NeuralMedic-DE

a11y-gate

Audit and fix web accessibility to WCAG 2.2 AA, gated by automated checks that actually run — axe-core via Playwright for violations, scripted keyboard/focus and reflow audits, plus a mandatory manual + screen-reader checklist. Use when the user wants to make a site/app/page accessible, fix a11y or WCAG/ADA/Section 508 issues, add an accessibility CI gate, run an axe/Lighthouse-style audit, check keyboard navigation, color contrast, ARIA, screen-reader support, or remediate accessibility violations. Triggers: "accessibility", "a11y", "WCAG", "ADA compliance", "screen reader", "keyboard navigation", "axe audit".

dbt-data-quality-gate

Enforce data quality, testing, contracts, and PII governance in a dbt project, gated by checks that actually run over dbt's compiled artifacts (target/manifest.json, target/run_results.json) — both plain JSON, so the gate is stdlib-only Python with no warehouse connection. Use when the user wants to add a data-quality CI gate, require tests/descriptions/owners on dbt models, enforce data contracts, check source freshness, find untagged PII columns, set a minimum test count or test pass-rate, or harden a data pipeline before merge. Triggers: "dbt", "data quality", "data contracts", "PII", "data tests", "freshness", "data pipeline gate".

Testing & QA Listed

full-stack-test-gate

Test a whole application and prove it works, gated by checks that actually run — the project's own unit/integration/regression suites, then a real browser that boots the app, clicks through every feature flow, screenshots each step, and fails on console errors, uncaught exceptions or failed requests; plus pixel-level visual regression and a crawler that reports which features no test touches. Use when the user wants to test an app end to end, write or run unit / integration / regression tests, set up E2E or Playwright testing, drive the UI and take screenshots, verify a change didn't break anything, add a test gate to CI, or find out what is untested. Triggers: "test the app", "end-to-end", "e2e", "regression test", "unit tests", "Playwright", "screenshot the UI", "click through the app", "smoke test", "QA", "visual regression", "test all features", "does it still work".

Data & Documents Listed

healthcare-data-interop

Build and validate healthcare-data pipelines and de-identify PHI, gated by checks that actually run — structural FHIR R4 validation, HL7 v2.x parsing, a Safe-Harbor PHI regex scan, and pydicom-based DICOM header de-identification with a re-read verify step. Use when the user works with DICOM, HL7 v2, or FHIR data; needs to ingest/transform/map clinical data; wants to de-identify or anonymize PHI; checks interoperability conformance; or builds a healthcare data pipeline. Triggers: "DICOM", "HL7", "FHIR", "de-identify PHI", "anonymize patient data", "healthcare data pipeline", "interoperability", "Safe Harbor", "US Core", "IHE".

DevOps & Infrastructure Listed

iac-compliance-review

Review Terraform / infrastructure-as-code for security and compliance gaps and EU data residency, gated by a check that actually runs over the plan — it parses `terraform show -json` output, applies a policy catalog (public storage, unencrypted data, open security groups, wildcard IAM, missing logging, non-EU regions, missing tags, public IPs), maps each finding to ISO 27001 Annex A / SOC 2 TSC / GDPR articles, and fails the build on blocking-severity findings. Use when the user wants an IaC security or compliance review, a cloud-config audit, a data-residency check, or to gate Terraform in CI. Triggers: "Terraform", "infrastructure as code", "IaC security", "cloud compliance", "data residency", "ISO 27001", "SOC 2", "GDPR", "encryption", "IAM".

medical-ai-compliance-gate

Audit a medical/health-AI codebase or data pipeline against GDPR, EU MDR, ISO 27001, and SOC 2 — gated by automated checks that actually run. A stdlib Python scanner runs ~29 heuristics from a 47-control catalog (hardcoded secrets, PII/PHI in logs, encryption at rest, TLS, audit logging, retention/ erasure, RBAC, EU data residency, consent, model cards, data lineage, SBOM, dependency pinning, CI/tests/monitoring), maps each finding to its control + framework + severity, fails the build on blocking gaps, and sends the rest to a mandatory human attestation. Use for a compliance/readiness audit or gap analysis, a healthcare/medical-AI compliance checklist or CI gate, or a DPIA/RoPA starting point. Honest scope: engineering assistance to PREPARE for compliance — NOT legal advice, certification, an MDR conformity assessment/CE marking, or a Notified Body, ISO, or SOC 2 audit. Triggers: "GDPR", "MDR", "medical device software", "MDSW", "ISO 27001", "SOC 2", "compliance gate", "DPIA", "healthcare AI audit".

odoo-addon-publisher

Produce sale-ready Odoo addons/modules that follow the Odoo Apps Store vendor guidelines for Odoo 18.0 and 19.0, gated by a validator that runs. Scaffolds a guideline-compliant module (manifest, company/vendor info, OPL-1 licensing, static/description/index.html, icon, cover image and screenshots) and verifies any addon against the rules. Use when the user wants to build, package, publish or submit an Odoo app/module/addon, fix a __manifest__.py, prepare an App Store listing, add a cover image/icon/screenshots, or check Odoo Apps compliance. Triggers: "Odoo module/addon/app", "publish to Odoo Apps", "__manifest__.py", "OPL-1", "Odoo App Store", "Odoo 18 / 19 module".

rag-eval-guardrails

Build a verified eval harness for a RAG/LLM feature plus PII/PHI-leakage guardrails, gated by checks that actually run. Scores a precomputed predictions file (so it runs with ZERO API access) on groundedness, citation validity, retrieval hit@k, answer F1/exact-match, refusal rate, and latency; compares to config thresholds and a baseline to catch regressions; and fails the build on PII/PHI leakage. Use when the user wants to evaluate or regression-test an AI/RAG feature, measure hallucination/groundedness, add an eval gate to CI, or scan prompts/answers/logs for leaked identifiers. Triggers: "RAG evaluation", "LLM eval", "eval harness", "hallucination", "groundedness", "PII/PHI leakage", "guardrails", "regression testing for AI features".

DevOps & Infrastructure Listed

secure-deploy-gate

Harden and pentest a web deployment, gated by checks that actually run — a stdlib Python scanner probes a live target's TLS/HTTPS (cert validity, weak protocols, HTTP→HTTPS redirect), security headers (HSTS, CSP, cookies, version disclosure), and connect-scans for risky internet-exposed ports (databases, caches, admin/Docker/Kubelet APIs), plus an offline static audit of the reverse-proxy and container config (Caddy, nginx, docker-compose, Dockerfile) — and ships a hardened Caddy/nginx/firewall reference setup. Findings map to a severity and fail the build; active scanning is authorization-gated. Use to secure or harden a deployment, pentest/scan your own server or site, set up HTTPS/TLS properly, pick a reverse proxy (Caddy), find open ports or exposed services, add security headers, or gate deployment security in CI. Triggers: "secure deployment", "pentest my server", "harden", "HTTPS/TLS setup", "Caddy", "reverse proxy", "open ports", "exposed database", "security headers", "HSTS".

Web & Frontend Listed

webflow-to-react

Convert a Webflow page or site into a pixel-perfect React implementation (Vite or Next.js) with Playwright visual-regression testing as the correctness gate. Use when the user wants to migrate, port, rebuild, clone, or recreate a Webflow design 1:1 in React, move off Webflow, or set up screenshot/visual-diff testing of a rebuilt page against the original. Triggers: "convert Webflow to React", "rebuild this Webflow site in Next.js", "pixel-perfect clone", "visual regression vs the original".