pi-gstack

Security audit: secrets archaeology, dependency supply chain, CI/CD pipeline, webhook audit, LLM/AI security, skill supply chain, OWASP Top 10, STRIDE threat model. Two modes: daily (8/10 confidence gate) and comprehensive (2/10). Use when asked to "security audit", "threat model", "vulnerability scan".

Systematic debugging: trace symptoms to root cause, test hypotheses, fix with minimal diff and regression test. Iron Law — no fixes without confirmed root cause. Use when asked to "debug", "fix this bug", "why is this broken", "root cause analysis". Proactively suggest when user reports errors or unexpected behavior.

YC Office Hours style product discussion. Six forcing questions that challenge assumptions before any code is written. Produces design documents, not code. Use when asked to "office hours", "product discussion", "validate idea", or before starting a new feature. Proactively suggest when user describes a product idea.

Strategic plan review with 4 scope modes (Expansion, Selective, Hold, Reduction). Challenges premises, generates alternatives, reviews architecture, error handling, deployment, and observability. Produces scoped implementation plan. Use when asked to "review this plan", "CEO review", "scope review", or after /skill:office-hours produces a design doc.

Weekly engineering retrospective. Analyze commit history, work patterns, file hotspots, and code quality metrics across a time window. Use when asked to "retro", "retrospective", "weekly review", "what did I ship". Proactively suggest end of week.

Designer's eye plan review. Rates design dimensions 0-10, identifies what would make each a 10, then fixes the plan. Use when asked to "review design plan", "design critique", or after /skill:plan-eng-review for UI-heavy features.

Developer experience plan review. Explores developer personas, benchmarks against competitors, designs magical moments, traces friction points. Three modes: DX EXPANSION (competitive), DX POLISH (bulletproof), DX TRIAGE (gaps only). Use when asked to "DX review", "developer experience audit", or for API/CLI/SDK/library plans.

Engineering manager plan review. Lock in architecture, data flow, diagrams, edge cases, and test coverage before implementation. Use when asked to "review architecture", "engineering review", "lock in the plan", or before starting to code. Proactively suggest after /skill:plan-ceo-review completes.

Pre-landing PR review. Analyze diff against base branch for SQL safety, race conditions, scope drift, shell injection, and structural issues. Use when asked to "review", "code review", or before merging. Proactively suggest when code changes are ready for review.

Auto full review pipeline. Runs office-hours → CEO review → Eng review → Design review → DX review in sequence, auto-deciding where safe and asking where needed. Use when you want to "review everything", "run the full pipeline", or before major implementation work.

Performance regression detection. Measures page load times, resource sizes, and Core Web Vitals. Compares against baselines and flags regressions. Use when asked to "benchmark", "performance test", "check page speed", or before/after performance-sensitive changes.

Post-deploy production monitoring. Watches the live site after deploy — checks pages load, captures screenshots, detects console errors, compares against baselines. Use after /skill:land-and-deploy to verify production health.

Post-ship documentation update. Cross-reference the diff against all project docs, update outdated paths/commands/counts, flag risky changes. Use after /ship, before merge. Proactively suggest when a PR changes project structure or features.

Code quality dashboard. Runs type checker, linter, tests, dead code detection, and shell linting. Scores each category 0-10 and tracks trends. Use when asked to "health check", "code quality", "dashboard", or "how healthy is this codebase".

Merge PR, wait for CI, verify deploy, and check production health. Picks up where /ship left off. Use when PR is approved and ready to land. Proactively suggest after /ship creates a PR.

QA testing without fixing. Find bugs, document with screenshots and repro steps, generate report. Does NOT modify source code. Use when asked to "find bugs", "test and report", or when you want a read-only QA pass.

Browser-based QA testing. Navigate pages, test forms and interactions, find bugs, fix with atomic git commits, re-verify, generate regression tests. Use when asked to "qa", "test this site", "find bugs", "test and fix". Proactively suggest when a feature is deployed and ready for verification.

Extract structured data from web pages. Drives the browser to pull JSON from pages without writing custom scrapers. Read-only — never submits forms or clicks mutating buttons. Use when asked to "scrape", "extract data from this page", or "get JSON from this site".

Configure deployment for a project. Auto-detects platform (Fly.io, Render, Vercel, Netlify, Heroku, Railway, GitHub Actions), guides through setup, and writes deploy configuration. Use when starting a new project that needs deployment, or when switching deploy targets.