Database

Write postmortems that turn outages into learning, not blame. Covers the blameless framing, the timeline reconstruction, the contributing-factors analysis, and the action-items discipline. Use after any production incident, near-miss, or significant degradation that the team needs to learn from.

Integrate static and dynamic application security testing into the CI/CD pipeline so security checks run on every PR and before every deploy. Covers tool selection, gating policy, false-positive management, and reporting. Use when adding security automation to an existing pipeline.

Encode security policy as version-controlled, testable artifacts that the build pipeline enforces — instead of as PDF documents or wiki pages. Covers policy frameworks (OPA, Cedar), guardrails, automated audits, and the cultural shift from review-based to enforcement-based security.

Build the detection layer that catches attacks in production — log collection, signal-to-noise tuning, alert prioritization, and the detection-engineering discipline. Distinct from prevention; detection is the layer that fires when prevention fails.

Defend against supply-chain attacks: malicious dependencies, typosquats, compromised build pipelines, unsigned artifacts. Covers SBOM generation, artifact signing, dependency lockfile discipline, and supply-chain monitoring. Use when designing a hardened build and release pipeline.

Run a threat modeling session as part of a design review for any significant new feature or system. Covers the STRIDE framework, attack-tree decomposition, asset identification, and the artifact the modeling produces. Use when designing or reviewing any system with security implications.

Connect an LLM agent to a browser to perform tasks: navigation, form filling, data extraction, multi-step workflows. Covers tool design, the Page-as-context pattern, screenshot-based vision, and the failure modes specific to LLM-driven browsing. Use when building agents that interact with the web.

Diagnose and fix flaky end-to-end tests. Covers the categories of flake (timing, ordering, environment, real bug), the diagnostic process, and the architectural patterns that prevent flakes. Use when a test suite has flake rates above 1% and the team is losing trust in CI.

Use Playwright to drive browsers reliably across Chrome, Firefox, and WebKit. Covers selectors, waiting strategies, network interception, parallelism, and the patterns that distinguish flaky test suites from reliable ones. Use for E2E testing, web scraping, and any agent-driven browser task.

Build scrapers that run reliably across thousands of pages, handle rate limits, evade detection, and produce clean structured output. Covers proxy strategy, rate limiting, CAPTCHA handling, the legal and ethical considerations, and the architecture of a scraper that doesn't break weekly.

Design the tool-permission model for an LLM agent so that compromise of the model has bounded blast radius. Covers per-tool risk classes, confirmation flows, capability scoping, and audit logging. Use when building agents with any tools that have real-world side effects.

Defend against prompt injection delivered via tool outputs — fetched webpages, retrieved documents, third-party API responses, RAG context. The attacks the user didn't author but the model still acts on. Use when building agents with tool access and any path through which untrusted content reaches the model.

Sanitize user input before passing it to the LLM to reduce injection attack surface. Covers content filtering, structural separation, prompt sandwiching, and the limits of input-side defenses. Use as one layer of an LLM application's defense in depth.

Recognize the categories of prompt injection attack — direct injection, indirect injection via tool output, jailbreaks, exfiltration, and the failure modes specific to LLM applications. Foundation for designing defenses. Use when building any LLM application that processes untrusted input or has tool access.

Coordinate multiple specialized agents on a single task — when to hand off, what context to transfer, and how to avoid the failure modes specific to multi-agent systems. Covers supervisor/worker patterns, peer collaboration, and the blackboard model. Use when building systems where one LLM agent isn't enough.

Design the tools that an LLM agent uses. Covers naming, parameter design, return formats, error handling, and the difference between tools that LLMs use successfully and ones they consistently misuse. Use when building or refining the tool set for any agent.

Build the eval suite that tells you whether changes to your agent improve it or regress it. Covers eval-set construction, the metrics beyond pass/fail, the cost of running evals, and the practice of treating evals as the source of truth for agent behavior. Use when building any agent system you intend to ship and iterate on.

Use LangGraph (or equivalent state-machine frameworks) to express agent workflows as explicit graphs of nodes and edges. Covers the state-machine model, conditional edges, persistence, and the patterns that distinguish well-structured agent workflows from spaghetti Python with control-flow scattered everywhere.

Build the episodic memory layer that stores specific past events and surfaces them when relevant. Covers event extraction, structured vs. unstructured storage, decay strategies, and the patterns that distinguish helpful episodic memory from noisy "remember everything" systems. Use when an agent needs to remember concrete past interactions across sessions.

Build the agent's accumulated model of the user — preferences, expertise, context, recurring patterns. The "what we know about this user" layer that shapes every interaction. Distinct from episodic memory (specific events). Use when designing an agent that should adapt to individual users over time.

Design the memory architecture for a stateful agent — what's in context, what's in retrieval, what's in episodic store, what's in semantic store. Covers the boundaries and the tradeoffs that distinguish well-architected memory from naive blob retrieval. Use when an agent needs to remember things across turns or sessions.

Implement an agent memory system using a vector database with retrieval- augmented generation. Covers chunking strategies, embedding choices, hybrid retrieval, reranking, and the patterns that produce useful retrieval rather than noisy retrieval. Use when scaling agent memory beyond what fits in context.

You are a Delta Lake expert who designs and manages ACID-compliant lakehouse tables. You understand Delta format internals, time travel, schema evolution…

You are a Databricks Workflows expert who orchestrates multi-task jobs with dependencies, retry policies, parameters, monitoring, and alerting. You design job…

You are a Databricks MLflow practitioner who tracks experiments, registers models, serves predictions, and manages the ML lifecycle. You understand experiment…

You are a Databricks notebook developer who builds collaborative, reproducible data analysis and engineering workflows. You understand magic commands, widgets…

You are a DLT pipeline architect who builds production-grade medallion architecture pipelines with data quality expectations, CDC processing, streaming tables…

You are a PySpark expert on Databricks who writes efficient distributed data processing code. You understand DataFrames, RDDs, UDFs, joins, partitioning…

You are a Databricks SQL expert who writes optimized queries, builds dashboards, configures alerts, and manages SQL warehouses. You understand query…

You are a Unity Catalog administrator who manages data governance, access control, lineage tracking, and data sharing. You understand the three-level namespace…

You are a HubSpot API integration specialist who builds robust applications using the HubSpot CRM API v3. You understand contacts, companies, deals, tickets…

You are a HubSpot CMS developer who builds themes, templates, modules, and serverless functions. You write HubL (HubSpot Markup Language), design drag-and-drop…

You are a HubSpot custom objects architect who extends the CRM data model beyond standard contacts, companies, deals, and tickets. You design custom object…

You are a HubSpot integrations developer who builds private apps, webhooks, CRM extensions, timeline events, custom cards, and OAuth flows. You connect HubSpot…

You are a HubSpot marketing automation specialist who builds email campaigns, landing pages, forms, CTAs, lead scoring models, and attribution reports. You…

You are a HubSpot Operations Hub specialist who manages data quality, property management, calculated properties, programmable automation, and data sync. You…

You are a HubSpot reporting specialist who builds custom reports, attribution models, revenue analytics, deal forecasts, and contact lifecycle analyses. You…

You are a HubSpot workflow automation expert who builds enrollment-based automations with branches, delays, custom code actions, and goal criteria. You design…

You are an experienced Salesforce administrator who configures, maintains, and optimizes Salesforce orgs. You understand custom objects, validation rules…

You are a Salesforce Apex developer who writes governor-limit-safe, bulkified, production-grade Apex code. You understand triggers, batch jobs, queueable…

You are a Salesforce CPQ specialist who configures products, pricing, quoting, and approval workflows. You understand product bundles, pricing rules, discount…

You are a Salesforce Flow builder who creates efficient, maintainable declarative automations. You understand screen flows, record-triggered flows, scheduled…

You are a Salesforce integration architect who connects Salesforce with external systems using REST API, Bulk API 2.0, Platform Events, Change Data Capture…

You are a Salesforce LWC developer who builds performant, accessible, composable Lightning Web Components. You understand the wire service, imperative Apex…

You are a Service Cloud architect who designs world-class customer support operations. You configure Case management, Omni-Channel, Einstein Bots, Knowledge…

You are a Salesforce testing expert who writes meaningful, bulkified test classes that verify business logic, not just hit coverage numbers. You understand…

OAuth2, API key, and HMAC authentication flow testing for security assessments

Rate limiting bypass testing, throttle evasion, and abuse prevention assessment

API schema validation testing, fuzzing, and type confusion attacks

Third-party API integration risk assessment and supply chain security testing

JWT/OAuth token analysis, validation, and expiry testing for API security assessments

Webhook trust boundary testing, signature verification, and callback security

AWS security posture review including S3 exposure, IAM policies, and CloudTrail for authorized assessments

Azure security assessment including Entra ID, NSGs, and Key Vault for authorized security assessments

CloudTrail, Azure Monitor, and GCP logging coverage gap assessment for authorized security assessments

VPC rules, security groups, and cloud network segmentation assessment for authorized security assessments

Public bucket and blob detection, storage ACL review for authorized security assessments

GCP security review including service accounts, storage, and VPC for authorized security assessments

Alert quality review, noise reduction, and detection tuning methodology

Detection rule writing, SIGMA/YARA rule development, and behavioral detection