Queries the data warehouse with SQL and answers business questions about data. Use when answering anything that needs warehouse data - counts, metrics, trends, aggregations, joins across tables, data lookups, or ad-hoc SQL analysis (for example "who uses X", "how many Y", "show me Z", "find customers", "what is the count").

Build a custom React component in the bestax/Bulma style. In an app using @allxsmith/bestax-bulma — compose existing components, helper props, public hooks (useBulmaClasses, usePrefixedClassNames), and --bulma-* CSS variables. In the bestax monorepo — the full component pipeline (SCSS partial, stories, tests, docs, wiring). Use when creating a component beyond stock Bulma or extending one.

Review a code change for frontend timing and lifecycle bugs, including listeners, timers, observers and async work that outlive their component, missing effect cleanup, Turbo/Stimulus/React lifecycle mistakes, overlapping interactions, and stale promise or animation work. Use when reviewing frontend code for race conditions, cleanup, or UI state consistency.

Prepare ready-to-review application packets (tailored CV, cover letter, screening answers) for new job matches and add them to the application queue. Use when asked to prepare, draft or queue applications for jobs found by job-finder, or for a specific job description file.

Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains. Use for NZISM control guidance, gap analysis, agency security obligations, classification framework (Unclassified through Top Secret), security risk management, system certification, and GCSB/NCSC NZ compliance. Triggers on: NZISM controls, NZ government security, GCSB compliance, agency cybersecurity obligations, NZ classification markings, Restricted/Confidential/Secret system scoping, agency security policies, third-party supplier security, Certification and Accreditation (C&A), and any question about NZ government information security requirements or the NZISM framework.

Expert ISO 42001 AI Management System (AIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 42001:2023, AI governance, AI management systems, AI risk assessment, AI system impact assessment, Annex A controls for AI, Statement of Applicability for AI systems, AI policy, responsible AI, AI lifecycle management, AI incident management, AI transparency, AI bias, AI certification readiness, or any topic related to implementing or auditing an AI Management System. Also trigger for questions like "how do I become ISO 42001 certified?", "what controls does ISO 42001 require?", "how do I assess AI risk under 42001?", "what is an AIMS?", or any request involving organisational governance of AI systems, responsible AI frameworks, or AI regulatory compliance aligned to an ISO standard.

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk management, Register of Information, contractual provisions with ICT providers, ICT concentration risk, oversight of critical ICT third-party service providers (CTPPs), or any DORA RTS/ITS obligation. Also trigger for: "DORA gap analysis", "DORA readiness", "Art. 6 ICT risk framework", "Art. 17 incident reporting", "Art. 26 TLPT", "Art. 28 third-party policy", "Art. 30 contractual provisions", "Register of Information CIR 2024/2956", "critical TPSP designation", "DORA vs NIS2", "DORA simplified framework", or EBA/ESMA/EIOPA digital resilience guidance.

Show real token usage and estimated savings for the current session. Reads directly from the Claude Code session log — no AI estimation. Triggers on /caveman-stats. Output is injected by the mode-tracker hook; the model itself does not compute the numbers.

UK self-employed (sole trader) tax rules for this invoicing app - income tax bands, personal allowance taper, Class 2/4 NIC, cash basis, payments on account, more than one trade, trading allowance, Making Tax Digital, invoice content. Use before changing anything under src/utils/taxCalculator.ts, the Dashboard or Accounting pages, expense handling, or PDF invoice content, and when writing or reviewing tax tests.

Diagnose and resolve RevenueCat integration issues — inspects dashboard configuration through the RevenueCat MCP, walks the SDK debug logs, and covers code-side gotchas. Use when the user says offerings are empty, products not loading, entitlement not active after purchase, paywall won't load, transactions not appearing, customer info shows no entitlements, sandbox purchase not working, an SDK-gated RevenueCat feature not working, or RevenueCat is broken on iOS, Android, Kotlin Multiplatform, Flutter, or React Native. Also use when asked to check or validate the store / product setup.

Picks the right Netlify site-protection layer and disambiguates the three unrelated "auth" concepts users conflate — app-user login (Netlify Identity), site-load gating (Password Protection / project visibility), and dashboard SAML SSO. Use it when asked to password-protect a site or Deploy Preview, make a project private/public, restrict a site to your team, require SSO to view a site, set up company-wide or internal-app SSO, invite users to a private project, or know which team member made a request to a private site. Also use it for SSO-session symptoms on protected sites: "logged out mid-session", 401s after about an hour, or token expiry/refresh questions. Not for wiring auth code — route app-login setup to netlify-identity.

Aha! integration. Manage data, records, and automate workflows. Use when the user wants to interact with Aha! data.

Design, build, document, and ship SDKs. Use when creating a client library, planning a breaking change, or reviewing SDK quality. It does not build a CLI (that's `devrel-tooling`) or an MCP server (that's `mcp-server-craft`).

Build MCP servers an agent can call. Use when designing tools, choosing stdio vs Streamable HTTP, or hardening an MCP server. It does not design a generic SDK (that's `sdk-craft`).

Build developer CLIs and API collections. Use when adding commands, completions, or generating a Postman collection from routes. It does not design the SDK API (that's `sdk-craft`).

Receive and verify Absorb LMS webhooks. Use when setting up an Absorb LMS webhook endpoint, verifying the absorb-signature header (HMAC-SHA256 of the raw body), debugging signature failures on Test Webhook requests, or handling events like UserCreated, CertificateAwarded and EnrollmentCompletedbyAdmin.

Receive and authenticate 100ms webhooks. Use when setting up a 100ms (live video) webhook endpoint, checking the secret header you configure in the 100ms dashboard, debugging 401s, or handling events like peer.join.success, peer.leave.success, session.open.success, session.close.success, recording.success and hls.started.success.

Add an SBOM Policy Enforcement (SscaEnforcement / CdSscaEnforcement) step to an existing Harness pipeline to verify SBOM attestations and apply OPA SBOM policy sets. Supports CI, Security, and CD (Deployment) including CI-only pipelines — if no Deploy stage exists, add one via Phase 3b (service, environment, infra, containerized step group) then place CdSscaEnforcement before deploy. Supports container images and repositories from Artifact Registry, Third-Party registries (docker, ECR, GCR, GAR, ACR), and Git. Matches Pipeline Studio SBOM Policy Enforcement UI. Only works with existing pipelines (may append a Deploy stage). Use when asked to enforce SBOM policies, add SBOM policy enforcement, verify SBOM attestation in pipeline, or block non-compliant components. Trigger phrases: enforce SBOM, SBOM policy enforcement, SBOM policy step, verify SBOM policy, SscaEnforcement, add policy enforcement after SBOM.