Research a specific CVE or vulnerability disclosure end-to-end — what version is affected, is your code reachable, is there a public PoC, is there a patch, what's the exposure window, what's the mitigation if you can't patch immediately. Use when the user mentions 'CVE,' 'vulnerability research,' 'is this CVE relevant,' 'zero-day,' 'CISA KEV,' 'GitHub Security Advisory,' 'reachability analysis,' 'patch analysis,' 'exploit availability,' 'EPSS,' 'CVSS,' or 'should we drop everything and patch this.'

Expert guidance for Swift Testing: test structure, #expect/#require macros, traits and tags, parameterized tests, test plans, parallel execution, async waiting patterns, and XCTest migration. Use when writing new Swift tests, modernizing XCTest suites, debugging flaky tests, or improving test quality and maintainability in Apple-platform or Swift server projects.

Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards.

Synthesize Drive files, Granola meeting notes, and web signals into a weekly Markdown research summary with Trends, Competitors, Ideas, and Risks sections. Use when a PM wants to consolidate scattered research into a single weekly digest.

Synthesizes customer feedback into actionable themes including feature requests, bugs, pain points, and praise. Use when planning product roadmap, understanding user sentiment, investigating specific issues, or preparing voice-of-customer reports.

DEPRECATED and retired as of 2026-08-20. Do not invoke, and do not schedule. This skill scanned for merged PRODUCT.md specs and auto-drafted docs PRs, which produced documentation for features that had not shipped. Docs for newly shipped features are now triggered by the weekly release and gated on documentation-worthiness by the missing_docs skill in warpdotdev/docs. If you were about to run this skill to find docs gaps, run missing_docs in drift-watch mode instead.

Use when the user provides an OpenAPI or Swagger spec and asks to find security issues, pentest the API, audit endpoints for OWASP API Top 10, or check for BOLA, BFLA, mass assignment, injection, or SSRF vulnerabilities in a running HTTP API

Running closed and open betas that produce real signal. Beta participant selection, structured feedback collection, beta-to-GA decision criteria, and the difference between soft-launch (no structure, no signal), kitchen-sink (everyone in, no actionable feedback), and structured beta (calibrated cohort, intentional feedback loops, clear graduation criteria). Triggers on beta program, alpha test, beta cohort, beta participant, beta feedback, beta to GA decision, design partner, early access program, closed beta, open beta, RC release. Also triggers when a feature is approaching launch and the team needs structured pre-GA validation, when prior betas produced noise rather than signal, or when the team has soft-launched before but wants more structured feedback this time.

Design test strategy using Beck's Test Desiderata — which properties matter, which tradeoffs to make. Use when the user asks "how should I test this", "what tests do I need", "review my test strategy", "is this well-tested", or when planning tests for a new feature or refactor.

Operate Ryvn infrastructure: manage organizations, provision environments, deploy services and installations, configure blueprints, manage release channels and promotion pipelines, set up connections and variable groups, view logs, approve tasks, handle preview deployments, and write network policies. Use this skill whenever the user mentions Ryvn, environments, services, installations, blueprints, deployments, infrastructure, provisioning, Kubernetes, cloud, GCP, service installations, release channels, promotion pipelines, network policy, egress rules, isolating a workload, or allowing a domain or IP, even if they don't say "Ryvn" explicitly.

Use when the user wants to explain or visualize a codebase on a Miro board — produces a minimal, notation-correct set of architecture / structure / behavior diagrams (flowchart, UML class, UML sequence, ERD) plus a short companion document, grounded in real repo artifacts.

Use when the user wants to explain or visualize a codebase on a Miro board — produces a minimal, notation-correct set of architecture / structure / behavior diagrams (flowchart, UML class, UML sequence, ERD) plus a short companion document, grounded in real repo artifacts.

Add OpenTelemetry observability (traces, logs, metrics) to a Python app with Liteverge. Use when the user asks to add observability, tracing, logging, or metrics to a FastAPI, Django, Flask, or similar Python backend — or to add custom spans, logs, and instrumentation to an already-instrumented app.

Add OpenTelemetry observability (traces, logs, metrics) to a Node.js/TypeScript app with Liteverge. Use when the user asks to add observability, tracing, logging, or metrics to an Express, Fastify, or similar Node.js backend — or to add custom spans, logs, and instrumentation to an already-instrumented app.

Add OpenTelemetry observability (traces, metrics) to an AWS Lambda function with Liteverge. Use when the user asks to add tracing, observability, or metrics to a Lambda function — or to add custom spans and metrics to an already-instrumented Lambda. Logs are not included; use CloudWatch for logging.

Add OpenTelemetry tracing to a browser/frontend app with Liteverge. Use when the user asks to add observability, tracing, or OpenTelemetry to a React, Next.js, Vue, Angular, or similar frontend app — or to add custom spans and instrumentation to an already-instrumented app.

Implements a use case's frontend: a React view, form, or grid wired to the backend API, covering the main flow and every alternative/failure flow. Use when the user asks to "implement the frontend for UC-xxx", "build the React view", "wire up the form", "add the page for", or mentions React implementation for a specific use case.

Spec-driven feature work that freezes obligations instead of the plan: one human-reviewed plan with EARS criteria, path, entities, interface and one-way doors, then proof-backed checks, then build, then an independent Verifier. Use when the user says "tlc-spec-lean", "plan feature", "specify feature", "write the checks", "build this plan", or "verify work". Do NOT use for standalone design documents unattached to a feature, architecture decomposition analysis, or work that already has a task list or checklist to execute.

Expert Mermaid diagram creation, validation, and rendering with dual-engine output (SVG/PNG/ASCII). Supports all 20+ diagram types including C4 architecture, AWS architecture-beta with service icons, flowcharts, sequence, ERD, state, class, mindmap, timeline, git graph, sankey, and more. Features code-to-diagram analysis, batch rendering, 15+ themes, and syntax validation. Use when users ask to create diagrams, visualize architecture, render mermaid files, generate ASCII diagrams, document system flows, model databases, draw AWS infrastructure, analyze code structure, or anything involving "mermaid", "diagram", "flowchart", "architecture diagram", "sequence diagram", "ERD", "C4", "ASCII diagram". Do NOT use for non-Mermaid image generation, data plotting with chart libraries, or general documentation writing.

Generate Excalidraw diagrams from natural language descriptions. Outputs .excalidraw JSON files openable in Excalidraw. Use when asked to "create a diagram", "make a flowchart", "visualize a process", "draw a system architecture", "create a mind map", "generate an Excalidraw file", "draw an ER diagram", "create a sequence diagram", or "make a class diagram". Supports flowcharts, relationship diagrams, mind maps, architecture, DFD, swimlane, class, sequence, and ER diagrams. Can use icon libraries (AWS, GCP, etc.) when set up. Do NOT use for code architecture analysis (use the architecture skills), Mermaid diagram rendering (use mermaid-studio), or non-visual documentation (use docs-writer).