Agent skills for Windsurf (legacy)

Optimize AssemblyAI costs through model selection, feature budgeting,

Implement AssemblyAI webhook handling for transcription completion events.

Assesses a research paper outline (.qmd file) against structured criteria from Kosuke Imai''s empirical research guide.

Use when code handles authentication, authorization, secrets, untrusted input, uploads, redirects, external requests, or sensitive data.

Routes between five assessment pathways — formative, rubric/criteria, authentic/performance, peer/self, and diagnostic — with validity and…

Create valid, reliable assessment items across formats (multiple choice, constructed response, performance tasks) following psychometric…

Audits game assets for compliance with naming conventions, file size budgets, format standards, and pipeline requirements.

Wraps each surfaced dimension as a self-contained 9-section autonomous-work-assignment envelope — scope, context, success criteria…

Makes agent reasoning visible, surfaces tradeoffs, and fades help so humans build judgment.

Audit something Claude built for the unstated assumptions baked into it — the silent interpretive leaps, not the caveats already written…

Extract and risk-rate hidden assumptions in a product brief or PRD.

Use ast-grep (`sg`) for Python and Zig structural code exploration, mechanical codemods, and rule maintenance in this repo.

Detect and triage OWASP AST01 Malicious Skills — hidden payloads (credential stealers, backdoors, social-engineering prose) shipped inside…

Detect and triage OWASP AST02 Supply Chain Compromise — registry flooding, dependency confusion in a skill's nested…

Detect and triage OWASP AST04 Insecure Metadata — brand-impersonating skill names, permission-understating manifests, risk_tier spoofing…

Detect and triage OWASP AST08 Poor Scanning — natural-language-only malicious intent, shell-parsing evasion (quote removal, IFS…

Detect and triage OWASP AST09 No Governance — no skill inventory, no approval workflow, orphaned skills after offboarding, regulated-data…

Detect and triage OWASP AST10 Cross-Platform Reuse — security metadata (risk_tier, permissions, signatures) silently dropped when a skill…

Use this skill when the user asks to view, export, or open agent output artifacts — "show me the artifacts", "export the results", "open…

Frontend component architect — decides component hierarchy, enforces SRP, and provides structured component specifications.

Core state machine orchestrator for the palskills development system.