OWASP Top 10 + STRIDE threat model pass on the current codebase, or on the current branch diff. Emits a findings report with severity, confidence, and exploit scenario. Use alongside Claude Code's built-in /security-review for spot checks, and whenever the diff touches auth, credentials, tool policy, shell execution, or data persistence. Adapted from Garry Tan's gstack /cso (garrytan/gstack); role framing stripped.
Use when encountering any bug, test failure, or unexpected behaviour, BEFORE proposing fixes. Four-phase root-cause workflow with an Iron Law — no fixes without root cause investigation first. Merges patterns from Jesse Vincent's Superpowers (obra/superpowers) and Garry Tan's gstack (garrytan/gstack).
Use when implementing any feature or bugfix, before writing implementation code. Enforces RED-GREEN-REFACTOR with an Iron Law — no production code without a failing test first. Ported from Jesse Vincent's Superpowers plugin (obra/superpowers) under its open-source terms; adapted for MARVIN's single-assistant constraints.
Pre-landing PR review. Analyses the current branch diff against the base branch for structural issues — SQL safety, LLM trust boundary, race conditions, shell injection, enum completeness, scope drift. Domain-agnostic. Adapted from Garry Tan's gstack /review (garrytan/gstack); role-catalog framing stripped; MARVIN's REVIEW.md honoured.