Claude Skills by kensaurus

Keep an already-open PR merge-ready: triage comments, resolve clear conflicts, fix CI. Do not merge. Dirty tree → merge-ready PR → workflow-release-prep. Create/merge PR lifecycle → workflow-pr.

Create a live React canvas beside chat for standalone analytical artifacts that benefit from visual layout: quantitative/security/ architecture analyses, data-heavy timelines/charts/tables, interactive explorations, or repeatable tools. Do not use for simple prose or code changes.

Create Cursor hooks. Use to create a hook, write hooks.json, add hook scripts, or automate behavior around agent events.

Create Cursor rules for persistent AI guidance. Use when user wants to create a rule, add coding standards, project conventions, file-specific patterns, or mentions ".cursor/rules", "AGENTS.md", "cursor rule", "coding standard", "convention", or "AI guidance".

Guide users through creating effective Agent Skills for Cursor. Use when user wants to create, write, update, or debug a skill, or asks about SKILL.md format, skill structure, ~/.cursor/skills/, or skill best practices.

Create custom subagents for specialized AI tasks. Use when the user wants to create a new type of subagent, set up task-specific agents, configure code reviewers, debuggers, or domain-specific assistants with custom prompts.

Convert 'Applied intelligently' Cursor rules (.cursor/rules/*.mdc) and slash commands (.cursor/commands/*.md) to Agent Skills format (.cursor/skills/). Use when the user wants to migrate rules or commands to skills, convert .mdc rules to SKILL.md format, or consolidate commands into the skills directory.

Run the rest of a /shell request as a literal shell command. Use only when the user explicitly invokes /shell and wants the following text executed directly in the terminal.

Split current work into small reviewable PRs. Use when the user asks to split a chat, branch, or change set. Whole dirty tree to one merge-ready PR → workflow-release-prep.

Configure a custom status line in the CLI. Use when the user mentions status line, statusline, statusLine, CLI status bar, prompt footer customization, or wants to add session context above the prompt.

View and modify Cursor CLI configuration in ~/.cursor/cli-config.json. Use to change CLI settings, configure permissions, switch approval mode, enable vim mode, toggle display options, configure sandbox, or manage any CLI preferences.

Modify Cursor/VSCode user settings in settings.json. Use when user wants to change editor settings, preferences, themes, font size, tab size, keybindings, or mentions "settings", "preferences", "theme", "font", "format on save", "auto save", or "cursor config".

Automated WCAG 2.2 accessibility audit using playwright-cli to crawl every page, inject axe-core via eval, test keyboard navigation, check color contrast, ARIA labels, and heading order. Use when "audit accessibility", "check a11y", "WCAG audit", "check keyboard nav", or "test screen reader".

Read-only audit of product-analytics instrumentation: event taxonomy, funnel completeness, consent-gated firing, dead/duplicate/phantom events. Use when "audit our analytics", "are we tracking the right events", "funnel instrumentation", or before iterate-post-launch. PostHog/Amplitude/Mixpanel/GA4.

Read-only audit of app-layer auth — route×gate matrix, session lifecycle, OAuth, and provider traps (getSession vs getUser, middleware-as-only-gate, CVE-2025-29927). Use when "audit our auth", "check middleware protection". RLS → plan-rls-audit. OWASP checklist → audit-security.

Read-only audit and decision advisor for backend architecture, topology-gated by stack. Use when "audit backend architecture", "which pattern should I use", "am I over-engineering", "sync vs event-driven". Mechanical boundary rules → enhance-arch-boundaries.

Analyse and shrink JavaScript bundle size for any web app. Use when asked to "reduce bundle size", "analyse bundle", "tree shaking", "lazy loading", "code splitting", "slow initial load", "large JS", "chunk size", "build performance", "LCP caused by JS", "why is the bundle so big", or "first load JS too large".

Audit CI/CD pipelines (GitHub Actions) for cost, speed, and safety. Use when the Actions bill is high, Actions minutes, runner cost, slow CI, artifact/cache storage, or "CI/CD / workflow audit". Gate logic (bypass, ratchet gaming, required-but-not) → audit-gate-logic.

Detect and fix repo-wide anti-patterns and consistency drift (naming, organisation, repeated smells). Use when "code smell", "anti-pattern", "technical debt", or "standardize the codebase". This PR/diff review → audit-code-review.

Review this PR or diff for quality, security, and maintainability. Use when reviewing pull requests, examining a named change set, or the user asks for a code review of current work. Repo-wide anti-patterns → audit-code-quality. Bulk transform semantics → audit-codemod-safety.

Read-only audit of a codemod or bulk mechanical transform for behavior-preservation — compiles/lints is not same-behavior. Use when "did this codemod break anything", "audit this bulk refactor", or before merging a mass find-replace. Diff quality → audit-code-review. SQL → plan-data-integrity.

Audit database schema for consistency, validation, and industry standards. Use when reviewing schema design, naming conventions, constraints, indexes, or migrations. Destructive-op gates → plan-data-integrity. Who-can-read-what RLS → plan-rls-audit. Restore/RPO → plan-backup-dr.

Read-only audit of custom lint/ratchet doctrine — is each rule right on the merits, not merely enforced. Use when "is this lint rule wrong", "the ratchet banned a legitimate pattern", "audit our guardrail doctrine". Enforcement → audit-gate-logic. Consolidation → housekeep-gates.

Read-only audit of config/env parity across dev, staging, and prod — missing or misnamed vars, drifted flags, hardcoded values, secrets reused across environments. Use when "works locally but not in prod", "audit our environments", or "config drift". Local runnability → workflow-environment-ready.

Audit frontend API calls against backend implementation for contract alignment and network shape. Use when "API audit", "FE-BE contract", or "review frontend API integration". Live 4xx/5xx reproduction → debug-fe-be-integration.

Read-only audit of CI gate logic — silent bypass, ratchet gaming, required-but-not, duplicate gates. Use when "can CI be bypassed" or "why did a regression pass CI". Cost → audit-cicd. Consolidation → housekeep-gates. Rule content → audit-doctrine.

Audit and fix internationalisation for any web or mobile app. Use when asked to "audit i18n", "fix translations", "add locale", "natural language", "translation quality", "hardcoded strings", "localisation", or "the Japanese feels like Google Translate".

Read-only audit of hosting, database, storage, egress, and serverless spend (Supabase, Vercel, S3/R2, edge). Use when "hosting bill is high", "cut infra costs", or a bill jumps. CI minutes → audit-cicd. Model tokens → plan-llm-cost-guardrails. Consumes test-load numbers.

Run a PDCA quality audit on LLM/AI features: traces, prompts, costs, evals, grounding, hallucination. Use for "audit LLM quality", "check Langfuse", "audit prompts", "check AI quality", "audit AI costs", "check traces". Jailbreak/OWASP LLM → audit-llm-security. Token caps → plan-llm-cost-guardrails.

Read-only OWASP LLM Top 10 audit of app-facing AI: prompt injection, data leakage, unsafe output/agency, RAG risks, misinformation, and unbounded spend. Use when "audit LLM security", "prompt injection", "jailbreak my chatbot", or "is my AI safe?". General app security → audit-security.

Read-only audit of mobile IAP and subscriptions — StoreKit 2, Play Billing, or RevenueCat — for server receipt validation, restore, lifecycle sync, grace periods, and entitlements. Use when "audit our IAP", "restore purchases broken", or before a paid app. Web Stripe/ledgers → audit-payment-system.

Read-only audit for payment/money-movement systems, scope-gated so a Stripe-Checkout site and an in-house ledger each see only relevant findings. Use when "audit payment system", "double charge / idempotency", "ledger / reconciliation", "webhook / 3DS / PCI". Mobile IAP → audit-monetization-iap.

Audit runtime performance (CWV, load priority). Use when "slow page", "LCP/INP/CLS", "fetchpriority", "early hints", "speculation rules", "bfcache", or "long tasks". JS payload → audit-bundle-size. Instant nav implement → enhance-web-instant-nav. Breaking point → test-load.

Read-only full-stack conformance audit against RealWorld ("Conduit"): formal API spec, shared E2E suite, and closest-stack reference. Use when "audit against RealWorld", "Conduit conformance", or "is my full-stack app complete?". General user journeys → audit-ux-journeys.

Read-only production-resilience audit: timeouts, bounded retries, circuit breakers, idempotency, rate limits, graceful degradation, PII. Use when "resilience audit", "will this survive real traffic?", or "audit retries/timeouts/idempotency". Feature parity → audit-realworld.

Audit-and-fix linearized mobile layouts at every breakpoint — desktop is not a wide phone. Use when "responsive audit", desktop looks stacked/stretched, no max-width, breakpoint gaps, or 1440 looks like a phone. Distinct from design-mobile-first (touch/mobile-up) and audit-ux-journeys (cross-page IA).

Static OWASP review of app code (injection, headers, deps). Use when "review security" or "check vulnerabilities". Session/route×gate/getSession → audit-auth-flows. Plan-only burndown → plan-security-audit. Table RLS → plan-rls-audit. LLM attacks → audit-llm-security.

Read-only audit of an agent-skill pack for contradictory directives, overlapping triggers, stale cross-refs, and context bloat. Use when "audit my skills", "conflicting skills", "wrong skill triggered", or after adding a batch. Per-file spec → validate:skills. How to write one → meta-skill-creator.

Read-only audit of unhappy-path UI states vibe-coding skips — empty, loading, error, offline, zero-results, permission, overflow — then plan fixes. Use when "check empty/error states", "audit loading states", or "what happens when this fails". Dead buttons → plan-stub-checker; backend timeouts → audit-resilience.

Audit visual-system coherence: tokens, component variants, color/type/ spacing, dark mode. Use for "design drift", inconsistent UI, or duplicate primitives. Per-page usability → audit-ux. Breakpoints → audit-responsive. Empty/error states → audit-ui-states. Plan-only unification → plan-uiux-unification.

Cross-page UX audit for user stories, task completion, and information architecture — the layer audit-ux (per-page heuristics) skips. Use when "audit user flows", "IA audit", "can users find X", "navigation audit", or "funnel drop-off". Full DS burndown → plan-uiux-unification.

Per-page UX audit using NN/g heuristics, Intuit microcopy, and Google HEART. Use when evaluating usability, auditing microcopy, checking UX heuristics, or assessing cognitive load. Cross-page flows/IA → audit-ux-journeys. Layout/breakpoints → audit-responsive. Empty/error states → audit-ui-states.

Optimize slow queries, indexes, and N+1s. Use when "slow query", "database performance", "add an index", or "N+1". Schema consistency → audit-db-schema. RLS access control → plan-rls-audit.

Implement error-handling patterns (boundaries, toasts, API error shape). Use when "error boundary", "error toast", or "standardize API errors". Plan-only observability audit → plan-error-handling. Live Sentry triage → debug-sentry-monitor.

Implement correlated errors, traces, and structured logs with PII redaction. Use when "add logging", "instrument this", "correlate error to trace", or wiring Sentry/Langfuse. Plan-only observability audit → plan-error-handling. Investigate Sentry issues → debug-sentry-monitor.

Apply backend patterns — queues, caching, rate limits, serverless/edge. Use when "queue jobs", "caching layer", "rate limiting", "server actions", or "edge function". Which architecture to pick → audit-backend-architecture.

Implement real-time features using WebSockets, Supabase Realtime, Server-Sent Events, and live data. Use when user wants "real-time", "live updates", "WebSocket", "notifications", "chat", "collaborative", "presence", "live data", or "instant sync".

Drive a planned mechanical change to 100% repo coverage when a prior run stopped early. Use when "finish the burndown", "it stopped halfway", "apply this everywhere", or "half-migrated". One approved plan plus deferrals → complete-everything. Parked inventory → housekeep-backlog.

Explicit closure mode for one approved plan: implement unfinished items plus connected deferrals, verify every acceptance criterion, require completion-judge PASS. Use when "complete everything", "don't defer", "fix out of scope too", or a plan was falsely marked done. One repo-wide pattern → burndown-full.

Wire ETL, ingestion, cron, edge-function, and queue jobs correctly. Use for "build a pipeline", "sync X into Y", "nightly aggregation", "cron double-counts", "dedupe", "backfill", "the numbers are wrong after a retry". Bakes in idempotency, atomic writes, data contracts, dead-letter, and observability.