Run security scans with the ASH (Automated Security Helper) MCP server. Use this skill whenever the user asks to scan for vulnerabilities, run a security check, find CVEs, audit dependencies, check for secrets, run SAST or SCA, scan IaC (Terraform/CloudFormation/Kubernetes), check for hardcoded credentials, or mentions ASH, Bandit, Semgrep, Checkov, Grype, Syft, or detect-secrets. Also trigger when the user wants to find security issues, harden a codebase, or asks "is my code secure". Do NOT trigger for code review without security context, performance audits, or test writing.
Packs the entire codebase (or selected folders) into a single token-efficient file using repomix, so other skills can analyze the whole repo without re-reading individual files. Use when the task requires whole-codebase context: full security audits, cross-cutting refactors, architecture review, project-wide code review, or first-time onboarding to an unfamiliar repo. Auto-runs once per session at first invocation of agent-master.
56 laws and principles of software engineering (Conway, Brooks, Hyrum, Gall, Postel, CAP, YAGNI, DRY, SOLID, Pareto, Amdahl, Murphy, and more). Use when designing architecture, planning projects, debating scope, reviewing code, running postmortems, or making engineering decisions where an established principle applies.
Behavior-preserving refactoring workflow that actively rewrites code for clarity — extracting overlong functions, flattening deep nesting, consolidating duplicated logic, AND removing over-engineered \"just in case\" abstractions — always gated on a passing test suite (or a characterization test written first) so behavior never changes. Use whenever the user wants code actually SIMPLIFIED or REFACTORED, not just reviewed: \"sederhanakan kode ini\", \"refactor biar lebih rapi\", \"reduce complexity\", \"ini over-engineered\". A read-only finding about the same issues (CQ-01/CQ-04/CQ-04b in `review-checklist.md`) is `code-review-edho-ferdian`'s job, not this skill's — see the scope table below for the exact boundary with that skill, `dead-code-cleanup-edho- ferdian`, and `build-fix-edho-ferdian`.
Staged dead-code removal workflow — detect (stack-appropriate tooling: knip/depcheck/ts-prune, vulture/deptry, cargo-udeps, deadcode, ...), classify by removal risk (SAFE/CAREFUL/RISKY), cross-check every \"unused\" hit against Salak's repo-graph.json reverse-dependency data when available, then delete in ordered categories (deps → exports → files → duplicates) running the test suite between each category. Use this whenever the user wants dead code, unused exports, unused dependencies, or duplicate code actually REMOVED — \"bersihkan kode mati\", \"hapus yang tidak dipakai\", \"cleanup unused code/deps\", \"remove dead code\", \"consolidate duplicates\". Not for finding-only review — see the scope note below for the boundary with code-review-edho-ferdian's CQ-07.
Code reviewer for Flutter/Dart mobile game changes. Use to review a diff/PR for bugs, style, and architectural violations against the skill's rules and the Dart quality bar. Read-only — reports findings, does not edit. Call last, after implementation and tests.
Full GitLab development loop — from issue to confirmed-resolved. Covers write-issue, analyze-issue, fix-issue, review-code, create-mr, summarize-issue, triage-issue, and post-merge verification.
Whole-codebase code auditor for Flutter/Dart mobile games (iOS + Android). Use to audit the ENTIRE project (not just a diff) for correctness, architecture conformance, consistency, dead code, and test coverage. Complements code-reviewer (which reviews a single diff/PR). Read-only — reports findings.
Gameplay programmer for Flutter/Dart mobile games (iOS + Android). Use to implement game systems, player abilities, interaction/collision logic, input/gesture handling, and UI flow in Dart/Flutter/Flame. Call after engine-architect; runs dart analyze/test; hands off to qa-tester and code-reviewer.
Design and setup guidance for the data layer — Postgres schema design, Prisma ORM patterns, Redis caching/queue patterns, and cross-ORM migration strategy (expand-contract). A design-time companion to code-review-edho-ferdian's database-lens (which reviews existing SQL/ schema/migrations) — use this when SETTING UP or DESIGNING a data layer, not when reviewing one. Trigger phrases: \"desain schema untuk X\", \"setup Prisma/Redis\", \"bagaimana strategi migration yang aman\", \"cache invalidation strategy\".
Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions, and define verifiable success criteria.
Code review focused exclusively on over-engineering. Finds what to delete: reinvented standard library, unneeded dependencies, speculative abstractions, dead flexibility. One line per finding: location, what to cut, what replaces it. Use when the user says "review for over-engineering", "what can we delete", "is this over-engineered", "simplify review", or invokes /ponytail-review. Complements correctness-focused review, this one only hunts complexity.
Single source of truth for security review criteria across the Edho Ferdian ecosystem — general OWASP-style checklist (SEC-01..19), plus stack-specific and domain-specific security items (see the reference list at the bottom of this file for the full stack/domain coverage). Runs STANDALONE for a security-only pass (\"cek keamanan kode ini\", \"security audit\", \"find vulnerabilities\") OR as the delegated depth layer for Domain 2 (SEC) of code-review-edho-ferdian's full review. Every other skill in this ecosystem that touches security cross-references this skill instead of holding its own copy — this is the only place security criteria are defined, to remove drift risk from duplication.
Design and evolve API boundaries and contracts — REST resource naming, status-code semantics, pagination strategy, versioning policy, and the discipline of treating one contract artifact (OpenAPI/schema) as authoritative so client and server never drift. A design-time activity, distinct from system-design-edho-ferdian (broader architectural trade-offs) and code-review-edho-ferdian (reviewing an already-written endpoint). Trigger phrases: \"desain API untuk fitur ini\", \"bagaimana struktur endpoint yang baik\", \"API contract berubah, bagaimana handle-nya\", \"REST vs apa\", or when starting a new API surface.
Measure-then-fix performance workflow — runs real profiling/measurement tooling (Lighthouse, bundle analyzers, heap-snapshot diffing, Node/browser profilers, DB EXPLAIN) to get a baseline, diagnoses against Core Web Vitals budgets and algorithmic-complexity patterns, applies a fix, then re-measures the delta against the budget. Use this whenever the user wants a performance problem actually diagnosed and fixed with real numbers — \"app terasa lambat\", \"kenapa lemot\", \"optimize performance\", \"reduce bundle size\", \"find memory leak\", \"Lighthouse audit\", \"why is this slow\" — not for a static read-time performance guess (see the scope note below for the boundary with code-review-edho-ferdian's PERF domain).
Guidance for WRITING unit and component tests well — React/Testing Library, Python/pytest, Go, and Vue, plus stack-agnostic regression-test patterns. A companion to code-review-edho-ferdian's test-quality-lens (which judges tests after they're written) and dev-kickoff-edho-ferdian's TEST stage (which mandates writing a failing test first but doesn't teach test-writing craft). Trigger phrases: \"tulis test untuk component ini\", \"bagaimana test hook ini\", \"test yang bagus untuk fitur X\", \"tulis test pytest/Go/Vue untuk ini\", or during dev-kickoff's TEST stage when the task needs concrete authoring guidance beyond \"write a failing test.\"
This rule governs the process of committing and pushing changes to git repositories. It should be applied whenever: (1) The user indicates they want to commit or push changes, (2) The user asks about git commit conventions, (3) The user wants to update or save their work to git, or (4) Any git-related commit and push operations are requested. The rule ensures consistent commit message formatting, proper change documentation, and maintainable git history. It's particularly important for maintaining clear project history, facilitating code reviews, and ensuring proper documentation of changes. This rule helps maintain high-quality commit messages that explain both what changed and why, making it easier for both humans and AI to understand the project's evolution.
Blueprint — behavioral guidelines for coding agents. Use when writing, reviewing, or refactoring code to ensure accuracy, simplicity, and surgical changes.
Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions, and define verifiable success criteria.
AWSCursor rule
