Skill UI

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

Automatically scans code for missing or weak input validation, highlighting potential XSS, SQL injection, or command injection risks so developers can harden their applications during reviews or audits.

Runs external LLM CLIs (OpenAI Codex or Google Gemini) to review uncommitted changes, branch diffs, or specific commits, providing an independent second opinion before merges or releases.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

A workflow for executing implementation plans by spinning up a fresh subagent for each task and enforcing consecutive spec compliance and code quality reviews so the session stays focused and high-quality without manual context switches.

A comprehensive guide detailing the most common and critical mistakes when developing with Supabase. Covers severe security issues (like exposing service role keys or missing RLS), data integrity failures, and performance bottlenecks (connection pooling, N+1 queries). Essential for code review, onboarding new developers, or auditing existing Supabase projects to ensure secure and robust applications.

This comprehensive guide demonstrates how to achieve highly testable Swift code using protocol-based dependency injection. By abstracting external concerns—such as file systems, networking, and external APIs—into small, focused protocols, developers can write deterministic unit tests that mock side effects and error paths, ensuring robust architecture across different environments (App, Test, Preview).

An expert skill designed for writing, reviewing, and refactoring SwiftUI code for iOS and macOS. It provides deep insights into modern state management (@Observable), optimizing view composition, handling data flow, and improving performance. The skill also assists with interpreting Instruments traces and adhering to Apple's latest Human Interface Guidelines.

This comprehensive workflow provides a complete cycle of quality assurance for software development. It covers every stage from defining the test strategy (TDD, Unit Testing) through integration, E2E testing, browser automation, performance profiling, security scanning, and final code review. Use this when setting up robust testing infrastructure or ensuring production-ready software quality.

Configures robust CI/CD pipelines for Vercel projects using GitHub Actions. This guide automates the full deployment lifecycle, including generating preview environments on every pull request, performing reliable production builds upon merging to main, and implementing test gating to ensure code quality before release. Ideal for professional web development workflows.

This comprehensive guide catalogs common anti-patterns and mistakes when deploying applications on Vercel. It covers critical architectural areas such as secret management (preventing key exposure), optimizing serverless function performance (cold start, timeouts), adhering to Edge Runtime standards, and resolving configuration errors. Use this skill for code reviews, security audits, and onboarding new developers to ensure best deployment practices.

A comprehensive guide to configuring Vercel across Development, Preview, and Production environments. Learn how to scope environment variables, manage secrets, and automate multi-stage deployments using both the Vercel CLI and REST API. Covers setting up custom environments (e.g., Staging) and implementing environment detection in code for reliable application behavior.