Creates .gitlab-ci.yml files, configures pipeline stages, defines CI jobs and runners, sets up deployment workflows, and generates reusable GitLab CI/CD templates following current best practices and security standards. Use when users ask to create or build a GitLab CI/CD pipeline, CI config, build pipeline, deploy pipeline, GitLab YAML, CI jobs, or any .gitlab-ci.yml configuration from scratch or for a new project.

Validates, lints, and secures Dockerfiles by running syntax checking, detecting security vulnerabilities, validating layer ordering, checking for hardcoded secrets, verifying base image tags, and analyzing build optimization. Use when validating Dockerfile syntax, checking security best practices, optimizing image builds, auditing container security, or debugging Dockerfile errors. Applies to all Dockerfile variants (Dockerfile, Dockerfile.prod, Dockerfile.dev, etc.).

Creates structured specifications, validates execution plans against specs, manages two-loop planning-to-execution workflows with decision gates, and captures provenance of AI-generated work. Use when building software with AI coding agents, when starting any non-trivial feature or change, when an agent keeps building the wrong thing, when you want repeatable and verifiable AI-assisted development, or when someone mentions spec-driven, SDD, specification first, or code is a side effect. Also use when the user wants to structure agent workflows, create specifications, establish decision gates between planning and execution, or capture provenance.

Query Google Analytics 4 (GA4) data via the Analytics Data API. Use when you need to pull website analytics like top pages, traffic sources, user counts, sessions, conversions, or any GA4 metrics/dimensions. Supports custom date ranges and filtering.

Semantic folder index for codebase navigation. Generates index.toon files with concise folder summaries ordered by importance, enabling fast LLM codebase traversal without reading every file. Commands: /toondex (create initial index), /redex (update with changes). Use when the user wants to index a codebase, understand project structure, map codebase folders, index project layout, navigate a large codebase, understand folder structure, or asks about /toondex or /redex commands.

Helps fix security vulnerabilities identified by DryRunSecurity. Activates when the user shares a DryRunSecurity comment (from a GitHub PR or GitLab MR) or asks for help fixing any security finding including SQL injection, XSS, CSRF, SSRF, path traversal, command injection, authentication bypass, authorization flaws, and prompt injection. Researches authoritative sources and applies fixes grounded in the user's specific codebase context.

Add or modify Adobe Commerce Admin UI extensions on the commerce/backend-ui/2 extension point: custom grid columns, mass actions, order view buttons, a custom Admin menu entry, and custom ACL resources. Use whenever the user wants to extend the Commerce Admin — add a column to the order, product, or customer grid, add a bulk/mass action to a grid, add a button to the order view page, add a custom menu item or page, or declare custom permissions the app checks itself — even when they don't name the extension point.

Scaffold or update an Adobe API Mesh configuration (mesh.json) in front of a Commerce app: add GraphQL/OpenAPI sources, extend an existing Commerce GraphQL type with a new field, and wire a cross-source resolver for it. Use when the user mentions API Mesh, mesh.json, extending a Commerce GraphQL type (e.g. adding a field to Order/CustomerOrder/Product), or stitching a runtime action's data into the storefront's GraphQL schema.

Manage custom business configuration in an Adobe Commerce app. Use when the user wants to add, modify, or remove merchant-configurable settings (config fields, admin config, store configuration) exposed through Commerce Admin. Creates typed config fields (text, password, email, url, tel, boolean, list) in businessConfig.schema. Requires a base app initialized with commerce-app-init.

Creates Drizzle ORM schema definitions and generated SQL migrations for PostgreSQL from the entity model. Use when the user asks to "create a migration", "generate SQL", "set up database tables", "update the schema", or mentions Drizzle, drizzle-kit, pg-core, schema.ts, or database versioning for a NestJS project.

Implements use cases across a NestJS backend with Drizzle ORM over PostgreSQL and a Next.js App Router frontend wired to that API. Use when the user asks to "implement a use case", "build the API", "create a REST endpoint", "write the data access layer", "build the page", or mentions NestJS modules, controllers, providers, Drizzle queries, repositories, or a Next.js frontend calling a NestJS backend.

Creates NestJS backend tests with Vitest — unit specs with stubbed repositories, and Supertest end-to-end specs that boot the application against a real PostgreSQL database in Testcontainers. Use when the user asks to "write backend tests", "test the API", "write an e2e test", "test the endpoint", or mentions Supertest, Testcontainers, NestJS testing, or Vitest for a NestJS project.

Use when the user asks to check, review, look at, or act on a pull request by number — "check PR 5", "review PR 12", "what's going on with PR 7", "look at this PR". Classifies the PR as same-repo or fork. Fork PRs are skipped by the policy reviewer's fork-guard; this skill offers to adopt the fork branch into the base repo as a same-repo PR the reviewer can run on, preserving the contributor's commits. Same-repo PRs pass straight through to the existing reviewer.

Resolve task-triggered coding-policy references, load their complete constraints, and identify required exception checks before the requested work. Use for "review this code", "write tests", "add a dependency", "change CI", "migrate state", "write a skill", "edit a rule" or "publish a plugin" when coding-policy governs the task. Read only the contracts named by applicable rule routers; this skill supplies policy context and grants no action authority.

Migrate a legacy tile.json plugin to the .tessl-plugin/plugin.json form. Runs `tessl plugin migrate`, renames .tileignore to .tesslignore, removes the obsolete tile.json, re-lints, then reconciles residual "tile" wording to "plugin" in the repo's prose. Use when a repo still has a tile.json (and no .tessl-plugin/plugin.json), or when the user asks to migrate / convert / modernize a tile.json plugin, move off tile.json, or adopt the plugin.json manifest form.