ngocsangyem

Use when writing, reviewing, or optimizing React/Next.js code. Triggers on .tsx/.jsx files, React component work, Next.js routes, bundle optimization, re-render issues, or performance improvements. Auto-activates alongside mk:typescript when React project detected.

JIRA project / user / group / scheme / automation administration via the jira-as wrapper (11 sub-domains, ~65 verbs). Triggers: 'create JIRA project', 'list users', 'delete user USERNAME', 'list permission schemes', 'create group NAME'. Requires admin role. Destructive ops (project/user/group delete) require 2-step token confirmation. NOT for per-issue ops (mk:jira-issue / mk:jira-lifecycle); NOT

Routing skill — recommends the correct mk:jira-* leaf for any Jira task. Triggers: 'jira', 'jira ticket', ambiguous Jira intent. NOT an executor — every actual operation forks via a leaf skill.

Advanced vulnerability analysis principles. OWASP Top 10 baseline + current threat landscape awareness, Supply Chain Security, attack surface mapping, risk prioritization. Use when performing security audits, threat modeling, or OWASP reviews. NOT for STRIDE/CSO-mode infrastructure audits (see mk:cso).

Session-persistent browser automation via Playwright CLI — form filling, screenshots, data extraction, multi-step flows. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information across multiple requests. NOT for AI-driven long-autonomous flows (see mk:agent-browser); NOT for generating .spec.ts E2E code (see

JIRA custom field discovery + configuration via the jira-as wrapper. Triggers: 'field ID for X', 'list custom fields', 'check fields for project PROJ', 'configure agile fields for board'. Read ops are open; create/configure-agile require admin. NOT for setting per-issue field values (mk:jira-issue update).