Skills

Rewrites AI-sounding prose so it reads like a person wrote it — in any language, without dropping facts. Use when asked to humanize a text, make it sound less AI-generated or less like ChatGPT, or clean machine phrasing out of an article, post, email, product description or page.

Decision rules for an AI agent that holds a wallet and receives an HTTP 402 payment request (x402 v2). Decides SIGN, REFUSE or ASK the human before any money moves, and says how to verify the delivery and retry without paying twice. Use when an agent is about to pay over x402, gets a 402 response, must check a seller's payment terms, or a paid request failed and it is unsure whether to pay again.

Diagnoses why an HTTP API sold over x402 v2 cannot be paid by standard buyer agents or never appears in the Coinbase CDP Bazaar catalog, using an ordered checklist and a decision tree over the pasted 402 response, headers and symptoms. Names the exact field that is wrong or missing and how to prove the fix. Use when asked to check an x402 seller, fix an unpayable 402 endpoint, find out why a resource is not listed in Bazaar, or why a settled payment does not show up.

Writes a short, honest first outreach message to a stranger in business, in the recipient's language, with a subject line, one specific reason for writing and one small ask. Use when asked to write a cold email, a first outreach message, a sales or partnership introduction, or a prospecting note, in any language.

Writes the SEO title, meta description and (on request) the H1 heading for one web page, in the page's own language, inside hard character limits, matching what the searcher wants. Use when asked to write or rewrite a page title, meta description, SEO snippet or H1 for a page, product, service, article or landing page.

Finds the loops behind a bill spike or an unexpected bill. Reviews a web app's code and config for loops and repeats that run up the bill on their own on Vercel, Turso, Cloudflare Workers and D1 and paid AI APIs. Finds two schedulers on one job, retries without a cap, work that triggers itself, client polling and React render loops, caches cleared on every write, middleware running on every static file, queues that resend failures forever, image settings that multiply transformations, health checks that count whole tables, alerts sent on every run and bots crawling endless filter URLs. Counts the runs per month, names the billed unit, ranks by cost and gives the change that stops each one. Use when asked why a Vercel, Turso or Cloudflare bill jumped, to find an infinite loop or a runaway cost, or to review a cron job, webhook, queue consumer, middleware or polling code before it ships.

Reviews CORS code or server configuration (an Express or Flask handler, an nginx block, a framework setting) for the five mistakes that let a hostile web page read private responses, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches a request Origin copied into the allow header while cookies are allowed, a wildcard origin together with credentials, the null origin allowed, an origin check by suffix, substring or an unanchored pattern, and a per-origin allow header sent without Vary Origin. It leaves out the safe look-alikes, such as an exact allow-list with credentials and a public read-only API that answers with a wildcard and no credentials. Use to review CORS code before release, to audit a gateway config, or to debug a browser CORS error that looks like a server mistake.

Reviews ONE AWS IAM policy (an identity policy, or a bucket policy) written as JSON for the five grants that hand out far more than a job needs, and lists only those, one line each with a fixed code, the statement, why it is dangerous and the fix - or exactly No findings. It catches every action on every resource or a whole service on every resource, iam:PassRole on any role, Allow combined with NotAction, a public principal with no condition, and actions that let a holder raise their own rights such as creating a policy version or attaching a policy. It leaves out the safe look-alikes, such as a public principal narrowed to an organization, read-only access to one bucket, and a Deny with NotAction. Use to review a policy before attaching it, to audit a role, or to check a bucket policy for public access.

Reviews ONE Dockerfile for the five build mistakes that cost security or build time, and lists only those, one line each with a fixed code, the instruction, why it hurts and the fix - or exactly No findings. It catches a final image that runs as root, a base image with no tag or the latest tag, a secret passed through an argument, an environment value or a file copy so that it stays in the image history, source copied in before the dependencies are installed so the cache is lost on every edit, and the package index left in the layer after apt-get. It leaves out the safe look-alikes, such as a build secret mounted for one instruction, a tag pinned by digest, and root in a build stage that never ships. Use to review a Dockerfile before merging, to audit the images of a repository, or to speed up a slow image build.

Reviews a plan or shell script that lets several coding agents work in parallel, each in its own git worktree, and lists only the five mistakes that make the agents collide, one line each with a fixed code, the place, why it breaks and the fix - or exactly No findings. It catches one branch checked out in two worktrees or forced onto a second one, two agents started on the same fixed port, an untracked secret file missing in a new worktree or written by two agents, a build folder or database file written by more than one agent, and worktrees that are never removed. It leaves out the safe look-alikes, such as two worktrees on different branches cut from one commit or a shared folder that every agent only reads. Use before launching parallel agents, to audit an orchestration script, or to debug agents that overwrite each other.

Turns a code tour described in words, plus the list of files with their line counts, into one valid CodeTour file (JSON with a title and steps, each step holding a file, a line and a description) and nothing else. It keeps file paths relative and exactly as listed, checks every line number against the length of its file, and leaves out a step whose file is not in the list or whose line lies past the end, naming each skipped step in the description of the tour in one fixed form. A tour with only valid steps carries no mention of skipping. Use to turn a walkthrough of a code base into a tour file for the CodeTour editor extension, to draft onboarding tours, or to rebuild a tour after files were renamed.

Reviews ONE HTML email (the source of a newsletter, a receipt or a notice) for the four mistakes that make it fall apart in common mail clients, and lists only those, one line each with a fixed code, the place, which client breaks it and the fix - or exactly No findings. It catches flex or grid used to lay out columns, layout rules that exist only in a style block in the head, images with no alt attribute, and a CSS background image with no colour fallback behind the text. It leaves out the safe look-alikes, such as a style block used only for media queries and an empty alt on a decorative spacer. Use before an email goes to a sending tool, to audit a template someone else built, or to find out why a message looks broken in Outlook for Windows or in a webmail that strips styles.

Reviews ONE Stripe webhook handler (the route code, in any language or framework) for the five mistakes that let a forged or repeated event move money, grant access or ship goods, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches a body parsed or re-serialized before the signature is checked, a handler that never checks the signature, a recency tolerance switched off or set huge, no record of event ids so a retry repeats the side effect, and slow work done before the 2xx answer. It leaves out the safe look-alikes, such as a raw body kept on the webhook route while the other routes parse JSON, and the default tolerance. Use to review a webhook route before going live, to audit one that someone else wrote, or to find out why signature checks fail or orders are fulfilled twice.

Counts the fields of ad and store copy against the published limit of each platform (Google responsive search ads, App Store product page, Google Play listing, X and LinkedIn posts) and returns a line only for each field that is over, with the exact count, the limit, the unit and a shortened version that fits - or exactly No findings. It counts by the platform's own rule: double-width characters in Google Ads, bytes for the App Store keywords, the fixed length of a link and the double weight of an emoji on X. Fields that fit are left out, including a field exactly at the limit. Use before pasting copy into an ad account, an app store console or a scheduler, to find which field a platform rejects or cuts, or when copy written for one platform has to be reused on another.

Checks ONE Google Analytics 4 tracking plan (events, their parameters, and the custom dimensions to register with their scope) against the published collection limits and naming rules, and lists only the breaches, one line each with a fixed code, the item, the rule it breaks and the fix - or exactly No findings. It catches an event or parameter name longer than allowed, more parameters on one event than GA4 collects, a reserved event name or a reserved parameter name or prefix, a name that breaks the format rules, and a custom dimension whose values are nearly unique. It leaves out names that sit exactly on a limit and events that use exactly the allowed number of parameters. Use before a plan goes to developers or to Google Tag Manager, to audit a plan that someone else wrote, or to find out why an event or a parameter never shows up in reports.

Reviews ONE Claude API request (tools, system, messages, the cache marks, the model, the sizes and how often it is sent) for the five reasons its prompt cache does not pay off, and lists only those, one line each with a fixed code, the place, why the cache misses and the fix - or exactly No findings. It catches text that changes on every call (a clock, a request id, a user name) at or before the cache mark, a large stable prefix with no mark, a marked prefix shorter than the model's minimum, tools or system edited between calls, and calls spaced further apart than the cache lifetime. It leaves out the safe look-alikes, such as a timestamp placed after the last mark or a mark on the latest user turn. Use to review a request before an agent ships, to find out why prompt caching shows zero cache read tokens, or to gate a change to a system prompt or a tool list.

Checks ONE operational runbook (a numbered procedure for a deploy, a failover, a rotation or a recovery) step by step for the five things a person at three in the morning needs and writers forget - an owner, an expected duration, a visible signal that the step worked, a way back, and someone to escalate to - and lists only the steps that miss something, one line per step with fixed codes for what is missing, or exactly No findings. It accepts a success signal written in other words, an owner or an escalation contact stated once for the whole runbook, and a read-only step that needs no way back, and it never rewrites the runbook or adds steps. Use to review a runbook before an on-call rotation relies on it, after an incident that showed a step was unclear, or to gate a pull request that edits a procedure document.

Checks the written readout of ONE A/B test (a paragraph, an email, a table or a slide transcript) for the five statistical mistakes that turn a no-effect test into a "win", and lists only those, one line each with a fixed code, the place, the evidence with the arithmetic and the fix - or exactly No findings. It catches stopping the moment a result looks significant, many metrics or variants judged without correction, a split of users that differs from the planned split by more than chance allows (the sample ratio check, calculated step by step), a sample too small for the effect the team wants to detect, and a relative lift reported without the absolute numbers behind it. It leaves out the safe look-alikes, such as a pre-registered single primary metric, guardrail metrics that only monitor, and a split of 50.2 to 49.8 on a small sample. Use before a test result is shipped, when an analyst or an agent writes a readout, or to review a result someone else announced.

Reviews ONE GitHub Actions workflow file (YAML) for the five mistakes that let an outsider run code or read secrets in your pipeline, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches text from an issue, pull request, comment or branch name pasted straight into a shell step, a pull_request_target or workflow_run job that checks out and runs the code of the pull request, a third-party action pinned to a tag or branch instead of a full commit hash, a missing or too wide permissions block, and a secret that is printed or handed to code you do not control. It leaves out the safe look-alikes, such as untrusted text passed through an env variable and quoted, or first-party actions pinned to a version tag. Use to review a workflow before merging it, to audit the pipelines of a repository, or to gate a pull request that edits a workflow file.

Reads a crawl export of a website (one row per page with its status, its robots setting and the links in its body, or a plain list of links from page to page), the sitemap list and the navigation and footer links, and reports the internal-link problems that keep pages from being found and indexed - orphan pages with no inbound link from another page, pages with a single contextual inbound link or links only from the footer, pages too many clicks from the home page or not reachable at all, links that point at a redirect or at a removed page, noindex pages listed in the sitemap, and a crawl that failed on some pages so that the orphan verdicts are unknown. Each finding has a fixed code, the address, the reason and a fix, worst first, or exactly No findings. Use for an internal link audit, to find orphan pages, to check pages with no inbound links before publishing, to check click depth, or to audit a blog or a catalog from a crawl export.

Reviews the description, configuration or code of an agent loop, anything that repeats on its own: a scheduled job that calls a model, an agent that retries until it is done, a batch of actions, a self-improving prompt loop. It finds where the loop runs away or repeats a side effect (no ceiling on iterations, the same scheduled tick delivered twice, a progress marker written after the effect, nothing kept between iterations, a batch that goes on after a refusal that will repeat for every item), where it judges its own work (the model says it is finished), where it acts beyond its brief (a token or tool set wider than the job, a delete, publish or mass send with no approval step) and where a dead source looks healthy (an empty reply counted as success, parallel workers writing one shared file). Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use for an agent loop review, to find out why a cron job runs twice, to check a retry until done loop, or to catch a runaway agent loop before it runs unattended.

Compares two versions of one API description (OpenAPI 3.0 or 3.1 in YAML or JSON, or two JSON Schemas of one request or response) and lists ONLY the changes that break clients written against the old version, one line each with a fixed code, the place, old and new, and who breaks - or exactly No breaking changes. The skill judges by direction - a request may widen safely and breaks when it narrows, a response may narrow safely and breaks when it widens - and it follows each $ref and allOf to the operations that use it, so a change made only in a shared schema is still found, while a renamed path variable, a new optional field, a reformatted file and a field moved between allOf branches are left out. Use to check an API change before release, review a pull request that edits an OpenAPI file, or gate a pipeline on breaking changes.

Reads what the owner of a site on Cloudflare Workers (usually Next.js through OpenNext) pasted - Search Console numbers, an audit of status codes, open-next.config.ts, wrangler.jsonc, data-fetch code, robots, sitemap and metadata code, wrangler tail lines, the owner's plan - and finds what stops Google from crawling, indexing or showing the pages, in a fixed diagnosis order. Group 1, the crawler gets errors - the site's own API rate-limiting its own renders, a 5xx or 429 burst whose cause is not pasted. Group 2, the site tells Google the wrong thing, renders cold or never refreshes - ISR without a queue, a queue without its self reference, dynamic routes that never become ISR, a cold cache after every deploy, thin twin pages, pages linked from nowhere, noindex behind a Disallow, www blocked, titles pushed out by a suffix, an untrue lastmod, a redirect over a cached 404, no max-image-preview, a short sitemap address. Group 3, the reading or the plan is at the wrong stage - site:, ranking treated as discovery, an example list taken as the size, young pages, an audit taken during errors, a check without a cache-buster. Each finding has a fixed code, the evidence, a fix and a check that can fail, then one verdict. Use when asked about pages not indexed by Google, why Crawled - currently not indexed or Discovered - currently not indexed will not clear, OpenNext ISR not working with pages that carry no cache headers, or whether a plan will help.

Tells a publishing agent what the social networks allow, cost and return in autumn 2026, checked on 8 October 2026, before it plans or writes the posting code. Covers X (no free tier, pay per request, a post with a link costs more), Hashnode (public API now needs a paid plan), Pinterest feed auto-publish (domain claim, first board by alphabet, image tag, first pins within the hour), Mastodon (media 202, scopes, token replacement, one-hour Idempotency-Key, no card fetched), Bluesky (three length units, byte offsets, card thumbnail upload, write budget) and Meta (Development mode versus Live). Answers as JSON when asked and says which facts to re-check. Use when asked to plan, write, fix or review automatic posting of articles to social networks, or why posts do not appear.