Development

Implement comprehensive input validation on server-side with complementary client-side validation for user experience, using allowlists, type checking, and sanitization to prevent injection attacks. Use this skill when validating user inputs, form data, API requests, file uploads, query parameters, or any external data entering the application. Apply this skill when implementing server-side validation as the primary security layer, adding client-side validation for immediate user feedback, validating data types and formats, checking ranges and required fields, sanitizing inputs to prevent SQL injection and XSS attacks, using allowlists over blocklists, providing field-specific error messages, or enforcing business rules at appropriate application layers. This skill ensures validation happens at all entry points consistently, security is never dependent on client-side checks alone, users receive helpful immediate feedback, and data integrity is maintained through multiple layers of validation.

Use after planning or implementing non-trivial tasks - runs Codex MCP background verification/review for quality gates (plan validation + implementation review)

Confirm a requested feature change via AERA Debug mode (Debug view, console, logs). Use when validation must happen through Debug UI or when you need to add debug-only probes/commands to make a change observable.

Build Telegram bots in Node.js. Use when a request mentions Telegram bot, BotFather, bot token, webhook, long polling, commands, inline keyboards, callback queries, or handling Telegram Bot API updates.

Generate comprehensive coverage report with requirement traceability mapping. Shows coverage per REQ-*, gaps, trends, and recommendations. Use for status dashboards, quality reviews, or compliance audits.

Structured code review output format for the reviewer agent. Provides APPROVED/ISSUES format with file:line references. Use when: reviewing code changes, code quality checks, architecture compliance checks, approving code for merge, identifying critical/major/minor issues.

Invoke Gemini CLI as a partner AI developer for tasks benefiting from its 1M token context window or a second opinion. Use when analyzing large codebases, generating documentation, getting alternative perspectives, researching topics with web search, or creating UI wireframes/components. Gemini has read/write/edit/shell/web search capabilities like Claude.

Comprehensive guide for building Next.js 15.5+ applications with Firebase, including App Router, TypeScript, MUI v7, Turbopack production builds (beta), and Firebase services. Use when configuring Next.js projects, troubleshooting errors, setting up Firebase integration, working with App Router patterns, or implementing best practices for Next.js + Firebase development.

Context for ongoing migration from old Portfolio Buddy app. Use when: fixing bugs, adding migrated features, checking feature parity, or understanding why certain code exists. Contains list of 40 features being migrated and known issues.

Analyze the codebase for security vulnerabilities, including dependency issues, improper data handling, and configuration risks.

Analyze and improve Claude Code skills against best practices. Supports scope keywords (project/global/all) to target current project skills, ~/.claude/skills/, or both. Default is project-only. Evaluate SKILL.md quality using a 100-point rubric. Activated when users mention "improve skill", "analyze skill", "audit skills", or need to refactor existing skills.

Create extraordinary, whimsical generative art for Genuary 2026 - you are a creative coder with artistic vision

使用系统原生方法进行屏幕捕获和内容分析，支持 macOS screencapture 命令和 Python 截图库

Master security principles, cryptography, compliance frameworks, and secure development practices. Use when securing applications, implementing authentication/authorization, or ensuring regulatory compliance.

Provides a complete solution for JWT-based authentication in FastAPI applications. Use this skill when a user wants to add secure token-based authentication to their FastAPI project. This skill handles JWT creation, decoding, signature and expiration verification, password hashing, and custom claims. It includes patterns for login endpoints, protected routes using dependencies, role-based access control decorators, token refresh mechanisms, and middleware-based validation.

Assess Claude Code knowledge and route to appropriate learning level.Use when: user wants to learn Claude Code, asks for guidance, or says "teach me".Triggers: "learn Claude Code", "teach me", "I'm new", "where do I start", "beginner".

Expert guide for Supabase integration - database schemas, RLS policies, auth, Edge Functions, and real-time subscriptions. Use when working with Supabase backend features.

Manage your Ridwell recycling account - check upcoming pickups, opt in/out of pickup events, view special/rotating categories, and answer questions about what items Ridwell accepts. Use when the user asks about Ridwell pickups, recycling categories, item classification, or wants to manage their Ridwell service.

Two-phase workflow that generates explicit YAML plan before execution, with approval gates and checkpointing. Use for complex multi-file changes, refactoring, bug fixes with dependencies, or any task where mistakes are costly. Achieves 90% first-pass success rate vs ad-hoc changes. Provides audit trail, rollback capability, and explicit approval points. Triggers on "refactor", "multi-step", "plan then execute", "complex changes", "safe refactoring".

Manage Linear issues, projects, and cycles. Maintains session memory across conversations for context continuity.