Development

Prisma Postgres setup and operations — Console, create-db CLI, Management API, and the TypeScript SDK. Use when provisioning Prisma Postgres databases, linking a local project, or integrating programmatic provisioning with service tokens or OAuth.

Full API lifecycle via the Postman MCP Server — sync OpenAPI specs to collections, generate typed clients, run API tests, create mocks, publish docs, OWASP audits. Use for Postman, collections, specs, mocks, or SDKs.

Review SQL, schemas, and migrations for PostgreSQL best practices — JSONB, arrays, ENUMs/domains, PL/pgSQL, RLS, privileges. Use when reviewing any PostgreSQL DDL, query, function, or migration.

Write, debug, and maintain Playwright tests — flaky tests, Page Object Model, locators/waits, fixtures, network mocking, auth, CI/CD. Covers E2E, component, API, visual, a11y, and extension testing.

Review code and architectures against the OWASP Top 10:2025. Use to audit for vulnerabilities, guide remediation, or write secure code. Triggers: "security review", "OWASP audit", "check for vulnerabilities", "is this code secure".

Build production-ready Node.js backend services with Express/Fastify — middleware, error handling, auth, database integration, and API design. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices.

Next.js performance optimization for Core Web Vitals, image/font optimization, caching, streaming, bundle size, and Server Components. Use when fixing LCP/INP/CLS, implementing next/image or next/font, configuring unstable_cache, converting Client to Server Components, streaming with Suspense, or reducing bundle size. Covers Next.js 16 + React 19 patterns.

Next.js App Router principles. Server Components, data fetching, routing patterns.

NestJS best practices — 40 rules across modules, DI, error handling, security, performance, testing, database, API design, microservices, and deployment. Use when writing, reviewing, or refactoring NestJS code.

Create software diagrams in Mermaid — class, sequence, flowchart, ERD, C4, state, gitgraph, gantt. Use to "diagram", "visualize", "map out", or "show the flow" of architecture, database schemas, code structure, or user/app flows.

Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states

Hunting playbook for race-condition / TOCTOU vulnerabilities — concurrent-request abuse, HTTP/2 single-packet attacks, double-redeem / double-spend, MFA-OTP & email-verify races, rate-limit bypass. Use when hunting races or TOCTOU bugs.

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

Continuous fullstack delivery loop — cycles a combined frontend+backend team through test → diagnose → fix → review → secure → re-test, building both layers together in cross-side vertical-slice waves until every E2E/suite, code-quality, visual-fidelity, and security gate is clean. Use to develop, fix, harden, or finish a feature that spans the API and the UI in one coordinated loop, instead of running the frontend and backend loops back-to-back.

Front-end system-design reference — box model, rendering/reflow, DOM & Web APIs, virtualisation, state design, network transports, web performance.

Continuous frontend delivery loop — cycles subagents through test → diagnose → fix → review → re-test until E2E and review are clean. Use to develop, fix, harden, or finish a frontend feature/epic verified by tests.

Create or update Figma Code Connect template files (.figma.ts/.figma.js) that map Figma components to code. Use for Code Connect, Figma component mapping, design-to-code.

Develop, configure, and debug Fastify (Node.js/TypeScript) servers and REST APIs — routes, plugins, JSON Schema validation, hooks, auth, serialization, performance, deployment. Triggers: Fastify, server.ts, app.ts, fastify.config.

Disciplined diagnosis loop for hard bugs and performance regressions — reproduce → hypothesise → instrument → fix → regression-test. Use when asked to diagnose/debug, something is broken or failing, or a perf regression is reported.

Write a structured retrospective of a delivery-loop run (frontend-delivery-loop, backend-delivery-loop, or fullstack-delivery-loop) that judges what went well, what went badly, where time/roundtrips/tool calls were wasted and in which skill or agent, how the agents integrated, and the session id + trace file paths — then save it as a Markdown report for skill-evolution-factory to act on. Use this the moment a delivery loop finishes (or stalls), whenever the user says "retro", "post-mortem", "...

Explains Cypress tests (E2E and component) and how Cypress works — use to understand, review, or critique tests without editing code, even if the user only says "tests". For creating or fixing tests, prefer cypress-author.

Search and extract Cypress information from official documentation (docs.cypress.io, cypress.io); prefer LLM markdown under /llm/* and refuse unverified API or behavior claims.

Creates, updates, and fixes Cypress tests (E2E and component) — use to write, add, update, or fix failing/flaky tests, even if the user only says "tests". For explaining or reviewing without edits, prefer cypress-explain.

Organize CSS using BEM, SMACSS, and CSS-in-JS patterns. Use when building scalable, maintainable styling systems with proper naming conventions.