ryanda9910

Review code for correctness, security, TypeScript quality, and performance. Run before any PR or deploy.

Write and review copy for this landing page. Enforces voice, tone, and specificity rules from DESIGN.md.

Run mobile QA checklist. Checks tap targets, overflow, accessibility, forms, and media on 375px viewport.

Implement UI components following the design system. Enforces token usage, component patterns, and motion rules.

Format the current file with the project's configured formatter.

A helpful productivity skill for your repo.

Frisk your skill catalog for routing collisions and scope overclaim before you ship a new skill. Triggers automatically when you are about to report a coding task done and your diff added or changed a SKILL.md (or on /friskeval). Two skills whose descriptions overlap fight for the same prompt, and a security skill that claims another's domain silently misroutes — so the agent picks the wrong skill and the user never knows. friskeval builds a TF-IDF model of every skill description, flags near-duplicate pairs and skills that carry another's discriminative vocabulary, checks that each trigger prompt still routes to its owner, and refuses to say "done" while a new skill collides with one already in the catalog.

Catch breaking changes before you call a release a patch. Triggers when you're about to bump a version, publish, or describe a change as patch/minor (or on /semver-guard). It reads the diff to the public surface — exports, function signatures, types, return shapes, defaults — classifies each change as breaking / additive / internal, and refuses to let a breaking change ship under a patch or minor label.

Pat down your own diff for security holes before claiming a coding task is done. Triggers automatically when you are about to report work complete (or on /patdown). Audits only what changed for secrets, injection, SSRF, broken authz, path traversal, unsafe eval/deserialization, and weak crypto — applies the safe fixes, escalates the rest, and refuses to say "done" while a high-severity issue is unaddressed.

Frisk your diff for new logic that ships with no test touching it. Triggers automatically when you are about to report a coding task done and your diff added or changed a function or a branch (or on /testfrisk). Coverage percentage is a lie of averages — it can be 90% while the exact if you just added is the untested 10%. testfrisk reads the changed lines, finds the new branches and behaviors, checks whether any test actually exercises each one, and refuses to say "done" while a new code path ships with zero test hitting it.

Frisk your agent hooks for commands that auto-run on untrusted input before you ship them. Triggers automatically when you are about to report a coding task done and your diff added or changed a hook (or on /hookfrisk). A hook fires by itself, with no human in the loop — so a hook that pipes tool output or a file path into a shell, or runs curl | bash, is remote code execution on every trigger. hookfrisk reads only the changed hook definitions, flags the ones that run attacker-influenced input or unsandboxed commands, proposes the safe rewrite, and refuses to say "done" while an auto-firing hook can be turned against you.

Frisk your HTTP routes for UNGATED MUTATING endpoints before you ship. Triggers automatically when you are about to report a coding task done and your diff added or changed a route handler (or on /gatefrisk). An endpoint that writes, deletes, pays, trades, or triggers a job with no auth check is an open switch on the public internet — a crawler's GET can flip it. gatefrisk enumerates the changed routes, classifies each one mutating vs read-only, checks the mutating ones for a gate, and refuses to say "done" while a mutating route ships open.

Frisk your diff for money stored or computed as a floating-point number before you call a coding task done. Triggers automatically when you are about to report work complete and your diff touched anything money-shaped (price, amount, total, balance, fee, tax, currency math) — or on /moneyfrisk. Floats can't represent most decimal cents exactly, so 0.1 + 0.2 is 0.30000000000000004 and money silently drifts; moneyfrisk flags float-typed money, unsafe float arithmetic on currency, and lossy float<->money conversions in the changed lines, and refuses to say "done" while a money value is riding on a float.

Frisk your logging statements for leaked secrets and PII before you ship. Triggers automatically when you are about to report a coding task done and your diff added or changed any log/print line (or on /logfrisk). Audits only the changed logging for tokens, keys, passwords, emails, national IDs, phone/card numbers, and whole-object dumps of requests, users, or config — redacts what's safe to redact, escalates the rest, and refuses to say "done" while a secret or PII leak is still being logged.

Frisk your frontend before you ship it. Triggers right before you'd say a UI task is done (or on /frontfrisk). A coding agent writes UI blind — it can't see the rendered page — so it ships the bugs you only catch by looking: failing contrast, missing alt/labels, controls you can't reach by keyboard, and color or spacing that drifted off the design tokens. frontfrisk checks the changed markup/styles for exactly those, and won't call the UI done while a blocker is open.

Don't say a task is done until you can prove it. Triggers right before you'd report work finished (or on /prove-it). For every claim you're about to make — "it works", "tests pass", "the bug is fixed" — it makes you show evidence: run it and paste the real output, or cite the exact file:line. No proof, no "done"; what you couldn't verify, you say so plainly.