Skills your agents can run

Patterns for using OrbStack to run Linux VMs and Docker on macOS. Includes orbctl/orb commands, machine lifecycle, cloud-init templates, networking, file sharing, and SSH access. Use this when working with OrbStack, orbctl, or Linux VMs on macOS.

Apollo Server configuration, plugins, caching, federation, and performance optimization.

Specialized skill for building production-ready serverless applications on AWS. Covers Lambda functions, API Gateway, DynamoDB, SQS/SNS event-driven patterns, SAM/CDK deployment, and cold start optimization.

Use this skill whenever the user needs to build and deploy a Spring Boot 4.x application with Java 21. Triggers on mentions of Spring Boot 4 setup, Java 21 Spring Boot, latest Spring Boot deployment, or Spring Boot 4.0.2 application setup.

Expert backend architect specializing in scalable API design, microservices architecture, and distributed systems.

Mobile app testing covering unit tests, UI automation, and performance testing. Applicable to test infrastructure, end-to-end (E2E) tests, testing standards, or when dealing with test framework setup, device farms, flaky tests, or platform-specific test errors.

Test for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices.

SSH connection and remote server management. Uses the paramiko (Python) library and supports executing remote commands, installing software, viewing logs, and other operations over SSH on Windows/Linux.

Comprehensive API testing patterns including contract testing, REST/GraphQL testing, and integration testing. Use when testing APIs or designing API test strategies.

Deploy vLLM using Docker (pre-built images or build-from-source) with NVIDIA GPU support and run the OpenAI-compatible server.

Deploy applications and websites to Vercel. Use this skill when the user requests deployment actions such as "Deploy my app", "Deploy this to production", "Create a preview deployment", "Deploy and give me the link", or "Push this live". No authentication required - returns preview URL and claimable deployment link.

Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and incident response. Use PROACTIVELY for security audits, DevSecOps, or compliance implementation.

Deploy to Cloudflare (Workers, R2, D1), Docker, GCP (Cloud Run, GKE), Kubernetes (kubectl, Helm). Use for serverless, containers, CI/CD, GitOps, security audit.

Use when designing new system architecture, reviewing existing designs, or making architectural decisions. Invoke for system design, architecture review, design patterns, ADRs, scalability planning.

Building and optimizing Docker images, multi-stage builds, networking, and volume management. Best practices for production deployments.

Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.

Build robust backend systems with modern technologies (Node.js, Python, Go, Rust), frameworks (NestJS, FastAPI, Django), databases (PostgreSQL, MongoDB, Redis), APIs (REST, GraphQL, gRPC), authentication (OAuth 2.1, JWT), testing strategies, security best practices (OWASP Top 10), performance optimization, scalability patterns (microservices, caching, sharding), DevOps practices (Docker, Kubernetes, CI/CD), and monitoring. Use when designing APIs, implementing authentication, optimizing database queries, setting up CI/CD pipelines, handling security vulnerabilities, building microservices, or developing production-ready backend systems.

Container vulnerability scanning and dependency risk assessment using Grype with CVSS severity ratings, EPSS exploit probability, and CISA KEV indicators. Use when: (1) Scanning container images and filesystems for known vulnerabilities, (2) Integrating vulnerability scanning into CI/CD pipelines with severity thresholds, (3) Analyzing SBOMs (Syft, SPDX, CycloneDX) for security risks, (4) Prioritizing remediation based on threat metrics (CVSS, EPSS, KEV), (5) Generating vulnerability reports in multiple formats (JSON, SARIF, CycloneDX) for security toolchain integration.

Database design principles and decision-making. Schema design, indexing strategy, ORM selection, serverless databases.

View Vercel deployment logs. Use when the user says "show logs", "check logs", "vercel logs", or "what went wrong with the deployment".