Coding & Development

Safety-check a GitHub repo BEFORE downloading, installing or running it. Use whenever the user pastes a github.com link (or owner/repo) and asks if it is safe, legit, malicious, sketchy, or worth trusting, or says "check this repo", "is this safe to run", "vet this". Downloads the repo as a ZIP without running anything, scans it for malware patterns, reviews the flagged files, and gives a plain-English verdict plus safe-run advice.

Oral exam on a code change before you merge or adopt it. Use when someone is about to own code they did not fully write (agent output, a teammate's branch, a vendored patch) and says "quiz me on this diff", "make sure I understand this before I merge", "comprehension check", or "viva this PR". Picks risky anchors from the diff, asks one closed-book question at a time, marks answers strictly, and issues an OWNED / NOT_YET / INTENT_MISMATCH receipt. Not for finding bugs line by line, and not for learning a topic from scratch.

Use when deciding how something should be structured: designing a new architecture, API, data model, system (scale, reliability) or module boundary, or judging whether an existing structure, model, layout or process is the right design and how it should change ('is this the best design', 'evaluate our X', 'should we reorganise'). Also whenever choosing between real alternatives. Triggers: 'design this', 'architecture', 'API design', 'data model', 'schema', 'is this the best', 'evaluate the design', '设计一下', '架构', '方案对比', '是不是最佳', '评估一下', '该怎么改'. NOT for visual UI design or a defect-only audit.

Review PRs, code, specifications, documents, claims, or prior reviews through evidence-bounded verification, reader comprehension, and falsification. Use when the user invokes Baker Street or asks to put an artifact before the agency. Supports triage, focused, and standard investigations; checked repairs and probe graduation; and authorized implementation or publication. Accept scope, budget, destination, plain voice, and --cross-examine, --case-branch, --publish-case, --post-pr, --heal, or --publish-repair instructions.

Explicit-only orchestration for a repository bug fix, feature, refactor or other change on one cheap worker model (Haiku on Claude Code, Luna on Codex) with effort-only escalation, parallel batches and evidence-based acceptance. Invoke it by name; it is never applied automatically. For an ordinary change with no cost, speed or parallelism preference, escalating-subagents is the usual choice.

Audita e ajusta a performance de qualquer PC Windows para jogo competitivo (stutter, 1% low, hitches, latencia, freeze, corte de audio) com metodo medido - inventario de hardware/software/BIOS, captura de frametime com PresentMon, diagnostico CPU vs GPU, catalogo de alavancas para Intel/AMD/NVIDIA/AMD GPU, teste A/B reversivel e congelamento do estado aprovado. Use quando o usuario pedir para otimizar, diagnosticar ou "tunar" um PC de jogo, replicar essa analise em outra maquina ou outro jogo, ou investigar microstutter, FPS instavel, travamentos ou latencia.

Apply a six-phase defensive security review to changes affecting applications, APIs, data, AI agents, and MCP configuration. Use static evidence, preserve behavior, and report limitations.

Add a new application to a GitOps-managed Kubernetes cluster (ArgoCD ApplicationSet with one directory per app, External Secrets, Gateway API routes, optional LoadBalancer IPs). Use when scaffolding or onboarding a new app or service that becomes its own ArgoCD application and namespace, or when a newly added app will not sync or its secrets never appear. Covers the safe onboarding order, every whitelist a new namespace needs, image, secret and storage conventions, the alert that tells on-call it is down, and when it is safe to expose publicly.

Audit Supabase Row Level Security from the migrations in a repo. Finds public tables without RLS, tables with RLS and no policies, `using (true)` / `with check (true)` policies, update policies that let users change their own plan/role/credits columns, views that skip RLS, views over `auth.users`, SECURITY DEFINER functions without a fixed search_path or callable by anon, and public storage buckets. Use when the user asks to check Supabase RLS or policies, before launching a Supabase app, after writing a migration, or when reviewing a Lovable, Bolt or Cursor build that uses Supabase.

Analyzes how an existing Expo or React Native repository does navigation and plans an incremental migration to Expo SDK 58 navigation, Expo Router (React Navigation and react-native-screens) and/or @expo/ui (SwiftUI, Jetpack Compose), behind a feature flag or without one, ending in a clean exit. Also a catalog of navigation patterns with verified status and known gaps - stacks, back interception, tabs, iPad sidebar and collapsible sections, modals, sheets, navbar buttons, overflow menus, large titles, hiding the navbar on tap and scroll, bottom toolbars, Surface Duo, iPhone Duo and foldables. Use when asked to assess an app's navigation, plan a move to Expo Router, React Navigation or @expo/ui, move an existing React Navigation app to more native elements and stable deep links (including a bare app that will not adopt Expo and stays on plain React Navigation), or choose or implement any of these patterns on Expo 58.

Review one pull request or diff so a person's attention lands on the few changes that can hurt production — a ranked "Human review, look here first" map (at most three entries, each with where, why it is dangerous in this diff, what to verify by hand in a minute, and a verdict), then at most five blocker or should-fix findings, no polish. Asks the 3 am question of every hotspot. Use for every pull-request review, before asking a person to approve a PR that touches person-reviewed paths, or when asked where the dangerous parts of a diff are. Not for whole-codebase audits (use review-sweep).

Check and fix a Stripe webhook endpoint. Scans for handlers that act on Stripe events without `constructEvent` signature verification and for signatures checked against a parsed body (`req.json()`, `JSON.stringify`, `express.json()`, a pages/api route with the default body parser), then walks through raw body, idempotency, replay and secret handling. Use when the user writes or reviews a Stripe webhook, asks "is my Stripe webhook secure", gets "No signatures found matching the expected signature", or before launching an app that takes payments.

Operate, program (SCPI over USB/LAN), capture waveforms from, verify and service the Siglent SDS2000X HD 12-bit oscilloscopes (SDS2104X/2204X/2354X/2504X HD): triggers, decode, MSO, FFT, power, Bode, AWG.

Read, analyse and edit Fractal FM3 preset save files (.syx) without FM3-Edit — pull a stored preset over USB, list its grid/blocks/channels/scenes/modifiers and every block parameter, change values, swap block types, rename, retarget to another slot, diff two saves, and push the file back into a slot. Use whenever the user asks to look inside, compare, copy or modify an FM3 preset or .syx, build a patch "by file", or when driving FM3-Edit by desktop control would be too slow.

Expert CLI configuration, review, troubleshooting and cross-vendor migration for routers, switches and firewalls — Cisco (IOS/IOS-XE, NX-OS, ASA, FTD), Fortinet FortiGate (FortiOS), Palo Alto (PAN-OS), Juniper (Junos/SRX/EX), MikroTik (RouterOS), Check Point (Gaia), Huawei (VRP/USG), Aruba/HPE (AOS-CX), Arista EOS, SonicWall, VyOS/EdgeOS, pfSense/OPNsense — plus host and cloud firewalls (UFW, nftables, iptables, Windows Firewall, AWS Security Groups/NACLs, Azure NSG, GCP firewall rules, Kubernetes NetworkPolicy). Use whenever the user pastes or asks for a device config, CLI commands, show/diagnose output, VLANs, routing (static/OSPF/BGP), ACLs, firewall policies, NAT, VPN/IPsec, HA, hardening, or wants to convert a config from one vendor to another — even if they don't name the vendor.

Improve anything in repeatable rounds, one testing flow at a time: a user walkthrough (a manager setting something up, a new hire using it), a lens review such as styling, or a dry run of a skill or prompt. Fresh subagents run the flow, score it against that flow's fixed rubric, and report findings; you fix what's in scope and rerun toward a target score. Works on pages, artifacts, apps, skills, prompts, documents, and workflows, including this skill itself. Use for "iterate on this", "run N rounds", "get it to 7/10", "test this as a new user", or "keep improving it until it's good". Not for a quick opinion, a one-off edit, or a single defect with a clear done state, such as a broken button or a failing test.

Operate, program (SCPI over USB/LAN/GPIB) and configure the Keysight Truevolt bench DMMs 34460A/34461A/34465A/34470A: measurement setup, triggering, math, data logging, digitizing, secondary measurements, status, errors, files, I/O, calibration and the full documented command set.

Google Play 发布：把 Unity 游戏打成签名 AAB，从注册 Play 开发者账号、创建应用、填应用内容和商品详情、封闭测试送审、凑满 12 名测试者连续 14 天，一直推进到申请正式版并提审。用户要发布、上架、提审到 Google Play；要接 Play 游戏服务（登录、成就、排行榜、云存档）、AdMob 广告、应用内评价或更新、内购；Play 审核被拒、送审被拦、测试人数不够；或者问 AdMob、Play 的钱怎么收（PIN 码、银行账户、税务信息）时使用。

Steam 发布（规划中：注册、收款和税务已实测，建应用之后还没走过）：把 Unity 游戏做成 Windows 版发到 Steam，从注册 Steamworks（Steam Direct）、签协议、付 100 美元注册费、填银行和 W-8BEN 税务信息，到建应用、商店页、上传构建、提审。用户要发布、上架、提审到 Steam；问 Steamworks 怎么注册、Steam 的钱怎么收、W-8BEN 怎么填、身份验证要传哪些证件；或者问在 Mac 上怎么给 Steam 打 Windows 包时使用。

微信小游戏渠道：把 Unity 游戏转成微信小游戏，从注册小游戏账号推进到版本提审，主线是个人主体、纯广告变现。用户要发布、上架、提审到微信小游戏时使用；要接入微信小游戏的流量主广告、分享、排行榜、游戏圈、存档、安全区和胶囊按钮时使用；要填运营素材（游戏简介、封面、推广图、推广文案、推广视频）时使用；问流量主的钱怎么结算、财务资料怎么填，或遇到微信小游戏黑屏、中文显示成方块、备案或认证卡住、审核被拒时也使用。

Safely clean up and debloat a Windows 10/11 PC by surveying it, archiving personal files, uninstalling bloatware, trimming startup apps, clearing junk and preparing the machine to run as an always-on server or agent box. Use this skill whenever the user wants to clean, speed up, debloat, declutter, "remove everything not needed", free disk space or RAM, remove preinstalled HP/Dell/Lenovo/OEM or Xbox apps, stop apps from starting with Windows, or turn a Windows laptop or desktop into a server, agent host, build machine or home lab, even if they never say "debloat".

Use for anything about shipping a mobile app to Google Play and/or the Apple App Store: first submission, a repeat version update, developer account questions (individual vs organization, transfers, package/bundle id rules), store listing text and screenshots, Data safety / App Privacy forms, the review demo account, and rejection handling. Trigger on "submit to the store", "upload to Play / App Store Connect", "TestFlight", "closed testing", "store screenshots", "store listing", "app review", "Play Console", "App Store Connect", "AAB", "IPA", "app transfer", "package name", "bundle id". Do not trigger for backend deploys or web hosting — this is about the two app stores only.

Get a Meta business portfolio verified and the official WhatsApp Cloud API (not a third-party reseller API) wired up end to end: diagnose a rejected business verification, prepare a resubmission with the right document types, and bring up the Cloud API itself — app, WABA, test number, system-user token, real phone number, webhook, smoke test, templates. Use when working on Meta business verification, a rejected or stalled verification, the WhatsApp Cloud API, a Meta developer app, a WABA, a system user token, or connecting a product to the official WhatsApp Business Platform. Not for Meta's own paid support tiers, and not for moving a number between WhatsApp Business Accounts once a portfolio is already verified and live — that's a narrower, separate procedure.

Explore local TS, JS, Svelte, Python and Go code with a native Rust analyzer. Use for fuzzy function search, evidenced caller/callee networks, entry paths, Git change review and explicitly confirmed bounded architecture memory. Uses the current Agent conversation model for narrative; no extra API key.