From platform-engineering
Cross-platform development rulebook covering security, architecture, and performance for SPA, PWA, mobile (iOS/Android), and desktop (Electron/Tauri) applications. MUST/DO/DON'T framework with real-world incident references and platform-specific guidance. TRIGGER WHEN: reviewing or building cross-platform apps, checking security posture, validating architecture decisions, optimizing performance, or auditing code against industry standards (OWASP, Core Web Vitals, OAuth 2.1). DO NOT TRIGGER WHEN: the task is purely about UI design, copywriting, or business logic unrelated to platform engineering concerns.
npx claudepluginhub acaprino/alfio-claude-plugins --plugin platform-engineeringThis skill uses the workspace's default tool permissions.
Three pillars govern every application you ship -- Security, Architecture, and Performance. Each rule is tagged with severity (MUST/DO/DON'T) and platform applicability.
references/api-design.mdreferences/api-security.mdreferences/auth-tokens.mdreferences/backend-and-platform-performance.mdreferences/client-server-architecture.mdreferences/frontend-performance.mdreferences/infrastructure.mdreferences/offline-first.mdreferences/platform-security.mdreferences/secrets-management.mdreferences/server-validation.mdreferences/xss-csp.mdGenerates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
Three pillars govern every application you ship -- Security, Architecture, and Performance. Each rule is tagged with severity (MUST/DO/DON'T) and platform applicability.
| Concern | SPA | PWA | Mobile | Electron | Tauri |
|---|---|---|---|---|---|
| Auth token storage | JS memory + httpOnly cookies | JS memory + httpOnly cookies | Platform Keychain/Keystore | OS credential store | OS credential store |
| OAuth flow | Auth Code + PKCE | Auth Code + PKCE | System browser + PKCE | Standard PKCE | Standard PKCE |
| XSS impact | Session hijack | + persistent SW hijack | WebView bridge access | XSS to RCE | Limited to web context |
| CSP | Critical | Critical | WebViews only | Critical | Relevant |
| Offline strategy | Optional | IndexedDB + Cache API + SW | Room/CoreData + sync queue | Optional | Optional |
| Bundle target | <170KB compressed JS | <170KB compressed JS | <20MB APK/IPA | 80-150MB (Chromium) | <10MB total |
| API style | REST or GraphQL | REST (SW caching) | GraphQL (fewer round-trips) | REST (server-side aggregation) | REST |
| State management | Zustand/Redux + TanStack Query | IndexedDB + Cache API | ViewModel+StateFlow / SwiftUI | IPC + context isolation | Rust invoke commands |
server-validation, auth-tokens, api-security, xss-csp, secrets-management, platform-securityclient-server-architecture, api-design, offline-first, infrastructurefrontend-performance, backend-and-platform-performance