Ruby on Rails
BackendCommonly used with
Skills using Ruby on Rails (55)
hunt-deserialization
Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.
autopilot-batch
Fan out a batch of autopilot-queued issues to parallel background worktree subagents — each runs /autopilot at the build model from its 'model:' label — with a gating review one model tier above every build (Opus reviews Sonnet builds, Fable reviews Opus builds).
qa-handoff
Generate a hands-on QA testing guide as a self-contained HTML page — for Rails apps or static (Hugo) sites. --publish uploads the HTML to the project's configured QA host.
qa-triage-batch
Fan out /qa-triage across a queue of qa-labeled reports in parallel, reconcile them across reports to cluster shared root causes, present one consolidated decision gate, and — on approval — create the resulting tech issues.
mir-backend-ruby-rails
Make It Right (Rails module). Ruby on Rails 8.1 specific reliability augmentation. Use alongside mir-backend and mir-backend-ruby when the target stack is Rails — carries the mechanical footguns the framework-agnostic skills deliberately omit: ActiveRecord N+1 and eager-loading strategies, params.expect / strong parameters and mass-assignment safety, callback side-effect timing (after_commit vs after_save) and jobs enqueued inside transactions, transaction semantics and nested transactions, migration safety on populated tables (the #1 Rails production incident class), connection pool sizing across the Rails 8 primary/cache/queue/cable databases, and the Rails security defaults and Active Storage advisories. TRIGGER only when the Ruby backend is Rails — building, reviewing, or debugging a Rails controller, model, concern, migration, Active Storage attachment, or background job that uses ActiveRecord. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-ruby (YARV runtime: GVL, Ractors, YJIT, Puma
openui-forge-ruby
OpenUI generative UI with a Ruby on Rails backend. SSE streaming via ActionController::Live, forwarding the OpenAI API stream with Net::HTTP.
test-driven-development
Strict red-green-refactor TDD workflow for implementing features, fixing bugs, or changing behavior in Rails applications. Enforces the discipline of writing a failing test before any production code. Use whenever you want to implement with TDD — whether a new feature, a bugfix, a refactor, or any behavior change.
rails-expert
Use when building Rails 7+ web applications with Hotwire, real-time features, or background job processing. Invoke for Active Record optimization, Turbo Frames/Streams, Action Cable, Sidekiq.
rails-load-defaults
Incrementally upgrade Rails `config.load_defaults` by walking through each new_framework_defaults config one at a time. Use this skill whenever the user mentions load_defaults upgrade, new_framework_defaults, framework defaults, or wants to bring their Rails app's default configuration up to match their Rails version. Also trigger when the user mentions a gap between their Rails version and their load_defaults version (e.g., "app is on Rails 7.2 but load_defaults is 6.1"). This skill handles the iterative uncomment-test-commit workflow and the final consolidation into config/application.rb.
dhh-rails-style
This skill should be used when writing Ruby and Rails code in DHH's distinctive 37signals style. It applies when writing Ruby code, Rails applications, creating models, controllers, or any Ruby file. Triggers on Ruby/Rails code generation, refactoring requests, code review, or when the user mentions DHH, 37signals, Basecamp, HEY, or Campfire style. Embodies REST purity, fat models, thin controllers, Current attributes, Hotwire patterns, and the "clarity over cleverness" philosophy.
security-audit
Audit Rails application code against the OWASP Top 10 — SQL injection, XSS, CSRF, mass assignment, and credential exposure. TRIGGER when the user wants a security review of Rails code or asks about injection/XSS/auth/secret-handling risks. Complements the built-in /security-review.
rails-skills
Ruby on Rails framework patterns, best practices, and implementation guides
ai-agent-guardrails
Apply safety controls when an LLM agent has authority to act on real systems. Covers blast-radius classification, dry-run-first patterns, out-of-band approval gates, scope locking, idempotency, kill switches, and rollback strategies. Invoke when designing an autonomous agent, when granting an LLM write access to production, or after an agent makes an unexpected change.
rails-audit-skill
Perform comprehensive technical reviews of Ruby on Rails applications. Runs automated analysis tools (RubyCritic, Brakeman, bundler-audit, Gitleaks, Debride, linters, SimpleCov, Rails stats, Rails ERD), analyzes code for architecture, security, authorization (Pundit/CanCanCan), dead code, and design issues, and produces a structured markdown report with prioritized findings and a 0-10 score. Use when the user requests a tech review, code audit, project assessment, or quality analysis of a Rails application.
namht-rails-to-spring
Port a service (or a chosen set of endpoints) from one language/stack to another while PRESERVING its contract and business behavior — e.g. Ruby on Rails + GraphQL → Java Spring Boot. Contract-first and parity-verified: freeze the contract, extract the business behavior from the source with parallel multi-lens agents, capture golden/shadow tests of the real responses, re-implement on the target stack, and prove byte-for-byte parity with an INDEPENDENT reviewer before cutover — endpoint by endpoint (strangler). Use when the user says "/port", "migrate to another language", "rewrite in <language>", "Rails to Spring", "port these resolvers/APIs". Edits code — change discipline applies.
design-system
The design system — how to build consistent, modern, responsive UI in Rails 8 + Hotwire + Tailwind CSS v4, brand-parameterised via brand packs. Load this WHENEVER building or reviewing UI: components (buttons, cards, forms, nav, modals, tables, badges, alerts), page layouts, tokens/theming, dark mode, responsiveness, or brand/logo usage. It defines the token architecture (brand primitives → semantic roles → fluid scale), the layout primitives you compose instead of ad-hoc flex/grid, the component catalog with variant/size/state, the Stimulus interaction patterns, and the responsive doctrine. Consistency is enforced here, not left to taste — and **art direction** is taught rather than left undefined: visual hierarchy, per-surface aesthetic intent, and the difference between a surface that is correct and one that is considered.
fidara-design
The Fidara design system — how to build consistent, modern, responsive UI in Rails 8 + Hotwire + Tailwind CSS v4, brand-parameterised via brand packs. Load this WHENEVER building or reviewing UI: components (buttons, cards, forms, nav, modals, tables, badges, alerts), page layouts, tokens/theming, dark mode, responsiveness, or brand/logo usage. It defines the token architecture (brand primitives → semantic roles → fluid scale), the layout primitives you compose instead of ad-hoc flex/grid, the component catalog with variant/size/state, the Stimulus interaction patterns, and the responsive doctrine. Consistency is enforced here, not left to taste — and **art direction** is taught rather than left undefined: visual hierarchy, per-surface aesthetic intent, and the difference between a surface that is correct and one that is considered.
hotwire
Deep reference for the Hotwire stack from the official handbooks — Turbo (Drive, Frames, Streams, morphing page refreshes), Stimulus (controllers, actions, targets, values, outlets), and Hotwire Native (wrap a web app into iOS and Android apps with bridge components and path configuration). Use this skill whenever the user works with Turbo or Stimulus in any backend (Rails, Laravel, Django, Phoenix, plain HTML), mentions turbo-rails, stimulus-rails, @hotwired packages, turbo_frame_tag, turbo_stream, broadcasts, data-controller/data-action/data-*-target attributes, morphing, "SPA-like without a SPA", partial page updates, live updates over WebSockets — or wants a mobile app from their web app: Hotwire Native, Turbo Native, Strada, bridge components, path configuration, WKWebView/ webview wrapper apps, or "turn my Rails app into an iOS/Android app". Also covers production Hotwire patterns extracted from shipped 37signals apps: real-time chat-scale broadcasting, optimistic UI, presence, typing indicators, unread
rails-8
Playbook for building full-stack Ruby on Rails 8.1 applications "the Rails way" — vanilla Rails, Hotwire (Turbo + Stimulus), the Solid stack, Propshaft + importmap, RSpec testing, ecosystem gems, OpenAPI docs, AI features, observability, and Kamal 2 deployment. Use this skill whenever the user is creating, extending, debugging, refactoring, testing, upgrading, documenting, or deploying a Rails app — or mentions Ruby on Rails, a Gemfile containing rails, ERB templates, Active Record, migrations, Hotwire, Turbo, Stimulus, Action Mailer, Active Storage, Action Text, Action Cable, Solid Queue, Solid Cache, Kamal, Thruster, RSpec, FactoryBot, simple_form, Tailwind, OpenAPI, Swagger, rswag, ruby_llm, or `bin/rails` commands. Trigger it for indirect phrasings like "my Ruby web app", "add a background job", "make this page update live", "add login to my app", "document my API", or "add AI to my app" when the project is Rails. Also for "how should I structure this in Rails?" questions.
build-review-md
Use this skill when the user wants to create or set up a REVIEW.md configuration file for their repository. Trigger for ANY of these: (1) user says "create REVIEW.md", "set up REVIEW.md", or "configure review rules", (2) code-gauntlet Phase 2d detects no REVIEW.md and suggests creating one, (3) user wants to customize what the code-gauntlet skill focuses on or ignores, (4) user asks "how do I configure the reviewer" or "how do I set review rules". Do NOT trigger for: reviewing code (use code-gauntlet), explaining what REVIEW.md does in the abstract, or editing an already-complete REVIEW.md the user is satisfied with. This skill NEVER loads into the main code-gauntlet context — it is a standalone configuration wizard.
ruby-rails
Ruby/Rails patterns — fixture builder, RSpec organization, migrations, console verification. Load this skill for Ruby on Rails development tasks. Use during coding phases like IMPLEMENT as well as technical architecture phases like DESIGN.
rspec
When the user wants to design, implement, debug, or optimize RSpec tests in Ruby. Use when the user mentions "RSpec," "describe/context/it," "let," "subject," "shared_examples," "shared_context," "expect(...).to eq," "rspec-rails," "FactoryBot," "VCR," "WebMock," "Capybara," ".rspec," "rspec --tag," or "rspec spec_helper.rb." For Rails system tests see also accessibility-testing and visual-regression. For JS/TS see jest-vitest. For Python see pytest. For Java see junit-testng.
build
Implements code incrementally with quality gates. Use when the user says 'build' or 'implement', or when starting the implementation phase of an approved plan.
rails-generic
General guidance for working on Ruby on Rails applications. Use this skill when creating, extending, debugging, refactoring, testing, or reviewing a Rails app, or when the user mentions Rails, Ruby, Active Record, migrations, controllers, views, models, jobs, or tests.
rails-security
Use when auditing a Rails app for SQL injection, XSS, CSRF, mass-assignment, or Gemfile.lock CVEs, or when reviewing only NEW security regressions in a PR vs base branch.
applying-azure-cost-guardrails
Applies Azure cost guardrails to a deployment — verifies consumption-priced SKUs, scale-to-zero on Container Apps, SQL Serverless auto-pause, Log Analytics dailyQuotaGb cap, Storage lifecycle rules, and the free tiers (SWA Free, ACS 100 emails/day, App Insights 5GB/mo). Audits an existing project's Bicep for accidentally provisioned fixed-cost resources and recommends fixes. Use when designing infrastructure to stay near zero cost when idle, auditing a deployment whose bill has grown, or onboarding to azure-cost analysis via Microsoft's azure-skills.
repo-review
Whole-repository review/audit of an existing or inherited codebase. Use when the user says "review this repository", "audit this codebase", "do a full code review of the repo", "what's wrong with this app", "I just inherited this project", or asks for a multi-axis sweep (e.g. "review for 1. performance 2. code smells 3. structure"). NOT for reviewing a single diff/PR (use the /code-review command) or a one-file change.
fix-issue
Investigates and fixes a GitHub issue. Use when given an issue number or URL, or when the user says 'fix issue'.
dhh-rails-reviewer
Use this agent when you need a brutally honest Rails code review from the perspective of David Heinemeier Hansson. Use kieran-rails-reviewer for strict convention and taste checks; use this agent for opinionated architectural critique.
filing-tracker
Builds and tracks the NBR filing calendar per entity — income tax returns and advance tax under the Income Tax Act 2023, monthly VAT returns under the VAT & SD Act 2012, withholding statements, and customs touchpoints. Use for "what tax filings are due", "tax calendar", "return deadline", or any Bangladesh tax-compliance scheduling.
rails-activestorage
Use when handling file uploads, variants, direct uploads, and rich text attachments
rails-api
Use when building a JSON API with Rails or adding an API namespace to an existing app — Api::BaseController setup, namespace versioning, serialization, CORS, pagination, standardized JSON errors, and request-spec patterns.
rails-audit
Use when auditing, reviewing, or doing a health-check of an existing/inherited Rails app — onboarding to a legacy codebase, assessing technical debt, or a pre-engagement code review. Orchestrates the deep-dive rails-* skills and produces a severity-ranked report. Triggers on: code audit, app review, legacy/inherited Rails app, technical debt assessment, 'review my Rails app'.
rails-clean-test-output
Systematically eliminate unexpected output (warnings, stray puts/p/pp, deprecation notices) from a Rails test suite, one issue at a time, with per-fix verification and commits. Works for both RSpec (`bundle exec rspec`) and Minitest (`bin/rails test`) - detect which the project uses and adapt. Use whenever the user wants to clean up, silence, fix, or investigate noisy test output, mentions warnings or stray logs during test runs, or asks to get their suite running "clean" - e.g. "my test output is noisy", "there's a bunch of warnings when I run specs/tests", "help me clean up the test output".
rails-controllers
Use when writing thin controllers with concerns, resource-oriented design, and REST patterns
rails-core
Use FIRST on any Ruby on Rails work — the project owner's hard-won Rails gotchas and non-negotiable rules (fixtures, migrations, Stimulus LSP, validation, gems, test suite). Read before writing or changing Rails code.
rails-database-performance
Use when reviewing or auditing a Rails app's database schema for missing indexes, slow query patterns, or database performance issues. Triggers on: schema review, slow queries, EXPLAIN ANALYZE output, missing index warnings, or any request to audit db/schema.rb.
rails-i18n
Use when adding or auditing internationalization (I18n) — locale file organization, lazy lookup, pluralization, number/date/currency formatting, per-request locale selection, fallbacks, translating validation errors and model/attribute names, and catching missing/unused keys with i18n-tasks. Triggers on "i18n", "internationalization", "translate", "locale", "pluralize", "missing translation", "l10n", "add a language".
rails-jobs
Use when writing background jobs with Solid Queue, including recurring jobs and context serialization
rails-logging
Rails logging and observability — Lograge for structured one-line request logs, tagged logging with request/user context, sensitive parameter filtering, ActiveSupport::Notifications for custom instrumentation, Sentry/error-tracker integration, health check endpoints, and log-level configuration. Use when setting up a new app's observability stack, debugging noisy logs, or adding structured logging.
rails-mailers
Use when writing, configuring, or testing ActionMailer mailers — layouts, previews, deliver_later vs deliver_now, i18n subjects, attachments, bounce handling, and local dev delivery. Triggers on "mailer", "send an email", "ActionMailer", "email template", "deliver_later", "mailer preview", "bounce".
rails-migrations
Use when writing, reviewing, or executing database migrations — especially on tables with existing data in production. Covers safe zero-downtime patterns, the strong_migrations gem, concurrent index creation, column and table renames, data backfills, and removing columns safely. Extends rails-core rule 5 (multi-step nullable columns) with the full toolkit. Triggers on "migration", "add column", "rename column", "backfill", "index", "drop column", "change column type", "zero-downtime".
rails-models
Use when writing ActiveRecord models with concerns, validations, callbacks, scopes, and associations
rails-multi-tenancy
Use when implementing URL-based multi-tenancy, CurrentAttributes, or account context patterns
rails-performance
Use when optimizing performance with caching, ETags, batching, and N+1 prevention
rails-philosophy
Core philosophies, design choices, and tacit knowledge underpinning 37signals-style Rails development
rails-project-setup
Use when setting up a new Rails 8 project with modern stack (Solid Queue, Solid Cache, Solid Cable, Kamal deployment)
rails-security
Use when implementing authentication, authorization, or security features in Rails
rails-stimulus
Use when writing Stimulus controllers with modern JavaScript patterns (ES2022 private fields, values, targets)
rails-style
Use when following Rails code style conventions for method ordering, conditionals, REST routing, and naming
rails-testing
Use when writing tests with fixtures, system tests, VCR cassettes, and parallel execution, or when profiling/speeding up a slow test suite (Stackprof, Speedscope, TestProf)
rails-turbo
Use when implementing Turbo Frames, Streams, broadcasting, and view transitions in Rails
rails-viewcomponents
Use when creating, extracting, or refactoring ViewComponents in a Rails app — including slot design, component API, testing, and when to extract vs keep as partials
ruby
Core Ruby language best-practices skill (Ruby 3.3/4.0) covering syntax and types, collections/Enumerable, blocks/procs/lambdas, OOP and modules, metaprogramming, Bundler/gems, testing (RSpec/Minitest), style/typing tooling (RuboCop, RBS, Steep, ruby-lsp), and performance/debugging. Use when the user mentions Ruby, gem, Bundler, Gemfile, RSpec, Minitest, RuboCop, irb, pry, blocks, procs, lambdas, mixins, or module/metaprogramming patterns that are not specific to a framework. For Ruby on Rails framework-specific questions (Active Record, routing, Action View, etc.), see the sibling `ruby-on-rails` skill instead.
ruby-on-rails
Comprehensive Ruby on Rails 8.1 best-practices skill covering MVC, Active Record, routing, views, background jobs, storage, security, testing, performance, Kamal/Thruster deployment, and engines/generators. Use when the user mentions Rails, Ruby on Rails, ActiveRecord, ActiveJob, ActionMailer, ActionCable, Active Storage, rails generate, rails routes, Hotwire, Turbo, Stimulus, Kamal, or asks to build, review, debug, or migrate a Rails application or API. For plain Ruby language questions (blocks, modules, metaprogramming, gems, RSpec/Minitest) not specific to the framework, see the sibling `ruby` skill instead.
Integration detected automatically from skill content. Some results may be false positives.