Build Weavr integration flows using Secure UI and the API. Covers tokenized capture and display, corporate and consumer onboarding, KYB pre-population, and choosing web or mobile components. Use when designing a Weavr integration across UI and backend.

Answers questions about the Weavr API, including managed accounts, cards, transactions, and authentication. Use whenever a developer asks how to integrate with Weavr, make API calls, handle errors, or understand request/response formats.

通用研究协议与质量守则。任何领域的研究任务(学科、金融、知识探索)都应当遵循本技能定义的流水线——问题拆解、多源检索、证据分级、交叉验证、引用核验、结构化成稿与知识库沉淀。用于保证研究质量、降低幻觉风险。

Applies this repository's skill-authoring standard as a procedure. Use for any change to, or judgment about, a file under skills/** — a SKILL.md, a reference, a persona prompt, a bundled script's instructions: creating a skill, editing one, reviewing a skill change, or acting on review feedback (human or bot) about one. Not for src/, tests/, or scripts/ code.

Resolve PR review feedback. Use when addressing feedback already left on a PR. Not for reviewing the code before feedback exists; that is ce-code-review.

Polish a working feature through user-directed live browser feedback. Use when a functional feature needs focused UX refinement before shipping.

Create professional diagrams with configurable dark/light theme via CSS custom properties. Use this skill whenever the user asks for any kind of technical or conceptual diagram, visualization of a system, process flow, data flow, component relationship, network topology, decision tree, org chart, state machine, or any visual representation of structure/logic/process. Also trigger when the user says "画个图" "画一个架构图" "diagram" "flowchart" "sequence diagram" "draw me a ..." or uploads content and asks to visualize it. Outputs a dark-theme SVG, a light-theme SVG, and a @2x PNG of each.

Connects Figma design components to code components using Code Connect mapping tools. Use when user says "code connect", "connect this component to code", "map this component", "link component to code", "create code connect mapping", or wants to establish mappings between Figma designs and code implementations. For canvas writes via `use_figma`, use `figma-use`.

Expert guidance for developing with the tinystruct Java framework. Use when working on the tinystruct codebase or any project built on tinystruct — including generating the bin/dispatcher and bin/dispatcher.cmd launcher scripts when a project lacks them, creating Application classes, @Action-mapped routes, unit tests, ActionRegistry, HTTP/CLI dual-mode handling, the built-in HTTP server, the event system, JSON with Builder/Builders, database persistence with AbstractData, POJO generation, Server-Sent Events (SSE), file uploads, and outbound HTTP networking.

Write articles, guides, blog posts, tutorials, newsletter issues, and other long-form content in a distinctive voice derived from supplied examples or brand guidance. Use when the user wants polished written content longer than a paragraph, especially when voice consistency, structure, and credibility matter.

Adversarial pre-mortem of a plan, code change, or bug diagnosis — cited findings over a fixed failure taxonomy plus a mandatory steelman; never scores or fixes, one pass per run. Modes plan (default), code, analysis; `deep` runs 3–5 parallel persona lenses; triggers on "critical", "challenge this", "pre-mortem", "red-team this", "deep critical review", "review from every angle", "/critical".

Reviews and guides LLM/AI application engineering — prompts, caching, RAG, agent loops and tools, resilience, model migration, evals, prompt-injection defence, and observability. Invoke with /ai-engineering for "review my prompt", "set up RAG", or "write evals".

Agent-first React state management. Use when: project has stackpack-state as dependency, user asks to manage state or create stores, user mentions Together/Separate/When/Gate/Presence patterns, user migrates from useState/Redux/Zustand/Jotai/XState. Read skill/skill.md for patterns, skill/api-reference.md for full API.

Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.

Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.

Suggest the matching Convex component when the user hand-rolls a pattern it already solves (crons, sharded-counter, rate-limiter, storage, search, presence, workflow, RAG, prosemirror-sync). Passive — suggest after the task, never interrupt. Never install without consent.

Point a domain you already own at your Convex app (DNS records, custom-domain attach, auth-origin rebind).

Share markdown and text as clean, readable web links via plsreadme.com. Use when someone asks to share a document, README, PRD, notes, or any content as a shareable link. Also handles updating and deleting previously shared docs. Triggers for "create a preview link", "share this as a page", "update that shared doc", or "delete that link".

Suggest the matching Convex component when the user hand-rolls a pattern it already solves (crons, sharded-counter, rate-limiter, storage, search, presence, workflow, RAG, prosemirror-sync). Passive — suggest after the task, never interrupt. Never install without consent.

Point a domain you already own at your Convex app (DNS records, custom-domain attach, auth-origin rebind).