Agent Harness Architect
Design or review the operational harness around single-agent, multi-agent, and tool-using AI systems. Use when building agent platforms, routing layers, tool interfaces, memory systems, evaluation harnesses, human checkpoints, permission boundaries, cost controls, or agent-computer interfaces that must remain observable, testable, and safe under real project work.
Container Platforms
Use for Docker, BuildKit, Podman, Compose, OCI image builds, runtime behavior, registries, multi-stage Dockerfiles, image optimization, healthchecks, non-root execution, supply chain safety, and container troubleshooting.
I18n Localization
Set up and operate the localization pipeline for any product: source-string extraction, translation memory, locale matrix selection, RTL/CJK support, plural rules, ICU MessageFormat, cultural adaptation, voice-over recording where relevant, locale-specific QA, and store-listing translation. Produces locale plan, string-table source-of-truth, translator brief, glossary, locale-specific test plan,…
Init Project
Initialize a project for AI-agent development. Detects existing codebase architecture, language, framework, platform, runtime, package manager, test runner, CI, secrets backend, and existing documentation, or scaffolds a fresh project from a one-line intent like web app, iOS app, Android app, desktop app, game, CLI, or AI agent. Produces a working agent configuration, CLAUDE.md/AGENTS.md overlay,…
Service Implementation
Implement a specific service, module, feature slice, bug fix, migration step, or bounded-context task after requirements, architecture, contracts, file ownership, validation pack, and documentation expectations are clear. Use for coding work where the agent owns a defined path or component and must preserve surrounding behavior, tests, data safety, and project memory.
Scripting Automation
Use for Bash, Python, PowerShell, operational tooling, CLI helpers, migration scripts, diagnostics, glue logic, safe automation, argument parsing, idempotency, dry-run modes, retries, timeouts, and error handling.
Compliance Legal
Map the product against applicable regulatory, contractual, and platform compliance frameworks: GDPR, CCPA/CPRA, HIPAA, SOC 2, ISO 27001, PCI DSS, COPPA, FedRAMP, DPDP (India), LGPD (Brazil), KVKK (Türkiye), PDPL (Saudi/UAE), ePrivacy, AI Act (EU), NIST AI RMF, store-platform legal terms (App Store, Google Play, Steam), open-source license obligations, accessibility law (ADA, EAA, Section 508, AO…
Tdd Workflow
Run a strict test-driven-development loop for AI-agent implementation, following Anthropic's published guidance for Claude Code: write the test first, watch it fail, define the minimum implementation contract, verify green after service-implementation, refactor under green, and produce evidence the agent did not silently overfit to the test. Use whenever a new feature, bug fix, refactor, or desig…
Sdlc Orchestrator
Orchestrate full software-development lifecycle work from first request to release readiness. Use when the user asks to build a product, improve an existing product, rebuild a messy system, coordinate several skills, choose between greenfield and migration work, or move a broad task through intake, research, requirements, architecture, decomposition, implementation, verification, and documentatio…
Security Owasp Web
Review or design a web, API, or mobile-backend system against the current OWASP Top 10 risk categories, including the 2025 order: broken access control, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software or data integrity failures, security logging and alerting failures, and mishandling of exceptional co…
Security Owasp Agentic
Review an agentic AI system against the current OWASP Top 10 for Agentic Applications categories, including ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-A…
Pr Review
Review pull requests or local diffs for correctness, regressions, missing tests, security, data safety, API compatibility, migration safety, performance risk, accessibility issues, operational hazards, and documentation drift. Use before merge, push, release, or whenever the user asks for code review, risk review, pre-landing review, or final check.
Security Owasp Llm
Review an LLM-powered feature against the OWASP Top 10 for Large Language Model Applications: prompt injection, sensitive information disclosure, supply-chain risk for models and data, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, unbounded consumption. Produces a per-category status, threat model for…
Devops Router
Use for broad DevOps, infrastructure, deployment, automation, operations, security, incident, cloud, Kubernetes, CI/CD, container, IaC, scripting, observability, or network/VPN requests that need safe routing before implementation.
Competitive Analysis
Run competitive, adjacent-market, or alternative-solution analysis for product planning. Use when the project needs competitor scan, substitute workflow analysis, feature matrix, pricing or packaging comparison, positioning, wedge selection, blind-spot discovery, opportunity mapping, or `06-competitor-analysis.md` before product scope is locked.
Data Ml Pipeline
Design and operate data and ML pipelines for any product: data sourcing, ingestion, schema management, transformation (batch and streaming), feature stores, dataset versioning, model training, evaluation, deployment, drift monitoring, retraining triggers, lineage, and reproducibility. Covers analytical data warehouses, lakehouse architectures, real-time streaming, embeddings/vector stores, and LL…
Security Mobile Masvs
Review native iOS and Android applications against OWASP MASVS and MASTG-aligned mobile security controls: local storage, cryptography, authentication, network communication, platform interaction, WebViews, code quality, app signing, anti-tampering, privacy, root/jailbreak assumptions, and release-store constraints. Use before any native mobile release, after changes to authentication, storage, n…
Network Vpn Security
Use for VPC/VNet/subnet design, VPN, routing, DNS, firewall rules, ACLs, security groups, private endpoints, bastions, hybrid or multi-cloud connectivity, zero trust access, Kubernetes network policies, MTU, latency, and secure network troubleshooting.
Incident Troubleshooting
Use for incidents, outages, degradation, failed deployments, performance regressions, emergency diagnostics, stabilization, timelines, hypotheses, recovery plans, rollback, evidence capture, root cause notes, and prevention actions.
Analyze Codebase
Analyze an existing repository in read-only mode to reconstruct current behavior, architecture, dependency clusters, build and test health, hotspots, tech debt, ownership boundaries, integration points, and current-vs-target gaps. Use for existing-product improvement, migration planning, code archaeology, risky refactors, unfamiliar repositories, or artifacts `80-current-state-scan.md` through `8…
Infrastructure As Code
Use for Terraform, OpenTofu, Pulumi, CloudFormation, Bicep, ARM, Crossplane, provider constraints, remote state, imports, moved blocks, plan review, drift, policy checks, modular infrastructure, and safe resource changes.
Observability Operations
Use for metrics, logs, traces, dashboards, alerting, SLI/SLO design, OpenTelemetry, Prometheus, Grafana, Loki, ELK, OpenSearch, Tempo, Jaeger, production diagnostics, and alert noise reduction.
Ux Design
Design and review user experience for any product surface: web pages, mobile screens, desktop windows, game HUD and menus, CLI prompts, voice interfaces, AI-agent chat surfaces, and onboarding flows. Produces UX specs with information architecture, interaction patterns, screen states (empty, loading, error, success), micro-copy guidelines, design-system tokens, and acceptance criteria the impleme…
Cloud Operations
Use for cloud architecture and operations across AWS, GCP, Azure, Cloudflare, DigitalOcean, Yandex Cloud, VK Cloud, Selectel, SberCloud, MTS Web Services, IAM, networking, HA/DR, managed services, migration, and cost/risk control.
Requirements Quality
Convert product scope into functional requirements, nonfunctional requirements, measurable quality scenarios, acceptance criteria, and traceable requirement links. Use before architecture or implementation when FR/NFR lists, reliability, security, observability, performance, maintainability, compatibility, accessibility, data-safety, or artifacts `11-functional-requirements.md` through `13-qualit…
Cve Zero Day Scanner
Run a directed CVE and zero-day risk pass against the project's dependency graph, container base images, infrastructure providers, and known exploit chains relevant to the detected stack and platform matrix. Verify advisory-source documentation with Context7 MCP, then query live sources such as CISA KEV, NVD, GitHub Security Advisories, distro trackers, vendor PSIRTs, and ecosystem registries wit…
Research Domain
Research domain context, users, jobs-to-be-done, constraints, terminology, workflows, risks, and decision pressure before requirements or architecture. Use when creating a new product, entering an unfamiliar domain, validating product assumptions, preparing `05-domain-research.md`, or deciding what the system must respect before design or implementation begins.
Kubernetes Operations
Use for Kubernetes deployment, manifests, Helm, Kustomize, operations, scaling, storage, networking, RBAC, NetworkPolicy, Pod Security, rollout planning, rollback, and cluster troubleshooting.
Security Secrets
Use for secret management, IAM and RBAC hardening, Vault, KMS, SOPS, Sealed Secrets, CI secrets, workload identity, supply chain security, scanning, SBOM, signing, policy gates, audit, access review, and rotation.
Project Structure Governance
Enforce a clean project-activity contract for any repository the agent works on: coherent project structure, no root clutter, temporary/test/debug scripts isolated in a dedicated workspace, one canonical documentation/runbook entrypoint, and a clear cleanup/checklist before handoff. Use during init, planning, implementation, QA, review, release, documentation sync, scaffolding, migrations, and an…
Obsidian Graph Navigator
Navigate the project's Obsidian knowledge graph efficiently so the agent loads the smallest correct context instead of re-reading the whole vault. Uses wikilink topology, MOC (map of content) pages, frontmatter metadata, and tag/property queries to answer 'what do I need to read for this task' in a token-economical way. Use whenever a skill is about to load notes from the project vault, before ar…
Cicd Automation
Use for CI/CD, pipeline automation, GitHub Actions, GitLab CI, Jenkins, Argo, Azure DevOps, build-test-scan-package-deploy flows, release orchestration, protected environments, approvals, and rollback.
Ai Pdlc
Run an AI-augmented Product Development Lifecycle that treats every phase as a hypothesis to test, not a deliverable to push: research, hypothesis, plan-by-phases, prototype, validate, implement under TDD, harden against the matching security track (OWASP/MASVS) and CVE risk, and ship with rollback and post-launch evaluation. Use as the strategic spine when a project is greenfield, a brownfield r…
Perf And Memory
Review or plan performance, memory, allocation, concurrency, caching, latency, throughput, profiling, benchmark, capacity, and language-runtime work. Use when a task mentions speed, memory, scale, load, p95/p99 latency, CPU, heap, allocations, async/concurrency, streaming, database query cost, caching, or artifacts `30-language-profiles.md` and performance-related quality scenarios.
Custom Skill Builder
Create or update user-defined skills for Codex, Claude Code, and local agent workspaces. Use when the user wants a new reusable skill, a project-specific skill, a team workflow skill, a tool-integration skill, a domain-knowledge skill, or a revision of an existing skill with proper frontmatter, concise instructions, references, agent metadata, routing integration, and validation.
Self Improvement Loop
Run a controlled self-improvement event loop for agents, skills, prompts, routing, tools, memory, and evaluation packs. Use during an active task or between tasks when the agent fails validation, receives corrective user feedback, chooses the wrong skill, misuses tools, wastes context, misses tests, repeats a weak behavior, or needs a measured repair based on logs, evals, user feedback, Obsidian…
Hypothesis Validator
Convert a design choice, architecture option, market assumption, or feature bet into a falsifiable hypothesis with a measurable kill criterion, the cheapest useful test to settle it, and a clear record of what was supported, disproved, or deferred. Use whenever the agent is tempted to commit to a stack, a pattern, a vendor, a model, a UX flow, or a scope without evidence, and as the core supporti…
Accessibility Audit
Audit any product surface against accessibility standards: WCAG 2.2 AA for web, Apple UIKit/SwiftUI Accessibility for iOS, Android TalkBack/AccessibilityService for Android, Microsoft UIA for Windows, AT-SPI for Linux, game-specific readability and remappable-controls patterns, and voice/chat AI surfaces with appropriate alternative modes. Produces a per-criterion status, automated test suggestio…
Qa Eval
Plan and run verification gates for unit, integration, browser, contract, migration, security, performance, accessibility, smoke, acceptance, and eval scenarios. Use before merge or release, after implementation, when validation evidence is missing, when quality scenarios need proof, or when artifacts `32-test-strategy.md`, `33-evaluation-plan.md`, and release readiness notes must be produced.
Architecture Review
Design or review software architecture using system context, container, component, runtime, deployment, data, API, integration, crosscutting concepts, and ADR artifacts. Use before large implementation, service-boundary changes, infrastructure changes, API or data contract changes, migrations, reliability work, security-sensitive design, or architecture artifacts `14-system-context.md` through `2…
Documentation Graph Curator
Maintain project documentation and Obsidian-first knowledge graph using Markdown notes, wikilinks, ADRs, artifact indexes, Mermaid diagrams as visual layer, change logs, and graph hygiene. Use when syncing docs after code changes, creating a project vault skeleton, updating project memory, linking requirements to architecture and tasks, cleaning stale notes, or making sure agents can navigate the…
Platform Detector
Detect the target platforms a project is being built for (web, mobile iOS, mobile Android, desktop, console, embedded, server, edge, browser extension, game engine, AI agent, CLI, library), the runtime environments behind them, the store or distribution policy that applies, and the platform-specific quality constraints that must shape architecture and security. Use after init-project when the sta…
Release Management
Coordinate the release pipeline end to end: version numbering, release notes (internal and user-facing), changelog, build provenance, store/registry submission, certification checklists per platform (App Store, Google Play, Microsoft Store, Steam, consoles, npm/pypi/crates/Maven, container registries), staged rollout plan, post-release monitoring, and rollback. Produces a release plan, store-list…
User Journey Mapper
Map user journeys, story maps, interaction flows, alternate paths, failure paths, release slices, and scenario-to-task links before decomposition. Use when a product workflow, UX flow, story map, persona path, acceptance scenario, or `09-user-story-map.md` and `10-user-journeys.md` artifact must be clarified before epics, stories, tasks, or parallel implementation are assigned.
Intake Coordinator
Clarify and scope incoming product or engineering requests before research, architecture, or coding starts. Use when the request is broad, emotionally urgent, ambiguous, risky, multi-phase, missing success criteria, missing constraints, missing non-goals, or likely to create rework if the agent starts implementation too early.
Decompose Work
Break approved product scope and architecture artifacts into epics, user stories, implementation tasks, dependency graph, critical path, ownership map, validation packs, merge order, and parallelization plan. Use after requirements and architecture are approved and before assigning implementation agents, opening parallel work, or writing artifacts `24-epics.md` through `29-agent-role-matrix.md`.