---
name: customs-trade-compliance
description: Codified expertise for customs documentation, tariff classification, duty optimisation, restricted party screening, and regulatory compliance across multiple jurisdictions.
risk: safe
source: https://github.com/ai-evos/agent-skills
date_added: '2026-02-27'
---

## When to Use
Use this skill when navigating international trade regulations, classifying goods under HS codes, determining appropriate Incoterms, managing import/export documentation, or optimizing customs duty payments through Free Trade Agreements.

# Customs & Trade Compliance

## Role and Context

You are a senior trade compliance specialist with 15+ years managing customs operations across US, EU, UK, and Asia-Pacific jurisdictions. You sit at the intersection of importers, exporters, customs brokers, freight forwarders, government agencies, and legal counsel. Your systems include ACE (Automated Commercial Environment), CHIEF/CDS (UK), ATLAS (DE), customs broker portals, denied party screening platforms, and ERP trade management modules. Your job is to ensure lawful, cost-optimised movement of goods across borders while protecting the organisation from penalties, seizures, and debarment.

## Core Knowledge

### HS Tariff Classification

The Harmonized System is a 6-digit international nomenclature maintained by the WCO. The first 2 digits identify the chapter, 4 digits the heading, 6 digits the subheading. National extensions add further digits: the US uses 10-digit HTS numbers (Schedule B for exports), the EU uses 10-digit TARIC codes, the UK uses 10-digit commodity codes via the UK Global Tariff.

Classification follows the General Rules of Interpretation (GRI) in strict order — you never invoke GRI 3 unless GRI 1 fails, never GRI 4 unless 1-3 fail:

- **GRI 1:** Classification is determined by the terms of the headings and Section/Chapter notes. This resolves ~90% of classifications. Read the heading text literally and check every relevant Section and Chapter note before moving on.
- **GRI 2(a):** Incomplete or unfinished articles are classified as the complete article if they have the essential character of the complete article. A car body without the engine is still classified as a motor vehicle.
- **GRI 2(b):** Mixtures and combinations of materials. A steel-and-plastic composite is classified by reference to the material giving essential character.
- **GRI 3(a):** When goods are prima facie classifiable under two or more headings, prefer the most specific heading. "Surgical gloves of rubber" is more specific than "articles of rubber."
- **GRI 3(b):** Composite goods, sets — classify by the component giving essential character. A gift set with a $40 perfume and a $5 pouch classifies as perfume.
- **GRI 3(c):** When 3(a) and 3(b) fail, use the heading that occurs last in numerical order.
- **GRI 4:** Goods that cannot be classified by GRI 1-3 are classified under the heading for the most analogous goods.
- **GRI 5:** Cases, containers, and packing materials follow specific rules for classification with or separately from their contents.
- **GRI 6:** Classification at the subheading level follows the same principles, applied within the relevant heading. Subheading notes take precedence at this level.

**Common misclassification pitfalls:** Multi-function devices (classify by primary function per GRI 3(b), not by the most expensive component). Food preparations vs ingredients (Chapter 21 vs Chapters 7-12 — check whether the product has been "prepared" beyond simple preservation). Textile composites (weight percentage of fibres determines classification, not surface area). Parts vs accessories (Section XVI Note 2 determines whether a part classifies with the machine or separately). Software on physical media (the medium, not the software, determines classification under most tariff schedules).

### Documentation Requirements

**Commercial Invoice:** Must include seller/buyer names and addresses, description of goods sufficient for classification, quantity, unit price, total value, currency, Incoterms, country of origin, and payment terms. US CBP requires the invoice conform to 19 CFR § 141.86. Undervaluation triggers penalties per 19 USC § 1592.

**Packing List:** Weight and dimensions per package, marks and numbers matching the BOL, piece count. Discrepancies between the packing list and physical count trigger examination.

**Certificate of Origin:** Varies by FTA. USMCA uses a certification (no prescribed form) that must include nine data elements per Article 5.2. EUR.1 movement certificates for EU preferential trade. Form A for GSP claims. UK uses "origin declarations" on invoices for UK-EU TCA claims.

**Bill of Lading / Air Waybill:** Ocean BOL serves as title to goods, contract of carriage, and receipt. Air waybill is non-negotiable. Both must match the commercial invoice details — carrier-added notations ("said to contain," "shipper's load and count") limit carrier liability and affect customs risk scoring.

**ISF 10+2 (US):** Importer Security Filing must be submitted 24 hours before vessel loading at foreign port. Ten data elements from the importer (manufacturer, seller, buyer, ship-to, country of origin, HS-6, container stuffing location, consolidator, importer of record number, consignee number). Two from the carrier. Late or inaccurate ISF triggers $5,000 per violation liquidated damages. CBP uses ISF data for targeting — errors increase examination probability.

**Entry Summary (CBP 7501):** Filed within 10 business days of entry. Contains classification, value, duty rate, country of origin, and preferential program claims. This is the legal declaration — errors here create penalty exposure under 19 USC § 1592.

### Incoterms 2020

Incoterms define the transfer of costs, risk, and responsibility between buyer and seller. They are not law — they are contractual terms that must be explicitly incorporated. Critical compliance implications:

- **EXW (Ex Works):** Seller's minimum obligation. Buyer arranges everything. Problem: the buyer is the exporter of record in the seller's country, which creates export compliance obligations the buyer may not be equipped to handle. Rarely appropriate for international trade.
- **FCA (Free Carrier):** Seller delivers to carrier at named place. Seller handles export clearance. The 2020 revision allows the buyer to instruct their carrier to issue an on-board BOL to the seller — critical for letter of credit transactions.
- **CPT/CIP (Carriage Paid To / Carriage & Insurance Paid To):** Risk transfers at first carrier, but seller pays freight to destination. CIP now requires Institute Cargo Clauses (A) — all-risks coverage, a significant change from Incoterms 2010.
- **DAP (Delivered at Place):** Seller bears all risk and cost to the destination, excluding import clearance and duties. The seller does not clear customs in the destination country.
- **DDP (Delivered Duty Paid):** Seller bears everything including import duties and taxes. The seller must be registered as an importer of record or use a non-resident importer arrangement. Customs valuation is based on the DDP price minus duties (deductive method) — if the seller includes duty in the invoice price, it creates a circular valuation problem.
- **Valuation impact:** Under CIF/CIP, the customs value includes freight and insurance. Under FOB/FCA, the importing country may add freight to arrive at the transaction value (US adds ocean freight; EU does not). Getting this wrong changes the duty calculation.
- **Common misunderstandings:** Incoterms do not transfer title to goods — that is governed by the sale contract and applicable law. Incoterms do not apply to domestic-only transactions by default — they must be explicitly invoked. Using FOB for containerised ocean freight is technically incorrect (FCA is preferred) because risk transfers at the ship's rail under FOB but at the container yard under FCA.

### Duty Optimisation

**FTA Utilisation:** Every preferential trade agreement has specific rules of origin that goods must satisfy. USMCA requires product-specific rules (Annex 4-B) including tariff shift, regional value content (RVC), and net cost methods. EU-UK TCA uses "wholly obtained" and "sufficient processing" rules with product-specific list rules in Annex ORIG-2. RCEP has uniform rules for 15 Asia-Pacific nations with cumulation provisions. AfCFTA allows 60% cumulation across member states.

**RVC calculation matters:** USMCA offers two methods — transaction value (TV) method: RVC = ((TV - VNM) / TV) × 100, and net cost (NC) method: RVC = ((NC - VNM) / NC) × 100. The net cost method excludes sales promotion, royalties, and shipping costs from the denominator, often yielding a higher RVC when margins are thin.

**Foreign Trade Zones (FTZs):** Goods admitted to an FTZ are not in US customs territory. Benefits: duty deferral until goods enter commerce, inverted tariff relief (pay duty on the finished product rate if lower than component rates), no duty on waste/scrap, no duty on re-exports. Zone-to-zone transfers maintain privileged foreign status.

**Temporary Import Bonds (TIBs):** ATA Carnet for professional equipment, samples, exhibition goods — duty-free entry into 78+ countries. US temporary importation under bond (TIB) per 19 USC § 1202, Chapter 98 — goods must be exported within 1 year (extendable to 3 years). Failure to export triggers liquidation at full duty plus bond premium.

**Duty Drawback:** Refund of 99% of duties paid on imported goods that are subsequently exported. Three types: manufacturing drawback (imported materials used in US-manufactured exports), unused merchandise drawback (imported goods exported in same condition), and substitution drawback (commercially interchangeable goods). Claims must be filed within 5 years of import. TFTEA simplified drawback significantly — no longer requires matching specific import entries to specific export entries for substitution claims.

### Restricted Party Screening

**Mandatory lists (US):** SDN (OFAC — Specially Designated Nationals), Entity List (BIS — export control), Denied Persons List (BIS — export privilege denied), Unverified List (BIS — cannot verify end use), Military End User List (BIS), Non-SDN Menu-Based Sanctions (OFAC). Screening must cover all parties in the transaction: buyer, seller, consignee, end user, freight forwarder, banks, and intermediate consignees.

**EU/UK lists:** EU Consolidated Sanctions List, UK OFSI Consolidated List, UK Export Control Joint Unit.

**Red flags triggering enhanced due diligence:** Customer reluctant to provide end-use information. Unusual routing (high-value goods through free ports). Customer willing to pay cash for expensive items. Delivery to a freight forwarder or trading company with no clear end user. Product capabilities exceed the stated application. Customer has no business background in the product type. Order patterns inconsistent with customer's business.

**False positive management:** ~95% of screening hits are false positives. Adjudication requires: exact name match vs partial match, address correlation, date of birth (for individuals), country nexus, alias analysis. Document the adjudication rationale for every hit — regulators will ask during audits.

### Regional Specialties

**US CBP:** Centers of Excellence and Expertise (CEEs) specialise by industry. Trusted Trader programmes: C-TPAT (security) and Trusted Trader (combining C-TPAT + ISA). ACE is the single window for all import/export data. Focused Assessment audits target specific compliance areas — prior disclosure before an FA starts is critical.

**EU Customs Union:** Common External Tariff (CET) applies uniformly. Authorised Economic Operator (AEO) provides AEOC (customs simplifications) and AEOS (security). Binding Tariff Information (BTI) provides classification certainty for 3 years. Union Customs Code (UCC) governs since 2016.

**UK post-Brexit:** UK Global Tariff replaced the CET. Northern Ireland Protocol / Windsor Framework creates dual-status goods. UK Customs Declaration Service (CDS) replaced CHIEF. UK-EU TCA requires Rules of Origin compliance for zero-tariff treatment — "originating" requires either wholly obtained in the UK/EU or sufficient processing.

**China:** CCC (China Compulsory Certification) required for listed product categories before import. China uses 13-digit HS codes. Cross-border e-commerce has distinct clearance channels (9610, 9710, 9810 trade modes). Recent Unreliable Entity List creates new screening obligations.

### Penalties and Compliance

**US penalty framework under 19 USC § 1592:**

- **Negligence:** 2× unpaid duties or 20% of dutiable value for first violation. Reduced to 1× or 10% with mitigation. Most common assessment.
- **Gross negligence:** 4× unpaid duties or 40% of dutiable value. Harder to mitigate — requires showing systemic compliance measures.
- **Fraud:** Full domestic value of the merchandise. Criminal referral possible. No mitigation without extraordinary cooperation.

**Prior disclosure (19 CFR § 162.74):** Filing a prior disclosure before CBP initiates an investigation caps penalties at interest on unpaid duties for negligence, 1× duties for gross negligence. This is the single most powerful tool in penalty mitigation. Requirements: identify the violation, provide correct information, tender the unpaid duties. Must be filed before CBP issues a pre-penalty notice or commences a formal investigation.

**Record-keeping:** 19 USC § 1508 requires 5-year retention of all entry records. EU requires 3 years (some member states require 10). Failure to produce records during an audit creates an adverse inference — CBP can reconstruct value/classification unfavourably.

## Decision Frameworks

### Classification Decision Logic

When classifying a product, follow this sequence without shortcuts. See [decision-frameworks.md](references/decision-frameworks.md) for full decision trees.

1. **Identify the good precisely.** Get the full technical specification — material composition, function, dimensions, and intended use. Never classify from a product name alone.
2. **Determine the Section and Chapter.** Use the Section and Chapter notes to confirm or exclude. Chapter notes override heading text.
3. **Apply GRI 1.** Read the heading terms literally. If only one heading covers the good, classification is decided.
4. **If GRI 1 produces multiple candidate headings,** apply GRI 2 then GRI 3 in sequence. For composite goods, determine essential character by function, value, bulk, or the factor most relevant to the specific good.
5. **Validate at the subheading level.** Apply GRI 6. Check subheading notes. Confirm the national tariff line (8/10-digit) aligns with the 6-digit determination.
6. **Check for binding rulings.** Search CBP CROSS database, EU BTI database, or WCO classification opinions for the same or analogous products. Existing rulings are persuasive even if not directly binding.
7. **Document the rationale.** Record the GRI applied, headings considered and rejected, and the determining factor. This documentation is your defence in an audit.

### FTA Qualification Analysis

1. **Identify applicable FTAs** based on origin and destination countries.
2. **Determine the product-specific rule of origin.** Look up the HS heading in the relevant FTA's annex. Rules vary by product — some require tariff shift, some require minimum RVC, some require both.
3. **Trace all non-originating materials** through the bill of materials. Each input must be classified to determine whether a tariff shift has occurred.
4. **Calculate RVC if required.** Choose the method that yields the most favourable result (where the FTA offers a choice). Verify all cost data with the supplier.
5. **Apply cumulation rules.** USMCA allows accumulation across the US, Mexico, and Canada. EU-UK TCA allows bilateral cumulation. RCEP allows diagonal cumulation among all 15 parties.
6. **Prepare the certification.** USMCA certifications must include nine prescribed data elements. EUR.1 requires Chamber of Commerce or customs authority endorsement. Retain supporting documentation for 5 years (USMCA) or 4 years (EU).

### Valuation Method Selection

Customs valuation follows the WTO Agreement on Customs Valuation (based on GATT Article VII). Methods are applied in hierarchical order — you only proceed to the next method when the prior method cannot be applied:

1. **Transaction Value (Method 1):** The price actually paid or payable, adjusted for additions (assists, royalties, commissions, packing) and deductions (post-importation costs, duties). This is used for ~90% of entries. Fails when: related-party transaction where the relationship influenced the price, no sale (consignment, leases, free goods), or conditional sale with unquantifiable conditions.
2. **Transaction Value of Identical Goods (Method 2):** Same goods, same country of origin, same commercial level. Rarely available because "identical" is strictly defined.
3. **Transaction Value of Similar Goods (Method 3):** Commercially interchangeable goods. Broader than Method 2 but still requires same country of origin.
4. **Deductive Value (Method 4):** Start from the resale price in the importing country, deduct: profit margin, transport, duties, and any post-importation processing costs.
5. **Computed Value (Method 5):** Build up from: cost of materials, fabrication, profit, and general expenses in the country of export. Only available if the exporter cooperates with cost data.
6. **Fallback Method (Method 6):** Flexible application of Methods 1-5 with reasonable adjustments. Cannot be based on arbitrary values, minimum values, or the price of goods in the domestic market of the exporting country.

### Screening Hit Assessment

When a restricted party screening tool returns a match, do not block the transaction automatically or clear it without investigation. Follow this protocol:

1. **Assess match quality:** Name match percentage, address correlation, country nexus, alias analysis, date of birth (individuals). Matches below 85% name similarity with no address or country correlation are likely false positives — document and clear.
2. **Verify entity identity:** Cross-reference against company registrations, D&B numbers, website verification, and prior transaction history. A legitimate customer with years of clean transaction history and a partial name match to an SDN entry is almost certainly a false positive.
3. **Check list specifics:** SDN hits require OFAC licence to proceed. Entity List hits require BIS licence with a presumption of denial. Denied Persons List hits are absolute prohibitions — no licence available.
4. **Escalate true positives and ambiguous cases** to compliance counsel immediately. Never proceed with a transaction while a screening hit is unresolved.
5. **Document everything.** Record the screening tool used, date, match details, adjudication rationale, and disposition. Retain for 5 years minimum.

## Key Edge Cases

These are situations where the obvious approach is wrong. Brief summaries here — see [edge-cases.md](references/edge-cases.md) for full analysis.

1. **De minimis threshold exploitation:** A supplier restructures shipments to stay below the $800 US de minimis threshold to avoid duties. Multiple shipments on the same day to the same consignee may be aggregated by CBP. Section 321 entry does not eliminate quota, AD/CVD, or PGA requirements — it only waives duty.

2. **Transshipment circumventing AD/CVD orders:** Goods manufactured in China but routed through Vietnam with minimal processing to claim Vietnamese origin. CBP uses evasion investigations (EAPA) with subpoena power. The "substantial transformation" test requires a new article of commerce with a different name, character, and use.

3. **Dual-use goods at the EAR/ITAR boundary:** A component with both commercial and military applications. ITAR controls based on the item, EAR controls based on the item plus the end use and end user. Commodity jurisdiction determination (CJ request) required when classification is ambiguous. Filing under the wrong regime is a violation of both.

4. **Post-importation adjustments:** Transfer pricing adjustments between related parties after the entry is liquidated. CBP requires reconciliation entries (CF 7501 with reconciliation flag) when the final price is not known at entry. Failure to reconcile creates duty exposure on the unpaid difference plus penalties.

5. **First sale valuation for related parties:** Using the price paid by the middleman (first sale) rather than the price paid by the importer (last sale) as the customs value. CBP allows this under the "first sale rule" (Nissho Iwai) but requires demonstrating the first sale is a bona fide arm's-length transaction. The EU and most other jurisdictions do not recognise first sale — they value on the last sale before importation.

6. **Retroactive FTA claims:** Discovering 18 months post-importation that goods qualified for preferential treatment. US allows post-importation claims via PSC (Post Summary Correction) within the liquidation period. EU requires the certificate of origin to have been valid at the time of importation. Timing and documentation requirements differ by FTA and jurisdiction.

7. **Classification of kits vs components:** A retail kit containing items from different HS chapters (e.g., a camping kit with a tent, stove, and utensils). GRI 3(b) classifies by essential character — but if no single component gives essential character, GRI 3(c) applies (last heading in numerical order). Kits "put up for retail sale" have specific rules under GRI 3(b) that differ from industrial assortments.

8. **Temporary imports that become permanent:** Equipment imported under an ATA Carnet or TIB that the importer decides to keep. The carnet/bond must be discharged by paying full duty plus any penalties. If the temporary import period has expired without export or duty payment, the carnet guarantee is called, creating liability for the guaranteeing chamber of commerce.

## Communication Patterns

### Tone Calibration

Match communication tone to the counterparty, regulatory context, and risk level:

- **Customs broker (routine):** Collaborative and precise. Provide complete documentation, flag unusual items, confirm classification up front. "HS 8471.30 confirmed — our GRI 1 analysis and the 2019 CBP ruling HQ H298456 support this classification. Packed 3 of 4 required docs, C/O follows by EOD."
- **Customs broker (urgent hold/exam):** Direct, factual, time-sensitive. "Shipment held at LA/LB — CBP requesting manufacturer documentation. Sending MID verification and production records now. Need your filing within 2 hours to avoid demurrage."
- **Regulatory authority (ruling request):** Formal, thoroughly documented, legally precise. Follow the agency's prescribed format exactly. Provide samples if requested. Never overstate certainty — use "it is our position that" rather than "this product is classified as."
- **Regulatory authority (penalty response):** Measured, cooperative, factual. Acknowledge the error if it exists. Present mitigation factors systematically. Never admit fraud when the facts support negligence.
- **Internal compliance advisory:** Clear business impact, specific action items, deadline. Translate regulatory requirements into operational language. "Effective March 1, all lithium battery imports require UN 38.3 test summaries at entry. Operations must collect these from suppliers before booking. Non-compliance: $10K+ per shipment in fines and cargo holds."
- **Supplier questionnaire:** Specific, structured, explain why you need the information. Suppliers who understand the duty savings from an FTA are more cooperative with origin data.

### Key Templates

Brief templates below. Full versions with variables in [communication-templates.md](references/communication-templates.md).

**Customs broker instructions:** Subject: `Entry Instructions — {PO/shipment_ref} — {origin} to {destination}`. Include: classification with GRI rationale, declared value with Incoterms, FTA claim with supporting documentation reference, any PGA requirements (FDA prior notice, EPA TSCA certification, FCC declaration).

**Prior disclosure filing:** Must be addressed to the CBP port director or Fines, Penalties and Forfeitures office with jurisdiction. Include: entry numbers, dates, specific violations, correct information, duty owed, and tender of the unpaid amount.

**Internal compliance alert:** Subject: `COMPLIANCE ACTION REQUIRED: {topic} — Effective {date}`. Lead with the business impact, then the regulatory basis, then the required action, then the deadline and consequences of non-compliance.

## Escalation Protocols

### Automatic Escalation Triggers

| Trigger                                         | Action                                                    | Timeline          |
| ----------------------------------------------- | --------------------------------------------------------- | ----------------- |
| CBP detention or seizure                        | Notify VP and legal counsel                               | Within 1 hour     |
| Restricted party screening true positive        | Halt transaction, notify compliance officer and legal     | Immediately       |
| Potential penalty exposure > $50,000            | Notify VP Trade Compliance and General Counsel            | Within 2 hours    |
| Customs examination with discrepancy found      | Assign dedicated specialist, notify broker                | Within 4 hours    |
| Denied party / SDN match confirmed              | Full stop on all transactions with the entity globally    | Immediately       |
| AD/CVD evasion investigation received           | Retain outside trade counsel                              | Within 24 hours   |
| FTA origin audit from foreign customs authority | Notify all affected suppliers, begin documentation review | Within 48 hours   |
| Voluntary self-disclosure decision              | Legal counsel approval required before filing             | Before submission |

### Escalation Chain

Level 1 (Analyst) → Level 2 (Trade Compliance Manager, 4 hours) → Level 3 (Director of Compliance, 24 hours) → Level 4 (VP Trade Compliance, 48 hours) → Level 5 (General Counsel / C-suite, immediate for seizures, SDN matches, or penalty exposure > $100K)

## Performance Indicators

Track these metrics monthly and trend quarterly:

| Metric                                       | Target       | Red Flag                       |
| -------------------------------------------- | ------------ | ------------------------------ |
| Classification accuracy (post-audit)         | > 98%        | < 95%                          |
| FTA utilisation rate (eligible shipments)    | > 90%        | < 70%                          |
| Entry rejection rate                         | < 2%         | > 5%                           |
| Prior disclosure frequency                   | < 2 per year | > 4 per year                   |
| Screening false positive adjudication time   | < 4 hours    | > 24 hours                     |
| Duty savings captured (FTA + FTZ + drawback) | Track trend  | Declining quarter-over-quarter |
| CBP examination rate                         | < 3%         | > 7%                           |
| Penalty exposure (annual)                    | $0           | Any material penalty assessed  |

## Additional Resources

- For detailed decision frameworks, classification logic, and valuation methodology, see [decision-frameworks.md](references/decision-frameworks.md)
- For the comprehensive edge case library with full analysis, see [edge-cases.md](references/edge-cases.md)
- For complete communication templates with variables and formatting guidance, see [communication-templates.md](references/communication-templates.md)

### When to Use
Use this skill when you are **planning, auditing, or remediating customs and trade compliance processes**:

- Classifying products (HS/HTS/TARIC), designing documentation flows, or implementing Incoterms for new trade lanes.
- Evaluating or optimising duty exposure via FTAs, FTZs, drawback, valuation, or Incoterms changes.
- Investigating compliance risk, penalty exposure, or restricted‑party screening issues across import/export operations.

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: cv-generator
description: "Generate professional, ATS-optimized CVs for FlowCV, Canva, Google Docs, or Word. Handles multi-source merging, JD targeting, seniority adaptation, and humanized rewriting. Outputs paste-ready text with an ATS flaw report and improvement suggestions."
category: content
risk: safe
source: community
date_added: "2026-06-06"
author: "WHOISABHISHEKADHIKARI"
user-invokable: true
tags:
  - cv
  - resume
  - ats
  - career
  - job-application
  - career-change
---

# CV Generator Skill — FlowCV / Canva Edition

## When to Use

Use this skill when you need to:
- Generate a professional, ATS-optimized CV from multiple sources (LinkedIn, GitHub, Portfolio).
- Tailor an existing CV for a specific Job Description (JD).
- Improve the language, metrics, and structure of a draft resume.
- Prepare a paste-ready version of your CV for tools like FlowCV or Canva.

Turns raw profile data into a polished, ATS-ready CV. Outputs a paste-ready plain-text
version formatted for FlowCV, Canva, Google Docs, or Word — with a flaw report and
missing-info checklist.

---

## FLAW REGISTER — KNOWN ISSUES FIXED IN THIS VERSION

The following issues were identified across the two prior skill drafts and are corrected here:

| # | Flaw | Fix applied |
|---|------|-------------|
| F-01 | Output was Markdown-first, not paste-ready plain text | Final output is plain text; Markdown is internal staging only |
| F-02 | FlowCV/Canva field structure was never addressed | Section mapping to tool fields added (section 11c) |
| F-03 | Questionnaire dumped all 20 questions at once in practice | Hard rule: one question at a time, wait for answer |
| F-04 | Anti-hallucination rules listed but never enforced structurally | Enforcement gate added before every output (section 10) |
| F-05 | Cover letter was offered but never scoped for these tools | Cover letter now outputs to a separate plain-text block, not inline |
| F-06 | ATS check listed but had no scored output | Flaw report now scores 0–100 with per-item pass/fail |
| F-07 | Seniority detection was "detect or ask" with no fallback | Default is mid-level if undetectable; user is told the assumption |
| F-08 | No guidance on what FlowCV/Canva cannot render | Added explicit field-by-field paste map (section 11c) |
| F-09 | Tense rules stated but never verified in quality gate | Tense check is now a hard gate — output blocked until corrected |
| F-10 | "Passionate about" and similar banned phrases still appeared in examples | Phrase blocklist now machine-checkable (section 7c) |
| F-11 | Nepal/South Asia market conventions were present but incomplete | Confirmed and expanded (section 14) |
| F-12 | No explicit rule on what to do when LinkedIn scraping is blocked | Hard fallback rule: ask for PDF export immediately, do not proceed empty |
| F-13 | File naming convention mentioned once, never enforced | File name rule is part of the final output block (section 11) |
| F-14 | Skill had no version history or upgrade path | Version field added to frontmatter |
| F-15 | GitHub was listed as a source but extraction rules were missing | GitHub extraction rules added (section 4f) |

---

## 1. Invocation

```
Use @cv-generator to build my CV from my LinkedIn PDF.
Use @cv-generator to tailor my CV for this job description.
Use @cv-generator to improve my existing draft.
Use @cv-generator to create a fresh CV via questionnaire.
Use @cv-generator — I want a FlowCV-ready output.
```

Any combination of sources is valid. Multiple sources are merged and deduplicated
before writing begins.

---

## Source Selection

Ask the user which source(s) to use. At least one is required.
If no source is provided, default immediately to the questionnaire (section 4d).

| # | Source | Instruction |
|---|--------|-------------|
| 1 | LinkedIn profile URL | Fetch page; extract all visible sections. **If blocked or empty: immediately ask for a LinkedIn PDF — do not proceed on an empty extraction.** |
| 2 | LinkedIn PDF export | Parse uploaded file. If scanned image: apply OCR and warn the user to verify accuracy. |
| 3 | Portfolio / personal website | Fetch URL; extract About, Projects, Skills, Services, Testimonials, Case Studies, Contact. |
| 4 | Questionnaire | Step-by-step (section 4d). One question at a time. |
| 5 | Existing CV or draft | Upload or paste; improve only — never alter facts. |
| 6 | GitHub profile | Extract pinned repos, bio, tech stack, contribution summary (section 4f). |
| 7 | Resume file (DOCX / PDF / TXT) | Parse and rewrite. Flag scanned PDFs; apply OCR. |

---

## Purpose, seniority, and format

### Purpose

Ask after source selection:

> "What is the main purpose of this CV?"

| Purpose | Key adaptation |
|---------|----------------|
| Applying for a specific job | Full JD analysis + keyword targeting (section 9) |
| General professional CV | Balanced, role-agnostic, reverse-chronological |
| Internship / entry-level | Education and projects lead; transferable skills foregrounded |
| Academic / research | Publications, grants, teaching, research interests |
| Freelance / client proposal | Deliverables, outcomes, services |
| Career change | Functional or hybrid; transferable skills reframed |
| Executive / board-level | Executive summary, board positions, P&L scope |
| Military-to-civilian | Translate ranks and jargon to civilian equivalents |
| Return to work / career break | Frame gap positively; emphasise upskilling |
| Other | Ask the user to describe the goal in one sentence |

### Seniority

Detect from data. If undetectable, **default to mid-level and tell the user:**
> "I've assumed mid-level (3–8 years). Let me know if this should be different."

| Level | Years | CV emphasis |
|-------|-------|-------------|
| Student / fresh graduate | 0–1 | Education first; projects; extracurriculars; 1 page |
| Junior / entry | 1–3 | Skills + education prominent; 1 page |
| Mid-level | 3–8 | Experience leads; achievements over duties; 1–2 pages |
| Senior | 8–15 | Leadership, scope, impact, mentoring; 2 pages |
| Executive / C-suite | 15+ | Strategic narrative; board roles; P&L; 2–3 pages |
| Academic | Any | No page limit; publications; grants; teaching |

### Format

| Format | Use when |
|--------|----------|
| Chronological (default) | Clear career progression; most job applications |
| Functional / skills-first | Career changers; large gaps; military-to-civilian |
| Hybrid / combination | Senior professionals rebranding; career changers with strong experience |
| Academic CV | University, research, PhDs, postdocs |
| Executive / Board bio | C-suite, NED, advisory |
| Portfolio-led | Designers, architects, creatives |

---

## Data extraction rules

### LinkedIn URL

If the page is blocked or returns no content, **stop immediately** and ask:
> "LinkedIn blocked the fetch. Please export your LinkedIn profile as a PDF
> (LinkedIn → Me → Settings → Data Privacy → Get a copy of your data) and upload it."

If accessible, extract in order:
1. Full name and headline
2. Contact information (email, phone, location — public only)
3. About / Professional Summary
4. Work experience: title, company, location, dates, bullets
5. Education: degree, institution, dates, grade/honours
6. Skills (flag top endorsed skills)
7. Certifications and licences
8. Projects
9. Achievements, honours, awards
10. Volunteer experience
11. Languages and proficiency
12. Publications, patents, courses

### LinkedIn PDF

Hard rules:
- Extract only what is physically present in the document.
- Preserve all dates exactly as written.
- If a section is absent, mark it **[Not provided]** — do not skip silently.
- Do not merge bullets across different roles.
- If scanned: apply OCR and display this warning before continuing:
  > "OCR was used to read this document. Please review the extracted text below
  > for accuracy before we continue."

### Portfolio / personal website

Extract:
- About / bio → Professional Summary
- Projects: name, description, technologies, outcomes, live/repo URLs
- Skills and services
- Testimonials or client logos → Achievements
- Case studies → 2–4 bullets each
- Blog posts or articles → Publications / Thought Leadership
- Contact details

### Questionnaire

**One question at a time. Wait for the answer before continuing.**
Do not display the full list unless the user explicitly asks for a form.

```
Q1.  Full legal name (as it should appear on the CV)
Q2.  Target job title or role
Q3.  Email address
Q4.  Phone number including country code (optional but recommended)
Q5.  City and country of residence
Q6.  LinkedIn URL (optional)
Q7.  Portfolio, GitHub, or personal website URL (optional)
Q8.  Professional summary — describe yourself in 2–3 sentences (will be rewritten)
Q9.  Work experience — for EACH role:
       - Job title
       - Company name and industry
       - Employment type (full-time / part-time / contract / freelance / internship)
       - Location or Remote
       - Start and end date (or "Present")
       - 3–6 key responsibilities and achievements
       - Any measurable results (numbers, %, revenue, team size, budget)
Q10. Education — for EACH qualification:
       - Degree or certificate name
       - Institution name and country
       - Start and graduation year
       - Grade, GPA, or classification if notable
       - Thesis or relevant modules (optional; for academic/entry-level only)
Q11. Technical and professional skills
       (ask to separate: Expert / Proficient / Familiar)
Q12. Projects — for each:
       - Name
       - Purpose
       - Your specific role
       - Technologies or methods used
       - Outcome or impact
Q13. Certifications (name, issuing body, date, expiry if applicable)
Q14. Achievements, awards, or recognitions
Q15. Languages and proficiency: Native / Fluent / Professional / Conversational / Basic
Q16. Volunteer or open-source work (optional)
Q17. Publications, speaking engagements, press mentions (optional)
Q18. Preferred CV format: chronological / functional / hybrid / academic / executive
Q19. Target country or job market
Q20. Any employment gaps? Dates and brief reason — will be framed constructively.
```

### Existing CV or draft

Rules:
- Preserve every fact: titles, companies, dates, institutions, grades.
- Rewrite weak or passive bullets with strong action verbs.
- Remove repetition across roles.
- Correct grammar, punctuation, spelling.
- Fix tense: past for completed roles, present for current role.
- Replace all banned phrases (section 7c).
- Improve ATS keyword density where natural — do not keyword-stuff.
- Restructure section order if it does not match target market or seniority.
- **Do not add experience, qualifications, metrics, or skills not present in the original.**

### GitHub profile

Extract:
- Bio / tagline → supplement Professional Summary
- Pinned repositories: name, description, tech stack, stars/forks
- Contribution activity (years active, languages used)
- README content for context on major projects
- Do not infer seniority from commit count alone

### Employment gaps and special situations

**Gap under 3 months:** no special treatment.

**Gap 3–12 months:** one-line entry:
> "Career break — [brief honest reason: personal development / caregiving / travel / health]"

**Gap over 12 months:** add a neutral framing entry in the experience section;
highlight any upskilling, freelance, volunteering, or relevant activity during the gap.
Never fabricate activity.

**Contract / freelance / part-time:** label employment type clearly. Group multiple
short contracts under one umbrella entry (e.g. "Freelance Consultant") if they share
a skill area.

**Concurrent roles:** list both with accurate overlapping dates; add "(concurrent with
[other role])" if helpful.

**Early or irrelevant roles (> 10 years):** condense to one line for senior professionals
unless directly relevant to the target role.

**Fresh graduate:** lead with Education → Projects → Skills → Internships.
Use academic projects as proof of practical skills.

**Military-to-civilian:** translate all ranks and jargon to civilian equivalents;
quantify command scope (e.g. "Managed 35 personnel and $2M in equipment").

**Non-English source:** translate accurately; preserve institution and company names
in the original language with an English translation in parentheses on first use;
advise the user to have the translation reviewed by a native speaker.

---

## Multi-source merging

1. Build a master profile combining all extracted data.
2. Deduplicate: keep the most detailed version of each entry.
3. If two sources conflict on a date or title, flag it and ask the user to confirm.
4. Identify gaps; ask follow-up questions only for critical missing data.
5. Never fabricate a detail — mark it **[Not provided]** until the user confirms.

---

## CV section order

### Chronological (default — mid / senior)
```
1.  Full Name
2.  Contact Information (email | phone | LinkedIn | portfolio | city, country)
3.  Professional Summary
4.  Core Skills
5.  Work Experience (reverse chronological)
6.  Education (reverse chronological)
7.  Certifications and Licences
8.  Projects
9.  Technical Skills (grouped: Languages | Frameworks | Tools | Platforms)
10. Achievements and Awards
11. Volunteer Experience
12. Publications / Speaking
13. Languages
14. Additional Information
```

### Fresh graduate / student
```
1.  Full Name + Contact Information
2.  Professional Summary / Objective
3.  Education
4.  Projects and Coursework
5.  Skills
6.  Work Experience / Internships
7.  Certifications
8.  Extracurricular / Volunteer
9.  Languages
```

### Functional / skills-first (career changers, large gaps)
```
1.  Full Name + Contact Information
2.  Professional Summary
3.  Core Competencies / Skills
4.  Key Achievements
5.  Work History (company, title, dates — minimal bullets)
6.  Education
7.  Certifications
8.  Languages
```

### Academic CV
```
1.  Full Name + Contact + ORCID / ResearchGate
2.  Research Interests
3.  Education
4.  Academic Positions
5.  Publications
6.  Grants and Funding
7.  Teaching Experience
8.  Supervision
9.  Awards and Honours
10. Conference Presentations
11. Professional Memberships
12. Skills
13. References
```

### Executive / Board
```
1.  Full Name + Contact Information
2.  Executive Summary
3.  Core Competencies
4.  Board and Advisory Roles
5.  Executive Experience
6.  Education and Qualifications
7.  Publications / Media / Speaking
8.  Professional Memberships
```

---

## Writing rules

### Professional Summary

Write 3–5 sentences (executive: 5–7) covering:
1. Who the person is: job title + years of experience
2. Primary domain of expertise
3. One concrete differentiator or standout achievement
4. Value proposition aligned to the target role

- Do not open with "I am".
- Do not open with any banned phrase (section 7c).
- Base strictly on data collected — no padding.

Good example:
> "Software engineer with seven years building distributed systems at scale.
> Deep expertise in Go and Kubernetes, with a track record of cutting infrastructure
> costs 30–40% through cloud-native redesigns. Seeking a staff-level role where
> systems reliability and platform engineering intersect."

### Experience bullets — STAR-lite

Pattern: `[Strong verb] + [what you did] + [scale/scope] + [outcome if available]`

Rules:
- 3–6 bullets per role (2–3 for short-tenure or early roles)
- Past tense for completed roles; present tense for current role
- 15–30 words per bullet
- Different verb to open each bullet — never repeat within one role
- If no metric was provided: write a result-focused statement without inventing numbers
- Never fabricate metrics — if the user says "we grew a lot", ask for specifics

Action verb bank:

```
Leadership:    Led, Directed, Managed, Supervised, Mentored, Coached, Championed
Building:      Built, Developed, Engineered, Architected, Designed, Implemented, Launched, Shipped
Improvement:   Reduced, Improved, Optimised, Streamlined, Accelerated, Automated, Consolidated
Analysis:      Analysed, Researched, Evaluated, Identified, Diagnosed, Assessed, Mapped
Communication: Presented, Authored, Documented, Trained, Negotiated, Advised, Collaborated
Growth:        Grew, Expanded, Scaled, Generated, Increased, Secured, Delivered
Strategy:      Defined, Established, Prioritised, Planned, Coordinated, Oversaw, Aligned
```

Rewrites:
```
BEFORE: "Responsible for managing the team"
AFTER:  "Managed a cross-functional team of 8 engineers, delivering the product roadmap
         on schedule for three consecutive quarters"

BEFORE: "Helped with developing new features"
AFTER:  "Developed four customer-facing features in React, reducing support tickets by 25%"

BEFORE: "Was involved in the migration project"
AFTER:  "Led migration from monolith to microservices, cutting deployment time from
         45 minutes to under 4 minutes"
```

### Banned phrases — machine-checkable blocklist

Before output, scan the full CV text and **reject any bullet or sentence containing**
any of the following strings (case-insensitive):

```
results-driven
dynamic individual
highly motivated
team player
proven track record
passionate about
passionate professional
detail-oriented
self-starter
hard worker
strong communication skills
excellent communication
synergy
leverage (when used as a verb meaning "use")
paradigm shift
thought leader
go-getter
innovative thinker
outside the box
people person
visionary
change agent
```

If found: rewrite the sentence to show the specific evidence instead.

### Tense enforcement

This is a hard gate — output is blocked until tense is correct:

- **Completed role** → all bullets in past tense (Led, Built, Reduced...)
- **Current role** → all bullets in present tense (Lead, Build, Reduce...)
- **Mixed tense within one role** → always fail; fix before output

### Acronym and terminology

- Spell out on first use: "Machine Learning (ML)"; use abbreviation thereafter.
- Consistent capitalisation throughout: "JavaScript" not "Javascript".
- Mirror exact JD phrasing where applicable.
- Include both full form and abbreviation for searchability.

---

## ATS optimisation

### Structural rules

| Rule | Why it matters |
|------|----------------|
| Name must be the very first line of the body | Parsers read top-to-bottom; name in header/footer is often missed |
| Contact info in body, not in header or footer | Header/footer text is invisible to Taleo, Workday, iCIMS |
| Single-column layout only | Two-column layouts break ATS text extraction order |
| No tables for layout | Table cells are read in unpredictable order |
| No text boxes, shapes, or SmartArt | Text inside shapes is invisible to ATS |
| No images or photos (unless market requires it) | Images are ignored; photos risk bias filtering |
| No icons in bullets or headings | Symbols like ➤ ✓ ★ corrupt parsed text |
| Bullet characters: hyphen (-) or plain dot (•) only | Safe across all ATS platforms |
| Standard section headings only | Non-standard headings cause misclassification |
| No "Objective" heading | Flags CV as outdated; use "Professional Summary" |
| Font: minimum 10pt body, 12–14pt headings | Smaller text garbles in PDF-to-text conversion |
| Margins: minimum 0.5 in / 1.27 cm all sides | Narrow margins cause line-wrapping errors |
| Spell out all URLs fully | Anchor text loses URL when ATS strips formatting |
| File format: .docx preferred for ATS; PDF for email | DOCX parses more accurately in most ATS |
| File name: FirstName_LastName_CV.docx | Generic names ("resume.pdf") get buried in recruiter files |

### Keyword strategy

1. Extract top 10–20 keywords from the JD (if provided).
2. Categorise: hard skills | soft skills | qualifications | industry terms.
3. For each keyword, record:
   - Present and prominent
   - Present but weak or buried → strengthen placement
   - Absent but user has the skill → weave in naturally
   - Absent and user lacks the skill → do not add
4. Target keyword density: 2–4 natural occurrences per hard skill across the full CV.
5. Include both spelled-out form and abbreviation for key terms.
6. Mirror exact JD phrasing for shared responsibilities.

### ATS platform quick notes

| Platform | Key quirk |
|----------|-----------|
| Workday | DOCX preferred; complex PDF tables fail |
| Taleo | Strictest; no special characters; plain text preferred |
| Greenhouse | Lenient; weights keyword frequency |
| Lever | Modern parser; handles most formats |
| iCIMS | DOCX preferred; strips header/footer text |
| SmartRecruiters | Handles DOCX and PDF; relatively lenient |

Default when platform is unknown: apply Taleo-level strictness.

---

## Job description integration

When a JD is provided, run four steps:

**Step 1 — Parse:**
- Job title and seniority signals
- Required vs preferred qualifications
- Hard skills: tools, languages, platforms, methodologies
- Soft skills and collaboration patterns
- Industry terminology
- Responsibility verb phrases (mirror these in bullets)

**Step 2 — Score:**
For each of the top 15 keywords, mark: present and prominent / present but weak /
absent.

**Step 3 — Integrate:**
- Strengthen weak keyword placements.
- Weave in missing keywords the user genuinely has experience with.
- Never add a keyword the user cannot truthfully claim.

**Step 4 — Report (include at end of output):**
```
JD KEYWORD MATCH REPORT
Total JD keywords identified: 18
Matched in CV: 14 (78%)
Added naturally during generation: 3
Not added (user lacks skill): 1 — Salesforce
Recommendation: even limited Salesforce exposure is worth noting if any exists
```

---

## Anti-hallucination enforcement gate

Before any output is produced, confirm every item in the CV passes this check.
**Output is blocked until all items pass.**

| Item | Rule |
|------|------|
| Job titles | Sourced directly from user data — not inferred or upgraded |
| Company names | Sourced directly — not corrected, normalised, or embellished |
| Dates | Reproduced exactly as provided — no normalisation without noting it |
| Degrees and institutions | Reproduced exactly as provided |
| Certifications | Only those explicitly named by the user |
| Metrics and numbers | Only those provided by the user — never approximated or invented |
| Awards and achievements | Only those named by the user |
| Skills and tools | Only those provided or clearly evidenced in source data |
| Projects | Only those named by the user |

If any item cannot be verified: mark it **[Not provided]** and include it in the
missing information checklist (section 11d). Never fill gaps silently.

---

## Final output — deliver in this exact order

### Formatted CV (staging draft)

Clean plain-text draft with clear section labels. Used as the working version
before generating the tool-specific paste copies below.

### FlowCV paste-ready version

FlowCV uses structured text fields, not free-form documents. Format accordingly:

```
FULL NAME
[First name] [Last name]

PROFESSIONAL TITLE
[Target job title]

CONTACT
Email: [email]
Phone: [+country code number]
Location: [City, Country]
LinkedIn: [full URL]
Portfolio: [full URL if applicable]

PROFESSIONAL SUMMARY
[3–5 sentence plain paragraph — no bullets, no Markdown]

CORE SKILLS
[skill], [skill], [skill], [skill]
[skill], [skill], [skill], [skill]

WORK EXPERIENCE

[Job Title]
[Company Name] | [City, Country] | [Mon YYYY] – [Mon YYYY or Present]
[Employment type if not full-time: Contract / Freelance / Part-time]
- [Bullet one: action verb + context + outcome]
- [Bullet two]
- [Bullet three]

[Repeat for each role]

EDUCATION

[Degree Name]
[Institution Name], [Country] | [YYYY] – [YYYY]
[Grade or classification if notable]

[Repeat for each qualification]

CERTIFICATIONS
[Certificate Name] — [Issuing Body] — [Month YYYY]

PROJECTS

[Project Name]
[Technologies: tool, tool, tool]
- [What it does / your role / outcome]

ACHIEVEMENTS
- [Achievement one]
- [Achievement two]

VOLUNTEER EXPERIENCE
[Role] — [Organisation] — [YYYY–YYYY]
- [One-line description]

LANGUAGES
[Language]: [Native / Fluent / Professional / Conversational / Basic]

ADDITIONAL INFORMATION
[Anything else: open-source, interests relevant to role]
```

### Canva paste-ready version

Canva CV templates use individual text boxes per section. Provide each section as
a separate clearly labelled block, with no Markdown symbols.

```
--- PASTE INTO: Name field ---
[Full name]

--- PASTE INTO: Job title / headline field ---
[Target job title]

--- PASTE INTO: Contact block ---
[email] | [phone] | [city, country] | [LinkedIn URL]

--- PASTE INTO: Summary / About field ---
[3–5 sentence paragraph, plain text, no hyphens or bullets]

--- PASTE INTO: Skills field ---
[skill] | [skill] | [skill] | [skill] | [skill]

--- PASTE INTO: Experience entry 1 ---
[Job Title]
[Company] | [Location] | [Mon YYYY – Mon YYYY]
- [Bullet]
- [Bullet]
- [Bullet]

[Continue for each role as a separate block]

--- PASTE INTO: Education entry 1 ---
[Degree]
[Institution], [Country] | [YYYY – YYYY]
[Grade if notable]

--- PASTE INTO: Certifications ---
[Certificate] | [Issuer] | [YYYY]

--- PASTE INTO: Languages ---
[Language] ([Proficiency])
```

### Missing information checklist

```
MISSING INFORMATION
[ ] Phone number
[ ] LinkedIn URL
[ ] Portfolio or GitHub URL
[ ] Measurable results for [Role] at [Company]
[ ] Certifications — do you hold any?
[ ] Languages — list any beyond English
[ ] Employment gap [Mon YYYY – Mon YYYY] — add a brief framing note
[ ] [Any other flagged item]
```

### CV flaw report (scored 0–100)

Run all checks. Display a scored report:

```
CV FLAW REPORT
──────────────────────────────────────
Score: [X]/100

PASS  Truthfulness — all facts sourced from user data
PASS  No hallucination — no fabricated details
PASS  Tense correctness — past for completed, present for current
PASS  ATS structure — single column, no tables or images
PASS  Standard headings — all recognisable by parsers
PASS  No forbidden characters — no ➤ ✓ ★
PASS  Humanized — no banned phrases found
PASS  Contact info in body (not header/footer)
FAIL  [Check name] — [specific issue and location in CV]
──────────────────────────────────────
Deductions: -[N] per FAIL item
Final score: [X]/100

ISSUES TO FIX:
1. [Exact location] — [Exact problem] — [Suggested fix]
2. [Exact location] — [Exact problem] — [Suggested fix]
```

Score deductions: -10 per FAIL on truthfulness or hallucination;
-5 per FAIL on tense, ATS structure, or banned phrases;
-3 per FAIL on formatting issues.

### Improvement suggestions (3–7, specific and actionable)

- "Your summary does not state the target role. Open with your job title explicitly."
- "The [Company] role has no metrics. Even approximate scope (team size, users, budget range) strengthens credibility."
- "Skills section mixes expert and basic tools without distinction. Group into Proficient / Familiar."
- "Add a GitHub or portfolio URL — technical recruiters check it before the interview."
- "Three bullets begin with 'Responsible for' — replace with direct action verbs."
- "CV is [N] pages for [N] years of experience. Target is [N] pages; trim older roles to one line."

### Suggested file name

```
Suggested filename: [FirstName]_[LastName]_CV.docx
```

---

## Cover letter companion (optional)

After the CV output, offer:

> "Would you like a tailored cover letter for this application?"

If yes, output as a **separate clearly labelled plain-text block** — not inline with the CV.

Rules:
- Opens with a specific hook — not "I am writing to apply for…"
- References company and role by name
- Bridges 2–3 strongest CV points to the JD's key requirements
- Closes with a clear call to action
- Matches tone of the target industry
- 3 paragraphs maximum, 250–350 words
- Does not repeat the CV verbatim

---

## Limitations

- **No hallucination.** Never invent a title, company, date, degree, cert, skill, metric, or award.
- **No fake metrics.** If the user says "we grew a lot", ask for specifics — never insert a percentage.
- **Respect source truth.** "Junior Developer" stays "Junior Developer" — suggest a reframe if needed; never silently change it.
- **No silent changes.** If something is materially reworded, note the change.
- **One version at a time.** Complete the CV before offering variants.
- **Privacy.** Do not expose full home address, national ID, DOB, marital status, or religion unless the user's target market requires it.
- **No keyword stuffing.** Adding skills the user does not have is fraud. Flag gaps; never fabricate.
- **OCR warning.** Always display before continuing: "OCR was used — please verify the extracted text for accuracy."

---

## Country and market conventions

| Market | Length | Photo | DOB | Marital status | References |
|--------|--------|-------|-----|----------------|------------|
| USA | 1–2 pages | No | No | No | "Available on request" |
| Canada | 1–2 pages | No | No | No | "Available on request" |
| UK | 2 pages | No | No | No | "Available on request" |
| Ireland | 2 pages | No | No | No | "Available on request" |
| Australia / NZ | 2–3 pages | No | No | No | "Available on request" |
| Germany / Austria / Switzerland | 2–3 pages | Yes (expected) | Yes | Sometimes | Listed or on request |
| France | 1–2 pages | Optional | No (illegal to require) | No | On request |
| Netherlands / Scandinavia | 1–2 pages | Optional | No | No | On request |
| Japan | 1–2 pages (rirekisho) | Yes | Yes | Yes | Listed |
| South Korea | 1–2 pages | Yes | Yes | Yes | Listed |
| China | 1–2 pages | Yes | Yes | Yes | Listed |
| India | 2–3 pages | Optional | Yes (common) | Sometimes | Listed |
| Nepal | 2–3 pages | Yes (common) | Yes | Sometimes | Listed |
| Bangladesh / Sri Lanka | 2–3 pages | Yes (common) | Yes | Sometimes | Listed |
| UAE / Gulf (GCC) | 2–3 pages | Yes (common) | Yes | Yes (sometimes) | Listed |
| Nigeria / East Africa | 2–3 pages | Yes (common) | Yes | Sometimes | Listed |
| South Africa | 3–5 pages | Optional | Yes (common) | No | Listed |
| Brazil | 1–2 pages | Optional | Yes (common) | No | On request |
| Academic (global) | No limit | Varies | Varies | No | Full list required |
| Executive / board (global) | 2–3 pages | No | No | No | On request |

Default when market is unknown: UK / international conventions (no photo, no DOB, 2 pages,
"Available on request").

---

## Decision tree

```
User invokes @cv-generator
        |
        v
Source provided? --No--> Run questionnaire (Q1–Q20, one at a time)
        |Yes
        v
LinkedIn URL blocked? --Yes--> Ask for PDF export immediately; do not proceed empty
        |No
        v
Collect all sources --> merge and deduplicate (section 5)
        |
        v
Ask: Purpose? --> Detect or assume seniority (default: mid-level; tell the user)
        |
        v
Select format (section 3c)
        |
        v
Select section order (section 6)
        |
        v
JD provided? --Yes--> Parse JD --> extract and score keywords (section 9)
        |No                  |
        v                    v
Write CV content       Integrate keywords naturally
(sections 7–8)               |
        |<-------------------+
        v
Run anti-hallucination gate (section 10) --> block output until all pass
        |
        v
Run tense enforcement (section 7d) --> block output until all pass
        |
        v
Run banned phrase scan (section 7c) --> fix any found
        |
        v
Output in order:
  Formatted CV (staging draft)
  FlowCV paste-ready version
  Canva paste-ready version
  Missing information checklist
  CV flaw report (scored)
  Improve suggestions
  Suggested file name
        |
        v
Offer cover letter (section 12)
```


---
name: cyber-audit
description: "Run read-only exposure checks for security advisories and write a structured local audit report."
category: security
risk: safe
source: community
source_repo: davidondrej/skills
source_type: community
date_added: "2026-07-07"
author: davidondrej
tags: [security, audit, read-only]
tools: [claude, codex]
license: "MIT"
license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
disable-model-invocation: true
---

# cyber-audit

## When to Use

- Use when the user asks whether their machine or projects are affected by a CVE, breach, or package advisory.
- Use when a read-only local security exposure report is appropriate.

## Hard rules

- **Read-only.** No installs, removes, upgrades, restarts, network calls, or file modifications outside `~/Documents/security-audits/`.
- **No `sudo`.** Never.
- **One report per invocation.** Always end by writing the `.md` file (even if the verdict is "Not affected" — the audit trail matters).
- If a check requires a state-changing command, **skip it and note "not checked (would require state change)"** in the table. Do not run it.

## Workflow

1. **Identify scope.** Extract from the advisory: package/binary name, affected versions, platform (macOS / Linux / Windows), attack vector (supply chain / RCE / local / network).
2. **Run checks in parallel** (Bash tool, multiple calls in one message). Pick relevant checks for the advisory type — don't run all of them.
3. **Build the table** as you go. Each row = one check + concrete result (version number, path, "None", "N/A").
4. **Write the report** to `~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md`. Use today's date from the environment header.
5. **Tell the user** the verdict in one line + path to the report.

## Check menu (pick what's relevant)

```bash
# --- Node / npm ecosystem (supply-chain advisories) ---
which npm pnpm yarn; npm root -g; pnpm root -g 2>/dev/null
ls /opt/homebrew/lib/node_modules                                  # global npm
find ~ -maxdepth 8 -type d -name "<pkg>" 2>/dev/null \
  | grep -v -E "(Library/Caches|\.Trash)"                          # installed copies
find ~/Documents ~/Desktop ~/Downloads -maxdepth 8 -type f \
  \( -name "package.json" -o -name "package-lock.json" \
     -o -name "pnpm-lock.yaml" -o -name "yarn.lock" \) 2>/dev/null \
  | xargs grep -l "<pkg>" 2>/dev/null                              # direct + transitive

# --- Python ecosystem ---
which python3 pip pipx uv
pip list 2>/dev/null | grep -i "<pkg>"
find ~/Documents -maxdepth 6 -name "requirements*.txt" -o -name "pyproject.toml" \
  -o -name "poetry.lock" -o -name "uv.lock" 2>/dev/null | xargs grep -l "<pkg>" 2>/dev/null

# --- Homebrew / system binaries ---
brew list --versions <formula> 2>/dev/null
which <binary>; <binary> --version 2>/dev/null

# --- Running processes / listeners (for RCE / network CVEs) ---
pgrep -lf "<binary>"
lsof -iTCP -sTCP:LISTEN -P -n 2>/dev/null | grep "<port>"

# --- LaunchAgents / LaunchDaemons (persistence / autostart) ---
ls ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null \
  | grep -i "<vendor>"

# --- Env vars that change exposure (e.g. OLLAMA_HOST, listening addr) ---
launchctl getenv <VAR>; grep -r "<VAR>" ~/.zshrc ~/.zprofile ~/.config 2>/dev/null

# --- VS Code / browser extensions (for IDE-targeted advisories) ---
ls ~/.vscode/extensions 2>/dev/null | grep -i "<ext>"
```

If the advisory mentions an ecosystem not above (Rust cargo, Go modules, Ruby gems, Docker images, etc.), apply the same pattern: global install path + manifest grep + running processes.

## Report template

File: `~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md`

```markdown
# <Subject> — Audit

**Date:** YYYY-MM-DD
**Host:** the user's Mac

## <CVEs | Advisory> in scope

- **<ID or source> "<Name>"** — <one-line description>. <Affected versions or scope>.

## Audit results

| Check | Result |
|---|---|
| <Check 1> | <Result> |
| <Check 2> | <Result> |

## Verdict

**<Not affected. | Affected. | Partially affected.>**

- <Rationale bullet 1>
- <Rationale bullet 2>

## Action taken

None — diagnostic only, no files modified, no <packages installed/removed | services started/stopped | firewall rules changed>.

## Follow-ups

- <Actionable item, or "None" if truly nothing>
```

Match the tone of the two existing reports in `~/Documents/security-audits/` — terse, factual, bulleted, no hedging.

## Verdict wording

- **Not affected.** — package/binary absent, or installed but patched, or not running and not exposed.
- **Affected.** — vulnerable version present *and* reachable by the attack vector.
- **Partially affected.** — present but mitigated (e.g. binary installed but service not running, or listener bound to loopback only). Spell out the mitigation in the bullets.

## When to break the read-only rule

Never on your own. If the verdict is "Affected", list the remediation command in **Follow-ups** and stop. The user runs it.

## Reference

Two existing reports in `~/Documents/security-audits/` show the expected style:
- `baseline-audit.md` (long-form baseline audit — different format, do not mimic)
- `YYYY-MM-DD-example-advisory.md` and any newer `YYYY-MM-DD-*.md` files (this is the format to match)

## Limitations

- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.


---
name: cyber-y2k
description: Web and App implementation guide for Cyber Y2K. Trigger when user wants modern Y2K, holographic visuals, and glitch aesthetics.
date_added: "2026-06-17"
risk: safe
source: self
source_type: self
---

# Cyber Y2K

> "Y2K, but seen through a distorted, modern lens. Darker, glitchier, and highly holographic."

## When to Use
Use this sub-style when the user's request matches the aesthetic described above. This is a child reference of the `design-it` skill and is not meant to be triggered directly.

## Core Principles
1. **Holographic Gradients**: Iridescent, oil-slick color palettes that shift as you move.
2. **Glitch Art**: Text or images that appear corrupted, split into RGB channels, or stutter.
3. **Tribal & Tribal-Tech Vectors**: Sharp, aggressive vector graphics (think early 2000s tribal tattoos mixed with circuit boards).

## Visual DNA
- **Colors**: Deep black background. Highlights are holographic (purple, cyan, lime green, hot pink all mixed into fluid gradients).
- **Typography**: Extremely bold, stretched fonts, or highly technical monospace fonts.
- **Visuals**: CD-ROM reflections, barbed wire graphics, and heavy chromatic aberration.

## Web Implementation
- Use CSS animations for glitching and animated background gradients.
- **CSS Example**:
```css
body {
  background-color: #050505;
  color: #fff;
}

/* Holographic button */
.cyber-y2k-btn {
  background: linear-gradient(124deg, #ff2400, #e81d1d, #e8b71d, #e3e81d, #1de840, #1ddde8, #2b1de8, #dd00f3, #dd00f3);
  background-size: 1800% 1800%;
  animation: rainbow 18s ease infinite;

  color: #fff;
  font-weight: 900;
  text-transform: uppercase;
  border: 1px solid rgba(255,255,255,0.5);
  border-radius: 30px;
  padding: 16px 32px;
  mix-blend-mode: screen; /* Makes it interact with background */
}

@keyframes rainbow {
  0%{background-position:0% 82%}
  50%{background-position:100% 19%}
  100%{background-position:0% 82%}
}

/* RGB Split text effect */
.glitch-text {
  position: relative;
  font-family: 'Courier New', monospace;
  font-size: 3rem;
  font-weight: bold;
}
.glitch-text::before, .glitch-text::after {
  content: attr(data-text);
  position: absolute;
  top: 0; left: 0;
  opacity: 0.8;
}
.glitch-text::before {
  color: #0ff;
  z-index: -1;
  transform: translate(-3px, 2px);
}
.glitch-text::after {
  color: #f0f;
  z-index: -2;
  transform: translate(3px, -2px);
}
```

## App Implementation

### SwiftUI
```swift
struct CyberY2KView: View {
    @State private var rotation: Double = 0

    var body: some View {
        ZStack {
            Color.black.ignoresSafeArea()

            VStack(spacing: 40) {
                // Glitch Text
                ZStack {
                    Text("SYSTEM.ERROR")
                        .font(.custom("Courier New", size: 40).bold())
                        .foregroundColor(.cyan)
                        .offset(x: -3, y: 2) // RGB split channel 1

                    Text("SYSTEM.ERROR")
                        .font(.custom("Courier New", size: 40).bold())
                        .foregroundColor(.pink)
                        .offset(x: 3, y: -2) // RGB split channel 2

                    Text("SYSTEM.ERROR")
                        .font(.custom("Courier New", size: 40).bold())
                        .foregroundColor(.white)
                }

                // Holographic Button
                Button(action: {}) {
                    Text("ENTER MATRIX")
                        .font(.headline.weight(.black))
                        .foregroundColor(.white)
                        .padding(.horizontal, 32)
                        .padding(.vertical, 16)
                        .background(
                            AngularGradient(
                                gradient: Gradient(colors: [.red, .yellow, .green, .cyan, .blue, .purple, .red]),
                                center: .center,
                                angle: .degrees(rotation)
                            )
                        )
                        .cornerRadius(30)
                        .overlay(RoundedRectangle(cornerRadius: 30).stroke(Color.white.opacity(0.5), lineWidth: 1))
                }
                .onAppear {
                    withAnimation(.linear(duration: 5).repeatForever(autoreverses: false)) {
                        rotation = 360
                    }
                }
            }
        }
    }
}
```
- The RGB Glitch effect is incredibly simple in SwiftUI: stack three identical `Text` views in a `ZStack`. Give the bottom ones `.cyan` and `.pink` colors and slightly `.offset()` them.
- Use an `AngularGradient` bound to a rotating `@State` variable to achieve the iridescent CD-ROM holographic effect.

### Flutter
```dart
class CyberY2KScreen extends StatefulWidget {
  @override
  State<CyberY2KScreen> createState() => _CyberY2KScreenState();
}

class _CyberY2KScreenState extends State<CyberY2KScreen> with SingleTickerProviderStateMixin {
  late AnimationController _controller;

  @override
  void initState() {
    super.initState();
    _controller = AnimationController(vsync: this, duration: const Duration(seconds: 5))..repeat();
  }

  @override
  Widget build(BuildContext context) {
    return Scaffold(
      backgroundColor: Colors.black,
      body: Center(
        child: Column(
          mainAxisAlignment: MainAxisAlignment.center,
          children: [
            // Glitch Text
            Stack(
              children: [
                Transform.translate(offset: const Offset(-3, 2), child: const Text('SYSTEM.ERROR', style: TextStyle(color: Colors.cyan, fontSize: 40, fontFamily: 'Courier', fontWeight: FontWeight.bold))),
                Transform.translate(offset: const Offset(3, -2), child: const Text('SYSTEM.ERROR', style: TextStyle(color: Colors.pinkAccent, fontSize: 40, fontFamily: 'Courier', fontWeight: FontWeight.bold))),
                const Text('SYSTEM.ERROR', style: TextStyle(color: Colors.white, fontSize: 40, fontFamily: 'Courier', fontWeight: FontWeight.bold)),
              ],
            ),
            const SizedBox(height: 60),
            // Holographic Button via ShaderMask
            AnimatedBuilder(
              animation: _controller,
              builder: (context, child) {
                return ShaderMask(
                  shaderCallback: (Rect bounds) {
                    return SweepGradient(
                      colors: const [Colors.red, Colors.yellow, Colors.green, Colors.cyan, Colors.blue, Colors.purple, Colors.red],
                      transform: GradientRotation(_controller.value * 2 * 3.14159), // Rotate through 360 degrees
                    ).createShader(bounds);
                  },
                  child: Container(
                    decoration: BoxDecoration(
                      color: Colors.white, // Color to be masked by shader
                      borderRadius: BorderRadius.circular(30),
                      border: Border.all(color: Colors.white.withOpacity(0.5)),
                    ),
                    padding: const EdgeInsets.symmetric(horizontal: 32, vertical: 16),
                    child: const Text('ENTER MATRIX', style: TextStyle(color: Colors.black, fontWeight: FontWeight.w900)),
                  ),
                );
              },
            ),
          ],
        ),
      ),
    );
  }
}
```
- In Flutter, a `ShaderMask` with a `SweepGradient` attached to an `AnimationController` creates a perfect, performant oil-slick holographic effect over any widget.
- Use `Stack` and `Transform.translate` to build the RGB glitch text.

### React Native
```jsx
// Requires react-native-linear-gradient for complex gradients
import LinearGradient from 'react-native-linear-gradient';

const GlitchText = ({ text }) => {
  const baseStyle = { fontSize: 40, fontFamily: 'Courier', fontWeight: 'bold', position: 'absolute' };
  return (
    <View style={{ alignItems: 'center', height: 50, justifyContent: 'center' }}>
      <Text style={[baseStyle, { color: '#00FFFF', transform: [{ translateX: -3 }, { translateY: 2 }] }]}>{text}</Text>
      <Text style={[baseStyle, { color: '#FF00FF', transform: [{ translateX: 3 }, { translateY: -2 }] }]}>{text}</Text>
      <Text style={[baseStyle, { color: '#FFF' }]}>{text}</Text>
    </View>
  );
};

const CyberY2KScreen = () => {
  return (
    <View style={{ flex: 1, backgroundColor: '#050505', justifyContent: 'center', alignItems: 'center' }}>
      <GlitchText text="SYSTEM.ERROR" />

      <View style={{ marginTop: 60 }}>
        {/* React Native cannot easily animate gradient angles natively.
            Use a complex LinearGradient to simulate the iridescent shine. */}
        <LinearGradient
          colors={['#ff2400', '#e8b71d', '#1de840', '#1ddde8', '#dd00f3']}
          start={{ x: 0, y: 0 }} end={{ x: 1, y: 1 }}
          style={{
            borderRadius: 30, padding: 16, paddingHorizontal: 32,
            borderWidth: 1, borderColor: 'rgba(255,255,255,0.5)'
          }}
        >
          <Text style={{ color: '#FFF', fontWeight: '900' }}>ENTER MATRIX</Text>
        </LinearGradient>
      </View>
    </View>
  );
};
```
- Stacked absolute `<Text>` nodes handle the RGB split glitch well.
- True animating holographic gradients (like Sweep/Angular) require `@shopify/react-native-skia`. If Skia is unavailable, use a static multi-stop `LinearGradient` as a fallback.

### Jetpack Compose
```kotlin
@Composable
fun GlitchText(text: String) {
    Box(contentAlignment = Alignment.Center) {
        Text(text, color = Color.Cyan, fontSize = 40.sp, fontFamily = FontFamily.Monospace, fontWeight = FontWeight.Bold,
            modifier = Modifier.offset(x = (-3).dp, y = 2.dp))
        Text(text, color = Color.Magenta, fontSize = 40.sp, fontFamily = FontFamily.Monospace, fontWeight = FontWeight.Bold,
            modifier = Modifier.offset(x = 3.dp, y = (-2).dp))
        Text(text, color = Color.White, fontSize = 40.sp, fontFamily = FontFamily.Monospace, fontWeight = FontWeight.Bold)
    }
}

@Composable
fun CyberY2KScreen() {
    val infiniteTransition = rememberInfiniteTransition()
    val rotation by infiniteTransition.animateFloat(
        initialValue = 0f,
        targetValue = 360f,
        animationSpec = infiniteRepeatable(
            animation = tween(5000, easing = LinearEasing)
        )
    )

    Column(
        modifier = Modifier.fillMaxSize().background(Color.Black),
        horizontalAlignment = Alignment.CenterHorizontally,
        verticalArrangement = Arrangement.Center
    ) {
        GlitchText("SYSTEM.ERROR")

        Spacer(Modifier.height(60.dp))

        // Holographic Button
        Box(
            modifier = Modifier
                .background(
                    brush = Brush.sweepGradient(
                        colors = listOf(Color.Red, Color.Yellow, Color.Green, Color.Cyan, Color.Blue, Color.Magenta, Color.Red),
                        center = Offset.Unspecified
                    ),
                    shape = RoundedCornerShape(30.dp)
                )
                .graphicsLayer { rotationZ = rotation } // Note: This rotates the whole button.
                // To rotate ONLY the gradient brush requires custom ShaderBrush or drawing the rect manually in drawBehind with a rotating matrix.
                .border(1.dp, Color.White.copy(alpha = 0.5f), RoundedCornerShape(30.dp))
                .padding(horizontal = 32.dp, vertical = 16.dp)
        ) {
            Text("ENTER MATRIX", color = Color.White, fontWeight = FontWeight.Black)
        }
    }
}
```
- Like other frameworks, use a `Box` to stack text with `Modifier.offset()` for glitches.
- A `Brush.sweepGradient` creates the holographic CD-ROM colors, though rotating the brush *itself* (not the whole widget) in Compose requires a bit of advanced `Matrix` manipulation inside a `ShaderBrush`.

## Do's and Don'ts
- **DO**: Incorporate UI elements that look like raw HTML/CSS (like visible tables or marquee tags) as an ironic nod to early web.
- **DON'T**: Use clean, modern geometric layouts. Cyber Y2K is chaotic and rebellious.

## Limitations
- This is a styling reference and does not replace environment-specific validation, accessibility testing, or expert review.
- Ensure appropriate contrast ratios and responsive behaviors are verified separately.


---
name: cyberpunk-ui
description: Web and App implementation guide for Cyberpunk UI. Trigger when user wants neon colors, dark backgrounds, high-tech dystopian aesthetics, and hacking interfaces.
date_added: "2026-06-17"
risk: safe
source: self
source_type: self
---

# Cyberpunk UI

> "High tech, low life. Neon signs cutting through the smog of a dystopian megacity."

## When to Use
Use this sub-style when the user's request matches the aesthetic described above. This is a child reference of the `design-it` skill and is not meant to be triggered directly.

## Core Principles
1. **Neon on Black**: The foundation is absolute black (`#000000`) or deep charcoal, cut by searingly bright neon accents.
2. **Angled Geometries**: Clipped corners (chamfers) rather than rounded corners. UI elements often look like they were cut from metal plates.
3. **Glitch and Data**: Random streams of hexadecimal data, barcode accents, and intentional visual tearing.

## Visual DNA
- **Colors**: Acid Yellow (`#FCE205`), Cyan (`#00FFFF`), Hot Pink (`#FF003C`), against Black.
- **Typography**: Industrial, squared-off sans-serifs (like `Rajdhani`, `Blender Pro`, or `Teko`), mixed with small monospace fonts for data.
- **Styling**: Diagonal stripes, warning tape patterns, and heavy outer glows.

## Web Implementation
- Rely on `clip-path` for the angled cuts.
- **CSS Example**:
```css
body {
  background-color: #050505;
  color: #00FFFF;
  font-family: 'Rajdhani', sans-serif;
  background-image: repeating-linear-gradient(
    45deg,
    #050505,
    #050505 10px,
    #0a0a0a 10px,
    #0a0a0a 20px
  );
}

.cyberpunk-button {
  background-color: #FF003C; /* Cyberpunk Red/Pink */
  color: #FFF;
  font-size: 1.5rem;
  font-weight: bold;
  text-transform: uppercase;
  border: none;
  padding: 16px 32px;

  /* The signature clipped corner */
  clip-path: polygon(
    0 0,
    calc(100% - 15px) 0,
    100% 15px,
    100% 100%,
    15px 100%,
    0 calc(100% - 15px)
  );

  position: relative;
  transition: all 0.2s ease;
}

/* The glitch/shadow effect */
.cyberpunk-button:hover {
  background-color: #FCE205; /* Acid Yellow */
  color: #000;
  box-shadow:
    -4px 0 0 #00FFFF,
    4px 0 0 #FF003C;
}

.data-stream {
  font-family: monospace;
  font-size: 0.8rem;
  color: rgba(0, 255, 255, 0.5);
}
```

## App Implementation

### SwiftUI
```swift
struct CyberpunkShape: Shape {
    let cutSize: CGFloat = 15
    func path(in rect: CGRect) -> Path {
        var path = Path()
        // Top left
        path.move(to: CGPoint(x: 0, y: 0))
        // Top right (cut)
        path.addLine(to: CGPoint(x: rect.maxX - cutSize, y: 0))
        path.addLine(to: CGPoint(x: rect.maxX, y: cutSize))
        // Bottom right
        path.addLine(to: CGPoint(x: rect.maxX, y: rect.maxY))
        // Bottom left (cut)
        path.addLine(to: CGPoint(x: cutSize, y: rect.maxY))
        path.addLine(to: CGPoint(x: 0, y: rect.maxY - cutSize))
        path.closeSubpath()
        return path
    }
}

struct CyberButton: View {
    var body: some View {
        Button(action: {}) {
            Text("SYS.OVERRIDE")
                .font(.custom("Rajdhani", size: 24))
                .fontWeight(.bold)
                .foregroundColor(.white)
                .padding(.horizontal, 32)
                .padding(.vertical, 16)
        }
        .background(Color(red: 1.0, green: 0.0, blue: 0.24)) // Cyberpunk Red
        .clipShape(CyberpunkShape())
        .overlay(
            CyberpunkShape()
                .stroke(Color(red: 0.0, green: 1.0, blue: 1.0), lineWidth: 2) // Cyan border
        )
    }
}
```
- Define a custom `Shape` that physically cuts off the corners, bypassing standard `cornerRadius`.
- Use `.clipShape()` for the background, and `.overlay()` with `.stroke()` for high-tech borders.

### Flutter
```dart
class CyberpunkClipper extends CustomClipper<Path> {
  final double cutSize = 15.0;

  @override
  Path getClip(Size size) {
    Path path = Path();
    path.lineTo(size.width - cutSize, 0); // Top right cut start
    path.lineTo(size.width, cutSize);     // Top right cut end
    path.lineTo(size.width, size.height);
    path.lineTo(cutSize, size.height);    // Bottom left cut start
    path.lineTo(0, size.height - cutSize);// Bottom left cut end
    path.close();
    return path;
  }

  @override
  bool shouldReclip(CustomClipper<Path> oldClipper) => false;
}

class CyberButton extends StatelessWidget {
  @override
  Widget build(BuildContext context) {
    return ClipPath(
      clipper: CyberpunkClipper(),
      child: Container(
        color: const Color(0xFFFF003C), // Cyberpunk Red
        padding: const EdgeInsets.symmetric(horizontal: 32, vertical: 16),
        child: const Text(
          'SYS.OVERRIDE',
          style: TextStyle(
            color: Colors.white,
            fontSize: 24,
            fontWeight: FontWeight.bold,
            fontFamily: 'Rajdhani',
          ),
        ),
      ),
    );
  }
}
```
- Extend `CustomClipper<Path>` to calculate the precise angular cuts.
- Wrap your containers in `ClipPath`.
- For borders, you must use a `CustomPaint` with a `CustomPainter` that traces the exact same path.

### React Native
```jsx
import Svg, { Polygon } from 'react-native-svg';

const CyberButton = () => {
  return (
    <View style={{ alignItems: 'center', justifyContent: 'center', width: 200, height: 60 }}>
      {/* Background SVG to achieve the clipped corner look */}
      <View style={{ position: 'absolute', top: 0, bottom: 0, left: 0, right: 0 }}>
        <Svg height="100%" width="100%" viewBox="0 0 200 60" preserveAspectRatio="none">
          <Polygon
            points="0,0 185,0 200,15 200,60 15,60 0,45"
            fill="#FF003C"
            stroke="#00FFFF"
            strokeWidth="2"
          />
        </Svg>
      </View>

      <Text style={{
        color: '#FFF',
        fontSize: 20,
        fontWeight: 'bold',
        fontFamily: 'Rajdhani-Bold'
      }}>
        SYS.OVERRIDE
      </Text>
    </View>
  );
};
```
- React Native does not natively support clipping paths on views easily.
- **Solution**: Use `react-native-svg` to draw a `<Polygon>` that acts as the absolute-positioned background behind transparent text.

### Jetpack Compose
```kotlin
class CyberpunkShape(private val cutSize: Dp) : Shape {
    override fun createOutline(
        size: Size,
        layoutDirection: LayoutDirection,
        density: Density
    ): Outline {
        val cutPx = with(density) { cutSize.toPx() }
        val path = Path().apply {
            moveTo(0f, 0f)
            lineTo(size.width - cutPx, 0f)
            lineTo(size.width, cutPx)
            lineTo(size.width, size.height)
            lineTo(cutPx, size.height)
            lineTo(0f, size.height - cutPx)
            close()
        }
        return Outline.Generic(path)
    }
}

@Composable
fun CyberButton() {
    Box(
        modifier = Modifier
            .clip(CyberpunkShape(15.dp))
            .background(Color(0xFFFF003C))
            .border(2.dp, Color(0xFF00FFFF), CyberpunkShape(15.dp))
            .clickable { }
            .padding(horizontal = 32.dp, vertical = 16.dp)
    ) {
        Text(
            text = "SYS.OVERRIDE",
            color = Color.White,
            fontSize = 24.sp,
            fontWeight = FontWeight.Bold,
            // Assuming custom font is loaded
        )
    }
}
```
- Create a custom `Shape` by overriding `createOutline` and tracing the `Path`.
- Pass this shape directly into `Modifier.clip()` and `Modifier.background()`.
- You can elegantly apply a border stroke directly to the custom shape using `Modifier.border()`.

## Do's and Don'ts
- **DO**: Include tiny, meaningless technical details (crosshairs, serial numbers, "SYS.OVERRIDE" text).
- **DON'T**: Use soft, organic curves or gradients. It must be sharp and aggressive.

## Limitations
- This is a styling reference and does not replace environment-specific validation, accessibility testing, or expert review.
- Ensure appropriate contrast ratios and responsive behaviors are verified separately.


---
name: cypress-skill
description: Generates production-grade Cypress E2E and component tests in JavaScript or TypeScript. Supports local execution and TestMu AI cloud. Use when the user asks to write Cypress tests, set up Cypress, test with cy commands, or mentions "Cypress", "cy.visit", "cy.get", "cy.intercept"....
risk: critical
source: https://github.com/LambdaTest/agent-skills/tree/main/cypress-skill
source_repo: LambdaTest/agent-skills
source_type: community
date_added: 2026-07-01
license: MIT
license_source: https://github.com/LambdaTest/agent-skills/blob/main/LICENSE
---

# Cypress Automation Skill
## When to Use

Use this skill when you need generates production-grade Cypress E2E and component tests in JavaScript or TypeScript. Supports local execution and TestMu AI cloud. Use when the user asks to write Cypress tests, set up Cypress, test with cy commands, or mentions "Cypress", "cy.visit", "cy.get", "cy.intercept"....

You are a senior QA automation architect specializing in Cypress.

## Step 1 — Execution Target

```
User says "test" / "automate"
│
├─ Mentions "cloud", "TestMu", "LambdaTest", "cross-browser"?
│  └─ TestMu AI cloud via cypress-cli plugin
│
├─ Mentions "locally", "open", "headed"?
│  └─ Local: npx cypress open
│
└─ Ambiguous? → Default local, mention cloud option
```

## Step 2 — Test Type

| Signal | Type | Config |
|--------|------|--------|
| "E2E", "end-to-end", page URL | E2E test | `cypress/e2e/` |
| "component", "React", "Vue" | Component test | `cypress/component/` |
| "API test", "cy.request" | API test via Cypress | `cypress/e2e/api/` |

## Core Patterns

### Command Chaining — CRITICAL

```javascript
// ✅ Cypress chains — no await, no async
cy.visit('/login');
cy.get('#username').type('user@test.com');
cy.get('#password').type('password123');
cy.get('button[type="submit"]').click();
cy.url().should('include', '/dashboard');

// ❌ NEVER use async/await with cy commands
// ❌ NEVER assign cy.get() to a variable for later use
```

### Selector Priority

```
1. cy.get('[data-cy="submit"]')     ← Best practice
2. cy.get('[data-testid="submit"]') ← Also good
3. cy.contains('Submit')            ← Text-based
4. cy.get('#submit-btn')            ← ID
5. cy.get('.btn-primary')           ← Class (fragile)
```

### Anti-Patterns

| Bad | Good | Why |
|-----|------|-----|
| `cy.wait(5000)` | `cy.intercept()` + `cy.wait('@alias')` | Arbitrary waits |
| `const el = cy.get()` | Chain directly | Cypress is async |
| `async/await` with cy | Chain `.then()` if needed | Different async model |
| Testing 3rd party sites | Stub/mock instead | Flaky, slow |
| Single `beforeEach` with everything | Multiple focused specs | Better isolation |

### Basic Test Structure

```javascript
describe('Login', () => {
  beforeEach(() => {
    cy.visit('/login');
  });

  it('should login with valid credentials', () => {
    cy.get('[data-cy="username"]').type('user@test.com');
    cy.get('[data-cy="password"]').type('password123');
    cy.get('[data-cy="submit"]').click();
    cy.url().should('include', '/dashboard');
    cy.get('[data-cy="welcome"]').should('contain', 'Welcome');
  });

  it('should show error for invalid credentials', () => {
    cy.get('[data-cy="username"]').type('wrong@test.com');
    cy.get('[data-cy="password"]').type('wrong');
    cy.get('[data-cy="submit"]').click();
    cy.get('[data-cy="error"]').should('be.visible');
  });
});
```

### Network Interception

```javascript
// Stub API response
cy.intercept('POST', '/api/login', {
  statusCode: 200,
  body: { token: 'fake-jwt', user: { name: 'Test User' } },
}).as('loginRequest');

cy.get('[data-cy="submit"]').click();
cy.wait('@loginRequest').its('request.body').should('deep.include', {
  email: 'user@test.com',
});

// Wait for real API
cy.intercept('GET', '/api/dashboard').as('dashboardLoad');
cy.visit('/dashboard');
cy.wait('@dashboardLoad');
```

### Custom Commands

```javascript
// cypress/support/commands.js
Cypress.Commands.add('login', (email, password) => {
  cy.session([email, password], () => {
    cy.visit('/login');
    cy.get('[data-cy="username"]').type(email);
    cy.get('[data-cy="password"]').type(password);
    cy.get('[data-cy="submit"]').click();
    cy.url().should('include', '/dashboard');
  });
});

// Usage in tests
cy.login('user@test.com', 'password123');
```

### TestMu AI Cloud

```javascript
// cypress.config.js
module.exports = {
  e2e: {
    setupNodeEvents(on, config) {
      // LambdaTest plugin
    },
  },
};

// lambdatest-config.json
{
  "lambdatest_auth": {
    "username": "${LT_USERNAME}",
    "access_key": "${LT_ACCESS_KEY}"
  },
  "browsers": [
    { "browser": "Chrome", "platform": "Windows 11", "versions": ["latest"] },
    { "browser": "Firefox", "platform": "macOS Sequoia", "versions": ["latest"] }
  ],
  "run_settings": {
    "build_name": "Cypress Build",
    "parallels": 5,
    "specs": "cypress/e2e/**/*.cy.js"
  }
}
```

**Run on cloud:**
```bash
npx lambdatest-cypress run
```

## Validation Workflow

1. **No arbitrary waits**: Zero `cy.wait(number)` — use intercepts
2. **Selectors**: Prefer `data-cy` attributes
3. **No async/await**: Pure Cypress chaining
4. **Assertions**: Use `.should()` chains, not manual checks
5. **Isolation**: Each test independent, use `cy.session()` for auth

## Quick Reference

| Task | Command |
|------|---------|
| Open interactive | `npx cypress open` |
| Run headless | `npx cypress run` |
| Run specific spec | `npx cypress run --spec "cypress/e2e/login.cy.js"` |
| Run in browser | `npx cypress run --browser chrome` |
| Component tests | `npx cypress run --component` |
| Environment vars | `CYPRESS_BASE_URL=http://localhost:3000 npx cypress run` |
| Fixtures | `cy.fixture('users.json').then(data => ...)` |
| File upload | `cy.get('input[type="file"]').selectFile('file.pdf')` |
| Viewport | `cy.viewport('iphone-x')` or `cy.viewport(1280, 720)` |
| Screenshot | `cy.screenshot('login-page')` |

## Reference Files

| File | When to Read |
|------|-------------|
| `reference/cloud-integration.md` | LambdaTest Cypress CLI, parallel, config |
| `reference/component-testing.md` | React/Vue/Angular component tests |
| `reference/custom-commands.md` | Advanced commands, overwrite, TypeScript |
| `reference/debugging-flaky.md` | Retry-ability, detached DOM, race conditions |

## Advanced Playbook

For production-grade patterns, see `reference/playbook.md`:

| Section | What's Inside |
|---------|--------------|
| §1 Production Config | Multi-env configs, setupNodeEvents |
| §2 Auth with cy.session() | UI login, API login, validation |
| §3 Page Object Pattern | Fluent page classes, barrel exports |
| §4 Network Interception | Mock, modify, delay, wait for API |
| §5 Component Testing | React/Vue mount, stubs, variants |
| §6 Custom Commands | TypeScript declarations, drag-drop |
| §7 DB Reset & Seeding | API reset, Cypress tasks, Prisma |
| §8 Time Control | cy.clock(), cy.tick() |
| §9 File Operations | Upload, drag-drop, download verify |
| §10 iframe & Shadow DOM | Content access patterns |
| §11 Accessibility | cypress-axe, WCAG audits |
| §12 Visual Regression | Percy, cypress-image-snapshot |
| §13 CI/CD | GitHub Actions matrix + Cypress Cloud parallel |
| §14 Debugging Table | 11 common problems with fixes |
| §15 Best Practices | 15-item production checklist |

## Limitations

- Use this skill only when the task clearly matches its upstream source and local project context.
- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.