Software Development Skills

Generate one "Implement Block X" GitHub issue per Spec Kit tasks.md PR-stack block, with a minimal body pointing at tasks.md as the source of truth.

Apply core engineering principles to design and review decisions — KISS (simple over complex), YAGNI (only what's needed now), DRY (single source of truth, never copy-paste), OOP and SOLID (single responsibility first), no magic (explicit over implicit), small commits, prefer libraries over reinvention, no backwards-compatibility shims, automate quality checks in CI, investigate root causes instead of masking symptoms, and fail fast (assertions, strict validation, early returns). Use when designing a new feature, reviewing a PR, choosing between alternative implementations, judging whether a design is overengineered or shortsighted, or evaluating tradeoffs in architecture decisions. Activates alongside designing-architecture and reviewing-changes.

Apply Go project conventions — Go 1.25.x toolchain pinned via toolchain directive and GOTOOLCHAIN=local, vendored deps via go mod vendor, golangci-lint v2 strict (~50 enabled linters), gofmt + goimports, gosec + semgrep + govulncheck + CodeQL static analysis, race-detector + fuzz-capable testing, reproducible-build flags (-trimpath, -buildid=) for TEE-attested binaries, cmd/ + internal/ + pkg/ layout, stdlib-first dependencies (log/slog, net/http, google/uuid, google.golang.org/protobuf). Use when starting a Go project, writing or reviewing Go code, configuring Go tooling, doing TEE-attested or reproducible builds, or evaluating compliance with these defaults. Co-activates with running-tdd-cycles, reviewing-changes, and engineering-philosophy.

Implement one Spec Kit tasks.md PR-stack block end-to-end — TDD + review + draft PR + CI fix loop.

Drive spec-driven project management via GitHub Issues — decompose a feature into dependency-linked task issues, label them ready / blocked / epic / in-progress, track progress, unblock downstream tasks as upstream ones close. Use when planning a new feature with multiple tasks, creating issues from a plan, picking up a ready task, checking what's ready to work on, closing a batch, or asking for project status. Each task is sized for one TDD cycle and links to blockers via "Blocked by: N" lines. Tool access is scoped to gh issue / gh label / gh pr / git checkout-branch only — no force-push, no gh repo deletions, never closes a PR or merges on the user's behalf. Echoes any state-changing gh command back to the user before running it. Composes with designing-architecture (produces the plan), running-tdd-cycles (executes one task), committing-changes (closes a task with a PR).

Run a layered quality gate over a code change — code quality, security audit, and architecture consistency, in that order. Use after writing or modifying code, before opening or merging a PR, when reviewing a diff or branch, or when asked for a code review, security audit, or architecture review. Produces severity-ranked findings (Critical / Major / Minor) tied to file:line, each with a concrete fix. Covers OWASP Top 10, SOLID, KISS / YAGNI / DRY, ruff + mypy for Python, golangci-lint for Go, solhint for Solidity, and common perf pitfalls (N+1, unbounded loops, leaks, missing indexes). For diffs over ~500 lines or 20 files, scopes the linter sweep to touched packages first and widens on demand. Read-only: never edits the diff, never runs unscoped Bash — every tool is a fixed command pattern (Bash(git diff ), Bash(uv run ruff ), Bash(golangci-lint )). Composes with python-conventions, go-conventions, solidity-conventions, engineering-philosophy.

Drive strict red-green-refactor TDD discipline for any code change. Use when a user requests test-driven development, asks to write a failing test first, wants to add a feature one requirement at a time, or invokes a phase like red, green, or refactor. Coordinates failing-test generation, minimal implementation, and refactor-with-safety-net for Python (pytest), JS/TS (Jest/Vitest), Go (testing/T), Java (JUnit), Ruby (RSpec), Rust (cargo test), and Solidity (forge). Enforces test-first ordering, fails-for-the-right-reason verification, and refactor-only-when-green gating. Composes with python-conventions, go-conventions, solidity-conventions, and engineering-philosophy.

Apply shell-command discipline for agent invocations — one command per call (no &&, ;, or inline cd dir && cmd chains), no inline env vars (VAR=value cmd), and gh auth login or gh auth switch for GitHub auth (never prefix with GHTOKEN=...). Use when invoking Bash commands as part of an agent workflow, writing shell snippets in a procedure, or reviewing how an agent issues shell commands. Prerequisites: a POSIX shell (bash or zsh); for the GitHub-auth rule the gh CLI must be installed and authenticated. Failure modes covered: gh auth login fails (re-run interactively, then gh auth status to verify), commands that need elevated privileges (set up the privilege separately rather than prefixing with sudo inline). Improves readability, atomicity, and permission auditability since each command becomes one auditable tool call instead of an opaque chain. Composes with every workflow skill that issues shell commands.

Apply Solidity project conventions — Foundry only (forge, cast, anvil, chisel; no Hardhat or Truffle), forge fmt with sortimports, solhint:all strict (--max-warnings=0 --noPoster) extending compiler-version ^0.8.22, fuzz tests via Foundry's built-in fuzzing, invariant tests via forge-std/StdInvariant.sol with handlers, gas snapshots via forge snapshot, coverage via forge coverage --report lcov, and script/Scratch.s.sol or chisel for scratch (never inline forge script heredocs). Use when starting a Solidity project, writing or reviewing Solidity contracts and tests, configuring Foundry or solhint, or evaluating compliance with these defaults. Co-activates with running-tdd-cycles, reviewing-changes, and engineering-philosophy.