Use when a named framework (GDPR, CCPA, SOC 2, HIPAA, PCI DSS, ISO 27001) and existing evidence need a per-criterion readiness score before an audit, assessor visit or regulator inquiry. Marks each criterion met, partial or not met, records approved exclusions and never claims ready with a gap.

Use when one test must reproduce a failure that spans HTTP and network layers, such as an incident nobody can recreate with HTTP stubs or TCP chaos alone. Combines WireMock fault stubs (500s, bad JSON, slow replies) with Toxiproxy (latency, loss, resets) and checks the app's resilience.

Use when scoping a chaos engineering experiment before running it: a steady-state hypothesis, real-world faults (latency, node or region failure), blast radius, automation and the verdict, with a five-check validation of the hypothesis and LitmusChaos and Gremlin setup. Chaos Mesh has its own skill.

Use whenever a user saw another user's or tenant's data, or a per-user response goes through a shared cache, Redis or a CDN, or a cache key is designed or changed. Checks the key holds every value the response depends on (tenant, user, scope, locale), writes the fixed key, Vary header and tests.

Use whenever code that sends or receives AWS SQS messages needs tests: Standard vs FIFO semantics, visibility timeouts, dead-letter queues for poison messages and retention, using LocalStack, aws-sdk-client-mock for TypeScript or moto for Python.

Use whenever pages or components need automated accessibility scanning: axe-core via axe.run(), @axe-core/playwright or the CLI on every PR, rule configuration and CI-gateable results, plus pa11y, Lighthouse CI accessibility, WAVE and IBM Equal Access (Section 508) in its references.

Run an iterative code-review loop: a review workflow scores the diff by severity, Claude fixes the issues at the chosen strictness, commits, then re-reviews — looping until the review comes back clean. Configurable at invocation: a model ladder (recommended Sonnet → Opus; also sonnet, opus, or a custom models= list), a strictness set of severities to enforce (default critical+major+minor; e.g. strictness=critical,major), and a per-tier round cap (rounds=3/5/10 or until-fixed). Asks if unspecified. Project-agnostic; any git repo. Use when the user asks to review-and-fix in a loop, do a feedback pass, or "keep reviewing until clean".

Max's house writing style and grammar for any prose you generate for him - docs, READMEs, PR descriptions, commit messages, Slack, emails, code comments, error messages, blog posts, and replies in chat. Use this whenever you are writing or editing English prose meant for Max or sent on his behalf, even when he doesn't explicitly ask for a particular style. Apply it by default to anything wordier than a one-line answer; favour warm-but-blunt, concise writing, US English, sentence case, the Oxford comma, and zero AI jargon. Do not use it for code itself, config, or data formats.

Use the Agent Ready (agent-ready.dev) command-line client to scan any public URL for AI agent-readability against the Vercel Agent Readability Spec, the llmstxt.org standard, and agent-protocol manifests (MCP server cards, A2A, agents.json, agent-permissions.json, UCP, x402, NLWeb). Activates for "scan this site with the agent-ready CLI", "run agent-ready scan {URL} in the terminal", "agent-ready get {id}", "agent-ready list", "agent-ready ask {question}", or any time the user wants a one-command terminal scan with no fetch wiring and no MCP install. Pick this skill when the agent can run shell commands. For raw HTTP, use the `agent-ready-api` skill; for MCP-native tool calls, use `agent-ready-mcp`.

Use when the user asks about Don Syme's DevCon session, conference talk, or presentation — including questions about the session title, speaker, date, or any F#/.NET topics covered. Provides metadata for this talk (title: "DevCon session Don Syme", speaker: Don Syme, date: 2026-05-31) but cannot answer substantive content questions because no transcript was captured. If the user asks what was said, argued, or demonstrated in the session, explain that the transcript body is empty and only the title, speaker name, and date are available.

Answer questions about better-auth and help build authentication features. Use when developers: (1) ask about better-auth APIs like `betterAuth`, `auth.api.*`, `authClient.*`; (2) wire up sign-in / sign-up / sessions; (3) integrate framework adapters (Next.js, Nuxt, SvelteKit, Hono, Astro, Bun, Express); (4) add plugins (organization, two-factor, magic-link, passkey, oauth-proxy); (5) configure DB adapters (Prisma, Drizzle, Kysely, Mongoose). Triggers on: "better-auth", "betterAuth", "authClient", "sign in flow", "auth session", "social login", "magic link", "passkey", "organization plugin".

Native Google Calendar and Tasks reads over the OneCLI gateway, for trusted-tier ground-truth verification. Gmail is intentionally excluded. Use when a trusted agent must verify a calendar event or a task/todo status, or otherwise read the owner's Calendar or Tasks.

Quick read-only health check — session context, workspace mounts, tool availability, and task snapshot. Use when the user asks for system status, health check, diagnostics, system info, check environment, what tools are available, or runs /status.

Read-only system-status probe for trusted-tier NanoClaw containers — surfaces stuck scheduled tasks, DB size, and recent task-run failures from the orchestrator's SQLite at `/workspace/store/messages.db`. Use as part of heartbeat or standalone. Triggers on "system status", "check tasks", "stuck tasks", "database size", "task failures".

Generate Playwright integration tests for Vaadin 25 views using the DramaFinder library, including element interaction, form validation, grid assertions, and navigation checks. Use whenever you are about to write, edit, or run an integration/IT test for a Vaadin view — including when the requirement comes from a GitHub issue, PR, spec, or ticket rather than the user's direct words (e.g. "implement

Pin session decisions, questions, objections, scope constraints, and corrections to a persistent board that survives context compaction. Use PROACTIVELY when: (1) user approves/rejects a recommendation, (2) user asks a clarifying question about a proposal, (3) user states a scope constraint, (4) user corrects a misunderstanding. Also use when user says pin, track this, mark as approved, board, show pins. Auto-invoke without user asking whenever a decision, question, or constraint is detected.

Comprehensive toolkit for validating, linting, testing, and automating Terragrunt configurations, HCL files, and Stacks. Use this skill when working with Terragrunt files (.hcl, terragrunt.hcl, terragrunt.stack.hcl), validating infrastructure-as-code, debugging Terragrunt configurations, performing dry-run testing with terragrunt plan, working with Terragrunt Stacks, or working with custom providers and modules.

Integrate Biome into Nx monorepos with deterministic setup, caching, migration from ESLint and Prettier, and plugin-based inferred tasks; use when adding Biome, replacing ESLint/Prettier, tuning cache inputs, or scaling lint and format workflows across projects.

Write and revise developer blog posts, and humanize existing drafts using the AI anti-pattern catalog, structural checks, and author voice calibration. Use when asked for a "humanizer", "humanization pass", "humanisation pass", "humanize this", "humanise this", "de-AI this", "remove AI slop", "remove AI tells", "anti-AI pass", "make this sound less AI-generated", "less robotic", or "more natural" in a writing or editing request, even when the user does not mention a blog. Also use for writing a blog post, revising blog content, turning a video transcript, meeting notes, or rough ideas into a blog, and continuing a blog series. Preserve the author's meaning, technical accuracy, and voice while identifying and rewriting formulaic prose.

Write, rewrite, or review a conference talk abstract and its notes for the program committee. Use when asked to "write a CFP abstract", "fix my abstract", "submit this talk", "write the talk proposal", "notes for the program committee", "shorten the abstract", "make the abstract less AI", or when a conference submission form, session description, or talk pitch is the artifact being edited. Also use when adapting a delivered talk into a new submission, or turning a talk idea into a proposal. Not for blog posts, which belong to the blog-writer skill.

Create, update, or audit a reusable corporate writing identity from brand and style guides, tone-of-voice guidance, corporate skills, published content, product messaging, examples, or editorial feedback. Use whenever someone wants to define, capture, refresh, or check a company voice, house style, corporate tone, audience, terminology, evidence, positioning, or editorial constraints without prescribing an individual author's personality.

Fetches and validates current third-party API documentation, checks SDK version compatibility, and verifies correct method signatures and parameter shapes before writing or debugging integration code. Use when writing, editing, or refactoring code that calls any third-party SDK, API, or library method; debugging issues where an API call succeeds but the expected side-effect doesn't happen; installing or importing external packages; or when something 'doesn't work' and the code involves an external service.