Software Development Skills

Hardens Elixir/Erlang/Phoenix code and deployments and answers Zero Trust architecture questions. Use when writing or reviewing code that parses untrusted input, deserializes terms, shells out, handles secrets, compares tokens, parses XML, or makes TLS connections; when adding LiveView routes, livesession, onmount hooks, or authorization in mount/handleevent; when hardening releases, Erlang distribution, EPMD, or crash dumps; or when asked about the NSA Zero Trust Implementation Guidelines (ZIG), pillars, capabilities, activities, or technology mappings.

Use after implementation when the breadboard in shape.md may have drifted from the actual code, or when reviewing the design quality of a built system.

Use when designing or architecting Elixir/Phoenix applications, creating comprehensive project documentation, planning OTP supervision trees, defining domain models with Ash Framework, structuring multi-app projects with path-based dependencies, or preparing handoff documentation for Director/Implementor AI…

Use when developing, sharpening, or pressure-testing a strategy or strategic plan — for a business, product, startup, campaign, or personal plan; when asking "is this a real strategy", separating goals from strategy, or finding the obstacle a plan states ambitions for but never names; when a draft reads as a goal list, vision, mission, or slogan; when a user resists a direction on values grounds or keeps deferring a choice ("we'll do both later"); or for any request to apply Richard Rumelt or "Good Strategy / Bad Strategy" thinking.

Use when reviewing, rewriting, or generating HTML, CSS, or accessible frontend code. Guides DOM structure, CSS architecture, layout decisions, and accessibility patterns for clean, idiomatic, production-quality interfaces.

Use when resolving zizmor warnings in GitHub Actions workflows, hardening CI pipelines, or pinning actions to SHA hashes. Covers artipacked, template-injection, excessive-permissions, secrets-outside-env, dependabot-execution, and when to suppress vs fix.

Use when the user wants a Basecamp card fully implemented or continued in the current session (feature, bug, refactor, or review follow-up). Steers the agent to read the card as the spec, work in isolation, implement in small verified commits, update the card, open a PR, and leave evidence. Requires a card ID; optional branch name continues existing work.

Create, fix, and validate skills for AI agents. Use when user says 'create a skill', 'write a skill', 'build a skill', 'fix my skill', 'skill not working', 'analyze my skill', 'run skill analysis', 'validate skill', 'audit my skills', 'check character budget', 'create a skill from this session', 'turn this into a skill', 'make this reusable', 'can this become a skill', 'could we create a skill', 'should this be a skill', 'check if this could be a skill', or 'any reusable patterns in this session'.

Update Elixir/Phoenix dependencies safely. Use when running mix hex.outdated, updating mix.exs version constraints, handling breaking version changes, reviewing changelogs for upgrades, or verifying updates with compile and test.

Write production-grade Ash Framework code with lead-engineer precision. Use when creating Ash resources, domains, actions, policies, calculations, aggregates, or relationships. Use when porting Ecto code to Ash, refactoring existing resources, adding authorization, or building LiveView forms with AshPhoenix. Use when adding background jobs with AshOban. Triggers on "add resource", "create action", "write policy", "port to Ash", "Ash migration", "managerelationship", "oban trigger", "scheduled action", or any Ash DSL work.