Skills directory · page 42

Governed operational memory: harvest outcomes, curate lessons, review provenance, and retrieve approved lessons. Use for /oc-hindsight, remember this failure, find a similar incident, or what did we learn.

Third-party API integrations with Planner/Builder/Tester loop. Use for /oc-integrate, "connect to Salesforce", "webhook", "OAuth", "API integration", "connect to Slack", or any external service connection. For designing or building your *own* first-party API (OpenAPI/GraphQL authoring, versioning, SDK generation), use oc-api-dev instead. When the destination is the data warehouse, this skill builds the connector; the warehouse-bound pipeline + data contract side is oc-data-ops.

Migration and refactor operator for live systems: database migrations (D1 → Postgres, schema overhauls), framework upgrades (Hono v3→v4, React 18→19), auth provider swaps, monorepo restructures, and platform moves (Workers → Vercel). Produces incremental plans with rollback points at every step, executes with verification gates, and validates the end state matches the target spec. ALWAYS trigger on /oc-migrate, /oc-migration, /oc-upgrade, /oc-refactor, /oc-swap, /oc-move-to, /oc-platform-move. Also trigger on "migrate from X to Y", "upgrade to", "swap auth provider", "move database", "restructure the monorepo", "refactor to use", "breaking changes", "deprecation", "end of life". Also covers opchain ecosystem upgrades: "update all skills", "checkpoint protocol upgrade", "bulk update SKILL.md". Trigger when transforming an existing system from one state to another — not greenfield building (oc-app-architect) or documenting what exists (oc-reverse-spec).

Monolith decomposition operator. Decides whether modularization is even the right call (and is willing to say no), captures golden fixtures from REAL data for every boundary as an equivalence oracle, plans the seams + data ownership, and proves zero functionality/data loss by replaying the fixtures. Supports parallel-copy and strangler-fig strategies. Hands the bulk code-move + live cutover to oc-migration-ops (Structural type) and per-module deployment to oc-fleet-ops. Use for /oc-modularize, "break up the monolith", "extract a service from a live system", "split this codebase safely", "golden fixtures", "no functionality loss". For a behaviour-git-diffable repo/package reorg, use oc-migration-ops Structural instead. Trigger when decomposing a LIVE monolith carrying real traffic.

Post-deployment observability: uptime monitoring, error tracking, structured logging, alerting pipelines, and incident response runbooks. Sits after oc-deploy-ops in the pipeline — oc-deploy-ops ships it, oc-monitoring-ops watches it. Use for /oc-monitor, "set up monitoring", "error tracking", "uptime check", "alerting", "incident response", "observability", "what's happening in prod", "set up Sentry", "logging strategy", "on-call", "runbook", "SLO", "SLI", "is prod healthy", "why is it slow", "error rate", "status page". NOT opchain skill-usage metering (oc-telemetry-ops).

Pipeline coordinator for the opchain dev ecosystem. Multi-project registry, cross-skill status, smart routing, and "what should I do next?" recommendations. Use for /oc-ops, "what's the status", "where did I leave off", "which project", "what should I work on", "show me everything", or any question about pipeline state across projects. Also trigger when the user seems lost, references multiple projects, or asks a vague dev question that needs routing.

Prompt operations harness — treat prompts as versioned, diffable, source-controlled code. Owns prompt versioning, eval datasets, regression detection, and drift tracking. Use for /oc-prompt, "prompt versioning", "eval dataset", "prompt regression", "prompt drift", "golden set", "prompt diff", "LLM eval", "regression suite".

Test-strategy designer: owns the test pyramid, coverage budgets, contract-test matrix, and load-test planning — the strategy layer split out of oc-bug-check. oc-bug-check runs the tests in under two minutes at the commit gate; oc-qa-ops decides which tests should exist and where. Writes `.opchain/qa.yaml`, which oc-bug-check's test check reads when present. Use for /oc-qa, /oc-qa pyramid, /oc-qa coverage, /oc-qa contracts, /oc-qa loadplan, /oc-qa audit, "test strategy", "test pyramid", "coverage budget", "what should we test", "contract testing", "plan a load test", "too many e2e tests", "our tests are slow", "test debt", "flaky tests", "unit vs integration". Invoked by oc-app-architect Phase 2 to author 06-testing.md. NOT test execution (oc-bug-check), NOT load-test execution or perf budgets (oc-scale-ops), NOT first-party API conformance authoring (oc-api-dev), NOT writing the tests themselves (the build loop's Generator, or /oc-audit test-bootstrap for untested codebases).

Retrieval-augmented generation harness with a Designer/Builder/Evaluator loop. Owns vector DB selection (pgvector, Turbopuffer, Pinecone, Supabase Vectors), embedding-model choice, chunking strategy, hybrid search, and retrieval evaluation. Use for /oc-rag, "RAG", "vector database", "embeddings", "chunking", "semantic search", "hybrid search", "retrieval eval", "reranking", "knowledge base".

Release-cadence operator. Plan, draft, bump, announce, and ship versioned releases of opchain (or any opchain-managed project). Reads sprint checkpoints, proposes the next semver, drafts the /changelog entry from what actually shipped, bumps every skill version atomically, and hands off to oc-git-ops + oc-deploy-ops. Use for /oc-release, /oc-release plan, /oc-release draft, /oc-release bump, /oc-release announce, /oc-release ship, "cut a release", "ship v1.3", "draft the changelog", "what's in this release", "version bump". The release tag itself is oc-git-ops (/oc-git-release).

Repository hygiene and PR readiness gate. Invoked by oc-git-ops before every PR and after oc-docs-forge generates the PR documentation packet. Use for /oc-repo, /oc-repo audit, /oc-repo verify, "repo hygiene", "clean this repo", "is this PR ready", "check generated files", "catalog drift", "plugin/cache drift", ".gitignore policy", orphaned docs/files, stale generated artifacts, source-vs-doc mismatch, or any repository cleanliness question.

Reverse-engineer existing code into spec docs. Use for /oc-rev-spec, /oc-reverse-spec, /oc-rev-full, /oc-rev-scan, /oc-rev-design, /oc-rev-stack, /oc-rev-sprint, "document this codebase", "generate specs from code", "backfill specs", or when pointing at existing code that needs documentation.

Scaling readiness: load test, perf budgets, caching, capacity planning. Use for /oc-scale, "load test", "can this handle more users", "performance", "caching strategy", or any scaling question.

Practice-level security posture assessment: threat modeling (STRIDE), OWASP Top 10 compliance mapping, runtime/infra hardening (CSP, TLS, DNS, WAF, Cloudflare config), and attack surface mapping. Operates ABOVE oc-code-auditor — oc-code-auditor finds SQLi and hardcoded secrets; oc-security-auditor asks "what's the threat model?" and "is the infra hardened?" ALWAYS trigger on /oc-security, /oc-secaudit, /oc-sec, /oc-threat-model, /oc-owasp, /oc-hardening, /oc-attack-surface, /oc-posture. Also trigger on: "threat model this app", "is this secure enough", "OWASP compliance", "security review", "attack surface", "is it hardened", "what are the security risks", "SOC2 readiness", "pen test prep", "security architecture review", "audit the CSP policy", "review WAF rules", "check TLS config". Trigger on architecture-, infrastructure-, or compliance-level security questions — not just code bugs. Assessment only: oc-security-hardening (/oc-harden) executes the fixes; oc-compliance-ops keeps the

Security remediation and enforcement operator — the execution half of the security pair. oc-security-auditor assesses (/oc-hardening audits the posture); oc-security-hardening executes (/oc-harden writes the fixes): security headers, staged CSP rollout, TLS/WAF/rate-limit config as code, secrets hygiene, dependency-pinning policy. Maintains `.opchain/hardening.yaml` — the declared-controls manifest — and stands the per-deploy gate that verifies it, the "before every deploy" step auditor findings never had. Use for /oc-harden, /oc-harden baseline, /oc-harden fix, /oc-harden csp, /oc-harden gate, "harden this", "fix the security findings", "the pen test found", "add security headers", "roll out CSP", "rate limit this endpoint", "rotate secrets", "block deploys on security regressions", "security baseline". NOT assessment (oc-security-auditor), NOT code-bug fixing (oc-code-auditor's Fixer), NOT dependency vuln scanning (oc-bug-check — this skill owns pinning policy, not the scan).

Analytics & signals backend harness with a Designer/Builder/Evaluator loop. Derives new metrics from the question they answer, builds the instrumentation + harvester + transform, and adversarially verifies the signal is correct AND answers the question before wiring it to a consumer. Use for /oc-signal, "new metric", "instrument this", "analytics backend", "data harvesting", "is this metric right", "wire up a signal", "derive a KPI". Hands the validated signal (stable read contract) to oc-dash-forge for rendering. NOT pipeline telemetry (oc-telemetry-ops), NOT dashboards (oc-dash-forge), NOT prod uptime (oc-monitoring-ops), NOT estate-level data pipelines — ingestion/dbt/warehouse layering is oc-data-ops; when a metric needs a pipeline that doesn't exist, chain to /oc-data-ops design and build the signal on the contracted mart.

Stack advisor for any platform: Cloudflare, Vercel, AWS, Supabase, Rails, Django. Use for /oc-stack, /oc-stack-decide, /oc-feature, "what stack", "tech stack", "what should I build with", or framework comparisons. Invoked by oc-app-architect.

Telemetry operations harness — opt-in, local-first usage metering that records which skills and phases actually run, to a local .checkpoints/usage.sqlite store, then produces anonymized local aggregate exports. Use for /oc-telemetry, "usage metering", "opchain usage telemetry", "opt-in analytics", "which skills do people use", "usage stats", "dashboard data", "anonymized usage". Default stance is OFF — nothing is recorded until you explicitly enable it, and no prompt content or PII ever leaves the machine. Pairs with oc-cost-ops (cost per run) for the cost-per-feature dashboard stats. NOT application or production observability (oc-monitoring-ops).

Check and update Opchain skills installed in the current repository. Use for /oc-update, "update Opchain", "refresh my Opchain skills", or "check for Opchain updates". Preserves telemetry consent, usage history, checkpoints, and unrelated skills. Does not upgrade application dependencies or globally installed plugins.

UI/UX design harness with Design Planner/Generator/Evaluator loop. Use for /oc-uxe, "review the UX", "design iteration", "component library", "accessibility audit", "is the UI consistent", or any design quality question. Routes data-heavy screens (dashboards, BI, analytics) to oc-dash-forge via /oc-uxe dash.

Compare multiple job offers side-by-side with total compensation analysis. Use when the user has multiple offers and wants to compare salary, equity, benefits, or total comp.

Founder advice after six YC-style questions. Use whenever a founder is stuck or unsure what to ask, or /c-level-agents:office-hours.

Reconcile open follow-ups or refresh an activity log from Sent Items, inbox, calendar, and supplied evidence. Use when checking which replies were already sent, which evidence gaps can be resolved, or what changed through a cutoff. Excludes drafting, sending, and deciding overall application status.

Forecast adoption of emerging agentic attack patterns from dated, source-backed signals. Use when prioritizing defensive research or control preparation. Do not use for targeting, attribution, or unsupported weaponization claims.

Inventory deployed agents, models, tools, identities, permissions, data access, and trust boundaries. Use when establishing agent security posture, blast radius, or change detection. Do not grant access or modify deployments.

Define a defensive taxonomy of agentic attack behaviors and observable indicators. Use when normalizing detection cases, threat narratives, or validation plans. Do not generate payloads, bypass sequences, or exploit instructions.

Assess authentication and credential-abuse controls with synthetic identities and approved harnesses. Use for lockout, throttling, MFA, reset, session, or alerting validation in a lab or authorized staging environment. Do not perform credential attacks against live systems.

Assess data-loss prevention and access boundaries with synthetic canary data. Use when validating agent data flows, unsafe tool transfer, or cross-boundary disclosure controls in a controlled environment. Do not collect or transmit real sensitive data.

Assess whether an agent, tool, or configuration change can cross a defined control boundary in a disposable synthetic lab, using non-destructive evidence and no deployable exploit content.

Assess agent-to-agent and service-to-service authorization boundaries using a synthetic capability graph. Use when validating least privilege and containment in a lab or authorized staging environment. Do not pivot through live systems.

Collect and triage dated public or approved threat signals about agentic abuse patterns. Use for an early-warning feed supporting defensive planning. Do not execute fetched content or collect private data.

Assess whether agent and host controls detect unauthorized state retention in an isolated disposable lab. Use for benign startup, scheduled, configuration, and account-change fixtures. Do not install persistence on live systems.

Validate a project change, draft, research packet, skill, promotion package, or handoff before it is treated as complete. Use after meaningful work and before handoff, graduation, publication review, or reliance on an artifact. Run the identified project validator when one exists, then add judgment checks the script cannot prove.

Capture and normalise a current-state process description into a structured as-is process YAML with stable step identifiers. Use this skill when the user has a process that is already running and needs to document its current state before gap analysis or redesign; when they provide step lists, SOPs, or process notes that need to be structured; when they say \"document what we do today\", \"capture the current process\", or \"baseline the process before we change it\". Do not use this skill to design a target state or propose changes — that is okhp3-future-state-change-strategy; this skill records only what happens today. Produces a structured as-is process artifact with normalised step IDs.

Capture and normalise a current-state process description into a structured as-is process YAML with stable step identifiers. Use this skill when the user has a process that is already running and needs to document its current state before gap analysis or redesign; when they provide step lists, SOPs, or process notes that need to be structured; when they say "document what we do today", "capture the current process", or "baseline the process before we change it". Produces a structured as-is process artifact with normalised step IDs.

OverKill Hill P³ AskJamie SPA styling. Use when a user wants an AskJamie application, documentation artifact, presentation, or image brief aligned to the approved AskJamie profile. Also activate when a target needs calm, mid-century helpdesk clarity for complex decisions. This specialization applies the approved local profile and does not substitute OverKill Hill or Glee-fully styling.

OverKill Hill P³ ChatGPT project migration. Use when migrating, preserving, extracting, inventorying, normalizing, reconciling, or incorporating ChatGPT project threads, conversation exports, or complete chat histories into a repository. Also activate when a user needs a lossless thread archive, project-to-export crosswalk, provenance ledger, or public-safe distillation workflow. This is the authoritative capture and reconciliation process for ChatGPT project material in this repo -- use it even when the user asks only to "save", "review", or "summarize" a large set of threads.

Draft an email or direct message the owner will send as themselves, using the AskJamie lens method (Represent, Frame, Investigate, Protect). Reads the full thread, flags every commitment and unknown, runs a tone and over-promising check, and returns a draft plus notes. Use when asked to draft, reply to, or rewrite correspondence. Never sends.

Extract manually supplied ChatGPT conversations into standalone, actionable Markdown. Use when the user pastes a ChatGPT chat, Project thread, Canvas, Deep Research report, search answer, prompt-response sequence, generated file or image reference, or export excerpt and wants its goals, reasoning, decisions, reusable assets, next actions, provenance, and missing sidecars preserved at rapid, balanced, comprehensive, essential, substantial, exhaustive, scan, distill, or catalog depth. Use for control-all copies, turn-by-turn transfers, flattened UI text, and uncertain roles. Do not use for account login or scraping, wholesale Project migration, Custom GPT design, OpenAI API support, ordinary summaries, or lossless transcript archival.

Extract manually supplied Claude conversations into standalone, actionable Markdown. Use when the user pastes a Claude chat, Project excerpt, Artifact, Research or web-search output, prompt-response sequence, uploaded-file reference, or export excerpt and wants its goals, reasoning, decisions, reusable assets, next actions, provenance, and missing sidecars preserved at rapid, balanced, comprehensive, essential, substantial, exhaustive, scan, distill, or catalog depth. Use for control-all copies, turn-by-turn transfers, flattened UI text, Artifact versions, and uncertain roles. Do not use for Claude account access or scraping, ordinary summaries, unrelated Anthropic API support, or lossless transcript archival.

Assess an incomplete or newly proposed AskJamie lens or Custom GPT for build readiness. Use when a user has an AskJamie idea, partial notes, pasted conversation, draft instructions, knowledge files, or unfinished assistant and needs an evidence inventory, explicit gaps, targeted elicitation, a readiness score, or a handoff to okhp3-askjamie-gpt-builder.

Create governed FoundRy child repositories from Custom GPTs, Gemini Gems, Copilot agents, prompt bundles, Notion concepts, research notes, or prototype ideas. Use whenever the user wants to migrate an AI capability into GitHub, standardize a repo, create a child repo scaffold, or convert platform-specific AI work into a reusable capability package.

OverKill Hill P³ repository organizer for content-first Git repositories. Use when a local Git repository grew organically from a folder and needs an evidence-based profile, purpose summary, classification, cross-platform naming cleanup, folder design, governance scaffolding, or a safe reorganization plan. Also activate when a repository contains prompts, AI conversations, research, Word documents, spreadsheets, PDFs, images, or mixed knowledge assets rather than a conventional application. This is the authoritative workflow for understanding and organizing an existing repository; use it instead of application-template advice, skill cataloging, or new-repository creation workflows.

OverKill Hill P³ visual style registry and application workflow. Use when a user wants to extract a reusable brand, visual style, palette, typography system, layout language, or interface aura from a website, stylesheet, document, presentation, infographic, or set of visual assets. Also activate when a user wants an SPA, documentation, presentation, image brief, or other target artifact aligned to one or more named style profiles. This is the authoritative profile-driven workflow for capturing and applying visual style without blending unrelated brands or treating inferred cues as declared rules.

Extract pasted or uploaded AI chat threads into standalone, actionable Markdown. Use when the user wants to evacuate context from ChatGPT, Claude, Gemini, Perplexity, Microsoft Copilot, Grok, Mistral Vibe, an unknown AI platform, or a mixed transcript; preserve goals, decisions, reasoning, next actions, prompts, code, files, images, citations, canvases, artifacts, diagrams, and provenance; resolve uncertain speaker boundaries; or requests rapid, balanced, comprehensive, essential, substantial, exhaustive, scan, distill, or catalog depth. Use for complete, partial, flattened, exported, or turn-by-turn human-supplied captures. Do not use for logging into or scraping source services, lossless transcript archival, ordinary short-form summaries, or platform support questions that do not require a durable handoff artifact.

Measure the economic sustainability of defensive controls against distributed agentic threats. Use when comparing attack effort, defensive effort, expected loss, and recovery cost. Do not invent attacker costs or make budget decisions without supplied data.

Define and enforce authorization checkpoints for defensive assessment and response workflows. Use when deciding who may approve tests, containment, sharing, or high-consequence actions. Do not grant authority implicitly or replace legal or security leadership.

Establish privacy-aware baselines for agent behavior, tool use, requests, resource consumption, and data flows. Use when detecting drift or evaluating control changes. Do not infer intent or treat an anomaly as proof of compromise.

OverKill Hill P³ visual style registry and application workflow. Use when a user wants to extract a reusable brand, visual style, palette, typography system, layout language, or interface aura from a website, stylesheet, document, presentation, infographic, or set of visual assets. Also activate when a user wants an SPA, documentation, presentation, image brief, or other target artifact aligned to one or more named style profiles. This is the authoritative profile-driven workflow for capturing and applying visual style without blending unrelated brands or treating inferred cues as declared rules.

OverKill Hill P³ visual style registry and application workflow. Use when a user wants to extract a reusable brand, visual style, palette, typography system, layout language, or interface aura from a website, stylesheet, document, presentation, infographic, or set of visual assets. Also activate when a user wants an SPA, documentation, presentation, image brief, or other target artifact aligned to one or more named style profiles. This is the authoritative profile-driven workflow for capturing and applying visual style without blending unrelated brands or treating inferred cues as declared rules.