Implements continuous improvement process for Cursor skills following Karpathy-style learning methodologies. Use when reviewing code, after bugs/incidents, during retrospectives, or when the user mentions "improve skills", "update guidelines", "skill feedback", or needs to document patterns, track deviations, or evolve coding standards.
Systematic approach to evolving Cursor skills through iterative refinement and meta-learning.
Learn by doing: Skills improve through real implementation feedback, not speculation.
Track everything: Patterns that work, deviations that occur, corrections needed.
Iterate fast: Small, frequent updates beat large, delayed rewrites.
Measure impact: Know which skills prevent bugs, which need clarification.
Apply this skill during:
When reviewing code or fixing bugs, document deviations from skills:
## Deviation Log
**Date**: 2026-04-04
**Skill**: adajoon-security
**Deviation**: API key stored in code instead of environment variable
**Location**: `backend/app/services/external_api.py:15`
**Impact**: Critical - exposed in git history
**Root Cause**: Skill didn't emphasize scanning for hardcoded secrets
**Fix**: Added pre-commit hook + updated skill section on secrets detection
Template location: .cursor/skills/adajoon-skill-improvement/logs/deviations.md
Document which patterns work vs fail in practice:
## Pattern Effectiveness Log
**Pattern**: "Use async/await for all database operations"
**Skill**: adajoon-conventions
**Status**: ✅ WORKING
**Evidence**: Zero sync DB calls in last 50 PRs
**Notes**: Clear examples in skill make this obvious
---
**Pattern**: "Only comment non-obvious intent"
**Skill**: adajoon-conventions
**Status**: ⚠️ NEEDS CLARITY
**Evidence**: 3 PRs this week had obvious comments flagged
**Notes**: Add more examples of what counts as "obvious"
Template location: .cursor/skills/adajoon-skill-improvement/logs/patterns.md
During code reviews, systematically check:
Checklist:
Quick log:
# In PR comments, tag skill issues with:
[SKILL:adajoon-conventions] Use f-strings instead of .format()
[SKILL:adajoon-security] Missing input validation on user_id parameter
[SKILL:NEW] Consider documenting this React context pattern
After fixing any bug, create a learning entry:
## Learning Entry #042
**Date**: 2026-04-04
**Category**: Database
**Mistake**: Missing database transaction caused partial updates
**What Happened**: User profile updated but related preferences failed
**Why It Happened**: Transaction not wrapped properly in async context
**The Fix**:
\`\`\`python
async with db.begin():
await db.execute(update_user)
await db.execute(update_preferences)
\`\`\`
**Skill Update**: Added transaction patterns to adajoon-database skill
**Prevention**: Added example of multi-table updates requiring transactions
Template location: .cursor/skills/adajoon-skill-improvement/learnings/YYYY-MM-DD-issue-number.md
Before adding new patterns to skills, validate them:
## Assumption Test
**Hypothesis**: Using SELECT FOR UPDATE improves concurrent vote handling
**Test Plan**:
1. Add FOR UPDATE to vote queries
2. Run concurrent vote test (100 simultaneous votes)
3. Measure deadlocks, race conditions, performance
**Results**:
- Deadlocks: 0 (was 12 without FOR UPDATE)
- Race conditions: 0 (was 5 without)
- Performance: +15ms per query (acceptable trade-off)
**Conclusion**: ✅ Add to adajoon-database skill
**Added**: Section "Concurrent Updates" with SELECT FOR UPDATE pattern
Run through skill checklist:
# Create pre-commit mental checklist
echo "Running skill self-review..."
# For Python changes:
- [ ] Type hints on all functions? (adajoon-conventions)
- [ ] Using async/await? (adajoon-conventions)
- [ ] Imports organized? (adajoon-conventions)
- [ ] No secrets in code? (adajoon-security)
- [ ] Input validation? (adajoon-security)
- [ ] Database transactions? (adajoon-database)
# For JavaScript changes:
- [ ] const/let (no var)? (adajoon-conventions)
- [ ] Arrow functions? (adajoon-conventions)
- [ ] Async/await not .then()? (adajoon-conventions)
- [ ] XSS prevention? (adajoon-security)
- [ ] CSRF token included? (adajoon-security)
# For deployment:
- [ ] Environment variables set? (adajoon-deployment)
- [ ] Database migrations? (adajoon-database)
- [ ] Health checks work? (adajoon-deployment)
Within 48 hours of deployment, review:
## Post-Deployment Review
**Deployment**: v1.2.3 (2026-04-04)
**Changes**: Added channel health filtering
**Questions**:
1. Did it work as expected? ✅ Yes
2. Any unexpected issues? ⚠️ Slow query on large datasets
3. User feedback? ✅ Positive
4. Skills followed? ⚠️ Missing index on health_status column
5. Skill gaps discovered? Yes - need query optimization section
**Actions**:
- [ ] Add index to health_status column
- [ ] Update adajoon-database with index strategy for enum columns
- [ ] Document N+1 query prevention pattern
Every Friday, review the week:
## Weekly Review: 2026-04-04
**Code Written**: 15 files changed, 847 additions
**PRs Merged**: 7
**Patterns Observed**:
- ✅ Excellent: Type hints used consistently (100%)
- ✅ Good: Async/await usage (95%)
- ⚠️ Needs work: Test coverage on edge cases (60%)
- ❌ Problem: 3 instances of missing input validation
**Skill Violations**:
- adajoon-security: 3x missing validation (channels.py, auth.py, votes.py)
- adajoon-conventions: 2x obvious comments
- adajoon-database: 1x missing transaction
**Next Week Focus**:
1. Add input validation examples to adajoon-security
2. Review all endpoint handlers for validation
3. Create validation helper functions
**Skill Updates Made**:
- Updated adajoon-security with validation patterns
- Added comment anti-patterns to adajoon-conventions
First of each month, analyze trends:
## Monthly Skill Audit: March 2026
**Stats**:
- Total commits: 134
- Skill violations: 18 (13% of commits)
- Bugs found: 7
- Skills updated: 4
**Which skills are most violated?**
1. adajoon-security (8 violations) - Input validation unclear
2. adajoon-conventions (6 violations) - Comment guidelines vague
3. adajoon-database (4 violations) - Transaction patterns missing
**Which skills prevent most bugs?**
1. adajoon-security (prevented 12 potential vulnerabilities)
2. adajoon-database (prevented 5 data integrity issues)
3. adajoon-conventions (prevented 3 type errors)
**Which skills need clarification?**
- adajoon-security: Add comprehensive input validation section
- adajoon-conventions: More comment anti-pattern examples
**What's missing from our skills?**
- Error handling patterns (create adajoon-error-handling skill?)
- Testing strategies (create adajoon-testing skill?)
- Performance optimization (add to existing skills?)
**Actions**:
- [ ] Expand adajoon-security validation section
- [ ] Add 10 more comment examples to adajoon-conventions
- [ ] Research need for error-handling skill
Process:
Example workflow:
# PR Comment
Found SQL injection vulnerability in search endpoint.
[Action]:
1. ✅ Fix the code in this PR
2. ✅ Check adajoon-security skill - has SQL injection section but no FastAPI examples
3. ✅ Add FastAPI parameterized query example
4. ✅ Update skill version to v1.3
5. ✅ Notify team of skill update
Process:
Template:
## Bug → Skill Update
**Bug**: Race condition in concurrent vote handling
**Root Cause**: Missing database-level locking
**Fix**: Added SELECT FOR UPDATE
**Skill Updated**: adajoon-database
**Section**: "Concurrent Updates"
**Prevention**: Added to code review checklist
**Validation**: Created integration test for concurrent operations
Process:
Example:
## Performance → Skill Update
**Issue**: Channel listing taking 2.5s with 10k channels
**Root Cause**: N+1 query loading categories
**Fix**: Added joinedload for eager loading
**Measurement**: Reduced to 150ms (94% improvement)
**Skill Updated**: adajoon-database v1.4
**Section**: Added "Query Optimization" with joinedload examples
**Rule Added**: Always use joinedload for known relationships
Process (highest priority):
Template:
## SECURITY INCIDENT → SKILL UPDATE
**Incident**: API key exposed in client-side code
**Severity**: CRITICAL
**Impact**: Potential unauthorized access
**Immediate Fix**: Rotated keys, moved to server-side only
**Skill Updated**: adajoon-security v2.0 (MAJOR)
**Changes**:
- Added "Never expose API keys in frontend" rule
- Added pre-commit hook to scan for common key patterns
- Added checklist item: "Verify no secrets in frontend bundle"
**Audit**: Scanned entire codebase - found 2 more instances, fixed
**Prevention**: Added .env.example with dummy values
**Team Notified**: 2026-04-04 via Slack + email
Use semantic versioning for skills:
Format: vMAJOR.MINOR.PATCH
Version header (add to skill file):
---