acaprino/platform-engineering
plugins/platform-engineering/skills/platform-engineering/SKILL.md
Cross-platform development rulebook covering security, architecture, and performance for SPA, PWA, mobile (iOS/Android), and desktop (Electron/Tauri) applications. MUST/DO/DON'T framework with real-world incident references and platform-specific guidance. TRIGGER WHEN: reviewing or building cross-platform apps, checking security posture, validating architecture decisions, optimizing performance, or auditing code against industry standards (OWASP, Core Web Vitals, OAuth 2.1). DO NOT TRIGGER WHEN: the task is purely about UI design, copywriting, or business logic unrelated to platform engineering concerns.
$ install --global
skillsauthnpx skillsauth add acaprino/anvil-toolset platform-engineeringInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 13, 2026, 4:14 AM143.6s14 files scanned
SKILL.md
- name:
- platform-engineering
- description:
- >
- TRIGGER WHEN:
- reviewing or building cross-platform apps, checking security posture,
- DO NOT TRIGGER WHEN:
- the task is purely about UI design, copywriting, or business logic
Cross-Platform Development Rulebook
Three pillars govern every application you ship -- Security, Architecture, and Performance. Each rule is tagged with severity (MUST/DO/DON'T) and platform applicability.
Quick Platform Decision Matrix
| Concern | SPA | PWA | Mobile | Electron | Tauri | |---------|-----|-----|--------|----------|-------| | Auth token storage | JS memory + httpOnly cookies | JS memory + httpOnly cookies | Platform Keychain/Keystore | OS credential store | OS credential store | | OAuth flow | Auth Code + PKCE | Auth Code + PKCE | System browser + PKCE | Standard PKCE | Standard PKCE | | XSS impact | Session hijack | + persistent SW hijack | WebView bridge access | XSS to RCE | Limited to web context | | CSP | Critical | Critical | WebViews only | Critical | Relevant | | Offline strategy | Optional | IndexedDB + Cache API + SW | Room/CoreData + sync queue | Optional | Optional | | Bundle target | <170KB compressed JS | <170KB compressed JS | <20MB APK/IPA | 80-150MB (Chromium) | <10MB total | | API style | REST or GraphQL | REST (SW caching) | GraphQL (fewer round-trips) | REST (server-side aggregation) | REST | | State management | Zustand/Redux + TanStack Query | IndexedDB + Cache API | ViewModel+StateFlow / SwiftUI | IPC + context isolation | Rust invoke commands |
When to Load References
- Security review or audit: Load
server-validation,auth-tokens,passkeys-webauthn,api-security,xss-csp,secrets-management,platform-security - Architecture decisions: Load
client-server-architecture,api-design,offline-first,infrastructure - Performance optimization: Load
frontend-performance,backend-and-platform-performance - Full platform review: Load all 13 references
Reference Materials
Security (Part 1)
- server-validation.md -- Server-side validation rules, trust boundaries, real-world bypass incidents
- auth-tokens.md -- Token storage per platform, OAuth 2.1 flows, JWT best practices, secure storage APIs
- passkeys-webauthn.md -- WebAuthn Level 3 / passkey patterns, server-side verification, cross-platform support, cloned-authenticator detection
- api-security.md -- Endpoint auth, rate limiting, CORS, OWASP API risks, Peloton/Parler case studies
- xss-csp.md -- XSS severity by platform, CSP directives, anti-CSRF, sanitization, British Airways incident
- secrets-management.md -- Secret exposure risks, environment variables, vault services, GitGuardian stats
- platform-security.md -- Mobile (Keychain/Keystore, cert pinning), Electron (nodeIntegration, contextIsolation, sandbox), Tauri (deny-by-default), PWA (service worker scope, Cache API risks), security headers matrix
Architecture (Part 2)
- client-server-architecture.md -- Thin client principle, BFF pattern, server-authoritative design
- api-design.md -- REST vs GraphQL trade-offs by platform, pagination strategies, state management per platform
- offline-first.md -- Conflict resolution strategies (LWW, CRDTs, OT), optimistic UI, sync patterns
- infrastructure.md -- Monolith-first principle, database access patterns, CI/CD pipelines per platform, observability, feature flag lifecycle
Performance (Part 3)
- frontend-performance.md -- Bundle size optimization, image formats and responsive loading, Core Web Vitals (LCP, INP, CLS) with business impact data
- backend-and-platform-performance.md -- API/DB performance (pagination, indexing, connection pooling), mobile battery/memory, SSR/SSG/ISR rendering strategies, CDN caching patterns
Related Skills
acaprino/review-quality-gates
development
VerifiedTrustedCommunity
Quality gates for multi-reviewer code review pipelines: adversarial verification panel, completeness critic, reviewer pipeline conventions, and the context sharing pattern for parallel reviewers. TRIGGER WHEN: running /senior-review:team-review quality gates; running /senior-review:code-review Steps 4b/4c (adversarial verification and completeness check); consolidating or deduplicating findings from multiple parallel reviewers. DO NOT TRIGGER WHEN: single-reviewer style review without a consolidation phase, or generic team coordination (the upstream agent-teams skills cover that).
6SKILL.mdUpdated Jul 28, 2026
acaprino/abstraction-architect
development
VerifiedTrustedCommunity
Knowledge base for pure-architecture decisions on when to unify duplicated logic into a shared abstraction versus leave it duplicated. Covers the canonical theory (Rule of Three, DRY/WET/AHA, Wrong Abstraction, Locality of Behaviour, Bounded Contexts, Tidy First options framing, CUPID vs SOLID), 12 essential-duplication patterns that justify unification, 12 wrong-abstraction patterns that justify inlining or decomposition, an operational decision frame, and a verified reading list. TRIGGER WHEN: the user is making an architectural decision about whether to centralize, extract, or remove a layer; reviewing an abstraction for premature generality; auditing scattered cross-cutting concerns; spawned by the abstraction-architect agent during /abstraction-architect:audit or as the Abstraction dimension of /senior-review:team-review or /senior-review:code-review; the user asks "should I extract this into a service" / "is this DRY enough" / "is this wrong abstraction". DO NOT TRIGGER WHEN: the task is code formatting and readability cleanup (use clean-code:clean-code), Python-specific refactoring with metrics (use python-development:python-refactor), generic dead-code removal (use senior-review:cleanup-dead-code), security review (use senior-review:security-auditor), or pure pattern-consistency review without an architecture lens (use senior-review:code-auditor).
6SKILL.mdUpdated May 26, 2026
acaprino/frontend-css
development
VerifiedTrustedCommunity
Unified web frontend knowledge base covering CSS architecture, UX psychology, UI components, distinctive aesthetics, and interface design generation. TRIGGER WHEN: working on web styling, design systems, component decisions, responsive strategy, distinctive frontend aesthetics, or exploring multiple interface designs. DO NOT TRIGGER WHEN: the task is purely backend or unrelated to web frontend.
6SKILL.mdUpdated May 13, 2026
acaprino/stripe
development
VerifiedTrustedCommunity
Stripe payments knowledge base - API patterns, checkout optimization, subscription lifecycle, pricing strategies, webhook reliability, Firebase integration, cost analysis, and revenue modeling. Loaded by stripe-integrator and revenue-optimizer agents; also consumable directly when the user asks for Stripe-specific patterns without needing an agent. TRIGGER WHEN: working with Stripe API (Payment Intents, Customers, Subscriptions, Checkout Sessions, Connect, webhooks, tax, usage-based billing), pricing strategy, or revenue modeling. DO NOT TRIGGER WHEN: payment work is non-Stripe (PayPal, Square, crypto) or the task is generic e-commerce unrelated to payments.
6SKILL.mdUpdated Apr 20, 2026