Business & Operations

Audit corporate tax compliance systems across jurisdictions. Analyzes tax engine configuration (Avalara, Vertex, ONESOURCE), nexus determination and Wayfair economic nexus tracking, sales/use tax calculation accuracy, federal and state income tax compliance (book-to-tax adjustments, NOL, R&D credits, apportionment), ASC 740 tax provision automation (ETR, deferred tax, uncertain tax positions), transfer pricing documentation (OECD BEPS Pillar One/Two, GloBE rules, CbCR), and filing calendar ma...

Manage the full tax compliance lifecycle — calendar management, federal and state filings, payroll taxes, sales tax, corporate income tax, R&D credits, and multi-state nexus tracking.

Build TAM databases from scratch using a 7-phase methodology (Source Discovery → Keyword Expansion → Config → Collection → Dedup → Exclusion → Enrichment hand-off). Triggers "tam map", "build tam", "total addressable market", "scrape industry", "map the market", "build a lead database", "venue partnerships tam", "labs tam", "residential tam", "installer tam". Entity-routed — Nites residential (Google Maps ZIP), Supply installer (SAM.gov + Houzz + state license dbs), Labs venue partnerships (S...

Domain knowledge for narrative threat report generation — executive summary structure, architecture overview patterns, per-category narrative templates, attack tree construction rules with Mermaid syntax, and reference attack tree examples. Consumed by the threat-report agent during report generation.

Domain knowledge for PDF security report assembly — artifact detection patterns with tier selection rules, Typst data variable contract with type specifications and image path resolution, and brand asset handling with logo location and fallback rules. Consumed by the report-assembler agent during report generation.

Synchronize a security issue in <tracker> with the state of its GitHub discussion, the <security-list> mailing thread, and any <upstream> PRs that fix it. The skill gathers all relevant signals, proposes label, milestone, assignee, field and draft-email updates, and only applies changes the user has explicitly confirmed. Suggests the next step in the handling process and prints the CVE allocation link when a CVE is needed.

Expert guidance on SwiftNIO best practices, patterns, and implementation. Use when developers mention: (1) SwiftNIO, NIO, ByteBuffer, Channel, ChannelPipeline, ChannelHandler, EventLoop, NIOAsyncChannel, or NIOFileSystem, (2) EventLoopFuture, ServerBootstrap, or DatagramBootstrap, (3) TCP/UDP server or client implementation, (4) ByteToMessageDecoder or wire protocol codecs, (5) binary protocol parsing or serialization, (6) blocking the event loop issues.

Assess supply chain risk exposure and resilience posture. Analyzes supplier dependency mapping (Tier 1/2/3), geographic concentration risk, single-source vulnerability, disruption scenario modeling (pandemic, trade war, port closure), Monte Carlo simulation, financial health monitoring (Altman Z-score), early warning systems, compliance tracking (UFLPA, conflict minerals, sanctions), ESG supply chain scoring, and mitigation strategy evaluation.

Apply production-ready Supabase SDK patterns for TypeScript and Python projects. Use when implementing queries, auth, realtime, storage, or RPC calls with @supabase/supabase-js or supabase-py. Trigger with phrases like "supabase SDK patterns", "supabase query", "supabase typescript", "supabase python", "supabase client setup", "supabase realtime", "supabase auth", "supabase storage".

This skill should be used when managing Supabase projects or organizations, creating new projects, listing projects, checking project status, retrieving API keys, pausing or restoring projects, or working with project costs and billing. Trigger when: "create Supabase project", "list Supabase projects", "Supabase API keys", "pause project", "restore project", "Supabase organization", "project cost", "get project URL", "publishable key", "secret key", "anon key", "service role key", "asymmetric...

Audit a media production studio or post-production facility. Analyzes facility scheduling and utilization, equipment lifecycle tracking, editorial and VFX pipelines, color grading and finishing workflows, digital asset management (MAM/DAM), IMF/MXF format compliance, SMPTE standards adherence, content security posture (TPN readiness), and talent/crew coordination systems.

Audit adaptive learning and student personalization systems for pedagogical quality. Use when you need to evaluate learning path algorithms (branching, remediation, acceleration), mastery detection models (Bayesian, IRT, threshold-based), knowledge graph prerequisite accuracy, recommendation engine fairness and bias, spaced repetition and interleaving, WCAG 2.1 AA and Section 508 accessibility compliance, IEP/504 accommodation implementation, xAPI/SCORM/LTI data integration, or teacher/studen...

strace and ltrace skill for system call and library call tracing. Use when a binary behaves incorrectly without crashing, diagnosing file-not-found errors, permission failures, network issues, or unexpected library calls by tracing syscalls and library function calls. Activates on queries about strace, ltrace, syscall tracing, library interception, ENOENT, EPERM, strace -e, or diagnosing binary behaviour without a debugger.

Authenticated Shopify implementation skill for fixing SEO, data quality, and theme issues after an audit or from a specific request. Use when a user wants to fix, implement, update, or roll out changes to product/collection content, SEO fields, image alt text, tags, schema markup, robots rules, internal linking, or other store data that requires Shopify authentication. Supports Admin GraphQL API, theme code, and mixed changes. Do not use for public-only audits (use store-analyzer), non-Shopif...

नेपाली नियमित लेखा परीक्षण (statutory audit under NCA Act 2053)। NFRS अनुपालन, ब्यालेन्स शीट / P&L सत्यापन, लेखा परीक्षण मत। Statutory audit under NCA Act 2053. NFRS compliance, balance sheet/P&L verification, audit opinion. Use for audit planning, NFRS compliance checks, or audit report generation.

Audit workforce scheduling systems for labor optimization and compliance. Use when you need to evaluate labor demand forecasting accuracy, shift generation and optimization algorithms, skill-based staff routing, FLSA overtime compliance, predictive scheduling law compliance (OR, NYC, Chicago, Seattle), union CBA shift bidding rules, real-time schedule adjustments (call-outs, flex staffing, VTO), cross-training ROI, or labor cost as percentage of revenue. Covers UKG/Kronos, ADP, Workday, Deput...

Staff-engineer-level code review that goes beyond correctness to evaluate architectural alignment, system-level implications, failure modes, performance, scalability, backward compatibility, observability, security, and cross-team impact. Use when reviewing a PR (URL or diff), analyzing code changes for architectural fitness, or when the user asks for a thorough/staff-level/senior review of code changes. Triggers on "review this PR", "review these changes", "staff review", "thorough code revi...

Maintain a ranked list of N artifacts (drafts, designs, code variants, research reports, ...) by comparing each new candidate against the current top and bottom of the list, using LLM judgment as the comparator. Supports both batch ranking (compare every artifact against every other) and incremental insertion (place a new artifact into an existing ranked list with O(log N) comparisons via binary search). Persists the ranklist as JSON; safe to call repeatedly as new candidates land.

Use when running a sprint retrospective, generating a retro, preparing retro data, or summarizing team activity for a retrospective. Takes team member names or a Slack alias as input. Gathers data from GitHub, Slack, Jira, Confluence, Google Docs, and CI/CD with strict privacy filtering.

Crawl and scraping systems architecture — distributed crawler topology, URL frontier, politeness, and compliance. Architecture-only (no execution code). Don't use for single-page scraping (Navigator) or ETL pipelines (Stream).

Use when Claude Code needs to classify risk before SpecDD work starts, especially around write authority, public contracts, security, data, migrations, dependencies, verification gaps, rollback, or destructive operations.

Use when Claude Code needs to refactor code, tests, docs, specs, or project structure in a SpecDD project while preserving specified behavior, public contracts, scenarios, ownership, and local write authority.

Use when Claude Code is explicitly asked for a plan, or must resolve unclear SpecDD scope, write authority, public-contract risk, affected files, or verification before safe implementation; do not trigger for ordinary authorized changes.

Use when Claude Code needs to create, add, restructure, or improve SpecDD `.sdd` contract files, define ownership or write authority, clean up missing or unclear specs, or introduce SpecDD adoption without changing implementation unless explicitly requested.