framework-compliance-t…
Make a cloud account compliant with a security or industry framework using Prowler Cloud.
Tailwind CSS 4 patterns and best practices. Trigger: When styling with Tailwind (className, variants, cn()), especially when dynamic styling or CSS variables are involved (no var() in className).
Claude Code
$ npx -y skills add prowler-cloud/prowler --skill tailwind-4 --agent claude-code
Codex
$ npx skills add prowler-cloud/prowler --skill tailwind-4 -a codex -y
Cursor
$ npx skills add prowler-cloud/prowler --skill tailwind-4 -a cursor -y
Gemini CLI
$ npx skills add prowler-cloud/prowler --skill tailwind-4 -a gemini-cli -y
GitHub Copilot
$ npx skills add prowler-cloud/prowler --skill tailwind-4 -a github-copilot -y
OpenCode
$ npx skills add prowler-cloud/prowler --skill tailwind-4 -a opencode -y
Windsurf
$ npx skills add prowler-cloud/prowler --skill tailwind-4 -a windsurf -y
name: tailwind-4 description: > Tailwind CSS 4 patterns and best practices. Trigger: When styling with Tailwind (className, variants, cn()), especially when dynamic styling or CSS variables are involved (no var() in className). license: Apache-2.0 metadata: author: prowler-cloud version: "1.1" scope: [root, ui] auto_invoke: "Working with Tailwind classes" allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
**Prowler UI:** use the semantic token utilities above. Raw palette classes (`bg-slate-800`, `bg-blue-500`) appear below only as generic Tailwind examples; in `ui/` they are not allowed (see `prowler-ui` Design System Discipline).
Tailwind class exists? → className="..."
Dynamic value? → style={{ width: `${x}%` }}
Conditional styles? → cn("base", condition && "variant")
Static only? → className="..." (no cn() needed)
Library can't use class?→ style prop with var() constants// ❌ NEVER: var() in className <div className="bg-[var(--color-primary)]" /> <div className="text-[var(--text-color)]" /> // ✅ ALWAYS: Use theme token utilities <div className="bg-button-primary" /> <div className="text-text-neutral-secondary" />
Tailwind 4 also accepts the `bg-(--token)` shorthand for CSS variables; it is still an escape hatch. If a token is used repeatedly, it belongs in `@theme`.
// ❌ NEVER: Hex colors in className <p className="text-[#ffffff]" /> <div className="bg-[#1e293b]" /> // ✅ ALWAYS: Use theme color utilities <p className="text-text-neutral-primary" /> <div className="bg-bg-neutral-secondary" />
Already defined in `ui/lib/utils.ts` (built on `extendTailwindMerge` so custom token classes merge correctly); import it with `import { cn } from "@/lib/utils";`. Never redefine it. Simplified shape:
import { type ClassValue, clsx } from "clsx";
import { twMerge } from "tailwind-merge";
export function cn(...inputs: ClassValue[]) {
return twMerge(clsx(inputs));
}// ✅ Conditional classes
<div className={cn("base-class", isActive && "active-class")} />
// ✅ Merging with potential conflicts
<button className={cn("px-4 py-2", className)} /> // className might override
// ✅ Multiple conditions
<div className={cn(
"rounded-lg border",
variant === "primary" && "bg-blue-500 text-white",
variant === "secondary" && "bg-gray-200 text-gray-800",
disabled && "opacity-50 cursor-not-allowed"
)} />// ❌ Static classes - unnecessary wrapper
<div className={cn("flex items-center gap-2")} />
// ✅ Just use className directly
<div className="flex items-center gap-2" />When libraries don't accept className (like Recharts):
// ✅ Constants with var() - ONLY for library props
// Prefer existing shared maps first, e.g. SEVERITY_COLORS in ui/types/severities.ts
const CHART_COLORS = {
emptyState: "var(--border-neutral-tertiary)",
critical: "var(--color-bg-data-critical)",
};
// Usage with Recharts (can't use className)
<Cell fill={CHART_COLORS.critical} />
<CartesianGrid stroke={CHART_COLORS.emptyState} />// ✅ style prop for truly dynamic values
<div style={{ width: `${percentage}%` }} />
<div style={{ opacity: isVisible ? 1 : 0 }} />
// ✅ CSS custom properties for theming
<div style={{ "--progress": `${value}%` } as React.CSSProperties} /><div className="flex items-center justify-between gap-4" /> <div className="flex flex-col gap-2" /> <div className="inline-flex items-center" />
<div className="grid grid-cols-3 gap-4" /> <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-4 gap-6" />
// Padding <div className="p-4" /> // All sides <div className="px-4 py-2" /> // Horizontal, vertical <div className="pt-4 pb-2" /> // Top, bottom // Margin <div className="m-4" /> <div className="mx-auto" /> // Center horizontally <div className="mt-8 mb-4" />
<h1 className="text-2xl font-bold text-white" /> <p className="text-sm text-slate-400" /> <span className="text-xs font-medium uppercase tracking-wide" />
<div className="rounded-lg border border-slate-700" /> <div className="rounded-full shadow-lg" /> <div className="ring-2 ring-blue-500 ring-offset-2" />
<button className="hover:bg-blue-600 focus:ring-2 active:scale-95" /> <input className="focus:border-blue-500 focus:outline-none" /> <div className="group-hover:opacity-100" />
<div className="w-full md:w-1/2 lg:w-1/3" /> <div className="hidden md:block" /> <div className="text-sm md:text-base lg:text-lg" />
<div className="bg-white dark:bg-slate-900" /> <p className="text-gray-900 dark:text-white" />
// ✅ OK for one-off values not in design syst
Prowler is the world’s most widely used Open-Source Cloud Security Platform that automates security and compliance across any cloud environment.
Make a cloud account compliant with a security or industry framework using Prowler Cloud.
Vercel AI SDK patterns for the installed major (ui/package.json: `ai` 6.x, `@ai-sdk/react` 3.x). The skill name is historical;…
Django REST Framework patterns. Trigger: When implementing generic DRF APIs (ViewSets, serializers, routers, permissions,…
Reviews Django migration files for PostgreSQL best practices specific to Prowler. Trigger: When creating migrations, running…
Create and maintain GitHub Agentic Workflows (gh-aw) for Prowler. Trigger: When creating agentic workflows, modifying gh-aw…
Strict JSON:API v1.1 specification compliance. Trigger: When creating or modifying API endpoints, reviewing API responses, or…
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…