figma-to-angular
>
angular-modernization
Modernizes Angular code such as components and directives to follow best practices using both automatic CLI migrations and Bitwarden-specific patterns. YOU must use this skill when someone requests modernizing Angular code. DO NOT invoke for general Angular discussions unrelated to modernization.
cipher-type-planner
Plans the creation or modification of a cipher type (vault item type) across the Bitwarden clients monorepo. Use this skill when a user wants to add a new cipher type, modify an existing cipher type, or asks about what is needed to implement a cipher type. DO NOT invoke for general vault or cipher questions unrelated to adding or changing a cipher type.
create-pull-request
Pull request creation workflow for Bitwarden Clients. Use when creating PRs, writing PR descriptions, or preparing branches for review. Triggered by "create PR", "pull request", "open PR", "gh pr create", "PR description".
fix-angular-fixmes
Resolves eslint-disable suppression comments throughout the Bitwarden clients codebase by fixing the underlying issue. Use when the user asks to "fix FIXMEs", "fix eslint suppressions", "clean up eslint-disable-next-line", "resolve CL-764", "resolve CL-903", "fix OnPush eslint suppressions", "fix Signals eslint suppressions", or reduce linting suppressions.
writing-client-code
Bitwarden client code conventions for Angular and TypeScript. Use when creating components, services, or modifying web/browser/desktop apps.
create-hec-event-integration
Use when adding a new HEC (HTTP Event Collector) event integration to the Bitwarden web client. Implements the Splunk token authentication model (Bearer token + URI). Covers feature flag setup and card registration behind the flag. Does not apply to API key integrations or integrations requiring a custom connect dialog.
evaluating-sdk-internal-updates
Evaluates a bitwarden/clients "Update sdk-internal to" PR against the sdk-internal commit range for compile-time and runtime breaking changes, maps affected symbols to TypeScript call sites, and applies clear in-scope fixes. Use when reviewing an SDK bump PR, an @bitwarden/sdk-internal version change in package.json, or triaging sdk-internal breaking changes. Requires a sibling `bitwarden/sdk-internal` clone.
ai-dev-team
The AI Dev Team contract — how work is run in any project using this framework: proportional process, TDD, behaviour-only tickets, which process skills exist and when to reach for them, and the git conventions. Load this at the START of any development task, when picking an agent or handing off between roles, and whenever you are about to commit, open a PR, or call work done.
answer-audit
Adversarially audit a RAG answer against the corpus it claims to cite. Use when asked to review, critique, sanity-check, or "give skeptical feedback on" an answer produced by Canon (or any retrieval-grounded system) — especially when the answer looks good. Assumes the answer is wrong until each claim is proven verbatim against a source passage.
ux-researcher
UX Researcher (/ux) — the research side of UX: user interviews, surveys, usability testing, personas, journey maps, information architecture, card sorting, jobs-to-be-done, and turning findings into prioritized design requirements. Use when you need to understand users, validate a concept, define IA/navigation, plan or run usability tests, or synthesize research into requirements before visual design. Invoke alongside /ba (requirements) and feeds /ui (Aura) with grounded direction. NOT for visual/UI design or prototypes (that's /ui) — /ux is discovery and evidence, not pixels.
ai-engineer
AI/LLM Application Engineer (/ai) — builds LLM-powered product features: RAG, agentic workflows, prompt engineering, tool use, structured output, evals, and guardrails. Use when implementing AI features in an app — a chatbot, RAG over docs, an agent, a summarizer, semantic search, prompt pipelines, or LLM evaluation. Invoke alongside /arch for AI system design and /secops for prompt-injection/data-exfil review. NOT for ML model training or serving infrastructure (that's the mlops-engineer), and NOT for generic backend CRUD (that's /be).
backend-developer
Backend Developer (/be, alias: James, /james) - Senior Backend Developer with 10+ years experience. Covers Java/Spring Boot (default), Kotlin, Python/FastAPI, PHP/Laravel, Quarkus, and Kafka/messaging - detects the project's stack and loads the matching reference. Use when implementing server features, REST APIs, business logic, persistence, messaging, or unit/integration tests in any of these stacks.
browser-extension-developer
Browser Extension Developer (/ext) — Chrome/Edge Manifest V3 and Firefox WebExtensions: the service-worker lifecycle and what may not live in it, choosing between popup / options / side panel / extension page / in-page overlay / tab group, chrome.scripting injection and getting a value back out of it, tabs & tab groups, the permissions model (activeTab vs optional host permissions) and its revocation rules, long-running work that survives the popup closing, content-script security and CSP, and building/testing an extension without a browser in the loop. Use when building, reviewing, debugging or store-shipping any browser extension, or when a task involves a manifest.json with manifest_version. NOT for ordinary web-app UI (that's /fe) and NOT for browser automation with Playwright/Puppeteer (that's /e2e).
data-engineer
Data Engineer (/data) — designs and builds data pipelines: ETL/ELT, dbt transformations, warehouses/lakehouses (BigQuery, Snowflake, DuckDB, Postgres), streaming (Kafka, Flink), orchestration (Airflow, Dagster), and data quality. Use when building ingestion/transformation pipelines, modeling analytics tables, wiring streaming or batch jobs, or setting up a warehouse. Invoke alongside /arch for data architecture and /dba for OLTP schema/query tuning. NOT for application CRUD/business logic (that's /be) and NOT for ML feature serving (that's mlops-engineer).
dba
Database Administrator / Database Specialist (/dba) — operational database design and tuning: schema design & normalization, indexing strategy, query optimization & execution plans, migrations (safe, zero-downtime), replication & high availability, partitioning/sharding, backups & recovery, and connection management. Covers Postgres, MySQL, and similar OLTP engines. Use when designing or reviewing a schema, tuning a slow query, planning a migration, or setting up replication/backups. Invoke alongside /arch for data architecture and /be for ORM/access patterns. NOT for analytics pipelines/warehouses (that's /data) — /dba is the operational/OLTP database.
frontend-developer
Frontend Developer (/fe, alias: Finn, /finn) - Senior Frontend Developer with 10+ years web and mobile experience. Covers React/Next.js (default), Angular, Vue/Nuxt, Flutter/Dart, and JavaFX desktop - detects the project's framework and loads the matching stack reference. Use when implementing UI components, state management, data fetching, styling, forms, or any web/cross-platform frontend feature in any of these stacks.
java
Java language and JVM engineering standards — records and sealed-type modelling, JSpecify null-safety with NullAway as a build error, immutability, virtual threads and modern concurrency, Error Prone/ArchUnit/PIT build gates, JUnit 6 testing doctrine, and boundary security. Load whenever writing, refactoring, or reviewing Java: any .java file, pom.xml/build.gradle change, javac or test failure, or Java design/test planning — with or without /be or /rev invoked. NOT for Kotlin (that is /be's kotlin reference) and NOT for Spring/API/persistence how-to (that is /be's java-expertise reference).
rust
Rust engineering standards and deep references — ownership/borrowing-driven design, error handling (thiserror/anyhow), async with tokio, axum services, testing, and clippy/cargo-deny discipline. Load whenever writing, editing, or reviewing Rust: any .rs file, Cargo.toml/Cargo.lock change, cargo or clippy failure, or Rust design/test planning — with or without a role agent (/be, /rev) invoked. NOT for merely running or installing a compiled Rust tool.
sql
SQL and relational-database engineering with dialect branches for Postgres, MySQL, Oracle, and SQLite. Load whenever writing, editing, or reviewing SQL: a .sql file, a schema migration, a raw query embedded in application code, index/EXPLAIN/tuning work, or stored procedures/triggers. NOT for ORM entity mapping where no SQL is written (that is /be), and NOT for analytics/warehouse modeling (that is /data).
typescript
JavaScript/TypeScript language engineering — the strictest-profile type system (discriminated unions, branded types, satisfies), parse-don't-validate boundaries with Zod, ESM and the Node runtime, typescript-eslint discipline (no floating promises), and Vitest/MSW/fast-check testing. Load whenever writing, editing, or reviewing .ts/.tsx/.js/.mjs code, tsconfig or package.json changes, tsc or lint failures, or TypeScript design/test planning — with or without /fe or /be invoked. NOT for React/Next/Angular/Vue framework questions (that is /fe's stack references) and NOT for E2E automation (that is /e2e).
native-mobile-developer
Native Mobile Developer (/ios, /android) — builds true native apps: iOS with Swift/SwiftUI and Android with Kotlin/Jetpack Compose. Use when implementing native iOS or Android features, SwiftUI/Compose UI, platform APIs (notifications, camera, background, widgets), App Store/Play Store concerns, or native performance/lifecycle work. Invoke alongside /ui for design and /arch for app architecture. NOT for cross-platform React Native or Flutter (that's /fe (loads references/flutter.md)) — this is native Swift/Kotlin.
fid-lifecycle
Run the Backlog → Investigation → FID → Jira-epic → tickets → Done lifecycle without leaving orphans or two sources of truth. Load this when taking an item off the Backlog, when an investigation concludes, when creating a FID or its epic, when adding a ticket that belongs to an existing FID, and when marking a ticket or a FID complete. It owns the bookkeeping rules — what to remove, what to link, what to update in the same change.
business-analyst
Business Analyst (/ba, alias: Anna, /anna) - Senior BA with 10+ years bridging business and technical teams. Use when conducting market research, competitive analysis, gathering/refining requirements with behavioral acceptance criteria, creating business process models, cost-benefit analysis, financial modeling, user research, or validating assumptions with data. Works closely with /po to shape requirements.
product-owner
Product Owner (/po, alias: Max, /max) - Senior PO with 10+ years agile experience. Use when defining product vision, creating/prioritizing backlog, writing user stories with acceptance criteria, making scope decisions, validating features against business goals, or planning releases and sprints.
scrum-master
Scrum Master (/sm, alias: Luda, /luda) — board integrity, not ceremony. Use when asked for board or sprint status, before planning, at the end of an epic, or any time work has moved fast: finds orphan tickets and empty epics, planning documents that disagree with the tracker, Backlog items whose work has already moved on, tickets marked Done without their negative acceptance criteria being met, items parked with no trigger, and epics claiming completion over open work. Also for creating tickets from investigation reports, orchestrating the team workflow, and advancing tickets through gates.
apex
Apex - Senior Product Marketing Manager & CSO specializing in B2B/B2C IT Products & SaaS. Use for Go-To-Market strategies, product positioning, growth funnels, IT product copywriting, SEO content strategy, or marketing analytics. Primary command: /mkt. Alias: /apex.
model-selection
Choose which model tier to spend on a piece of work — the most capable model (Fable 5 / Opus) versus a cheaper, faster one — so quality holds where it matters and cost falls where it does not. Load this before launching subagents or a workflow, before a review or research sweep, when a task is large and repetitive, or whenever you are about to spend a strong model on volume. Applies to your own reasoning effort as much as to delegated agents.
devops-engineer
DevOps Engineer (/devops) - Senior DevOps Engineer with 12+ years cloud infrastructure experience. Use when setting up cloud infrastructure, writing Terraform configurations (loads references/terraform.md), creating Kubernetes manifests, building CI/CD pipelines with GitHub Actions, configuring Docker, or managing secrets.
mlops-engineer
Senior MLOps Engineer with 8+ years ML systems experience. Use for model serving & inference infrastructure, AI/ML pipelines, training-data pipelines, model deployment & monitoring, and AI cost optimization at the infrastructure level. For app-level LLM product features (RAG, agents, prompt engineering, evals, guardrails) use the ai-engineer (/ai) instead — mlops-engineer owns the ML/inference ops layer, not the product feature.
secops-engineer
Soren - Principal Security Engineer with 15+ years application, infrastructure, and cloud security experience. Security review is a safety-override gate, required on security-relevant changes (auth, secrets, PII, external input, etc.) and always in the regulated preset. Use when conducting security reviews, threat modeling (STRIDE/PASTA/LINDDUN), implementing authentication (OAuth 2.1/Passkeys/WebAuthn), supply chain security (SBOM/SLSA), container/K8s hardening, Zero Trust architecture, AI/LLM security, privacy engineering, security scanning pipelines, compliance (GDPR/PCI-DSS/SOC2/ISO27001), or incident response. Primary command: /secops. Alias: /soren.
sre-engineer
SRE / Observability Engineer (/sre) — reliability engineering: SLOs/SLIs & error budgets, monitoring & alerting (Prometheus, Grafana, OpenTelemetry), incident response & runbooks, on-call, capacity & load, chaos/resilience, and post-incident reviews. Use when defining reliability targets, instrumenting observability, setting up alerting, writing runbooks, doing incident response, or reviewing a change for production readiness. Invoke alongside /arch for reliability NFRs and devops-engineer for the underlying infra/CI-CD. NOT for provisioning infra or pipelines (that's devops-engineer) — /sre owns reliability, not the cluster.
parallel-delivery
How a ticket moves through multiple parallel sessions — one orchestrator authoring tickets, N workers each claiming and delivering one ticket end-to-end in an isolated workspace. Load this before claiming a ticket for cross-session delivery, before creating its workspace or branch, when a ticket under-specifies what it asks for, and when reporting a ticket back as done. Covers the claim protocol (assignee is the lock), workspace isolation, the ticket-is-the-sole-context rule, and the report-back contract (a PR is the report).
pull-request
How to run a pull request to the point where it can be merged — resolving every review conversation, checking every workflow run rather than the summary, and confirming the merge result is what CI actually tested. Load this whenever you open, update, review, or merge a PR, whenever a review round returns findings, and before saying a branch is "green" or merging anything.
performance-engineer
Performance Engineer (/perf) — measures and optimizes performance across the stack: Core Web Vitals (LCP/INP/CLS), bundle/asset budgets, frontend rendering, backend latency & throughput, profiling & flame graphs, database query performance, caching, and load testing. Use when something is slow, you need to set/enforce performance budgets, profile a hot path, run a load test, or audit Web Vitals. Invoke during /rev for perf review and alongside /sre for capacity. NOT for reliability/SLOs & incident response (that's /sre) — /perf is about speed/efficiency, not uptime.
reviewer
/rev - Senior Full-Stack Code Reviewer with 12+ years experience in Java/Kotlin and TypeScript/React. Use when reviewing code quality, checking security vulnerabilities, validating style compliance, running static analysis tools, ensuring test coverage, or verifying implementation against acceptance criteria. Also responds to 'Rev' or /rev or /reviewer command.
backend-tester
Senior QA Engineer with 10+ years Java testing experience. Use when writing unit tests with JUnit, creating integration tests with Testcontainers, implementing API tests, following TDD methodology, or testing reactive code with StepVerifier.
e2e-tester
/e2e - Senior QA Automation Engineer with 10+ years E2E testing experience. Use when writing end-to-end tests for web apps with Playwright, mobile apps with Detox, testing critical user flows, cross-browser testing, visual regression testing, or performance testing. Also responds to 'Adam' or /adam command.
frontend-tester
Senior Frontend QA Engineer with 10+ years JavaScript/TypeScript testing experience. Use when writing unit tests for React components, creating integration tests with React Testing Library, testing custom hooks, mocking APIs, or following TDD for frontend.
tester
/qa - Senior QA Engineer specializing in test case design, BDD specs, and feature validation. Use when designing test cases from acceptance criteria, writing BDD specs, reviewing E2E tests, validating user requirements, creating test reports, or performing exploratory testing. Also responds to 'Rob' or /rob or /tester command.
verify
>
research-method
Run an investigation so its result is trustworthy, and write it up so it survives a hostile reader. Load this when a question needs measuring rather than deciding, when designing an experiment or benchmark, when a result looks good enough to publish, and when drafting an article or pre-registration for a technical community. Covers experiment design, deterministic verification, kill conditions, claims discipline, and the boundary between what the data supports and what it does not.
review-tier
Decide HOW MUCH code review a change needs, and scope it, before spending a multi-agent review on it. Load this whenever you are about to run /code-review, ultracode, or any review workflow — and on every follow-up round of a review loop. It classifies the diff's risk deterministically, picks the review shape (full / targeted / fix-scoped / lint-only / skip), and refuses to spend review budget on a branch whose free gates are not green. Use it to keep the review's defect-finding power while cutting its cost.
kai
Kai — Self-Improving Meta-Agent. Reviews working-rules a human has already approved in whatever memory backend the project uses, keeps the ones that are universal rather than project-specific, and emits proposed SKILL.md edits as a diff for review. Never applies or commits a change. Use when reviewing accumulated rules for promotion into skills, or when asked about self-improvement of the agent team.
technical-writer
Senior Technical Writer with 10+ years documenting complex systems. Use when creating/updating documentation, writing API docs, creating architecture diagrams (C4, Mermaid), generating changelogs, writing READMEs, or creating onboarding guides.
verify-landed
Prove that a change you just made actually exists and actually does something, before reporting it as done. Load this after any edit intended to change behaviour — a bug fix, a guard, a new refusal — and before claiming a finding is fixed, a ticket is complete, or a criterion is met. It catches the two cheapest ways to ship nothing — an edit that silently matched nothing, and a claim resting on a comment rather than on code.
workflow-engine
The ai-dev-team workflow contract. ALWAYS consult this at the START of any development task and BEFORE EVERY handoff between agents — it decides which process applies (proportional to the size of the change), which approval gates are required, and whether work may proceed or must stop. Triggers whenever you begin a ticket/feature/fix/bug, hand off between roles (/po /ba /arch /secops /ui /fe /be /rev /qa /e2e ...), or are about to advance a ticket, commit, or mark work done. If you are doing development work and have not consulted the workflow, you are doing it wrong — load it first.
solution-architect
Solution Architect (/arch, alias: Jorge, /jorge) - Principal Solution Architect with 15+ years designing scalable distributed systems. Use when making technology choices, designing system architecture, selecting patterns (Saga, CQRS, Event Sourcing), creating ADRs, planning integrations, database sharding/replication, microservices/microfrontends, security architecture, data platforms, AI/ML systems, or cloud cost optimization. Provides architectural guardrails, not prescriptions — developers decide HOW within boundaries.
accountant
Senior Accountant & Strategic CFO with 20+ years experience in tech sector. Use for tax planning, VAT/sales tax compliance, financial forecasting, contractor assessments, or accounting app logic design. Auto-triggers tax warnings and savings opportunities. Adapts to the user's jurisdiction by loading the matching reference (e.g. UK tax, persona Inga) from references/.
legal-counsel
Senior Legal Counsel with 20+ years experience in corporate law. Use for legal advice, contract drafting, compliance checks, data protection (GDPR/CCPA), employment law, or risk assessment. Auto-triggers penalty warnings and statute citations. Adapts to the user's jurisdiction by loading the matching reference (e.g. UK / English & Welsh law, persona Alex) from references/.
Page 671 of 1647 · 82344 results