
Orchestrates test-driven fixes for Mattermost security tickets (Jira/Atlassian) with a Staff Security Engineer mindset: failing secure-behavior tests first, then implementation, then security review and edge-case loops, then opening a non-draft PR that follows `.github/PULL_REQUEST_TEMPLATE.md` when present, with a vague public description (no exploit detail). Use when the user invokes /security-fix:security-fix with a mattermost.atlassian.net browse URL, MM-* security work, backend permission or authorization bugs, or asks for this security TDD workflow.
Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Focuses on recently modified code unless instructed otherwise.
Resolve git merge conflicts by analyzing change intent across branches. Use when the user asks to resolve merge conflicts, sync a branch, merge branches, or when a git merge produces conflicts.
Translate Figma nodes into production-ready code with 1:1 visual fidelity using the Figma MCP workflow (design context, screenshots, assets, and project-convention translation). Trigger when the user provides Figma URLs or node IDs, or asks to implement designs or components that must match Figma specs. Requires a working Figma MCP server connection.
Discover and run all pre-commit code quality checks (linters, type checks, i18n extraction) in a monorepo, auto-fix failures, and report results. Use when the user asks to run pre-commit checks, validate code before committing, or ensure CI checks pass locally.
Brief description of what this skill does
Orchestrate phased software implementation using a team of engineers. Delegates research, planning, implementation, code review, and QA validation to separate engineers following a pipeline defined in .planning/PLAN.md. Use when the user asks to execute a multi-phase implementation plan, run a team-based development workflow, or implement features using planning/implementation/review stages.
Evaluate the quality and efficacy of existing tests by reviewing test code against source code. Use when the user asks to review tests, validate test quality, audit test suites, check test efficacy, or assess whether tests are testing things properly. Prioritizes real interactions over mocking and simulation.
Update Mattermost plugin repositories with common files from mattermost-plugin-starter-template and fix all linter issues. Use when syncing build tooling, updating golangci-lint config, or fixing linter errors in a Mattermost plugin.
--- name: update-github-actions description: Update all GitHub Actions workflow dependencies (uses: owner/action@vX) to their latest released versions. Fetches current releases from GitHub, updates all workflow YAML files to use SHA pinning with version comments, and commits. user-invocable: true disable-model-invocation: true allowed-tools: Read, Write, Edit, Bash, Glob, Grep, WebFetch, mcp__github-server__list_commits --- # Update GitHub Actions Dependencies Scan all `.github/workflows/*.yml
Audit and improve CLAUDE.md files in repositories. Use when user asks to check, audit, update, improve, or fix CLAUDE.md files. Scans for all CLAUDE.md files, evaluates quality against templates, outputs quality report, then makes targeted updates. Also use when the user mentions "CLAUDE.md maintenance" or "project memory optimization".
Investigate production issues, query logs and metrics, and explore dashboards on the Mattermost Grafana instance at grafana.internal.mattermost.com.
Brief description of what this skill does
Update all direct Go module dependencies to their latest versions, tidy the module graph, verify tests pass, and commit the result. Use when you want to bump deps, address CVEs, or do routine dependency maintenance.
Autonomous issue resolution agent that investigates, plans, and fixes issues using sub-agents and browser-based validation. Use when the user provides one or more issues to resolve autonomously, wants hands-off debugging and fixing, or needs an orchestrated investigate-plan-execute-validate workflow.
Analyze Mattermost schema migrations against best practices and generate a review report. Pass a migration number/name as argument or omit to auto-detect new migrations.
Backfill realistic test data into a Mattermost server using the Mattermost MCP tools. Creates users, teams, channels, and natural conversations. Use when the user asks to populate a Mattermost instance, create test data, set up a demo environment, seed conversations, or backfill a Mattermost server. Also provides guidance on reading, searching, and interacting with Mattermost via MCP tools.
Create a new Mattermost plugin from the starter template in the current directory. Use when creating a new plugin from scratch, scaffolding a Mattermost plugin, or bootstrapping a plugin project.
Analyze a GitHub pull request for risk level and generate concrete QA recommendations. Accepts a PR URL or "owner/repo#number" reference. Uses `gh` CLI to fetch the diff and metadata, computes blast radius, scores six risk dimensions, and returns a structured JSON risk assessment. Use when the user invokes /qa-analysis:qa-analysis with a GitHub PR URL or reference, or asks for a PR risk assessment, QA recommendations, or "what should I test?" for a given pull request.
Add an MCP (Model Context Protocol) server to a Mattermost plugin so the Agents plugin can call its tools. Use when implementing cross-plugin MCP, exposing AI tools from a Mattermost plugin to the Agents plugin, or wiring up the `pluginmcp` helper from mattermost-plugin-agents.
Update the Go version in go.mod (and related config files) to the latest stable release. Fetches the current latest version from the web, updates all relevant files, runs go mod tidy, and commits.