Automated WCAG 2.2 accessibility audit using Playwright browser MCP to crawl every page, inject axe-core via browser_evaluate, test keyboard navigation, check color contrast, ARIA…
Read-only check that a codemod or bulk transform preserved behavior — compiling is not proof. Use when "did this codemod break anything", "audit this bulk refactor", or before…
Post-deploy smoke test combining all 5 MCPs (Sentry + Supabase + Langfuse CLI + Playwright + Firecrawl) into one workflow.
Artistic, research-grounded UI enhancement skill for making an existing page feel intentional, spacious, and human-crafted.
Full end-to-end Mushi Mushi integration smoke test: bug capture → AI triage → story mapping → TDD test generation → approval → execution → PDCA cycle.
Systematically debug and fix errors using structured investigation. Use when the user asks to "debug", "fix an error", "troubleshoot", "investigate a bug", or shares an error…
Audit and fix internationalisation for any web or mobile app. Finds hardcoded user-facing strings, checks they are extracted to i18n keys, and reviews translation quality: natural…
Plan-only pricing audit: value metric, tiers, price points, free-tier boundary, annual and enterprise anchors, and a willingness-to-pay study.
Design and run a k6/Artillery load profile that measures throughput, latency percentiles, error rate, and the breaking point under concurrent traffic.
Create distinctive, production-grade frontend interfaces. Use when building web components, pages, dashboards, or beautifying UI. Avoids generic AI aesthetics.
Exhaustive audit for stubs, dead buttons, fake/placeholder components, unwired handlers, dead links, orphans, and severed integrations — produces a burndown and wiring plan with…
First-contact orientation for an unfamiliar codebase. Reads package manifests, entry points, routing, data layer, auth, environment variables, and recent git history.
Read-only audit of app-layer auth: route×gate matrix, session lifecycle, OAuth, provider traps (getSession vs getUser, middleware-only gates, CVE-2025-29927).
Cross-page UX audit for user stories, task completion, and information architecture — the layer audit-ux (per-page heuristics) doesn't cover.
Take the local working tree to a merge-ready PR against main: review, split if needed, commit, push, open the PR, drive CI green; never merge.
Audit and fix how easily content is understood: line length (CPL), reading level, grouping, deadspace, icons or tables that cut verbosity.
Close the PDCA loop on the work you just did. After implementing changes, drive the LIVE app on localhost through the Playwright browser MCP like a real end user — manually, not…
Complete bug-fix lifecycle in one sweep: triage production signals (Sentry / logs) → reproduce → fix (debug-error) → verify full-stack (test-playwright) → PR (workflow-pr) →…
Take a shipped repo to market: plan-gtm audit and interview, approval, then measure, message, activate, get found, launch, and a weekly loop.
Read-only audit of CI gate logic: silent bypass, ratchet gaming, required-but-not, duplicate gates. Use when "can CI be bypassed" or "why did a regression pass CI".
GENERIC webapp QA fallback — use ONLY when no project-specific QA skill applies (66ai-user-story-testing for 6-6 AI, sbc-qa-data-integrity-audit/sbc-pdca-audit for 一人社長,…
End-to-end feature build workflow: spec → TDD → implement → smoke test → PR. Sequences workflow-spec-tdd, test-unit, test-playwright, and workflow-pr into a single tracked loop.
Pre-release quality gate that sequences test-red-team, audit-security, audit-bundle-size, audit-performance, and test-unit into a single sweep.
Weekly go-to-market review for a shipped product: funnel by source, activation cohort, top drop-off, launch results, then one experiment and one post, scorecard row appended.
Plan-only dead-code audit: Knip baseline for unused files, exports, and deps, plus duplication, debug residue, suppressions, orphan assets, env drift. Deletes nothing.
Install guardrails-as-code into a repo so AI/vibe-coding can't keep reintroducing the same classes of problems (leaked secrets, injection, off-system styles, untested code,…
Read-only audit for the non-functional "20%" AI agents systematically skip: timeouts, retries with backoff+jitter, circuit breakers, idempotency keys, rate limiting, graceful…
Audit an existing app's design system and current motion, then apply coherent, performant, accessible motion using the right-sized 2026 stack — CSS/tw-animate-css for utility…
Enforce architecture boundaries in CI with dependency-cruiser or eslint-boundaries: layer direction, feature isolation, forbidden imports.
Read-only audit of product-analytics instrumentation: event taxonomy, funnel completeness, consent-gated firing, dead/duplicate/phantom events.
Write honest "X vs Y", "alternatives to X", and "migrate from X" pages from verified facts, each unique and dated for review.
Audit a full-stack app against the RealWorld ("Conduit") reference — its formal API spec, shared Bruno/Hurl E2E suite, and closest-stack reference implementation — to find what is…
Add growth loops to a live product: a "powered by" badge, shareable artifacts, invites and referral credit, each with K-factor events.
Polish an existing React Native screen to feel intentional, native, and human-crafted. Catches RN-specific silent failures — safe area violations, sub-minimum touch targets,…
Audit dependencies for hallucinated or slopsquatted packages, supply-chain risk, and licensing/provenance gaps, then produce a phased remediation plan.
Prevent browser automation from freezing, getting stuck, or waiting excessively during page navigation and interaction.
Read-only audit for payment/money-movement systems, scope-gated so a simple Stripe-Checkout site and an in-house ledger/gateway each see only relevant findings.
Audit-first skill for elevating an existing website or web app with 3D and cinematic motion — Three.js / React Three Fiber for the scene, GSAP ScrollTrigger for scroll-driven…
Lifecycle email from product events: activation nudges, trial expiry by activated vs stalled, limit-reached upgrades, win-back, with exits and consent.
Add or upgrade PWA features to any web app: service worker, offline mode, install prompt, push notifications, and background sync.
Copy-not-move organizer for document trees: hash inventory, dry run, labeled copies, search catalog, verify every source survived.
Apply cohesive visual themes to artifacts (slides, docs, landing pages). Provides 11 pre-set themes with colors/fonts.
Plan and execute a disciplined feature-flag rollout for any app. Detects existing flag infrastructure (LaunchDarkly, Flagsmith, GrowthBook, Unleash, PostHog, or custom env-var…
Audit CI/CD pipelines (GitHub Actions) for cost, speed, and safety. Use when the GitHub Actions bill is high, when the user mentions Actions minutes, runner cost, workflow cost,…
Split current work into small reviewable PRs. Use when the user asks to split a chat, set of changes, branch, or PR. — from kensaurus/cursor-kenji
Build MCP (Model Context Protocol) servers that give LLMs access to external services and APIs. Use when building MCP servers, integrating external APIs, or creating tools for AI…
Activation pass: define the activation event, cut steps to first value, add templates, sample data, a short checklist, and signup → activated events.
Read-only audit of mobile IAP and subscriptions — StoreKit 2, Play Billing, or RevenueCat — for server receipt validation, restore, lifecycle sync, grace periods, and…
Close the post-launch improvement loop for any shipped app. Pulls Sentry for top errors and performance regressions, Supabase for slow queries, failed API calls, and advisor…
OWASP Top 10 security audit with Supabase-first methodology — RLS pass, bundle/secret scan, auth-path tracing, dependency CVEs. Plan only, no patches or destructive testing.
Audit every trust boundary for unvalidated input, injection, and forged-request gaps, then produce a phased hardening plan.
Audit and fix transactional/marketing deliverability — SPF, DKIM, DMARC, reputation, bounce/complaint handling, list hygiene, unsubscribe compliance — so mail lands in the inbox.
Optimize database queries, schemas, and performance. Use when fixing slow queries, adding indexes, N+1 problems, schema design, RLS policies, or when user mentions "slow query",…
Create museum-quality visual art in .png and .pdf formats using design philosophy. Use when user asks for poster, visual design, infographic, certificate, badge, banner, social…
Create or review a SKILL.md file. Use when writing a new skill, auditing an existing one, or unsure how to structure skill content.
Comprehensive repo housekeeping: update stale READMEs to match current architecture, remove dead files (logs, screenshots, deprecated code, build artifacts), update npm/pip/cargo…
Generative, NN/g-grounded page enhancement skill. Given a route, screen, or component, it produces concrete, design-system-compliant code changes that replace generic,…
Resolve an in-progress git merge or rebase conflict by tracing each side back to its original intent.
Audit a Supabase/Postgres project for Row-Level Security and access-control gaps, then produce a phased remediation plan.
User-story-driven test coverage audit and plan — no test writing in this pass. Derives stories from real code, builds story-to-test traceability matrix, detects fake-green and…