tinh2

Build and ship features with security baked in — runs OWASP Top 10 pre-scan, builds and ships with /ship, validates with post-build security review, then penetration tests the result. Use when shipping auth flows, payment logic, API endpoints, admin panels, or any security-sensitive code.

Conduct a CPO-perspective product strategy review of a codebase. Evaluates feature completeness against core value proposition, time-to-value for new users, user journey quality, retention architecture (notifications, personalization, network effects), growth levers (viral mechanics, SEO, onboarding optimization), competitive moat strength, analytics measurement foundation, and platform extensibil

Audit deployment readiness across CI/CD, containers, monitoring, IaC, secrets, CDN, and DNS — score each area 0-100, identify critical gaps, and optionally auto-fix by chaining deploy sub-skills

Audit commercial building energy performance including HVAC optimization, ENERGY STAR scoring, utility cost analysis, demand response readiness, and sustainability compliance. Covers BMS/BAS systems, EUI benchmarking against CBECS and ASHRAE 90.1, lighting and plug load efficiency, on-site renewables, and local building performance standards like NYC LL97, Boston BERDO, and DC BEPS.

Generates structured engineering specs (backend or frontend) from feature descriptions, designs, or ticket references. Triggers on "spec", "story", "ticket", "engineering spec", "write a story for", "write a spec for", "create a ticket for".

Analyze university and research institution funding allocation systems including RCM revenue attribution, performance-based budgeting, faculty startup package management, F&A indirect cost recovery distribution, equipment sharing and core facility recharge rates, space utilization surveys, strategic investment pool governance, and NACUBO endowment spending compliance.

Analyze disability services software — IEP and ISP management, person-centered planning workflows, HCBS Settings Rule compliance, accommodation tracking, assistive technology integration, EVV (Electronic Visit Verification), caregiver and DSP scheduling, and outcome measurement. Audit platforms serving individuals with intellectual, developmental, physical, and psychiatric disabilities for regulat

Learn to build and publish your own AI agent skills -- from idea to published on skills-hub.ai

Scan project dependencies for known vulnerabilities (CVEs), auto-fix safe patches, and generate SBOM. Auto-detects all package managers in monorepos — npm (npm audit), yarn (yarn audit), pnpm (pnpm audit), pip/poetry (pip-audit), Cargo (cargo audit), Go modules (govulncheck), Maven (dependency-check), Gradle, Bundler (bundle audit), and Composer. Categorizes findings by severity (Critical/High/Med

Audit manufacturing software for FDA 21 CFR Part 11 (electronic records, e-signatures, audit trails), ISO 9001/13485/14001/45001 quality management (document control, CAPA, nonconformance), GMP batch records and cleaning validation, lot/serial traceability (forward, backward, process, recall-ready), OSHA safety (incident tracking, LOTO, PPE), hazmat handling (SDS, chemical inventory, RCRA waste),

Reconstructs the development cycle from git history, distills sequential/parallel patterns, and produces actionable insights for improving future iterations. Triggers: recall, retrospective, development analysis, what happened, dev cycle analysis.

Test a skill's quality before publishing — validate SKILL.md frontmatter schema, check instruction structure for phases and guardrails, score against the marketplace rubric out of 100, simulate a dry run to find failure points, and report a pass/fail verdict with specific fixes