', or 'security workflow'.
Generates realistic test data preserving referential integrity. Reads schemas, foreign keys, and builds relationships.
Analyzes and compares existing skills from any source (skills.sh, GitHub, Claude marketplace, or local files) against a target skill or requirement. Fetches skill content, evaluates it across 10 dimensions, produces a structured comparison table, identifies gaps, and recommends whether to adopt, adapt, or build from scratch. Trigger when: analyze this skill, compare skills, is this skill good enough, what does this skill do, skill evaluation, should I use this skill, skill gap analysis, paste a skills.sh URL, GitHub skill URL, or upload a SKILL.md file for review.
Expert SQLite guidance for modern full-stack and AI projects. Use when user mentions sqlite, sqlite3, bun:sqlite, better-sqlite3, aiosqlite, libsql, Turso, Cloudflare D1, WAL mode, FTS5, sqlite-vec, or asks about local/embedded databases, schema design, SQLite migrations with Drizzle or raw SQL, performance tuning, backup/restore, and building stateful CLI with SQLite.
Ensure mobile app UI complies with iOS VoiceOver, Android TalkBack, and WCAG mobile criteria. Detect missing labels, contrast issues, and propose accessible alternatives.
Before executing a task, analyze the available tool set (web search, code execution, file read/write, API calls, database queries, memory tools), select the optimal tools, plan execution order, and prevent unnecessary tool calls. Triggers on multi-step tasks, 'which tool should I use', 'plan the tools', or whenever multiple tools could apply.
Before starting a task or taking a critical step, surface and verify the assumptions the agent is making. Checks 4 types - technical (libraries, APIs), data (files, formats), business logic (rules, scope), and user intent (what the user actually wants). Triggers on ambiguous requests, multi-step tasks, or whenever 'are you sure', 'check first', 'don't assume' appears.
Design and implement secure APIs and integration points for external AI bots and agents (OpenAI tool-calling, LangChain, OpenClaw). Use this skill whenever the user mentions agent integrations, tool manifests, bot API access, OAuth2 scopes for bots, webhook integrations, or designing endpoints for agentic workflows. Also trigger when users ask about securing bot writes or designing APIs for AI-powered automation.
Writes OpenAPI/AsyncAPI specifications before writing any code. Determines provider-consumer contracts and endpoint definitions early.