michaelalber
UserProduction-ready AI coding skills and agents for Claude Code, OpenCode, and Pi. Covers TDD, .NET, Python, Rust, edge AI, and more.
Categories
Indexed Skills (50)
codebase-design
Shared vocabulary for designing deep modules — a lot of behaviour behind a small interface, placed at a clean seam, testable through that interface. Use when designing or improving a module's interface, finding deepening opportunities, deciding where a seam goes, making code more testable, or when another skill needs the deep-module vocabulary. Pairs with improve-codebase-architecture (which applies it) and domain-model (which supplies the domain nouns). Ported from https://github.com/mattpocock/skills (Matt Pocock).
improve-codebase-architecture
Deep module refactoring using APOSD vocabulary: eliminates shallow modules, reduces information leakage, resolves temporal coupling, and aligns naming with the ubiquitous language. Use when asked to "improve the architecture", "refactor this module", "apply APOSD", or "clean up the design". Works best after domain-model is established. Ported from https://github.com/mattpocock/skills (Matt Pocock).
domain-model
Interrogates a plan or codebase using Domain-Driven Design vocabulary. Enforces CONTEXT.md terminology, surfaces code/plan contradictions, and records domain decisions as ADRs sparingly. Use when designing a bounded context, reviewing a domain model, or asked to "apply DDD", "model the domain", or "review the domain model". Creates CONTEXT.md lazily from CONTEXT-FORMAT.md when the first term is resolved. Model-invocable so grill-with-docs, improve-codebase-architecture, codebase-design, and qraspi-architecture can pull it in mid-session. Ported from https://github.com/mattpocock/skills (Matt Pocock).
grilling
Interviews the user relentlessly about a plan, decision, or idea — one question at a time, each with a recommended answer. Shared engine behind "grill-me" and "grill-with-docs". Use on any "grill" trigger phrase or to stress-test thinking. Do NOT use to build the plan; it ends at shared understanding, not implementation.
architecture-journal
Lightweight ADR templates with retrospective prompts at 30/90/180 days — converts experience into transferable expertise. Use when making architecture decisions, recording technical choices, or reviewing past decisions to extract lessons.
architecture-review
Devil's advocate architecture critic -- challenges designs via Socratic questioning against SOLID, coupling, failure modes, scalability, and operational complexity. Use when stress-testing an architecture decision, evaluating a proposed system design, reviewing architecture before implementation, or asked to critique a technical approach.
code-review-coach
Deliberate practice for code review — review code yourself first, then compare against expert analysis with category-based scoring. Use when practicing code review skills, improving review quality, calibrating finding severity, or building more systematic review habits through deliberate practice.
dependency-mapper
Coupling visualization with Robert C. Martin stability metrics — makes architectural decisions visible as dependency patterns. Use when analyzing module dependencies, detecting circular references, visualizing coupling, or assessing architectural health through Robert C. Martin stability metrics.
pattern-tradeoff-analyzer
Pattern selection coach -- presents 2-3 patterns with explicit tradeoffs for your problem, challenges golden hammer tendencies, and builds pattern selection judgment. Use when choosing between design patterns, architectural approaches, or implementation strategies.
pr-feedback-writer
Review communication coach — practice writing constructive PR feedback with proper blocking/suggestion/nit classification, empathetic framing, and clear explanations. Use when writing PR review comments, practicing constructive feedback, improving how code review findings are communicated, or learning to classify findings as blocking, suggestion, or nit.
refactor-challenger
Refactoring prioritization coach — distinguishes "bothers me aesthetically" from "will cause a production incident." Use when deciding which refactoring to prioritize, building a business case for technical improvements, or practicing the distinction between aesthetic preferences and production-risk code smells.
security-review-trainer
Progressive security review challenges -- intentional vulnerabilities embedded in clean code, scored findings, and increasing subtlety. Use when building security review skills, practicing vulnerability identification, developing severity judgment, or training to detect subtle security flaws in progressively harder code samples.
spec-coach
Interactive spec design coach. Guides through vision, PRD structure, three-tier boundary definition, INVEST user-story quality, specification by example, and measurable success criteria to produce a complete, deployable spec. Use when designing a new skill, agent, feature, or any AI system that needs explicit behavioral boundaries — writing an agent spec, an SRS/requirements doc, a spec.md/plan.md, or running a spec-kit/specify workflow.
system-design-kata
Domain-calibrated system design exercises — security workflows, edge fleet management, hybrid cloud, and real-world scenarios. Use when practicing system design, developing distributed systems trade-off judgment, or improving design skills through domain-specific scenarios covering edge AI, security workflows, and hybrid cloud. Distinct from generic interview prep.
technical-debt-assessor
Technical debt quantification practice — deliberate vs accidental debt, cost-to-fix vs cost-to-carry analysis, interest rate estimation, and business case building. Use when developing judgment about which technical debt to pay down, building a business case for improvements, or deciding whether to accept or address identified debt.
4d-schema-migration
Parses 4D application exports and generates SQL Server DDL, EF Core entities, and Blazor UI guidance. Use when migrating from 4th Dimension (4D) platform to .NET/SQL Server.
alembic-migration-manager
Manages the full Alembic migration lifecycle with safety checks and rollback planning. Python analog of ef-migration-manager. Use when creating, reviewing, or applying database migrations in Python projects using SQLAlchemy and Alembic.
automated-code-review
Systematic review execution engine -- transforms structured human review coaching patterns into autonomous review checklists with pass/fail gates, convention detection, and structured finding production. Use when running autonomous code reviews to ensure systematic coverage and consistent quality.
axum-scaffolder
Scaffolds Axum HTTP endpoints with OpenAPI (utoipa), Tower middleware, JWT auth, rate limiting, CORS, health checks, and versioning. Axum-first: typed extractors, typed responses, compile-time route verification. Use when creating Rust REST APIs, scaffolding Axum endpoints/projects, configuring Tower middleware, or adding OpenAPI/JWT to Axum. Not when the codebase uses Actix-web — Axum-into-Actix needs manual integration not covered here.
capture-consolidate
Merges multiple capture documents from transcript-capture and email-capture into a unified intake bundle. Assigns canonical per-project REQ-XXX IDs, deduplicates overlapping requirements, surfaces cross-document contradictions for PM resolution, and produces a final capture bundle ready for spec generation. Use when two or more capture documents from transcript-capture or email-capture need to be merged into a single intake bundle for spec generation.
cargo-package-scaffold
Cargo crate creation with CI/CD pipeline setup, test harness, and crates.io publish workflow. Use when creating new Rust crates, configuring Cargo.toml metadata, setting up GitHub Actions for Rust CI, or publishing to crates.io. Do NOT use when the crate is internal-only and not intended for crates.io publication; Do NOT use when the target is a binary application — this skill targets library crates.
confluence-guide-writer
Reads Confluence spec pages and/or source code and generates well-formatted tutorial and user-guide content for a Confluence space's user-guide section, targeting client/end-user/stakeholder audiences. Use when writing Confluence user guides, generating tutorial or how-to pages for clients/end users, or producing stakeholder docs from spec pages or source. Not for detecting or reconciling stale pages — use doc-sync.
doc-sync
Documentation staleness detection, XML doc comment generation, and README synchronization -- keeps documentation accurate and in sync with code changes. Use when auditing documentation coverage, generating XML doc comments, or syncing READMEs after code changes.
dotnet-architecture-checklist
Grades an existing .NET solution against the style it actually uses — controller-based layered/N-tier Web API OR vertical-slice CQRS (FreeMediator/Mapster)/Blazor — detecting framework, hosting model, and style FIRST (a layered API is not penalized for not being vertical-slice), then checking architectural coherence, controller/handler discipline, EF Core lifetimes, framework health, and config/secrets hygiene with file:line evidence. Use to review or grade a .NET solution. Not for Socratic critique (architecture-review), security audits (dotnet-security-review), or new test-first code (tdd).
dotnet-controller-api-scaffolder
Scaffolds controller-based ASP.NET Core Web API endpoints ([ApiController]/ControllerBase) that CONFORM to an existing codebase — base controller, validation (DataAnnotations or FluentValidation), service layer vs. mediator, response envelope, routing, versioning, DI. Detect-and-match, never impose. Use when adding controllers/actions to an existing controller-based API. Not for greenfield Minimal APIs (minimal-api-scaffolder); use dotnet-vertical-slice only when the team has chosen CQRS/vertical-slice.
dotnet-security-review
OWASP-based security review of .NET/.NET Framework apps with Telerik UI specialization. Detects framework and entry points, scans the OWASP Top 10 (2025) mapped to .NET patterns (deserialization, injection, auth, Telerik, crypto, secrets), and emits an exec summary plus graded findings. Use to audit .NET for vulnerabilities. Not for architecture grading (dotnet-architecture-checklist).
dotnet-vertical-slice
Scaffold vertical slice architecture with CQRS + FreeMediator, including optional Telerik Blazor UI generation. Use when creating feature-based .NET projects with command/query separation and pipeline behaviors. Do NOT use when the project uses layer-based (N-tier) architecture — this skill enforces feature folder structure and will conflict with existing layer conventions.
ef-migration-manager
EF Core migration lifecycle with safety checks and rollback planning. Use when creating, reviewing, or applying database migrations in .NET projects. Do NOT use when the goal is initial schema design or ad-hoc SQL management; Do NOT use when the project uses Dapper or raw SQL without an EF Core DbContext.
email-capture
Converts email threads, SOWs, change requests, and pasted documents into structured capture documents for spec-driven development. Extracts requirements, decisions, commitments, and open questions with source attribution to sender and message date. Use when given an email thread, SOW, change request, or pasted document that needs to be converted into structured requirements with per-message source attribution.
environment-health
Docker health checks, service monitoring, container lifecycle management, connection validation, and environment diagnostics. Use when troubleshooting dev environment issues or performing health audits.
evaluate-tests
Audits existing tests in two modes: (1) test-file quality — grades tests against Beck's behavioral and structure-insensitive criteria, flagging implementation-coupled, fragile, and theater tests with a prioritized rewrite list; (2) TDD compliance — analyzes git history for test-first discipline, producing a 0-25 scorecard with AI anti-pattern findings. Use when auditing inherited suites, checking AI-generated tests before merge, prepping for safe refactoring, or verifying TDD was followed. Not for writing new tests (tdd), or when there are no tests yet.
fastapi-scaffolder
Scaffolds FastAPI endpoints with OpenAPI documentation, Pydantic v2 request/response models, JWT authentication, rate limiting, and health checks. Python analog of minimal-api-scaffolder. Use when creating REST APIs, adding endpoints, setting up FastAPI projects, or configuring API infrastructure.
fitness-functions
Author architectural fitness functions and wire them into a target project's CI as gatekeepers. Use for "add a fitness function", "wire an arch test as a CI gate", "enforce layering in CI", "fail the build when the dependency rule is violated". Per-stack tool selection (NetArchTest, import-linter, cargo-deny, Conftest). Do NOT use to run an existing test suite -- that is tdd. Do NOT use to analyze coupling for insight without gating -- that is dependency-mapper.
jira-comment-writer
Plain-language Jira comment drafter for project managers and clients. Translates technical progress, blockers, and decisions into clear, jargon-free updates. Use when adding a comment to a Jira issue that a non-technical stakeholder will read. Do NOT use when the audience is engineers or technical peers — use pr-feedback-writer instead; this skill targets non-technical stakeholders only.
jira-review
Reviews Jira issues for implementation readiness. Detects complexity signals, parses acceptance criteria, and recommends clarification or planning mode when needed. Use when reviewing a Jira issue for readiness, checking whether a ticket has enough detail to implement, assessing acceptance-criteria completeness, or evaluating a story before sprint planning. Not for completed implementations (reviews readiness, not accuracy), or non-Jira trackers.
legacy-migration-analyzer
Analyze .NET Framework to .NET 10 migration paths. Use when assessing legacy codebases for modernization, identifying breaking changes, and planning incremental migration strategies. Also
minimal-api-scaffolder
Scaffolds .NET 10 Minimal API endpoints with OpenAPI documentation, versioning strategies, and security patterns. Use when creating REST APIs, adding endpoints, setting up API projects, or configuring API infrastructure. Do NOT use when the project is controller-based MVC — use dotnet-vertical-slice for handler architecture instead.
nuget-package-scaffold
NuGet package creation with CI/CD pipeline setup and test harness. Use when creating new NuGet packages, configuring package metadata, or setting up publish workflows. Do NOT use when the library is internal-only and not intended for NuGet publication; Do NOT use when the target is an application project.
oss-vetting
OSS library vetting and SBOM analysis for federal contractor environments (LANL/DOE/CUI). Use this skill when evaluating any open-source or third-party package for use in a federal contractor project — including NuGet packages, npm, PyPI, or any OSS library. Triggers include: vet this library, can we use X in LANL, is X approved for CUI systems, evaluate this NuGet package, generate an SBOM, supply chain risk, check this dependency, OSS assessment, 800-171 compliance for this package, C-SCRM review. Also trigger for any question about whether a library is safe, compliant, or appropriate for use on a government contract or CUI-adjacent system.
para-file
Captures and files an incoming document into the PARA system (Projects, Areas, Resources, Archives) across local folders, OneDrive/Teams synced paths, and Confluence/Jira — scaffolding the PARA structure if missing and classifying by actionability. Use when filing a new note, document, link, or downloaded file; when sorting an inbox; or when asked "where does this go" / "file this". Do NOT use for periodic review, auditing, or archiving completed work — use para-review instead.
para-review
Runs a periodic PARA review across local folders, OneDrive/Teams synced paths, and Confluence/Jira: a hygiene audit (misfiled items, stale Projects, archivable Resources, empty Areas), the weekly review ritual (process inbox, update project list, surface what needs attention), document summarization, and safe archiving of completed/inactive items. Use for "weekly review", "PARA audit", "clean up my files", or "archive finished projects". Do NOT use to file a single new document — use para-file instead.
php-api-scaffolder
Scaffolds Laravel API endpoints with API Resource responses, Form Request validation, Sanctum authentication, throttle-based rate limiting, URI versioning, OpenAPI documentation, and health checks. PHP analog of fastapi-scaffolder, minimal-api-scaffolder, and axum-scaffolder. Use when creating REST APIs in Laravel, adding API endpoints, setting up API routing and middleware, or configuring API infrastructure.
php-architecture-checklist
Grades an existing PHP/Laravel codebase. Detects PHP version, framework (Laravel/Symfony/plain), and autoloading layout, then checks service-layer boundaries, strict typing, input validation, query safety, and config/secrets hygiene with file:line evidence. Use to review or grade a PHP codebase. Not for Socratic critique (architecture-review), security audits (php-security-review), or new test-first code (tdd).
php-feature-slice
Scaffolds feature-based PHP / Laravel architecture using feature folders, thin controllers, Form Requests, a service/action layer, and API Resources. PHP analog of dotnet-vertical-slice and python-feature-slice — no mediator library; uses the Laravel service container for dependency injection and structural CQRS conventions. Use when creating feature-based PHP projects, adding Laravel features, scaffolding service layers, or organizing PHP code by feature rather than by technical layer.
php-migration-manager
Manages the full Laravel database migration lifecycle with safety checks and rollback planning (PHP analog of ef-/alembic-/sqlx-migration-manager). Covers create, review, apply, and rollback; enforces a reversible down(), expand-contract for zero-downtime changes, and guards against destructive operations in production. Use when creating or reviewing Laravel migrations, planning a schema change, applying/rolling back, or designing a zero-downtime migration.
php-package-scaffold
Scaffolds production-ready Composer packages for Packagist with a complete composer.json, PSR-4 autoloading, a Pest/PHPUnit test harness, GitHub Actions CI (PHP version matrix, PHPStan, PHP-CS-Fixer), and a semver tag-based publish workflow. PHP analog of nuget-package-scaffold, pypi-package-scaffold, and cargo-package-scaffold. Use when creating a reusable PHP library, configuring composer.json metadata, setting up Composer/Packagist publishing, or building a PHP package CI pipeline.
php-security-review
OWASP-based security review of PHP / Laravel applications. Detects the framework and entry points, scans against the OWASP Top 10 (2025) mapped to PHP/Laravel patterns (mass-assignment, query injection, Blade XSS, auth/session, file uploads, secrets), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit PHP code for vulnerabilities. Do NOT use to grade architecture/structure — use php-architecture-checklist.
pypi-package-scaffold
Scaffolds production-ready PyPI packages with pyproject.toml, hatch/flit/build tooling, GitHub Actions publish workflow, test harness, and documentation. Python analog of nuget-package-scaffold. Use when creating Python packages, setting up PyPI publishing, configuring package metadata, or building Python libraries.
python-architecture-checklist
Grades an existing Python codebase. Detects Python version, framework (FastAPI/Django/Flask), and package layout, then checks clean-architecture boundaries, type-safety discipline, complexity, dependency direction, and config/secrets hygiene with file:line evidence. Use to review or grade a Python codebase. Not for Socratic critique (architecture-review), security audits (python-security-review), or new test-first code (tdd).
substack-writer
Structured multi-pass pipeline for turning raw technical notes into publication-quality Substack/blog posts for a professional software-engineering portfolio. Use whenever the user wants to draft, outline, revise, or polish a Substack post, technical blog article, or portfolio writing piece — especially anything about AI-augmented development, edge AI, RAG, .NET/C#, Python, Rust, APIs, or industrial automation. Trigger even if they just say "help me write a post about X" or paste raw notes to turn into an article. Keeps the human as the source of technical substance and applies editorial craft rather than generating generic filler.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.