Skills

Decide what to limit, by what key, and what a legitimate burst looks like before it's throttled.

Trace untrusted input to where it's used and check the boundary that should have stopped it.

Draft a threat model for a feature: what an attacker wants, and the cheapest way they get it.

Check every mutation for a server-side ownership check, not just a hidden button.

Find credentials in source, history, logs and error messages, and say how to rotate each.

Read an advisory list and separate what's exploitable in this codebase from what isn't.

Report every tap target under 44px and how to grow the hit area without moving the pixels.

Check a form for unlabelled inputs, errors announced to nobody, and tab order that jumps.

Walk every dialog, menu and drawer with a keyboard and report where focus gets stuck or lost.

Find ARIA that lies: roles that don't match behaviour, labels that duplicate visible text, and live regions nobody announces.

Check every text and icon colour against its background and report the pairs that fail WCAG AA.

Check whether a sample can support the claim being made from it.

Restructure a long query into CTEs that each say one thing, without changing the plan.

Check whether a pipeline can be re-run without doubling its output, and what to key on if not.

Review a dashboard for charts that answer no question, and axes that flatter the numbers.

Pin down what a metric actually counts, its window, and which rows it silently excludes.

List the screens with no offline story, and what each should show when the network is gone.

Find fixed elements that ignore the safe area and end up under a notch or a home indicator.

Check drag and swipe handlers for 1:1 tracking, velocity on release, and interruptibility mid-flight.

Review animation code for the wrong easing, durations over budget, and motion on things tapped all day.

Find the work happening per frame that shouldn't be, and what to move off the main thread.

Check images for missing dimensions, wrong formats, and the layout shift that follows.

Find the imports responsible for a bundle's weight and the smaller thing each one could be.

Trace a new user's first ten minutes and list every step that assumes knowledge they don't have.

Take a spec and propose the smallest version that still answers the question it was written for.

Draft a pull request description: the problem, the approach, and what a reviewer should look at first.

Write a commit message that says why, from a diff that only shows what.

Find feature flags nobody has flipped in months and the code each one still holds hostage.

Write the ADR for a choice already made, including the options that lost and why.

Summarise a paper into its claim, method, and the one limitation the abstract skipped.