lv416e
@lv416e
Public Skills
semgrep-rule-variant-creator
by lv416e
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
data-pipeline-engineering
by lv416e
"Use when building or modifying any data pipeline, before writing transformation logic - idempotent-first approach covering schema design, quality checks, incremental loads, CDC, and observability that ensures every step is repeatable and verifiable データパイプラインの構築や変更時、変換ロジックを書く前に使用 - スキーマ設計、品質チェック、増分ロード、CDC、オブザーバビリティを網羅する冪等性ファースト手法により、全ステップの再実行可能性と検証可能性を保証"
second-opinion
by lv416e
"Runs external LLM code reviews (OpenAI Codex or Google Gemini CLI) on uncommitted changes, branch diffs, or specific commits. Use when the user asks for a second opinion, external review, codex review, gemini review, or mentions /second-opinion."
dwarf-expert
by lv416e
Provides expertise for analyzing DWARF debug files and understanding the DWARF debug format/standard (v3-v5). Triggers when understanding DWARF information, interacting with DWARF files, answering DWARF-related questions, or working with code that parses DWARF data.
prompt-engineering
by lv416e
"Use when designing, testing, or deploying LLM prompts for applications - systematic prompt design methodology (pattern selection, structured output, evaluation, versioning) ensuring every prompt is tested against ground truth before production LLMプロンプトの設計、テスト、デプロイ時に使用 - 体系的なプロンプト設計手法（パターン選択、構造化出力、評価、バージョン管理）により、すべてのプロンプトが本番前にグランドトゥルースに対してテスト済みであることを保証"
devops-infrastructure
by lv416e
"Use when provisioning infrastructure, building containers, configuring CI/CD, or deploying services - ensures all infrastructure is codified, versioned, and reviewable with repeatable deployment strategies and proper secrets management インフラのプロビジョニング、コンテナのビルド、CI/CDの構成、サービスのデプロイ時に使用 - すべてのインフラがコード化、バージョン管理、レビュー可能であることを保証し、再現可能なデプロイ戦略と適切なシークレット管理を実現"
debug-buttercup
by lv416e
Debugs the Buttercup CRS (Cyber Reasoning System) running on Kubernetes. Use when diagnosing pod crashes, restart loops, Redis failures, resource pressure, disk saturation, DinD issues, or any service misbehavior in the crs namespace. Covers triage, log analysis, queue inspection, and common failure patterns for: redis, fuzzer-bot, coverage-bot, seed-gen, patcher, build-bot, scheduler, task-server, task-downloader, program-model, litellm, dind, tracer-bot, merger-bot, competition-api, pov-reproducer, scratch-cleaner, registry-cache, image-preloader, ui.
constant-time-analysis
by lv416e
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
spec-to-code-compliance
by lv416e
Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.
performance-profiling
by lv416e
"Use when investigating performance issues, before attempting any optimization - four-phase methodology (baseline measurement, bottleneck profiling, complexity analysis, targeted optimization) that ensures data-driven decisions over gut-feel tuning パフォーマンスの問題を調査する際、最適化を試みる前に使用 - 4フェーズ手法（ベースライン測定、ボトルネックプロファイリング、計算量分析、的を絞った最適化）により、直感的なチューニングではなくデータに基づく判断を保証"
devcontainer-setup
by lv416e
Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up isolated development environments, or configuring sandboxed Claude Code workspaces.
api-design
by lv416e
"Use when designing or modifying any API endpoint, before writing handler code - contract-first approach covering resource modeling, URL design, schema conventions, versioning, and authentication that ensures the interface is right before implementation begins APIエンドポイントの設計や変更時、ハンドラーコードを書く前に使用 - リソースモデリング、URL設計、スキーマ規約、バージョニング、認証を網羅するコントラクトファースト手法により、実装前にインターフェースの正しさを保証"
ask-questions-if-underspecified
by lv416e
Clarify requirements before implementing. Use when serious doubts arise.
entry-point-analyzer
by lv416e
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.
multi-agent-orchestration
by lv416e
"Use when work can be decomposed into independent, parallelizable tasks - Planner/Worker/Judge pattern for spawning subagents with bounded scope, clear acceptance criteria, and quality gates before merging results 作業を独立した並列化可能なタスクに分解できる場合に使用 - 境界付きスコープ、明確な受け入れ基準、マージ前の品質ゲートを持つサブエージェント生成のためのPlanner/Worker/Judgeパターン"
differential-review
by lv416e
Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.
sharp-edges
by lv416e
"Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration."
refactoring-legacy-code
by lv416e
"Use when modernizing, migrating, or restructuring existing code - systematic approach to safe refactoring through characterization tests, dependency analysis, strangler fig migration, and incremental transformation; ensures no behavior changes without test coverage first 既存コードのモダナイゼーション、移行、再構築時に使用 - 特性テスト、依存関係分析、ストラングラーフィグ移行、段階的変換による安全なリファクタリングの体系的アプローチ。テストカバレッジなしでの動作変更を防止"
audit-context-building
by lv416e
Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.
firebase-apk-scanner
by lv416e
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
property-based-testing
by lv416e
Provides guidance for property-based testing across multiple languages and smart contracts. Use when writing tests, reviewing code with serialization/validation/parsing patterns, designing features, or when property-based testing would provide stronger coverage than example-based tests.
modern-python
by lv416e
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
architecture-decision-records
by lv416e
"Use when making any significant architectural decision - framework selection, infrastructure change, API design choice, database selection, pattern adoption - to record the decision in MADR format with full context, alternatives, and rationale so future engineers understand WHY 重要なアーキテクチャ上の意思決定（フレームワーク選定、インフラ変更、API設計選択、データベース選定、パターン採用）を行う際に使用 - MADR形式で完全なコンテキスト、代替案、根拠を記録し、将来のエンジニアがなぜその決定をしたか理解できるようにする"
semgrep-rule-creator
by lv416e
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.