Software Development Skills

Create, maintain, and run gated Go integration tests for internal APIs and service-to-service clients (HTTP/gRPC). Use for endpoint verification, contract checks with real runtime config, opt-in execution, timeout/retry safety, and integration failure triage in Go services.

Compress chaotic information into a leader-ready structure before output. ALWAYS use when the user is preparing to brief a senior leader, present a technical proposal, write a one-pager, or otherwise turn scattered facts and feelings into Frame → Crux → Nodes → Tilt + Reasoning that fits in 3–5 minutes of reading. Trigger phrases include "向领导汇报", "做技术方案 presentation", "整理思路", "report up", "brief the boss", "summarize for leadership", "executive briefing", "one-pager". NOT for writing the final polished document (use tech-doc-writer), NOT for decomposing tasks into implementation steps (use writing-plans), NOT for incident root-cause analysis (use incident-postmortem), NOT for aggregating research with citations (use deep-research).

Generate Go fuzz tests (Go 1.18+ testing.F) for specified code when users ask for fuzzing/模糊测试/fuzz test generation, parser robustness, round-trip, or differential fuzzing. Always run an applicability gate first; if the target is not suitable, explain concrete reasons and stop without writing fuzz test code.

Use when creating or refactoring GitHub Actions CI workflows for Go repositories. Covers repository-shape detection, Make-driven delegation with formal fallbacks, Go setup, caching, tool pinning, permissions, reusable workflows, and quality gate design.

Review Go code with a defect-first approach using repository policy (constitution.md first, then AGENTS.md fallback). Use for code review, PR review, quality checks, risk analysis, and regression detection.

Review Go code for error handling correctness, nil safety, and failure-path integrity including ignored errors, missing wrapping, panic misuse, SQL/HTTP resource lifecycle, and transaction patterns. Trigger when code contains error returns, panic calls, sql.Rows, transactions, HTTP client/server code, or nil-sensitive pointer operations. Use for error-handling and correctness-focused review.

Review Go code for business logic correctness, boundary conditions, off-by-one errors, state management, data flow integrity, and return value contracts. Trigger on any Go code change that modifies behavior, conditional logic, state transitions, or data processing. Use for logic-correctness focused review.

Canonical skill for Go Makefiles. Create/refactor root Makefiles for Go repositories with standardized build/test/lint/run targets, self-documenting help output, predictable artifacts, and maintainable target naming.

Review Go code for observability gaps: missing structured logging, broken trace context propagation, Prometheus cardinality explosions, span lifecycle errors, and sensitive fields in logs. Dispatched by go-review-lead as a vertical reviewer. Also trigger directly when the user says "review my logging", "check my tracing", "observability review", or "are my metrics correct".

Review Go code for code quality, style, and modern Go practices including function length, nesting depth, naming, mutable globals, interface design, receiver consistency, modern Go idioms (slog, generics, typed atomics), and static analysis. Trigger when reviewing Go code structure, readability, or maintainability. Also runs golangci-lint for automated style checks.

Orchestrate a comprehensive Go code review by triaging code changes, dispatching vertical review skills (security, concurrency, error, logic, performance, quality, test, observability) as parallel agents, then consolidating results into a unified report. Use for full Go PR review or comprehensive code review. Replaces the monolithic go-code-reviewer with focused parallel analysis.

Review Go code for security vulnerabilities including OWASP Top 10, injection, auth/authz, crypto, secrets, SSRF, XSS, and input validation. Trigger when code involves SQL, user input, authentication, HTTP handlers, TLS, crypto, secrets, or file path operations. Use for security-focused code review of Go projects.

Review Go test code for quality including table-driven tests, t.Helper usage, assertion completeness, boundary cases, benchmarks, fuzz tests, and coverage targets. Trigger when PR contains test.go files, test helpers, httptest usage, testing.B, testing.F, or testdata directories. Use for test-quality focused review.

Kafka event-driven architecture designer and reviewer. ALWAYS use when designing, reviewing, or troubleshooting Kafka-based event systems — topic design, partition strategy, consumer group configuration, event schema definition (Avro/Protobuf/JSON), idempotent consumers, dead letter queues, exactly-once semantics, Schema Registry compatibility, backpressure handling, and consumer lag monitoring. Use even for "just publish an event" — Kafka's partition-ordered-not-globally-ordered semantics, at-least-once default delivery, and consumer rebalance storms are the source of most production event-driven bugs.

Transcribe a specified local video or audio file into cleaned final .txt, .pdf, or .docx transcripts using speech recognition with Apple Silicon GPU acceleration and LLM-based proofreading. Use when the user wants text extracted from a local media file path such as .mp4, .mov, .mkv, .webm, .mp3, .m4a, or .wav, and the output language should follow the spoken language in the media automatically. Prefer this skill for local-file transcription workflows that should produce cleaned transcripts with natural paragraphs, LLM-corrected Chinese text, and simplified Chinese output for Chinese speech.

MongoDB schema migration safety reviewer and migration script generator. ALWAYS use when writing, reviewing, or planning MongoDB schema changes — field additions/removals, index builds, schema validator changes, document type migrations, shard key modifications, or any bulk update touching production collections. Covers index build lock behavior (foreground vs rolling builds), additive schema evolution, id-range batched updates, write concern tuning during migration, reshardCollection (5.0+), collMod validator changes, and rollback planning. Use even for "just add a field" — MongoDB's schema-less nature makes silent type inconsistencies and missing-field bugs harder to detect than RDBMS constraint violations.

MySQL schema migration safety reviewer and DDL generator. ALWAYS use when writing, reviewing, or planning MySQL schema changes — ALTER TABLE, CREATE/DROP INDEX, column type changes, charset conversions, data backfills, or any DDL touching production tables. Covers online DDL algorithm selection (INSTANT/INPLACE/COPY), lock-safety analysis, large-table migration with gh-ost/pt-osc, phased rollout design, replication-safe DDL, backward compatibility, and rollback planning. Use even for "simple" ADD COLUMN — MySQL DDL locking behavior is version- and operation-dependent, and mistakes cause production outages.

Oracle Database schema migration safety reviewer and DDL generator. ALWAYS use when writing, reviewing, or planning Oracle schema changes — ALTER TABLE, CREATE/DROP INDEX, column type changes, constraint additions, partition DDL, or any DDL touching production tables. Covers DDL auto-commit implications, DDLLOCKTIMEOUT, DBMSREDEFINITION for online table restructuring, ENABLE NOVALIDATE constraint patterns, global index impact from partition DDL, CTAS-based migration, ROWID-range batching, and Flashback recovery. Use even for "simple" ADD COLUMN — Oracle DDL issues implicit COMMIT before and after execution, making every DDL statement irreversible without manual rollback planning.

PostgreSQL schema migration safety reviewer and DDL generator. ALWAYS use when writing, reviewing, or planning PostgreSQL schema changes — ALTER TABLE, CREATE/DROP INDEX, column type changes, constraint additions, RLS policy changes, or any DDL touching production tables. Covers lock-level analysis, CREATE INDEX CONCURRENTLY, NOT VALID constraint patterns, transactional DDL rollback, pgrepack for table rewrites, phased rollout design, and backward compatibility. Use even for "simple" ADD COLUMN — PostgreSQL DDL lock behavior varies by operation and version, and AccessExclusiveLock on a hot table causes immediate outage.

Redis caching strategy designer and reviewer. ALWAYS use when designing, reviewing, or troubleshooting Redis caching layers — cache pattern selection (cache-aside, write-through, write-behind), TTL strategy, cache stampede/penetration/avalanche prevention, hot key handling, cache-DB consistency, distributed locking, key naming, and degradation design. Use even for "just add a cache" requests — cache invalidation is one of the two hard problems in computer science, and a naive implementation creates subtle consistency bugs that surface only under load.

Orchestrate a comprehensive US-stock investment analysis by classifying sector archetype, fetching SEC filings, dispatching six vertical equity-research skills (business model, earnings quality, balance sheet, management, industry & competition, peer comparison) as parallel agents, then synthesizing a buy/hold/sell verdict with Bull/Base/Bear target-price ranges using sector-aware thresholds and calibrated probability assignment. Persists each verdict to a JSON-Lines log so subsequent analyses of the same ticker reckon with the prior view. Use when the user asks "should I buy ", "analyze ", "is a good buy now", "美股目标价 / 估值 / 投资标的分析", "evaluate ", or any full US-equity workup. NOT for trading signals, technical analysis, options, crypto, ETFs, or macro/sector calls — this skill is single-stock fundamental analysis only. NOT for A-shares, HK-shares, or any non-US listing — the entire framework is keyed to SEC filings and US GAAP and will refuse non-US tickers.

Review a US-listed company's balance sheet health for an equity-research workup. Covers net-debt/EBITDA leverage, current ratio, cash runway, goodwill concentration and impairment history, DSO trend, inventory days, off-balance-sheet items (operating leases, contingent liabilities), and pension underfunding. Trigger when analyzing financial-statement risk at L4 of the seven-layer X-ray framework, or when assessing whether the company can survive a downturn. Dispatched by stock-analysis-lead.

Review a US-listed company's business model and revenue structure for an equity-research workup. Covers product/service mix, customer concentration, geographic exposure, industry position, revenue-growth decomposition (organic vs acquired vs price vs volume), and information-tier discipline (which numbers are facts vs management narrative). Trigger when analyzing a single US ticker's business fundamentals, when reading 10-K Item 1 "Business" and Item 1A "Risk Factors", or when the orchestrator stock-analysis-lead dispatches business review. Dispatched by stock-analysis-lead or invoked directly for business-focused analysis.

Review a US-listed company's earnings quality, cash-flow integrity, and operating leverage for an equity-research workup. Covers operating cash flow vs net income drift, free cash flow trajectory, capex character (maintenance vs expansion), equity issuance / shareholder-return yield, revenue-quality signals (receivables vs revenue growth, channel stuffing), gross-margin level and trend, operating leverage, and three-cost-rate hygiene (S&M, R&D, G&A). SaaS-specific: ARR/NRR/GRR/CAC payback/Magic Number. Trigger when analyzing financial statements at L1+L2+L3 of the seven-layer X-ray framework. Dispatched by stock-analysis-lead.