Explorar skills

Adversarial thinking partner that challenges your ideas, plans, and decisions before you commit to them. Default mode is constructive disagreement, not validation. Use when you want pushback, devil's advocate analysis, or stress-testing of a position. Triggers on: "Nietzsche", "challenge this", "poke holes in this", "play devil's advocate", "stress-test my plan", "argue against this", "I want push

Policy-drafting workflow for security policies — AUP, Incident Response Plan, Access Control, Data Classification, BCP, Change Management, Vendor Management, Crypto, and Remote Work. Structure with Purpose/Scope/Statement/Roles/Enforcement/Review, ISO 27001 Annex A.5 alignment, NL/EN drafting.

Radical simplifier of explanations. Takes a complex concept and distills it until a non-expert can understand it without losing accuracy. Default test: "would a curious 12-year-old follow this?" Forces the user to confront gaps in their own understanding by making them explain it simply. Triggers on: "Feynman", "explain this simply", "help me explain this to non-technical stakeholders", "I need to

Phishing-simulation campaign workflow — RoE and ethical-scope template, population segmentation, pretexting patterns (HR/IT/finance/vendor/calendar), infrastructure (sender domain, SPF/DKIM/DMARC, tracking), click-rate and credential-success metrics, opt-out and duty of care, NL/EU AVG context for employee monitoring.

Astro security review — render-mode attack surface (SSG/SSR/hybrid), set:html and MDX content collections (XSS + author trust), API routes and middleware (auth, scope), adapter-specific runtime models (Cloudflare/Vercel/Netlify/Node), env-var hygiene (PUBLIC_ prefix), and Decap CMS pairing (OAuth backend, token storage, branch-based editorial workflow).

When contributing to public or open-source repositories where AI attribution should be hidden. Use when the user says "stealth mode," "undercover," "no AI attribution," "hide AI," "contribute anonymously," "clean commits," "no co-authored-by," or when working on repos where AI involvement should not be visible. Strips all AI fingerprints from commits, PRs, code comments, and generated content.

Transitional standalone visual regression guard using before/after screenshot comparison. Two modes: SIT (compare staging vs local dev) or Local (compare git-stashed base vs current changes). No long-lived baselines — captures fresh screenshots each run and deletes after comparison. Config-driven from workspace-config.yaml. Use when: "跑 visual regression", "檢查畫面", "頁面有沒有壞", "visual test", "screens

When the user wants to review past decisions, understand why something was built a certain way, audit decision quality, or learn from past reasoning. Use when the user says "why did we," "look back," "thinkback," "decision review," "was that the right call," "what were we thinking," "review our decisions," "decision audit," "trace back," "replay thinking," or when revisiting old code and needing t

Review spec-forge generated documents (tech-design + feature specs) for quality, completeness, and internal consistency. Finds issues like incomplete sections, contradictions, missing traceability, and vague specs, then optionally auto-fixes them. Supports iterative review-fix cycles with a maximum of 2 iterations.

Flips constraints and beliefs to expose false walls and test plan robustness against inverted worldviews.

EU Digital Operational Resilience Act (2022/2554) compliance — scope (financial entities + critical ICT TPPs), five pillars (ICT risk management, incident reporting, resilience testing incl. TLPT, third-party risk, information sharing), and Dutch oversight via DNB/AFM.

Next.js security review — middleware auth-bypass patterns (CVE-2025-29927), Server Actions auth/CSRF, Server/Client Component boundary and SSR data leaks, auth.js (NextAuth) config, route handlers as API, Image Optimization SSRF, security headers via middleware.