Skills

Plans authorized penetration tests for systems you own or are permitted to assess. Defines scope, rules of engagement, and objectives; maps the attack surface; structures phases (recon, mapping, exploitation, post-exploitation, reporting) around a framework like the OWASP Testing Guide or PTES; and specifies safe handling of findings. Emphasizes explicit authorization and non-destructive testing.

Builds disaster recovery and business continuity plans for systems and data. Defines RTO and RPO targets, maps critical dependencies, chooses backup and replication strategies, documents failover and restore procedures, and designs a testing cadence with game days. Produces a plan that balances resilience against cost and operational complexity.

Designs caching strategies across the stack to cut latency and load. Chooses cache layers (browser, CDN, application, database), picks patterns (cache-aside, read-through, write-through, write-behind), sets TTLs and eviction policies, and plans invalidation to avoid staleness and stampedes. Produces a layered plan with keys, TTLs, and invalidation rules.

Designs and implements visual regression testing for web UIs. Recommends a tooling approach (Playwright snapshots, Storybook + a diffing service, or a dedicated platform), writes screenshot tests with stable selectors and masked dynamic regions, sets sensible diff thresholds, and integrates the suite into CI with baseline management to reduce flaky failures.

Reviews applications and data flows for common privacy-regulation obligations (GDPR, CCPA/CPRA). Maps what personal data is collected, where it flows, and how long it is retained; checks for lawful basis, consent handling, data-subject rights, and third-party sharing; and produces a prioritized remediation list. Provides engineering guidance, not legal advice.

Curates high-quality datasets for supervised fine-tuning (SFT) and preference optimization (DPO/RLHF). Covers deduplication, quality filtering, formatting into chat/instruction templates, train/validation splits, label balancing, contamination checks against eval sets, and PII scrubbing. Produces clean, well-documented datasets ready for training.

Generates consumer-driven contract tests between services so that API providers and consumers stay compatible as they evolve independently. Produces Pact-style contracts, provider verification stubs, and CI wiring, and flags breaking changes before they reach production.

Designs evaluation harnesses for LLM applications, covering dataset construction, task-specific metrics, LLM-as-judge rubrics with bias controls, and regression gates. Helps teams measure quality, catch regressions across model or prompt changes, and report results with confidence intervals rather than vibes.

Reviews cloud IAM policies for least-privilege violations, overly broad wildcards, privilege escalation paths, and risky trust relationships across AWS, GCP, and Azure. Explains the risk of each finding and rewrites policies to grant only the permissions actually needed.

Designs chaos engineering experiments to validate system resilience. Defines steady-state hypotheses, blast-radius limits, fault injections (latency, errors, instance/zone loss, resource exhaustion), abort conditions, and observability checks. Produces a safe, incremental experiment plan and success criteria for game days and automated chaos.

Sets up and interprets mutation testing to measure real test-suite effectiveness beyond line coverage. Configures tools like Stryker, PIT, or mutmut, explains surviving mutants, recommends targeted tests to kill them, and tunes performance for CI. Helps teams find tests that assert nothing and coverage that lies.

Modernizes legacy codebases incrementally and safely. Establishes characterization tests to lock in current behavior, then applies the strangler-fig pattern, dependency updates, and idiomatic refactors in small verifiable steps, producing a migration plan that avoids big-bang rewrites.

Analyzes LLM usage and reduces inference cost without sacrificing quality. Covers prompt compression, context trimming, caching (prompt and semantic), model routing by task difficulty, batching, structured output to cut retries, and token accounting. Produces a concrete plan with estimated savings and quality guardrails.

Generates property-based tests that assert invariants across randomly generated inputs using frameworks like Hypothesis, fast-check, or jqwik. Identifies properties (round-trip, idempotence, invariants, oracle comparison), defines generators and shrinking, and sets up stateful testing for complex APIs. Surfaces edge cases that example-based tests miss.

Implements secure OAuth 2.0 and OpenID Connect flows including authorization code with PKCE, client credentials, and device code grants. Generates token exchange logic, refresh handling, state/nonce validation, and secure token storage. Flags common pitfalls like implicit flow usage, missing PKCE, and insecure redirect URI handling.

Designs and implements real-time services using WebSockets and Server-Sent Events. Covers connection lifecycle, heartbeats, reconnection with backoff, room/channel fan-out, backpressure, authentication on upgrade, and horizontal scaling with a pub/sub backplane. Produces production patterns for chat, live dashboards, collaborative editing, and streaming updates.

Designs routing layers that dispatch requests across multiple LLMs based on task type, difficulty, latency, cost, and reliability. Covers classifier-based and heuristic routing, fallbacks and retries across providers, quality scoring, and A/B evaluation of routing policies. Helps teams get frontier quality where it matters and cheap models everywhere else.

Designs recommendation systems end to end: candidate generation, ranking, and re-ranking. Covers collaborative filtering, content-based and embedding retrieval, two-tower models, cold-start strategies, feature stores, offline/online evaluation (NDCG, recall@k), and feedback loops. Produces an architecture and evaluation plan tailored to the product.

Helps researchers and nonprofits draft compelling grant proposals. Structures the significance, aims, methodology, timeline, and budget justification to match a funder's priorities and review criteria, tightens the narrative, and flags gaps a reviewer would penalize before submission.

Designs multi-agent systems where a coordinator delegates sub-tasks to specialist agents, verifies intermediate results, and synthesizes a final answer. Covers agent role definition, routing and delegation strategy, shared memory and message passing, verification loops, cost and latency budgeting, and failure handling across frameworks like LangGraph, CrewAI, or a custom orchestrator.

Red-teams LLM applications for prompt injection, jailbreaks, and data exfiltration risks. Generates adversarial test cases for direct and indirect injection, system prompt leakage, tool-call abuse, and unsafe output handling, then reports findings with severity ratings and concrete mitigations such as input isolation, output filtering, and least-privilege tools.