enforces engineering-governance checks before code changes that may be unnecessary, risky, architectural, or scope-widening. use when the user asks whether to refactor, clean up, redesign, choose a next development step, review a proposed implementation, evaluate architectural consistency, review a pull request, or prevent development drift. do not use as the primary implementation skill for routine debugging, bug fixes, feature coding, or language-specific coding unless a no-op, minimal-diff, or architecture-conflict judgment is needed.

Manage Things 3 tasks on macOS -- view lists, create tasks with deadlines and tags, complete tasks, move between projects, set due dates, search, and organize. This skill should be used when the user mentions Things 3, wants to manage tasks or to-dos, asks about their inbox, today, upcoming, or someday tasks, wants to create, complete, move, or delete tasks, discusses projects or task management, or says things like 'add a task', 'show my inbox', 'what do I need to do today', 'mark it done', 'my to-do list'.

Cypress E2E testing patterns -- commands, selectors, network stubbing, auth caching, time control, test isolation, and best practices. Use when building or reviewing E2E tests with Cypress, when setting up browser testing, or when debugging flaky Cypress tests.

Go API testing patterns that catch real bugs. Covers httptest server setup, table-driven tests with subtests, test helpers, middleware testing, dependency injection with interfaces, database setup/teardown, parallel tests, testify assertions, and golden files. Triggers when writing tests for any Go HTTP API, adding test coverage, or building a new API that needs tests.

Reference catalog of the eight flake patterns - async/timing, test ordering, shared parallel state, resource leaks, network, locator drift, environment variance, randomness - with detection heuristics, remediation per pattern, and the concrete code-level fixes: replacing fixed sleeps with framework auto-waits, isolating state in beforeEach fixtures, per-worker DB schemas via workerIndex, try/finally teardown, mocking network + clock at the boundary, stable role-based locators, TZ pinning, and RNG seeding. Use when triaging an unknown flake to identify the category before bisecting, or when a classified flake needs the specific code change to apply.

Write correct Flask tests that avoid common pitfalls. Covers app factory with test config, application context for test_client, pytest fixtures in conftest.py, database isolation with transactions, testing file uploads, testing error handlers, testing with authentication, mock.patch placement, and the essential test patterns that catch real bugs. Use when writing or reviewing Flask test suites.

SQLite best practices that must be applied by default in every Go application using database/sql with SQLite. Covers connection setup with WAL mode, foreign_keys, busy_timeout, pool settings (SetMaxOpenConns), modernc.org/sqlite (pure Go, no CGO), context-aware queries, transactions, migration patterns, prepared statements, and the Scanner interface. Always apply these patterns when creating or modifying any Go application that uses SQLite.

Create, configure, and deploy PubNub Functions 2.0 event handlers, triggers, and serverless endpoints. Use when building real-time message transformations, PubNub modules, webhook integrations, or edge data processing.

Decides what kind of failure a red CI test is before anyone starts fixing it. Extracts seven failure signals from the runner output, stack trace, run history, and environment metadata, then walks an ordered first-match-wins rule set to exactly one verdict: flaky-known, environment-drift, defect, timeout, flaky-pre-incident, or flake-of-unknown-cause. Emits the verdict together with the alternatives that were rejected and the specific condition each one failed, so the triage decision is auditable rather than asserted. Use when a test has just gone red and the next action depends on whether the cause is a product defect, a non-deterministic test, or drifted infrastructure.

Flask patterns -- application factory, blueprints, error handlers, extensions, request lifecycle, configuration, logging, CLI commands, and project structure. Use when building or reviewing Flask APIs, setting up a new Flask project, migrating from a single-file app to a structured project, or choosing between Flask patterns.

Full-lifecycle Apple App Store review for iOS and iPadOS apps. Use for pre-submission audits, rejection diagnosis and Resolution Center replies, Guideline 4.3 spam or similarity recovery, human-craft and low-effort audits, Apple design and Human Interface Guidelines audits of native interaction, motion, gestures, materials, haptics, accessibility, and iPad adaptation, App Review Notes, privacy manifests, Info.plist permission strings, subscriptions, Sign in with Apple, account deletion, UGC, third-party AI consent, TestFlight or App Store readiness, and vague requests such as "review my app" or "will Apple approve this" when an Xcode, Expo, React Native, or Flutter project is present. Produces evidence-tagged Markdown, JSON, and a self-contained visual HTML report, runs a read-only deterministic scan first, and only offers grouped fixes after the report.

Audits a Claude Code skill for security risks in three modes: before download (from a URL or install command), after download but before install (from a .skill file), or after install (from a local skills directory). Use this skill whenever a user is about to install a skill from any source — including GitHub URLs, git clone commands, npx/npm commands, curl/wget downloads, pip installs, marketplace links, or raw SKILL.md URLs. Also trigger when a user asks "is this skill safe?", "should I trust this skill?", "can you check this before I install it?", "audit this skill", or pastes any link to a skill repository or .skill file. If a user mentions installing ANY skill, proactively offer to audit it first — do not wait for them to ask.