Firebase
CloudCommonly used with
Skills using Firebase (267)
moai-domain-database
Database specialist covering PostgreSQL, MongoDB, Redis, Oracle, and cloud database platforms (Neon, Supabase, Firestore). Use for schema design, query optimization, indexing strategies, data modeling, or cloud database selection. Cloud vendor guide absorbed from moai-platform-database-cloud.
moai-platform-auth
Authentication and authorization specialist covering Auth0, Clerk, and Firebase Auth. Use when implementing authentication, MFA, SSO, passkeys, WebAuthn, social login, or security features.
moai-platform-database-cloud
Cloud database platform specialist covering Neon (serverless PostgreSQL), Supabase (PostgreSQL 16 with real-time), and Firebase Firestore (NoSQL with offline sync). Use when choosing or setting up cloud databases.
apk-redteam-pipeline
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.
hunt-cloud-misconfig
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).
vibe-build
Build your MVP following the AGENTS.md plan. Use when the user wants to start building, implement features, or says "build my MVP", "start coding", or "implement the project".
firebase-ai
Use when setting up firebase_ai, generating text/chat with Gemini, streaming AI output, building multimodal prompts, or handling AI errors.
firebase-analytics
Use when logging analytics events, setting user properties, configuring default event parameters, building funnels, or adding screen-view tracking.
firebase-app-check
Use when implementing app attestation, configuring App Check providers, setting up debug tokens, enabling backend enforcement, or managing token refresh.
firebase-auth
Use when setting up auth, managing auth state, implementing email/password or social sign-in, handling auth errors, or managing users.
firebase-cloud-firestore
Use when setting up Firestore, designing schemas, doing CRUD, creating listeners, paginating queries, configuring indexes, enabling offline persistence, or writing security rules.
firebase-cloud-functions
Use when calling callable functions (httpsCallable), passing data to server-side logic, handling function errors/timeouts, configuring regions, or testing with the Emulator Suite.
firebase-crashlytics
Use when implementing crash reporting, capturing fatal/non-fatal errors, recording isolate/async exceptions, customizing reports, or uploading obfuscated symbols.
firebase-data-connect
Use when setting up Data Connect, writing GraphQL queries/mutations, configuring generated SDKs, handling offline, or applying security rules.
firebase-database
Use when syncing real-time data, structuring JSON trees, reading/writing, creating listeners, enabling offline persistence, managing presence, sharding, or writing security rules.
firebase-in-app-messaging
Use when running in-app message campaigns, triggering/suppressing messages, configuring opt-in data collection, testing on specific devices, or handling message callbacks.
firebase-messaging
Use when setting up Firebase Cloud Messaging, managing permissions and tokens, handling background/foreground notification taps, or dispatching messages server-side (HTTP v1).
firebase-remote-config
Use when implementing feature flags, running A/B tests, setting parameter defaults, fetching/activating config, or enabling real-time config updates.
firebase-storage
Use when setting up Storage, uploading/downloading files, managing metadata, handling errors, or applying security rules.
flutterfire-configure
Use when adding Firebase to a Flutter project, running flutterfire configure, initializing Firebase in main.dart, or configuring multiple flavors.
generate-images-with-firebase-ai
Use when generating or editing images from Flutter/Dart with Firebase AI Logic and a Gemini image model (Nano Banana), making the first call work, choosing Gemini Developer API vs Vertex AI, hitting quota, billing or App Check failures, getting empty or image-only responses, sending a user photo as input, controlling aspect ratio or size, writing the image prompt, or deciding what to test.
analytics-setup
Generates protocol-based analytics infrastructure with swappable providers (TelemetryDeck, Firebase, Mixpanel). Use when user wants to add analytics, track events, or set up telemetry.
announcement-banner
Generates an in-app announcement banner system with remote configuration, scheduling, deep link actions, and dismiss tracking. Use when user wants in-app banners, promotional notices, maintenance alerts, or contextual announcements.
error-monitoring
Generates protocol-based error/crash monitoring with swappable providers (Sentry, Crashlytics). Use when user wants to add crash reporting, error tracking, or production monitoring.
feature-flags
Generate feature flag infrastructure with local defaults, remote configuration, SwiftUI integration, and debug menu. Use when adding feature flags or A/B testing to iOS/macOS apps.
offensive-mobile
Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance.
launchworthy
Production readiness audit that turns a demo into a real product. Built for apps shipped fast with AI coding tools (Lovable, Bolt, v0, Cursor, Claude Code). Auto-detects your stack and audits 5 domains (Frontend, Backend & Data, Auth & Security, Infrastructure, Operations), then produces a scored scorecard and a prioritized punch list with exact file paths and copy-paste fixes. Use before you go live, or on an app that is already live, when the user says "harden this", "is this production ready", "is this safe to launch", "will this survive real users", "audit my app", "turn this into a product", "production audit", "is my supabase secure", or wants to go from demo to production.
offensive-mobile
Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance.
firebase-deploy
Deploy the ontology-atlas static site to Firebase Hosting from this repo. Use when the user asks to deploy, redeploy, publish the site, update Firebase Hosting, or verify the live web.app URL. The workflow must read `.env.prod`, build the static export, deploy only Hosting, and verify the live URL. Never commit `.env.prod` or introduce Firebase backend services.
revenue-check
Pull product revenue per app from Firestore (or fixtures) and produce a cash-flow report
seo-ai-site-builders
Turn a JavaScript-only site built by an AI website generator into indexable HTML. Input: a site made with Lovable, Base44, Bolt, v0, Replit, Firebase Studio, Framer, Wix, Durable, Softr, Bubble, Glide or any similar tool. Output: proof of what crawlers actually receive (bundled zero-dependency script), the right conversion route (native SSR, build-time prerendering or SSG, framework migration, or crawler-only prerendering as a last resort), the HTML each page must serve, and the routing, status code and hosting config that goes with it. Use when a vibe-coded or AI-generated site is not indexed, shows an empty page in view-source, has meta tags that only appear after JavaScript runs, is invisible to ChatGPT and Perplexity, or when picking a builder before starting.
crashlytics
Generate crash reports from Firebase Crashlytics with automated fix proposals, severity scoring, and developer assignments via git blame. Use when analyzing crashes, triaging production issues, or generating crash triage reports.
moai-domain-database
Database specialist covering PostgreSQL, MongoDB, Redis, Oracle, and cloud database platforms (Neon, Supabase, Firestore). Use for schema design, query optimization, indexing strategies, data modeling, or cloud database selection. Cloud vendor guide absorbed from moai-platform-database-cloud.
qa-testing-mobile
Mobile QA for iOS and Android. Use when planning automation frameworks, device matrix, flake control, or CI/CD release gates.
audit
Security and performance audit of the AGIS dashboard into docs/AGIS-AUDIT.md.
doctor
Check runtimes, GIS libraries, DB clients, installed modules, secrets hygiene, repo standards and toolkit version; print pass/fail with fixes.
firebase-cli
Safety-first Firebase CLI (firebase-tools v15) skill for full project control — deploy, Hosting (sites/channels/rollback), Cloud Functions (+secrets), Firestore (databases/indexes/backups/delete), Realtime Database, Auth import/export, Remote Config, App Distribution, App Hosting, Extensions, Data Connect, Emulator Suite & MCP server. Classifies every command by risk tier via a deterministic classifier script and gates destructive/irreversible/cost-incurring ops behind AskUserQuestion confirmation; enforces the --non-interactive/--force contract so nothing hangs and nothing is auto-confirmed. Wrong-project preflight prevents deploying to prod by accident. Ships a 3-level self-test (static classifier battery, live read-only, guarded live-write w/ cleanup). Use when running, planning, or debugging any `firebase` command.
kronos-agent
Financial time-series forecasting using the Kronos foundation model (MIT, NeoQuasar). Takes OHLC candles, returns predicted future candles with configurable horizon. Infrastructure skill — called by trader agents or scheduled ingestion, not directly invoked by users or the model.
migration-planner
Plan and track cross-platform or cross-service migrations (Supabase to Firebase, single to multi-tenant, schema migrations, etc). Generates rollback-safe migration plans with state tracking.
product-health-agent
Managed agent that analyzes production app engagement and operational health. Reads Firestore aggregates, Cloud Logging, and Cloud Monitoring; mounts source repos read-only; writes structured insights to a workspace Firestore collection. Designed for daily digests and on-demand deep dives on the Glam and SpinDineSwift production apps. Read-only by design.
angular
Build Angular apps with the Angular CLI: standalone components, signals, zoneless, Vitest, angular-eslint, mise tasks. Use for Angular apps, routing, forms, SSR.
astro
Build content-driven websites and web apps with Astro: islands, Tailwind CSS v4, Content Layer, Vitest, Prettier, and mise tasks. Use for Astro sites, SSG, SSR, or islands.
firebase
Set up and ship Firebase backends with the Firebase CLI: emulators, Firestore rules, Auth, Functions, Hosting or App Hosting. Use when an app needs Firebase.
genkit
Build Genkit AI flows, tools, prompts, and RAG in TypeScript, Go, or Python with the Genkit CLI and dev UI. Use when a project adopts Genkit instead of ADK.
aws-plan
AWS architecture, IaC skeleton, migration steps and cost estimate into docs/AWS-PLAN.md.
cadastral-schema
Mauza/Parcel Firestore model, size limits, geohash, geometry storage, rule constraints.
secrets-audit
Find credentials in the working tree and git history (keys, tokens, connection strings); walk through rotation and history purge.
auth
Authentication and authorization. JWT, OAuth2, OIDC, SAML, API keys, mTLS, MFA, passwordless, social login, session management, identity providers (Auth0, Okta, Cognito).
hn-digest
Scan the Hacker News front page and report today's themes, hot discussions, and industry mix. One request gets the whole page; output is three sections: overview, hot discussions, industry mix. Use when asked to scan HN, get today's HN front page, see what's trending on Hacker News, or produce an HN digest. Triggers: "what's on HN today", "top HN today", "HN digest", "scan HN", "hacker news trends", "what's trending on Hacker News". Trigger phrases in any language count — match on meaning, not on these exact English strings. Does not read comment text — mining a specific thread's comments is a different job and not this skill.
deploy-profiles
How each service runs locally and in the cloud (Firebase App Hosting, Vercel, Hugging Face Spaces, EAS, Docker, AWS) with commands, config, env sources, health checks, rollback. Apply to deploy, hosting, environment or AWS tasks.
mobile-engineer-role
Operate as a mobile engineer who plans around release trains, a real device matrix, and app-store rules that a web engineer never faces. Use when building or reviewing an iOS or Android feature and you need mobile-specific release and compatibility discipline.
durable
Use when user data must not be lost or corrupted — creating the first database/table/schema, writing migrations, backfilling or importing data, any destructive operation (delete, drop, truncate, overwrite), setting up backups or recovery, or moving data between systems; and for "is my data safe", "will I lose my data", "back up my app" checks on existing projects. Any store — SQL (Postgres, MySQL, SQLite), document (Mongo, Firestore), serverless (Supabase, Neon, Turso), files, queues. Do NOT use for query speed or connection-pool sizing (that is lean), access control over data (that is bulletproof), or privacy/legal deletion regimes (that is compliance-guard).
api-baas-firebase
Firebase backend-as-a-service — Firestore, Authentication, Cloud Functions v2, Storage, Hosting, Admin SDK, security rules, emulator suite
security-audit
Use when the user asks for a security review, security audit, vulnerability scan, secret scan, dependency or CVE check, OWASP review, pentest review, compliance evidence, or asks "is this safe to ship". Runs real scanners (Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner) over code, full git history, dependencies, IaC, and Supabase/Firebase row-level security, verifies each finding against source, and writes one severity-ranked report.
create-auth-skill
Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.
monorepo-sync-types
Regenerate backend types and re-export them via packages/shared/types/ in a turborepo monorepo so both apps/web/ and apps/mobile/ consume a single typed surface. Supports Supabase (via supabase gen types typescript), neon-drizzle (via drizzle-kit introspect/pull + InferSelectModel/InferInsertModel re-exports — the default DB stack), tRPC (via inference from the server router import), and custom REST (via a manual or zod-derived schema). Reads .workflow/meta.json with stack.framework="monorepo" and stack.{auth,db} populated. Use when "rigenera i tipi da Supabase", "sync DB schema to packages/shared/types", "il backend è cambiato, aggiorna i tipi", "sync types from tRPC", "sync Drizzle types after a schema change". Not for: creating shared packages from scratch (use monorepo-add-shared-package), wiring the backend client itself (use module-add or rn-module-add).
rn-backend
Use to connect an Expo + RN app to a backend (auth, database, storage, realtime), agnostic of the provider. Teaches the shared patterns: secure-store for tokens, auth state via Zustand + TanStack Query, refresh-on-401 middleware, auth-gate routing via Expo Router (app)/_layout.tsx, row-level security vs API-auth concepts. Provider-specific details live in sub-references: Supabase (default, matches the course), Firebase, custom REST/JSON, tRPC. Triggers on: "setup backend", "setup auth with X", "connect Supabase/Firebase/my API", "secure token storage", "refresh token flow", "row level security". Not for: building the login UI (rn-add-screen — uses Form template), push notifications (rn-push-notifications), payments (rn-publishing-payments).
rn-module-add
Use to wire a backend/infra module (auth, db, storage, realtime, push, payments) into a scaffolded Expo + RN app. Reads .workflow/meta.json with stack.framework="expo-rn" and the user-chosen provider for each module (Supabase, Firebase, custom REST, tRPC, RevenueCat). Installs deps, generates the wiring code (lib/auth.ts, lib/supabase.ts, etc.), updates meta.json#stack to record the choice. Always idempotent. Triggers on: "add auth", "wire up db", "set up Supabase", "set up Firebase", "add payments", "add push" (the server-side part), "aggiungi modulo X". Not for: building UI for the module (rn-add-screen does the login screen, etc.), client-side knowledge only (rn-backend, rn-push-notifications), scaffolding (rn-bootstrap).
rn-push-notifications
Use when adding push or local notifications to an Expo + RN app: requesting permissions at the right moment, registering for push (Expo push service in dev, APNs/FCM direct in prod), handling foreground + tapped + cold-start notifications, deep linking from a notification payload to a specific route, scheduling local notifications, badge management. Triggers on: "add push notifications", "local notification", "deep link from notification", "iOS/Android push setup", "register for notifications". Not for: backend setup that sends the notifications (rn-backend), animations on a notification badge (rn-animations-gestures).
setup-connectors
Guided co-pilot to set up, health-check ("doctor"), add, or extend the connectors/credentials for the CURRENT project (Firebase, Linear, Stripe, Twilio, AWS, pal, …). Does everything it can automatically, then hands Simon numbered steps for the rest and waits. Use when connectors aren't working ("can't access Firebase/Stripe/Linear", "not enough permissions"), when first setting up a machine/project, when adding a new connector, to enable a one-off prod write, or to audit the existing setup for insecure credential handling (world-readable key files, a secret inside a repo, a CLI profile defaulting to the wrong work/personal account) and fix it. Reads the per-project manifest in ~/.claude/connectors/<project>.json; the deep spec is references/connectors-setup.md.
ship-pr
Simon's PR-authoring standard — every PR body STARTS with a human-readable Deploy TLDR (imperative, do-only numbered steps covering cross-repo order, build prerequisites, deploy commands, and the post-deploy smoke). Apply whenever creating a PR or finalizing one for review, in any repo.
flutter-authentication
Implement, repair, or review Flutter user authentication and session lifecycle, including OAuth or OIDC redirects, PKCE, token refresh, logout, account switching, passkeys, and device re-authentication. Use when sign-in identity or session behavior is the task; route broad threat audits to flutter-security and request transport to flutter-networking.
flutter-notifications
Implement or repair Flutter local notifications and remote push delivery across permission, scheduling, token, lifecycle, payload, interaction, and reconciliation flows. Use for notification behavior; route ordinary API transport, navigation, persistence, and custom native bridge work to their specialists.
dart
Flutter & Dart development — the always-on coding baseline plus deep references for state management, architecture, navigation, UI/theming/animation, performance, data & networking, Firebase, media, monetization, native interop, and build tooling. Auto-applies when editing any Dart file. Use when writing or reviewing any Flutter/Dart code; read the reference matching your task.
datastore-stack-menu
Return the datastore templates this plugin offers, as a vwf menu payload. Invoked by /vwf:architecture and /vwf:setup when `datastore` is listed in the config's `stacks:` — not a general-purpose skill.
gcp-iam
Least-privilege identity on Google Cloud — the service-account shape per workload, why keyless beats JSON keys, the roles that are quietly over-broad, and how Firebase security rules relate to IAM. Use when wiring service auth, granting access, or reviewing a design for privilege.
gcp-local-stack
Which Google Cloud services can run locally, which cannot, and what to do about the ones that cannot — the emulator map behind vwf's `local_stack` harness capability. Use when setting up local development or E2E tests against a GCP-backed product, or when deciding whether a stack needs Docker.
gcp-stack-menu
Return the Google Cloud stack templates this plugin offers, as a vwf menu payload. Invoked by /vwf:architecture and /vwf:setup when `gcp` is listed in the config's `stacks:` — not a general-purpose skill.
gcp-stack-template
Return one Google Cloud stack template as a vwf template payload — its axis fields, per-capability harness mechanisms, and conventions. Invoked by /vwf:architecture and /vwf:setup after the user picks from the gcp menu — not a general-purpose skill.
identity-stack-menu
Return the identity templates this plugin offers, as a vwf menu payload. Invoked by /vwf:architecture and /vwf:setup when `identity` is listed in the config's `stacks:` — not a general-purpose skill.
apple-three-piece-analytics
Choose analytics and metrics sources for a solo / small-team Apple app and decide whether a third-party tracking SDK is justified. Use when picking an analytics SDK; when asked "should I add Firebase / Mixpanel / Amplitude / TelemetryDeck"; when asked what App Store Connect Analytics, MetricKit (`MXMetricPayload`) or Game Center can measure without an SDK; when the analytics choice drives `PrivacyInfo.xcprivacy` or ATT. Does NOT own MetricKit perf wiring (ios-performance-engineering), App Review privacy-label parity (app-store-review-rejections), or sink code (telemetry-facade-pattern).
build-time-secret-injection
Use when wiring a value that ships in the binary but must stay out of public-repo diffs until launch (AdMob `GADApplicationIdentifier` / banner unit ID, a third-party SDK app key) into an Apple build via xcconfig, Info.plist `$()` substitution and a guarded `Bundle.main` read, including `ci_post_clone.sh` generation on Xcode Cloud; or when CLI tooling reads an ASC `.p8` / key ID from `secrets/.env`. Not for signing certs, CloudKit or APNs keys, nor leak prevention (gitleaks, lefthook, Secret Scanning) — see apple-public-repo-security. SDK isolation is monetization-sdk-integration.
monetization-sdk-integration
Use when adding, upgrading, or auditing a third-party monetization SDK (AdMob / Google Mobile Ads, UMP consent, mediation networks, RevenueCat), or when a PR adds `import GoogleMobileAds` outside the single live-bridge file, breaks `canImport` / `.when(platforms: [.iOS])` gating, or lands without a Fake bridge. Owns the break-glass admission test, single-import-site isolation contract, and test seam. Does not cover native StoreKit 2 IAP (storekit2-iap-defaults), production ID storage (build-time-secret-injection), or App Review consequences (app-store-review-rejections).
add-platform
Add support for a new AI coding tool, IDE, PR-reviewer, or context-packer to VibeTags — wire a new generated output file through ServiceRegistry, Platform, the renderer registry, and (if granular) GranularRulesWriter. Use when the user says "add platform support", "support <tool>", "generate a new output file for X", "new AI platform", or names an AI coding assistant/IDE/PR-reviewer/context-packer VibeTags doesn't yet generate a file for.
add-mcp
Add optional MCP servers after initial install. Triggers: add mcp, mcp ekle, firebase ekle, flutter ekle, unity ekle.
agent-refine
Agent sistemini proje bazli refine et — eksik agent tespit, genis olanları böl, yeni agent tanimla, registry guncelle. Triggers: agent-refine, agent refine, agent ekle, agent bol, agent eksik.
audit
Proje kodu taraması — güvenlik, maliyet, performans, gereksiz dosya, API tehlikeleri. Genel veya odaklı.
google-developer
Locate the official Google skill and developer docs through the google/skills developers catalog. Use for any other Google product, such as Gemini, Android, Chrome, Web, or Flutter.
database
Database design, SQL, NoSQL, and data management
super-claudiosoftware-development
Software development skill. Use when the user wants to build, code, automate, or deploy anything technical. Covers backend APIs, databases, workflow automation, scripts, free public APIs, and hosting/deployment. Trigger on backend: "build an API", "REST API", "database schema", "Supabase", "Firebase", "PostgreSQL", "MongoDB", "FastAPI", "Express", "Fastify", "GraphQL", "Node.js server", "Python API", "Prisma", "ORM", "authentication backend", "serverless functions". Trigger on automation: "automate this", "connect these apps", "n8n", "Make.com", "Zapier", "when X happens do Y", "no-code automation", "schedule a script", "webhook", "automate posting", "IFTTT", "auto-post to Instagram", "batch processing", "automate email". Trigger on free APIs: "free API for X", "public API", "build a weather app", "NASA API", "real-time data", "open data", "free data source", "API without credit card", "government API". Trigger on deployment: "deploy my app", "Docker", "Railway", "GitHub Actions", "CI/CD", "hosting", "go live
observability
Logging, metrics and alert conventions per service. Apply when adding logging, telemetry or alerts.
mobile-android-assessment
Assess an Android app (static + dynamic). Load when the target is an APK/AAB, a mobile bug-bounty scope, or "test the android app". Signals: .apk file, Java/Kotlin/Smali, AndroidManifest.xml, exported components, WebViews, hardcoded secrets, Frida/objection.
rad-code-review
Review my code, code review, is this ready to ship, check for bugs, security audit, review this PR, pre-merge check, is this safe to deploy, check code quality. The specialist lanes and memory that the built-in /code-review doesn't have: it invokes the built-in engine for general bug-finding, then adds a mechanical hallucinated-imports validator (with a vendored slopsquat denylist; Python/JS/TS/Rust/Go), an AI-slop lane, framework IDOR heuristics, a Supabase/Firebase BaaS-RLS security lane, an optional codex-security specialist scan on deep/--security-deep, and a deterministic findings index that tracks CR-NNN IDs across runs (new / recurring / resolved). Fixes apply to the working tree only — never commits.
slopsec
Security audit and hardening for vibe-coded SaaS apps. Use when reviewing, securing, hardening, or pen-testing an app — especially AI-generated / vibe-coded / "shipped fast" projects (Next.js, Supabase, Firebase, Express, serverless). Triggers: "is my app secure", "security review", "harden this", "check for vulnerabilities", "I'm about to launch", "audit before deploy", "exposed secrets", "leaked API keys", "before I ship". Walks the 50 most common ways vibe-coded apps get owned and produces a prioritized fix list.
analyze
Deep cross-layer consistency audit for any codebase. Traces every feature from UI to database, finds broken wiring, missing handlers, model mismatches, and security gaps. Auto-fixes critical and warning issues. Use this after building features, before releases, or whenever something feels off. Works with any tech stack.
cost-analysis
Analyzes infrastructure costs at 1K-100K user scales by reading the actual codebase, auto-detecting cloud providers, modeling per-action costs, and projecting total monthly spend with optimization recommendations.
engineering-excellence
Audits code for KISS, YAGNI, DRY, SOLID, and testability; maintains living engineering notes under .heyeddi/docs/engineering/. Use when refactoring, before merge, or when the user asks for simple scalable design, architecture notes, reuse catalog, or engineering ADRs — not for visual UX (use ux-flow-auditor) or CI gates (use pre-merge-gate).
flutter-engineering
Ensures HeyEddi Flutter projects have the right engineering stack — Flutter (Riverpod, go_router, Material 3), FastAPI backend, or Firebase tooling. Audits gaps, scaffolds as needed, runs flutter test/analyze, documents local dev servers. Use when frontend is Flutter or before design/feature work on a HeyEddi mobile/web app.
heyeddi-design
End-to-end UI design for HeyEddi stack (PrimeVue, DESIGN.md, semantic tokens: OpenProps on scaffold default). Use when the user wants to design, explore, critique, or improve existing frontend: e.g. "enterprise view", "critique the login page", "this UI looks bad", "settings page". Runs discovery, critique, polish, craft, document. Sub-commands init, discover, shape, craft, critique, polish, document. Not for pre-made screenshot handoff: use heyeddi-handoff instead.
heyeddi-handoff
Implements screens from designer screenshots and handoff notes. Two-pass workflow — designer writes mockup-brief with Implementation spec, implementer builds shell then route, verify_handoff checks tokens and layout. Use when approved mockups exist — not for greenfield design.
heyeddi-intake
Translates vague user prompts into HeyEddi product docs (personas, route intent, voice), route-specific handoff artifacts (wireframes, user mockups, or briefs), and skill-routing under .heyeddi/. Use first on new projects before @heyeddi-design, @heyeddi-handoff, or @flutter-engineering. Never hand-write product.md: use write_product.
heyeddi-orchestrator
Discover HeyEddi skills, auto-sync .heyeddi/ (skills index), cross-pillar opinions, and suggest @skills. Use at session start, after reinstalling skills, or when connecting heyeddi-product, ux-flow-auditor, and heyeddi-design on a route.
heyeddi-pr-review
Reviews submitted PRs using only committed changes: product fit, docs drift, engineering quality, test coverage, and pre-merge gate. Use when approving a PR, doing reviewer QA, or self-checking before requesting review. Not for replying to review comments (use heyeddi-pr-respond).
heyeddi-product
Product leadership: user stories, acceptance criteria, backlog, holistic reviews. Verifies the product works and is useful; delegates UX flow, design critique, visual contrast, and engineering audits; synthesizes plans and change recommendations. Use after @heyeddi-intake, before ship, or when the user asks for PM review, user stories, acceptance criteria, or "is this feature good enough?"
heyeddi-pr-respond
Addresses PR review feedback: fetch all comment types, fix-vs-decline decisions, apply fixes, re-run pre-merge gate, threaded replies. Use when responding to human review comments as the PR author. For reviewing a submitted PR use heyeddi-pr-review.
project-engineering
Ensures HeyEddi projects have the right engineering stack — Vue (Vite/Vitest), FastAPI backend, or Firebase tooling. Audits gaps, scaffolds as needed, installs deps, runs tests, documents local dev servers. Use when the repo is thin or before design/feature work on any HeyEddi app.
ux-flow-auditor
Traces user task flows with Playwright: click depth, step success, friction: and writes reports to .heyeddi/docs/ux-flows/. Use when measuring ease of use, clicks to complete a task, or onboarding friction. Not for static visual critique (use heyeddi-design critique) or layout screenshots (use visual-auditor).
visual-auditor
Captures screenshots, reviews UI against product.md and design.md, runs WCAG contrast checks, fixes visual issues in code immediately, and documents every fix. Use after craft/handoff or when UI looks wrong: not report-only QA.
database-admin
Expert database administrator specializing in modern cloud databases, automation, and reliability engineering. Masters AWS/Azure/GCP database services, Infrastructure as Code, high availability, disaster recovery, performance optimization, and compliance. Handles multi-cloud strategies, container databases, and cost optimization. Use PROACTIVELY for database architecture, operations, or reliability engineering.
discover
Extracts semantic memory from project analysis. Scans codebase, docs, and configs to understand tech stack, constraints, and goals.
Showing top 100 of 267 skills using Firebase by quality score.
See all 267 skills via search →Integration detected automatically from skill content. Some results may be false positives.