Project-specific commit message format (verb-led, sentence case, single line, no conventional-commits prefix). Use when drafting a commit message, staging changes for commit, amending, squashing, or when user asks to commit, or runs git commit.
Evaluate, benchmark, compare, and optimize descriptions for existing skills. Use when users want to run evals to test a skill, benchmark skill performance with variance analysis, do blind A/B comparisons between skill versions, or optimize a skill's description for better triggering accuracy. Do NOT use for creating skills from scratch — see write-a-skill for that.
Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".
Turn a PRD into a multi-phase implementation plan using tracer-bullet vertical slices, saved as a local Markdown file in docs/plans/. Use when user wants to break down a PRD, create an implementation plan, plan phases from a PRD, or mentions "tracer bullets".
Write a structured PRD from design decisions, rough ideas, or conversation context. Use when user wants to write a PRD, create requirements, document a feature spec, or bridge design decisions into a product requirements document. Bridges the gap between design exploration (grill-me) and implementation planning (prd-to-plan).
Fix vulnerabilities identified by /security:review using the Fix-Verify Loop. Use when: user says "fix security findings", "remediate vulnerabilities", or invokes /security:fix with a report path. Requires an existing security review report as input. Modifies source code — explicit opt-in only.
Load when performing dual-source security review, cross-validating Semgrep findings with Codex, or resolving conflicting vulnerability assessments. Trigger on: security audit, scan vulnerabilities, cross-validate findings, conflict resolution, confidence scoring.
Run a read-only dual-verification security audit (Semgrep + Codex cross-validation). Use when: user says "security review", "audit code", "scan for vulnerabilities", "is this safe", "check for secrets", "before merge security scan", or invokes /security:review. Produces a confidence-scored report; never modifies source code. For remediation, see /security:fix.