Skills

Decodes and reviews JSON Web Tokens and their surrounding auth flow for correctness and security. Explains header and claims, checks algorithm and key handling, validates expiration and audience/issuer claims, and flags common pitfalls such as the alg:none attack, weak secrets, missing validation, and over-long token lifetimes. Never treats token contents as trusted secrets to echo back.

Inspects messy tabular data and produces a repeatable cleaning plan plus code. Detects and fixes common issues: inconsistent types, duplicate rows, missing values, malformed dates, mixed encodings, whitespace and casing problems, and outliers. Outputs pandas or Polars code, a summary of changes, and a validation checklist.

Reviews claims in a document for accuracy and verifiability. Extracts discrete factual statements, rates each as supported, unsupported, or needs-verification, flags logical inconsistencies and unsourced numbers, and suggests what evidence would confirm or refute each claim. Designed to reduce hallucinated or outdated facts before publishing.

Builds structured competitive analyses from public information. Maps competitors across positioning, pricing, features, target segments, and go-to-market motion; produces feature-comparison matrices and SWOT summaries; and highlights differentiation gaps and opportunities. Emphasizes citing sources and separating verified facts from inference.

Designs surveys that produce reliable, unbiased data. Turns research goals into clear questions, chooses appropriate scales and response types, avoids leading and double-barreled wording, orders questions to reduce bias, and plans screening and branching logic. Outputs a ready-to-field questionnaire with an analysis plan for each question.

Generates and refactors dbt models for analytics engineering. Writes staging, intermediate, and mart models following layered conventions, adds schema.yml tests and descriptions, applies incremental and materialization strategies, and structures sources and refs correctly. Produces SQL plus YAML that fits dbt best practices and is ready to run.

Turns customer results into a persuasive, credible case study. Structures the story as challenge, solution, and measurable results, weaves in quotes and concrete metrics, keeps claims verifiable, and ends with a clear call to action. Produces a publish-ready draft plus a one-paragraph summary and pull-quote suggestions.

Translates requirements and user stories into behavior-driven development scenarios in Gherkin. Writes clear Given/When/Then steps, covers happy paths, edge cases, and negative cases, uses scenario outlines with examples for data-driven tests, and keeps steps declarative and reusable. Optionally scaffolds step definitions for Cucumber or Behave.

Produces structured test plans for features and releases. Defines scope and objectives, derives test cases from requirements and acceptance criteria, covers functional, edge, negative, performance, and accessibility cases, sets entry/exit criteria, and maps risk to test priority. Outputs a clear plan with a traceability matrix linking tests to requirements.

Builds discovery and usability interview guides that surface real insight. Translates research questions into open, non-leading prompts, sequences warm-up to deep-dive topics, adds follow-up probes, and applies techniques like the "five whys" and past-behavior questions. Outputs a timed guide with a consent intro and a synthesis template for notes.

Produces operational runbooks for services and common incidents. Documents prerequisites, step-by-step diagnosis and remediation, exact commands, verification checks, rollback steps, and escalation paths. Structures each runbook so an on-call engineer can follow it under pressure, and keeps destructive steps clearly flagged with safeguards.

Sets up and maintains Git hooks for a repository. Recommends a manager (Husky, Lefthook, or pre-commit), wires up pre-commit and commit-msg hooks for linting, formatting, type checks, secret scanning, and conventional-commit validation, and keeps hooks fast with staged-file filtering. Produces config plus a short contributor guide.

Designs and implements rate limiting for APIs and services. Recommends an algorithm (token bucket, leaky bucket, fixed or sliding window) for the use case, defines per-key and per-endpoint limits, plans distributed enforcement with Redis, and specifies response headers and 429 handling with retry-after. Produces a design plus reference implementation.

Turns reliability goals into concrete SLIs, SLOs, and error budgets. Helps choose the right service level indicators, set realistic targets from historical data, compute burn rates, and design multi-window multi-burn-rate alerting so teams get paged before the budget is exhausted.

Models complex application logic as explicit finite state machines and statecharts. Identifies states, events, guards, and side effects; prevents impossible states; and generates implementations (e.g., XState-style) with diagrams. Ideal for wizards, checkout flows, connection lifecycles, and any feature where implicit boolean flags cause bugs.

Advises on how to evolve APIs without breaking clients. Compares versioning strategies (URI, header, media-type), classifies changes as breaking or non-breaking, and produces deprecation timelines, migration guides, and compatibility shims so teams can ship changes safely.

Writes reusable, well-structured Terraform modules with clean input/output interfaces, sensible defaults, validation rules, and examples. Covers module composition, variable typing and validation, remote state and backends, provider version pinning, and testing with terraform validate/plan and tools like Terratest. Emphasizes least-privilege IAM and safe defaults.

Builds cross-browser extensions on Manifest V3 with background service workers, content scripts, popup and options UIs, and message passing. Covers permissions scoping, storage sync, context menus, and store submission requirements for Chrome, Edge, and Firefox. Emphasizes least-privilege permissions and secure content-script isolation.

Builds robust webhook producers and consumers. Covers signature verification, idempotency keys, retry with exponential backoff, dead-letter handling, event ordering, and replay endpoints, and generates handler code plus tests so integrations survive duplicates and outages.

Scans code, configuration, and git history for leaked credentials such as API keys, tokens, private keys, and connection strings. Classifies findings by severity and false-positive likelihood, and provides safe remediation steps including rotation, history scrubbing, and pre-commit prevention.

Writes end-to-end UI tests with Playwright or Cypress that mirror real user journeys. Covers resilient selectors (roles/test-ids), network stubbing, auth setup, fixtures, waiting strategies that avoid flakiness, visual and accessibility assertions, and CI integration. Produces maintainable specs and a page-object structure.