johnqtcg
UserA curated system of production-ready Claude Code skills with quantitative evaluation reports, golden test fixtures, and engineering workflow integration.
Categories
Indexed Skills (48)
git-commit
Safely create a git commit by validating repository state, staging intended changes, scanning for secrets/conflicts, generating a Conventional Commits message (repository convention first, else an English Angular default) from the staged diff, and committing without amend.
api-integration-test
Create, maintain, and run gated Go integration tests for internal APIs and service-to-service clients (HTTP/gRPC). Use for endpoint verification, contract checks with real runtime config, opt-in execution, timeout/retry safety, and integration failure triage in Go services.
constructive-thinking
Compress chaotic information into a leader-ready structure before output. ALWAYS use when the user is preparing to brief a senior leader, present a technical proposal, write a one-pager, or otherwise turn scattered facts and feelings into Frame → Crux → Nodes → Tilt + Reasoning that fits in 3–5 minutes of reading. Trigger phrases include "向领导汇报", "做技术方案 presentation", "整理思路", "report up", "brief the boss", "summarize for leadership", "executive briefing", "one-pager". NOT for writing the final polished document (use tech-doc-writer), NOT for decomposing tasks into implementation steps (use writing-plans), NOT for incident root-cause analysis (use incident-postmortem), NOT for aggregating research with citations (use deep-research).
deep-research
Perform auditable research with executable mode budgets, mandatory source-content verification, typed web and repository evidence, confidence assessment, honest degradation, and one fixed nine-section report. Use for web research, claim verification, technical comparisons, trend analysis, pure codebase research, and hybrid codebase-plus-web investigations that need traceable conclusions rather than search-result summaries.
e2e-test
Design, maintain, and execute reliable end-to-end tests for critical user journeys with Agent Browser as first choice for exploration and Playwright as the preferred code path for suites and CI. Use for E2E strategy, journey coverage, flaky test triage, artifact collection, CI gating, regression prevention, and browser automation tasks.
fuzzing-test
Generate Go fuzz tests (Go 1.18+ testing.F) for specified code when users ask for fuzzing/模糊测试/fuzz test generation, parser robustness, round-trip, or differential fuzzing. Always run an applicability gate first; if the target is not suitable, explain concrete reasons and stop without writing fuzz test code.
go-benchmark
Go performance benchmarking and pprof profiling specialist. ALWAYS use when writing benchmark functions (testing.B), generating or reading pprof profiles, interpreting flame graphs, finding memory allocation hotspots, comparing implementations with benchstat, or measuring ns/op / B/op / allocs/op. In Go code contexts, also trigger when the user says "it's slow", "too many allocations", "find the bottleneck", or "profile this Go code".
go-ci-workflow
Use when creating or refactoring GitHub Actions CI workflows for Go repositories. Covers repository-shape detection, Make-driven delegation with formal fallbacks, Go setup, caching, tool pinning, permissions, reusable workflows, and quality gate design.
go-code-reviewer
Review Go code with a defect-first approach using repository policy (constitution.md first, then AGENTS.md fallback). Use for code review, PR review, quality checks, risk analysis, and regression detection.
go-concurrency-review
Review Go code for concurrency safety and goroutine lifecycle issues including race conditions, deadlocks, goroutine leaks, mutex misuse, and context propagation. Trigger when code contains go func, channels, sync primitives, WaitGroup, errgroup, or goroutine lifecycle management. Use for concurrency-focused review of Go projects.
go-dependency-audit
Go dependency audit specialist for CVE scanning (govulncheck), license compliance, outdated dependency detection, upgrade impact analysis, and supply chain security. ALWAYS use when auditing go.mod dependencies, running govulncheck, checking license compatibility, planning dependency upgrades, or investigating supply chain risks in Go projects. Complements security-review (code-level) with module-level supply chain analysis.
go-error-review
Review Go code for error handling correctness, nil safety, and failure-path integrity including ignored errors, missing wrapping, panic misuse, SQL/HTTP resource lifecycle, and transaction patterns. Trigger when code contains error returns, panic calls, sql.Rows, transactions, HTTP client/server code, or nil-sensitive pointer operations. Use for error-handling and correctness-focused review.
go-logic-review
Review Go code for business logic correctness, boundary conditions, off-by-one errors, state management, data flow integrity, and return value contracts. Trigger on any Go code change that modifies behavior, conditional logic, state transitions, or data processing. Use for logic-correctness focused review.
go-makefile-writer
Canonical skill for Go Makefiles. Create/refactor root Makefiles for Go repositories with standardized build/test/lint/run targets, self-documenting help output, predictable artifacts, and maintainable target naming.
go-observability-review
Review Go code for observability gaps: missing structured logging, broken trace context propagation, Prometheus cardinality explosions, span lifecycle errors, and sensitive fields in logs. Dispatched by go-review-lead as a vertical reviewer. Also trigger directly when the user says "review my logging", "check my tracing", "observability review", or "are my metrics correct".
go-performance-review
Review Go code for performance issues including slice/map pre-allocation, string concatenation, N+1 queries, connection pool configuration, sync.Pool, memory alignment, lock scope, buffered I/O, and HTTP transport tuning. Trigger when code contains make(), loops, database queries, string building, sync primitives, HTTP clients, or hot-path operations. Use for performance-focused review.
go-quality-review
Review Go code for code quality, style, and modern Go practices including function length, nesting depth, naming, mutable globals, interface design, receiver consistency, modern Go idioms (slog, generics, typed atomics), and static analysis. Trigger when reviewing Go code structure, readability, or maintainability. Also runs golangci-lint for automated style checks.
go-review-lead
Orchestrate a comprehensive Go code review by triaging code changes, dispatching vertical review skills (security, concurrency, error, logic, performance, quality, test, observability) as parallel agents, then consolidating results into a unified report. Use for full Go PR review or comprehensive code review. Replaces the monolithic go-code-reviewer with focused parallel analysis.
go-security-review
Review Go code for security vulnerabilities including OWASP Top 10, injection, auth/authz, crypto, secrets, SSRF, XSS, and input validation. Trigger when code involves SQL, user input, authentication, HTTP handlers, TLS, crypto, secrets, or file path operations. Use for security-focused code review of Go projects.
go-test-review
Review Go test code for quality including table-driven tests, t.Helper usage, assertion completeness, boundary cases, benchmarks, fuzz tests, and coverage targets. Trigger when PR contains _test.go files, test helpers, httptest usage, testing.B, testing.F, or testdata directories. Use for test-quality focused review.
google-search
Use when the user wants help finding information through Google or Google-style web search and expects more than raw links. Handle current facts, public-information lookups, official documents, tutorials, reports, tools, materials, or source discovery by classifying the search goal, generating precise queries, executing search, ranking sources, cross-checking key claims, and returning a concise conclusion plus reusable search strings. Also use for programmer-specific searches (error debugging, official docs, GitHub code search, Stack Overflow, RFC lookup, benchmarks).
load-test
Performance load testing specialist for writing k6/vegeta/wrk scripts, defining SLOs, modeling scenarios (spike/soak/stress/breakpoint), analyzing results, and identifying bottlenecks. ALWAYS use when writing load test scripts, reviewing test results, designing test scenarios, setting performance SLOs, or diagnosing latency and throughput issues at the service level. Complements go-benchmark (micro-level function profiling) with macro-level end-to-end service testing. Use proactively for any pre-release performance validation, capacity planning, or production incident investigation involving latency/throughput.
local-transcript
Transcribe a specified local video or audio file into cleaned final `.txt`, `.pdf`, or `.docx` transcripts using speech recognition with Apple Silicon GPU acceleration and LLM-based proofreading. Use when the user wants text extracted from a local media file path such as `.mp4`, `.mov`, `.mkv`, `.webm`, `.mp3`, `.m4a`, or `.wav`, and the output language should follow the spoken language in the media automatically. Prefer this skill for local-file transcription workflows that should produce cleaned transcripts with natural paragraphs, LLM-corrected Chinese text, and simplified Chinese output for Chinese speech.
log-analyzer
Senior-SRE log analysis specialist. Use when investigating incidents from logs, triaging error spikes, extracting timelines, correlating distributed traces, or separating signal from noise across plain-text, JSON (slog/zap), syslog, journald, container, and Kubernetes logs. ALWAYS use when the user asks to "analyze logs", "find the error", "what went wrong", "investigate this outage", "correlate request_id/trace_id", "look at the log file", or hands over log dumps / aggregator queries / kubectl logs output. Hands off to incident-postmortem when a blameless post-mortem document is requested.
monitoring-alerting
Monitoring and alerting design reviewer for production backend services. ALWAYS use when writing Prometheus alerting rules, designing Grafana dashboards, defining SLI/SLO, configuring alert routing (PagerDuty/OpsGenie/Slack), or reviewing existing monitoring setups. Covers SLI/SLO definition, alert rule quality (sensitivity/specificity tradeoff), burn-rate alerting, alert fatigue prevention, dashboard design principles, label cardinality management, and on-call routing configuration. Use even for "just add an alert" — a poorly designed alert either pages at 3AM for non-issues (alert fatigue) or stays silent during real outages (false confidence).
readme-generator
Generate or refactor project README.md files using repository evidence. Use when the user asks to create/rewrite/standardize README, improve documentation structure, or produce maintainable README templates for different project types (service/library/CLI/monorepo).
security-review
Exploitability-first standalone security review of code changes, diffs, PRs, or services. Use when asked for a security review, security audit, vulnerability assessment, or pre-merge security check (安全审查/安全评审/漏洞排查) — covers auth, input, secrets, API, data, concurrency, container, third-party, and dependency risk across Go, Node.js/TypeScript, Java, and Python, with mandatory evidence, false-positive suppression, scope-based depth (Lite/Standard/Deep), and CWE/OWASP-mapped machine-readable output. NOT for general-purpose Go code review — use go-review-lead for that (it dispatches go-security-review as its security dimension); this skill is the deeper security-only process with mandatory gates and audit-grade output.
stock-analysis-lead
Orchestrate a comprehensive US-stock investment analysis by classifying sector archetype, fetching SEC filings, dispatching six vertical equity-research skills (business model, earnings quality, balance sheet, management, industry & competition, peer comparison) as parallel agents, then synthesizing a buy/hold/sell verdict with Bull/Base/Bear target-price ranges using sector-aware thresholds and calibrated probability assignment. Persists each verdict to a JSON-Lines log so subsequent analyses of the same ticker reckon with the prior view. Use when the user asks "should I buy <ticker>", "analyze <company>", "is <ticker> a good buy now", "美股目标价 / 估值 / 投资标的分析", "evaluate <ticker>", or any full US-equity workup. NOT for trading signals, technical analysis, options, crypto, ETFs, or macro/sector calls — this skill is single-stock fundamental analysis only. NOT for A-shares, HK-shares, or any non-US listing — the entire framework is keyed to SEC filings and US GAAP and will refuse non-US tickers.
stock-balance-sheet-review
Review a US-listed company's balance sheet health for an equity-research workup. Covers net-debt/EBITDA leverage, current ratio, cash runway, goodwill concentration and impairment history, DSO trend, inventory days, off-balance-sheet items (operating leases, contingent liabilities), and pension underfunding. Trigger when analyzing financial-statement risk at L4 of the seven-layer X-ray framework, or when assessing whether the company can survive a downturn. Dispatched by stock-analysis-lead.
stock-business-review
Review a US-listed company's business model and revenue structure for an equity-research workup. Covers product/service mix, customer concentration, geographic exposure, industry position, revenue-growth decomposition (organic vs acquired vs price vs volume), and information-tier discipline (which numbers are facts vs management narrative). Trigger when analyzing a single US ticker's business fundamentals, when reading 10-K Item 1 "Business" and Item 1A "Risk Factors", or when the orchestrator stock-analysis-lead dispatches business review. Dispatched by stock-analysis-lead or invoked directly for business-focused analysis.
stock-industry-review
Review a US-listed company's industry position and competitive moat for an equity-research workup. Covers Porter Five Forces scan, market-share trend (absolute and relative to industry growth), TAM size and trajectory, unit economics where disclosed (LTV/CAC, unit gross margin), moat classification (network / brand / scale-cost / switching-cost / patent / regulatory / proprietary-data), substitute threats, new-entrant threats, pricing-power evidence, supplier/channel concentration risk, and regulatory exposure. Trigger when analyzing competitive position at L6 of the seven-layer X-ray framework. Dispatched by stock-analysis-lead; at Lite depth runs in Lite-Industry mode (moat type + share trend only, no full Porter scan).
stock-management-review
Review a US-listed company's management quality and capital-allocation track record for an equity-research workup. Covers 5-year capital-allocation history (buybacks vs dividends vs M&A vs capex vs debt), buyback timing, M&A return-on-investment, guidance-vs-actuals track record, comp-structure alignment, insider ownership and trading activity, earnings-call communication style, and strategic-thesis stability. Trigger when analyzing the human-judgment layer (L5 of the seven-layer X-ray) — the most under-rated and longest-impact dimension. Dispatched by stock-analysis-lead.
stock-peer-comparison-review
Independently benchmark a US-listed target equity against 2-4 closest peers on a fixed 12-item ratio panel — growth rates, profitability, capital intensity, balance sheet leverage, capital returns, and valuation multiples. Provides cross-validation for moat and market-share claims made by the business and industry reviewers. Trigger when running a Standard-or-deeper stock-analysis-lead workup; supplies the independent quantitative comparison that single-name analysis cannot. Dispatched by stock-analysis-lead.
systematic-debugging
Use when debugging, diagnosing, or investigating any bug, test failure, flaky test, race condition, unexpected behavior, build failure, production incident, third-party breakage, root cause analysis, or performance regression before proposing fixes
tdd-workflow
Enforce practical Test-Driven Development for code changes in Go services. Use for new features, bug fixes, refactors, API changes, and new modules. Requires Red-Green-Refactor evidence, defect-hypothesis-driven tests, killer cases, and coverage gates (line + risk-path).
tech-doc-writer
Write, review, and improve technical documents (技术文档, 设计文档, 操作手册, 故障报告, API文档). Use when users ask to write/draft/review/improve a technical document, create an RFC/ADR, write a runbook or operation guide, produce API docs, or create any structured technical writing deliverable. Audience-aware, evidence-based, with quality gates and anti-staleness enforcement. Supports concept docs, task docs, reference docs, troubleshooting docs, and design docs (RFC/ADR).
thirdparty-api-integration-test
Create and run gated Go integration tests for third-party APIs with real external calls, strict configuration gates, bounded timeouts, and safe runtime controls. Use for vendor/client contract verification and failure triage.
unit-test
Use when the user asks for unit tests (e.g, "单元测试", "unit test"), wants to add/fix Go tests, wants table-driven and subtest organization, or wants to enforce a minimum coverage gate (default 80% for logic packages). Prioritize bug discovery (especially boundary, mapping loss, and concurrency defects) over test volume. Do NOT use for benchmarks, fuzz tests, integration tests, E2E tests, load tests, or mock generation.
update-doc
Keep repository documentation synchronized with the latest code. Use when updating README/docs/codemaps after code changes, running docs-drift checks, or producing scoped evidence-backed doc patches for service/library/CLI/monorepo projects.
writing-plans
Create implementation plans for multi-step tasks. Use when you have a spec, requirements, or feature request that needs decomposition into concrete steps before implementation. Covers feature, bugfix, refactor, migration, API change, and docs-only plans. NOT for single-file edits, trivial fixes, or tasks completable in under 5 minutes.
api-design
REST API contract designer and reviewer. ALWAYS use when designing new endpoints, reviewing existing API contracts, planning API versioning, or standardizing error models. Covers resource modeling (URL/naming), HTTP method semantics, status code selection, error model consistency, pagination/filtering/sorting, idempotency keys, concurrency control (ETag/If-Match), object-level authorization (IDOR prevention), rate limiting, backward compatibility assessment, and OpenAPI-ready output. Use even for "just add an endpoint" — inconsistent APIs compound into integration nightmares that are extremely expensive to fix after clients depend on them.
create-pr
Create evidence-backed pull requests to the GitHub main branch with strict preflight, quality, and security gates. Use when users ask to create/submit/open/update a PR to main (including private repos), decide draft vs ready state, and provide reviewer-ready context for team review.
kafka-event-driven-design
Kafka event-driven architecture designer and reviewer. ALWAYS use when designing, reviewing, or troubleshooting Kafka-based event systems — topic design, partition strategy, consumer group configuration, event schema definition (Avro/Protobuf/JSON), idempotent consumers, dead letter queues, exactly-once semantics, Schema Registry compatibility, backpressure handling, and consumer lag monitoring. Use even for "just publish an event" — Kafka's partition-ordered-not-globally-ordered semantics, at-least-once default delivery, and consumer rebalance storms are the source of most production event-driven bugs.
mongo-migration
MongoDB schema migration safety reviewer and migration script generator. ALWAYS use when writing, reviewing, or planning MongoDB schema changes — field additions/removals, index builds, schema validator changes, document type migrations, shard key modifications, or any bulk update touching production collections. Covers index build lock behavior (foreground vs rolling builds), additive schema evolution, _id-range batched updates, write concern tuning during migration, reshardCollection (5.0+), collMod validator changes, and rollback planning. Use even for "just add a field" — MongoDB's schema-less nature makes silent type inconsistencies and missing-field bugs harder to detect than RDBMS constraint violations.
mysql-migration
MySQL schema migration safety reviewer and DDL generator. ALWAYS use when writing, reviewing, or planning MySQL schema changes — ALTER TABLE, CREATE/DROP INDEX, column type changes, charset conversions, data backfills, or any DDL touching production tables. Covers online DDL algorithm selection (INSTANT/INPLACE/COPY), lock-safety analysis, large-table migration with gh-ost/pt-osc, phased rollout design, replication-safe DDL, backward compatibility, and rollback planning. Use even for "simple" ADD COLUMN — MySQL DDL locking behavior is version- and operation-dependent, and mistakes cause production outages.
oracle-migration
Oracle Database schema migration safety reviewer and DDL generator. ALWAYS use when writing, reviewing, or planning Oracle schema changes — ALTER TABLE, CREATE/DROP INDEX, column type changes, constraint additions, partition DDL, or any DDL touching production tables. Covers DDL auto-commit implications, DDL_LOCK_TIMEOUT, DBMS_REDEFINITION for online table restructuring, ENABLE NOVALIDATE constraint patterns, global index impact from partition DDL, CTAS-based migration, ROWID-range batching, and Flashback recovery. Use even for "simple" ADD COLUMN — Oracle DDL issues implicit COMMIT before and after execution, making every DDL statement irreversible without manual rollback planning.
pg-migration
PostgreSQL schema migration safety reviewer and DDL generator. ALWAYS use when writing, reviewing, or planning PostgreSQL schema changes — ALTER TABLE, CREATE/DROP INDEX, column type changes, constraint additions, RLS policy changes, or any DDL touching production tables. Covers lock-level analysis, CREATE INDEX CONCURRENTLY, NOT VALID constraint patterns, transactional DDL rollback, pg_repack for table rewrites, phased rollout design, and backward compatibility. Use even for "simple" ADD COLUMN — PostgreSQL DDL lock behavior varies by operation and version, and AccessExclusiveLock on a hot table causes immediate outage.
redis-cache-strategy
Redis caching strategy designer and reviewer. ALWAYS use when designing, reviewing, or troubleshooting Redis caching layers — cache pattern selection (cache-aside, write-through, write-behind), TTL strategy, cache stampede/penetration/avalanche prevention, hot key handling, cache-DB consistency, distributed locking, key naming, and degradation design. Use even for "just add a cache" requests — cache invalidation is one of the two hard problems in computer science, and a naive implementation creates subtle consistency bugs that surface only under load.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.