Security audit: secrets archaeology, dependency supply chain, CI/CD pipeline, webhook audit, LLM/AI security, skill supply chain, OWASP Top 10, STRIDE threat model. Two modes: daily (8/10 confidence gate) and comprehensive (2/10). Use when asked to "security audit", "threat model", "vulnerability scan".
Systematic debugging: trace symptoms to root cause, test hypotheses, fix with minimal diff and regression test. Iron Law — no fixes without confirmed root cause. Use when asked to "debug", "fix this bug", "why is this broken", "root cause analysis". Proactively suggest when user reports errors or unexpected behavior.
YC Office Hours style product discussion. Six forcing questions that challenge assumptions before any code is written. Produces design documents, not code. Use when asked to "office hours", "product discussion", "validate idea", or before starting a new feature. Proactively suggest when user describes a product idea.
Strategic plan review with 4 scope modes (Expansion, Selective, Hold, Reduction). Challenges premises, generates alternatives, reviews architecture, error handling, deployment, and observability. Produces scoped implementation plan. Use when asked to "review this plan", "CEO review", "scope review", or after /skill:office-hours produces a design doc.
Weekly engineering retrospective. Analyze commit history, work patterns, file hotspots, and code quality metrics across a time window. Use when asked to "retro", "retrospective", "weekly review", "what did I ship". Proactively suggest end of week.
Designer's eye plan review. Rates design dimensions 0-10, identifies what would make each a 10, then fixes the plan. Use when asked to "review design plan", "design critique", or after /skill:plan-eng-review for UI-heavy features.
Developer experience plan review. Explores developer personas, benchmarks against competitors, designs magical moments, traces friction points. Three modes: DX EXPANSION (competitive), DX POLISH (bulletproof), DX TRIAGE (gaps only). Use when asked to "DX review", "developer experience audit", or for API/CLI/SDK/library plans.
Engineering manager plan review. Lock in architecture, data flow, diagrams, edge cases, and test coverage before implementation. Use when asked to "review architecture", "engineering review", "lock in the plan", or before starting to code. Proactively suggest after /skill:plan-ceo-review completes.