codexpiator

Entry point for the Codexpiator toolkit. Use only when a software-engineering request's domain is ambiguous, spans multiple domains, or is exploratory - if it clearly matches one specific codexpiator-* skill's own description, prefer that skill directly instead.

AI/LLM integration guidance - LLM integration patterns, prompt engineering basics, agentic and tool-use safety and security (prompt injection, excessive AI permissions, unvalidated AI output), and MCP usage and recommendations. Use when integrating an LLM, building an AI feature or agent, writing prompts, evaluating an MCP server, or assessing whether an AI/agent feature is safe.

Software architecture guidance - project structure conventions, design patterns catalog, API contracts and versioning, scalability trade-offs, and monolith vs microservices. Use when structuring a new project, deciding how to split code, or making a structural/scaling decision.

Backend engineering guidance - API design and contracts, data modeling and databases, authentication and authorization implementation (sessions vs JWT, password hashing - see codexpiator-security for the threat-model/hardening side), error handling and logging, caching, background jobs and queues, resilience and rate limiting, backend performance, and backend testing. Use for any server-side/API/data-layer question.

DevOps guidance - CI/CD pipelines, environments and config, containerization, observability and monitoring, incident response and rollback, and deployment platforms. Use when setting up deployment, CI/CD, monitoring, or handling an incident.

Git workflow and developer experience guidance - branching strategy, commit and PR conventions, code review checklist, documentation practices, and repo hygiene/onboarding. Use when working with git, writing commits/PRs, reviewing code, or setting up a repo.

Frontend engineering guidance - component architecture, state management, CSS/styling architecture, forms and validation, routing, responsive/mobile design, frontend performance, SEO/AI-visibility, and accessibility. Use for any UI/component/frontend-structure question, including what to test on the frontend (see codexpiator-testing-qa for general testing strategy/TDD discipline instead).

Security guidance - secure coding checklist, authn/authz threat-model and hardening (MFA, IDOR/BOLA, session fixation, password-reset abuse - see codexpiator-backend for base auth implementation), input validation and injection defense, secrets and config management, dependency and supply-chain risk, infrastructure and access control, business-logic/webhook security, AI/agent security (prompt injection, excessive AI permissions), and security testing. Use for any security-sensitive question or before shipping anything that touches auth, user input, payments, AI/agent features, or infrastructure config.

General testing strategy and quality gates - testing pyramid, TDD workflow, mocking and test data, and CI quality gates. Use whenever following TDD, deciding what test level to use, or deciding what should block a merge (for frontend-specific test scope, see codexpiator-frontend/frontend-testing.md).