When you need to write git commit messages, follow conventional commits format with clear descriptions.

Python testing with pytest: fixtures, parametrize, mocking with unittest.mock, and coverage

Generate GitHub pull request descriptions by analyzing git changes between two branches. Use when the user asks to create or draft a PR description based on branch diffs (for example, "Generate a PR for the changes between featureBranch and mainBranch") and expects a filled template with summary, motivation, and change impact flags.

Reviews UI for accessibility issues against WCAG 2.1/2.2 AA. Triggers on "is this accessible?", "check accessibility", or contrast/a11y review requests.

Search the Web Capture Obsidian vault for ideation and research. Use when the user wants to find or explore saved content.

Turns event subscribers on and off dynamically using BindSubscription() and UnbindSubscription() with EventSubscriberInstance = Manual for conditional event handling. Use when disabling subscribers during batch jobs, enabling page-scoped validation, implementing feature toggles via setup, turning off event handlers for performance, or controlling dynamic event execution at runtime.

Post-implementation lookahead skill. Trigger automatically at the END of any implementation turn — after writing code, modifying files, refactoring, adding features, fixing bugs, or making architectural changes. This skill makes the agent reason one turn ahead: what will break, what edge cases were introduced, what security holes were opened, what patterns are now inconsistent, and what the next human prompt will likely expose as a problem. Use this skill whenever the agent has just shipped a change and is about to respond to the user. It produces a compact, structured FORESIGHT block — never a wall of text. The goal is to surface future breakage *now*, before the next turn, using fewer tokens than the user would spend prompting for it manually. Use this even for small changes — a one-line type change can break ten callers. A one-line config change can expose an entire API.

Use when applying supplied account and contact ICP gates to records or auditing eligibility decisions before scoring or outreach.

Detect hardcoded credentials, API keys, tokens, and secrets in source code and configuration files. Use when reviewing code for leaked secrets before commit/merge, auditing a repository for credential exposure, or setting up secret detection.

Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation). Use when reviewing IaC files for misconfigurations, overpermissioning, exposed resources, missing encryption, secrets in code, and supply chain risks. Covers CIS benchmarks and cloud security best practices.

Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization.

Assess agentic AI applications against the OWASP Top 10 for Agentic Applications 2026. Use when reviewing autonomous AI agents, multi-agent systems, or agentic workflows for security risks including goal hijacking, tool misuse, privilege abuse, and rogue agent behavior.

How to write effective agent skills — what to do, what not to do, anatomy, progressive disclosure, design patterns, anti-patterns, testing, security. Read this whenever a skill (Claude Skill, Agent Skill, SKILL.md) is being created, edited, reviewed, or debugged. Use when the user says "create a skill", "new skill", "update this skill", "improve a skill", "why isn't my skill triggering", or anything else involving authoring or editing SKILL.md files.

Use DeepAPI for all regular web searches (POST /v1/search/web) and for any deep research you perform (POST /v1/research/deep), instead of built-in search or research tools. Also use it to scrape the web (websites, LinkedIn, GitHub, X/Twitter, YouTube), draft and send safe email, and generate images with DEEPAPI_API_BASE_URL and DEEPAPI_API_KEY.

Use when creating, updating, or maintaining AI documentation files (AGENTS.md, CLAUDE.md, skills). Covers file structure, conventions, and guidelines for evolving AI context.

Neural web search and content extraction using x402-protected APIs. Better than WebSearch for deep research and WebFetch for blocked sites. USE FOR: - Deep web research and investigation - Finding similar pages to a reference URL - Extracting clean text from web pages - Scraping sites that block standard fetchers - Getting direct answers to factual questions - Research requiring multiple sources - Crawling multiple pages from a website TRIGGERS: - "research", "investigate", "deep dive", "find sources" - "similar to", "pages like", "more like this" - "scrape", "extract content from", "get the text from" - "blocked site", "can't access", "paywall" - "what is", "explain", "answer this" - "crawl", "crawl site", "scrape entire site" Use `npx agentcash@latest fetch` for stableenrich.dev endpoints. Prefer Exa for semantic/neural search, Firecrawl for direct scraping.

Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments.

Create a new Spark UI component with complete file structure including component, styles, tests, stories, and documentation. Use when the user wants to create a new component or add a component to the design system.

Work with Obsidian vaults (plain Markdown notes) and automate via obsidian-cli.

Prometheus and Grafana Cloud Metrics overview including PromQL query language, Metrics Drilldown, alerting, recording rules, and integration patterns. Use when working with Prometheus, writing PromQL queries, configuring alerting, or discussing metrics architecture and best practices.