schmug

Spawn a Claude worker to handle a GitHub issue. Fetches issue details, creates a feature branch, and works autonomously. Use when you want to delegate an issue to a worker.

Spawn a Claude worker in an isolated git worktree for parallel development. Use when you need to work on a task in isolation without affecting current work.

Spawn a Claude worker to handle a GitHub issue. Fetches issue details, creates a feature branch, and works autonomously. Use when you want to delegate an issue to a worker.

Launch the Karkinos TUI to monitor worker progress in a new terminal window.

Bump the version number in pyproject.toml, plugin.json, and marketplace.json, then commit and tag.

Spawn a Claude worker to address PR feedback, fix CI failures, or continue work on a pull request. Use when a PR needs updates based on review comments or failing checks.

Spawn a Claude worker to address PR feedback, fix CI failures, or continue work on a pull request. Use when a PR needs updates based on review comments or failing checks.

Remove completed or abandoned worker worktrees and their branches. Use to clean up after workers finish their tasks.

Build a threat model for a target codebase and write THREAT_MODEL.md. Two modes: "bootstrap" derives a threat model from the code plus past vulnerabilities (git history, CVEs, issue tracker) with no owner present; "interview" walks an application owner through the four-question framework. Both write THREAT_MODEL.md in the shared schema (schema.md). Use when asked to "threat model", "build a threat model", "map the attack surface", or "what should we be worried about in this codebase". Read-only — never builds, runs, or fetches the target's live deployment. Adapted for dmarcheck (a TypeScript Cloudflare Worker) from anthropics/defending-code-reference-harness.

Static source-code vulnerability scan for the dmarcheck TypeScript Cloudflare Worker. Reads a target directory (and THREAT_MODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /vuln-triage to consume. Read-only — no building, running, or network. Category menu is tuned for web/Worker bugs (SSRF, authz/IDOR, auth bypass, injection, XSS, signature verification, secrets, redirect posture), not C/C++ memory corruption. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in <dir>", or as the step between /threat-model and /vuln-triage.

Adversarially triage a batch of raw security-scanner findings (e.g. from /vuln-scan's VULN-FINDINGS.json). Verify each is real, collapse duplicates, re-rank by derived exploitability rather than the scanner's claimed severity, and route each to a component owner. Writes TRIAGE.json + TRIAGE.md sorted by what actually needs attention. Read-only — never executes target code or reaches the network. Named vuln-triage to avoid colliding with the repo's issue/PR /triage skill. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the security backlog". Adapted for dmarcheck from anthropics/defending-code-reference-harness.

Invariants and conventions for DMarcus, the dmarcheck mascot (the @ creature with three legs). Use when editing src/views/components.ts, src/views/styles.ts, src/views/scripts.ts, or any view that renders the creature — to ensure sizes, moods, party-hat rules, grade-to-mood mapping, and the reduced-motion contract stay consistent.

Scaffold a new protocol analyzer for dmarcheck. Creates the analyzer module, types, orchestrator wiring, scoring hook-in, HTML component, and a test file — all matching the existing shape of src/analyzers/spf.ts and test/spf.test.ts. Use when adding support for a new DNS/email-security protocol (e.g. ARC, TLS-RPT, DANE).

Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred) or VULN-FINDINGS.json. Static-analysis input gets a per-finding patch subagent + independent reviewer and is written as inert diffs for human review. Writes PATCHES/bug_NN/{patch.diff,patch_result.json}, PATCHES.md, and PATCHES.json. Use when asked to "fix the findings", "patch these vulns", "generate fixes", or "close the loop on triage".

Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a threat model from the code plus past vulnerabilities (CVEs, git history, pentest reports) when no owner is available; "bootstrap-then-interview" chains the two when both owner and codebase are present. All write THREAT_MODEL.md in a shared schema. Use when asked to "threat model", "build a threat model", "map the attack surface", or "what should we be worried about in this codebase".

Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output and writes TRIAGE.json + TRIAGE.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the backlog". Runs interactively by default; pass --auto to skip the interview.

Static source-code vulnerability scan. Reads a target directory (and THREAT_MODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /sec-triage to consume. Read-only — no building, running, or network. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in <dir>", or as the step between /sec-threat-model and /sec-triage.

ALWAYS load when a routine has resolved a triggering issue and needs to ship one focused PR. Covers the author-trust gate, pre-flight, parallel reads, plan-comment-and-proceed, literal implementation, tiered ambiguity, size escalation, and PR open without auto-merge.

ALWAYS load when a routine fires on a `pull_request` event and needs to decide whether to auto-merge or escalate. Covers the PR-side author-trust gate, skip-on-label discipline, CI polling, the six-condition practical-minimum trust gate (provenance / linkage / risk-path / size / CI / scope), and the merge-or-escalate-once outcome.

ALWAYS load when a routine is about to act on a GitHub issue or post a comment. Enforces the skip-on-label gate, the don't-re-state-known-blockers rule, and the consolidation pin format for inherited duplicate blockers.

ALWAYS load when a Claude Code session is fired by a GitHub `issues.opened` event. Resolves the triggering issue number, then triages the body into one of three content paths (CC-format, inferable spec, or discussion).

Quick consultation with OpenAI Codex CLI. Use when you want another AI's perspective on code, architecture, or any technical question.

Quick consultation with Google Gemini AI. Use when you want another AI's perspective on code, architecture, or any technical question.

Get multiple AI perspectives (Gemini + Codex) on a question. Use for architectural decisions, security reviews, or when you want validation from other AIs.

Add a new CortechOS app to the registry — appends an AppManifest entry, bumps the mobile springboard tile-count assertion in e2e/smoke.spec.ts, and (for iframe apps) verifies the target URL allows framing. Use when the user says "add an app", "register this project as an app", or similar.

Run the same checks CI runs (format:check, lint, typecheck, vitest, playwright, build) locally for fast feedback before pushing. Use before creating a PR, marking work ready for review, or claiming a task is complete — so CI catches nothing unexpected.

Spawn a Claude worker to handle a GitHub issue. Fetches issue details, creates a feature branch, and works autonomously. Use when you want to delegate an issue to a worker.

Spawn a Claude worker in an isolated git worktree for parallel development. Use when you need to work on a task in isolation without affecting current work.