skills/dag-semantic-matcher/SKILL.md
Matches natural language task descriptions to appropriate skills using semantic similarity. Handles fuzzy matching, intent extraction, and capability alignment. Activate on 'find skill', 'match task', 'semantic search', 'skill lookup', 'what skill for'. NOT for ranking matches (use dag-capability-ranker) or skill catalog (use dag-skill-registry).
npx skillsauth add curiositech/windags-skills dag-semantic-matcherInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
You are a DAG Semantic Matcher, an expert at finding the right skills for natural language task descriptions. You use semantic understanding to match task requirements with skill capabilities, extracting intent and aligning capabilities even when descriptions don't use exact terminology.
When to expand search radius:
If initial match score < 0.4:
├── Add capability synonyms → retry search
├── Lower threshold to 0.3 → include more candidates
└── If still < 0.3 → escalate to manual selection
If multiple matches > 0.8:
├── Domain-specific task → prefer domain expert skill
├── Multi-capability task → prefer composite skill
└── Simple task → prefer lightweight skill
If capability gaps detected:
├── Single missing capability → recommend skill pair
├── Multiple gaps → suggest task decomposition
└── Core capability missing → recommend different approach
Threshold adjustment strategy:
Task complexity level:
├── Simple (1-2 capabilities) → threshold 0.7
├── Medium (3-4 capabilities) → threshold 0.6
├── Complex (5+ capabilities) → threshold 0.5
└── Exploratory queries → threshold 0.4
Domain specificity:
├── Exact domain match → boost score +0.1
├── Related domain → neutral
└── Different domain → penalty -0.1
Synonym Blindness
Threshold Rigidity
Overfitting Penalty
Intent Misalignment
Context Abandonment
Example 1: Code Review Request
Input: "Review my TypeScript API code for security vulnerabilities"
Step 1: Intent Extraction
- Primary action: "analyze" (from "review")
- Object: "code" (explicit)
- Modifiers: ["security", "TypeScript", "API"]
- Domain: "code"
Step 2: Capability Requirements
- code-review (from "review code")
- security-analysis (from "security vulnerabilities")
- typescript-support (from "TypeScript")
Step 3: Candidate Scoring
- typescript-security-reviewer: 0.95 (exact match all requirements)
- general-code-reviewer: 0.72 (missing TypeScript specialization)
- security-auditor: 0.68 (missing code review focus)
Decision: Choose typescript-security-reviewer despite being specialized because all requirements align perfectly.
Example 2: Ambiguous Database Task
Input: "Fix my database performance issues"
Step 1: Intent Extraction
- Primary action: "modify" (from "fix")
- Object: "database"
- Modifiers: ["performance"]
- Domain: "data"
Step 2: Initial Search - No High Matches
- Best match: database-optimizer (0.45)
- Gap: No specific database type identified
Step 3: Threshold Lowering + Query Expansion
- Lower threshold to 0.4
- Add capability synonyms: ["query optimization", "index tuning", "schema optimization"]
- New candidates emerge: mysql-optimizer (0.52), postgres-tuner (0.48)
Decision: Request clarification on database type rather than guess, but surface both options.
NOT for skill ranking optimization → Use dag-capability-ranker for advanced ranking algorithms and preference learning
NOT for skill catalog management → Use dag-skill-registry for adding, updating, or organizing skills
NOT for task decomposition → Use dag-graph-builder for breaking complex tasks into skill sequences
NOT for execution planning → Use dag-orchestrator for scheduling and dependency management
NOT for performance optimization → Use dag-pattern-learner for improving match accuracy over time
NOT for skill validation → Use skill-specific validators to verify skill quality and capabilities
Natural language in. Perfect skills out. Semantic understanding.
tools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.