brakemanStatic analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for vulnerabilities, setting up security scanning in CI/CD, managing security warnings, or investigating specific vulnerability ty
hwc-forms-validationHandle Hotwire form workflows: form submission lifecycle, inline editing, validation errors, typeahead/autocomplete, modal forms, and external form controls. Prefer this skill when the core problem is correctness and UX of form interaction. Use hwc-navigation-content for pagination/tabs/filter navig
hwc-navigation-contentBuild Hotwire navigation and content-discovery flows: Turbo Frame pagination, tabbed navigation, lazy loading, faceted filtering/search, cache lifecycle, scroll restoration, and visit/render control. Prefer this skill when the core problem is request/response navigation state and browser history beh
hwc-realtime-streamingImplement real-time Hotwire behavior: Turbo Streams over WebSocket/SSE, custom stream actions, inline stream tags, live list updates, and cross-tab state synchronization. Prefer this skill when the core problem is push-based updates or stream action orchestration. Use hwc-navigation-content for pull
hwc-stimulus-fundamentalsCover Stimulus controller fundamentals: lifecycle hooks, values and valueChanged callbacks, targets and target callbacks, outlets, action parameters, keyboard events, and controller architecture patterns. Prefer this skill when the request is primarily about Stimulus APIs and controller design indep
hwc-ux-feedbackImplement cross-cutting Hotwire UX feedback patterns: loading states, busy indicators, progress bars, optimistic UI, render interception, and view/page transitions. Prefer this skill when the core goal is perceived performance and user feedback, independent of a single feature domain. Use hwc-forms-
rails-authorizationUse when implementing or testing authorization in Rails using Pundit or CanCanCan — must always verify authorization by attempting an unauthorized action in the browser or console and confirming it raises Pundit::NotAuthorizedError or CanCan::AccessDenied as expected, use policy objects rather than
rails-background-jobUse when adding or reviewing background jobs in Rails — must write the job spec covering idempotency, retry, and error handling and verify it FAILS before implementation, ensure the perform method only loads the record from the passed ID, guards for no-op, and delegates to a service, and run the ful
rails-code-reviewReviews Rails (Ruby on Rails) pull requests, diffs, and merge requests for quality, security, and conventions. Use when asked to do a PR review, review my diff, review my merge request, or code review of Ruby on Rails code. Grounds every finding in a real file:line from the actual diff, applies exac
rails-guidesMaps Rails topics to the official versioned guides at guides.rubyonrails.org for WebFetch. Use when asked about any Rails-specific topic including ActiveRecord, routing, controllers, views, mailers, jobs, Action Cable, Action Text, Active Storage, migrations, validations, callbacks, associations, ca
rails-performanceUse when optimizing Rails performance — follows a strict workflow: measure baseline, identify bottleneck, write failing RED regression spec asserting query count with db-query-matchers, apply fix, verify spec GREEN, check with EXPLAIN ANALYZE in rails dbconsole, and report quantified improvements. R
rails-review-migrationUse when reviewing production database migrations, performing a migration safety review, planning zero-downtime migration, or deploying database changes safely. Reviews phased rollouts, lock behavior, rollback strategy, strong_migrations, and deployment ordering. Enforces: add nullable-first then ba
ruby-api-clientUse when integrating with external APIs in Ruby using a strict 5-layer pattern: Auth → Client → Fetcher → Builder → Entity — each layer test-gated (spec RED → impl GREEN before next layer), Auth has `self.default` + `DEFAULT_TIMEOUT` + cached `#token`, Client wraps HTTP with nested `Error` + `MISSIN
ruby-service-objectUse when creating or refactoring Ruby service classes following the `def self.call(...)` → `new(...).call` entry point pattern with a strict `{ success: true/false, response: { ... } }` response contract. Handles error shape (`{ success: false, response: { error: { message: string } } }`), `Standard
rubyUse when writing, reviewing, or debugging pure Ruby code — idiomatic patterns, modern 3.x+ features (pattern matching, Data.define, endless methods), error handling conventions (raise vs fail, result objects), memoization, and performance idioms. For Rails use rails-guides. For testing use minitest.
test-driven-developmentUse when implementing any feature or bugfix, before writing implementation code
write-testsUse when writing, reviewing, or configuring RSpec tests in Ruby on Rails — must execute the spec via `bundle exec rspec` and capture the actual test output (failure message or stack trace) rather than describing expected behavior, prefer behavioral confidence over implementation coupling, pick the s