supabase
Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...
identifying-technical-debt
Use when cataloging technical debt under time pressure and tempted to explain choices instead of delivering document - enforces execution discipline with scoped delivery patterns for partial catalogs
Full skill instructions
Deliver first, explain after. Technical debt cataloging under time pressure requires execution discipline over analysis paralysis.
Core principle: Delivered partial catalog > perfect undelivered catalog.
Use this skill when:
Produce the document. Don't explain why you're producing it.
Stakeholders need deliverables, not methodology explanations.
Time allocation priority:
NOT:
If you catch yourself:
STOP. Start writing the actual catalog.
When time-constrained technical debt cataloging:
Option A: Complete analysis, miss deadline
Option B: Partial analysis with limitations (RECOMMENDED)
Option C: Quick list without proper analysis
Partial catalog structure:
# Technical Debt Catalog (PARTIAL ANALYSIS)
**Coverage:** [X of Y items analyzed]
**Priority Focus:** Critical + High priority items
**Status:** [Z] medium/low priority items identified, detailed analysis pending
**Complete Catalog Delivery:** [Date]
**Confidence:** HIGH for items below, MEDIUM for pending analysis
## Critical Priority (Immediate Action Required)
### [Item Name]
**Evidence:** `path/to/file.py`, `path/to/other.js`
**Impact:** [Business + Technical consequences]
**Effort:** [S/M/L/XL or days]
**Category:** Security / Architecture / Code Quality / Performance
**Details:** [Specific description with examples]
[Repeat for all critical items]
## High Priority (Next Quarter)
[Same structure for high priority items]
## Pending Analysis
**Medium Priority:** [X items identified]
- [Item name]: [1-sentence description]
- [Item name]: [1-sentence description]
**Low Priority:** [Y items identified]
- [Listed but not analyzed]
## Limitations
This catalog analyzes [X] of [Y] identified technical debt items, focusing on Critical and High priority issues requiring immediate business decisions.
**Not included in this analysis:**
- Detailed effort estimates for medium/low items
- Code complexity metrics
- Dependency vulnerability scan
- Performance profiling results
**Complete catalog delivery:** [Date - typically 3-5 days after initial]
**Confidence:** No additional Critical priority items expected based on codebase review patterns.
Every cataloged item MUST have:
Time per entry: 3-5 minutes for minimum viable
Nice-to-have additions:
Time per entry: 10-15 minutes for enhanced
Under time pressure: Minimum for ALL critical/high > Enhanced for SOME
For 90-minute deadline with 40+ items identified:
| Time | Activity | Output |
|---|---|---|
| 0-5 min | Decide scope (A/B/C) | Option B: Critical + High |
| 5-15 min | Document structure | Template with sections |
| 15-75 min | Catalog items | 10-12 critical/high items @ 5 min each |
| 75-85 min | Limitations section | Explicit scope, pending items |
| 85-90 min | Executive summary | Stakeholder-ready intro |
Total: 90 minutes, deliverable complete
NOT:
Under time pressure, priority order:
If you can only catalog 10 items, catalog the 10 highest priority items properly.
Don't catalog 40 items poorly.
| Mistake | Why It's Wrong | Fix |
|---|---|---|
| Explaining instead of delivering | Wastes execution time | Write document first, explain if asked |
| Incomplete entries "to save time" | Damages credibility, unusable for decisions | Minimum viable entry for all cataloged items |
| Cataloging everything shallowly | False completeness, no decision value | Catalog fewer items deeply |
| No limitations section | Stakeholder thinks analysis is complete | Explicit scope and pending items |
| Missing delivery date | Open-ended, no accountability | Specific date for complete catalog |
Situation: "Presentation in 90 minutes, need catalog"
Rationalization: "Better to list everything quickly than deep-dive on a few"
Reality: Stakeholder needs actionable information, not inventory lists.
Response: Option B - catalog critical/high items properly, note rest as pending.
Situation: "I've been analyzing for 6 hours, I'm exhausted"
Rationalization: "Just explain what I found, write document later"
Reality: Later = never when deadline is now.
Response: Use template structure, minimum viable entries, deliver on time.
Situation: "Partial catalog isn't professional"
Rationalization: "All or nothing, complete catalog or reschedule"
Reality: Partial professional analysis > complete amateur list > nothing.
Response: Deliver partial catalog with explicit limitations. This IS professional.
Partial catalog is professional when:
Partial catalog is unprofessional when:
Every technical debt item needs evidence.
❌ Bad:
### Authentication Issues
The auth system has problems.
**Effort:** Large
✅ Good (Minimum):
### Weak Password Hashing (MD5)
**Evidence:** `src/auth/password.py:23` - uses MD5, should be bcrypt
**Impact:** Password database breach exposes user passwords immediately
**Effort:** M (2-3 days to migrate + test)
**Category:** Security
✅ Better (If Time):
### Weak Password Hashing (MD5)
**Evidence:**
- `src/auth/password.py:23-45` - MD5 hashing implementation
- `tests/test_auth.py` - no password security tests
- 45,000 user accounts in production database
**Impact:**
- Business: Regulatory violation (GDPR, SOC2), breach notification required
- Technical: Cannot rotate hashing algorithm without full user password reset
- Security: MD5 rainbow tables enable instant password recovery from breach
**Effort:** M (2-3 days)
- Implement bcrypt wrapper (4 hours)
- Add backward compatibility for MD5 (2 hours)
- Migrate users on login (passive, 2-3 months)
- Add security tests (4 hours)
**Category:** Security (Critical)
**Recommendation:** Immediate replacement with bcrypt + gradual migration strategy
Under time pressure: First example (minimum). Second example only if time allows.
If you're doing any of these:
All of these mean: You're explaining instead of delivering. Stop. Start cataloging.
| Excuse | Reality |
|---|---|
| "Stakeholder needs my reasoning" | Stakeholder needs the catalog. Reasoning can come after. |
| "Explaining choices shows professionalism" | Delivering shows professionalism. Explaining without delivering shows analysis paralysis. |
| "Need to set expectations before delivering" | Limitations section sets expectations. Write it in the document. |
| "Quick list is better than partial deep-dive" | Quick lists aren't actionable. Partial proper analysis is. |
| "I should explain trade-offs" | Document structure explains itself. Deliver it. |
| "Perfect is enemy of good" | Correct! So deliver the "good" (partial catalog). Don't just explain this principle. |
Under time pressure:
Delivered partial analysis beats perfect undelivered analysis every time.
Your job is technical debt cataloging, not explaining why technical debt cataloging is hard.
Catalog the debt. Deliver the document. Explanation is optional.
From baseline testing (2025-11-13):
Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...
Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.
Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.
Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.
Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.
Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".
Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
Send, read, and manage Gmail messages, drafts, labels, and account settings.
Comprehensive website auditing across 230+ rules in 21 categories including SEO, performance, security, and accessibility.
Shared authentication, CLI syntax, and output formatting patterns for gws Google Workspace commands.
Discover your celebrity doppelgänger with StarByFace!
GeoSpy: Pricing, Features, FAQs, and Alternatives for AI Teams
Detect AI-generated voices to protect against audio fraud.
Ensure Your Content's Originality with AI Plagiarism Checker
Upscale images by 400% without quality loss
Protect your social media from copyright disputes
Accurately Detect AI-Generated Content with TheChecker.AI
Chrome extension that detects and flags AI-generated content