oliver-kriska

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after /phx:deps-audit findings or to initialize hex_vet.exs.

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after phx-deps-audit findings or to initialize hex_vet.exs.

Audit Hex deps for supply-chain security risk — bidi chars; Use after mix deps.update, when checking if a package…

Record vetted Hex versions after security review. Use to approve audited dependencies, not to scan them.

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after /phx-deps-audit findings or to initialize hex_vet.exs.

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

Review changed Elixir/Phoenix code read-only. Check requirements, cite evidence, deduplicate findings, and return a severity-based verdict.

Initialize plugin in a project — install Iron Laws, auto-activation rules, and reference auto-loading into CLAUDE.md. Use when setting up or updating the plugin.

Walk through the Elixir/Phoenix plugin commands, workflow, and features in 6 interactive sections. Use when a new user wants to learn what the plugin offers or needs a refresher on available commands.

Ash Framework — resources, actions, policies, aggregates, calculations, AshPhoenix.Form, LiveView, migrations. Use when generating resources via mix ash.codegen, editing changes, checks, types, validations, or domain code interfaces.

Detect N+1 query anti-patterns specifically — Repo calls inside Enum/for loops, missing preloads on associations. Use when N+1 is explicitly suspected, NOT for unrelated Ecto questions or wider database performance.

Ecto patterns — schemas, changesets, queries, migrations, Multi, associations, preloads, upserts. Use when editing Repo calls, Ecto.Query, or schema fields. Skip for Ash.

OTP/BEAM patterns and Elixir idioms — GenServer, Supervisor, Task, Registry, pattern matching, with chains, pipes. Use when designing processes or debugging BEAM issues.

Read, write, and search a scribe-managed knowledge base (markdown vault with frontmatter conventions, wikilinks, and qmd hybrid search). Use when the user's project has a scribe.yaml (KB root) or a .claude/kb-name/ drop-file directory (consumer side), or when…

Clean up a scribe knowledge base — split bloated articles, expand or merge thin stubs, archive overgrown rolling files, and merge KB-self-named directories. Use when `scribe lint` reports content-quality warnings (bloated article, thin article, rolling file…

Set up and operate the scribe CLI — install/init personal or team KBs, diagnose with doctor/status, run sync/extraction, manage cron and Full Disk Access, and pick the right command for a maintenance goal. Use when the user wants to install or run scribe,…

Audit and re-deploy the getscribe.dev marketing site whenever scribe ships a new release. Use this whenever a new scribe version is tagged or pushed, a new CHANGELOG entry lands, or the user says anything like "sync the site", "update getscribe.dev", "the…

Read the user's GitHub pull-request dashboard with `prmarmot-cli` — their own PRs and what blocks them (CI, conflicts, reviews, unresolved comments, missing reviewers), their review queue, every open PR in one repository, what changed since they last looked,…

Cut and publish a PR Marmot release end-to-end — pick the next version from the unreleased commits, bump the app and CLI versions + Cargo.lock + CHANGELOG with `make bump`, commit, and push the vX.Y.Z tag that makes CI build, sign, notarize, publish, and…

Screenshot-verify what the running prboard GPUI window actually renders. Use this EVERY time visual confirmation is needed — after any UI/theme/layout change, before claiming a visual fix works, when checking light vs dark mode, or when a screenshot looks…

Connects Amp and Claude Code through amp-bridge. Use when either agent needs to ask, answer, delegate to, or troubleshoot the other side, including channel events, ask Amp, ask Claude, send to Amp, reply failures, or no live sessions.

Connects Amp and Claude Code through amp-bridge. Use when either agent needs to ask, answer, delegate to, or troubleshoot the other side, including channel events, ask Amp, ask Claude, send to Amp, reply failures, or no live sessions.