Total 56,460 skills
Showing 12 of 56460 skills
Provides comprehensive SAP Commerce Cloud (formerly Hybris) development guidance including type system modeling, service layer architecture, ImpEx data management, FlexibleSearch queries, OCC API customization, Composable Storefront (Spartacus/Angular), B2C/B2B accelerator patterns, WCMS content management, CCv2 cloud deployment, SAP BTP/Kyma integration, CronJobs, business processes, Solr search, promotions, caching, SmartEdit, Backoffice configuration, and testing patterns. Use when the user asks about "SAP Commerce Cloud", "SAP Commerce", "Hybris", "create SAP Commerce extensions", "define item types in items.xml", "write ImpEx scripts", "implement facades/services/DAOs", "customize OCC REST APIs", "work with FlexibleSearch queries", "customize B2C or B2B accelerators", "SAP Commerce B2B", "configure Spring beans", "create CronJobs or scheduled tasks", "define business processes or order flows", "configure Solr search or indexing", "set up promotions or coupons", "configure caching", "customize Backoffice", "SAP Commerce WCMS", "SAP Commerce CMS", "SAP Commerce integration", "integrate Composable Storefront or Spartacus", "customize Angular CMS components in Spartacus", "deploy to CCv2 or SAP Commerce Cloud public cloud", "configure manifest.json for CCv2", "integrate SAP BTP or Kyma with SAP Commerce", "customize SmartEdit", "write unit or integration tests for SAP Commerce", or asks about troubleshooting SAP Commerce issues.
Analyze decisions made during implementation, review, or design work and distinguish project-wide guidance from route-specific fixes, already-documented rules, and premature patterns. Use when the user asks which lessons or decisions deserve inclusion in project documentation, wants to review proposed guidelines before approving documentation changes, or asks to update project guidance from recent work.
Integrate Cardcom payment processing and Israeli invoice generation into applications, covering Low Profile payments, tokenization, recurring billing, and automatic tax invoice/receipt creation per Israeli law. Use when user asks to accept payments via Cardcom, generate Israeli invoices with payments, set up "slikat ashrai" with hashbonit, handle recurring billing (hora'ot keva), or mentions "Cardcom", "CardCom API", "Low Profile", Israeli payment with invoicing, or needs combined payment plus document generation. Targets the REST API V11. Do NOT use for Tranzila integration (use tranzila-payment-gateway), general accounting, or non-payment queries.
Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django/Hibernate/Rails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, distributed SQL database, serverless PostgreSQL-compatible database, migrate to DSQL, DSQL query plan, DSQL EXPLAIN ANALYZE, DSQL ENUM, DSQL foreign key, DSQL OCC retry, DSQL multi-region, DSQL JSONB, DSQL GIN index, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.
Builds Nango Function implementation patterns for createAction() and createSync() without choosing a local CLI or remote API workflow. Use only when the user asks to create or update a Nango action or sync and it is unclear whether the work should happen in a checked-out project via CLI or through Nango remote APIs. Do not load when building-nango-functions-locally or building-nango-functions-remotely applies; those skills overlap with this content and add workflow-specific validation and deploy details.
Review Go and TypeScript code for performance problems — allocations, GC pressure, O(n²) algorithms, N+1 queries, unbounded concurrency, blocked event loops, re-render storms. Works on uncommitted changes, a commit range, a branch, or a full PR. Use when the user says "perf review", "check performance", "find bad allocs", "is this slow", "review allocations", "will this scale", or asks for a performance pass on a diff, branch, or PR. Do not use for general correctness review or style review — this skill only hunts performance.
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analysis alerts, so the plan is ordered by what is actually reachable. Use when the user asks for an application security review or audit, an appsec assessment, vulnerability scanning across their stack, a security review before a launch or a customer security questionnaire, or does not yet know which kind of security test they need.
Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for an OWASP Top 10 assessment, OWASP compliance testing, or a security review mapped to OWASP categories.
Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, security-test, audit, or find vulnerabilities in an API, endpoint, or backend service.
Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.
Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.
Create and manage todo tracking documents for features, bugs, and multi-step tasks. Use when starting new work that benefits from a persistent record of decisions, progress, and context.