agent-skills

Use when asked what first impression a public brand or marketing site makes, why visitors come to it, whether the impression matches the intended positioning, or whether its calls to action work — "first impression test", "what does a visitor think in the first seconds", "persona test of the site", "does the site match our positioning", "do the CTAs work", "brand check across our sites". Runs blind persona subagents on screenshots of the first screen without scrolling, a brand-name-only test, a measured call-to-action check and a comparison with the written norm. Report only, changes no site. Not for a full site revision (use a site-revision skill), not for rewriting copy (use a copywriting skill), not for performance or accessibility audits.

Use when auditing, reviewing or tightening an existing CI pipeline (e.g. Woodpecker, GitHub Actions, GitLab CI), when a secret scan or other gate logs 0 items or has no self-test or must-fail proof, when guarding the pipeline file itself with a test, when pipeline or gate files are protected or operator-signed, or when asked to make CI "stricter", "more reliable" or "trustworthy" — checks that every gate really verifies something (non-zero counts in the log, a must-fail proof), covers every file, runs at a strict level, and is pinned and ratcheted. Also use when a gate has been green for a long time without ever catching anything. Not for setting up a new pipeline or closing local/CI drift — that is ci-local-parity.

Use when setting up a project's CI pipeline together with local verification, or auditing or repairing local/CI parity — ensures the local verify command covers everything CI checks, adds pre-commit/pre-push hooks that enforce this, and keeps trunk-based development honest (small commits, frequent pushes, CI checked per push). Load before creating or changing a CI pipeline file, before adding a quality gate (coverage, static analysis, security scan), and whenever a CI gate fails that local checks passed — including a single failing coverage or quality gate, not only a full pipeline setup.

Use when you need to check browser-specific CSS/layout/JS rendering differences (Chromium/Firefox/WebKit) before shipping a CSS/JS change or investigating compatibility issues across engines. NOT for viewport/breakpoint layout review (use responsive-visual-review), NOT for functional/interaction E2E testing across browsers (use playwright-testing), NOT for designing a polyfill/feature-detection fix.

Use when load-testing a site's or API's critical endpoints — the "performance budget test" NFR checklists ask for but a Lighthouse-only audit never exercises, since Lighthouse simulates exactly one user. Works on any HTTP-reachable site or API (k6 by default, Artillery as alternative). Trigger on "load test this", "how does this hold up under traffic", "stress test the API", "set up performance budget tests", or when an NFR audit flags load-testing as unverified. NOT for browser-rendering performance (use nfr-gap-audit's baseline or production-cwv-review). NOT against production without explicit, scoped authorization — real load has real cost and risk; always confirm target, intensity, and time window first, and prefer staging when available.

Use when running a systematic, self-directed skill-and-NFR audit on a website/web-app project, covering non-functional-requirement domains (performance, accessibility, security, SEO, testing, privacy, i18n, ...). Trigger on "skill audit", "NFR audit", "audit this project for skills/gaps", "what skills am I missing", or before starting a multi-phase quality-improvement effort on a site.

Use when comparing real-user field performance data (CrUX/RUM) against lab Lighthouse data to find divergences where pages score well in the lab but are slow for real users. NOT a replacement for the Lighthouse/lab baseline, NOT for setting up RUM/analytics from scratch, NOT for synthetic load/stress testing.

Use when you need a structural visual review of a website across breakpoints (mobile/tablet/desktop) to catch layout breaks, overflow, and spacing issues without a baseline or hosted regression service. NOT for CRO/conversion/copy review, NOT for new UI design work, NOT for automated pixel-diff regression gating in CI, NOT for accessibility/contrast auditing.

Use when asked to review the whole codebase of a website or web app AND fix what is found, end to end. Works on any stack and hosting type (traditional web host, static host/CDN, app platform, containers). Trigger on "review the whole site and fix everything", "full code review and remediation", "audit and fix this website", or when the requested end state is "every fix validated live". NOT for reviewing a single diff/PR (use a code-review skill), NOT for a gap inventory without fixing (use an NFR/gap-audit skill), NOT for visual-only or conversion-only reviews (use a visual or landing-page review skill).

Use when asked for a full revision of an existing marketing or practitioner website — positioning, content, proof, bilingual parity, technical quality and CI — with every change validated on the live site. Orchestrates the whole run from customer evidence and jobs to be done (requests, won and lost proposals, feedback) and a positioning decision through a baseline persona walkthrough, work packages in customer language, a fact-and-quote verification gate, a live feedback loop with the owner, a follow-up persona walkthrough, a technical review and a final all-URL check with retrospective. Trigger on "full revision of the website", "website overhaul", "site refresh", "reposition and rewrite the site", "content and technical review, everything validated live", or when the owner reviews on the live site and wants feedback batched into pushes. NOT for a code-only review-and-fix (use a code review-and-remediation skill), NOT for a gap inventory without changes (use an NFR/gap-audit skill), NOT for a single page's copy (use a copy-editing skill).

Use when <the situations and phrases that should load this skill, in the user's words>. <One sentence on what it does and what it checks.> Not for <neighbouring task> (use <other skill>).

Use when auditing third-party scripts, resources (analytics, fonts, chat widgets), and their data access — checking SRI coverage, CSP allowlist alignment, and vendor data leakage risks. NOT a full penetration test or server-side dependency-vulnerability scan, NOT a standalone GDPR/consent-banner completeness check.

Use when reviewing actual translation quality (correctness, naturalness, consistency) for multi-language sites — checking for literal phrasing, broken placeholders, untranslated leftovers, and terminology drift. NOT a substitute for professional translator sign-off on launch-critical copy, NOT a key-parity check.