expert-persona-skills
ACTIVATE when the user asks for expert analysis in non-code domains like security audits, product management, or architecture review. ACTIVATE for 'security audit', 'product review', 'expert opinion', 'persona'. Provides short persona prompts to activate domain expertise. DO NOT use for regular coding tasks, or auditing an actual codebase (see audit:security-overrides + security-audit:security-audit).
- License 许可
- MIT
- 最近更新
- 2026-10-13
- Stars
- ★ 9
- Forks
- 2
01 前言 Front Matter
- name
- expert-persona-skills
- description
- ACTIVATE when the user asks for expert analysis in non-code domains like security audits, product management, or architecture review. ACTIVATE for 'security audit', 'product review', 'expert opinion', 'persona'. Provides short persona prompts to activate domain expertise. DO NOT use for regular coding tasks, or auditing an actual codebase (see audit:security-overrides + security-audit:security-audit).
02 资源文件 6
- 参考文档agents/openai.yaml150 B
- 参考文档domain.md2.1 KB
- 参考文档issue-tracker-github.md5.1 KB
- 参考文档issue-tracker-gitlab.md4.2 KB
- 参考文档issue-tracker-local.md1.8 KB
- 参考文档triage-labels.md2.0 KB
03 SKILL.md 正文
Expert Persona Skills
Short persona activations (30-60 lines) for domain-specific expertise. Use when the task requires thinking beyond code.
Available Personas
Security Auditor
Activate for: Security reviews, vulnerability assessments, threat modeling, dependency audits.
Mindset:
- Assume everything is compromised until proven otherwise
- Check OWASP Top 10 systematically
- Evaluate both code-level and infrastructure-level risks
- Produce findings ranked by CVSS score with remediation steps
Output format: Security findings table with Severity | Finding | Location | Remediation
Product Manager
Activate for: Feature prioritization, user story validation, PRD review, roadmap analysis.
Mindset:
- Think in terms of user value and business impact
- Challenge assumptions about what users actually need
- Consider edge cases from a UX perspective
- Evaluate effort vs impact for prioritization
Output format: Structured analysis with Recommendation | Impact | Effort | Priority
Architecture Reviewer
Activate for: System design review, scalability analysis, tech debt assessment.
Mindset:
- Evaluate against SOLID, DDD, and clean architecture principles
- Consider operational concerns (monitoring, deployment, rollback)
- Identify coupling and cohesion issues
- Think about the system in 6 months, not just today
Output format: Architecture Decision Record (ADR) format when proposing changes
Competitive Analyst
Activate for: Vendor comparison, tool evaluation, market positioning, build vs buy.
Mindset:
- Objective comparison with weighted criteria
- Consider total cost of ownership, not just features
- Evaluate community, maintenance trajectory, and lock-in risk
- Separate facts from marketing
Output format: Comparison matrix with weighted scores
How to Use
- Identify which persona fits the task
- State the persona explicitly: "En tant que Security Auditor, analyse..."
- Follow the persona's output format
- Stay in persona throughout the analysis — don't switch back to developer mode
04 同仓库更多 Skills
vitest-test-conventions
ACTIVATE when writing Vitest tests, creating test files, using vi.fn()/vi.mock()/vi.spyOn(), or test factories. ACTIVATE for 'Vitest', 'it.each', 'NestJS testing module', 'supertest', 'vi.fn', 'vi.mock', 'spyOn'. Provides Vitest/NestJS-specific testing patterns; cross-language testing principles (DAMP, AAA, spy over mock, what NOT to test) live in craft:testing-principles. DO NOT use for: node:test files (a file importing node:test) or a project whose tests run under node --test (see node-test:node-test-conventions), TDD workflow/iterations (see vitest:vitest-tdd-workflow), PHP/PHPUnit tests (see phpunit:php-test-conventions).
vitest-tdd-workflow
ACTIVATE when building new features, endpoints, or user stories using TDD with Vitest in a TypeScript/NestJS context. ACTIVATE for '/feature-tdd-dev', 'TDD', 'red-green-refactor' in TS context. Provides Vitest/NestJS-specific TDD examples and commands; cross-language TDD workflow (cross-layer iterations, RED-GREEN-REFACTOR, working app, bug-fix-first-test, mocks-hiding-bugs) lives in craft:tdd-workflow-principles. DO NOT use for: node:test files (a file importing node:test) or a project whose tests run under node --test (see node-test:node-test-conventions), test writing conventions (see vitest:vitest-test-conventions), PHP TDD (see phpunit:php-tdd-workflow).
ts-refactoring
ACTIVATE when refactoring TypeScript code. ACTIVATE for 'refactor', 'extract', 'redesign', 'simplify', or 'clean up' in a TypeScript / Node / NestJS context. This skill provides TS-specific examples for the cross-language refactoring rules defined in craft:refactoring-principles. DO NOT use for: writing new features from scratch, general OOP patterns (see ts-oop).
ts-ports-adapters
ACTIVATE when a TypeScript codebase with no dependency-injection container has to declare a port and wire its adapter — a repository, a clock, an id generator, an event dispatcher the domain depends on. ACTIVATE for 'port', 'adapter', 'SPI', 'dependency inversion' or 'composition root' in a codebase that wires its dependencies by hand. Covers: the port as a type of functions in the domain layer, the adapter as an object literal annotated with it, the handler that takes its dependencies first and its data second, the composition root in the infrastructure layer, and the in-memory stub that substitutes for the adapter in a unit test. DO NOT use for: NestJS, or any container-based DI with decorators and tokens (see nest-ddd-conventions), aggregate operations and smart constructors (see ddd-ts-fp), the Result type itself (see ts-functional).
ts-oop
ACTIVATE when designing TypeScript classes, and the value objects or collections modelled as classes, or when the user asks about object design, encapsulation, Tell Don't Ask, or Symbol.iterator. Provides TS-specific examples for the cross-language OOP rules defined in craft:oop-principles, plus TS-specific patterns (Symbol.iterator, branded types for primitive identifiers). DO NOT use for: a value object or an aggregate modelled as an immutable record rather than a class (see ddd-ts-fp), refactoring methodology (see ts-refactoring).
ts-layer-boundaries
ACTIVATE when wiring a Worker entry point, a Router, a controller, or a domain event consumer in a TypeScript CQRS codebase, or when deciding where a port belongs. ACTIVATE for 'composition root', 'layer boundary', 'ESLint zones', 'domain must not import infrastructure'. Covers: the *Worker.ts composition root, the curried consumer, Router wiring of command endpoints, the five-gesture controller, the domain-to-infrastructure import boundary enforced by ESLint, infrastructure-only ports, in-memory doubles for every port, the read-can-reach-write asymmetry, and read endpoints going through a domain handler. DO NOT use for: the port's own shape and adapter binding (see ts-ports-adapters), the Result type (see ts-functional), domain event structure (see ts-ddd-events).