Planning & Specification Workflows

Automated WCAG 2.2 accessibility audit using Playwright browser MCP to crawl every page, inject axe-core via browserevaluate, test keyboard navigation, check color contrast, ARIA labels, heading hierarchy, form labels, and focus management. Cross-references Sentry for assistive-technology-related errors, researches current WCAG guidelines via Firecrawl, and produces a structured PASS/FAIL compliance report per criterion. Works with any project — auto-detects pages from the route manifest. Use when asked to: "audit accessibility", "check a11y", "WCAG audit", "check keyboard nav", "test screen reader", "accessibility compliance", "ADA compliance check", "run a11y audit", "check color contrast", or "audit for disabilities".

Read-only audit AND decision advisor for backend/distributed-systems architecture, topology-gated so a Next.js/Supabase monolith and a Kubernetes fleet each see only relevant findings. Reports which patterns are present (maturity matrix, file:line), then — following "start simple, earn every pattern" — recommends which to adopt now, adopt-when-[trigger], or defer as premature, flagging over-engineering and the distributed-monolith anti-pattern. Covers sync request/response vs event-driven, cache-aside, database-per-service, API gateway, BFF, circuit breaker, bulkhead, outbox + CDC, saga, CQRS, hexagonal, strangler-fig, service mesh, cell-based, mTLS, tracing + SLOs, contract testing. Use when "audit backend architecture", "which pattern should I use", "am I over-engineering", "sync vs event-driven", "cache-aside/CQRS/saga/db-per-service", "microservices resilience review", or "audit-backend-architecture". Defers per-call resilience to audit-resilience; fixes via backend-patterns.

Analyse and shrink JavaScript bundle size for any web app. Auto-detects bundler (Vite, Webpack, Rollup, esbuild, Next.js, Turbopack). Runs a production build with bundle analysis, identifies the largest chunks, duplicate dependencies, non-tree-shakeable imports, and missing code-splitting or lazy-load boundaries. Researches current best practices via Firecrawl and Context7. Maps every finding to a specific file and import with before/after size estimates. Generic across any framework. Use when asked to "reduce bundle size", "analyse bundle", "tree shaking", "lazy loading", "code splitting", "slow initial load", "large JS", "chunk size", "build performance", "LCP caused by JS", "why is the bundle so big", or "first load JS too large".

Audit CI/CD pipelines (GitHub Actions) for cost, speed, and safety. Use when the GitHub Actions bill is high, when the user mentions Actions minutes, runner cost, workflow cost, slow CI, artifact/cache storage, or wants a CI/CD / workflow audit. Finds double-billing triggers, missing concurrency, macOS/large runners on push, missing path filters, long artifact retention, and doomed jobs — then proposes fixes that never delete tests or break deploys.

Review code for quality, security, and maintainability following best practices. Use when reviewing pull requests, examining code changes, auditing code quality, or when the user asks for a code review. Integrates research via Firecrawl to verify patterns against current best practices, and Sentry MCP to check if the code change relates to production errors.

Audit database schema for consistency, robustness, and industry standards. Auto-detects database type (Supabase/Postgres/MySQL), ORM (Prisma/Drizzle/Sequelize), and migration tool. Uses Supabase MCP for live schema inspection and advisors, Firecrawl for current schema best practices, and Context7 for ORM documentation. Covers naming conventions, data types, constraints, indexes, RLS policies, relationships, migrations, and security. Use when reviewing database schema design, checking naming conventions, validating constraints/indexes/ RLS policies, auditing migrations, or when the user mentions database quality, schema review, or data integrity concerns.

Audit frontend API calls against backend implementation for any project. Auto-detects API client library (axios, fetch, ky), state management (TanStack Query, SWR, Redux), and backend framework. Uses Sentry MCP for production API error data, Firecrawl for current API contract best practices, Context7 for library docs, and Supabase MCP for schema verification. Replaces hardcoded paths with auto-detected patterns. Use when reviewing frontend API integration, optimizing network requests, ensuring FE-BE contract alignment, or when the user mentions API audit, API errors, or network optimization.

Audit and fix internationalisation for any web or mobile app. Finds hardcoded user-facing strings, checks they are extracted to i18n keys, and reviews translation quality: natural tone that sounds like a real person wrote it, locale-appropriate phrasing (not literal translation), consistent voice, helpful error messages that guide rather than blame, and action labels that say what actually happens. Walks the live app in each locale via Playwright. Uses Firecrawl for i18n best practices, Context7 for library docs. Works with react-i18next, i18next, next-intl, vue-i18n, and any other library. Use when asked to "audit i18n", "fix translations", "add locale", "natural language", "translation quality", "hardcoded strings", "localisation", or "the Japanese feels like Google Translate".

Run a PDCA quality audit on LLM/AI features: traces, prompts, costs, evals, grounding, hallucination. Use for "audit LLM", "check Langfuse", "audit prompts", "check AI quality", "audit AI costs", "check traces", "audit eval scores", "verify AI pipeline".

Read-only audit for payment/money-movement systems, scope-gated so a simple Stripe-Checkout site and an in-house ledger/gateway each see only relevant findings. Checks the things that lose money or trigger PCI liability: idempotency on every mutation (double-charge on retry), double-entry append-only ledger, payment state machine (no double-capture), sync-auth vs async-webhook flow, HMAC + event-id webhook dedup, 3-way reconciliation vs PSP settlement, fraud/velocity + 3DS/SCA, multi-currency in minor units, PCI DSS v4.0.1 (never log PAN, tokens only, key rotation), and resilience (PSP timeout, partial ledger write, breaker). Uses the Stripe MCP for version-anchored provider checks when the PSP is Stripe. Use when "audit payment system", "payment gateway audit", "double charge / idempotency", "ledger / reconciliation", "webhook / 3DS / PCI", or "audit-payment-system". Defers per-call resilience to audit-resilience, PCI/secrets to audit-security, ledger schema to audit-db-schema.

Audit a full-stack app against the RealWorld ("Conduit") reference — its formal API spec, shared Bruno/Hurl E2E suite, and closest-stack reference implementation — to find what is implemented correctly, partially, or not at all across frontend, backend, and data layer. Auto-detects whether to run strict spec conformance (the repo IS a RealWorld build) or benchmark the repo's own domain against RealWorld's production-relevant patterns, and bows out cleanly on non-CRUD/non-web repos. Read-only: produces a prioritized gap report and hands remediation to other skills. Use when "audit against realworld", "compare my app to realworld", "conduit conformance", "is my full-stack app complete", "full-stack gap check", or "what's missing to reach production". RealWorld is a completeness/pattern reference, not a production bar — real hardening is delegated to audit-security / plan- skills.

Read-only audit for the non-functional "20%" AI agents systematically skip: timeouts, retries with backoff+jitter, circuit breakers, idempotency keys, rate limiting, graceful degradation/fallbacks, cancellation, audit logging on sensitive actions, and PII handling in logs. Inventories every external call, mutation, webhook, and payment path and marks each concern Implemented/Partial/Missing with file:line, severity, and the exact skill to fix it. Use when "is this production-ready", "resilience audit", "will this survive real traffic", "audit retries/timeouts/idempotency", "reliability review", "the 80% problem", or "audit-resilience". Produces a prioritized report only — remediation is delegated to backend-error-handling / backend-observability / backend-patterns / plan- skills.

Audit visual UI coherency, design token compliance, and component modularity against a design system for any project. Auto-detects CSS framework (Tailwind v3/v4, CSS Modules, Styled Components), component library (shadcn, Radix, MUI, Chakra), and icon library. Uses browser MCP tools for live visual verification, Firecrawl for current design system best practices, and Context7 for component library documentation. Use when reviewing design consistency, checking component modularity, auditing color/typography/spacing tokens, checking dark mode compliance, or when the user mentions design drift, UI inconsistency, design system compliance, visual coherency, token violations, or component architecture review. This skill focuses on VISUAL UI only — for UX evaluation (heuristics, content, interaction patterns, user flows), use the audit-ux skill instead.

Audit user experience quality using research-backed frameworks: Nielsen Norman Group's 10 usability heuristics, Intuit Content Design System for microcopy, Google's HEART metrics, and Laws of UX (Fitts's, Hick's, Miller's, Jakob's, cognitive load). Evaluates information architecture, user flows, error recovery, onboarding, content clarity, and interaction patterns. Uses browser MCP for live walkthrough, Firecrawl for current NN/g research, and Sequential Thinking for complex flows. Generic — works with any webapp. Use when evaluating usability, reviewing user flows, auditing microcopy, checking UX heuristics, assessing cognitive load, reviewing onboarding, or when the user mentions UX audit, usability review, heuristic evaluation, content audit, interaction design review, or user flow analysis. Focuses on EXPERIENCE — for visual design-system compliance (tokens, components, dark mode), use audit-uiux-design-system instead.

Cross-page UX audit for user stories, task completion, and information architecture — the layer audit-ux (per-page heuristics) doesn't cover. Derives real user stories from routes/nav/CTAs (not invented personas), scopes depth by audit trigger (KPIs dropping / complaints / redesign / pre-launch), audits IA structurally (click depth, orphan pages, dead ends, label consistency, grouping vs mental model, findability/first-click), then walks every core story end-to-end in a headed browser producing a task-completion matrix with friction logs. Evidence-disciplined: validates with analytics/funnels/drop-offs when available, otherwise marks findings as expert-judgment hypotheses — never presents taste as data. Reports impact×effort quick-wins vs roadmap. Use when "audit user flows", "user story audit", "information architecture / IA audit", "can users find X", "users get lost", "navigation audit", "funnel drop-off", "task completion", or "audit-ux-journeys". Per-page heuristics/microcopy stay with audit-ux.

Optimize database queries, schemas, and performance. Use when fixing slow queries, adding indexes, N+1 problems, schema design, RLS policies, or when user mentions "slow query", "database performance", "timeout", "index", "query optimization", "Prisma", "Supabase", or "PostgreSQL".

Implement solid error handling patterns. Use when adding error handling, improving error UX, debugging error flows, standardizing error responses, or when user mentions "error boundary", "try/catch", "error state", "toast notification", "form validation error", or "API error handling".

Instrument features so errors, traces, and logs are correlated from the first line. Use when adding logging, tracing, or monitoring; wiring Sentry, Langfuse, or structured logs; or when asked "add logging", "instrument this", "why can't I debug prod", "correlate the error to the trace", "redact PII from logs", "set up alerts/SLOs".

Implement real-time features using WebSockets, Supabase Realtime, Server-Sent Events, and live data. Use when user wants "real-time", "live updates", "WebSocket", "notifications", "chat", "collaborative", "presence", "live data", or "instant sync".

Drive a planned change to 100% coverage across an entire codebase when a prior agent run stopped early. Use whenever a refactor, migration, rename, rule-application, or sweeping edit was planned and partially executed but left incomplete — i.e. the agent "ran out of steam," forgot files, or treated the plan's file list as the full scope. Triggers on phrases like "finish the burndown", "it stopped halfway", "apply this everywhere", "complete the refactor across all files", "make sure nothing was missed", or invoking /burndown-full. Works for any plan and any task, framework-agnostic.

Close an approved plan with zero plan-related deferrals: implement every unfinished item, absorb every connected out-of-scope/follow-up/nice-to-have item parked by prior runs, fix newly exposed gaps, and run the full applicable verification ladder. Use when a plan was marked done with work deferred, or the user says "complete everything", "don't defer", "fix out of scope too", "finish the whole plan", "close every TODO", or invokes /complete-everything. Distinct from burndown-full, which proves mechanical pattern coverage; this skill closes intent, behavior, and verification gaps.

Systematically debug and fix errors using structured investigation. Use when the user asks to "debug", "fix an error", "troubleshoot", "investigate a bug", or shares an error message or stack trace.

Debug frontend-backend integration issues for any project by analyzing backend logs, identifying incorrect API calls, and fixing both sides. Auto-detects FE/BE frameworks, API style (REST/GraphQL/tRPC), and validation library. Uses Sentry MCP for production error context, Firecrawl for debugging pattern research, and Supabase MCP for data verification. Replaces hardcoded paths with auto-detected patterns. Use when diagnosing API errors, mismatched requests, integration issues between frontend and backend, or when the user mentions API 4xx/5xx errors, validation failures, or FE-BE contract mismatches.

Monitor, triage, fix, and proactively enhance Sentry error monitoring for any project. Use when asked to: check Sentry, fix Sentry errors, triage Sentry issues, run post-deploy monitoring, review production errors, clean up Sentry noise, audit Sentry setup, improve monitoring coverage, enhance error tracking, or "run sentry check". Works with any GitHub repo — auto-detects org, project, framework, and config. Fetches issues via Sentry MCP, triages them, performs root cause analysis, fixes code bugs, updates noise filters, audits the monitoring architecture, and resolves issues only after verified fixes.