Menu
Use when the user wants a security review of code or a diff — OWASP/CWE findings with severity, taint/data-flow analysis, and concrete fixes via security_review
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when the user wants tests generated for code or a diff — enumerates edge cases and failure modes first, then emits runnable test code via testgen
Use when a task would benefit from a structured thinking technique but you're not sure which — recommends the right prompt technique for the intent (debug, spec, refactor, decision, design) and applies it
Use for decisions or judgments worth multiple independent perspectives — multi-model council with parallel analysis, search grounding, and synthesis (30-60s); for a quick single-call verdict use the jury tool directly
Use when the user shares or finishes a plan and wants it stress-tested before execution — adversarial multi-model pre-mortem with ranked risks, mitigations, and concrete plan edits
Use when code changes are ready for review — a diff exists, the user says "review my changes/PR", or a commit is about to happen. Multi-model diff review (Kimi, DeepSeek, GPT-5.5 panel + Gemini judge) with a MERGEABLE verdict
Use when TachiBot tools seem missing, a provider isn't working, or the user asks to set up/configure TachiBot or its API keys — runs doctor and walks through fixing the gaps
| name | audit |
| description | Use when the user wants a security review of code or a diff — OWASP/CWE findings with severity, taint/data-flow analysis, and concrete fixes via security_review |
| user-invocable | true |
Run a dedicated security audit with the security_review tool — it carries an attacker mental model (taint/data-flow, OWASP/CWE), not a generic code review.
git diff) to check changed code only, or code / files for a whole component.language/framework, and context for the trust boundaries (e.g. "public internet-facing API", "internal service behind VPN", "handles untrusted uploads").standard: owasp, cwe, or both (default).security_review({ code | diff | files, language?, context?, standard? }).For code you are authorized to review. Requires OPENROUTER_API_KEY. If the tool returns its missing-key error, relay it and suggest /setup.