shandar/pwp-plugin Skills

API design standards — consistent, predictable, documented endpoints. Use this skill whenever the user is building, reviewing, or planning an API. Also use when they mention REST endpoints, API routes, request/response shapes, status codes, pagination, versioning, or say things like 'design the API', 'what should this endpoint look like', 'review my API', or 'add an endpoint for X'. Covers REST conventions, status codes, response envelopes, pagination, filtering, versioning, and validation.

New project initialization protocol — from empty directory to production-ready foundation in one session. Use this skill whenever the user wants to start a new project, initialize a repo, scaffold an application, or set up a codebase from scratch. Also use when they say 'new project', 'start fresh', 'initialize a repo', 'scaffold this', 'set up the project', or 'create a new app'. Covers repo setup, tooling config, folder structure, hello world verification, and CI/CD.

Systematic code review protocol — review code with rigor and specificity. Use this skill whenever the user asks you to review code, check a PR, audit a file, look over changes, or give feedback on implementation quality. Also use when they say 'review this', 'is this code good', 'check my work', 'what do you think of this implementation', or 'any issues with this'. Covers correctness, security, readability, performance, maintainability, and testing.

Systematic debugging protocol — diagnose, isolate, and fix bugs with discipline. Use this skill whenever the user reports a bug, error, crash, or unexpected behavior. Also use when they say things like 'this is broken', 'not working', 'something's wrong', 'fix this', 'why is this failing', or share an error message or stack trace. Covers reproduce → isolate → root cause → fix → verify workflow.

Deployment protocol — safe, observable, reversible releases from main to production. Use this skill whenever the user is deploying, releasing, shipping, or pushing to production. Also use when they say 'deploy this', 'ship it', 'push to production', 'release', 'go live', 'pre-deploy check', 'rollback', 'feature flags', or ask about deployment strategies, staging, CI/CD pipelines, or monitoring setup. Covers environment ladder, pre-deploy checklist, deployment strategies, database migration safety, feature flags, rollback plans, and post-deploy verification.

Documentation lifecycle protocol — living docs that stay current and traceable. Use this skill whenever the user needs to create, update, or organize project documentation. Also use when they say 'update the docs', 'write documentation', 'update the changelog', 'document this', 'add to the README', 'architecture docs', 'create a plan document', or ask about documentation structure, feature traceability, or post-completion walkthroughs. Covers living documents, feature traceability IDs, changelog management, architecture docs, and walkthrough artifacts.

Data and schema migration protocol — safe, reversible, verified migrations. Use this skill whenever the user needs to do a database migration, schema change, data transformation, platform move, or major dependency upgrade. Also use when they say 'add a column', 'change the schema', 'upgrade the database', 'move to a new host', 'backfill data', or 'major version upgrade'. Covers schema, data, platform, and dependency migrations with rollback strategies.

Performance optimization protocol — measure first, optimize second, verify always. Use this skill whenever the user reports something is slow, asks about performance, wants to optimize, or mentions load times, bundle size, rendering speed, memory usage, or database query performance. Also use when they say 'this is slow', 'speed this up', 'optimize this', 'reduce bundle size', 'improve load time', or 'why is this taking so long'. Covers web vitals, profiling, bottleneck identification, and before/after verification.

Safe refactoring protocol — restructure code without breaking behavior. Use this skill whenever the user asks to refactor, restructure, reorganize, clean up, simplify, or decompose code. Also use when they say 'this file is too big', 'too much duplication', 'split this up', 'make this cleaner', 'reduce complexity', or 'extract this into its own thing'. Covers extract, rename, move, inline, and simplify patterns with safety verification.

Security review protocol — systematic checks for common vulnerabilities and security hygiene. Use this skill whenever the user asks about security, wants a security audit, mentions vulnerabilities, OWASP, XSS, SQL injection, authentication issues, or secrets management. Also use when they say 'is this secure', 'check for vulnerabilities', 'security review', 'audit this for security', or 'are there any security issues'. Covers secrets, input validation, auth, authorization, data protection, dependencies, and error handling.

Testing strategy and implementation protocol — structured quality assurance that catches real bugs. Use this skill whenever the user asks to write tests, add test coverage, set up a testing strategy, or asks 'how should I test this'. Also use when they say 'add tests', 'write tests for this', 'test coverage', 'what should I test', 'this needs tests', or 'set up testing'. Covers test pyramid, naming conventions, coverage targets, test data factories, and when to test what.