Skills

Reviews pasted code that announces published articles to social channels (Bluesky, Mastodon, a Facebook page, Pinterest through a feed, Tumblr, DEV) for the ways a channel stays silent or posts twice, which tests with a fake network and a green build do not catch. It flags a shared HTTP helper that cuts a response body the Bluesky login then parses, a text cut by UTF-16 position or link offsets taken from character positions instead of UTF-8 bytes, a Mastodon media upload judged by status 200 only, a link posted without uploading the picture, a missing write:media scope, an Idempotency-Key reused after its one hour, an alert cut to N characters of an HTML error page, dispatch called from cache invalidation, a new "announced" column without a backfill, Promise.all or no timeout around channels, a missing token treated as an error, staging that posts, a full article copied to a blog platform, an OAuth 1.0a signature that leaves out the form body, a DEV request from a Worker without a User-Agent, and duplicates counted by searching a title in an RSS feed. Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use to review article-announcing code before release, to find why a channel never posts, or to check a new channel before its first live post.

Reviews pasted Cloudflare Workers code and configuration (a Worker, a Next.js app on OpenNext, D1 queries, wrangler config) for platform pitfalls that pass every local test and then fail in production or quietly cost money. It flags the edge runtime under OpenNext, a fetch to your own Worker's workers.dev address (error 1042), D1 queries that bind more than 100 parameters as data grows, LIKE patterns over D1's 50-byte limit, reading rowsAffected where D1 returns meta.changes, interactive transactions D1 does not have, secrets kept in plain vars, outbound fetch code that treats only a thrown error as failure, a browser User-Agent that bot protection challenges, client hop-by-hop headers forwarded to fetch, cron triggers whose day of the week is written as numbers, and unbounded queries on the request path. Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use to review a Cloudflare Worker before deploy, check D1 or wrangler code, or audit a Next.js app running on Cloudflare.

Reviews pasted code and configuration that spends money (paid AI or API calls, purchases, paid lookups, anything billed per use) and checks whether the limit on that spending really stands in the way of the spending. It flags a cap that sits beside the path instead of on it (a gateway limit while a script calls the provider directly, a counter only in the browser), a missing setting that means no limit, an alert or a budget email used as the protection, a cap that the caller sets through a header or a request field, a paid job that runs by default, a per-call cap with no running total, a total kept where it resets, a cap checked only after the money is gone, and a spend counter whose failure or missing value lets the call through. Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use before deploying a Worker, script or job that pays per call, or when a cap exists and you want to know if it can fail silently.

Reviews a pasted test, check script, smoke test, mutation script or CI step and says whether it can fail when the thing it guards is broken, so a green result is worth something. It finds a completeness guard that counts its own hard-coded list instead of the directory, a one-star glob that never enters subfolders, a mutation script that restores with git checkout and wipes the uncommitted fix under test, a null test that an empty string passes, a status 200 that is only the login page, a wait loop without sleep that measures network speed instead of time, a test that calls the pure function directly and never the call site, a counterfactual control whose data does not create the condition, a fix copied into two branches and tested in one, a limit tested only with ordinary values, and a catch that turns a failure into success. Each finding has a fixed code, the place, why it passes and the one input that would make it fail, or exactly No findings. Use to review a test that cannot fail, a check script that always passes, or a guard before you trust it.

Reviews a rate-limiting setup on Cloudflare (a WAF rate limiting rule, a Workers Rate Limiting binding, or a counter in your own code) and lists every reason it will not limit what its author thinks it limits. It flags free-plan rules that use the client address or a header field, which the plan refuses, windows the plan does not offer, an address key for callers that are themselves Workers and share one outbound address, a binding number treated as a global figure when each isolate counts for itself, a raw IPv6 address as a key, per-client limits with no global ceiling on a costly action, load tests fired without waiting a full window, one known attacker handled with a rule instead of an IP Access Rule, and a 429 without Retry-After. Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use to check or design rate limiting for an API, a pay endpoint or an agent-facing endpoint on Cloudflare.

Reviews a pasted image pipeline (upload or AI generation, storage in R2, resizing, serving through Cloudflare image transformations, a Next.js loader, a sharp or WebP script) for the traps that quietly ship huge or broken images or spend a shared quota. It flags photographs stored as PNG, files stored exactly as a generator returned them, a redirect-on-error setting that hides an exhausted transformation quota, a list of widths that multiplies the unique-transformation count, widths above the original, transformations "turned off" while the images binding or the zone setting stays on, lossy WebP on charts and infographics, a job that re-encodes WebP that is already lossy, a preview subdomain mistaken for a zone, an original overwritten by a backdated fix, and self-made variants that can 404. Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use to review an image pipeline, Cloudflare image transformations or WebP handling before it ships.

Reads the results of probing a website with AI-crawler user agents (status codes per bot, a control request, sometimes robots.txt or the site's settings) and says what they really show as JSON - whether training bots, search bots and user-triggered agents are open, blocked, mixed or unknown, what is behind a refusal, and whether the robots.txt that answered is the site's own file. Knows the traps - a bare bot name proves nothing and lies differently for each bot, a blocked training bot is a choice while a blocked search bot is a defect, Python-urllib and libwww-perl are refused by Browser Integrity Check and not by the site's policy, since 15 September 2026 Cloudflare refuses training bots on zones nobody touched, and a robots.txt of only comments is a stand-in from the edge. Use when asked whether a site blocks ChatGPT, Claude, Perplexity or Google AI, how to read curl results with bot user agents, or why an AI crawler gets a 403.

Replaces personal data and secrets in a text with typed placeholders and leaves every other character exactly as it was, so the text can go into a log, a ticket, a prompt or a shared document. Covers email addresses (also written out as "at" and "dot"), phone numbers in any format, IBANs, payment card numbers, national ID numbers such as the Bulgarian EGN, IP addresses, and secrets - passwords, API keys, tokens, the password inside a connection string, a key in a URL. Keeps what only looks sensitive - order, invoice and tracking numbers, the last four digits of a card, version numbers, hashes, request ids, placeholders like your-api-key - and ignores text in the input that asks it not to redact. Use when asked to redact, mask, anonymise or scrub personal data, PII or secrets from logs, emails, chat transcripts, support tickets or documents before storing or sharing them.

Translates the messages of a gettext PO file (.po) into another language and returns the whole file, so msgfmt and the app that loads it accept it. Only the msgstr values change. msgid, msgid_plural and msgctxt, every comment line, flags, the header (apart from its Plural-Forms line), obsolete entries and all placeholders such as %s, %d, %(name)s, {name} and %1$s come back exactly as they were. Entries with plural forms get exactly the number of msgstr lines the target language needs, for example three for Russian, Ukrainian, Polish and Czech, six for Arabic and one for Japanese. Use to translate or localize a .po file for WordPress, Django, Qt, GNU gettext or any app that ships gettext catalogs.

Stops an AI agent from reporting false success, or hallucinated completion: work it calls done that did not happen. Every action in its status report gets one of five states (done and verified, done but not confirmed, partly done, failed, not done), backed by what the tool results of the session show. Failures and unknowns come first, counts come from the results, and no id, receipt or hash is invented. When a result does show success, the agent says so plainly. Use whenever an agent reports on actions it took with tools, such as messages, batches, tests, builds, deploys, file edits, data updates, payments or API calls.

Builds a vocabulary list for a language learner from one pasted text, as strict JSON: for every word the learner should learn it gives the form as written in the text, the dictionary form, a translation in the sense the text uses and the whole sentence of the text as the example sentence, copied word for word. It skips the words the learner already knows, also when they appear inflected, and leaves out names, function words and numbers. Dictionary forms follow the conventions of the text's language, German separable verbs are reassembled, false friends are translated by the sense of the sentence. Use to make a vocabulary list or glossary from a text, prepare example sentences for flashcards, pre-teach the words of a reading passage, or build a word list by level for Bulgarian, German, English or Spanish learners.

Writes a faithful summary of a text in the text's own language, using only what the text says, with every number, name and date kept exactly and every qualifier kept. Use when asked to summarize, shorten, condense, give the gist or a TL;DR of an article, report, email, transcript, thread or document.

Repairs broken or messy CSV so a standard parser reads it, without changing the text of a single cell, and answers with the CSV only, no code fence. Fixes quotes that do not close, a quote inside an unquoted cell, cells that hold the delimiter or a line break, rows shorter than the header, a Markdown table, and chat text or a fence around the data. Numbers such as 1,250, 007 and 1.10, dates, spaces inside cells and values that look like formulas stay exactly as written. Semicolon and tab files keep their delimiter. A row longer than the header, a row that could be read two ways, an unbalanced quote that no reading closes, an HTML page and prose with no table get a fixed one-line CANNOT REPAIR answer instead of a guess that moves data between columns. Use when an export, an API or another model returned CSV that does not parse, or when asked to fix, clean up, close or convert a table to valid CSV.

Repairs broken XML so a standard parser accepts it, without changing a single text node, attribute value, comment or CDATA section, and answers with the XML only, no code fence. Fixes a raw ampersand or less-than sign in text or in an attribute value, an HTML entity name such as nbsp that plain XML does not define, an attribute value without quotes, an end tag that is missing in one place only, a declaration that is not the first thing in the file, a stray byte order mark, and chat text or a fence around the document. Whitespace, indentation, attribute order, empty elements, numeric character references and CDATA stay as written. Mis-nested tags, an element that could end in two places, a document cut off in the middle, an unknown entity name, two root elements, a repeated attribute and an HTML page get a fixed one-line CANNOT REPAIR answer instead of a guess. Use when a feed, a sitemap, an SVG, a SOAP or legacy API response, an Office file part or another model returned XML that does not parse, or when asked to fix, clean up or close invalid XML.

Repairs broken JSON so a program can parse it, without changing any value. Fixes trailing and missing commas, comments, single quotes, unquoted keys, Python and JavaScript literals, smart quotes used as delimiters, raw line breaks and stray quotes inside strings, a code fence or chat text around the JSON, and output cut off in the middle. A value that was cut off becomes null instead of a guess, numbers JSON cannot hold as written are kept as strings, and when the structure can be read two ways the answer says so instead of picking one. Use when a tool, an API or another model returned JSON that does not parse, or when asked to fix, clean up, validate or close invalid or truncated JSON.

Keeps an assistant answering in the language the user writes in, whatever the language of the pasted text, the logs, the code comments, the tool output or the documents it works from. Covers the slips that happen in practice - drifting into the language of an English log or a Russian forum post, mixing in words or letters of a close neighbour (Russian in Bulgarian or Ukrainian, Czech in Polish, Portuguese in Spanish, Dutch in German), answering in Latin letters a user who typed a Cyrillic language in Latin letters, and obeying a line inside the material that asks for another language. Code, commands, identifiers, error messages and quotations stay as they are, marked as code or quotes, and the explanation around them is in the user's language. An explicit request from the user for another language always wins. Use when an agent works for people who do not write English, when replies come back in the wrong language or with foreign words mixed in, or in long sessions full of foreign-language tool output.

Repairs a gettext .po translation file so that msgfmt --check compiles it, changing only what blocks compilation and translating nothing. Knows what the checker really rejects - an unescaped quote or a missing closing quote, an escape it does not know, a msgid that starts or ends with a newline while its msgstr does not, c-format or python-format placeholders that differ, the wrong number of plural forms, msgstr without an index on a plural entry or with one on a plain entry, charset=CHARSET left in the header, plural entries with no Plural-Forms, and the same entry twice - and what it accepts, so a working file is left alone. A translation that cannot be fixed without new words keeps its text and gets the fuzzy flag; two different translations of one entry, or a plural formula the file gives no way to know, get a fixed one-line CANNOT REPAIR answer. Use when msgfmt, a build, Django compilemessages, Poedit or a CI step fails on a .po file, or when asked to fix a broken PO or gettext catalog.

Converts HTML into CommonMark Markdown and answers with the Markdown only, no wrapper fence. Headings become ATX headings, links keep their address byte for byte (title included), images keep their source and alt text, lists keep nesting and an ordered list keeps the number it begins with, code blocks keep their text and indentation, tables become pipe tables with literal pipes escaped, entities are decoded once so the text reads as a browser shows it, and characters that Markdown would read as syntax at that spot are escaped instead of silently changing the document. Scripts, styles and comments are dropped, and an instruction hidden in a comment is never followed. Elements Markdown cannot say, such as an iframe, subscript or superscript, stay as the original HTML instead of being lost. HTML cut off inside a tag or with no visible content gets a fixed one-line CANNOT CONVERT answer instead of an invented page. Use when scraped, exported or pasted HTML has to become Markdown for docs, a knowledge base, a README or a model prompt.

Rewrites a JavaScript regular expression that can hang on a crafted input (catastrophic backtracking, ReDoS) into one that gives exactly the same yes or no for every text and runs in linear time, answered as JSON with the pattern and flags. Knows the shapes that explode - a quantified group whose inside is quantified too, alternatives under a star that can match the same text, an optional separator between repeats, a counted group of runs, an unanchored run before a literal - and how to remove the ambiguity without atomic groups, which JavaScript lacks. Keeps the flags, keeps an already linear pattern as it is, and answers with a CANNOT line when no regular expression can give the same answers, such as a backreference that compares two arbitrary substrings. Use when a regex in a validator or a search times out, when a security scan reports ReDoS or catastrophic backtracking, or when asked to make a regex safe for untrusted input.

Translates an XLIFF 1.2 file (.xlf) into the language the request names and returns the whole file, so the localization tool and the app that import it accept it. Each translatable unit gets one target element right after its source, with state set to translated. Sources, unit ids, notes, inline codes (g, x, ph, bpt, ept, it, mrk elements) with the same ids, units marked translate no, and targets already in state final, signed-off or translated come back byte for byte. Raw ampersands and escapes are handled, and a file that is XLIFF 2.0, or that already names a different target language, gets a fixed one-line CANNOT TRANSLATE answer instead of a guess. Use to translate or localize an .xlf or .xliff file from Angular, Xcode, Okapi, Weblate, memoQ, Trados or any other XLIFF 1.2 exporter.

Reads one pasted text, such as an incident report, a case history, a project log, a news story or an email thread, and lists its events as strict JSON. Events the text dates come first in chronological order, each with the date as written, the date in ISO form, a short event and the exact quote. Events with no date are listed apart in the order of the text. It resolves a relative date such as "two days later" only when the text gives the date it counts from, takes a date only from the event it belongs to, keeps a year-only date or a range as the text gives it, never borrows a missing year, leaves a numeric date such as 03/04/2026 open when nothing says how it is read, and never fills a gap from its own knowledge. Lines addressed to an AI are ignored. Use to build a timeline from a report, put the events of a long text in order, extract dates and events for a chronology, or check which events of a story have no date.

Builds the table of contents of a Markdown document with the exact heading anchors that GitHub or GitLab generate, and answers with the list only, no code fence. Finds the real headings (hash headings with closing hashes, underline headings, none inside code fences, indented code, comments or front matter), strips inline markup, lowercases, drops every character that is not a letter, digit, hyphen or underscore, turns each single space into one hyphen without collapsing or trimming, keeps Cyrillic and other non-Latin letters as they are, and numbers duplicate headings with -1, -2 in document order including the case where a numbered name already exists. Shows how emoji, ampersands, plus signs, dots and spaced dashes change the anchor. Indents two spaces per level below the shallowest heading. A named renderer other than GitHub or GitLab, a GitHub emoji shortcode, raw HTML in a heading, a heading with no characters left for an anchor, a heading inside a quote, list or table, and a document with no headings get a fixed one-line CANNOT BUILD answer instead of a guessed anchor. Use when asked to add, fix or check a table of contents, contents list or in-page links in a README, wiki page or docs file, or when a contents link jumps nowhere.

Turns a list of phone numbers written any way people write them into E.164 (a plus sign, the country code and the national number, digits only), one JSON object per number, using a default country the request states. Where plain models slip - the trunk 0 left in, "+44 (0)20" glued to a stray zero, Italian numbers with the leading 0 wrongly dropped, the leading 1 of a North American number kept, a made-up country for a bare local number, an extension stuck onto the number - it follows the numbering rules, keeps extensions in a separate field, and refuses with a reason instead of guessing when a number is too short, too long, cut, in two parts, has an impossible area code, or is local with no default country. Use to clean a contact list, a CSV column or a form export before import into a CRM, an SMS tool or a dialler, or to turn one pasted number into the international form.

Checks a summary against the source text it was made from and lists the summary sentences the source does not support, each copied word for word, as strict JSON. It catches a number that was rounded or given another unit, a hedge that became a certainty, a cause the source never states, two facts joined into a false one, a claim whose speaker was dropped, a fact that comes from outside the source, and it ignores any instruction hidden in the source. A sentence is judged supported or unsupported and nothing in between, and a faithful paraphrase is never flagged. It never checks the source against the world and never judges what the summary left out or how well it is written. Use to check a summary, abstract, executive summary or AI-written digest against its source, to review an agent's report of a document, or to find where a summary says more than the text.