security-hardening

Expert guidance for architecting and troubleshooting Adobe Workfront Planning (WFP, aka "Maestro"): workspace and record-type design, record connections and hierarchies, formula fields, object and connection limits across Select/Prime/Ultimate tiers, the Planning API (filtering, bulk actions, workspace builds, API v2), Fusion, AI Assistant, CX Enterprise Coworker, GenStudio, Canvas Dashboards, views, access, licensing (incl. standalone Planning), permissions, business rules, and request forms. Use this skill whenever the user asks about Workfront Planning or Maestro: designing or building a workspace, connecting record types, fixing a broken formula, hitting or raising a limit (such as the 500 connected-records or 25,000 records-per-type caps), tier and capacity questions, filtering records through the API, choosing an automation surface, or reconciling public docs with actual API behavior. Also trigger for "build me a Planning workspace", "why is my formula failing", or "Select vs Prime vs Ultimate limits".

Review an exported Adobe Workfront Planning + Fusion scenario blueprint (.json) for performance, speed, resource use, and API call volume, and produce a prioritized optimization self-review. Use this whenever someone shares a Fusion scenario that uses Workfront Planning (Maestro) and wants it faster, cheaper, or more reliable: slow runs, long execution time, scenario timeouts, high operations consumption, too many API calls, or rate-limit / 429 errors, especially when it works in test but breaks under load or at scale. Trigger for phrases like "make my Fusion scenario faster", "why is this Planning scenario so slow", "reduce operations or API calls", "our replication or sync scenario times out", or "review this blueprint". It is specific to the Workfront Planning connector: if a scenario does not use Planning, it says so and does not apply. Read-only; it does not modify the blueprint.

Discover and collect all URLs of a website with the web CLI: parses robots.txt and sitemaps (XML, sitemap indexes, gzip) or follows links, with include/exclude glob patterns, a URL limit and language detection from the URL path. Triggers on: site urls, list pages, discover urls, site inventory, url collection, find all pages, site-scan, website urls, enumerate pages, map site, how many pages.

Captures the rendered layout of a webpage as a spatial tree of elements, with positions, sizes, grid layouts, backgrounds, and overlay occlusion, via the web CLI. Returns indented text, a JSON tree, and a map from node IDs to CSS selectors. Use before page decomposition, overlay detection, or brand extraction, or when the user asks for a page's visual hierarchy or layout.

Reduces a webpage to a structural skeleton. The web CLI detects sections and replaces content with semantic tokens (text, headings, images, CTAs, links, inputs), then the agent collapses repeated patterns and decorative wrappers and writes skeleton.html and manifest.json. Use when migrating a page to AEM Edge Delivery Services, extracting a page blueprint, or analyzing page structure for block generation.

Detects and removes overlays that block a webpage (cookie and GDPR consent banners, modals, newsletter popups, paywalls, login walls) with the web CLI, using Consent-O-Matic rules for known consent platforms plus DOM heuristics. Use before screenshotting, scraping, or automating a page that shows or may show such overlays, or when the user asks to dismiss cookie banners or popups.

Detects the languages on a webpage, both declared in markup (html lang, hreflang links, nested lang attributes, Content-Language meta) and present in the body text (Google CLD3), and reports where the two disagree. Use for i18n audits, hreflang validation, multilingual page checks, or when asked what language a page is in.

Extracts structured resources from a webpage with the web CLI: icons (SVGs classified as icon or logo and optimized for AEM Edge Delivery Services /icons/), metadata and Open Graph tags, body text, forms, videos, and social links. Use when migrating pages to Edge Delivery Services, auditing a site, or extracting a page's icons, metadata, or other assets.

Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized `repro_outputs/` files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.

Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

Audit, diagnose, or optimize website loading and interaction performance, Core Web Vitals, and Lighthouse performance scores.

Audit a landing page, sales page or checkout page for conversion leaks and return a fix list ordered by expected revenue impact. Use when asked to review, critique or improve a landing page, sales page, opt-in page, product page or checkout flow, when conversion rate is low, when paid traffic is not converting, or when someone asks "why isn't this page converting" or wants a CRO / landing page review.

Audit a browser fingerprint for internal contradictions with the liarjs CLI - canvas, WebGL, WebGL2, WebGPU, audio, 220 fonts, WebRTC and timezone probes, scored against the TLS/HTTP/ASN view of the same request. Use when asked to run a browser fingerprint test, see what a fingerprint looks like, check canvas or WebGL fingerprint stability, compare a spoofed profile against a real browser, or find out whether a browser profile is self-consistent.

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

When the user wants help with pricing decisions, packaging, or monetization strategy. Also use when the user mentions 'pricing,' 'pricing tiers,' 'freemium,' 'free trial,' 'packaging,' 'price increase,' 'value metric,' 'Van Westendorp,' 'willingness to pay,' 'monetization,' 'how much should I charge,' 'my pricing is wrong,' 'pricing page,' 'annual vs monthly,' 'per seat pricing,' 'should I offer a free plan,' 'pricing page teardown,' 'pricing page audit,' 'is my pricing page AI-readable,' or 'can AI read my pricing.' Use this whenever someone is figuring out what to charge, how to structure their plans, or wants to audit a pricing page (for humans and for the AI agents that shortlist tools). For in-app upgrade screens, see paywalls. For offer construction (bonuses, guarantees, value framing, naming) on services/courses/coaching/high-ticket B2B, see offers.