Backend

Build and implement Spring Boot 3 backend with Java 17 - REST APIs, JPA entities, services, repositories, security (JWT), and database migrations for Photo Map MVP. This skill should be used when creating, developing, or implementing *.java files, backend endpoints, business logic, database entities, DTOs, authentication, or API error handling. File types .java, .xml, .properties, .yml, .sql (project)

Create and manage database migrations for schema changes, ensuring zero-downtime deployments and data integrity. Use this skill when creating migration files, modifying database schemas, adding or altering tables/columns/indexes, or working with migration tools like Alembic, Flyway, Liquibase, or framework-specific migration systems (Django migrations, Rails migrations, Prisma migrations). Apply this skill when implementing reversible migrations with up/down methods, handling data migrations separately from schema changes, creating indexes on large tables, or planning backwards-compatible schema changes for high-availability systems. This skill ensures migrations are version-controlled, focused, safe to rollback, and compatible with CI/CD pipelines and zero-downtime deployment strategies.

Integrate OpenAI Agent SDK with Google Gemini backend into FastAPI service using the official Google Gemini API via OpenAI compatibility layer.

協助開發者進行程式開發，包含公司 API 設計規範指引和 Spring Boot 專案快速建立。用於：(1) 開發新的 API 端點時、(2) 規劃和設計 API 時、(3) 需要快速建立新的 Spring Boot 專案時、(4) Code Review 時驗證 API 是否符合公司規範時

Comprehensive guide for Cloudflare Durable Objects - globally unique, stateful objects for coordination, real-time communication, and persistent state management.Use when: building real-time applications, creating WebSocket servers with hibernation, implementing chat rooms or multiplayer games, coordinating between multiple clients, managing per-user or per-room state, implementing rate limiting or session management, scheduling tasks with alarms, building queues or workflows, or encountering "do class export", "new_sqlite_classes", "migrations required", "websocket hibernation", "alarm api error", or "global uniqueness" errors.Prevents 15+ documented issues: class not exported, missing migrations, wrong migration type, constructor overhead blocking hibernation, setTimeout breaking hibernation, in-memory state lost on hibernation, outgoing WebSocket not hibernating, global uniqueness confusion, partial deleteAll on KV backend, binding name mismatches, state size limits exceeded, non-atomic migrations, loc

High-performance web scraping API with Chrome TLS fingerprint and JS rendering

Node.js/TypeScript backend expert. Handles Express/Fastify API routes, TypeScript strict mode, Prisma ORM, Zod validation, error handling, configuration management. Use when project is Node.js backend (package.json + TypeScript server).

Backend AI functionality with Vercel AI SDK v5 - text generation, structured output with Zod,tool calling, and agents. Multi-provider support for OpenAI, Anthropic, Google, and Cloudflare Workers AI.Use when: implementing server-side AI features, generating text/chat completions, creating structuredAI outputs with Zod schemas, building AI agents with tools, streaming AI responses, integratingOpenAI/Anthropic/Google/Cloudflare providers, or encountering AI SDK errors like AI_APICallError,AI_NoObjectGeneratedError, streaming failures, or worker startup limits.Keywords: ai sdk core, vercel ai sdk, generateText, streamText, generateObject, streamObject,ai sdk node, ai sdk server, zod ai schema, ai tools calling, ai agent class, openai sdk, anthropic sdk,google gemini sdk, workers-ai-provider, ai streaming backend, multi-provider ai, ai sdk errors,AI_APICallError, AI_NoObjectGeneratedError, streamText fails, worker startup limit ai

Complete guide for OpenAI's Assistants API v2: stateful conversational AI with built-in tools(Code Interpreter, File Search, Function Calling), vector stores for RAG (up to 10,000 files),thread/run lifecycle management, and streaming patterns. Both Node.js SDK and fetch approaches.⚠️ DEPRECATION NOTICE: OpenAI plans to sunset Assistants API in H1 2026 in favor of Responses API.This skill remains valuable for existing apps and migration planning.Use when: building stateful chatbots with OpenAI, implementing RAG with vector stores, executingPython code with Code Interpreter, using file search for document Q&A, managing conversation threads,streaming assistant responses, or encountering errors like "thread already has active run", vectorstore indexing delays, run polling timeouts, or file upload issues.Keywords: openai assistants, assistants api, openai threads, openai runs, code interpreter assistant,file search openai, vector store openai, openai rag, assistant streaming, thread persistence,state

Git workflow patterns for agents. Invoke at session start when working in a git repository, before any git operations (status, add, commit, push, rebase), when making code changes, or when the user asks to commit, create PRs, or manage branches. Covers atomic commits, intentional staging, history restructuring, and safe parallel work patterns.

Perform automated security analysis on code changes to identify common vulnerabilities including SQL injection, path traversal, hardcoded secrets, XSS, and insecure API usage. Reviews Python code for OWASP Top 10 vulnerabilities.

Production-grade authentication & authorization covering JWT, cookies, sessions, hashing, MFA, OAuth2, RBAC, and permissions across all frameworks (Next.js, Express.js, FastAPI, Django, Spring, etc.). Includes intelligent pattern selection, Better Auth integration, email verification, social login, token revocation, permission management, and 10+ years security expertise. Use when implementing authentication, authorization, user management, MFA, OAuth integration, or securing APIs in any framework.

Implement PostHog analytics for PhotoVault with dual tracking (client + server). Use when working with event tracking, funnel analysis, user identification, TypeScript event schemas, ad-blocker-proof server-side tracking, or debugging missing analytics data. Includes PhotoVault event definitions and privacy defaults.

Model system responsibilities across clients, servers, and optional peer-to-peer nodes.

Use this skill when implementing real-time features with WebSockets, including connection lifecycle management, pub/sub event patterns, state synchronization between client and server, event broadcasting, and integration with frontend state management (React Query, SWR, etc.). Covers FastAPI/Node.js/Express backends and React/Next.js/Vue frontends with fallback strategies and error recovery.

Complete Supabase setup for Mem0 OSS including PostgreSQL schema with pgvector for embeddings, memory_relationships tables for graph memory, RLS policies for user/tenant isolation, performance indexes, connection pooling, and backup/migration strategies. Use when setting up Mem0 with Supabase, configuring OSS memory backend, implementing memory persistence, migrating from Platform to OSS, or when user mentions Mem0 Supabase, memory database, pgvector for Mem0, memory isolation, or Mem0 backup.

Implementing Supabase realtime subscriptions and live updates for StickerNest. Use when the user asks to add realtime, live updates, presence, subscriptions, postgres_changes, broadcast channels, or sync data across tabs/devices. Covers Supabase Realtime, EventBus integration, and subscription lifecycle.

General-purpose browser automation skill for Playwright. Use this skill when the user wants to automate browser tasks like testing login flows, scraping data, taking screenshots, filling forms, clicking elements, or any interactive web automation. This skill provides smart utilities for session management, error handling, and development server detection. NOT for scheduled monitoring (use web-monitor-bot instead).

Manage Node.js dependencies including adding, updating, auditing, and resolving conflicts. Use when updating dependencies or resolving version conflicts.

Analyzes a codebase to generate comprehensive architectural documentation including technologies used, data flows, functional components, APIs, external dependencies, commit history analysis, and complexity hotspots.