Skill UI

Runs Semgrep static analysis with auto language detection, parallel Task subagents, Semgrep Pro checks, and configurable “run all” or “important only” modes to audit codebases for vulnerabilities and bug patterns.

A comprehensive skill to identify, analyze, prioritize, and track technical debt across large codebases. It provides three interconnected tools: a Debt Scanner, a Debt Prioritizer (using cost-of-delay frameworks), and a Debt Dashboard. This system helps engineering teams make data-driven decisions to balance new features with necessary maintenance and refactoring work, ensuring the long-term sustainability of software systems.

This skill simulates a senior documentation engineer, generating highly structured, evidence-based technical documentation. It processes codebases to create comprehensive wiki pages, mandating deep structural analysis, citing specific code paths (file:line), and incorporating mandatory architectural diagrams (Mermaid). Ideal for creating deep-dive system manuals, component guides, and technical deep dives with verifiable sources.

This skill simulates an expert software engineer and systems analyst. It is designed for deep, evidence-based understanding of complex codebases. Users can ask "how does X work" or request architectural reviews, ensuring every claim is grounded in actual code paths, data flows, and dependency chains, following a rigorous multi-iteration process.

This skill provides a structured workflow for porting existing Semgrep security rules to multiple target languages. It guides users through applicability analysis, test-first rule creation, and validation for each language variant, ensuring consistent and accurate security coverage across polyglot codebases.

A systematic skill for identifying similar vulnerabilities and bugs across large, complex codebases. It guides the user through generalizing initial bug patterns using techniques like CodeQL and Semgrep, ensuring comprehensive security audits beyond the initially discovered flaw. Ideal for advanced security research and robust code auditing.

A forensic tool for performing post-mortem analysis on AI-assisted coding sessions. It goes beyond simply stating what was done, determining *why* work deviated (e.g., spec ambiguity, repo friction, agent error), identifying scope creep, and classifying rework patterns. It provides evidence-backed recommendations to improve prompts, codebase health, and future development workflows.

A comprehensive set of specialized tools for deep interaction with source codebases. This context-mode is mandatory for advanced tasks such as running code snippets, analyzing files, batch processing repository commands, indexing knowledge, searching content, and fetching web data. It ensures that interactions are context-aware and highly efficient, moving beyond basic file listing or general chat prompts.

Analyze the gap between project requirements and existing codebase to inform implementation strategy. Evaluates code patterns, identifies missing capabilities, and suggests viable approaches for new features.

This skill runs a comprehensive, sequenced pipeline (Patterns 1-5) to structurally analyze a monolithic codebase. It inventories components, detects domain duplication, resolves hierarchy issues, measures inter-module coupling, and groups components into candidate, domain-aligned services. It is essential for architects planning service extraction, providing actionable metrics and DDD insights before refactoring or splitting the application.

This skill guides developers through creating a comprehensive refactoring plan and serving as a Request for Comments (RFC). It orchestrates detailed interviews, codebase analysis, and scope definition. It ensures the refactor is broken down into tiny, safe, incremental commits, culminating in a structured GitHub issue that serves as a definitive architectural and technical decision document.

This advanced skill performs a full-sweep analysis, providing a unified assessment of code quality across multiple dimensions: code decay, architecture integrity, technical debt, and test coverage. It automatically applies safe fixes directly to the codebase, while requiring confirmation for risky changes. It is ideal for comprehensive pre-release code health audits and automated refactoring.