Lists permitted and prohibited actions, blocks disallowed content types, and responds to permission queries in shared or public group settings. Use when joining a new group, when unsure about rules, permissions, or boundaries, when someone asks what you are allowed to do here, or when operating in a public channel or untrusted group chat environment.

Configures pgsodium Vault extension for API key and secret storage. Creates SECURITY DEFINER functions assigned to service_role for secure access. Eliminates hardcoded secrets. Use when storing API keys, managing secrets in Supabase, implementing pgsodium Vault, or replacing hardcoded credentials with Vault references.

Run quality checks on Java code before committing. Validates against best practices, enterprise standards, and common issues. MUST be run before any git commit operation that includes Java files.

Use when the user asks to log work, record what was done, or save task progress. Creates a structured markdown task log in `agent-logs/` with validation, waivers, and a final gates summary.

Use when the user asks you to implement a feature, fix a bug, or complete a repository task end-to-end (from scoping through code changes, validation, and final gate summary).

Use when `.tf` or `.tfvars` files have been edited, added, or removed and you need to verify that the code changes produce the intended Terraform plan before the task is considered complete. Runs `terraform plan` in `examples/test_app` and cross-checks the result against the change set you expected your edits to cause. This is a gate: do not declare a Terraform task done without passing it.

Scan a project for practice gaps — missing domains, weak implementations, and new technology areas. Use when starting a new project, joining an existing codebase, beginning a major feature (3+ new files), or when the PreToolUse gate hook blocks a write. Produces a structured gap report that drives skill-search and downstream skills.

Generate project-level quality standards in CLAUDE.md from installed proactive skills. The quality block is the single biggest lever for code quality (4x improvement in experiments). Use after skill-classifier runs, when the skill set changes, or when the user asks "update my quality standards", "what standards should I follow".

Compare your code against installed proactive skill checklists and fix gaps. Use after committing, after completing a feature, before submitting a PR, or whenever you want to verify your code meets quality standards. Can be triggered by a post-commit hook, a periodic check, or a direct request like "review your code", "check quality", "did you follow the skills".

Gestisce il sistema di passaggio di consegne tra sessioni AI per qualsiasi progetto. Crea, aggiorna e legge file HANDOFF-N.md nella cartella .handoff/ del progetto, mantenendo una knowledge base persistente con documentazione (CLAUDE.md, PROMPTS.md, CLIENTS.md, WORKFLOW.md). Usa questa skill ogni volta che l'utente vuole: - Salvare lo stato ("crea handoff", "salva lo stato", "facciamo il punto", "chiudiamo la sessione", "riprendiamo domani", "passaggio di consegne", "freeze the context", "save state") - Riprendere da una sessione precedente ("riprendi da dove eravamo", "carica handoff", "resume", "continua da HANDOFF", "cosa avevamo fatto") - Inizializzare la knowledge base di un nuovo progetto ("/handoff init") - Aggiornare la documentazione persistente (CLAUDE.md, PROMPTS.md, CLIENTS.md, WORKFLOW.md) Suggerisci proattivamente la creazione di un handoff dopo sessioni lunghe con modifiche importanti, debugging complessi, o decisioni architetturali significative.

Traccia bug emersi testando una skill o un plugin, per guidarne l'upgrade. Controparte di handoff orientata al ciclo test → bug → fix di una skill specifica: crea/legge file BUG-N.md in `.handoffskill/<nome-skill>/` con uno STATUS.md aggregato. Usa quando l'utente segnala che una skill non funziona ("questo non funziona", "bug nella skill X"), vuole testarla sistematicamente ("testiamo la skill X"), o riprendere uno stato di test precedente ("riprendi i bug di X"). Invoca anche con "/handoff-skill".

Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.

Use when the user proposes — or the agent detects — a deviation from constitutional defaults that requires an Architecture Decision Record. Triggered by proposals to extract microservices, drop foreign keys, denormalize without measured evidence, store transactional truth in Neo4j, skip Row Level Security, skip the transactional outbox, run destructive migrations, use database-per-service, or any explicit override of a constitutional principle. Drafts a structured ADR with context, decision, consequences, alternatives rejected, migration path, validation criteria, and constitutional sections affected — and refuses to proceed with the underlying work until the ADR is at least Proposed status.

Use when designing or reviewing database architecture for high-demand multi-tenant commerce platforms — including PostgreSQL schema design, foreign keys, indexes, JSONB usage, multi-tenant isolation with Row Level Security, transactional outbox, Neo4j GraphRAG projections, event sourcing decisions, audit logging, partitioning, expand/contract migrations, and product/inventory/order modeling for restaurants, boutiques, drugstores, retailers, distributors, grocery, hardware, or appliance businesses. Triggered by any request to design tables, design schemas, create migrations, model products/variants/inventory/orders/payments, choose between monolith and microservices, choose between PostgreSQL and Neo4j as source of truth, model multi-tenant data, design event flows, or review an ER diagram.

Use when reviewing or designing how Neo4j and GraphRAG interact with PostgreSQL transactional truth — including any feature involving recommendations, semantic product search, ingredient relationships, substitution suggestions, complementary products, AI-assisted discovery, vector search combined with graph traversal, or any proposal that puts orders, inventory, payments, prices, or tenant access rules into Neo4j. Evaluates architectural proposals for data boundary violations, identifies sync pattern errors between Neo4j and PostgreSQL, produces structured design review feedback with severity-ranked findings, counter-proposals with Mermaid diagrams, eventing changes, and re-projection plans. Triggered by mentions of GraphRAG, Neo4j, knowledge graph, recommendations engine, semantic search, vector + graph hybrid search, AI product discovery, or any design that crosses the PostgreSQL ↔ Neo4j boundary.

Generates code verifier/challenge pairs, exchanges authorization codes for sessions, sets secure HTTP-only session cookies, and configures server-side callback handling to implement the Proof Key for Code Exchange auth flow. Replaces implicit token-in-fragment flows by removing hash-based token extraction and localStorage usage. Use when implementing Supabase authentication, OAuth login, secure browser auth, SSR auth setup, or modern auth flow migration.

Configures private Realtime channels with RLS-backed authorization on the realtime.messages table. Enforces tenant-scoped Presence and Broadcast security. Use when implementing private realtime channels, realtime authorization, presence security, broadcast security, or securing the realtime messages table.

Interview stakeholders to clarify ambiguous or underspecified requirements before writing code. Use when receiving a new task, feature request, or bug report that lacks clear acceptance criteria. Produces clarified requirements ready for spec authoring. Common triggers: "new feature", "build me", "implement", "add support for", or any task where requirements are vague or incomplete.

Verify that implementation and tests remain synchronized with specs after code changes. Use when code has been generated or modified from specs, after implementation is complete, or when reviewing a PR that touches spec-covered code. Reports mismatched targets, broken test links, and undocumented behavioral changes. Common triggers: "verify the spec", "check spec alignment", "are specs up to date", or after completing implementation work.

Create or update .spec.md files from clarified requirements. Use when requirements have been gathered and confirmed, and specs need to be written or updated before implementation begins. Produces well-structured spec files with frontmatter, requirements, and test links. Common triggers: "write the spec", "update the spec", "create a spec for", or after requirement-gathering completes.

Enforces that service_role key is never exposed to client-side code. Validates admin client isolation, privileged operations routing, and server-only key usage. Use when implementing admin operations, server-side Supabase clients, or auditing service_role key usage.

Installs spec-as-source enforcement scripts, CI workflow, and pre-commit hooks into a project. Trigger — setup spec enforcement, add spec checks, configure spec-as-source, install spec scripts, add spec CI.

Syncs .github/workflows/spec-verification.yml with the test runner and test files declared in specs. Trigger — update CI workflow, sync spec CI, regenerate workflow, CI out of sync with specs, add spec test to CI.

Deletes all files declared as targets in specs/*.spec.md and rebuilds them from the specs to verify spec-as-source integrity. Trigger — clean rebuild, verify source of truth, spec drift check, regenerate from specifications, rebuild from spec.

Sets up Prometheus scrape jobs targeting the Supabase metrics endpoint and configures log drain pipelines. Establishes monitoring dashboards and alerting baselines. Use when configuring Supabase monitoring, setting up Prometheus metrics, implementing log drains, or establishing observability for production Supabase deployments.

Scaffolds a complete A2A agent specifically configured for Gemini Enterprise compatibility, including the JSON-RPC root path and a health check.

Tail a Hubitat hub's live log or event websocket, filtered, and interpret it against the code to diagnose an app or driver. Use when the user wants to debug, watch logs, tail the log stream, see live events, or figure out why a Hubitat app/driver misbehaves.

Deploy a Hubitat app or driver's Groovy source to a hub and confirm it saved and runs by watching the log stream. Use when the user wants to deploy, push, upload, or install app/driver code onto a Hubitat hub, or iterate the edit-deploy-check loop.

Run a command on a Hubitat device over HTTP and confirm it landed — turn a switch or plug on/off, set a dimmer level, refresh a sensor, start an irrigation zone, or run a driver's custom command. Use when the user wants to command, control, operate, or exercise a device, test that a device responds, or run a device command and verify it took effect. Not for deleting a device (that is device-removal).

Read the operator's current IANA timezone from the host-owned `tz_state` singleton, resolved from their live location, with no home-zone guessing. Use when a skill needs the zone the operator is in right now — phrasing "today" / "tomorrow", picking the parse zone for a "remind me at 8am" reminder, deciding whether a local time has passed — instead of the container clock, `home_tz`, or a hand-written SQL read. The single shared reader; do not copy the script into another plugin.

Deterministically decide whether a deadline/event is past or future relative to the real current instant. The mandated computation path for `rules/temporal-awareness.md` — call it before any "already passed", "still time to act", or upcoming/just-happened framing instead of eyeballing the clock.

Search messages.db for past chat history by keyword and/or sender username. Use when the user references past messages, after context compaction, after a session nuke, or anywhere `rules/context-recovery.md` requires checking the message history before claiming lost context.

Creates Postgres functions to validate storage path payloads and prevent directory traversal. Enforces tenant-safe file paths via storage RLS bucket policies. Use when configuring Supabase storage buckets, writing storage RLS policies, or implementing tenant-scoped file uploads.

Use when the user asks to run E2E tests, verify a web page, generate tests for an app, prove destructive actions are blocked, check if a UI element is visible, fill out a form, or drive a browser with natural language. Returns per-step results with safety classifications, policy decisions, DOM diffs, structured page context, and a signed audit trail.

Demo skill one used to verify global vs project install behavior across agents

Reference material for writing Rego/OPA policies in a specific domain — Kubernetes admission control, Terraform/CloudFormation infrastructure-as-code validation, HTTP API authorization (request body validation, rate limiting), RBAC/ABAC access control models, metadata annotations, or Regal linter compliance by rule category. Load this when rules.md's general Rego style rules aren't enough and you need worked examples or domain-specific patterns for one of these areas.