Software Development Skills

Deep bash correctness — set -euo pipefail traps, IFS/word-splitting, trap inheritance, process substitution, array gotchas, version-gated features, ShellCheck "looks right but isn't" patterns. Load when writing or hardening non-trivial bash scripts (installers, CI, unattended ops). Skip for basic if/while/for, one-shot interactive commands, or zsh/fish/POSIX-sh work. Triggers on: "set -e not triggering", "pipefail", "trap ERR", "PIPESTATUS", "macOS bash 3.2", "shellcheck SC2086", "harden bash script", "robust bash".

Deep C operational intuition — undefined behavior, sanitizers (ASan/UBSan/TSan/MSan), hardening flags, atomics/memory ordering, fuzzing, ABI quirks. Load when diagnosing UB, configuring sanitizers or hardened builds, investigating data races, or debugging alignment/atomics. Skip for ordinary C coding, malloc/free, or syntax help. Triggers on: "undefined behavior", "strict aliasing", "AddressSanitizer", "UBSan", "Valgrind", "use-after-free", "FORTIFYSOURCE", "memoryorder", "libFuzzer", "ABI".

Deep GPU/CUDA operational intuition — nvidia-smi/dcgm fields, NCCL tuning, MIG vs MPS, NVLink/InfiniBand/GPUDirect, Nsight profiling, Xid/ECC diagnosis, Hopper/Blackwell specifics. Load when debugging cluster-level GPU issues, distributed-training hangs, multi-tenant sharing, interconnect sizing, or architecture tuning. Skip for training-loop authoring, model architecture, dataloader perf, or ROCm/Gaudi. Triggers on: "nvidia-smi", "DCGMFIPROF", "NCCLTOPOFILE", "MIG", "NVLink", "GPUDirect RDMA", "nsys", "Xid", "ECC row remapping", "TMA", "FP8", "Hopper", "Blackwell".

Dynamic Application Security Testing with two tiers: Nuclei (fast, template-based) and ZAP (deep, active scanning via Docker). Use when asked to scan for vulnerabilities, run a security scan, DAST scan, pen test the app, check for XSS/SQLi/CSRF, scan for security issues on a running app, or after deploying a local dev server. Complements threat-modeling (design-time) with runtime verification. Triggers on: vulnerability scan, security scan, DAST, pen test, penetration test, XSS, SQL injection, CSRF, "is this secure" (for running apps), "scan my app", "check for vulnerabilities", "find security issues".

Deep DL-training operational intuition — initialization, optimizer choice (AdamW/Muon/Schedule-Free), decoupled weight decay, LR schedules (cosine/WSD), μP transfer, mixed precision (bfloat16/FP8), normalization (RMSNorm, Peri-LN), NaN forensics, loss-spike rewind. Load when picking optimizer/schedule, weight-decay setup, debugging loss spikes/NaN, normalization choice, or μP transfer. Skip for architecture selection, inference/serving, or sharding topology. Pairs with pytorch. Triggers on: "AdamW", "Muon", "Schedule-Free", "decoupled weight decay", "WSD", "muP", "μTransfer", "GradScaler", "bfloat16", "FP8", "RMSNorm", "Peri-LN", "Fixup", "Mixup", "loss spike", "spike skip".

Iterative review-fix cycle that eliminates all critical issues. Runs code-reviewer, fixes critical findings, verifies tests pass, and repeats until clean or max iterations reached. Use when the user says "review and fix", "find and fix bugs", "clean up the code", "fix all issues", "review then fix", or any request that combines finding problems with resolving them automatically.

Deep Hetzner operational intuition — Cloud vs Robot vs Storage Box split, server-type taxonomy, region availability, IPv4 cost model, snapshot vs backup vs image, firewall default-deny, hcloud CLI, Floating-IP aliasing, cloud-init, Terraform provider drift. Load when sizing Hetzner resources, migrating to/from Hetzner, automating with hcloud/Terraform, or diagnosing Hetzner-specific gotchas. Skip for generic IaaS, Linux admin, or non-Hetzner clouds. Triggers on: "hcloud cli", "hcloudserver", "cax11", "cpx21", "fsn1", "hetzner robot", "primary ip cost", "without-ipv4", "vswitch", "floating ip hetzner", "storage box".

Set up strict complexity linting for any project. Detects languages, recommends linters, configures strict rules, and installs a Stop hook to enforce them automatically. Use when prompted by the SessionStart detection message, or manually to configure/reconfigure linting.

Deep SQLite operational intuition — WAL mechanics, checkpointing, fsync semantics, multi-process locking, FTS5 internals, replication (Litestream/LiteFS/rqlite). Load when diagnosing WAL, SQLITEBUSY, multi-writer concurrency, network-FS corruption, pragma tuning, or backup/replication. Skip for ordinary SQL, schema design, or basic indexing. Triggers on: "WAL mode", "walcheckpoint", "SQLITEBUSY", "busytimeout", "BEGIN IMMEDIATE", "sqlite over NFS", "FTS5 tokenizer", "Litestream", "LiteFS".

Deep Terraform/OpenTofu operational intuition — state-file mechanics and locking, refactoring blocks (import/moved/removed), lifecycle gotchas, count-vs-foreach migration, backend migration, post-1.5.5 fork divergence. Load for state surgery, refactoring blocks, lifecycle interactions, backend migration, or TF vs OpenTofu choices. Skip for ordinary resource authoring, basic HCL, "what is Terraform", or first-time provider setup. Triggers on: "terraform state mv", "import block", "moved block", "removed block", "createbeforedestroy", "force-unlock", "init -migrate-state", "OpenTofu vs Terraform", "tofu fork".

Deep TLS/openssl debugging — sclient handshake forensics, chain validation, ACME mechanics, OCSP stapling, mTLS, keystore conversion (PEM/DER/PKCS12/JKS). Load when TLS will not connect, debugging cert chains, ACME failures, OCSP stapling, mTLS setup, or keystore conversion. Skip for "what is HTTPS" or basic crypto. Triggers on: "openssl sclient", "verify error", "SNI mismatch", "OCSP stapling", "ACME challenge", "HTTP-01", "DNS-01", "PKCS12 convert", "mTLS client cert", "missing intermediate".

Deep uv (Astral Python packaging/runtime) operational intuition — project model, lockfile semantics, workspaces, PEP 735 dependency groups, [tool.uv.sources], build-isolation, managed Python, migration from pip/poetry/pipx. Load for uv workflow choices, lockfile behaviour, workspace layout, dependency-source quirks, build-isolation, or migration. Skip for ordinary Python coding, library APIs, or generic packaging primers. Triggers on: "uv lock", "uv sync --frozen", "uv.lock universal resolution", "tool.uv.sources", "dependency-groups PEP 735", "uvx", "no-build-isolation", "UVLINKMODE", "PEP 723 inline script".