Security

Fix security vulnerabilities from pip-audit, npm audit, Snyk, and other security scanners. Use when security audit checks fail with CVE warnings.

Personal AI Infrastructure (PAI) - PAI System Template. Your name is @assistantName@ and you are @userFullName@'s AI assistant. Do not introduce yourself as "Claude Code" MUST BE USED proactively for all user requests. USE PROACTIVELY to ensure complete context availability. Your personality is friendly, professional, resilient to user frustration. Operating Environment is Personal AI infrastructure built around Claude Code with Skills-based context management. This skill provides critical info on how to answer questions, Patrick's key contacts, security guidelines, stack preferences, social media accounts, and other core information.

Expert-level state management with Redux Toolkit and Zustand using TypeScript. Handle complex application state including shopping carts, user authentication, product catalogs, API state management, and advanced patterns. Generate production-ready store configurations, slices, hooks, and complete implementations across React, Next.js, and universal applications. Use when building scalable state management solutions with TypeScript for e-commerce, authentication, async operations, and complex state architectures.

StoreFront deployment planning, configuration, and security hardening. Use when planning StoreFront infrastructure, configuring stores and authentication, setting up server groups, implementing SSL/TLS, or troubleshooting StoreFront connectivity issues. Covers architecture patterns, high availability, and operational procedures.

Keep documentation in sync with code changes. Use when implementing features, modifying APIs, changing architecture, adding configuration, updating security, or making any changes that affect user-facing or developer-facing documentation.

Validation patterns and compliance checking for Kailash SDK including parameter validation, DataFlow pattern validation, connection validation, absolute import validation, workflow structure validation, and security validation. Use when asking about 'validation', 'validate', 'check compliance', 'verify', 'lint', 'code review', 'parameter validation', 'connection validation', 'import validation', 'security validation', or 'workflow validation'.

Configure domains in Cloudflare including adding sites, DNS records, SSL settings, and page rules. Use when setting up Cloudflare for new domains, configuring DNS records (A, CNAME, MX, TXT), or managing Cloudflare settings via API or dashboard guidance.

Add authentication and authorization to routes, Server Actions, and API endpoints using Supabase Auth. Use when user needs "protect [route]", "add authentication", "require login", "add RBAC", "implement login/logout", or mentions auth, permissions, OAuth, API keys. Provides patterns for protected routes, Server Action auth checks, role-based access control (5 roles), OAuth providers (Google, GitHub), email verification, password strength, account lockout, and API key authentication. Do NOT use when building new features (use worldcrafter-feature-builder which can add auth), database-only changes (use worldcrafter-database-setup for RLS policies), routes without auth (use worldcrafter-route-creator), or testing only (use worldcrafter-test-generator).

Secure dotfiles management with chezmoi. Use when helping users initialize chezmoi repositories, add/manage dotfiles, handle secrets with age encryption, create templates for multi-machine configs, troubleshoot chezmoi issues, or review dotfiles for security. Always checks for security implications before adding files.

Go backend with Gin, MongoDB, JWT auth, and Clean Architecture.

Validates essential web resource files (sitemap.xml, robots.txt, llms.txt, security.txt) for compliance with their specifications. Use when user asks about "sitemap validation", "robots.txt check", "llms.txt", "security.txt", "RFC 9116", "RFC 9309", "web resource audit", "サイトマップ", "セキュリティ", or wants to verify crawler/LLM accessibility files.

Write secure and optimized database queries using parameterized queries, preventing SQL injection, avoiding N+1 queries through eager loading, selecting only needed columns, and using transactions for related operations. Use this skill when writing database queries using ORM query methods, raw SQL, or query builders in repository files, data access layer files, service files, or any backend code that fetches or manipulates database data. Use this when writing ORM queries with methods like findAll, findOne, findMany, where, include, select, joins, or populate to retrieve data from databases, writing raw SQL queries safely using parameterized inputs or prepared statements (never string interpolation or concatenation) to prevent SQL injection attacks, optimizing queries to prevent N+1 problems by using eager loading with include/populate or SQL joins to fetch related data in a single query instead of multiple sequential queries that degrade performance, implementing database transactions to wrap related operatio

Comprehensive code review workflow coordinating quality, security, performance, and documentation reviewers. 4-hour timeline for thorough multi-agent review.

Integrate with Azure DevOps for work item management, pipeline monitoring, and repository operations.Use when asked about: ado, azure devops, work item, create task, create bug, query work items,pipeline, set up ado, my work items, sprint items, what did I complete.Requires: Azure CLI with devops extension, authentication via az login.

OAuth 2.1 compliance checklist for authorization servers. Use when implementing OAuth 2.1 beyond OpenID Connect Basic OP requirements, verifying OAuth 2.1 specific features, or understanding differences from OAuth 2.0. Covers all OAuth 2.1 draft-ietf-oauth-v2-1-14 requirements not in Basic OP.

Senior-level React and Tailwind CSS development expert with 10+ years experience. Automatically audits, generates, and optimizes React applications with focus on hooks, Context API, performance, security, and modern Tailwind styling. Use for React component generation using TypeScript, hook optimization, security audits, responsive design implementation, animation, Context API patterns, performance optimization, and project structure analysis. Ensures clean code, prevents backend data exposure, and follows senior-level best practices.

Transform a Vibes app into a multi-tenant SaaS with subdomain-based tenancy. Adds Clerk authentication, subscription gating, and generates a unified app with landing page, tenant routing, and admin dashboard.

This skill should be used when users want to train or fine-tune language models using TRL (Transformer Reinforcement Learning) on Hugging Face Jobs infrastructure. Covers SFT, DPO, GRPO and reward modeling training methods, plus GGUF conversion for local deployment. Includes guidance on the TRL Jobs package, UV scripts with PEP 723 format, dataset preparation and validation, hardware selection, cost estimation, Trackio monitoring, Hub authentication, and model persistence. Should be invoked for tasks involving cloud GPU training, GGUF conversion, or when users mention training on Hugging Face Jobs without local GPU setup.

Write secure, performant database queries using parameterized queries, proper eager loading, and transaction management. Use this skill when writing database queries, ORM operations, raw SQL statements, or repository methods. When working on files in repositories/, queries/, services/, or any code that interacts with the database. When optimizing query performance, preventing N+1 queries, implementing transactions, adding query timeouts, or caching expensive queries. When reviewing code for SQL injection vulnerabilities.

Guide users through creating and configuring a GitHub App for workspace authentication. Use when setting up GitHub App authentication for happy-little-claude-coders, creating github-app-credentials secret, or configuring automatic token refresh.