Development

用户运行 cm-security，或要求代码安全扫描、漏洞检查、密钥泄露排查、依赖漏洞检查时使用。默认检查当前分支相对主分支及已跟踪未提交修改，结合业务地图复核；--all 检查全部已跟踪文件。只报告问题，不自动修复、安装、升级或发布。安装自检用 cm-check，功能测试与覆盖率用 cm-test。

用户要查看或切换 CM 自动派发偏好、单/双 AI 声明、谁写谁审，或修改用户级运行时默认时使用。只管理运行时声明，不安装工具、不测试配额、不接管正在运行的任务。

Testing doctrine for tests that reveal bugs instead of passing for the wrong reason — spanning software and LLM/AI systems. Use when authoring or reviewing tests, adding a mock, deciding where a test belongs, letting a coding agent generate tests, triaging flaky CI, designing an eval suite for an LLM/agent feature, or rebuilding a brittle suite. Not for general code review, library debugging unrelated to tests, CI pipeline design beyond tests, or production observability.

Retrieves authoritative, up-to-date technical documentation, API references, configuration details, and code examples for any developer technology. Use this skill whenever answering technical questions or writing code that interacts with external technologies. This includes libraries, frameworks, programming languages, SDKs, APIs, CLI tools, cloud services, infrastructure tools, and developer platforms. Common scenarios: - looking up API endpoints, classes, functions, or method parameters -...

Build and troubleshoot text entry with lynx-ui Input, TextArea, and KeyboardAware primitives, including controlled values, native filtering, selection, and keyboard avoidance.

Add DeferredComponent usage guidance, API references, example sources, and component selection routing.

Rapid development with Cloudflare Workers - build and deploy serverless applications on Cloudflare's global network. Use when building APIs, full-stack web apps, edge functions, background jobs, or real-time applications. Triggers on phrases like "cloudflare workers", "wrangler", "edge computing", "serverless cloudflare", "workers bindings", or files like wrangler.toml, worker.ts, worker.js.

Full-stack TypeScript with Vite 8, React 19, Tailwind v4, shadcn/ui, Biome, Vitest, and Hono 4. Use when setting up or working in a TypeScript project - components, styling, build and HMR, tests, lint/CI, or a Hono API with type-safe RPC.

Fan work out to subagents safely — draw provably disjoint lanes, write the full lane brief, order dependent tickets into waves, and keep the parent as the sole gatekeeper that re-runs every gate and performs every commit and tracker write. Use when parallel or batch work is explicitly authorized, when an authorized ticket range has a dependency graph, when workers share one git checkout, or when any agent or human may be writing the same tree concurrently.

Strict one-ticket TDD for implementation work — lock the Verification-command before editing, drive red-green at the highest meaningful seam production traffic actually uses, and prove the provider failure modes (duplicate and out-of-order delivery, replay, partial failure, forged payloads, wrong-tenant access) rather than assuming them. Use when implementing a Coding ticket, and whenever the change touches an external provider, a queue, a signed webhook, a billing or provisioning lifecycle, ...

Audit a whole codebase rather than a single diff — establish the boundary and baseline, sweep layer by layer (entry points, domain, data, integrations, auth, tests, ops), check every stated invariant for a real enforcement point, a failing-on-violation test, and a production signal, rank findings by blast radius, and emit each as a ticket with a Verification-command. Use when asked to audit an app or codebase, assess a project's health, review before a launch, verify that a security/performan...

Teach and quiz the user until they deeply understand something — a codebase, a PR/diff, a concept, or the current session's work. Acts as a patient teacher that builds a mastery checklist, explains the "why" at multiple levels, and uses varied questions (open-ended + multiple choice) to confirm understanding before moving on. Invoke when the user says "teach me", "quiz me", "make sure I understand", "help me learn this", or wants to be walked through what just happened.

Expert in Zod — TypeScript-first schema validation. Covers parsing, custom errors, refinements, type inference, and integration with React Hook Form, Next.js, and tRPC.

TypeScript and JavaScript expert with deep knowledge of type-level programming, performance optimization, monorepo management, migration strategies, and modern tooling.

This skill embodies the principles of \"Clean Code\" by Robert C. Martin (Uncle Bob). Use it to transform \"code that works\" into \"code that is clean.\"

Layer A interaction-mechanics reference anchored to the beui.dev catalog. Stacks on any style skill whenever work adds or changes motion or interaction — micro-interactions, animated components, transitions, gestures, hover/press/state feedback, loading/success/error morphs, 'make it feel alive'. Mandates reading the mapped beui.dev component source before designing an interaction; owns interaction mechanics and reduced-motion discipline; owns zero visual taste. Load it alongside a style skil...

Publish a finished lesson MP4 from ~/Movies/lpm-lessons/<slug>/ to the lpm YouTube channel through Chrome (YouTube Studio): search-optimized title and description with chapters, tags, category, the title-card thumbnail, Public, then added to the lesson playlist. Use when the user asks to upload, publish or post a video to YouTube.

Make a narrated lesson video about lpm from the real desktop app, recorded on a pristine data directory. Title and optional narration text in, MP4 with OpenAI voice out, audio in sync with the clicks. Use when the user asks for a video lesson, tutorial, screencast, or YouTube video about lpm.

Use when a defect, regression, intermittent failure, or performance symptom needs evidence-led reproduction and causal diagnosis before a fix; use advanced-testing-strategy to design broader test coverage.

Use when output must clear two independent adversarial reviewers before it ships — production code, published content, or any deliverable where a single self-reviewing agent shares the blind spots that produced the output. Not for internal drafts or deterministic checks (use build/test/lint pipelines for those).

Use when performing GitHub operations via `gh` for issue triage, PR and CI status, releases, Dependabot and secret-scanning alerts, GitHub Pages, or preparing a private repo for safe open-source release (strip secrets, sanitise, package). Use git-collaboration-workflow for branching, merge/rebase, or local conflicts.

Convene a four-voice council for ambiguous decisions, tradeoffs, and go/no-go calls where multiple valid paths exist and structured disagreement is more useful than a single confident answer. Not for code review, implementation planning, or architecture design — use the dedicated agents/skills for those.

Use when architecting, specifying, implementing, or auditing PMS, POS, restaurant, hotel, resort, lodge, guest-house, venue, catering, or food-service software.

Use when building, diagnosing, or modernising Java/JVM APIs, data pipelines, modular ERP, or Hibernate N+1/fetch plans with Spring Boot/Batch, Jakarta EE, transactions, tests, PostgreSQL/jOOQ, Maven/Gradle, WebLogic, Oracle JDBC, Quarkus, GraalVM, JFR, or javax-to-jakarta.persistence migration.