Administer Docker Sandbox governance — local versus organization policy, filesystem and network access rules, audit logging, and sign-in enforcement across a fleet of developer machines. Use when creating or scoping an organization policy, diagnosing why an allow rule has no effect, writing filesystem mount rules, configuring audit delivery or SIEM forwarding, or deploying MDM sign-in enforcement. This is the administrator's view; route a single developer's blocked request to diagnosing-sbx-sandboxes instead.

Run DiffDock molecular docking via NVIDIA NIM to predict small-molecule binding poses against protein targets. Use for DiffDock, molecular docking, ligand docking, blind docking, SMILES or SDF ligands, ranked poses, confidence scores, hosted NVIDIA API, or local Docker deployment.

Use when creating social media content ideas, hunting for viral references, adapting content formulas from other niches/countries, or planning content calendars. Generates hook variations, writes caption drafts, curates cross-niche reference swipe files, scores references with STEPPS framework, produces complete content briefs, and builds weekly posting schedules — all grounded in brand and offer data. Integrates with Brand Studio (positioning, narrative, voice) and Offer Studio (promise, audience psychology). Triggers: 'contenido', 'content', 'ideas de contenido', 'reel', 'carrusel', 'post', 'viral', 'qué publico', 'dame ideas', 'inspiración', 'referencia', 'steal like an artist', 'calendario de contenido', 'qué posteo', 'ideas para Instagram', 'ideas para TikTok', 'content hunting'.

Independently audit one complete committed CAD build using cad.look image evidence and cad.inspect geometry facts. Use only for the Host-owned CAD handoff review that returns prioritized P0/P1 issues as ordinary text; do not use for CAD editing, finite-element analysis, physical load certification, or export.

Choose and implement effector-storage persistence patterns for Effector apps. Use when tasks involve persist/createPersist usage, selecting adapters (local/session/query/broadcast/storage/asyncStorage/memory/nil/log), configuring clock/pickup/context/keyPrefix, validating data with contracts, handling done/fail/finally flows, SSR-safe adapter fallback with either, or debugging sync and serialization issues.

Review a code change against the rules the project has written down in its standards and agent instruction files, including frontmatter requirements, reference and inclusion conventions, cross-references, platform portability, tool-use instructions, naming and placement, writing style, and protected paths. Use when reviewing for project standards compliance, especially changes to skills, rules, plugin manifests, or AGENTS.md and CLAUDE.md files.

Review a code change for production-observable performance problems, including N+1 queries, unbounded memory growth, missing pagination, hot-path allocations, and blocking I/O in async contexts. Use when reviewing for runtime performance, query efficiency, memory use, or scalability at expected load.

Review a code change for missing error handling on I/O boundaries, unbounded retries, missing timeouts, swallowed errors, resource leaks on error paths, cascading failures, and CI or deploy guards that do not mirror production. Use when reviewing for reliability, failure modes, partial failures, or graceful degradation.

Review a code change for injection, authentication and authorization bypasses, secrets in code or logs, insecure deserialization, SSRF, path traversal, cryptographic failures, feature-gate leaks, and protections disabled in production config. Use when reviewing for security, vulnerabilities, access control, or exploitable attack paths.

Authors, reviews, installs, and debugs GitHub Agentic Workflows in repositories, including workflow markdown, frontmatter, gh aw compile and run flows, safe outputs, security guardrails, and operational patterns. Use when creating or maintaining GH-AW automation. Don't use for standard deterministic GitHub Actions YAML, generic CI pipelines, or non-GitHub automation systems.

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.

Orient and bootstrap any project that uses OpenMed, the on-device clinical and biomedical NLP library, for named-entity recognition, PHI de-identification, FHIR export, and evaluation. Use when the user mentions OpenMed, wants to install it, asks which OpenMed capability or model fits a task, or is starting to build a clinical/medical text pipeline and needs the right entry point.

Scaffold a synthetic gold-standard annotation project for evaluating OpenMed NER and de-identification models — label schema, annotation guidelines, BRAT or Label Studio config, and disjoint train/dev/test splits. Use when the user wants to create eval fixtures, set up annotation, define a label set, write guidelines, configure an annotation tool, or build a held-out gold set for the OpenMed eval harness. Trigger on "gold corpus", "annotation project", "label schema", "annotation guidelines", "BRAT", "Label Studio", "train dev test split", or "build eval fixtures" for OpenMed. Committed gold must be synthetic; licensed (i2b2/n2c2/MIMIC) data is eval-only and never committed.

Migrate a .NET 8 project to .NET 9 and resolve all breaking changes. USE FOR: upgrading TargetFramework from net8.0 to net9.0, fixing build errors after updating the .NET 9 SDK, resolving behavioral changes in .NET 9 / C# 13 / ASP.NET Core 9 / EF Core 9, replacing BinaryFormatter (now always throws), resolving SYSLIB0054-SYSLIB0057, adapting to params span overload resolution, fixing C# 13 compiler changes, updating HttpClientFactory for SocketsHttpHandler, and resolving EF Core 9 migration/Cosmos DB changes. DO NOT USE FOR: .NET Framework migrations, upgrading from .NET 7 or earlier, greenfield .NET 9 projects, or cosmetic modernization unrelated to the upgrade.

Generate a rich GitHub PR description with dashboard/web-UI screenshots and scrolling animations captured from a running dev server, hosted as a GitHub gist, and pushed to the PR via `gh pr edit`. Use this skill whenever the user asks to "make a PR description with screenshots", "write up a PR with visuals", "add screenshots to my PR", "PR description with GIFs / demo / scroll animations", or anything involving turning a code PR into a visual-heavy writeup. Also triggers on phrases like "ship a PR writeup", "PR body with light and dark mode screenshots", "visual PR review", "generate PR body from dev server". The core value is the parallel capture pipeline — multiple browser sessions running concurrently to produce theme/viewport matrix screenshots in roughly the wall-clock time of a single pass.

Run Rust fmt, clippy, and unit tests. Use after making Rust code changes.

Review Renovate bot PRs that update GitHub Actions dependencies. Verifies supply chain integrity by checking pinned commit SHAs against upstream tagged releases, reviews changelogs for breaking changes, and confirms compatibility with existing workflow configurations. Use when a Renovate PR updates GitHub Actions in .github/workflows/.

Migrates Next.js projects to vinext (Vite-based Next.js reimplementation). Load when asked to migrate, convert, or switch from Next.js to vinext. Handles compatibility scanning, package replacement, Vite config generation, ESM conversion, and deployment setup (Cloudflare Workers natively, other platforms via Nitro).

Create and maintain a Markdown knowledge base that any AI agent can read, search, and update. Use when the user wants to start a knowledge base, add or update notes, organize docs/notes for an agent or LLM to consume, build an index of notes, or run a cleanup/maintenance pass on an existing MD knowledge base. Triggers include "knowledge base", "KB", "notes for the agent", "index of notes", "second brain", "docs for AI context", "add a note", "update the KB".

Deeper risk assessment for a single feature or product area when the launch review found something that needs more than a line item. Structured analysis: what could go wrong, how likely, how bad, what mitigates it. Use when user says "deep dive on this risk", "risk assessment for [feature]", "what could go wrong with", or when launch-review flags a novel issue.