engineering-core

Plugin engineering-core from marketplace developer-agent-skills in reddygopalkrishna/developer-agent-skills. Commands read from the repo's manifest — 6 days ago.

Skills (61)

• api-design

  Designs and reviews HTTP/REST APIs that are consistent, evolvable and safe to retry - resource naming, method semantics, status codes, RFC 9457 errors, pagination, versioning, idempotency keys, ETags, rate limits, long-running operations, webhooks and OpenAPI contracts. Use when creating or changing

• auth-implementation

  Implements authentication and authorization safely - OAuth 2.0 and OpenID Connect flows with PKCE, sessions vs tokens, token validation, refresh rotation, logout, RBAC/ABAC/ReBAC checks, service-to-service auth, MFA and passkeys. Use when adding login or SSO, integrating an identity provider, handli

• background-jobs

  Designs and reviews background jobs, task queues, workers and scheduled (cron) jobs - queue choice, small ID-based payloads, idempotent handlers, retries with backoff and dead-letter queues, timeouts and heartbeats, concurrency and rate limits, transactional enqueue, single-runner schedules, dedupli

• building-agents

  Designs and hardens LLM agents that call tools in a loop - choosing between a single call, a fixed workflow and an agent, tool design, context management, stop conditions and budgets, human approval, sandboxing, prompt-injection defenses, tracing and agent evaluation. Use when building an AI agent,

• caching-strategies

  Designs caches that stay correct, covering where to cache (browser, CDN, application, distributed), cache-aside vs write-through, key design, TTLs, invalidation, stampede protection and HTTP Cache-Control headers. Use when adding Redis, Memcached, a CDN or HTTP caching, when users see stale data or

• ci-cd-pipelines

  Designs, speeds up and hardens CI/CD pipelines, covering stage ordering, caching, parallel and sharded tests, pinned actions, least-privilege tokens, OIDC cloud auth, build-once artifact promotion, flaky-test handling and safe deployments with rollback. Use when creating or editing GitHub Actions, G

• cloud-cost-optimization

  Finds and reduces cloud spend on AWS, Azure, GCP and Kubernetes - cost visibility and tagging, rightsizing, autoscaling and scheduling, idle and orphaned resources, storage tiers, commitment discounts, spot capacity, data transfer and logging costs, and unit economics. Use when the cloud bill is too

• code-review-changes

  Reviews code changes (a pull request, merge request or diff) like a senior engineer - finds real bugs, security holes, data risks and breaking changes, verifies each one, and reports it with file:line, a concrete failure scenario and a suggested fix. Use when asked to review a PR, merge request, dif

• codebase-onboarding

  Maps an unfamiliar repository before changing it - stack, build/test/run commands, entry points, data flow, conventions and how changes ship - and writes a short map. Use when starting work in a repo you have not seen, when asked to explain how a codebase works, onboard to a project, find where some

• concurrency-patterns

  Finds and fixes race conditions, lost updates, deadlocks and async bugs using atomic operations, optimistic or pessimistic locking, database constraints and race detectors. Use when code runs in threads, async tasks, goroutines, background workers or multiple service instances, when duplicates or do

• data-pipelines

  Builds batch and streaming data pipelines that are idempotent, re-runnable and safe to backfill, with incremental loads, late-data handling, schema contracts and data quality gates. Use when writing ETL or ELT jobs, Airflow, Dagster or Prefect DAGs, dbt models, Kafka, Spark or Flink jobs, planning a

• data-privacy-retention

  Engineers privacy into systems that store personal data - data inventory and PII classification, minimization, encryption and field-level encryption with a KMS, pseudonymization, access control and audit, retention and deletion jobs, erasure and access requests across every copy, PII-free logs, mask

• database-migrations

  Plans and writes zero-downtime database schema migrations (expand/contract, safe indexes, batched backfills, rollback). Use when adding, renaming or dropping columns or tables, changing types or constraints, adding indexes, or backfilling data on a live database.

• database-schema-design

  Designs relational and document database schemas, covering entities, keys, constraints, data types, multi-tenancy, soft deletes, audit columns and access-pattern modeling for NoSQL. Use when doing schema design or data modeling, creating new tables or collections, designing the tables behind a new f

• database-testing

  Sets up fast, isolated tests against a real database engine - Testcontainers or CI service containers, per-test isolation (rollback, truncate, template databases), factories instead of large fixtures, migration tests, and tests for constraints, triggers, queries and query counts. Use when writing te

• dependency-upgrades

  Upgrades libraries, frameworks and toolchains safely - inventory outdated and vulnerable packages, read changelogs and migration guides, upgrade one major version at a time, regenerate and review lockfiles, test, and keep a one-commit rollback. Use when bumping dependencies, fixing security advisori

• design-docs

  Writes and reviews technical design documents (RFCs) and Architecture Decision Records (ADRs) with goals and non-goals, real alternatives, risks, security, rollout, rollback and observability. Use when planning a new system, service or major feature, choosing between architectures or technologies, r

• design-systems

  Builds and maintains design systems and shared component libraries, covering design tokens, theming and dark mode, component API design, loading, empty, error and disabled states, built-in accessibility, documentation, visual regression tests and semver releases with deprecations. Use when creating

• dockerfiles

  Writes and reviews production-grade Dockerfiles and container images, covering multi-stage builds, pinned minimal base images, non-root users, cache-friendly layers, secret-free builds, signal handling and health checks. Use when creating or editing a Dockerfile, .dockerignore or compose file, shrin

• domain-driven-design

  Applies Domain-Driven Design where it pays off - ubiquitous language, bounded contexts and context maps, aggregates sized around invariants, entities vs value objects, domain events and repositories - and says when DDD is overkill. Use when modelling a complex business domain, splitting a monolith o

• event-driven-architecture

  Designs reliable event-driven systems - events vs commands, event styles, schema evolution, ordering and partition keys, at-least-once delivery with idempotent consumers, transactional outbox, retries and dead-letter queues, replay, lag monitoring, choreography vs orchestration. Use when adding a me

• file-storage-uploads

  Builds safe file upload, storage and download flows on object storage (presigned URLs, multipart and resumable uploads, size and type limits, magic-byte checks, malware scanning with quarantine, image processing safety, safe serving headers, signed downloads, lifecycle rules). Use when adding file o

• frontend-security

  Hardens browser code against XSS, token theft, CSRF, clickjacking and supply-chain attacks (safe DOM sinks, sanitization, strict CSP, Trusted Types, token storage, SRI, postMessage checks). Use when writing or reviewing frontend code that renders user content, handles auth tokens or cookies, adds th

• git-workflow

  Uses Git safely and cleanly - atomic commits with clear messages, branching, rebase vs merge, conflict resolution, pull request descriptions, and recovering from mistakes such as lost commits, bad merges, commits on the wrong branch, or a committed secret. Use when committing, writing commit message

• graphql-apis

  Builds and reviews GraphQL APIs - schema design (nullability, connections, input and payload types, errors as data), per-request DataLoader batching for N+1, depth and cost limits, persisted queries, field-level authorization, schema evolution with deprecation and usage data, caching, subscriptions,

• grpc-services

  Builds and reviews gRPC services and .proto contracts - versioned packages, field numbering and reserved fields, buf lint and buf breaking in CI, status codes and rich error details, deadlines and propagation, retries via service config, streaming choices, load balancing over HTTP/2, health checks,

• incident-response

  Guides production incident handling - assess severity, mitigate first (roll back, disable a flag, scale, fail over), then diagnose from recent changes, metrics, logs and traces, keep a timestamped timeline, draft status updates, and write a blameless postmortem with owned action items. Use when prod

• infrastructure-as-code

  Writes and changes cloud infrastructure safely with Terraform/OpenTofu, Bicep, Pulumi, or CloudFormation/CDK - remote state, pinned modules and providers, plan review before apply, replacement and data-loss checks, drift, imports, policy scanning and CI. Use when editing .tf, .bicep, Pulumi or CDK c

• internationalization

  Makes applications ready for multiple languages and regions with externalized strings, ICU MessageFormat plurals, locale-aware dates, numbers and currencies, time zones, RTL layouts, Unicode-safe text handling and pseudo-localization. Use when adding i18n or l10n support, a new language or market, f

• kubernetes-deployments

  Writes production-ready Kubernetes workloads and debugs them - resource requests and limits, liveness/readiness/startup probes, rolling updates, PodDisruptionBudgets, autoscaling, security context, config and secrets, graceful shutdown, Helm or Kustomize, and kubectl troubleshooting. Use when writin

• large-scale-migrations

  Plans and executes large codebase and platform migrations incrementally - JavaScript to TypeScript, AngularJS to React, Java 8 to 21, .NET Framework to modern .NET, monolith to services, on-premises to cloud - using a deliberate strategy, an inventory, codemods, dual-running, a ratcheting progress m

• legacy-refactoring

  Changes legacy or untested code safely by pinning current behavior with characterization tests, finding seams to break dependencies, and refactoring in small behavior-preserving steps that keep the build green. Use when modifying code that has no tests, cleaning up a large class or function, untangl

• llm-evals

  Builds evaluation suites for LLM features and agents - error analysis on real outputs, pass criteria, code-based checks, calibrated LLM-as-judge graders, dataset splits, CI regression runs, and noise-aware comparisons with cost and latency. Use when testing prompts or models, comparing model or prom

• llm-integration

  Builds production features on top of LLM APIs - prompt structure, structured outputs with schema validation, streaming, retries and timeouts, cost and latency control, prompt-injection defenses, PII handling and tracing. Use when adding an LLM call to an app, designing a prompt for a product feature

• mcp-servers

  Builds, secures and tests Model Context Protocol (MCP) servers - choosing MCP vs a CLI or API, tools, resources and prompts, stdio vs Streamable HTTP transport, task-shaped tool design, logging rules, OAuth for remote servers, input validation, testing with the MCP Inspector, and versioning. Use whe

• micro-frontends

  Decides whether micro-frontends are worth it and, if so, designs them - composition approach (separate apps per route, build-time packages, Module Federation, import maps, single-spa, Web Components, iframes, server or edge composition), shared dependencies and version skew, routing ownership, cross

• ml-experiments

  Runs trustworthy machine learning experiments - problem and metric framing, baselines, correct train/validation/test splits, leakage prevention, reproducibility, experiment tracking, imbalance, cross-validation, hyperparameter search, error analysis, model cards, train/serve skew and drift monitorin

• monorepo-management

  Sets up and maintains monorepos - workspace tooling choice, package boundaries, affected-only builds and tests, remote caching, shared config, versioning and code ownership. Use when creating or restructuring a monorepo, adding a package or app to one, CI is slow because everything rebuilds, imports

• nosql-design

  Designs and reviews MongoDB, DynamoDB and Redis usage from access patterns - keys and indexes, query shapes, hot partitions, document and item size limits, atomic updates, transactions, TTLs, Redis data structures, eviction and persistence. Use when choosing a key or index, writing NoSQL queries, de

• observability

  Instruments services so production behavior can be understood and debugged - structured logs with trace correlation, RED/USE metrics with histograms and safe label cardinality, OpenTelemetry tracing and context propagation, SLOs with burn-rate alerts, dashboards and runbooks. Use when adding logging

• orm-patterns

  Writes efficient, correct data access code with ORMs (Prisma, Hibernate/JPA, EF Core, SQLAlchemy, Django ORM, ActiveRecord) - finding and fixing N+1 queries, eager vs lazy loading, transaction boundaries, bulk operations, safe raw SQL and optimistic locking. Use when writing or reviewing ORM queries

• performance-profiling

  Finds and fixes backend and application performance problems by measuring first - define the target metric, reproduce under realistic load, profile CPU, memory, I/O and locks, fix the biggest bottleneck, re-measure, and add a regression guard. Use when code or a service is slow, p95 or p99 latency i

• postgres-operations

  Operates PostgreSQL in production - connection pooling with PgBouncer, autovacuum and bloat, transaction ID wraparound, replication and replication slots, backups with point-in-time recovery, restore tests and major version upgrades. Use when Postgres runs out of connections, tables bloat, vacuum fa

• rag-systems

  Designs, builds and debugs retrieval-augmented generation (RAG) - ingestion and parsing, chunking, embeddings, hybrid search with reranking, access control at retrieval time, grounded answers with citations, and retrieval and answer evaluation. Use when building search or Q&A over documents, a knowl

• react-patterns

  Writes and reviews idiomatic React - minimal state with derived values, effects only for external systems, server state through a data library or framework loaders, correct keys, composition over prop drilling, measured memoization, error boundaries, Suspense, forms and actions, and the Server/Clien

• realtime-apis

  Designs and scales realtime features with polling, long polling, Server-Sent Events, WebSockets or webhooks, covering auth at connect time, heartbeats, reconnect and resume, ordering, backpressure, fan-out across instances, and deploys. Use when building live updates, chat, notifications, dashboards

• resilience-patterns

  Makes services survive slow and failing dependencies - timeouts and deadline propagation, safe retries with backoff and jitter, retry budgets, circuit breakers, bulkheads, load shedding, backpressure, idempotent consumers, transactional outbox, sagas, health checks and graceful shutdown. Use when ad

• root-cause-debugging

  Finds the real cause of a bug before changing code, using a minimal reproduction, ranked hypotheses, one-variable experiments and bisection (git bisect, input bisection). Use when something is broken, failing, crashing, flaky, intermittent, behaving differently between environments, a test fails for

• search-integration

  Adds and tunes full-text search - choosing database full-text search vs a search engine, Elasticsearch/OpenSearch mappings and analyzers, keeping the index in sync with the database (outbox, CDC, bulk indexing), zero-downtime reindexing with aliases, bool queries with filters, deep pagination with s

• security-audit

  Audits code for security issues and writes secure code, checking against the OWASP Top 10 risk categories with concrete, language-specific checks - broken access control and IDOR, injection, XSS, SSRF, authentication, sessions and JWTs, secrets, cryptography, unsafe deserialization, file uploads, CS

• seo-and-ssr

  Makes web pages crawlable, indexable and shareable by choosing the right rendering mode (CSR, SSR, SSG, ISR, streaming) and getting metadata, canonicals, structured data, sitemaps, status codes, hreflang and hydration right. Use when building public pages, choosing between client and server renderin

• sql-optimization

  Diagnoses and fixes slow SQL using real query plans, index design, sargable rewrites, keyset pagination and ORM fixes such as N+1 queries. Use when a query, endpoint, report or job is slow, database CPU or IO is high, an EXPLAIN plan needs reading, an index needs designing, or an ORM issues too many

• system-design

  Designs software systems from requirements to a reviewed architecture - functional and non-functional requirements, back-of-envelope capacity estimates, components, data storage and consistency choices, sync vs async, failure modes, and an explicit tradeoff table. Use when designing a new service or

• test-strategy

  Decides what to test and at which level, then writes fast, deterministic tests that check behavior rather than implementation details. Use when planning how a feature or system should be tested, choosing between unit, integration, contract and end-to-end tests, deciding what to mock, fixing flaky te

• threat-modeling

  Builds practical threat models - a data flow diagram with trust boundaries, STRIDE analysis per element, ranked threats, and mitigations turned into tracked work. Use when designing a new system or feature, reviewing a design doc or architecture for security, adding an external integration, auth flo

• typescript-patterns

  Writes and reviews type-safe TypeScript - strict compiler settings, unknown plus narrowing instead of any, discriminated unions with exhaustive checks, satisfies and as const, branded types, and runtime validation at trust boundaries with schema-inferred types. Use when writing or reviewing TypeScri

• unit-testing

  Writes and updates unit tests for new or changed code in the project's existing framework and style, covering happy, error and boundary paths, then runs them with coverage and fixes failures. Use when implementing a feature or bug fix that needs tests, when asked to add or update unit tests or impro

• verify-before-done

  Proves a code change works before calling it done by finding and running the project's build, typecheck, lint and tests, reading the output and fixing failures, plus a browser check for UI changes. Use when finishing any coding task, before saying a change is complete, fixed or working, before handi

• web-accessibility

  Builds and audits web UIs to WCAG 2.2 level AA - semantic HTML, correct ARIA, keyboard and focus handling, accessible forms and errors, alt text, color contrast, target size, dialogs, live regions and motion - and tests with automated tools plus keyboard and screen reader checks. Use when building o

• web-performance

  Measures and improves web page speed using Core Web Vitals (LCP, INP, CLS) with field and lab data - fixes slow loading, slow interactions and layout shifts, cuts JavaScript, image and font weight, sets caching headers, and adds performance budgets to CI. Use when a site or web app feels slow, Light

• writing-skills

  Writes and improves Agent Skills (SKILL.md folders) that agents reliably load and follow. Use when the user asks to create, edit, review, or debug a skill, says a skill is not triggering or is ignored, or wants to turn a team workflow, checklist or runbook into a reusable skill. Not for writing gene