hogwarts

Adopt portless for stable, git-worktree-aware .localhost dev URLs following its documented best practices (pinned devDependency + portless.json + dev/dev:app script split — never a hand-rolled slug or sh -c wrapper), then wire it into Conductor via .conductor/settings.toml. Detects the stack first, wraps ONLY the JS/TS frontend dev server, and researches per-workspace isolation for backends/DB/Docker that portless can't cover. Use when asked to set up portless, fix stable dev URLs across worktrees, or make a repo Conductor-friendly for parallel agents.

Create or update GitHub issues for bug reports, feature requests, and refactor tasks using the gh CLI. Use when the user wants to file a ticket, create an issue, report a bug, request a feature, plan a refactor, or update an existing GitHub issue. Also triggers for new issue, open a ticket, file a bug, feature request, create task, or mentions wanting to track work in GitHub Issues.

Sets up, audits, or migrates release-please (Conventional-Commit versioning, changelogs, GitHub releases). Use to set up release automation, automated versioning/changelogs, or release-please; to audit, review, fix, or question an existing setup; or to switch release forms (single ↔ per-module) without breaking changelog/tag history.

Sets up a repo for Conductor end-to-end: install/setup script (automatic), selectable Run targets (with more than one, no default so nothing autostarts), and archive cleanup (automatic) — writes .conductor/settings.toml. Use when asked to set up conductor, configure a workspace, add run targets, stop conductor autostarting, make a run-button menu, or add archive/cleanup on workspace removal.

Release & supply-chain readiness audit: gathers evidence from real workflows, manifests, and repo settings, compares against a gold-standard reference stack, has an adversarial subagent try to refute the draft, and returns a prioritized action plan (P1–P3) whose fixes are delegated to the sibling setup skills. Use when asked to audit release automation, publishing security, CI or supply-chain maturity, or whether a repo is ready to release. For a whole-repo health check (docs, tests, code quality) use maturity-analysis instead.

Audits and sets up .github/dependabot.yml: recommends a grouping mode (low-noise, balanced, fine-grained) from the repo's use-case, gates setup on pinned dependency versions, wires CODEOWNERS over the deprecated reviewers key, groups security updates. Use when asked to set up, review, fix, or audit Dependabot / automated dependency updates / dependency grouping.

Sets up a GitHub branch ruleset protecting the default branch via the gh CLI: no deletion, no force-push, linear history, signed commits, PR-only changes, and a required CI status check with a dynamically resolved integration_id. Idempotent — creates the ruleset or updates an existing one. Use when asked to protect the default branch, set up branch protection or rulesets, or require status checks before merge.

End-to-end repo analysis: project overview, key files, maturity assessment with expert subagents per dimension, and real issues found. Use when asked how mature a repo is, to assess or audit a codebase, or for a project health check.

Supply-chain audit: verifies every GitHub Actions reference is pinned to a full commit SHA (not a mutable tag or branch), reports unpinned uses with evidence, and optionally rewrites them to SHA + version comment.

Supply-chain audit for Node.js (js/ts) repos: verifies every package.json dependency is pinned to an exact version (no ^ ~ >= * latest or mutable git refs), checks the lockfile is committed, reports drift with evidence, optionally rewrites to exact pins, and wires up the Miragon/pin-npm-dependencies CI guardrail + save-exact.

Sets up tokenless npm publishing via OIDC trusted publishing: no NPM_TOKEN secret, automatic provenance attestations, an idempotent skip-if-already-published step, a reusable workflow_call structure, and GitHub Environments for any unavoidable long-lived secrets. Use when asked to publish npm packages securely, remove or replace NPM_TOKEN, or set up trusted publishing / provenance.

Analyzes a repo's contributor experience and creates or updates what's missing: GitHub issue-form templates (bug/feature/refactor), an open-source target-group-focused README, CONTRIBUTING.md, and the remaining community-health files (PR template, CODE_OF_CONDUCT, SECURITY, LICENSE, CODEOWNERS). Use when asked to make a repo contributor-friendly, open-source ready, or to set up issue templates / README / CONTRIBUTING.

Export a BPMN file to an image (SVG, PNG, or PDF) using npx bpmn-to-image. Use when asked to export, render, or convert a .bpmn diagram to an image.

Analyze a GitHub repo and submit it to an awesome list via PR or issue. Usage: /make-me-awesome [REPO_TO_PROMOTE] [AWESOME_LIST_REPO]

Publish a markdown blog post to Medium via GitHub Gist import (macOS). Transforms headings to bold, creates a Gist, copies its URL to the clipboard, and opens Medium's import page for you to finish manually.

Creates a German Outlook meeting invitation with context, goals, agenda, and emojis — ready to copy-paste or auto-fill into Outlook (macOS).

Add a file pattern or command to the agento-patronum protection list. Use when the user wants to block access to a file, path, or command.

Show all patterns currently protected by agento-patronum. Use when the user asks what is protected, whether a specific file or command is blocked, or wants to review the current protection shield.

Remove a pattern from the agento-patronum protection list. Use when the user wants to unblock access to a file or command.

Suggest protection patterns based on project context. Invoke automatically when user mentions a new tech stack, cloud provider, or sensitive tooling. Also invoke when user asks what to protect.

Run agento-patronum self-test to verify hook enforcement is working.

Clear (truncate) the Revelio log after explicit user confirmation. Use when the user asks to wipe, clear, reset, or obliviate the Revelio log, or runs /revelio-clear.

Reveal recent failed tool calls, API errors, and permission denials from the per-repo Revelio log. Use when the user asks to see what went wrong, what failed, or runs /revelio.

Add a new default pattern to defaults/patronum.json with correct schema and validation.

Set up the agento-patronum development environment. Check prerequisites, install docs dependencies, validate plugin structure.

Validate the agento-patronum plugin structure. Run before opening a PR.