All Skills

Zustand 5 state management patterns. Trigger: When implementing client-side state with Zustand (stores, selectors, persist middleware, slices).

Test-Driven Development workflow for ALL Prowler components (UI, SDK, API). Trigger: ALWAYS when implementing features, fixing bugs, or refactoring - regardless of component. This is a MANDATORY workflow, not optional.

Syncs skill metadata to AGENTS.md Auto-invoke sections. Trigger: When updating skill metadata (metadata.scope/metadata.auto_invoke), regenerating Auto-invoke tables, or running ./skills/skill-sync/assets/sync.sh (including --dry-run/--scope).

Playwright E2E testing patterns. Trigger: When writing Playwright E2E tests (Page Object Model, selectors, MCP exploration workflow). For Prowler-specific UI conventions under ui/tests, also use prowler-test-ui.

Manages Prowler changelog entries as towncrier fragments (`<component>/changelog.d/<slug>.<type>.md`) compiled into keepachangelog-style CHANGELOG.md files at release time. Trigger: When creating PRs, adding changelog entries or fragments, fixing a failing changelog gate, or working with changelog.d/ or CHANGELOG.md in ui/, api/, mcp_server/, or prowler/.

React 19 patterns with React Compiler. Trigger: When writing React 19 components/hooks in .tsx (React Compiler rules, hook patterns, refs as props). If using Next.js App Router/Server Actions, also use nextjs-16.

Creates professional git commits for Prowler following conventional-commits format, with prek pre-commit hooks. Trigger: When creating commits, after completing code changes, when user asks to commit.

Creates and updates Prowler SDK security checks (implementation, metadata, fixers, configurable checks). Trigger: When creating or updating a Prowler SDK security check or its metadata.json for any provider (AWS, Azure, GCP, Kubernetes, GitHub, M365, etc.), adding a check fixer, or making a check configurable via audit_config.

Creates Pull Requests for Prowler following the project template and conventions. Trigger: When working on pull request requirements or creation (PR template sections, PR title Conventional Commits check, changelog gate/no-changelog label, backport labels), or when inspecting PR-related GitHub workflows like conventional-commit.yml, pr-check-changelog.yml, pr-conflict-checker.yml, labeler.yml, or CODEOWNERS.

Creates Prowler Attack Paths openCypher queries using the Cartography schema as the source of truth for node labels, properties, and relationships. Covers Prowler-specific additions (Internet node, ProwlerFinding, internal isolation labels), $provider_uid scoping, and list-property item nodes with typed `HAS_*` edges that run efficiently on both Neo4j and Amazon Neptune sinks. Trigger: When creating or updating Attack Paths queries.

Testing patterns for the Prowler MCP Server: in-memory FastMCP clients, the ProwlerAPIClient singleton, JSON:API model builders and mocked httpx transports. Trigger: When writing tests under mcp_server/tests/ (tools, models, api_client, auth, sub-servers).

Strict JSON:API v1.1 specification compliance. Trigger: When creating or modifying API endpoints, reviewing API responses, or validating JSON:API compliance.

Prowler API patterns: RLS, RBAC, providers, Celery tasks, SSE. Trigger: When working in api/ on models/serializers/viewsets/filters/tasks involving tenant isolation (RLS), RBAC, provider lifecycle, Celery tasks or SSE endpoints.

E2E testing patterns for Prowler UI (Playwright). Trigger: When writing Playwright E2E tests under ui/tests in the Prowler UI (Prowler-specific base page/helpers, tags, flows).

Updates the "Prowler at a Glance" table in README.md with accurate provider statistics. Trigger: When updating README.md provider stats, checks count, services count, compliance frameworks, or categories.

Django REST Framework patterns. Trigger: When implementing generic DRF APIs (ViewSets, serializers, routers, permissions, filtersets). For Prowler API specifics (RLS/RBAC/Providers), also use prowler-api.

Testing patterns for the Prowler SDK (Python): checks, services, fixers and providers. Trigger: When writing or fixing tests for the Prowler SDK (checks/services/fixers/providers under tests/), including AWS mocking with moto or botocore and MagicMock-based mocking for the other providers.

Reviews Django migration files for PostgreSQL best practices specific to Prowler. Trigger: When creating migrations, running makemigrations/pgmakemigrations, reviewing migration PRs, adding indexes or constraints to database tables, modifying existing migration files, or writing data backfill migrations. Always use this skill when you see AddIndex, CreateModel, AddConstraint, RunPython, bulk_create, bulk_update, or backfill operations in migration files.

Pytest testing patterns for Python. Trigger: When writing or refactoring pytest tests (fixtures, mocking, parametrize, markers). For Prowler-specific API/SDK testing conventions, also use prowler-test-api or prowler-test-sdk.

Reviews Pull Requests that add or modify Prowler compliance frameworks (universal multi-provider or legacy per-provider JSON, mappings, guardrails, formatters). Trigger: When reviewing PRs with compliance framework changes, CIS/NIST/PCI-DSS additions, or compliance JSON files.

Creates MCP tools for Prowler MCP Server. Covers BaseTool pattern, tool annotations, model design, error handling and API client usage. Trigger: When working in mcp_server/ on tools (BaseTool), models (MinimalSerializerMixin/from_api_response), Hub/Docs tools, or API client patterns.

Prowler UI-specific patterns. For generic patterns, see: typescript, react-19, nextjs-16, tailwind-4. Trigger: When working inside ui/ on Prowler-specific conventions (shadcn, folder placement, actions/adapters, shared types/hooks/lib).

Testing patterns for Prowler API: JSON:API, Celery tasks, RLS isolation, RBAC. Trigger: When writing tests for api/ (JSON:API requests/assertions, cross-tenant isolation, RBAC, Celery tasks, viewsets/serializers).

Creates, syncs, audits and maintains Prowler compliance frameworks: universal multi-provider JSON (preferred) and legacy per-provider JSON, ConfigRequirements guardrails, output formatters, external compliance plug-ins (entry points), and check-to-requirement mapping audits. Trigger: When working with compliance frameworks (CIS, CIS Controls, NIST, PCI-DSS, SOC2, GDPR, ISO27001, ENS, MITRE ATT&CK, CCC, C5, CSA CCM, DORA, CMMC, Cyber Essentials, FedRAMP 20x, KISA ISMS-P, ASD Essential Eight, DISA STIG, CISA SCuBA, SecNumCloud, HIPAA, NIS2, Prowler ThreatScore), creating a universal framework, adding ConfigRequirements guardrails, syncing with upstream catalogs, auditing check mappings, adding output formatters, or fixing compliance JSON bugs.