Audits a Claude Code skill for security risks in three modes: before download (from a URL or install command), after download but before install (from a .skill file), or after install (from a local skills directory). Use this skill whenever a user is about to install a skill from any source — including GitHub URLs, git clone commands, npx/npm commands, curl/wget downloads, pip installs, marketplace links, or raw SKILL.md URLs. Also trigger when a user asks "is this skill safe?", "should I trust this skill?", "can you check this before I install it?", "audit this skill", or pastes any link to a skill repository or .skill file. If a user mentions installing ANY skill, proactively offer to audit it first — do not wait for them to ask.

Configures pgsodium Vault extension for API key and secret storage. Creates SECURITY DEFINER functions assigned to service_role for secure access. Eliminates hardcoded secrets. Use when storing API keys, managing secrets in Supabase, implementing pgsodium Vault, or replacing hardcoded credentials with Vault references.

Use when the user asks to log work, record what was done, or save task progress. Creates a structured markdown task log in `agent-logs/` with validation, waivers, and a final gates summary.

Use when the user asks you to implement a feature, fix a bug, or complete a repository task end-to-end (from scoping through code changes, validation, and final gate summary).

Use when `.tf` or `.tfvars` files have been edited, added, or removed and you need to verify that the code changes produce the intended Terraform plan before the task is considered complete. Runs `terraform plan` in `examples/test_app` and cross-checks the result against the change set you expected your edits to cause. This is a gate: do not declare a Terraform task done without passing it.

Use when the user proposes — or the agent detects — a deviation from constitutional defaults that requires an Architecture Decision Record. Triggered by proposals to extract microservices, drop foreign keys, denormalize without measured evidence, store transactional truth in Neo4j, skip Row Level Security, skip the transactional outbox, run destructive migrations, use database-per-service, or any explicit override of a constitutional principle. Drafts a structured ADR with context, decision, consequences, alternatives rejected, migration path, validation criteria, and constitutional sections affected — and refuses to proceed with the underlying work until the ADR is at least Proposed status.

Use when designing or reviewing database architecture for high-demand multi-tenant commerce platforms — including PostgreSQL schema design, foreign keys, indexes, JSONB usage, multi-tenant isolation with Row Level Security, transactional outbox, Neo4j GraphRAG projections, event sourcing decisions, audit logging, partitioning, expand/contract migrations, and product/inventory/order modeling for restaurants, boutiques, drugstores, retailers, distributors, grocery, hardware, or appliance businesses. Triggered by any request to design tables, design schemas, create migrations, model products/variants/inventory/orders/payments, choose between monolith and microservices, choose between PostgreSQL and Neo4j as source of truth, model multi-tenant data, design event flows, or review an ER diagram.

Use when reviewing or designing how Neo4j and GraphRAG interact with PostgreSQL transactional truth — including any feature involving recommendations, semantic product search, ingredient relationships, substitution suggestions, complementary products, AI-assisted discovery, vector search combined with graph traversal, or any proposal that puts orders, inventory, payments, prices, or tenant access rules into Neo4j. Evaluates architectural proposals for data boundary violations, identifies sync pattern errors between Neo4j and PostgreSQL, produces structured design review feedback with severity-ranked findings, counter-proposals with Mermaid diagrams, eventing changes, and re-projection plans. Triggered by mentions of GraphRAG, Neo4j, knowledge graph, recommendations engine, semantic search, vector + graph hybrid search, AI product discovery, or any design that crosses the PostgreSQL ↔ Neo4j boundary.

Generates code verifier/challenge pairs, exchanges authorization codes for sessions, sets secure HTTP-only session cookies, and configures server-side callback handling to implement the Proof Key for Code Exchange auth flow. Replaces implicit token-in-fragment flows by removing hash-based token extraction and localStorage usage. Use when implementing Supabase authentication, OAuth login, secure browser auth, SSR auth setup, or modern auth flow migration.

Configures private Realtime channels with RLS-backed authorization on the realtime.messages table. Enforces tenant-scoped Presence and Broadcast security. Use when implementing private realtime channels, realtime authorization, presence security, broadcast security, or securing the realtime messages table.

Interview stakeholders to clarify ambiguous or underspecified requirements before writing code. Use when receiving a new task, feature request, or bug report that lacks clear acceptance criteria. Produces clarified requirements ready for spec authoring. Common triggers: "new feature", "build me", "implement", "add support for", or any task where requirements are vague or incomplete.

Verify that implementation and tests remain synchronized with specs after code changes. Use when code has been generated or modified from specs, after implementation is complete, or when reviewing a PR that touches spec-covered code. Reports mismatched targets, broken test links, and undocumented behavioral changes. Common triggers: "verify the spec", "check spec alignment", "are specs up to date", or after completing implementation work.

Create or update .spec.md files from clarified requirements. Use when requirements have been gathered and confirmed, and specs need to be written or updated before implementation begins. Produces well-structured spec files with frontmatter, requirements, and test links. Common triggers: "write the spec", "update the spec", "create a spec for", or after requirement-gathering completes.

Enforces that service_role key is never exposed to client-side code. Validates admin client isolation, privileged operations routing, and server-only key usage. Use when implementing admin operations, server-side Supabase clients, or auditing service_role key usage.

Sets up Prometheus scrape jobs targeting the Supabase metrics endpoint and configures log drain pipelines. Establishes monitoring dashboards and alerting baselines. Use when configuring Supabase monitoring, setting up Prometheus metrics, implementing log drains, or establishing observability for production Supabase deployments.

Implements server-side auth session management with HTTP-only cookie synchronization for Next.js, SvelteKit, and other SSR frameworks. Depends on PKCE auth flow. Use when implementing SSR authentication, server-side session sync, HTTP-only auth cookies, Next.js Supabase auth, or SvelteKit Supabase auth.

Scaffolds a complete A2A agent specifically configured for Gemini Enterprise compatibility, including the JSON-RPC root path and a health check.

Expert OpenTelemetry guidance for collector configuration, pipeline design, and production telemetry instrumentation. Use when configuring collectors, designing pipelines, instrumenting applications, implementing sampling, managing cardinality, securing telemetry, writing OTTL transformations, or setting up AI coding agent observability (Claude Code, Codex, Gemini CLI, GitHub Copilot).

Generates Postgres Auth Hook that injects tenant_id and serialized permissions into JWT app_metadata using jsonb_set. Use when implementing RBAC, multi-tenant JWT claims, custom access token hooks, or permission injection into Supabase auth tokens.

Creates Postgres functions to validate storage path payloads and prevent directory traversal. Enforces tenant-safe file paths via storage RLS bucket policies. Use when configuring Supabase storage buckets, writing storage RLS policies, or implementing tenant-scoped file uploads.

Route and calibrate research drawn from socially noisy web communities so agents do not mistake crowd mood for truth. Use when research notes, summaries, or quoted material come from Moltbook, Hacker News, Reddit, or Product Hunt and the job is to decide how much weight that material deserves, separate concrete weak signals from vibe/noise, or choose the right source-specific calibration skill before carrying findings forward.

Calibrate research done on Hacker News so agents do not mistake experienced technical cynicism, anti-hype sentiment, or comment-thread confidence for balanced evidence. Use when summarizing Hacker News reactions, extracting concerns from HN threads, citing HN as part of research, or deciding how much weight to give repeated negative or skeptical Hacker News comments.

Interpret and calibrate already-collected research material derived from Moltbook so agents do not mistake noise, spam, novelty, or social heat for reliable evidence. Use when weighing notes, summaries, or quoted material from Moltbook as part of research, deciding whether a Moltbook claim is worth following up, checking source reliability or evidence quality, or separating concrete weak signals from social-performance noise. Prefer when Moltbook is being used as a weak-signal discovery source rather than as authoritative proof. This skill classifies gathered Moltbook material as concrete report, vibe signal, or noise; flags evidence strength and uncertainty; and suggests whether the claim is follow-up-worthy. This is an informational calibration skill, not a browsing or execution workflow.

Use when the user asks to run E2E tests, verify a web page, generate tests for an app, prove destructive actions are blocked, check if a UI element is visible, fill out a form, or drive a browser with natural language. Returns per-step results with safety classifications, policy decisions, DOM diffs, structured page context, and a signed audit trail.

Configures and consumes the SonicJS headless CMS REST API — builds API clients, constructs query filters for content endpoints, configures CORS headers, and handles authenticated GET/POST requests with JSON payloads. Use when fetching data from SonicJS endpoints, sending HTTP requests to a SonicJS backend, integrating a frontend with a SonicJS API, creating or retrieving CMS content via fetch, managing CORS for a SonicJS deployment, or building an API client against SonicJS collections.

Configures login flows, implements role-based access control (RBAC), generates JWT tokens, and manages user accounts in SonicJS. Use when configuring login flows, role-based access, permissions, auth, session management, or creating authentication middleware.

Scaffolds new SonicJS routes, configures Drizzle ORM schemas, sets up authentication and RBAC, registers Hono.js plugins, and manages Cloudflare Workers deployment for a SonicJS edge-native headless CMS. Use when creating an API endpoint, adding a content type, configuring a database schema, deploying the CMS to Cloudflare, building or modifying a SonicJS plugin, setting up auth flows, or architecting any part of a SonicJS application backed by Cloudflare Workers, D1, R2, and HTMX.