Firebase
CloudCommonly used with
Skills using Firebase (86)
moai-domain-database
Database specialist covering PostgreSQL, MongoDB, Redis, Oracle, and cloud database platforms (Neon, Supabase, Firestore). Use for schema design, query optimization, indexing strategies, data modeling, or cloud database selection. Cloud vendor guide absorbed from moai-platform-database-cloud.
moai-platform-auth
Authentication and authorization specialist covering Auth0, Clerk, and Firebase Auth. Use when implementing authentication, MFA, SSO, passkeys, WebAuthn, social login, or security features.
moai-platform-database-cloud
Cloud database platform specialist covering Neon (serverless PostgreSQL), Supabase (PostgreSQL 16 with real-time), and Firebase Firestore (NoSQL with offline sync). Use when choosing or setting up cloud databases.
analytics-setup
Generates protocol-based analytics infrastructure with swappable providers (TelemetryDeck, Firebase, Mixpanel). Use when user wants to add analytics, track events, or set up telemetry.
announcement-banner
Generates an in-app announcement banner system with remote configuration, scheduling, deep link actions, and dismiss tracking. Use when user wants in-app banners, promotional notices, maintenance alerts, or contextual announcements.
error-monitoring
Generates protocol-based error/crash monitoring with swappable providers (Sentry, Crashlytics). Use when user wants to add crash reporting, error tracking, or production monitoring.
feature-flags
Generate feature flag infrastructure with local defaults, remote configuration, SwiftUI integration, and debug menu. Use when adding feature flags or A/B testing to iOS/macOS apps.
vibe-build
Build your MVP following the AGENTS.md plan. Use when the user wants to start building, implement features, or says "build my MVP", "start coding", or "implement the project".
launchworthy
Production readiness audit that turns a demo into a real product. Built for apps shipped fast with AI coding tools (Lovable, Bolt, v0, Cursor, Claude Code). Auto-detects your stack and audits 5 domains (Frontend, Backend & Data, Auth & Security, Infrastructure, Operations), then produces a scored scorecard and a prioritized punch list with exact file paths and copy-paste fixes. Use before you go live, or on an app that is already live, when the user says "harden this", "is this production ready", "is this safe to launch", "will this survive real users", "audit my app", "turn this into a product", "production audit", "is my supabase secure", or wants to go from demo to production.
apk-redteam-pipeline
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.
hunt-cloud-misconfig
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).
firebase-cli
Safety-first Firebase CLI (firebase-tools v15) skill for full project control — deploy, Hosting (sites/channels/rollback), Cloud Functions (+secrets), Firestore (databases/indexes/backups/delete), Realtime Database, Auth import/export, Remote Config, App Distribution, App Hosting, Extensions, Data Connect, Emulator Suite & MCP server. Classifies every command by risk tier via a deterministic classifier script and gates destructive/irreversible/cost-incurring ops behind AskUserQuestion confirmation; enforces the --non-interactive/--force contract so nothing hangs and nothing is auto-confirmed. Wrong-project preflight prevents deploying to prod by accident. Ships a 3-level self-test (static classifier battery, live read-only, guarded live-write w/ cleanup). Use when running, planning, or debugging any `firebase` command.
revenue-check
Pull product revenue per app from Firestore (or fixtures) and produce a cash-flow report
hn-digest
Scan the Hacker News front page and report today's themes, hot discussions, and industry mix. One request gets the whole page; output is three sections: overview, hot discussions, industry mix. Use when asked to scan HN, get today's HN front page, see what's trending on Hacker News, or produce an HN digest. Triggers: "what's on HN today", "top HN today", "HN digest", "scan HN", "hacker news trends", "what's trending on Hacker News". Trigger phrases in any language count — match on meaning, not on these exact English strings. Does not read comment text — mining a specific thread's comments is a different job and not this skill.
create-auth-skill
Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.
slopsec
Security audit and hardening for vibe-coded SaaS apps. Use when reviewing, securing, hardening, or pen-testing an app — especially AI-generated / vibe-coded / "shipped fast" projects (Next.js, Supabase, Firebase, Express, serverless). Triggers: "is my app secure", "security review", "harden this", "check for vulnerabilities", "I'm about to launch", "audit before deploy", "exposed secrets", "leaked API keys", "before I ship". Walks the 50 most common ways vibe-coded apps get owned and produces a prioritized fix list.
kronos-agent
Financial time-series forecasting using the Kronos foundation model (MIT, NeoQuasar). Takes OHLC candles, returns predicted future candles with configurable horizon. Infrastructure skill — called by trader agents or scheduled ingestion, not directly invoked by users or the model.
migration-planner
Plan and track cross-platform or cross-service migrations (Supabase to Firebase, single to multi-tenant, schema migrations, etc). Generates rollback-safe migration plans with state tracking.
product-health-agent
Managed agent that analyzes production app engagement and operational health. Reads Firestore aggregates, Cloud Logging, and Cloud Monitoring; mounts source repos read-only; writes structured insights to a workspace Firestore collection. Designed for daily digests and on-demand deep dives on the Glam and SpinDineSwift production apps. Read-only by design.
audience-growth-tracker-sms
When the user wants to track follower growth, understand what drives new followers, or analyze audience development. Also use when the user mentions 'follower growth,' 'followers,' 'audience growth,' 'gaining followers,' 'losing followers,' 'who follows me,' or 'grow my audience.' Uses BlackTwist follower data when available. For post-level metrics, see performance-analyzer-sms. For content patterns, see content-pattern-analyzer-sms.
carousel-writer-sms
When the user wants to write content for a LinkedIn carousel, slide deck, or swipeable multi-slide format. Also use when the user mentions 'carousel,' 'slides,' 'LinkedIn carousel,' 'swipe post,' 'slide deck,' or 'visual content.' Outputs slide-by-slide text content (not visual design). For single posts, see post-writer-sms. For threads, see thread-writer-sms.
content-calendar-sms
When the user wants to plan a posting schedule, create a content calendar, or organize when and what to post. Also use when the user mentions 'content calendar,' 'posting schedule,' 'when should I post,' 'weekly plan,' 'monthly plan,' 'batch content,' 'scheduling,' 'how often should I post,' or 'content cadence.' For deciding what topics to cover, see content-strategy-sms. For writing the actual posts, see post-writer-sms.
content-pattern-analyzer-sms
When the user wants to find patterns in what content works and what doesn't. Also use when the user mentions 'what's working,' 'content patterns,' 'best topics,' 'best format,' 'best time to post,' 'analyze my content,' 'do more of,' 'do less of,' or 'what should I change.' For raw metrics, see performance-analyzer-sms. For audience-specific analysis, see audience-growth-tracker-sms. For actionable recommendations, see optimization-advisor-sms.
content-repurposer-sms
When the user wants to turn one piece of content into multiple formats or adapt content across platforms. Also use when the user mentions 'repurpose,' 'turn this into,' 'adapt this for,' 'cross-post,' 'reformat,' 'blog to social,' 'newsletter to posts,' or 'get more from this content.' For writing original posts, see post-writer-sms. For threads, see thread-writer-sms. For carousels, see carousel-writer-sms.
content-strategy-sms
When the user wants to plan a social media content strategy, decide what to post, or figure out topic clusters and content mix. Also use when the user mentions 'content strategy,' 'what should I post,' 'content ideas,' 'topic clusters,' 'content pillars,' 'content planning,' 'content mix,' 'I don't know what to post,' or 'social media strategy.' Use this to define the what and why of posting. For writing actual posts, see post-writer-sms. For scheduling, see content-calendar-sms. For platform-specific tactics, see platform-strategy-sms.
hook-writer-sms
When the user wants help writing opening lines, hooks, or first sentences that grab attention. Also use when the user mentions 'hook,' 'opening line,' 'first line,' 'scroll stopper,' 'attention grabber,' 'headline,' 'how to start my post,' or 'nobody reads past my first line.' Can be used standalone or invoked by other creation skills. For writing full posts, see post-writer-sms. For threads, see thread-writer-sms.
optimization-advisor-sms
When the user wants concrete recommendations on how to improve their social media performance. Also use when the user mentions 'what should I do next,' 'how do I improve,' 'optimize my social media,' 'recommendations,' 'suggestions,' 'next steps,' 'what's my biggest opportunity,' or 'help me grow.' Synthesizes insights from performance, audience, and pattern analysis into prioritized actions. For raw analytics, see performance-analyzer-sms. For growth tracking, see audience-growth-tracker-sms. For pattern detection, see content-pattern-analyzer-sms.
performance-analyzer-sms
When the user wants to analyze how their social media posts are performing. Also use when the user mentions 'analytics,' 'performance,' 'how did my posts do,' 'engagement,' 'impressions,' 'what's working,' 'post metrics,' 'my best posts,' or 'why isn't this post performing.' Uses BlackTwist analytics when available, works from user-provided data otherwise. For audience growth specifically, see audience-growth-tracker-sms. For pattern detection, see content-pattern-analyzer-sms. For actionable next steps, see optimization-advisor-sms.
platform-strategy-sms
When the user wants platform-specific tactical guidance for LinkedIn, Twitter/X, Threads, or Bluesky. Also use when the user mentions 'LinkedIn strategy,' 'Twitter strategy,' 'Threads strategy,' 'Bluesky strategy,' 'algorithm,' 'what works on LinkedIn,' 'cross-posting,' 'platform differences,' 'adapt my content,' or 'which platform should I focus on.' For overall content strategy, see content-strategy-sms. For writing posts, see post-writer-sms.
post-writer-sms
When the user wants to write a social media post for LinkedIn, Twitter/X, Threads, or Bluesky. Also use when the user mentions 'write a post,' 'draft a post,' 'LinkedIn post,' 'tweet,' 'Threads post,' 'Bluesky post,' 'social media post,' 'help me write,' or shares a topic and wants it turned into a post. For multi-part content, see thread-writer-sms. For carousels, see carousel-writer-sms. For opening lines specifically, see hook-writer-sms.
social-media-context-sms
When the user wants to set up or update their social media profile, voice, audience, content pillars, or platform preferences. Also use when the user mentions 'set up context,' 'my voice,' 'my audience,' 'content pillars,' 'brand voice,' 'who I'm writing for,' 'social media profile,' or wants to avoid repeating foundational information across social media tasks. Use this at the start of any new project before using other social media skills — it creates .agents/social-media-context-sms.md that all other skills reference.
thread-writer-sms
When the user wants to write a multi-part thread for Twitter/X, LinkedIn, or other platforms. Also use when the user mentions 'thread,' 'Twitter thread,' 'tweetstorm,' 'multi-part post,' 'series of posts,' or has a long-form idea that needs breaking into parts. For single posts, see post-writer-sms. For carousels, see carousel-writer-sms.
api-baas-firebase
Firebase backend-as-a-service — Firestore, Authentication, Cloud Functions v2, Storage, Hosting, Admin SDK, security rules, emulator suite
dart
Flutter & Dart development — the always-on coding baseline plus deep references for state management, architecture, navigation, UI/theming/animation, performance, data & networking, Firebase, media, monetization, native interop, and build tooling. Auto-applies when editing any Dart file. Use when writing or reviewing any Flutter/Dart code; read the reference matching your task.
mobile-engineer-role
Operate as a mobile engineer who plans around release trains, a real device matrix, and app-store rules that a web engineer never faces. Use when building or reviewing an iOS or Android feature and you need mobile-specific release and compatibility discipline.
monorepo-sync-types
Regenerate backend types and re-export them via packages/shared/types/ in a turborepo monorepo so both apps/web/ and apps/mobile/ consume a single typed surface. Supports Supabase (via supabase gen types typescript), neon-drizzle (via drizzle-kit introspect/pull + InferSelectModel/InferInsertModel re-exports — the default DB stack), tRPC (via inference from the server router import), and custom REST (via a manual or zod-derived schema). Reads .workflow/meta.json with stack.framework="monorepo" and stack.{auth,db} populated. Use when "rigenera i tipi da Supabase", "sync DB schema to packages/shared/types", "il backend è cambiato, aggiorna i tipi", "sync types from tRPC", "sync Drizzle types after a schema change". Not for: creating shared packages from scratch (use monorepo-add-shared-package), wiring the backend client itself (use module-add or rn-module-add).
rn-backend
Use to connect an Expo + RN app to a backend (auth, database, storage, realtime), agnostic of the provider. Teaches the shared patterns: secure-store for tokens, auth state via Zustand + TanStack Query, refresh-on-401 middleware, auth-gate routing via Expo Router (app)/_layout.tsx, row-level security vs API-auth concepts. Provider-specific details live in sub-references: Supabase (default, matches the course), Firebase, custom REST/JSON, tRPC. Triggers on: "setup backend", "setup auth with X", "connect Supabase/Firebase/my API", "secure token storage", "refresh token flow", "row level security". Not for: building the login UI (rn-add-screen — uses Form template), push notifications (rn-push-notifications), payments (rn-publishing-payments).
rn-module-add
Use to wire a backend/infra module (auth, db, storage, realtime, push, payments) into a scaffolded Expo + RN app. Reads .workflow/meta.json with stack.framework="expo-rn" and the user-chosen provider for each module (Supabase, Firebase, custom REST, tRPC, RevenueCat). Installs deps, generates the wiring code (lib/auth.ts, lib/supabase.ts, etc.), updates meta.json#stack to record the choice. Always idempotent. Triggers on: "add auth", "wire up db", "set up Supabase", "set up Firebase", "add payments", "add push" (the server-side part), "aggiungi modulo X". Not for: building UI for the module (rn-add-screen does the login screen, etc.), client-side knowledge only (rn-backend, rn-push-notifications), scaffolding (rn-bootstrap).
rn-push-notifications
Use when adding push or local notifications to an Expo + RN app: requesting permissions at the right moment, registering for push (Expo push service in dev, APNs/FCM direct in prod), handling foreground + tapped + cold-start notifications, deep linking from a notification payload to a specific route, scheduling local notifications, badge management. Triggers on: "add push notifications", "local notification", "deep link from notification", "iOS/Android push setup", "register for notifications". Not for: backend setup that sends the notifications (rn-backend), animations on a notification badge (rn-animations-gestures).
database
Database design, SQL, NoSQL, and data management
super-claudiosoftware-development
Software development skill. Use when the user wants to build, code, automate, or deploy anything technical. Covers backend APIs, databases, workflow automation, scripts, free public APIs, and hosting/deployment. Trigger on backend: "build an API", "REST API", "database schema", "Supabase", "Firebase", "PostgreSQL", "MongoDB", "FastAPI", "Express", "Fastify", "GraphQL", "Node.js server", "Python API", "Prisma", "ORM", "authentication backend", "serverless functions". Trigger on automation: "automate this", "connect these apps", "n8n", "Make.com", "Zapier", "when X happens do Y", "no-code automation", "schedule a script", "webhook", "automate posting", "IFTTT", "auto-post to Instagram", "batch processing", "automate email". Trigger on free APIs: "free API for X", "public API", "build a weather app", "NASA API", "real-time data", "open data", "free data source", "API without credit card", "government API". Trigger on deployment: "deploy my app", "Docker", "Railway", "GitHub Actions", "CI/CD", "hosting", "go live
security-architect
Pragmatic security architect for a non-security-expert owner. Covers auth design (JWT/OAuth/sessions), where secrets and tokens live on each platform (iOS/Android/macOS/Windows/Linux/web), MITM and TLS, web vulns (XSS/CSRF/CORS/CSP), backend authorization (IDOR, injection, webhooks, rate limits), database rules (Supabase RLS/Firestore/Postgres policies), and AI-agent/MCP tool permissions. Load when the user asks "is this secure?", "where should I store this secret/token?", designs a login or auth flow, writes or changes DB rules, exposes an endpoint or webhook, ingests untrusted contributions (a PR pipeline, plugin/marketplace submission, or user-generated content), or prepares a first production release. Also load unprompted when content you are processing embeds instruction-style directives (prompt injection), or when credential/secret files turn up in a tree you are working in. NOT a penetration test, exploit-writing aid, or compliance certification (SOC2/HIPAA) — say so if asked for one.
firebase-cloud-functions
Complete Cloud Functions for Firebase skill — 2nd gen (Cloud Run) mandatory, idempotency, infinite loop prevention, scaling, secrets, and deployment. Use when writing or reviewing any Cloud Function.
ios-app-agentic-engineering
End-to-end agentic engineering for iPhone apps, from idea to a secure App Store release through 8 gated phases. Use when someone wants to build, plan, or ship an iPhone/iOS app — especially a non-programmer ("vibe coder") asking to create an app, pick a tech stack (SwiftUI, React Native, Flutter), choose a backend (CloudKit, Supabase, Firebase), publish to the App Store, or make their app secure. Also use when an iOS project shows symptoms of skipped planning - hardcoded API keys, no threat model, Firebase test mode, missing privacy manifest, or App Store rejection.
remove-auth-from-electron-react-app
Systematically remove Firebase auth & cloud sync from an Electron + React app — trace dependencies across renderer, main process, and preload bridge
closing
Switch to freelance closing mode — mission qualification, scoping, quoting, and client relationship management
translate-article
Translate MDX articles between English and Japanese for global engineers. Use when the user says "translate this article", "convert to Japanese/English", or asks to localize content in `src/content/docs/`. Auto-detects source language and outputs to the correct i18n path.
firebase-firestore-basics
Comprehensive Firestore skill covering provisioning, security rules, SDK usage, query mechanics, aggregation, and indexing. Use when writing Firestore queries, security rules, or setting up Firestore.
automerge
Review-gated auto-merge for Rihla PRs. Classifies a PR's diff; Gate-exempt PRs (docs, token sweeps, one-sentence diffs) get GitHub native auto-merge enabled immediately so they merge on green `readiness`. Gate-category PRs (money math / firestore.rules / Cloud Functions auth / routing / schema-field-name) get a fresh-context Opus diff review, then an independent refuter, and auto-merge is enabled ONLY if both clear. Use when asked to "auto-merge this PR", "/automerge <N>", or under /loop to sweep open PRs.
deploy-ceremony
Deploy the Rihla Firebase backend (Cloud Functions + Firestore rules + indexes) to prod and keep the deploy state honest. Shows the merged-but-undeployed delta first (pending_deploy.sh), runs the commit-bound deploy + prod-state verify, advances the `backend-deployed` source-of-truth tag, then records the deploy in docs/DEPLOY-LEDGER.md and clears stale "⚠️ NOT deployed" flags. Use when asked to "deploy the backend", "run the deploy ceremony", "ship the functions", or after merging a Functions/rules PR.
run-the-gate
Fresh-context spec review before implementation for Rihla money/rules/routing/schema changes. Spawns TWO parallel zero-history Opus subagents per round — a rubric reviewer (7 verification principles) and an orthogonal-axis adversary (off-map regressions, derived surfaces, l10n pairs) — applies the union of P1 findings, and re-runs until both verdicts are clean in the same round. Use before writing code that touches BalanceCalculator/MoneySerializer, firestore.rules or Cloud Functions auth, app_router.dart / deep-links / back-guards, or any field-name/schema change with both a read-path and a write-path. Use when asked to "run the Gate", "gate this spec", or "fresh-context review".
backlog-bug
Create a BUG ticket quickly
backlog-feat
Create a FEATURE ticket quickly
audit
Comprehensive codebase audit skill covering 10 systemic bug categories plus CI automation. Use this skill proactively during code review, E2E testing, pre-deployment checks, or whenever you spot any of these patterns — raw database values in UI (snake_case, camelCase enums, numeric codes), API contract mismatches between client and server, Firestore/database rules gaps, CORS missing production domains, analytics/consent gating features, dynamic Tailwind/CSS classes purged in prod, window.open without noopener, orphaned data on deletion, hardcoded secrets, Android/iOS security misconfigs, performance regressions (bundle size, re-renders, lazy loading), or accessibility gaps (missing aria labels, keyboard nav, screen reader). Also triggers on "audit this", "did you check everything", "is this production ready", "what did we miss", "are you sure", or any thoroughness question. One bug instance always means many more exist — this skill enforces the ripple search.
agentic-dev-loop
系統化開發工作流，把「先研究 → 寫 plan.md → 依計畫實作 → 部署前雙閘驗證 → 部署」固定成一條可重複的迴圈，專為單人維護多個 Firebase / Google Apps Script / GCP Cloud Run 專案的情境設計。核心是「計畫先行、狀態外部化到檔案、依專案風險分級決定授權與驗證強度」，作為編排器串接三個既有 skill：進入專案前若尚未建立連動禁區 → project-guardrails 分析並寫入 CLAUDE.md，規劃時據以避開「改 A 壞 B」；部署前 Verify 雙閘 → web-security-reviewer 做安全/個資/壓力驗證、ui-ux-deploy-reviewer 做 UI/UX 與呈現層審查（僅當有前端介面）。MANDATORY TRIGGERS：使用者說「開一個新功能」「幫我規劃這個開發」「從頭把這個功能做到上線」「先研究再做」「整理成 plan.md」「這個專案要怎麼做（指要從規劃做到上線，不是單純問方向）」「修這個 bug（要有計畫地修）」「<專案名> 要加東西」（以專案名開頭的開發需求）「要部署到 Firebase / Cloud Run」「GAS 寫一個…」「我有個想法想做成���具」「幫我排開發的步驟」「走完整個開發到部署的流程」，或貼上 issue 連結、錯誤截圖、需求描述並希望有系統地把它從規劃做到上線時，都要套用此 skill。注意分流：若使用者只要「單獨檢查 UI/UX」用 ui-ux-deploy-reviewer、只要「單獨做安全審查」用 web-security-reviewer、只要「分析專案禁區」用 project-guardrails；本 skill 是把這些串成完整迴圈的編排器，當意圖是「有規劃、可重現、會走到上線」的整段開發時才觸發。**重要安全防漏：若使用者說的是泛泛的「部署前檢查」「上線前幫我檢查」而沒指明只要 UI/UX 或只要安全，應由本 skill 接手走 Verify 雙閘（同時跑 web-security-reviewer 與 ui-ux-deploy-reviewer），絕不要只做其中一道——尤其不要只做 UI/UX 而漏掉安全閘，那會讓含學生個資的專案在沒過安全驗證下就上線。**SCOPE：本 skill 是工作流編排器，不取代使用者對計畫的閱讀與判斷；只在使用者自己的專案上運作，不協助繞過授權
engineering
Universal coding standards, security (OWASP, secrets, input validation), testing, naming conventions, error handling, SOLID/KISS/DRY/YAGNI. Sub-skills: backend-principles (APIs, serverless, rate limiting, CORS), web-app-frontend (React, Vue, GSAP, ShadCN, Tailwind, TypeScript), firebase-cloud-functions (2nd gen, idempotency), firebase-firestore (queries, security rules, indexing).
wnb-koin-feature-module
Use this skill when adding a new feature to an Android + Koin project, or when reviewing dependency injection wiring. Enforces feature-scoped Koin modules — one `Module` per feature package (customerModule, sellerModule, authModule, …) that bundles the feature's ViewModels and feature-only bindings, alongside concern-scoped modules (databaseModule, ktorModule, dispatcherModule, firebaseModule) for cross-cutting infrastructure. Requires `viewModelOf(::XxxViewModel)` for simple constructors, `viewModel { … }` for manual wiring, `single` vs `factory` semantics, `named(...)` qualifier for parallel bindings of the same type, all modules merged into a single `appModules` list, `startKoin { modules(appModules) }` only in `Application.onCreate`. Triggers on "add koin module", "koin binding", "viewModelOf", "koin module", "single vs factory", "named qualifier", "startKoin", "loadKoinModules", "feature module", "DI wiring", "inject viewmodel".
firebase-deploy
Deploy the ontology-atlas static site to Firebase Hosting from this repo. Use when the user asks to deploy, redeploy, publish the site, update Firebase Hosting, or verify the live web.app URL. The workflow must read `.env.prod`, build the static export, deploy only Hosting, and verify the live URL. Never commit `.env.prod` or introduce Firebase backend services.
appstore-publish
mimi-seed MCP로 App Store Connect에 릴리스 노트와 스크린샷을 업로드한다. Use when publishing iOS App Store metadata updates via mimi-seed MCP in Claude Code or Codex.
deploy
CI 빌드 → 출시 준비도 점검 → 릴리스 노트 생성 → 스토어 적용을 잇는 mimi-seed 풀 배포 파이프라인 스킬. Use when running an end-to-end release (build → check → notes → apply) via the mimi-seed MCP / CLI across Play Store and App Store.
mimi-seed
mimi-seed MCP(@yoonion/mimi-seed-mcp)로 Google Play·App Store Connect·Firebase·AdMob 출시 운영을 Claude Code/Codex에서 바로 실행하는 범용 진입 스킬. deferred-tool 로딩(ToolSearch select)과 비가역 작업 안전수칙을 포함한다. Use when a user asks to do app-store / Firebase / AdMob / CI ops via the mimi-seed MCP and you need the correct tool-loading order, workflows, and safety rules.
mimi-seed-install
mimi-seed-sdk 를 소스(git clone)에서 설치한다 — 두 패키지 install·build·npm link → Claude Code MCP + Codex marketplace/plugin 등록 → 언어 선택 + 계정 연결(mimi-seed setup)까지. Use when the user has cloned mimi-seed-sdk and asks to install / set it up from source, or when `mimi-seed` is not on PATH in a checkout of this repo.
mimi-seed-onboarding
mimi-seed 를 처음 쓰는 사용자를 온보딩한다 — 설치 상태 판별 → mimi_seed_status 연결 스캔 → 목표 선택(출시/Firebase·AdMob/분석/소셜/CI) → 목표에 필요한 최소 자격증명만 `npx mimi-seed setup` 으로 연결 안내 → 첫 읽기 전용 액션 성공 → 도메인 스킬 인계. "뭘 할 수 있어?" 질문에는 mimi-seed://tools/catalog 리소스로 답한다. Use when a user asks to set up or get started with mimi-seed, asks what mimi-seed can do, is using it for the first time, or asks what to do first after installing the plugin or MCP server.
mimi-seed-update
mimi-seed를 최신 버전으로 올린다 — MCP 서버(@yoonion/mimi-seed-mcp) · 스킬 번들(플러그인) · CLI(mimi-seed). 설치 형태(플러그인 / 전역 npm / npx 등록 / 개발 클론)를 먼저 판별해 그에 맞는 명령만 실행하고, "설치된 버전"이 아니라 "실제로 돌고 있는 버전"을 검증한다. Use when the user asks to update or upgrade mimi-seed, when a newly released MCP tool does not show up, or when mimi-seed tools look stale or missing.
playstore-publish
mimi-seed MCP로 Google Play 스토어 등록정보·이미지·릴리스 노트를 업로드하고 트랙 출시/승격을 처리한다. Use when publishing Android Play Store metadata, images, or releasing/promoting a track via the mimi-seed MCP.
video-create-publish
Create, render, validate, and optionally publish polished short-form videos and YouTube Shorts with Mimi Seed. Use for story-to-video production, vertical social videos, carousel-to-video adaptations, visual-quality revisions, or YouTube upload/status work where typography, human-safe cropping, motion design, asset provenance, and publish confirmation matter.
add-platform
Add support for a new AI coding tool, IDE, PR-reviewer, or context-packer to VibeTags — wire a new generated output file through ServiceRegistry, Platform, the renderer registry, and (if granular) GranularRulesWriter. Use when the user says "add platform support", "support <tool>", "generate a new output file for X", "new AI platform", or names an AI coding assistant/IDE/PR-reviewer/context-packer VibeTags doesn't yet generate a file for.
cloud-test-grids
When the user wants to design, integrate, or operate against a cloud-hosted browser / device test grid — BrowserStack, Sauce Labs, LambdaTest, AWS Device Farm, Firebase Test Lab, Perfecto, Kobiton. Use when the user mentions "BrowserStack," "Sauce Labs," "Sauce," "LambdaTest," "AWS Device Farm," "Firebase Test Lab," "cloud grid," "cloud-hosted devices," "real-device cloud," or "bstack:options / sauce:options / lt:options." For self-hosted grids see selenium-grid. For specific test tools see playwright / cypress / selenium / appium.
espresso
When the user wants to design, implement, debug, or stabilize Espresso tests for native Android UI automation. Use when the user mentions "Espresso," "onView," "ViewMatchers," "withId," "IdlingResource," "ActivityScenario," "ActivityScenarioRule," "AndroidJUnitRunner," "androidx.test," "instrumented tests," "Espresso Intents," "Espresso Web," or "@RunWith(AndroidJUnit4)." For cross-platform mobile see appium. For iOS-native see xcuitest. For React Native see detox. For YAML-driven flows see maestro.
google-ads-app-campaigns
Build App campaigns for install and in-app action goals across Search, Display, YouTube, Discover, and Google Play. Triggers on 'set up an App campaign', 'get more app installs', 'app engagement campaign', or 'App campaigns for engagement'. Fully automated app-promotion format — distinct from web-focused campaign types.
project-guardrails
分析專案程式碼，找出「改 A 會壞 B」的連動禁區——高扇入模組、資料結構契約、部署設定、對外契約、演算法核心——經確認後寫入該專案的 CLAUDE.md。當使用者要建立 guardrails、問哪些程式碼不能亂動、哪些模組牽一髮動全身時觸發。也是 agentic-dev-loop Step 0 的前置階段。
project-guardrails
為專案建立「連動禁區」防護段落。自動分析專案程式碼,找出高扇入模組、資料結構契約、部署設定、對外契約與演算法核心等「改 A 會壞 B」的高風險區域,經使用者確認後寫入該專案的 CLAUDE.md,作為日後所有修改行為的防護依據。MANDATORY TRIGGERS:使用者說「建立連動禁區」「設定 guardrails」「init guardrails」「幫這個專案建立防護」「分析哪些程式碼不能亂動」「哪些模組牽一髮動全身」「建立修改防護段落」「把禁區寫進 CLAUDE.md」,或在新專案開始前要求建立修改安全機制時,都要套用此 skill。適用於 Firebase/PWA、GAS、後端服務等各類專案。SCOPE:本 skill 只做分析與(經確認後的)CLAUDE.md 寫入,不修改任何程式碼。本 skill 同時是 agentic-dev-loop 開發迴圈的「前置」階段：當該編排器在 Step 0 發現專案尚未建立連動禁區時會呼叫本 skill；使用者單獨要求分析禁區時仍直接觸發本 skill。
ui-ux-deploy-reviewer
部署前的 UI/UX 總體檢。以全球公認的 20 項 UI/UX 原則(Nielsen 十大易用性啟發法 + 互動心理學定律 + 可及性與適應性)逐項審視網站或 Web App 的前端程式碼與使用者體驗,輸出「依嚴重度排序的問題清單 + 修正建議 + 部署放行檢核表」。MANDATORY TRIGGERS:使用者說「部署前 UI/UX 檢查」「deploy 前跑一次 UI/UX」「上線前幫我檢查 UI/UX」「審查 UI/UX」「用 20 原則檢視」「這個網站好不好用」「易用性審查」「heuristic evaluation」「檢查使用者體驗」,或在準備 firebase deploy / 上線 / 發布前要求做最後檢查時,都要套用此 skill。即使使用者沒明說「UI/UX」,只要意圖是部署前對介面與體驗做整體審視,就觸發。SCOPE:本 skill 審查 UI/UX 與呈現層程式碼品質;資訊安全審查請改用 web-security-reviewer。本 skill 同時是 agentic-dev-loop「Verify 雙閘」的 UI/UX 閘。分流原則：泛泛的「部署前／上線前檢查」（未指明只要 UI/UX）應交給 agentic-dev-loop 走雙閘，以免漏掉安全審查；本 skill 只在意圖明確聚焦 UI/UX／易用性／20 原則時觸發。
apple-three-piece-analytics
Default analytics stack for solo / small Apple-platform Apps — App Store Connect Analytics + MetricKit + Game Center (for games), no third-party tracking SDK by default, PrivacyInfo.xcprivacy mandatory. Invoke when starting a new project, deciding analytics SDK (vs Firebase / TelemetryDeck / Amplitude), writing PrivacyInfo, or when asked "should I integrate Firebase / Mixpanel / TelemetryDeck".
build-time-secret-injection
Use when introducing an AdMob production ID (`GADApplicationIdentifier` / `GADBannerUnitID`), ASC API `.p8` key, or any "ships in binary but must stay out of public-repo PR diffs" identifier into an Apple build. Codifies the xcconfig + Info.plist `$()` substitution + `Bundle.main` read pattern, paired with `secrets/.env` for CLI tooling; multi-app `CI_PRODUCT` dispatch + built-bundle smoke-test. Build-time injection mechanism, not the repo-hygiene baseline; for secret-leak prevention (gitleaks, lefthook, GitHub Secret Scanning) see apple-public-repo-security.
monetization-sdk-integration
Invoke when adding, upgrading, or auditing any third-party monetization SDK (AdMob, UMP, StoreKit wrappers, RevenueCat, ironSource, etc.). Also invoke when reviewing PR diffs that touch your monetization target's ad-bridge sources, or when anyone proposes `import GoogleMobileAds` outside the existing live-bridge file.
kappmaker
KAppMaker CLI - automate mobile app bootstrapping, AI logo/screenshot generation, App Store Connect setup, Google Play Console setup, Adapty subscriptions, image tools, Android builds, store publishing, package refactoring, and version bumping. Use when the user wants to create a mobile app, generate logos, screenshots, translate screenshots, set up App Store Connect, configure Google Play Console (listings, subscriptions, IAPs, data safety), configure Adapty, add a new subscription or credit-pack IAP to an existing app, process images, convert images to WebP, build Android releases, generate keystores, publish to Play Store or App Store, refactor package names, or bump versions.
analyze
Deep cross-layer consistency audit for any codebase. Traces every feature from UI to database, finds broken wiring, missing handlers, model mismatches, and security gaps. Auto-fixes critical and warning issues. Use this after building features, before releases, or whenever something feels off. Works with any tech stack.
cost-analysis
Analyzes infrastructure costs at 1K-100K user scales by reading the actual codebase, auto-detecting cloud providers, modeling per-action costs, and projecting total monthly spend with optimization recommendations.
issue-create
File a new GitHub issue in the checked-out repo — search first for duplicates/adjacent issues to update or reference, detect the repo's issue template if any, then compose title/body/labels/milestone matching house style. Use when asked to file, create, open, report, or track an issue.
cloud-architecture-gcp
GCP service-level architecture knowledge — compute (Cloud Run/GKE/Cloud Functions/GCE), data (Cloud SQL/Spanner/Firestore/Bigtable), messaging (Pub/Sub/Cloud Tasks/Workflows), analytics (BigQuery), edge (Cloud CDN/Load Balancing/API Gateway), storage + secrets (GCS/Secret Manager/Artifact Registry), and Vertex AI. Cost models, quotas, failure modes, and cold-start gotchas. Activate when the active cloud is GCP and the work involves designing, scaling, costing, or diagnosing GCP architecture (Cloud Run cold starts, Cloud SQL connection limits, Spanner hot spots, egress, Pub/Sub backlog).
google-play-growth
Understand Google Play growth and Google Ads app acquisition. Use when evaluating Android app growth strategy, Google Ads App campaigns, Google Play store listing optimization, store listing experiments, custom store listings, web-to-app flows, Android app-growth cost planning such as CPI, CPA, tCPA, tROAS, and the measurement realities around Google Ads, GAID, Firebase, and modern attribution.
create-auth
Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.
firebase
Firebase Firestore, Auth, Storage, real-time listeners, security rules
android-backend-integration-desk
define Android service and API integration, auth, sync, payments, push notifications, analytics, remote config, multiplayer, leaderboards, cloud saves, retries, offline behavior, and failure modes.
gcp-expert
Use when the request names GCP, Google Cloud, gcloud, GCE, GKE, Cloud Run, Cloud Functions, BigQuery, Cloud SQL, Spanner, Firestore, AlloyDB, Pub/Sub, Cloud Storage, GCS, VPC, Cloud Load Balancing, IAM, Workload Identity, Workload Identity Federation, Cloud KMS, Secret Manager, Cloud Logging, Cloud Monitoring, Cloud Trace, Cloud Build, Artifact Registry, VPC Service Controls, or Organization Policy. Produces service selection rationale, IAM and project layout, VPC and Cloud NAT topology, Workload Identity Federation trust for CI, BigQuery partition and cluster plans, Cloud Run service skeletons, GCS lifecycle and KMS configuration, and cost guardrails. Do not invoke for AWS, Azure, or non Google Cloud platforms; route those to aws-expert or the relevant cloud skill.
Integration detected automatically from skill content. Some results may be false positives.