Decision guide for delegating to caveman-style subagents. Tells the main thread WHEN to spawn `cavecrew-investigator` (locate code), `cavecrew-builder` (1-2 file edit), or `cavecrew-reviewer` (diff review) instead of doing the work inline or using vanilla `Explore`. Subagent output is caveman-compressed so the tool-result injected back into main context is ~60% smaller — main context lasts longer across long sessions. Trigger: "delegate to subagent", "use cavecrew", "spawn investigator/builder/reviewer", "save context", "compressed agent output".
Quick-reference card for all caveman modes, skills, and commands. One-shot display, not a persistent mode. Trigger: /caveman-help, "caveman help", "what caveman commands", "how do I use caveman".
Ultra-compressed communication mode. Cuts token usage ~75% by speaking like caveman while keeping full technical accuracy. Supports intensity levels: lite, full (default), ultra, wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman. Also auto-triggers when token efficiency is requested.
Compresses natural language files (markdown, text) into caveman-speak to reduce input token usage ~46%. Backs up original before overwriting. Only touches prose — code blocks stay exact. Trigger: /caveman:compress <filepath>, or user asks to compress a memory/doc file.
White-box code security audit. 5-phase protocol covering 55+ vulnerability types across 9 languages (Java, Python, Go, PHP, JS/TS, C/C++, C#, Ruby, Rust) and 10 security dimensions (D1-D10). Dual-track model: sink-driven + control-driven. Taint analysis, anti-hallucination verification. Writes CODE-AUDIT.md — read-only, no code changes. Human triages findings. Integrates Semgrep MCP when available.
Security-focused code review. Scans the current branch diff for vulnerabilities: injection, broken auth, authorization bypasses, cryptographic weaknesses, sensitive data exposure, and supply chain risks. Writes findings to SECURITY-REVIEW.md — read-only, no code changes. Human decides what to fix. Integrates Semgrep MCP when available.
Active web security scanner. Probes a live URL for security misconfigurations, exposed sensitive files, HTTP security headers, SSL/TLS issues, CORS policy, and information disclosure. Uses only curl + python3 — no extra tools needed. Only scan targets you own or have explicit written authorization to test.
Systematically QA test a web application using Playwright MCP. Use when asked to "qa", "QA", "test this site", "find bugs", "dogfood", or review quality. Modes: diff-aware (auto on feature branches), full, quick, regression. Produces structured report with health score, screenshots, and repro steps.