Use when implementing infrastructure as code with Terraform across AWS, Azure, or GCP. Invoke for module development (create reusable modules, manage module versioning), state management (migrate backends, import existing resources, resolve state conflicts), provider configuration, multi-environment workflows, and infrastructure testing.

Test-driven development workflow using red-green-refactor cycles with integration tests at service boundaries and property-based testing. Use when the user explicitly requests TDD, test-first development, write tests first, unit tests, red-green-refactor, or property-based testing approaches.

Explain or summarize Baruch Sadogursky's JavaZone 2026 talk "The Right 300 Tokens Beat 100k Noisy Ones" and answer questions about its four context antipatterns, demos, conclusions, and evaluation caveats. Use when someone asks what this talk was about or what Baruch said about context engineering. Contains the talk's substance directly; ordinary summaries do not need a recording download or transcript retrieval.

Use when designing new screens, redesigning existing UI, creating visual concepts, or improving interfaces in Nicolify. Executes a 7-phase creative Design Thinking workflow: defines user personas, frames problems, audits existing components (Shadcn UI + Tailwind CSS v4 + FSD architecture), researches SaaS UI patterns, proposes multiple distinct layout paradigms with ASCII wireframes and HTML mockups, iterates through dialogue, and delivers a complete UI-SPEC.md with component trees, data flow, responsive behavior, and interaction patterns — all following Nicolify's design tokens and codebase conventions. Triggers: 'diseña', 'rediseña', 'nueva pantalla', 'concepto visual', 'propuesta de diseño', 'UX', 'layout', 'prototipo', 'mejora la interfaz', 'wireframe', 'mockup', 'esquema de color', 'componentes de pantalla'.

Live verification of frontend changes in dev-app.nicolify.com using Chrome DevTools MCP from WSL2. Use when: verifying a frontend bug fix, reproducing a user-reported UI bug step-by-step, checking real-time SSE/polling behavior, validating card/form interactions, inspecting DOM or console or network live, or any task where 'me lo muestres en el navegador' would be cheaper than guessing. Triggers: 'verifica en el navegador', 'prueba con chrome-devtools', 'reproduce el bug en vivo', 'abrí el navegador', 'chrome-devtools-mcp', 'live test', 'verify UI fix'.

Select electronic components and build a procurement-ready BOM with real LCSC/JLC supplier evidence (stock, price, datasheet). Use after the PRD stage and before PCB design. Provides parts_search.py (jlcsearch API) and bom_validate.py (schema gate).

Parametric CAD modeling with build123d (Python) - enclosures, mechanical parts, assemblies. Builds a scene from cad/parts/*.py, exports STEP/GLB, renders PNG views for visual self-review, and prepares STL/3MF for printing. Use after PCB release (or directly for non-PCB products).

Removes Open Harness hosted demo restrictions from a fork. Use when a maintainer wants to remove managed-template trial caps, hosted deployment gating, or "deploy your own" limits. Triggers on "remove demo limits", "remove trial limits", "remove hosted restrictions", "open this up for my fork", "remove managed template restrictions".

Delegate a hard decision or conundrum to the Kyotee harness engine — a cross-vendor Council that debates to consensus, a Two-Brain divergent/ convergent debate, or a forced tool-checking solo run. Use when a decision is high-stakes, genuinely contested, or benefits from multiple model perspectives, and you want a synthesised answer (with dissent noted) back in this session. Requires a running kyotee engine (see setup).

Review a code change for off-by-one and boundary errors, null propagation, changed sentinel meanings, tooling and provisioning drift, race conditions, invalid state transitions, React effect cleanup gaps, and broken error propagation. Use when reviewing for logic bugs, behavioral correctness, or edge cases that tests miss.

Turn one finding from a conformance sweep into a small pull request that brings the code back in line with the team standard it cites. Use as the action for a `tessl:finding.created` trigger on the conformance-sweep loop.

Carry a factory pull request through review by resolving review comments and failed checks on its existing branch, until it is ready for a person to merge or needs one to decide. Use as the action for review, review-comment, `@factory` conversation and failed-check triggers on `factory/` branches.

Experimental end-to-end product-design orchestrator that frames project context, retrieves research, models experience flows, defines visual direction, creates artifacts, and validates rendered outcomes. Use only when explicitly asked for "end-to-end product design", "design this feature end-to-end", "redesign this flow", "build an experience from this brief", or "create a product experience". Use the stable specialist skills for isolated audits, dashboards, AI features, design systems, handoff, or case studies.

Run an SEO + structured-data audit of the site (wraps `bun run seo:audit`) and verify per-page SEO wiring and JSON-LD. Use before pushing, or when asked to check SEO.

Reviews Bash, Zsh, and Fish shell scripts for bugs, security vulnerabilities, portability issues, and style violations against the Google Shell Style Guide, ShellCheck, BashPitfalls, and shell-specific idiom conventions. Use when the user asks to review, audit, lint, or improve a .sh/.bash/.zsh/.fish file, or pastes shell script content for feedback.

Creates and maintains CHANGELOG.md in Keep a Changelog format, including adding entries and cutting releases. Use when the user asks to update the changelog, add a changelog entry, or record a release.

Configure or troubleshoot the hosted AgentMail MCP server for Codex, Claude Code, Cursor, Claude.ai, ChatGPT, or another Streamable HTTP MCP client. Use for installation, OAuth, API-key headers, connection failures, or MCP tool discovery. Do not use when the connection already works and the user just wants to send, check, or manage mail — use the sibling action skills for that.

Performs a COMPREHENSIVE, formal security audit of an entire codebase and produces a written audit report (AUDIT-{PROJECT}-{DATE}.md) with prioritized findings (H/M/L) and a remediation plan. Covers SAST, OWASP Top 10, OWASP LLM Top 10, SCA (dependency analysis), Zero Trust validation, code quality. Takes 30+ minutes. TRIGGER ONLY when the user explicitly requests a formal full-codebase audit producing a report: "security audit", "OWASP audit", "full security review", "AUDIT-Report erstellen", "Codebase auditieren", "SCA audit", "dependency audit", "CVE audit", "Sicherheitsaudit". DO NOT trigger for: PR-level security checks (use the built-in security-review skill), one-off security questions, threat-modeling discussions without an audit report, individual finding fixes, or generic mentions of "secure" / "security".

Use when evaluating LLM or RAG outputs: audit eval coverage, analyze failed traces, write binary judge prompts, validate judges against labels, generate targeted synthetic cases, evaluate retrieval quality, or plan review tooling. Do not use for ordinary software test implementation.

Query TradingView market data through the bundled tradingview MCP server without a desktop app or login. Use whenever the user wants a technical analysis readout (RSI, MACD, Bollinger rating, BUY/SELL summary), multi-timeframe alignment (weekly→daily→4h→1h→15m), exchange-wide scans (Bollinger squeeze, volume breakout, consecutive candles, smart volume), top gainers/losers by exchange, futures market data (NQ/ES/CL/GC overview, overnight movers, category snapshots), pre-market / after-hours quotes, a quick options chain or unusual options activity (volume/OI by strike), bulk stock prices, a global market snapshot, strategy backtests (Sharpe, drawdown, win rate), or crypto exchange scans. Triggers include "TA on X", "multi-timeframe read", "BB squeeze scan", "futures movers", "NQ overnight", "pre-market price", "unusual options activity", "backtest RSI on AAPL", and "top gainers on NASDAQ". For options greeks, watchlists, alerts, or chart screenshots use tradingview-reader instead.