Skills

Turns customer results into a persuasive, credible case study. Structures the story as challenge, solution, and measurable results, weaves in quotes and concrete metrics, keeps claims verifiable, and ends with a clear call to action. Produces a publish-ready draft plus a one-paragraph summary and pull-quote suggestions.

Plans authorized penetration tests for systems you own or are permitted to assess. Defines scope, rules of engagement, and objectives; maps the attack surface; structures phases (recon, mapping, exploitation, post-exploitation, reporting) around a framework like the OWASP Testing Guide or PTES; and specifies safe handling of findings. Emphasizes explicit authorization and non-destructive testing.

Translates requirements and user stories into behavior-driven development scenarios in Gherkin. Writes clear Given/When/Then steps, covers happy paths, edge cases, and negative cases, uses scenario outlines with examples for data-driven tests, and keeps steps declarative and reusable. Optionally scaffolds step definitions for Cucumber or Behave.

Generates candidate names for products, features, projects, or companies against a clear brief. Explores naming styles (descriptive, evocative, coined, compound), checks each for pronounceability and unwanted meanings, and suggests domain and handle patterns to verify. Returns a shortlist with rationale rather than an undifferentiated list.

Helps make and document structured decisions. Elicits the options and the criteria that matter, assigns weights, scores each option, computes a weighted result, and runs a quick sensitivity check to show how robust the recommendation is. Produces a clear matrix plus a short written rationale suitable for an ADR or decision log.

Generates and refactors dbt models for analytics engineering. Writes staging, intermediate, and mart models following layered conventions, adds schema.yml tests and descriptions, applies incremental and materialization strategies, and structures sources and refs correctly. Produces SQL plus YAML that fits dbt best practices and is ready to run.

Reviews applications and data flows for common privacy-regulation obligations (GDPR, CCPA/CPRA). Maps what personal data is collected, where it flows, and how long it is retained; checks for lawful basis, consent handling, data-subject rights, and third-party sharing; and produces a prioritized remediation list. Provides engineering guidance, not legal advice.

Designs and implements visual regression testing for web UIs. Recommends a tooling approach (Playwright snapshots, Storybook + a diffing service, or a dedicated platform), writes screenshot tests with stable selectors and masked dynamic regions, sets sensible diff thresholds, and integrates the suite into CI with baseline management to reduce flaky failures.

Designs and implements rate limiting for APIs and services. Recommends an algorithm (token bucket, leaky bucket, fixed or sliding window) for the use case, defines per-key and per-endpoint limits, plans distributed enforcement with Redis, and specifies response headers and 429 handling with retry-after. Produces a design plus reference implementation.

Helps turn a game concept into a structured game design document. Captures the core loop, mechanics, progression, economy, controls, level structure, art and audio direction, and target platform and audience. Keeps scope realistic, flags dependencies and risks, and produces a living GDD that a small team can build from.

Reviews claims in a document for accuracy and verifiability. Extracts discrete factual statements, rates each as supported, unsupported, or needs-verification, flags logical inconsistencies and unsourced numbers, and suggests what evidence would confirm or refute each claim. Designed to reduce hallucinated or outdated facts before publishing.

Turns analysis results into a clear narrative for a specific audience. Selects the key message, orders findings for impact, recommends the right chart for each point, writes plain-language takeaways, and frames actionable recommendations. Helps analysts move from raw numbers to a memo or slide narrative executives can act on.

Models complex application logic as explicit finite state machines and statecharts. Identifies states, events, guards, and side effects; prevents impossible states; and generates implementations (e.g., XState-style) with diagrams. Ideal for wizards, checkout flows, connection lifecycles, and any feature where implicit boolean flags cause bugs.

Designs data quality checks for tables, pipelines, and warehouses. Generates expectation suites covering schema conformance, null and uniqueness constraints, referential integrity, freshness, and statistical drift, then wires them into pipelines so bad data is caught before it reaches dashboards or models.

Designs routing layers that dispatch requests across multiple LLMs based on task type, difficulty, latency, cost, and reliability. Covers classifier-based and heuristic routing, fallbacks and retries across providers, quality scoring, and A/B evaluation of routing policies. Helps teams get frontier quality where it matters and cheap models everywhere else.

Designs recommendation systems end to end: candidate generation, ranking, and re-ranking. Covers collaborative filtering, content-based and embedding retrieval, two-tower models, cold-start strategies, feature stores, offline/online evaluation (NDCG, recall@k), and feedback loops. Produces an architecture and evaluation plan tailored to the product.

Generates consumer-driven contract tests between services so that API providers and consumers stay compatible as they evolve independently. Produces Pact-style contracts, provider verification stubs, and CI wiring, and flags breaking changes before they reach production.

Designs and scaffolds ergonomic command-line tools with subcommands, flags, config files, shell completions, and helpful error output. Covers argument parsing conventions, exit codes, stdin/stdout piping, colored output, progress indicators, and cross-platform packaging. Produces maintainable CLIs that follow POSIX conventions and feel great to use.

Implements secure OAuth 2.0 and OpenID Connect flows including authorization code with PKCE, client credentials, and device code grants. Generates token exchange logic, refresh handling, state/nonce validation, and secure token storage. Flags common pitfalls like implicit flow usage, missing PKCE, and insecure redirect URI handling.

Adds production-grade observability to a codebase by instrumenting it with structured logs, metrics, and distributed traces. Recommends span boundaries, cardinality-safe labels, and OpenTelemetry conventions, then generates the wiring code and dashboards needed to make a service debuggable in production.

Turns strategy into well-formed Objectives and Key Results. Coaches on ambitious yet measurable objectives, outcome-based (not output-based) key results, leading vs lagging indicators, alignment across teams, and quarterly cadence with check-ins and scoring. Flags common anti-patterns like task lists disguised as OKRs.