Tools

Automated security scanning workflow using Semgrep MCP. Scans changed files for OWASP Top 10 vulnerabilities, CWE patterns, hardcoded secrets, and security misconfigurations. Returns prioritized findings with remediation guidance. Use when security validation is needed for code changes (invoked by security-engineer, code-quality-validator, or /audit command). Scans only changed files for efficiency (10-15s overhead).

Clear description of what this skill does and when to use it

This skill should be used when the user asks to "analyze data", "build a model", "explore this dataset", "run analysis", or needs a structured data science workflow. Orchestrates brainstorm, plan, implement, review, and verify phases with output-first verification.

Provides quick reference for all Sagebase CLI commands and Docker operations. Activates when user asks how to run application, test, format code, manage database, or execute any Sagebase operation. Includes just commands, unified CLI, testing, formatting, and database management.

Teaches generic constraints, avoiding any in generic defaults, and mapped types in TypeScript. Use when creating reusable functions, components, or types that work with multiple types while maintaining type safety.

Production-grade accessibility skill for WCAG 2.2 AA compliance.Covers auditing, remediation, component authoring, and validation workflows.Auto-invoked for UI implementation, a11y fixes, and accessibility testing.

This skill should be used when creating new test lanes for the XML test data generator. A test lane consists of an XSD schema file paired with a meta.yaml configuration file. This skill guides the process of creating both files with proper semantic type mappings, distribution settings, and field overrides. Use when users request new test lanes, want to generate test data configurations, or need help setting up XSD + meta.yaml pairs for the testgen CLI tool.

Work with the NNT (Nakul Notation Tool) compiler - parse music notation shorthand, query musical structures, and export to MusicXML, ABC, and other formats for PhD research and educational content

Comprehensive TypeScript best practices including type imports, security patterns, code structure, and early returns. Use when writing TypeScript code, reviewing for quality, implementing error handling, or ensuring type safety.

Squash all commits in a feature branch into a single commit with an AI-generated summary message. Use when the user wants to clean up their git history before merging, combine multiple commits, or create a single commit from a feature branch.

Create new demo or utility modules following CLY project patterns. Use when adding TUI demonstration modules to modules/demo/ or utility modules to modules/, following Bubbletea/Bubbles conventions with proper Cobra CLI integration.

⚡ PRIMARY TOOL for: 'what's the architecture', 'system design', 'how are layers organized', 'find design patterns', 'audit structure', 'map dependencies'. Uses claudemem v0.3.0 AST structural analysis with PageRank. GREP/FIND/GLOB ARE FORBIDDEN.

Guides implementation of new MCP tools from specification to production-readycode, following the braiins-pool-mcp-server architecture patterns and bestpractices defined in ARCHITECTURE.md.

Automated Google Tag Manager debugging with visual monitoring, screenshot annotation, and MCP integration. Use when testing GTM configurations, verifying tag firing, debugging dataLayer events, validating consent mode, checking tracking implementations, or automating GTM container builds with Stape/GTM MCP servers. Triggers on "debug GTM", "test GTM tags", "GTM preview", "verify tag firing", "check dataLayer", "monitor tags", "validate consent", "did my GTM fix work", "validate tracking", "annotate screenshot", "GTM QA", or when verifying configuration changes via browser automation.

Role definition for code reviewer agents. Defines review criteria, feedback patterns, and approval workflows. Use to understand how to review PRs and provide constructive feedback.

This skill should be used when the user asks to "verify this works", "prove it's done", "show me evidence", or as Phase 5 of the /dev workflow before claiming completion. Requires fresh runtime evidence.

CI/CD pipeline failure resolution with autonomous iteration loops. Local validation → branch & PR creation → CI monitoring → iteration until green. Proven patterns for GitHub Actions, includes role-specific adaptations. Use when CI pipeline failures occur, GitHub Actions errors detected, autonomous error resolution needed, PR creation for fixes required. Triggers on ci pipeline failures, github actions errors, autonomous ci resolution, ci iteration, pr creation for errors, pipeline validation, test failures in ci, build failures in ci, continuous integration debugging.

Complete browser automation with Playwright. Auto-detects dev servers, writes clean test scripts to /tmp. Test pages, fill forms, take screenshots, check responsive design, validate UX, test login flows, check links, automate any browser task. Use when user wants to test websites, automate browser interactions, validate web functionality, or perform any browser-based testing.

Manage git worktrees for the current repository. Use when asked to create a worktree, set up parallel development, work on multiple branches simultaneously, or manage existing worktrees. Triggers on phrases like "create worktree", "new worktree", "parallel branch", "list worktrees", or "remove worktree".

Implement Next.js 15 patterns for PhotoVault including Server Components, Client Components, Server Actions, and API routes. Use when working with app router, middleware, data fetching, caching, loading states, or debugging hydration errors. Includes Next.js 15 async params and caching changes.