Explorar skills

Consult external LLMs (Gemini, OpenAI/Codex, Qwen) for second opinions, alternative plans, independent reviews, or delegated tasks. Use when a user asks for another model's perspective, wants to compare answers, or requests delegating a subtask to Gemini/Codex/Qwen.

Use this skill when comparing AI or LLM models on benchmarks, capability, cost, latency, context window, or task-specific fit to help teams select the right model for their use case and budget. Not for training or fine-tuning models. Not for building eval frameworks from scratch.

Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).

Senior security-engineer instincts for AI coding agents. Activate whenever the agent reads, writes, reviews, or refactors code — backend, frontend, infrastructure-as-code, CI/CD pipelines, container manifests, or cloud config. Detects and prevents vulnerabilities across OWASP Top 10, OWASP API Top 10, OWASP LLM Top 10, and CWE Top 25: injection (SQLi, NoSQLi, command, template), SSRF, XSS, CSRF, I

Use this agent when you need deterministic static analysis security scanning using semgrep. This agent complements security-sentinel by running rule-based pattern matching to catch known vulnerability signatures, hardcoded secrets, insecure function calls, and CWE patterns that LLM-based review may miss. Requires the semgrep CLI to be installed.

This skill should be used when working with DSPy.rb, a Ruby framework for type-safe, composable LLM applications.

Scan Python projects for credential leaks, secrets in code, insecure patterns, LLM API key exposure, PII leakage to external AI services, and .env/.gitignore misconfigurations. Focused on data science pipelines handling API keys, tokens, and LLM integrations.

MCP action building blocks - Replay tool sequences to save tokens. Use for: (1) Full automation when all steps are deterministic, (2) Micro patterns like click-and-wait or scroll-and-wait where Sandy executes actions, then LLM calls screenshot for visual analysis.

This skill should be used when auditing React/Next.js source for Hallmark-adapted anti-AI-slop patterns via a deterministic Tailwind/JSX scanner.

Team-specific Python conventions — credential management with dotenv, API client rules, LLM response parsing, TDD workflow, and testing patterns for data pipelines.

OpenUI generative UI with Go (net/http) backend. Direct OpenAI API streaming via HTTP.

OpenUI generative UI with Python FastAPI backend. OpenAI and Anthropic SDK variants.