Reference
Skills
Skills are loaded on demand by agents through the built-in skill tool. Project skills document specific products; senior skills are deep references for whole ecosystems; content skills run publishing systems.
Project skills
4Technical UI documentation for the DevX visual system. Invoke when extending, refactoring, or redesigning the DevX resources pages, i18n, or related components.
Design system and architecture documentation for the Samurai cybersecurity platform. Use when building or modifying any UI component, backend endpoint, or feature module in Samurai.
Real glassmorphism for TypeScript + CSS web applications, with Tauri packaging where it applies. Covers the optics of frosted glass, backdrop-filter, layered surfaces, design tokens, typed components, accessibility, performance, browser support, fullstack architecture, and native window vibrancy (macOS, Windows, Linux fallback). Use when designing, building, reviewing, or debugging glass UI, frosted panels, translucent navigation, blur/backdrop effects, Liquid-Glass-style surfaces, or when packaging a web app with Tauri and deciding between CSS glass and native vibrancy.
Full design and development documentation for xscriptor.com, the Xscriptor literary portfolio (Next.js 16 App Router, static export, five locales, four book-reader engines, decryption animations). Use when building or modifying pages, components, CSS, content, i18n, book readers, or the build/deploy of xscriptor.com.
Senior skills
18API design reference pack, current for 2026: REST resource modeling and HTTP semantics, GraphQL schema design and federation, gRPC/protobuf and streaming, versioning and compatibility, pagination and filtering, RFC 9457 problem details, OAuth 2.1/OIDC/mTLS security, OpenAPI 3.1 contracts and codegen, and events and webhooks. Use when designing, reviewing, versioning, or documenting HTTP, GraphQL, gRPC, or event-driven interfaces: choosing a style for a new surface, fixing status codes or error shapes, adding cursor pagination or filtering, standardizing idempotency keys and retry semantics, hardening OAuth scopes, tokens, and tenancy, authoring or linting OpenAPI/AsyncAPI, running contract tests, or evolving a public API without breaking consumers. Optional pack: consumers degrade gracefully when it is absent.
Architecture reference pack, current for 2026: ADRs, C4 modeling and diagrams-as-code, style selection (modular monolith, microservices, event-driven, serverless, CQRS/event sourcing), DDD, module boundaries and fitness functions, data ownership and distributed consistency (sagas, outbox, read models, data mesh), integration patterns, migration (strangler fig, expand-contract), quality attribute tradeoffs (ATAM, CAP/PACELC), and docs-as-code governance. Use when choosing or reviewing a system's structure or style, writing or superseding an ADR, drawing C4 views, defining bounded contexts, aggregates, or domain events, enforcing dependency direction in CI, designing idempotent retries and ordering, planning a strangler-fig or expand-contract migration, running a lightweight ATAM, or keeping architecture docs and tech radar alive. Optional pack; consumers degrade gracefully when absent.
Cloud-native platform reference pack covering Kubernetes, GitOps, service mesh, SRE, serverless, infrastructure as code, multi-cloud, supply-chain security, and cost/platform engineering. Covers workloads, scheduling, networking, autoscaling, policy, upgrades, and debugging; Argo CD and Flux promotion flows; Istio ambient and Linkerd; SLI/SLO error budgets and incident practice; function and container serverless plus edge; OpenTofu, Terraform, Pulumi, and Crossplane; identity federation and data gravity; SLSA, sigstore, SBOMs, and admission control; and FinOps with internal developer platforms. Use when designing, reviewing, debugging, or operating cloud infrastructure; when choosing, migrating, or standardizing Kubernetes, GitOps, mesh, serverless, IaC, security, or cost tooling; or when defining promotion, reliability, hardening, or cost standards.
Deployment reference pack for shipping software to production: container image builds and supply-chain hygiene, CI pipeline design and security, continuous delivery strategies (rolling, blue-green, canary, progressive delivery), infrastructure as code and environment topology, secrets and configuration, zero-downtime database migrations, deployment observability and rollback, feature flags, and release management. Use when writing or reviewing a Dockerfile or build pipeline, designing CI/CD workflows, choosing a deployment strategy or rollback plan, provisioning environments with IaC, managing secrets and configuration, planning schema migrations or backfills, gating releases on SLOs, rolling out features behind flags, or cutting a release and writing changelogs.
Go reference pack (1.22-1.26): language core, concurrency, layout and tooling, web services, data, testing, profiling, observability, security. Covers generics, slices/maps helpers, iterators and range-over-func, error wrapping and errors.Join, defer semantics; goroutines, channels, context, errgroup, worker pools, leak patterns; cmd/internal layout, modules, go.work, golangci-lint, release; net/http routing, chi/echo/gin, gRPC, graceful shutdown; database/sql, pgx, sqlc, migrations; table-driven tests, fuzzing, benchmarks, Testcontainers; pprof, trace, GOGC/GOMEMLIMIT; slog, OpenTelemetry, Prometheus, crypto, supply chain. Use when writing, reviewing, debugging, or migrating non-trivial Go services and libraries, or when current idioms, decision tables, and pitfalls are needed.
JVM reference pack for Java 21-25, Kotlin 2.x with K2, Spring Boot 3.5+/4.x, persistence, JVM performance, Gradle/Maven, testing, Android/Compose, observability, security, and migrations. Use when writing, reviewing, tuning, or modernizing Java or Kotlin services and libraries; when choosing JVM frameworks, build tooling, concurrency model, or GC strategy; when diagnosing JVM production incidents; or when planning Java, Kotlin, Spring Boot, or Android upgrades.
Mobile platform reference pack (2026): cross-platform framework selection (native, React Native/Expo, Flutter, Kotlin Multiplatform, MAUI), iOS (Swift 6 concurrency, SwiftUI, SwiftData) and Android (Kotlin 2, Jetpack Compose) architecture, offline-first data and sync engines with conflict resolution, startup/jank/memory performance, mobile security against OWASP MASVS, and release engineering across App Store and Google Play with fastlane/EAS and CI/CD. Use when choosing a mobile stack, designing or reviewing an iOS or Android app, implementing offline sync or background work, debugging startup time, jank, memory, or app size, hardening secure storage, TLS, and secrets, handling permissions and privacy, or shipping builds through store review, staged rollouts, and crash reporting.
Monorepo reference pack (2026): tool selection across Nx, Turborepo, pnpm workspaces, Bazel, Moon, and Make; layout plus enforced dependency boundaries; workspace protocols, catalogs, peer dependencies, hoisting, and dedupe; shared tsconfig, ESLint, and Prettier packages; task graphs, affected detection, remote caching, CI sharding, and merge queues; workspace generators plus API and schema codegen; Changesets, fixed vs independent versioning, release trains, and publishing; polyrepo-to-monorepo migration; CODEOWNERS, drift detection, and monorepo health metrics. Use when creating, migrating, reviewing, or operating a monorepo: choosing or replacing a task runner, fixing slow or flaky CI, defining package boundaries and ownership, deduplicating dependencies, wiring shared configuration, automating releases, or auditing monorepo health. Depth lives in references/, one topic per file.
Observability reference pack for production systems: OpenTelemetry architecture and semantic conventions, structured logging and correlation IDs, Prometheus-compatible metrics and cardinality control, distributed tracing and sampling, continuous profiling, SLOs and burn-rate alerting, dashboards, collector pipelines, telemetry cost governance, and per-language instrumentation patterns. Use when instrumenting a service or library, designing OpenTelemetry Collector pipelines, migrating from vendor APM agents, defining SLIs/SLOs and alerts, building dashboards or runbooks, taming metric cardinality or telemetry spend, correlating logs/metrics/traces/profiles during an incident, testing telemetry, or reviewing instrumentation quality.
Performance engineering reference pack for senior work across stacks: measurement discipline (USE/RED, percentiles, Little's Law, Amdahl), caching layers and invalidation, database indexing and query tuning, CPU and memory profiling with flamegraphs, frontend Core Web Vitals and bundle control, concurrency limits and backpressure, memory and GC tuning, load test scenario design, and capacity and cost planning. Use when investigating a latency or throughput regression, setting performance budgets, designing a cache or invalidation strategy, fixing N+1 queries or connection pool sizing, profiling CPU, memory, or lock contention, reducing bundle size or INP, tuning queues and rate limits, diagnosing memory leaks or OOM kills, designing smoke/load/stress/spike/soak tests, or planning capacity and cost per request.
Python 3.12-3.14 reference pack: language core, typing, async and concurrency, web frameworks, data layer, testing, tooling and packaging, performance, security and observability, deployment. Use when writing, reviewing, debugging, upgrading, or shipping non-trivial Python: designing typed APIs with PEP 695 generics, fixing asyncio cancellation and structured concurrency, tuning SQLAlchemy 2.0 async sessions or Django async ORM, validating runtime data with pydantic v2, hardening FastAPI or Litestar services, choosing uv/ruff/hatch tooling, profiling hot paths, packaging and publishing distributions, or deploying containers and serverless workers. Use when migrating pre-3.12 idioms or troubleshooting free-threaded builds. Optional pack: consumers degrade gracefully when it is absent.
Rust reference pack (editions 2021/2024, 2026 stable toolchains): ownership and lifetimes, traits and generics, async/tokio and structured concurrency, error handling, unsafe/FFI, axum and the data layer, embedded no_std, testing, build tooling, performance, security, and observability. Use when writing, reviewing, debugging, or architecting non-trivial Rust: borrow-checker fights, async cancellation, unsound or unaudited unsafe, C/pyo3/wasm interop, web services with axum or actix, sqlx/diesel schemas and migrations, cargo workspaces and feature flags, cross-compilation and supply chain, profiling and benchmarking, or firmware on embedded-hal and embassy.
Cross-language secure coding reference pack for 2026: injection prevention across SQL, NoSQL, ORM, OS command, template, LDAP, and XPath sinks; XSS/CSRF; output encoding; Trusted Types and CSP; SSRF and unsafe deserialization; passwords, AEAD, randomness, keys, and secrets; validation, file uploads, and path traversal; per-language cheatsheets (Python, TS/Node, Go, Rust, JVM, C/C++); dependency, provenance, and patch-SLA hygiene; and a secure code review checklist with SAST/DAST/SCA/fuzzing tests. Use when writing, reviewing, or hardening application code in any language; when fixing injection, XSS, CSRF, SSRF, deserialization, crypto, secret-handling, validation, upload, or dependency vulnerabilities; when choosing parameterization, encoding, or validation strategies; or when auditing a codebase against OWASP-style defect classes. Optional: consumers degrade gracefully when absent.
Security reference pack for 2026 application, cloud, and AI security work: threat modeling with STRIDE, attack trees, and LINDDUN; the current OWASP Top 10, ASVS, API Security Top 10, and LLM Top 10; authentication and authorization with OAuth 2.1, OIDC, passkeys, and RBAC/ABAC/ReBAC; security architecture and zero trust; Kubernetes and cloud hardening; software supply chain security with SLSA, sigstore, and SBOMs; applied cryptography including post-quantum migration; LLM and agent security; and incident response. Use when threat modeling a system, designing or reviewing authentication and authorization, triaging findings against OWASP or ASVS, hardening containers, cloud IAM, or CI/CD, choosing cryptography or planning post-quantum migration, securing LLM and agent features, or preparing for and running incident response.
Cross-platform systems reference pack: shell scripting (bash/zsh, strict mode, traps, shellcheck, bats), Linux (systemd, cgroups v2, namespaces, journald, packages), macOS (launchd, Homebrew, SIP/Gatekeeper, MDM), Windows (PowerShell 7, winget, WSL2, Task Scheduler, AD), networking (DNS, TCP/TLS, nftables, tcpdump, VPN, proxies), storage (ext4/btrfs/ZFS, NVMe, RAID, LVM, backups), performance (perf, eBPF, iostat/vmstat, sysctl, OOM), containers (OCI, rootless, overlays, host debugging), and hardening (SSH, SELinux/AppArmor, auditd, CIS, patching). Use when scripting, debugging Linux/macOS/Windows hosts, diagnosing network or disk incidents, tuning performance, debugging containers from the host, or hardening servers. Optional pack: consumers degrade gracefully when it is absent.
Cross-language testing reference pack: strategy and the pyramid/trophy trade-off, unit, integration, end-to-end, property-based, mutation, and consumer-driven contract testing, test doubles, test data management, flake control, CI parallelism, coverage and quality metrics, and AI-assisted test generation. Use when planning a test strategy, deciding what to test at which layer, writing or reviewing unit, integration, E2E, contract, or property tests, choosing test doubles, designing factories and fixtures, stabilizing a flaky suite, wiring sharding and reruns in CI, interpreting coverage or mutation scores, or reviewing LLM-generated tests. Tooling ranges cover pytest, Vitest, Playwright, Testcontainers, Hypothesis, fast-check, proptest, jqwik, Pact, Stryker, PIT, and cargo-mutants. Optional pack: consumers degrade gracefully when it is absent.
TypeScript reference pack (TS 5.9 through 7.x era) covering the type system, modules and build strategy, React, major frameworks, runtimes, Node backends, testing, quality tooling, security, and the 2026 ecosystem state. Use when writing, reviewing, refactoring, debugging, or migrating non-trivial TypeScript: advanced types and declaration files, ESM/CJS interop and dual publishing, React server components and hooks, Next/Vue/Svelte/Angular choices, runtime selection across Node/Bun/Deno/edge, Fastify/Hono/NestJS services, Vitest/Playwright strategy, strict tsconfig and lint hardening, or supply-chain and web security. Depth lives in references/, one topic per file.
Web platform reference pack (2026): rendering architectures (SSR, SSG, ISR, streaming, RSC, islands, SPA), client and server state, forms and optimistic UI, modern CSS and design systems, Core Web Vitals, WCAG 2.2 accessibility, edge runtimes, PWAs and offline, browser security, and technical SEO/i18n/analytics. Use when designing or reviewing a web front end, choosing a rendering or caching strategy, debugging performance, accessibility, or security problems, building offline or installable experiences, selecting edge versus origin compute, or making framework and deployment decisions for browser-delivered applications.