AST-based code search, lint, and rewrite using ast-grep. Use when finding code patterns structurally (not textually), writing lint rules, building codemods, or migrating API usage across a codebase. Prefer over regex grep when the match target is a syntactic construct (function call, import, class field, assignment).

Answer questions about the Zod schema validation library and help build schemas, parsers, refinements, transforms, codecs, and error formatters. Use when developers: (1) ask about Zod APIs like `z.object`, `z.string`, `z.array`, `z.union`, `z.discriminatedUnion`, `parse`, `safeParse`, `z.infer`; (2) define request/response/form schemas in TypeScript; (3) handle `ZodError` or customize error messages; (4) migrate between Zod v3 and v4 (entry-point split, `formatError` → `treeifyError`/`prettifyError`, unified `error` param replacing `message`/`errorMap`). Triggers on: "zod", "z.object", "z.string", "z.array", "z.union", "z.infer", "z.input", "z.output", "ZodError", "$ZodError", "safeParse", "parseAsync", "z.codec", "treeifyError", "prettifyError", "flattenError", "discriminatedUnion", "zod/v4", "zod/v3", "zod/mini", "z.coerce", "superRefine".

Answer questions about better-auth and help build authentication features. Use when developers: (1) ask about better-auth APIs like `betterAuth`, `auth.api.*`, `authClient.*`; (2) wire up sign-in / sign-up / sessions; (3) integrate framework adapters (Next.js, Nuxt, SvelteKit, Hono, Astro, Bun, Express); (4) add plugins (organization, two-factor, magic-link, passkey, oauth-proxy); (5) configure DB adapters (Prisma, Drizzle, Kysely, Mongoose). Triggers on: "better-auth", "betterAuth", "authClient", "sign in flow", "auth session", "social login", "magic link", "passkey", "organization plugin".

Use when creating or editing Nullstone IaC YAML files under `.nullstone/` — adding or wiring apps, datastores, networks, domains, subdomains, ingresses, clusters, cluster-namespaces; setting `vars`, `environment`, `connections`, or `capabilities`; configuring `events`. Triggers on file paths `.nullstone/config.yml`, `.nullstone/{env}.yml`, `.nullstone/previews.yml`, and anything under `.nullstone/stacks/{stack}/`.

Install, uninstall, or list tessl skill tiles for installed mks plugins. Use this when asked to "install the tile for an mks plugin", "uninstall the tile for an mks plugin", "list tiles for an mks plugin", "tessl install PLUGIN", "tessl uninstall PLUGIN", or "tessl list". This skill is only for the mks CLI — not for any other plugin system.

Manage the mks CLI and its plugins. Use this when installing, listing, updating, or removing skills plugins (e.g., "install cherry-pick-filter plugin", "list installed plugins", "update plugins").

Sync a working branch to a clean merge branch by cherry-picking commits that don't touch filtered paths. Use this script only when syncing branches to beta/main during PR preparation or updates (e.g., "sync to beta", "cherry-pick to beta", "update PR branch").

Use this skill when the user asks to retrieve online book metadata, list editions, identify authors and publishers, find publication details, surface subjects, display cover image URLs, or cite Open Library source URLs by ISBN, title, author, or broad book query. This skill uses Open Library for read-only public book metadata. Do not use this skill for ebook downloads, shopping links, review aggregation, broad reading recommendations, metadata editing, or claims about any user's personal collection.

Creates, debugs, and optimizes GitHub Actions workflow YAML files. Recommends current action versions with SHA pinning from a daily-updated index of 260+ actions. Configures matrix builds, dependency caching, reusable workflows, OIDC authentication, secrets management, and runner selection. Includes a workflow-analyzer agent for reviewing existing workflows. Use when the user asks about GitHub Actions, workflows, CI/CD, .github/workflows, any action by name (actions/checkout, setup-node, setup-python, etc.), or workflow analysis.

Optimizes RLS policies by enforcing SELECT-wrapped auth.uid() calls, mandatory B-Tree/GIN indexes on policy-referenced columns, and SECURITY DEFINER encapsulation of deep JOINs. Use when optimizing RLS performance, fixing policy full table scans, wrapping auth.uid in SELECT, or indexing columns used in RLS policies.

Configures pgsodium Vault extension for API key and secret storage. Creates SECURITY DEFINER functions assigned to service_role for secure access. Eliminates hardcoded secrets. Use when storing API keys, managing secrets in Supabase, implementing pgsodium Vault, or replacing hardcoded credentials with Vault references.

Creates PL/pgSQL RPC implementing Reciprocal Rank Fusion (score = 1/(k+rank)) to fuse semantic pgvector results with full-text tsvector results. Use when implementing hybrid search, RRF search, semantic plus keyword search, exact SKU and conceptual queries, or vector and full-text fusion.

Configures TUS resumable upload client for files over 6MB with Postgres Advisory Lock 409 Conflict handling. Enforces tenant-scoped bucket paths. Use when implementing large file uploads, resumable uploads, TUS protocol, uploads over unstable networks, or files larger than 6MB in Supabase Storage.

Creates RLS policies enforcing tenant_id isolation on shared-schema tables. Verifies ALTER TABLE ENABLE ROW LEVEL SECURITY before policy creation. Requires tenant_id column and custom-access-token-hook JWT claims. Use when implementing multi-tenant data isolation, tenant-safe queries, shared schema RLS, or tenant_id policy creation.

Inspects database health by analyzing slow queries, identifying bottlenecks, and checking Postgres performance indicators. Use when diagnosing database issues, checking slow queries, inspecting DB health, finding performance bottlenecks, or troubleshooting Supabase Postgres problems.

Configures pgvector HNSW indexes with correct distance operators. Enforces inner product operator for normalized embeddings instead of cosine distance. Use when setting up vector search, creating embedding indexes, configuring semantic search, or choosing between HNSW and IVFFlat index types.

Generates code verifier/challenge pairs, exchanges authorization codes for sessions, sets secure HTTP-only session cookies, and configures server-side callback handling to implement the Proof Key for Code Exchange auth flow. Replaces implicit token-in-fragment flows by removing hash-based token extraction and localStorage usage. Use when implementing Supabase authentication, OAuth login, secure browser auth, SSR auth setup, or modern auth flow migration.

Build, customize, and deploy Ghost CMS themes. Use whenever the user mentions Ghost themes, Ghost CMS, Handlebars templates (.hbs), Ghost Admin, membership/subscription integration, custom settings, or the content API — even without saying "theme". Trigger on: building a blog theme, creating a Ghost site, editing .hbs templates, member-only content, hero sections, routing (routes.yaml), image optimization, dark mode, search, deploy, gscan validation, JSON-LD/SEO, or any mention of {{ghost_head}}, {{ghost_foot}}, {{#foreach}}, {{#get}}, {{img_url}}, {{asset}}, @custom, @member, or Portal. Also use to modify, extend, or debug an existing theme. Also trigger on Koenig editor cards and .kg-* card styling (kg-image-card, kg-gallery-card, kg-bookmark-card, kg-callout-card, kg-toggle-card, kg-header-card, kg-signup-card), card_assets, cards.min.css, and breakout/wide/full-width card layout.

Use when building joi schemas, validating input data, defining custom types, conditional validation with .when(), cross-field references, custom error messages, or writing joi extensions. Standalone package that integrates with the hapijs ecosystem.

Diagnoses and optimizes SQL Server database performance. Use when diagnosing slow T-SQL queries, tuning indexes, reading execution plans, fixing parameter sniffing, optimizing batch operations, reducing transaction log bloat, troubleshooting locking and blocking, configuring tempdb, or when a query that used to be fast is now slow. Also use when writing high-throughput INSERT/UPDATE/DELETE operations, implementing minimal logging, designing covering indexes, or analyzing wait statistics.