ChulioZ

accessibility-audit

Audit the app's UI/UX for accessibility against a maintained criteria list, and periodically refresh that list from current standards. Use when asked for an accessibility or a11y audit/review, to check WCAG conformance, or to find keyboard, screen-reader, contrast, focus or target-size problems in the UI. Drives the real app in a browser against generated data — never production data. Produces a ranked report; files issues only with your approval.

audit

Run the full audit sweep — accessibility, legal, security, UI, and Claude-file — in one pass and merge the results into a single ranked report with one approval step. Use when asked to audit the app/project/repo generally, for a health check or compliance sweep, before a release or before opening public registration, or when more than one of the five domains is wanted. For a single domain, invoke accessibility-audit, legal-audit, security-audit, ui-audit or claude-file-audit directly.

claude-file-audit

Audit the repo's own documentation — CLAUDE.md, README.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, LICENSE, the community-health files under .github/ (issue forms, PR template, FUNDING.yml) and every committed file under .claude/ (rules, skills, launch config) — for staleness, contradictions and drift from the code, and periodically refresh the criteria from current Claude Code/harness capabilities. Use when asked to audit or review the Claude files, rules, skills, CLAUDE.md, the root docs or the GitHub issue/PR templates, to check whether the repo's own docs still match reality, or to clean up the agent-facing documentation. Produces a ranked report; files issues only with your approval.

create-issue

Interview the user and open a GitHub issue that is specific enough to be implemented without further questions. Use when asked to create/file/open an issue, turn an idea or bug report into a tracked issue, or "write this up as an issue". Grounds the issue in this repo's architecture and asks the user targeted questions to remove ambiguity before filing. Pairs with the `pick-issue` and `implement` skills.

AI & Automation Listed

dependabot

Check for, review, and merge open Dependabot dependency-update PRs. Use when asked to handle/triage/merge Dependabot PRs, clear the dependency-update backlog, or "merge what's safe". Merges every PR that passes review and, for each intentionally held one, leaves a PR comment explaining why and labels it `blocked` so `pick-issue` skips it until re-checked here.

Code & Development Listed

implement

End-to-end workflow for implementing a change: branch from up-to-date main, write the prod code + tests, review locally, commit/push, open a PR, review it, merge with the user's go-ahead if safe, watch main's CI + the Railway production deploy, and clean up the branch. Use whenever you're told to implement, build, add, fix, or otherwise ship something — a GitHub issue on this repo, a directly requested change, or similar. Not for reviewing someone else's PR (use `review-pr`) or triaging Dependabot (use `dependabot`).

legal-audit

Audit the app's legal surface — privacy policy, Impressum, Nutzungsbedingungen and the internal records in docs/legal/ — against what the code actually does, and surface recent legal developments as a sourced reading list. Use when asked for a legal/privacy/GDPR/DSGVO/compliance audit, to check whether the policy still matches the app, or before opening public registration. Produces a ranked report; files issues only with your approval, and never adopts a legal duty on its own.

API & Backend Listed

pick-issue

Survey all open GitHub issues, pending Dependabot PRs, and human-authored pull requests, pick the single best next thing to work on, and hand it to the right builder skill. An open non-draft human PR is reviewed first — only a security exposure or broken core functionality outranks it; everything else is ranked by value-for-effort. Use when asked "what should I work on/implement next?", to triage the backlog, or to choose and start the next issue. Hands the winner to `implement` (issues), `dependabot` (dependency PRs), or `review-pr` (human PRs).

Code & Development Listed

review-pr

Review a GitHub pull request end-to-end to decide whether it is safe to merge. Use when asked to review a PR, check if a PR is mergeable/safe, or vet changes before merging. Not tied to any PR author — works for human and bot PRs alike. For Dependabot-specific batch triage, use the `dependabot` skill (it calls this one per PR).

security-audit

Audit the app's security surface — authentication, authorization and tenant isolation, transport/CSRF/cookies, injection and SSRF, uploads and storage, secrets and logging, the CI security tooling, and public-repo disclosure risk (code whose secrecy is load-bearing) — against a maintained criteria list, and periodically refresh that list from current threats. Use when asked for a security audit/review, a pentest-style pass, or to find and close security holes, and before opening public registration. Defensive only: finds weaknesses to fix them, never to weaponize; a confirmed live hole is disclosed privately. Composes with the built-in /security-review and CodeQL rather than duplicating them. Produces a ranked report; files issues only with your approval.

test-data

Create isolated, throwaway test data for automated tests (or manual dev runs) and clean it up afterward. Use when a test or a local experiment needs rounds, games, sessions, or votes to run against, and you must NOT touch the real data/ folder. Covers the temp-DATA_DIR pattern, seeding via the API vs. a raw data.json, and teardown.

Web & Frontend Listed

ui-audit

Audit the app's visual design — colour, layout, spacing, typography, depth, iconography, imagery and motion polish — against a maintained criteria list, and drive it toward being genuinely beautiful and characterful while staying within the brand. Use when asked to improve the UI, make the app prettier/fancier/more polished/stunning, review the visual design, or tighten the look and feel. Plain UI only — never UX (no flows, steps, screen order or copy); accessibility is the accessibility-audit skill's job. Drives the real app in a browser over generated data. Produces a ranked report with before/after evidence; files issues only with your approval.