Skills

Designs low-risk secret rotation for applications and agents, covering inventory, overlapping credentials, automation, audit evidence, emergency revocation, and rollback.

将陌生的代码仓库整理成简明的工程指南，涵盖架构、约定、本地设置、关键执行路径和低风险的首次贡献。

Evaluates retrieval quality for search and RAG systems using grounded test sets, relevance metrics, failure taxonomy, chunking experiments, and actionable remediation.

Diagnoses failing browser and end-to-end tests by correlating assertions, traces, screenshots, network activity, timing, and application state into reproducible fixes.

Converts product safety requirements into practical agent and LLM policies with abuse cases, escalation paths, safe defaults, audit events, and acceptance criteria.

Converts a loosely defined opportunity into testable product requirements, user journeys, scope boundaries, assumptions, risks, success metrics, and discovery questions.

按照实用的无障碍要求审查产品界面，覆盖语义结构、键盘操作、焦点行为、颜色对比度、屏幕阅读器和表单。

Turns merged work, pull requests, issues, and user-visible behavior changes into accurate, audience-specific release notes with breaking-change and upgrade guidance.

Designs and implements secure, ergonomic Model Context Protocol servers with precise tool schemas, transport selection, authentication boundaries, error contracts, and tests.

Designs surveys that produce reliable, unbiased data. Turns research goals into clear questions, chooses appropriate scales and response types, avoids leading and double-barreled wording, orders questions to reduce bias, and plans screening and branching logic. Outputs a ready-to-field questionnaire with an analysis plan for each question.

Designs caching strategies across the stack to cut latency and load. Chooses cache layers (browser, CDN, application, database), picks patterns (cache-aside, read-through, write-through, write-behind), sets TTLs and eviction policies, and plans invalidation to avoid staleness and stampedes. Produces a layered plan with keys, TTLs, and invalidation rules.

Writes conversion-focused ad copy for search, social, and display. Crafts headlines and descriptions within platform character limits, leads with a clear benefit and hook, matches message to audience and funnel stage, and produces multiple variants for A/B testing. Keeps claims honest and includes a strong, specific call to action.

Helps make and document structured decisions. Elicits the options and the criteria that matter, assigns weights, scores each option, computes a weighted result, and runs a quick sensitivity check to show how robust the recommendation is. Produces a clear matrix plus a short written rationale suitable for an ADR or decision log.

Plans authorized penetration tests for systems you own or are permitted to assess. Defines scope, rules of engagement, and objectives; maps the attack surface; structures phases (recon, mapping, exploitation, post-exploitation, reporting) around a framework like the OWASP Testing Guide or PTES; and specifies safe handling of findings. Emphasizes explicit authorization and non-destructive testing.

Generates and refactors dbt models for analytics engineering. Writes staging, intermediate, and mart models following layered conventions, adds schema.yml tests and descriptions, applies incremental and materialization strategies, and structures sources and refs correctly. Produces SQL plus YAML that fits dbt best practices and is ready to run.

Designs and implements rate limiting for APIs and services. Recommends an algorithm (token bucket, leaky bucket, fixed or sliding window) for the use case, defines per-key and per-endpoint limits, plans distributed enforcement with Redis, and specifies response headers and 429 handling with retry-after. Produces a design plus reference implementation.

Produces structured test plans for features and releases. Defines scope and objectives, derives test cases from requirements and acceptance criteria, covers functional, edge, negative, performance, and accessibility cases, sets entry/exit criteria, and maps risk to test priority. Outputs a clear plan with a traceability matrix linking tests to requirements.

Designs and implements visual regression testing for web UIs. Recommends a tooling approach (Playwright snapshots, Storybook + a diffing service, or a dedicated platform), writes screenshot tests with stable selectors and masked dynamic regions, sets sensible diff thresholds, and integrates the suite into CI with baseline management to reduce flaky failures.

Reviews applications and data flows for common privacy-regulation obligations (GDPR, CCPA/CPRA). Maps what personal data is collected, where it flows, and how long it is retained; checks for lawful basis, consent handling, data-subject rights, and third-party sharing; and produces a prioritized remediation list. Provides engineering guidance, not legal advice.

Helps turn a game concept into a structured game design document. Captures the core loop, mechanics, progression, economy, controls, level structure, art and audio direction, and target platform and audience. Keeps scope realistic, flags dependencies and risks, and produces a living GDD that a small team can build from.

Helps process a busy inbox quickly. Categorizes messages by urgency and type, extracts action items and deadlines, drafts short reply options, and proposes an order to handle them. Summarizes long threads into the decision needed and flags anything sensitive or requiring escalation, so you can clear the inbox with fewer decisions.