galaykos

by Ivan-WG

Payments and billing discipline (Stripe/Paddle/Braintree): PCI scope minimization via tokenization, integer-minor-unit money, signature-verified idempotent webhooks, subscription state machines and activation races, dunning and proration, and an append-only ledger with reconciliation — a firing payments skill and a /payments:review command. The failure class is double-charges and revenue leaks.

by Ivan-WG

Meta-bundle: the PHP category in one install — laravel (Laravel best practices and the Inertia.js skill behind one /laravel:review, plus the backend-engineer worker), web-dev (the generalist worker, the frontend-reviewer, and the Vite skill for Laravel's default asset bundler via /web-dev:review) and code-review (the review fan-in plus comment discipline: no-comment default, write-time denies for restatement, commented-out code, signature-repeating docblocks and files over the comment ceiling). Uninstall cleanly with /php-suite:uninstall — removes the bundle and prunes its auto-installed plugins.

by Ivan-WG

Scan the current project's manifests and suggest every cc-plugins-marketplace plugin in three tiers — stack-matched, the curated any-project core, and the universal remainder — then install the picked ones after confirmation; --yes auto-installs the first two tiers, --full installs everything relevant to the detected stack after one plan confirm (--stack a,b,c fills in a stack the manifests do not show yet), --all offers every row explicitly, --persist/--global choose scope. Includes /plugin-scout:suggest.

by Ivan-WG

Meta-bundle: the engineering-process category in one install — git workflow, approach deliberation (build-vs-buy, estimation, rollout, pattern selection folded in), hindsight mining, docs discipline (api-design), subagent orchestration, task execution, stack scanning, plugin scouting, a token-cost warn hook (lean), file-aware skill auto-routing (skill-router), a stronger-model second opinion when stuck (fresh-take), a refuting research harness (ultra-deep-research), and a committed codebase map (brain). Uninstall cleanly with /process-suite:uninstall — removes the bundle and prunes its auto-installed plugins. 200k-window installs: see the README's context-window requirement first.

by Ivan-WG

Meta-bundle: the code-quality disciplines that advise rather than enforce — approach deliberation and design patterns, OWASP security review and threat modeling, systematic debugging, resilience (failure modes, error handling, concurrency, observability, measure-first performance), dependency hygiene and stack inventory (stack-scan), and test design and coverage review. Accessibility auditing lives in ui-ux (frontend-suite, craft-suite). Split out of quality-suite so a project can take the enforcing half without the advisory half's always-on context; the membership rule is prose, not script-checked. Uninstall cleanly with /quality-principles-suite:uninstall. 200k-window installs: see the README's context-window requirement first.

by Ivan-WG

Meta-bundle: the code-quality plugins that carry an enforcement mechanism — review and code smells with the single-pass fan-in, architecture's evidence-at-claim Stop gate, candor's citation-and-reversal Stop gate, comment discipline (warn-on-write plus a narrow pre-write deny), destructive-command blocking, secret-leak prevention, a token-cost warn hook (lean), and file-aware skill auto-routing. The advisory nine live in quality-principles-suite; the membership rule is prose, not script-checked. Uninstall cleanly with /quality-suite:uninstall.

by Ivan-WG

Runtime quality in one plugin — does it stay up, can you see it, is it fast. Failure-mode design for integration points (timeouts, retries with backoff and idempotency, circuit breaking, graceful degradation, delivery semantics) with the merged error-handling and concurrency disciplines and the event-driven skill (brokers, outbox, sagas, DLQ, consumer idempotency); application observability (structured logs with correlation IDs, RED/USE metrics without cardinality bombs, trace propagation, honest health checks); and measure-first performance (N+1, payload, bundle, Core Web Vitals, cache correctness, percentile load tests). One audit, /resilience:review, over all six rubrics or one of them via --concern, and two workers, observability-engineer and performance-engineer, that apply only what a measurement or a finding proves.

by Ivan-WG

Secret-leak prevention: a PreToolUse hook that blocks a Write/Edit introducing a high-confidence secret (cloud keys, private-key blocks, provider tokens, assigned secret literals) before it reaches disk, plus a /secret-scanning:scan command to sweep a path or diff on demand. Fail-open, high-confidence-only, with a fixture escape.

by Ivan-WG

Security for web apps: OWASP-aligned code review (injection, XSS, CSRF, authz vs authn, mass assignment, uploads, secrets, dependency audit) mapped to PHP/Laravel and JS/Vue, PLUS design-phase threat-modeling (STRIDE, trust boundaries), a data-privacy (GDPR/CCPA) regulatory lens, and an api-auth lens (token model, OAuth2+PKCE, scopes). Includes /security:review and a security-engineer worker agent.

by Ivan-WG

File-aware skill auto-routing: a PostToolUse hook injects one additionalContext directive to load the relevant best-practice skill(s) when you edit a matching file (PHP/Laravel/Blade, React/Vue/Inertia/Livewire via .tsx/.jsx/.vue, plain .ts/.js/.py/.go/.rb/.rs, SQL and migrations (one engine-agnostic rubric, plus a MariaDB row where that engine is detected), components, tests, Dockerfiles, OpenAPI), a SessionStart hook primes a repo-tailored skill index, and low-confidence content signals flush as one digest on your next prompt (SessionEnd keeps the ledger). Every relevant skill co-fires per edit; fail-open, once per skill per session.

by Ivan-WG

Know what is installed, keep it healthy, find what to add. /stack-scan:report inventories manifests, lockfiles (composer, npm/yarn/pnpm/bun), runtimes and docker images into a required-vs-installed table with drift, missing locks and EOL majors flagged. /stack-scan:audit runs the composer/npm vulnerability, outdated and licence checks (package-hygiene) — report-only. /stack-scan:suggest reads the same manifests and suggests every marketplace plugin in three tiers with cited evidence (--yes auto-installs tiers 1-2, --full the whole stack-relevant set after one confirm, --persist/--global set scope); --skills searches skills.sh for third-party skills instead — provenance, preview, explicit picks only. Add-at-all is approaches' build-vs-buy.

by Ivan-WG

System-level design: service boundaries on data ownership, scaling paths, cache placement, sync vs async integration and its failure modes, single points of failure, plus domain modeling (bounded contexts, aggregates, ubiquitous language) and an event-driven skill (delivery semantics, outbox, sagas, DLQ) — firing system-design, domain-modeling, and event-driven skills, a /system-design:review command, and a system-architect worker + system-design-reviewer pair. Complements code-architecture (code-level structure) without overlapping it.

by Ivan-WG

Disciplined task execution: one task at a time, scope locked to the task, bounded verify-fix inner loop per task, no drift, no unbounded outer loop. Completion means every check passed with evidence — held at Stop by candor's gate (clause 4) when candor is installed; without it a run can end by narration. Ships the shared task-executor agent — the delegatable 'apply the fixes' sink every review routes to — a PostToolUse scope-lock tripwire, parallel-planning (/task-runner:plan), and the subagent discipline (the orchestration plugin was merged in on 2026-09-14): delegation contracts, verification panels, scripts/dispatch-lint.sh, and the ultra-assess boost hook.

by Ivan-WG

Idea-to-execution clarification: brainstorm fuzzy ideas into approved designs, grill requirements until zero ambiguity, deliberate the implementation approach with a blind four-persona round (via the approaches plugin when installed; inline 2-3 approaches otherwise), decide visual choices with mockups, validate whole experiences with an interactive clickable demo, then emit milestone-grouped single-prompt task cards. Outputs live under taskmaster-docs/ (no collision with a project's own docs/).

by Ivan-WG

Meta-bundle (10 plugins): the clarification-to-execution pipeline and only what it dispatches into — taskmaster planning, task-runner execution, orchestration, code-architecture, approaches, stack-scan, skill-router, plus the ui-ux, testing and security lanes its cards route to. Trimmed from 32 on 2026-08-31 to fit the host's skill-listing budget: over that cap the host drops descriptions name-only and the surviving set varies per reload, so the extra members cost reachability for every member. Install the rest individually. Uninstall cleanly with /taskmaster-suite:uninstall. 200k-window installs: see the README's context-window requirement first.

by Ivan-WG

Chat-message brevity as a shape contract, not a word filter: prose-line budgets per turn kind, a fixed work-done skeleton (verdict → artifacts → max 5 findings → blocker → next), and a named cut list. Levels lite/full/ultra plus wenyan (classical-Chinese novelty) variants, hook-reinforced each turn. Out of scope: code, files written, subagent prompts, and how much work a turn does. Ships /terse:commit, /terse:compress, /terse:check, three compressed-return agents, and an opt-in MCP catalog shrinker.

by Ivan-WG

Testing best practices: test pyramid and what to actually test, Pest/PHPUnit and Vitest/Jest idioms, Playwright/Dusk e2e discipline, factories and fixtures, mocking boundaries, flaky-test causes, coverage traps — plus the TDD workflow (red-green-refactor, red-green regression proof for bug fixes). Includes /testing:flake-hunt and a test-engineer worker agent; the test rubric reaches any diff through /code-review:review.

by Ivan-WG

Five expert reviewers that RUN the project's own static analysis instead of reciting a best-practice checklist: php-expert (phpstan, psalm, phpcs, rector), ts-expert (tsc, eslint, biome, oxlint), react-expert (the hook rules), vue-expert (vue-tsc, eslint-plugin-vue) and ui-expert (stylelint, pa11y, lighthouse-ci, axe). A detect-analyzers.sh mechanism reports which tool is configured, which one CI actually enforces, what the baseline already forgives and which rules are switched off — so the headline finding is the analyzer's blind spot, which no remembered rubric can produce. Read-only; fixes route to the existing workers.

by Ivan-WG

UI/UX best practices with per-stack skills: shadcn/ui, ReUI, Aceternity UI, Astryx, Material UI, Tailwind, plus a library-agnostic component-libraries skill (headless and styled React libraries, owned-code vs dependency rules, a per-library map) — plus a design-tokens skill (spacing/type/radius/elevation/motion scales + semantic color tiering), a theming-system skill, theme creation with a live colour preview, a /ui-ux:build entry point, a WCAG 2.2 AA accessibility audit (/ui-ux:audit, the a11y-audit skill, and an a11y-engineer worker that applies the fix list with native semantics over ARIA patches), and ui-ux-reviewer + ui-ux-engineer agents.

by Ivan-WG

Deep-research harness that fans out parallel web searches, tiers sources by provenance, extracts date-stamped claims, and adversarially refutes them before synthesizing a cited report with a contradiction ledger and per-section confidence. Trigger 'ultra-deep-research' escalates to a Workflow-driven loop-until-dry fan-out with multi-vote refutation panels; standard depth runs a portable parallel-Agent fan-out. Ships /ultra-deep-research:research plus researcher and verifier subagents. Writes the report inline and to research/<topic>-<date>.md.

by Ivan-WG

Scout skills.sh — Vercel's open agent-skills directory — for third-party skills matching the project's stack: scans manifests, queries the skills.sh search API, reports each hit with provenance (source repo, install count, skills.sh URL), previews the picked skills' SKILL.md before anything lands, then installs only explicit picks via npx skills add — project-level, never global, never auto-installed. Includes /vercel-skills-scout:suggest.

by Ivan-WG

Web development in one plugin: a web-developer worker (routing, REST/API integration, forms, state, SSR/CSR), an opus-floored frontend-reviewer for component and view logic, and three version-pinned stack skills — Next.js (App Router boundaries, opt-in caching, server actions, 14→16), React Native (lists, navigation, native-driver animation, Expo inversions), Vite (VITE_ env security, chunking, base, proxy, 5→8) — loaded by the code-review fan-in from the lockfile. Inertia and Laravel stay in their own plugins; plain JS/TS needs no skill.

by Ivan-WG

Meta-bundle: the whole idea-to-shipped pipeline in one install — the core-suite baseline (candor, code-review, git-workflow, hindsight, secret-scanning, skill-router, stack-scan) plus taskmaster clarification and cards, task-runner execution with delegation contracts, approaches deliberation, code-architecture plan-before-code and verification, testing, debugging, and the ui-ux and security lanes the cards dispatch into. Replaces taskmaster-suite, process-suite and quality-principles-suite (2026-09-14). Fifteen members: over the host's 200k skill-listing floor by design — the README names the settings line. Uninstall cleanly with /workflow-suite:uninstall.