Database

Methodical debugging — reproduce, isolate, root-cause, and fix bugs using systematic techniques rather than guesswork. Use this skill when the user reports a bug, encounters an error, gets unexpected behavior, sees a stack trace, or needs help troubleshooting. Also trigger for "why is this broken," "this doesn't work," "I'm getting an error," "help me fix this," "unexpected output," or any situation where code isn't behaving as intended. Works with any language, framework, or runtime environment.

Design and implement CI/CD pipelines, Docker configurations, infrastructure-as-code, and deployment strategies. Use this skill when the user asks about CI/CD, Docker, containers, Kubernetes, deployment, infrastructure, DevOps practices, or build pipelines. Also trigger for "set up a pipeline," "Dockerize this," "deploy this app," "GitHub Actions workflow," "automate deployment," "infrastructure as code," or any task involving build automation, containerization, orchestration, or production infrastructure. Covers GitHub Actions, GitLab CI, Docker, Kubernetes, Terraform, and general DevOps principles.

Write clear, comprehensive technical documentation — API references, READMEs, architecture decision records, onboarding guides, and inline code documentation. Use this skill when the user asks to write documentation, create a README, document an API, write an ADR, explain a system, or create developer guides. Also trigger for "document this," "write a README," "API docs," "how do I explain this codebase," "onboarding guide," or any task involving technical writing for a developer audience. Adapts to any language, framework, or documentation tooling.

Convert mistakes into executable rules using a structured error-to-rule system. Covers error categorization, rule extraction, pre-decision scanning, and maintenance for continuous improvement.

Use this skill when designing or restructuring a TypeScript application that spans a React frontend and a Node backend. Activate when users mention typescript react node backend architecture, fullstack architecture, monorepo layout, API layer design, shared types, end-to-end type safety, tRPC vs REST vs GraphQL, Next.js app structure, service layering, or "where should this code live" questions in a TS codebase.

Comprehensive NestJS best practices covering architecture, dependency injection, security, performance, testing, database patterns, API design, microservices, and deployment across 40 rules prioritized by impact.

Profile, identify bottlenecks, and optimize application performance across the full stack — frontend, backend, database, and infrastructure. Use this skill when the user asks about performance optimization, slow responses, profiling, load testing, caching strategy, or resource efficiency. Also trigger for "make this faster," "this is slow," "optimize performance," "reduce load time," "memory leak," "CPU usage is high," or any task involving measuring and improving application speed, throughput, or resource consumption. Language and framework agnostic.

Systematically refactor code using safe transformation patterns — improving structure, readability, and maintainability without changing behavior. Use this skill when the user asks to refactor, restructure, clean up, simplify, decompose, or reorganize code. Also trigger for "this code is a mess," "make this more maintainable," "reduce complexity," "extract this into," "break this up," or any request to improve code structure while preserving existing functionality. Works with any language or framework.

Perform comprehensive security audits covering OWASP top 10 vulnerabilities, dependency CVEs, secrets exposure, and threat modeling. Use this skill when the user asks for a security review, vulnerability assessment, penetration test review, threat model, or security hardening guidance. Also trigger for "is this secure," "check for vulnerabilities," "security best practices," "audit this for security," or any concern about application security, data protection, or attack surface reduction. Works with any language, framework, or infrastructure.

Generate secure, optimized SQL queries with proper parameterization, input validation, injection prevention, performance optimization, and cross-database syntax awareness for PostgreSQL, MySQL, SQLite, and SQL Server.

Auto-generate comprehensive test suites — unit tests, integration tests, and end-to-end tests — for any language or framework. Use this skill when the user asks to write tests, add test coverage, create a test suite, generate specs, or anything involving automated testing. Also trigger when the user says "add tests for this," "test this function," "increase coverage," "write specs," or mentions TDD, BDD, property-based testing, or test-driven development. Detects the project's language, test framework, and conventions automatically from the codebase.

Apply version control best practices for branching strategies, commit hygiene, collaboration workflows, and repository management. Use this skill when the user asks about git workflows, branching strategies, commit message conventions, merge vs rebase, monorepo management, or wants guidance on organizing their version control for solo or team development.

Use this skill when integrating AI and machine learning features into consumer mobile apps or games, deciding between on-device and cloud inference, designing AI-driven UX, building recommendation engines, implementing AI moderation, or managing inference costs. Trigger keywords: AI, ML, machine learning, on-device, Core ML, TensorFlow Lite, recommendation engine, generative AI, AI moderation, inference cost, LLM, personalization, dynamic difficulty.

Use this skill when planning and executing a mobile app or game launch, from pre-launch preparation through soft launch, launch day, and the critical first 30 days post-launch. Covers beta testing, soft launch KPIs, press outreach, App Store featuring, and post-launch optimization. Trigger keywords: app launch, game launch, soft launch, beta test, TestFlight, pre-launch, launch strategy, App Store featuring, Product Hunt, press kit, launch day, pre-registration, app release.

Use this skill when optimizing app listings for App Store or Google Play visibility and conversion. Covers keyword research, title/subtitle optimization, screenshot strategy, ratings management, A/B testing listings, localization, and seasonal ASO. Trigger keywords: ASO, app store optimization, App Store listing, Google Play listing, app keywords, app screenshots, app ratings, app reviews, store listing optimization, app conversion rate.

Use this skill when designing virtual economies, progression systems, reward loops, or monetization structures for mobile games. Covers currency design, sink/faucet balancing, gacha mechanics, player spend segmentation, and live economy tuning. Trigger keywords: virtual currency, game economy, progression, gacha, loot box, IAP, monetization, reward loop, currency sink, whale, pay-to-win, economy balancing, pity timer.

Use this skill when planning live operations for mobile games after launch, designing content calendars, building battle passes or season passes, creating limited-time events and offers, segmenting players for targeted content, or managing update cadence. Trigger keywords: live ops, live operations, battle pass, season pass, limited-time event, content calendar, player segmentation, live service, hotfix, patch notes, live game.

Use this skill when designing analytics systems for mobile apps, selecting analytics tools, defining event taxonomies, analyzing retention and funnels, or setting up crash monitoring and attribution. Trigger keywords: analytics, events, tracking, retention, cohort, funnel, DAU, MAU, attribution, SKAN, Crashlytics, A/B testing, feature flags, mobile metrics.

Use this skill when advising on mobile app architecture, native vs cross-platform decisions, offline-first design, push notifications, deep linking, performance optimization, mobile security, or CI/CD pipelines for iOS and Android. Trigger keywords: mobile app, iOS, Android, React Native, Flutter, Swift, Kotlin, mobile architecture, offline-first, push notifications, deep linking, mobile CI/CD, Fastlane, mobile performance.

Use this skill when designing monetization strategies for mobile apps or games, including in-app purchases, subscriptions, ad monetization, paywall design, pricing psychology, and revenue optimization. Trigger keywords: monetization, in-app purchase, IAP, subscription, paywall, ad revenue, freemium, eCPM, ARPDAU, LTV, mobile ads, rewarded video, ad mediation, App Store commission, pricing strategy.

Use this skill when planning and executing mobile user acquisition campaigns, including paid UA channels, creative strategy, ROAS optimization, iOS privacy (ATT/SKAN), Android Privacy Sandbox, attribution with MMPs, UA metrics, budget allocation, and scaling spend. Trigger keywords: user acquisition, UA, mobile ads, CPI, ROAS, LTV, Apple Search Ads, Meta ads, TikTok ads, Google UAC, App Campaigns, SKAdNetwork, SKAN, ATT, AppsFlyer, Adjust, attribution, MMP, ad creative, playable ads, mobile marketing, install campaigns.

Use this skill when preparing apps for App Store or Google Play review, handling rejections, implementing privacy requirements, managing subscription compliance, or navigating platform policies. Trigger keywords: App Store review, Google Play policy, app rejection, ATT, App Tracking Transparency, privacy labels, COPPA, subscription compliance, StoreKit, Google Play Billing, app review, age rating, data safety, app store guidelines.

Use this skill when working with Airtable as a business database, designing relational data models in Airtable, building views, automations, formulas, or interfaces, or deciding between Airtable, spreadsheets, and traditional databases. Trigger keywords: Airtable, base, table, view, linked record, Airtable formula, Airtable automation, Airtable interface, relational data.

Use this skill when connecting APIs without deep coding knowledge, working with webhooks, understanding REST basics as a non-developer, handling authentication patterns, dealing with API rate limits, or using middleware tools to bridge systems. Trigger keywords: API, webhook, REST, integration, authentication, API key, OAuth, rate limit, middleware, Postman, HTTP request.

Design and implement no-code automation workflows to save time and scale operations. Covers opportunity identification, workflow design, tool selection (Zapier, Make, n8n), testing, maintenance, and ROI calculation.

Use this skill when building chatbots or AI assistants without code, designing conversation flows, creating decision trees, integrating NLU, planning human handoff, or evaluating chatbot platforms like Voiceflow, Botpress, or Chatfuel. Trigger keywords: chatbot, conversational AI, bot builder, conversation design, decision tree, NLU, intent, entity, human handoff, Voiceflow, Botpress, Chatfuel.

Use this skill when building email workflow automations, designing drip sequences, setting up behavioral triggers, planning segmentation logic, improving deliverability, running A/B tests on email, or evaluating tools like Mailchimp, ConvertKit, or ActiveCampaign. Trigger keywords: email automation, drip sequence, drip campaign, email workflow, behavioral trigger, segmentation, deliverability, A/B test email, Mailchimp, ConvertKit, ActiveCampaign, email marketing.

Optimize email workflows with inbox zero methodology, triage systems, template strategies, and communication best practices. Use this skill when the user asks about managing their inbox, writing better emails, reducing email overload, setting up email filters, or wants strategies for email communication efficiency, response time management, or inbox organization.

Design and plan smart home automation systems with a focus on reliability, interoperability, and practical daily value. Use this skill when the user asks about setting up a smart home, choosing home automation approaches, designing lighting or climate automation, integrating IoT devices, or wants advice on home automation architecture, protocols, or automation routines.

Use this skill when building internal tools with platforms like Retool, Appsmith, or similar low-code builders, creating admin panels, dashboards, CRUD apps for operations teams, or connecting internal tools to databases and APIs. Trigger keywords: internal tool, admin panel, Retool, Appsmith, Tooljet, back office, operations dashboard, CRUD app, low-code, internal app, ops tool.

Use this skill when building applications without writing code, evaluating no-code platforms like Bubble, Glide, Softr, or Adalo, designing databases for no-code apps, or planning migration from no-code to custom code. Trigger keywords: no-code, nocode, Bubble, Glide, Softr, Adalo, app builder, no-code database, visual development, citizen developer.

Use this skill when mapping business processes before automating them, learning BPMN basics, identifying automation candidates, optimizing processes, finding bottlenecks, or creating as-is vs to-be process maps. Trigger keywords: process mapping, BPMN, workflow diagram, business process, bottleneck, process optimization, as-is, to-be, automation candidate, process documentation.

Use this skill for advanced spreadsheet techniques in Google Sheets or Excel, spreadsheet automation with Apps Script, pivot tables, VLOOKUP/INDEX-MATCH, data validation, dashboard building, or deciding when to graduate from spreadsheets to databases. Trigger keywords: spreadsheet, Google Sheets, Excel, Apps Script, pivot table, VLOOKUP, INDEX MATCH, XLOOKUP, data validation, dashboard, formula, macro.

Use this skill when designing automated workflows, building trigger-action patterns, creating multi-step automations, or planning error handling and monitoring for automated processes. Trigger keywords: workflow automation, automated process, trigger action, automation ROI, monitoring alerts, orchestration, automation pipeline.

Use this skill when building integrations with Zapier or Make (formerly Integromat), designing zap or scenario architecture, working with filters, paths, data transformations, webhooks, or optimizing automation costs. Trigger keywords: Zapier, Make, Integromat, zap, scenario, webhook, integration platform, iPaaS, automation tool.

Use this skill when building or improving application security programs. Activate when users mention AppSec, SAST, DAST, IAST, secure SDLC, security champions, dependency scanning, secrets management, security testing in CI/CD, or when they need to integrate security into the software development lifecycle.

Use this skill when securing cloud infrastructure across AWS, Azure, or GCP. Activate when users mention cloud security, IAM policies, security groups, encryption at rest or in transit, cloud misconfigurations, CIS benchmarks, shared responsibility model, or hardening cloud environments.

Use this skill when navigating security compliance frameworks, preparing for audits, or building compliance programs. Activate when users mention SOC 2, ISO 27001, HIPAA, PCI DSS, compliance automation, audit preparation, evidence collection, continuous compliance, or when they need to map security controls to regulatory requirements.

Use this skill when designing or evaluating identity and access management strategies. Activate when users mention IAM, SSO, MFA, RBAC, ABAC, privileged access management, identity governance, OAuth, SAML, OIDC, authentication protocols, or when they need to control who can access what across their organization.

Use this skill when preparing for, detecting, responding to, or recovering from security incidents. Activate when users mention incident response, IR playbooks, breach handling, containment, eradication, NIST IR framework, severity classification, post-incident reviews, or communication during security events.

Design and implement privacy-preserving systems and practices that protect user data while enabling legitimate business functions. Use this skill when the user asks about data privacy, implementing privacy by design, data minimization, consent management, anonymization techniques, or wants guidance on building systems that respect user privacy.

Use this skill when building, improving, or evaluating security awareness programs. Activate when users mention security training, phishing simulations, security culture, social engineering awareness, security policies, measuring security awareness, or building a human-centric security program.

Use this skill when building, managing, or improving security operations capabilities. Activate when users mention SOC operations, SIEM configuration, log management, alert triage, detection engineering, security monitoring, threat hunting, or building a security operations center from scratch.

Use this skill when identifying, analyzing, and prioritizing threats to systems, applications, or infrastructure. Activate when users mention threat modeling, STRIDE, DREAD, attack trees, trust boundaries, asset classification, or when they need to systematically evaluate what can go wrong with their architecture.

Use this skill when establishing or improving vulnerability management programs. Activate when users mention vulnerability scanning, CVE tracking, patch management, risk-based prioritization, CVSS scoring, vulnerability disclosure, remediation SLAs, or when they need to systematically reduce their attack surface.

Use this skill when designing or evaluating zero trust architectures, implementing identity-centric security, or moving away from perimeter-based models. Activate when users mention zero trust, never trust always verify, micro-segmentation, BeyondCorp, least privilege access, identity-aware proxies, or implementation roadmaps for zero trust.

When you add AI features to your application — chatbots, RAG search, AI-powered actions — you introduce an entirely new class of vulnerabilities. Prompt…

AI-generated auth code is the most dangerous code in your application. It produces JWTs with no expiry, stores tokens in localStorage (XSS-accessible), skips…

AI-generated Dockerfiles run everything as root, use latest tags, embed secrets in environment variables, install unnecessary tools, and skip health checks.…

AI-generated code loves hardcoded secrets. API keys inline, database passwords in config files, tokens committed to git. The AI doesn't understand that the…

AI-generated database code is functionally correct and almost always insecure. It concatenates strings into SQL queries, connects as root, skips TLS, and…

AI coding tools install packages without thinking. "Add a date library" becomes npm install moment — a 4.2MB package with known vulnerabilities, when date-fns…

AI-generated error handling is designed for debugging, not production. It returns full stack traces to the client, logs passwords in request bodies, exposes…

AI-generated code trusts user input by default. It parses JSON without schema validation, builds queries from URL parameters, accepts file uploads without…

AI coding tools default to "make it work" — and the fastest way to make it work is to grant full access everywhere. Admin IAM roles, root database users…

AI gets your application running. This checklist gets it running safely. Every item here has been found missing in production AI-generated codebases. Work…

Most teams treat security scanning as a CI/CD gate — a check that runs after the code is pushed. By then, the vulnerability is committed, the secret is in git…

AI-generated APIs work great in demos and fall apart in production. They return too much data, accept requests from anywhere, have no rate limits, and use JWTs…

AI-generated file handling code accepts any upload, stores it in the web root, serves it with the original filename, and never validates the content. A user…

The most common vulnerability in AI-generated code isn't SQL injection or XSS — it's trust misconfiguration. Code that assumes everything is fine. Open CORS…