Claude Skills by 1398281322-a11y

Use when designing, implementing, or reviewing Java microservice or 电商/文旅/支付业务 involving 订单, 支付, 分账, 结算, OSS, 文件上传, STS, 直传, SSRF, 财务统计, GMV, 接口规范, 接口安全, 定时任务, XXL-JOB, 接口性能, N+1, 连接池, 防重放, 水平越权, 退款, 核销, 库存, 秒杀, 购物车, 优惠券, Redis, RocketMQ, 幂等, 高并发, 分布式事务, 限流, 缓存, 分库分表, 索引, 容灾, 远程调用, JVM, 对账, or 账期. Skip heavy concurrency skills for ordinary single-table CRUD.

Use when defining API 接口规范, REST methods, HTTP status, 错误码, 版本, pagination, 金额单位分, 时区, Idempotency-Key, or request_id. Do not use for HMAC/replay (backend-api-security) or SQL 越权 (backend-safe-check).

Use when hardening APIs: HTTPS, HMAC 签名, timestamp+nonce 防重放, CORS, 脱敏, JWT none 算法, 密钥不进 URL. For SQL injection and resource 越权 WHERE, use backend-safe-check.

Use when adding or debugging Redis cache, cache-aside, 穿透, 击穿, 雪崩, cache stampede, hot key, or cache-DB consistency. Do not use for Redis distributed locks (use backend-distributed-lock) or as a message queue replacement.

Use when implementing 购物车, add to cart, 未登录购物车, 登录合并, cart checkout. Cart does not deduct stock. Do not use for order creation itself (backend-order-state / backend-inventory-occupy).

Use when deducting stock, quotas, tickets, 名额, or commission-related remaining amounts under concurrent requests; oversell, 超卖, 扣库存, 核销占名额. Do not use for ordinary CRUD that does not mutate a remaining counter.

Use when discussing 一致性哈希, virtual nodes, load balancing sticky keys, or comparing hash-mod vs consistent hash. Do not confuse with Redis Cluster hash slots (backend-redis-ops) or DB sharding keys (backend-sharding).

Use when implementing 延迟关单, 超时未支付取消, delayed messages, RocketMQ delay levels, timing wheel, or Redis ZSET delay. Do not scan huge unpaid-order tables with @Scheduled.

Use when generating order numbers, primary keys, or globally unique IDs (雪花, ASSIGN_ID, segment). Do not use UUID as a clustered InnoDB primary key. Do not use for shard-key design (backend-sharding).

Use when multiple instances need mutual exclusion with Redisson or Redis SET NX PX, 看门狗, fencing. Do not use as the default for oversell/stock (backend-concurrency-sell) or as a substitute for unique keys (backend-idempotent).

Use when cluster login state, 分布式 Session, JWT, SSO, Redis session, sticky sessions, or gateway auth is in play. Do not use for SQL 越权 resource checks (backend-safe-check).

Use when a business write spans services or datasources (order then coupon, pay then commission, verify then settle), or the user mentions 本地消息表, 事务消息, TCC, Seata, Saga. Do not use for a single-service single-DB transaction. Never default to TCC.

Use when implementing 文件存储, OSS, S3, MinIO, STS 直传, 预签名 URL, 分片上传, CDN, 私有桶, or 文件不进 MySQL. Do not use for magic-byte/SSRF/SVG (backend-file-upload).

Use when hardening 文件上传/下载: 类型白名单, magic bytes, 大小限制, 路径穿越, SVG XSS, Zip Slip, 从 URL 拉文件 SSRF. Do not use for STS/直传/CDN (backend-file-oss).

Use when implementing 记账流水, 账户余额, 借贷, 日切, 不可改历史流水, or 余额必须能用流水重放。Not for GMV dashboards (backend-finance-stats) or merchant payout bills (backend-finance-settlement).

Use when building 商家结算, 账期 T+N, 结算单, 抽佣, 待结算/可结算, merchant payout. Distinct from WeChat 分账 (backend-pay-split-account) and from GMV reports (backend-finance-stats).

Use when defining 财务统计口径, GMV, 实收, 支付GMV vs 结算GMV, 退款后净额, 报表切日, or 实时 SUM 大表. Do not mix GMV with platform revenue. Settlement bills are backend-finance-settlement.

Use when designing 容灾, 高可用, failover, RPO/RTO, Redis/MySQL/RocketMQ downtime, multi-AZ, or degradation. Do not treat HA and DR as the same thing. Skip for feature CRUD with no availability target.

Use when a single DB row or Redis key becomes a hotspot (热点账户, 热点行, 爆款 SKU, 钱包余额行锁排队). Do not use as a substitute for ordinary stock WHERE stock>=n (backend-concurrency-sell) unless that row is the bottleneck.

Use when handling duplicate HTTP submits, payment/refund callbacks, RocketMQ reconsume, Feign retries, 核销, 结算, or 防重. Do not use for read-only queries or simple unique-free CRUD with no retry/callback.

Use when deciding 下单扣库存 vs 支付扣库存 vs 预占/锁定库存, 可售库存, 锁定库存, occupy TTL. Do not replace the SQL condition stock>=n (backend-concurrency-sell). Do not use for 秒杀分层 (backend-seckill).

Use when diagnosing Full GC, OOM, Metaspace, direct memory, heap dump, jstat, 频繁 GC, CPU 飙高 from JVM. Do not use for business oversell or Redis. Skip ordinary CRUD with no latency/GC symptoms.

Use when sending or consuming RocketMQ (or Kafka) messages: 消息丢失, 重复消费, 顺序, 积压, 死信, 延迟消息, transactional messages. Do not use Redis List as a production business queue.

Use when designing 异地多活, unitization, 同城双活, conflict resolution across DCs, or comparing 多活 vs 容灾. Do not default to multi-live; try single-region HA first (backend-ha-dr).

Use when diagnosing slow SQL, creating or changing secondary indexes, EXPLAIN, 最左前缀, covering index, or implicit conversion. Do not use for sharding or table status-machine design.

Use when debugging lost updates, phantom reads, deadlocks, SELECT FOR UPDATE, InnoDB isolation, MVCC, gap lock, next-key lock, or 当前读/快照读. Do not use for secondary index design (backend-mysql-index) or sharding.

Use when designing 读写分离, MySQL 主从, binlog, GTID, 半同步, 主从延迟, write-then-read. Do not use for sharding (backend-sharding) or secondary indexes (backend-mysql-index).

Use when adding tracing, metrics, 链路追踪, TraceId, 慢接口排查, 全链路压测, or production incident workflow. Skip when the task is greenfield CRUD with no performance or incident context.

Use when preventing lost updates with version/CAS, MyBatis-Plus @Version, or comparing 乐观锁 vs 悲观锁. Do not use for stock oversell by itself (backend-concurrency-sell) or Redis locks (backend-distributed-lock).

Use when implementing 订单状态机, 待支付/已支付/已发货/已完成/已取消, illegal status jumps, or 正向履约. For 售后逆向 use backend-refund-aftersale. For stock occupy timing use backend-inventory-occupy.

Use when handling 重复支付, 同一订单两笔成功, 支付与超时关单撞车, 用户连点收银台, or rows=0 after pay update. Do not auto-refund without reading current status.

Use when implementing 支付异步回调, WeChat/Alipay notify, 验签, 金额校验, notify 返回 SUCCESS. Do not use user JWT on callbacks. Unique-key mechanics also in backend-idempotent.

Use when payment HTTP times out, 回调丢失, 主动查单, PAYING 补偿扫描, or 支付成功不等于收到 notify. Do not treat timeout as failure and create a new out_trade_no.

Use when calling WeChat/Alipay 退款 API, refund notify, 部分退, stable refundNo, refund timeout query. Business aftersale flow is backend-refund-aftersale; do not mix the two files.

Use when implementing 支付分账, 多门店分账, 延迟分账, WeChat profit sharing, 平台抽佣后再打给商户. Do not default to real-time split. Distinct from order split (backend-split-order).

Use when creating 支付单, unified order, 预下单, 支付二维码过期, pay status vs order status. Do not mix payment state machine with order fulfillment states (backend-order-state).

Use when optimizing 接口性能, N+1 SQL/RPC, 循环远程调用, Hikari 连接池, 批量写入, or 同步转异步. Do not use for GC (backend-jvm-prod), EXPLAIN (backend-mysql-index), or incident 排查顺序 (backend-observability).

Use when designing 商品详情页, SKU specs, 静态化, CDN, 商详缓存与库存分离. For penetration/breakdown/avalanche read backend-cache-trap. For flash-sale pages read backend-seckill.

Use when implementing 优惠券领取/核销, 超发, 满减叠加, 促销计算, 优惠金额以服务端为准. Do not trust frontend prices. For 秒杀券 also consider backend-seckill.

Use when protecting public or hotspot APIs with 限流, 熔断, 降级, Sentinel, gateway rate limit, or shedding traffic. Do not use for ordinary internal single-table CRUD with no burst risk.

Use when money, coupons, commission, or inventory can diverge across systems: 对账, 支付对账单, 分佣核对, 库存对账, 差错处理. Do not replace this with Seata/TCC as the default.

Use when operating Redis persistence (RDB/AOF), Sentinel vs Cluster, 大 key, 热 key, fork blocking, 16384 slots. Do not use for cache penetration/breakdown/avalanche (backend-cache-trap) or distributed locks (backend-distributed-lock).

Use when implementing 售后, 仅退款, 退货退款, 退库存, 退优惠券, reverse order flow. Do not reuse 正向下单代码硬改状态. Payment callback idempotency is backend-idempotent.

Use when calling other services or third parties via Feign, HTTP, RPC: 超时, 重试, 仓壁, deadline, 第三方对接. Do not retry non-idempotent writes. Circuit breaking details also in backend-rate-limit.

Use when writing or reviewing APIs that touch authz, 越权, SQL injection, third-party callback signatures, 核销 merchant ownership, or sensitive fields. Use on almost every write API; skip only for internal read prototypes with no user input.

Use when implementing 定时任务, @Scheduled, cron, XXL-JOB, Quartz, ShedLock, or cluster duplicate job execution. Do not use for 延迟关单 (backend-delay-job). Jobs must be idempotent.

Use when designing 秒杀, 抢购, flash sale, 限时抢, 10万 QPS 活动. Do not use for ordinary product listing. Prefer layers of filtering; do not put all traffic on DB or distributed locks.

Use when data volume or write throughput truly requires 分库分表, shard key design, ShardingSphere, or cross-shard queries. Do not use as the default for big tables; try archive/partition/index first. Never mix with index-only problems.

Use when an order must split by merchant, warehouse, or 门店/景区: 拆单, 父单子单, 多商家结算. Do not use for sharding tables (backend-sharding).

Use when creating or changing MySQL tables, status fields, unique keys, big-table archive, or partitioning. Do not use for index details (backend-mysql-index) or sharding (backend-sharding).