Scans a real codebase and writes coding-conventions.md from what it actually finds — variable style, SQL patterns, error handling, INSERT strategy, naming. Run once on any new project to bootstrap the convention system. Triggers on "scan conventions", "generate conventions", "bootstrap conventions", "extract conventions from code", "what are the conventions".
Security audit — checks auth, SQL injection, exposed endpoints, and sensitive data. Triggers on "security check", "is this secure", "check for vulnerabilities", "check auth", "audit security", "security audit".
Use when switching environments, updating config values, or verifying URLs/settings. Triggers on "check environment", "switch to production", "update URLs", "check config", "is this prod-ready".
Use when verifying a feature works, after making changes, or before shipping. Triggers on "verify this works", "test this", "does this work", "run the checklist", "before I ship", "check this end to end".
Use when cleaning up, simplifying, or restructuring existing code without changing behavior. Triggers on "refactor", "clean up", "simplify this", "this is getting messy", "too long", "hard to read", "extract this".
Use when the user wants to review a file for bugs, antipatterns, or quality issues. Triggers on "review", "check for issues", "look for problems", "audit", "before I ship".
Use when the user reports a LOGIC bug — wrong behavior, incorrect output, or a feature not working as designed. Triggers on "fix the bug where", "it's broken", "not sending", "not saving", "wrong result", "something broke".
Commits to a bold design direction before writing a single line of CSS. Generates a complete design system — palette, font pairing, style direction, and UX rules. Triggers on "build a landing page", "design this UI", "create a component", "design system for", "new page design", "frontend design".