ca-policy-investigation
Use this skill when asked to investigate Conditional Access policy changes, sign-in failures related to CA policies (error codes 53000, 50074, 530032), or suspected policy bypass/manipulation. Triggers on keywords like "Conditional Access", "CA policy", "device compliance", "policy bypass", "53000", "50074", or when investigating why a user was blocked then suddenly unblocked. This skill provides forensic analysis of CA policy modifications correlated with sign-in failures.
security-patterns
Security best practices, API key management, input validation. Use when handling secrets, user input, or security-sensitive code.
laravel-validation
Form request validation and comprehensive validation testing. Use when working with validation rules, form requests, validation testing, or when user mentions validation, form requests, validation rules, conditional validation, validation testing.
id-generator
Generate intelligent session IDs based on detected content source type. Analyzes ContentSummary and creates meaningful IDs (podcast-xyz, transcript-abc, etc.).
encore-auth
Implement authentication with auth handlers and gateways in Encore.ts.
authentication-tracing
Use this skill when asked to trace authentication flows, analyze SessionId chains, investigate token reuse vs interactive MFA, or assess geographic anomalies in sign-ins. Triggers on keywords like "trace authentication", "trace back to interactive MFA", "SessionId analysis", "token reuse", "geographic anomaly", "impossible travel", or when investigating suspicious sign-in locations. This skill provides forensic analysis of Entra ID authentication chains to distinguish legitimate activity from credential/token theft.
requesting-gcloud-bq-auth
gcloudやbqコマンド実行時に認証エラー（Reauthentication required等）を検出した場合に使用。エージェントが自動で認証コマンドを実行することを防ぎ、ユーザーに認証を依頼します。
user-investigation
Use this skill when asked to investigate a user account for security issues, suspicious activity, or compliance review. Triggers on keywords like "investigate user", "security investigation", "user investigation", "check user activity", "analyze sign-ins", or when a UPN/email is mentioned with investigation context. This skill provides comprehensive Entra ID user security analysis including sign-in anomalies, MFA status, device compliance, audit logs, security incidents, Identity Protection risk, and automated HTML reports.
laravel-policies
Authorization policies for resource access control. Use when working with authorization, permissions, access control, or when user mentions policies, authorization, permissions, can, ability checks.
env-helper
Read environment variables via get_env tool (mask secrets).
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior - before proposing fixes
testing
Validates test coverage and quality by checking behavior focus, identifying gaps, and ensuring >80% statement coverage. Use when task file is in testing/ directory and requires test validation before marking complete. Adds minimal tests for genuinely missing edge cases.
encore-testing
Test APIs and services with Vitest in Encore.ts.
write-back-testing
Implement test utilities that write test data to the source system and validate end-to-end read cycles.
test-driven-development
Use when implementing any feature or bugfix, before writing implementation code - write the test first, watch it fail, write minimal code to pass; ensures tests actually verify behavior by requiring failure first
testing-guide
Test-driven development (TDD), unit/integration/UAT testing strategies, test organization, coverage requirements, and GenAI validation patterns. Use when writing tests, validating code, or ensuring quality.
pytest-best-practices
Expert guidance for writing high-quality pytest tests. Use when writing tests, setting up fixtures, parametrizing, mocking, or reviewing test code.
test-and-fix-connector
Validate a connector by running the test suite, diagnosing failures, and applying fixes until all tests pass.
test-driven-development
Use when implementing any feature or bugfix - write tests first, watch them fail, then implement