adnanmokhtar
UserWrite your AI coding setup once, run it in every tool. One source of truth — 149 commands, 88 agents, 116 skills, 23 role-based packs — compiled into the native format of Claude Code, Cursor, Gemini CLI, OpenCode, Aider, Cline, Codex, Continue, Copilot, Windsurf, Kimi and Qwen.
Categories
Indexed Skills (47)
eval-run
Run the offline LLM eval harness and gate on regression. Detects the project's own eval framework (promptfoo / OpenAI-evals / deepeval / ragas / LangSmith / a custom pytest harness), loads the versioned dataset, runs each case through the CURRENT prompt+model+retrieval, scores with the configured scorers (assertion + LLM-as-judge), diffs against the stored baseline, and FAILS below threshold. Emits a per-metric table + the regressed cases with their cited case-id + score. The measurement half of every prompt/model/retrieval change — dispatched by @ai-feature-reviewer and /add-ai-feature's Evaluate phase.
llm-gateway-audit
Inventories the provider-call surface and audits the seam — every provider-SDK import/call outside the gateway module (enumerated individually, never "and N others"), calls with no timeout or no max-output-token cap, a single-provider production path with no fallback, repeated large identical context with no exact/prompt caching, a semantic cache whose key is not tenant/permission-scoped, calls not logging model id + prompt version + tokens + cost + latency trace-linked, and prompt/response logging with no PII/secret redaction. Emits the seam inventory (N call sites, M behind the seam) plus one finding per site with its closure verb. TRIGGER — before adding retry/caching/fallback/cost-tracking, when cost or p95 latency is a question, any diff adding a provider call, and dispatched by /ai-audit and @ai-feature-reviewer dimension 5. ANTI-TRIGGERS (do NOT fire) — deriving retry/backoff/circuit-breaker algorithms (distributed-systems / backend own the mechanics; this audits their application to provider calls); t
prompt-audit
Static sweep of every prompt-assembly and output-parsing site for the five prompt-engineering defects — free-text regex/split/JSON.parse where the provider offers a schema, instructions concatenated with untrusted user or retrieved content in one blob, a structured-output call with no schema validation and no repair path, sampling parameters wrong for a single-answer call (temperature > 0 where the provider exposes it — or a temperature set at all where the provider has removed it and a non-default value is a 400), and a prompt literal with no version id feeding logs + cache key + eval run. Emits one finding per site with <path:line> + a real excerpt + the pattern's closure verb. TRIGGER — any diff touching a prompt, a model call, or an output parser; dispatched by /ai-audit and by @ai-feature-reviewer dimension 2. ANTI-TRIGGERS (do NOT fire) — authoring or improving a prompt (that is /add-ai-feature Phase 4); the prompt-injection exploit judgment or the output→sink review (that is @llm-security-reviewer LLM0
retrieval-eval
Measures the retrieval stage in isolation — loads or builds a labelled question→gold-chunk set, runs the project's OWN retriever, and reports recall@k, context precision/relevance, and filtered recall (recall with the tenant/permission predicate applied, where a pre-filter strands an HNSW traversal and recall craters silently), plus the retrieval-vs-generation split that says which stage actually failed. Also the tuning loop for top_k, chunk size, reranker on/off, and ef_search/nprobe. TRIGGER — before tuning any retrieval parameter, when a RAG answer is wrong and nobody knows which stage broke, and dispatched by /ai-audit, @rag-architect, @ai-feature-reviewer dimension 3, and /add-ai-feature Phase 7. ANTI-TRIGGERS (do NOT fire) — end-answer quality, faithfulness, or answer relevance (that is eval-run against the project's harness); ANN index configuration, params, metric, or refresh (that is vector-index-audit); a corpus with no labelled set (HALT with the construction recipe — never score a set the model wr
vector-index-audit
Audits the ANN index behind retrieval against a STATED recall/latency/scale target — flags a brute-force/sequential scan at scale, HNSW/IVF built with library-default parameters and no recall number, a distance metric or normalisation mismatched to the embedding model (and a dimension mismatch), a heavy metadata/tenant pre-filter combined with a tight ef/nprobe (silent filtered-recall collapse), and a write path with no vector upsert/delete or rebuild/compaction so the index serves stale or deleted content. Emits the index inventory (store, family, params, dim, metric, corpus size, filter mode, refresh path) plus findings with closure verbs. TRIGGER — any diff touching index creation/config/migration, a re-embed or embedding-model upgrade, retrieval latency or recall in question, and dispatched by /ai-audit and @ai-feature-reviewer dimension 3. ANTI-TRIGGERS (do NOT fire) — chunking, top-k, reranking, or context-assembly decisions (that is rag-pipeline, owned by @rag-architect); MEASURING recall (that is retr
complexity-derivation
Mechanically derive the time + space complexity of code or a designed algorithm — loop-nesting products, divide-and-conquer recurrences (recursion tree / Master theorem), amortized analysis (aggregate / accounting), expected-vs-worst for randomized + hashed structures, and space (peak allocation + recursion depth + hidden copies). Produces a cited big-O with the construct each bound came from. Stack-agnostic.
detect-drift
Stack-conditional drift detector for codebase alignment. Runs the 11 universal detectors (6 structural + 5 functional — SOLID, clean code, performance, security, unhandled-io) plus per-stack detectors against the gold-standard inventory. Emits a finding row per fingerprint hit with evidence cited to <path:line>. Used by /align-scan and /align-fast.
find-and-align
Per-finding fix loop for codebase alignment. DETECT → DECIDE → FIX → VERIFY → RECORD. One commit per finding. Net-lines ≤ 0 for structural rows; small + budget for functional rows (added lines must cite idioms). Stack-agnostic. Used by /align-phase, /align-fast.
api-consistency-audit
API surface consistency audit — 22 drift fingerprints across endpoints, covering response envelope shape, error contract, pagination, resource-path and field naming, idempotency keys, auth/rate-limit/security headers, conditional requests (ETag/If-Match), batch contract, log and metric naming, timeout-retry policy, and OpenAPI coverage. Used by /polish on backend-* stacks; 16 fingerprints emit a closure verb from a closed 15-verb vocabulary, 6 emit a routed observation with no verb. Every finding carries <path:line> evidence. Behaviour-preserving — envelope unification and naming changes ship through the deprecation flow, never a blind rewrite. NOT for adding endpoints (/add-endpoint), fixing functional bugs (/fix-bug), or non-backend stacks (halts).
migration-safety
Static scan of migration files for online-safety violations — blocking `CREATE INDEX` without `CONCURRENTLY`, `NOT NULL` added with no safe backfill, destructive drops of columns the running code still reads, and table-rewriting DDL. Run on any diff that adds or edits a migration, and before a deploy that ships a schema change. Not the timed rehearsal against prod-sized data — that is `migration-rehearsal` in the database pack.
architectural-diagnosis
Project-wide architectural diagnosis. Builds dependency + responsibility maps, flags layer violations, cyclic dependencies, god modules, anemic modules, wrong-level responsibilities, cross-cutting duplication, missing abstractions, bottleneck modules. Emits the foundation fix list (cascade impact) — these run BEFORE tactical fixes in /optimize. Stack-agnostic; reads PROJECT_KIND for stack-specific layer rules.
change-brief
The comprehension gate — "if you can't explain the code, it isn't yours." For every non-trivial change (AI-generated or human), produce + validate a 5-field change brief (What / Why this shape / Edge cases / Blast radius / Verified by) before the change is committed or a PR opens. Mechanical, not advisory — the brief has a required shape, a hand-wave grep, and a citation requirement; a brief that paraphrases the diff without explaining it is rejected. Wired into /pre-commit and /review-changes; named by engineering-principles.md § AI-assisted development.
debt-ledger
Track technical debt as a persisted, ranked ledger — dated/owned TODOs, unjustified suppressions, deprecated-API call sites, major-version-lag deps — each with a blast-radius and a fix-cost, diffed run-over-run so accrual (new debt vs paid-down) is visible instead of rediscovered every audit.
refactoring-sweep
Codifies the 10 Fowler-style refactoring closure verbs as detector + procedure pairs. Is the core apply-engine of /refactor (these 10 verbs ARE /refactor's closed vocabulary) and is also used by /optimize Phase 2 (tactical) and any /align-recheck run that hits the refactoring class. Each verb has a fingerprint (what triggers it), a procedure (how to apply it safely), and a verify step (what must stay green). Behaviour-preserving — refactoring NEVER changes observable output.
smoke-verify
Stack-agnostic boot-check run as the FINAL step of a behaviour-preserving sweep (/optimize, /audit, /align, /migrate). A green test suite does NOT prove the app still starts — a refactor can break DI wiring, route/handler registration, an import cycle, or config loading that no unit test exercises. This skill actually boots the app (dev server / HTTP server + health probe / CLI invocation / library import) per PROJECT_KIND and FAILS if it doesn't come up. Reuses frontend/skills/dev-server-start/SKILL.md for frontend stacks.
test-shield
Pre-sweep coverage gate for behaviour-preserving work (/optimize, /audit refactor + perf verbs). "Refactor, tests stay green" is only proof of preservation if a test actually exercises the touched branch — on an UNCOVERED branch a structural fix can silently change behaviour and still show green. Before such a fix, this skill detects the touched-but-uncovered branches in scope and pins current behaviour with a characterization test (dispatching /add-test) BEFORE the fix lands, or halts the row. Reuses testing/skills/coverage-gap/SKILL.md for detection.
schema-consistency-audit
Schema + migration consistency audit. Detects drift in nullability, type choice, timezone handling, charset/collation, timestamp and audit-field coverage, soft-delete coverage, migration patterns, and object naming. Findings are ranked by data-integrity risk, not by detector order. Emits closure verbs that ship as reversible migrations. Used by /polish on data-* stacks and /db-audit.
release-security
Container-image supply-chain gate — trivy/grype CVE scan of the image's OS and baked libraries, syft SBOM, cosign digest signing plus provenance attestation. Run in CI after the image is built and pushed, before deploy promotes it. Not the Dockerfile linter (`dockerfile-lint`) and not the lockfile audit (`deps-audit`) — this scans the built image, and `admission-policy` is what verifies the signature at deploy.
changelog-generate
Generate a categorized changelog / release notes from commit + PR history (conventional-commits · semver). Groups feat/fix/breaking for humans, surfaces breaking changes with migration notes, and derives the semver bump from the change types — never hand-written from memory or a raw git-log dump.
diagram-sync
Generate / refresh architecture diagrams (C4 · mermaid) from the REAL module + import graph, embed them in docs, and flag drift when a committed diagram no longer matches the code. A hand-drawn diagram left to rot is worse than none.
docstring-coverage
Detect exported / public API symbols missing a docstring — functions, classes, modules, endpoints, exported types — and optionally gate on a coverage threshold. A docstring states WHY / the contract, not a restated signature. An undocumented public API is a coverage gap.
quickstart-verify
Execute a README / getting-started / CONTRIBUTING setup section end-to-end in a CLEAN environment to prove onboarding actually works — install → build → run → smoke. Reports per-step pass/fail and time-to-first-green. Distinct from doc-writer, which authors the prose; this one runs it.
api-snapshot
Snapshot the API's OpenAPI spec and diff it against the last committed snapshot, blocking merge on breaking changes that carry no ADR. Run on any controller or DTO change. Proves the *declared* contract held — `endpoint-test` is the runtime counterpart that proves the running route still matches its DTO.
debug-tenant
Debug tenant isolation issues — a user sees data that doesn't belong to them, or doesn't see data that does. Use on a suspected cross-tenant leak or a missing-data report; walks the full tenant-resolution chain hop by hop. Not a static scan — it reproduces against a running system via `log-tail` and `endpoint-test`.
endpoint-test
Hit a running dev endpoint via curl and verify status + response shape + required headers (auth, tenant) field-by-field against the DTO. Use AFTER any controller, DTO, guard, pipe or interceptor edit to prove the route works end-to-end, or when a frontend reports an unexpected shape and you need ground truth. NOT when no dev server is running (it refuses to auto-start), NOT against staging/prod hosts, and NOT for static contract diffing — that is api-snapshot.
env-diff
Compare .env against .env.example — flag missing keys (will break at runtime), orphan keys (dead config), and unvalidated keys (absent from the env schema). Run after pulling a branch that may have added env vars, after editing the env schema, and in CI as a pre-deploy gate. Checks key presence and validation wiring only, never whether a value is correct.
log-tail
Tail structured logs from the dev server, filtered by correlation id, level, or module. Use when a request failed and you need what the server actually recorded — a 500 with no body, a trace to follow end-to-end, an error whose stack never reached the client. Reads what was already logged; it cannot recover a field the code never emitted, does not tail production, and is not a metrics or APM query.
module-scaffold
Generate a complete module following the project's declared architecture — entity, repo, service/use-case, DTOs, controller, tests, DI wiring, migration. Use when creating a new feature module from scratch or replacing a prototype with a properly-layered version. Emits structure, not verified behaviour — run `endpoint-test` on each scaffolded route once wired.
parallelize-independent-ops
Convert a sequential I/O-bound code path into bounded parallel execution using the project's concurrency primitive. Used when an endpoint, batch job, or aggregation does N independent awaits in a loop — the most common backend perf failure. Refuses to parallelize when data dependencies, transactions, or shared keys make it unsafe.
check-business-coverage
Cross-feature audit — walks the project's declared business cycles (Create→Update→Delete, Subscribe→Unsubscribe, Send→Resend) and surfaces every missing counterpart. Use for a pre-release sweep across the whole product, before an external audit (GDPR, App Store Privacy), or as a quarterly completeness review. Product-level — `audit-funnel-completion` covers conversion within a single flow.
pricing-tax-audit
Audits pricing / billing / tax / currency correctness. Money is an integer minor-unit or a decimal type, never a float; every price computation states its rounding + tax jurisdiction + currency; multi-currency values are never mixed. A float price, an unhandled proration, or a missing tax jurisdiction is a money bug.
dead-branch-scan
Find unreachable code branches — code after return, conditions that can never be true, and feature flags always on/off.
grain-probe
Prove a model's declared grain by executing a duplicate-key query against the built table and reporting rows, distinct keys, and the top offending key values. Run before any aggregation claim is trusted, before approving any fact-to-dimension join, after a grain or key change, and as the uniqueness column of every model audit. Proves the key IS unique in the data — `contract-diff` proves the upstream SHAPE has not changed under it, and `lineage-trace` proves who would be affected if it had.
lineage-trace
Trace a column, model, or metric downstream to every consumer — models, dashboards, exports, reverse-ETL syncs, notebooks — and upstream to its sources, then report orphans and unreachable nodes. Run before changing or deleting anything in the warehouse, when sizing the blast radius of a defect, and when hunting models nobody reads. Answers WHO is affected — `contract-diff` answers WHETHER a change is breaking, and `grain-probe` answers whether the data is what it claims.
migration-rehearsal
Run a pending migration against a restored prod-sized copy. Measure duration, the lock profile, the algorithm the engine actually chose, and rollback behaviour. Postgres and MySQL lanes. Do this BEFORE prod.
schema-diff
Diff the ORM entities against the actual DB schema — catch drift between code and reality. Run before generating a new migration (drift corrupts autogenerate output), after an out-of-band hotfix, and weekly in CI against a restored backup. Detects drift only — `migration-rehearsal` is what proves the corrective migration is safe to apply.
dockerfile-lint
Lint a Dockerfile for safety, size, and correctness using hadolint plus project rules (non-root FINAL stage, multi-stage, pinned base, healthcheck, BuildKit secret handling). Run before merging any Dockerfile change and after a base-image bump. Covers the Dockerfile only — `release-security` scans the built image for CVEs, SBOM, and signatures.
gitops-audit
Audit GitOps discipline — git as the single source of truth for cluster state, reconciled by a controller (Argo CD / Flux). Finds drift (cluster ≠ git), out-of-band manual kubectl/helm, plaintext secrets in git, auto-sync+prune with no safeguard, and missing sync-wave ordering. Not general CI/CD — the git→cluster reconciliation loop only.
monitor-deploy
Watch a just-shipped deploy until it proves healthy (or rolls back). Polls health/readiness, error rate, and latency against a baseline for an observation window; on threshold breach it surfaces evidence and triggers /rollback-deploy. The executor behind /deploy-stage's --watch / --no-monitor and the recovery confirmation in /rollback-deploy.
progressive-delivery
Audit the two pieces that decouple deploy from release — feature-flag lifecycle (no stale/orphaned/permanent flags, kill-switch on risky flows, flag-config parity across envs) and automated canary ANALYSIS wiring (a canary that promotes/aborts itself on SLO/error metrics, not a human eyeballing a dashboard).
chaos-test
Inject failures (network, latency, crashes) against a running service to verify resilience. Run after adding an external dependency (cache, queue, third-party API), before promoting a service to a higher SLO tier, or before a high-traffic event. Requires a running service — this is not a static resilience review.
dlq-replay
Replay messages from a dead-letter queue back to a primary handler — selective or full, idempotency-safe, rate-limited, observable, and reversible (re-DLQ on failure). Run once the poison message's root cause is resolved, on a periodic DLQ drain, or during disaster recovery. Never run before the handler bug is fixed — replay re-poisons the queue.
doc-drift-scan
Find docs that lie about live code, on three axes — DEAD (names something deleted), WRONG (describes an existing symbol, default, flag or signature incorrectly) and UNDOCUMENTED (public thing with no entry). Covers file paths, task names, env vars, schema, ADR links, CLI flags, signatures and examples. Run before merging a PR that touched documented code, after a refactor or rename, and weekly in CI. `quickstart-verify` executes the setup procedure; `diagram-sync` catches the same drift in diagrams.
commitment-coverage
Analyse committed-spend and reserved-capacity posture — coverage (what share of eligible usage is discounted), utilisation (what share of what was bought is used), expiry exposure, and a buy/hold/let-lapse recommendation with break-even arithmetic. Run before a commitment purchase or renewal, quarterly, and after any material capacity change. Owns the RATE half of spend — `unit-cost-probe` owns the per-unit number and `egress-trace` owns transfer, neither of which commitments affect.
egress-trace
Trace data-transfer spend to its architectural cause — cross-zone chatter, network-address-translation charges, cross-region replication, internet egress, and cache or content-delivery misses — and attribute each line to the component pair producing it. Run when transfer is a material share of the bill, after a topology change, when a cost is unattributable to any obvious resource, and before approving a cross-zone or cross-region hop. Owns the TRANSFER branch — `unit-cost-probe` owns the per-unit arithmetic and `commitment-coverage` owns rate, neither of which applies here.
spend-anomaly-triage
Triage a cost spike or creep to its cause — separating rate, usage, and mix changes, then correlating the usage half against deploys, flag flips, traffic, backfills, and incidents to produce a ranked suspect ledger with a confirm/refute test for each. Run when a detector fires, when a bill moves unexpectedly, or when a slow creep has doubled a line over a quarter. Explains WHY spend moved — `unit-cost-probe` gives the number, `commitment-coverage` explains the rate half, `egress-trace` explains transfer.
unit-cost-probe
Compute the measured cost of one named business unit — per request, tenant, order, job, GB, or 1k tokens — by joining attributed spend to the unit's denominator over the same whole billing period, and label every branch measured / allocated / not derivable. Run when a unit cost is claimed, before a pricing decision, to verify a cost model's branch, and to check whether a predicted change appeared. Produces the NUMBER for one unit — `commitment-coverage` explains the rate half of a change, `egress-trace` explains the transfer branch, and `spend-anomaly-triage` explains a spike.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.