meisijiya/harness-engineering-skills

Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface. Use when creating REST or GraphQL endpoints, defining type contracts between modules, or establishing boundaries between frontend and backend.

Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be configured.

Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another. Use when migrating a database schema in production, such as renaming or dropping a column without downtime (expand/contract). Use when deciding whether to maintain or sunset existing code.

Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies

Use when implementation is complete, all tests pass, and you need to decide how to integrate the work

Builds production-quality, accessible, responsive user-facing UIs. Use when building or modifying interfaces and pages, creating components, implementing layouts, meeting WCAG accessibility requirements, managing state, or when the output needs to look and feel production-quality rather than AI-generated.

Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting. Use when shipping any feature that runs in production and you need evidence it works. Use when production issues are reported but you can't tell what happened from the available data.

帮助开发者跟进 AI 编写或维护的真实代码，通过源码定位、执行推演、证据核验和迁移练习保持独立维护能力。当用户要求古法编程、带着理解本次改动、接手 AI 项目、验证自己是否真正懂关键逻辑，或围绕实际代码练习推理时使用。不用于普通功能实现、仅找 bug 的审查或纯概念问答；实现、排障、性能测量仍由当前工程流程负责。

Optimizes application performance across frontend, backend, queries, and databases. Use when performance requirements exist, when you suspect performance regressions, when Core Web Vitals or load times need improvement, when N+1 query patterns need fixing, or when profiling reveals bottlenecks.

Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation

Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

Prepares production launches. Use when preparing to deploy to production, or when asking what needs to be in place before shipping. Use when you need a pre-launch checklist, when setting up monitoring, when planning a staged rollout, or when you need a rollback strategy.

Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback

动手实现工单、编写或修改代码、处理接口与安全性能问题、准备开口说「做完了」之前，先查这张能力路由表再动手。它把本包覆盖的通用工程能力接到「当前这一步在干什么」上，覆盖实现全流程的阶段检查点：动手前的契约与隔离方式、写到不可信输入或慢查询或界面时的专项技能、完成前的证据核验、合并与提交收尾。工单实现（含 /implement）、独立工程任务、只读安全审计、性能测量、浏览器取证同样适用。按当前动作只点名最贴近的一个，动作切换时重新查表；表里没有的行说明本包不覆盖，交回主流程继续。工作树隔离与并行委派先与用户商定，闸门优先于一切。Route only; procedures live in the target skills.

Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always