Safe Refactoring: Refactor Without Changing Behavior

Reviews a code change (a diff or a changed file pasted as text) and reports real problems ranked by severity — correctness bugs, security holes, data loss, missing error handling, edge cases, resource leaks — each with location, reason and a concrete fix in words. Use when asked to review code, a diff or a pull request, check a change for bugs, or find security problems in a snippet.

Compares two versions of one API description (OpenAPI 3.0 or 3.1 in YAML or JSON, or two JSON Schemas of one request or response) and lists ONLY the changes that break clients written against the old version, one line each with a fixed code, the place, old and new, and who breaks - or exactly No breaking changes. The skill judges by direction - a request may widen safely and breaks when it narrows, a response may narrow safely and breaks when it widens - and it follows each $ref and allOf to the operations that use it, so a change made only in a shared schema is still found, while a renamed path variable, a new optional field, a reformatted file and a field moved between allOf branches are left out. Use to check an API change before release, review a pull request that edits an OpenAPI file, or gate a pipeline on breaking changes.

Reviews a pasted test, check script, smoke test, mutation script or CI step and says whether it can fail when the thing it guards is broken, so a green result is worth something. It finds a completeness guard that counts its own hard-coded list instead of the directory, a one-star glob that never enters subfolders, a mutation script that restores with git checkout and wipes the uncommitted fix under test, a null test that an empty string passes, a status 200 that is only the login page, a wait loop without sleep that measures network speed instead of time, a test that calls the pure function directly and never the call site, a counterfactual control whose data does not create the condition, a fix copied into two branches and tested in one, a limit tested only with ordinary values, and a catch that turns a failure into success. Each finding has a fixed code, the place, why it passes and the one input that would make it fail, or exactly No findings. Use to review a test that cannot fail, a check script that always passes, or a guard before you trust it.

Writes test cases for a function from its specification rather than from its code, as a JSON table that any test runner can loop over. Every rule, boundary and error the spec defines gets a case, and every expected value is worked out from the spec; where the code you show disagrees with the spec, the case follows the spec and a note says where. Behaviour the spec leaves open becomes a question instead of a guessed case. Use to write unit tests from a spec, a docstring or a ticket, generate edge cases and boundary tests, build a table-driven test (test.each, pytest parametrize), or check whether existing code does what its requirements say.

Reviews pasted application code, scripts and config for the four ways a secret leaks from the code that uses it, and lists only those, one line each with a fixed code, the place, who can then read the secret and the fix - or exactly No findings. It catches a secret value written to a log or printed (the key itself, an object or environment dump that contains it), a secret placed in a URL query string, a secret typed into source or a committed file, and a server secret sent to the browser through a public environment prefix or a prop of a client component. It leaves out the safe look-alikes: printing only that a key is present, its length or its last four characters, a publishable key that is public by design, and a secret read from the environment on the server. Use to review code that calls an API with a key, to check a Next.js or Vite project before release, or to gate a pull request that touches credentials.

Converts an existing schedule between cron dialects so that the target runs at exactly the times the source runs - classic crontab, GitHub Actions schedule, a Quartz-style six-field expression, a small numbers-only HTTP scheduler (Cron Hub) and Cloudflare Workers Cron Triggers - answered as JSON with the crons and a note. Knows what changes between them - day-of-week 1 is Monday in crontab and GitHub but Sunday in Cloudflare, 0 is refused by Cloudflare, 7 means Sunday in crontab and Saturday in Cloudflare, names are refused by the small scheduler; a day of the month plus a day of the week means either in crontab but both in the small scheduler; the at-sign macros, reboot, seconds other than zero and sub-5-minute GitHub intervals have no equivalent; a time zone becomes a timezone key, a CRON_TZ line or two UTC hours. Refuses what cannot be run at the same times. Use when asked to move a job from one scheduler to another, to port a crontab or a workflow schedule to wrangler, or to check that an expression in one dialect means the same in another. For a schedule given in words, use cron-schedule instead.

Turns the props of a UI component (a TypeScript type or a list of props) into strict JSON test data that stresses how it displays, and nothing else. Per prop it picks the worst values for the type, a string that is empty, one word of eighty characters with no space, on two lines, an emoji joined with a zero-width joiner, right-to-left letters or HTML-looking text, numbers at zero and at the large and decimal ends, lists that are empty, hold one item or hold a hundred, optional props left out, and dates at the far ends and across a time-zone edge. Every fixture still fits the declared type: a required prop is never missing, an enum gets only its values, a documented range is never broken, and callbacks are named apart from the data. Use to build fixtures for a component story, a visual test or a layout check, or to find what breaks a card, a list row or a badge.

Writes the response headers a site is missing, in the format of the person's own host, and keeps the page working. It reads the report line, the current response headers, the file that sets headers and the served head, and gives one line per finding with a fixed code, then a Headers block and a Verify line. It covers a missing or short Strict-Transport-Security, no framing rule, no nosniff, no enforcing Content-Security-Policy (a Report-Only header does not count) and a server version in a header. It enforces only directives that cannot break rendering; script, style, image, font and connect sources go into a Report-Only header built from the origins in the pasted head. It leaves out safe look-alikes: unsafe-inline in style-src only, a long max-age without preload, SAMEORIGIN, a Server header with no number and a missing Referrer-Policy. Exactly No findings. when all is well. Use when a site check reports missing security headers, no HSTS, a short HSTS max-age or a version number in a response header.