SoluDevTech
OrganizationAgentic Coding Workflow
Categories
Indexed Skills (37)
vercel-react-best-practices
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
async-python-patterns
Comprehensive guidance for implementing asynchronous Python applications using asyncio, concurrent programming patterns, and async/await for building high-performance, non-blocking systems.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
code-reviewer
Use to review the code, Invoke when you finished the task asked by the user. Grades the code on a scale from 1 to 10 across 6 dimensions (correctness, security, performance, maintainability, testability, architecture) with a per-dimension breakdown and an overall score that gates merging.
code-simplifier
Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Focuses on recently modified code unless instructed otherwise.
dbanalyze
Analyze a database schema by running SchemaCrawler lint and extracting the full schema via information_schema. Use this skill whenever the user wants to audit a database schema, check normalization, detect missing indexes, redundant indexes, nullable FK columns, inconsistent data types, design smells, or get improvement recommendations.
feature-implementation
Skill-driven development workflow for implementation tasks. Use this skill when the user asks to implement a feature, fix a bug, or make significant code changes. Orchestrates work through phases, requirements gathering, test-first development (TDD), clean architecture implementation, code review, and documentation.
githubpr
Manage the full GitHub PR lifecycle from a Jira ticket create a branch with the format <JIRA-ID>/<simple-description>, push, open a PR for review, poll CI, and merge when green. Use this skill whenever the user mentions creating a PR, opening a pull request, pushing a branch for review, or linking a Jira ticket to a GitHub PR. Also trigger when the user asks to wait for CI, merge a PR or manage the git workflow around a Jira ticket.
hexagonal-nestjs-patterns
NestJS/TypeScript backend with hexagonal architecture, SOLID, and KISS. Project structure, ports as abstract classes (inbound/outbound split), Zod entity/DTO validation, injection tokens, exception filters, Swagger via zod-openapi. Use when implementing or refactoring a NestJS backend following hexagonal architecture.
hexagonal-python-patterns
FastAPI backend with hexagonal architecture, SOLID principles, and KISS. Project structure, config, dependencies, routes, use cases, entities, errors, logging, and ports patterns.
hexagonal-react-patterns
React/TypeScript frontend with hexagonal architecture, SOLID, and KISS. Project structure, layer rules (domain pure-TS, application/hooks, infrastructure/adapters), ports, CVA variants, Zod-in-domain, and full checklists. Use when implementing or refactoring a React app following hexagonal architecture.
iac-review
Static review of Kubernetes/Flux manifests in a GitOps repo (K3s + Flux CD). Scores manifests on 10 across correctness, security, reliability, consistency, GitOps hygiene, and maintainability. Use when reviewing PRs that change deployments, services, ingresses, network policies, external secrets, Flux Kustomizations, Helm values, or any K8s manifest — before it reaches the cluster. Complements popeyescan (runtime audit).
linter
Run linting and formatting checks on the codebase. Use this skill when code changes are made and need static analysis validation. Runs ruff (Python) and eslint+prettier (TypeScript/React) depending on the project type. Invoke after implementation and before code review.
loop-implementation-review
Implementation loop wrapping feature-implementation. Adds mandatory NEW e2e QA tests in @soludev-compose-apps/<app_name>, a zero-critical-issues code review gate, one draft PR per modified repo, and a reviewer loop until 0 critical issues and score >= 8/10. Use when the user asks to implement a feature/evolution/bugfix and loop until QA, code review, and PR reviewer sign-off are all green.
performance-audit
Deep performance audit for Python and React codebases. Use this skill ANY TIME the user shares code and mentions performance, slow queries, latency, re-renders, optimization, profiling, bottlenecks, or memory issues — even if they don't use the word "audit". Also trigger when the user pastes code and asks "is this efficient?", "why is this slow?", "how can I improve this?", or shares ORM/database code (Django, SQLAlchemy, Prisma, TypeORM) where N+1 query risks are high. Covers: N+1 queries, missing indexes, loop anti-patterns, React re-render storms, missing memoization, bundle bloat, async misuse, memory leaks, caching strategy opportunities (query caching, HTTP caching, client-side caching, cache invalidation triggers), and 20+ other patterns across both stacks.
popeyescan
Run a Popeye scan on a Kubernetes/K3s cluster and produce a prioritized analysis. Use this skill whenever the user wants to audit cluster health with Popeye, run popeye, analyze popeye output, triage cluster warnings, check missing probes or resource limits, orphaned services, or review cluster quality score. Also use when the user pastes raw popeye output and asks for analysis, prioritization, or next steps.
sonarfix
SonarQube issue remediation workflow. Use this skill when the user asks to fix SonarQube issues, run a code quality sweep, or remediate static analysis findings for a project. Retrieves issues via the SonarQube REST API using curl, groups them, presents a fix plan, and implements fixes in batches with test verification.
tester-qa
Manually test the app after a functionality is done. Two modes — Bug Hunt (find real bugs and produce BUG_REPORT.md) and QA (write/fix Playwright specs in @soludev-compose-apps e2e repo). Use after the developer finishes writing code, tests, and documentation.
trivyfix
Trivy vulnerability remediation workflow. Use this skill when the user asks to fix Trivy vulnerabilities, run a security scan, or remediate CVE findings for a project. Runs trivy CLI scans, groups findings by severity and type, presents a fix plan, and implements fixes in batches with verification.
promptfoo-framework-dod-ai-ethics
Test AI systems against the DoD AI Ethical Principles (Responsible, Equitable, Traceable, Reliable, Governable) with promptfoo. Use when measuring ethical and security risk for DoD-aligned AI systems, testing human accountability, bias minimization, auditability, safety, and governability.
promptfoo-framework-nist-ai-rmf
Test AI systems against the NIST AI Risk Management Framework (AI RMF) with promptfoo. Use when measuring AI risks across the four core functions (Govern, Map, Measure, Manage), testing specific MEASURE categories (safety, security, privacy, fairness, misuse), or demonstrating NIST AI RMF compliance for federal AI guidelines.
promptfoo-framework-owasp-agentic
Test AI agent applications against the OWASP Top 10 for Agentic Applications (ASI01-ASI10) with promptfoo. Use when testing agent goal hijack, tool misuse, identity/privilege abuse, agentic supply chain, unexpected code execution, memory/context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, or rogue agents.
promptfoo-framework-owasp-api
Test LLM applications with API access against the OWASP API Security Top 10 (2023) with promptfoo. Use when testing BOLA (API1), broken authentication (API2), excessive data exposure (API3), resource consumption (API4), BFLA (API5), sensitive business flows (API6), SSRF (API7), security misconfiguration (API8), inventory management (API9), or unsafe API consumption (API10).
promptfoo-framework-owasp-llm
Test LLM applications against the OWASP LLM Top 10 (2025) with promptfoo. Use when testing for prompt injection (LLM01), sensitive information disclosure (LLM02), supply chain vulnerabilities (LLM03), data/model poisoning (LLM04), improper output handling (LLM05), excessive agency (LLM06), system prompt leakage (LLM07), vector/embedding weaknesses (LLM08), misinformation (LLM09), or unbounded consumption (LLM10).
promptfoo-redteam-agents
Red team LLM agents, MCP servers, and multi-turn chatbots with promptfoo. Use when testing agents for privilege escalation (RBAC/BOLA/BFLA), memory poisoning, multi-stage attack chains, tool/API manipulation, objective hijacking, MCP tool poisoning, tool shadowing, cross-server attacks, and multi-turn conversation manipulation. Covers layered testing (black-box/component/trace-based), OpenTelemetry tracing, trajectory assertions, and stateful strategies.
promptfoo-redteam-foundation-models
Assess foundation and fine-tuned LLM security with promptfoo — dynamic red team scans against live models plus static ModelAudit scanning of model files. Use when baseline-testing a base/foundation model, comparing multiple models side-by-side, scanning model files for trojans/malicious pickle/embedded executables, running HarmBench standardized benchmarks, or contributing results to promptfoo.dev/models.
promptfoo-redteam-guardrails
Test and validate LLM guardrails (Azure Content Filter, AWS Bedrock Guardrails, NVIDIA NeMo, OpenAI moderation, Google Model Armor) with promptfoo. Use when benchmarking content filters, measuring true/false positives, testing evasion resistance, configuring Model Armor with Vertex AI, or comparing guardrail vendors.
promptfoo-redteam-llm
Red team an LLM application end-to-end with promptfoo — the foundational workflow. Use when setting up the first red team for an LLM app, configuring prompts/targets/plugins/strategies, generating adversarial test cases, and reviewing the vulnerability report. Covers OWASP LLM01/08/09, PII, harmful content, hallucination, hijacking.
promptfoo-redteam-multi-input
Red team multi-input LLM applications with promptfoo — apps that combine user identity, session context, form fields, and messages into one request. Use when testing authorization bypass + prompt injection combos across multiple fields, role confusion attacks, BOLA/BFLA/RBAC with user_id + action inputs, typed DOCX/PDF/image upload workflows, and role-based context testing.
promptfoo-redteam-multimodal
Red team vision, audio, and video LLMs with promptfoo. Use when testing multimodal models against image-embedded harmful text, audio-delivered harmful content, video-embedded attacks, static image + variable text, real unsafe images (UnsafeBench), or VLGuard dataset. Covers the critical injectVar setting, image/audio/video strategies, and dataset plugins.
promptfoo-redteam-rag
Red team Retrieval-Augmented Generation (RAG) applications with promptfoo. Use when testing RAG systems for prompt injection via retrieved context, context injection from compromised knowledge base documents, data poisoning, source attribution fabrication, data/PII exfiltration, context window overflow, and component-level (retrieval vs generation) isolation.
promptfoo-redteam-supply-chain
Secure the LLM supply chain and detect model drift with promptfoo. Use when establishing behavioral baselines, setting up CI/CD pre-deployment security gates, detecting model drift via ASR thresholds, running vendor acceptance tests, comparing fine-tuned vs base models, integrating static (ModelAudit) + dynamic (red team) gates, or alerting on security regressions over time. Covers OWASP LLM03 supply chain vulnerabilities.
promptfoo-strategies-custom-regression
Custom, composition, and regression red team strategies for promptfoo — custom (text-based multi-turn), custom strategy scripts (JavaScript), layer (compose multiple strategies sequentially), retry (regression testing from historical failures). Use when creating user-defined attack strategies, chaining strategies together (jailbreak → encoding, agentic → multimodal), building regression test suites from past failures, or writing custom JavaScript strategy transforms.
promptfoo-strategies-dynamic
Dynamic (iterative, single-turn) red team strategies for promptfoo — jailbreak, jailbreak:composite, jailbreak:meta, jailbreak:tree, best-of-n, GCG, citation, likert, math-prompt, authoritative-markup-injection. Use when an LLM-as-attacker iteratively refines prompts to bypass security controls, building attack taxonomies, chaining research techniques, or using academic framing.
promptfoo-strategies-indirect-injection
Indirect prompt injection strategy for promptfoo — indirect-web-pwn. Use when testing AI agents with web browsing capabilities for manipulation via malicious instructions embedded in web pages they fetch. Tests data exfiltration (with data-exfil plugin, deterministic server-side tracking) and behavior manipulation (with any other plugin, LLM-based grading). Supports layering with jailbreak strategies for more effective attacks.
promptfoo-strategies-multi-turn
Multi-turn (conversational) red team strategies for promptfoo — crescendo, goat, goblin, hydra, mischievous-user. Use when testing stateful chatbots or agents that maintain conversation history, gradually escalating harm over multiple turns, branching across conversation paths with persistent memory, or simulating persistent creative users.
promptfoo-strategies-static
Static (deterministic, single-turn) red team strategies for promptfoo — base64, hex, ROT13, leetspeak, homoglyph, image/audio/video encoding, jailbreak-templates, camelCase, emoji smuggling, morse code, pig latin. Use when testing filter bypass via encoding, character substitution, known jailbreak templates, or multimodal encoding without an LLM-as-attacker.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.