全部能力

Builds all detected projects and verifies successful compilation. Use when checking that a bootstrapped project compiles.

Static Application Security Testing (SAST) for code vulnerability

Builds and launches Docker containers with health verification. Use when validating that containerized services start correctly.

Configures structured JSON logging with Serilog (.NET) or structlog (Python). Use when adding logging to backend projects.

Generates .NET Clean Architecture backend structure from entity definitions. Use when bootstrapping .NET backend projects.

使用 Go 标准库和 NestJS TypeScript 构建简洁、可扩展 API 的指南，涵盖安全性、验证和模块化架构。

Audits whether test results can be trusted: flakiness, isolation, real external dependencies, time/random/order dependency, and shared state. Use when auditing…

Sets up test infrastructure with Vitest, xUnit, and pytest. Use when adding testing frameworks and sample tests to a project.

Scaffolds new React projects or restructures monoliths to component-based architecture. Use when setting up frontend structure.

Story-level quality gate with 4-level verdict (PASS/CONCERNS/FAIL/WAIVED) and Quality Score. Use when Story is ready for quality assessment.

Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or…

Checks layer leakage in method signatures, missing DTOs, entity leakage to API, inconsistent error contracts. Use when auditing API contracts.

Expert firmware analyst specializing in embedded systems, IoT security, and hardware reverse engineering.

SQL development best practices for writing efficient, secure, and maintainable database queries

Executes Story tasks in priority order (To Review, To Rework, Todo). Use when Story has planned tasks ready for implementation.

Sets up logging, error handling, CORS, health checks, and API docs. Use when adding cross-cutting concerns to backend projects.

Deploy and manage web apps using Azure App Service with auto-scaling, deployment slots, SSL/TLS, and monitoring. Use for hosting web applications on Azure.

Verifies bootstrapped projects via build, test, and container health checks. Use when validating project setup completeness.

Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3…

Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.