Vanta

Route a task to the least intrusive executive-function support based on the user's stated current capacity, memory load, activation, and motivation. Use when work feels stuck, overwhelming, hard to hold in mind, or when the user asks for neurodivergent-friendly support without wanting a diagnostic or coaching ritual.

Reduce work to the smallest safe and useful outcome when capacity is low or burnout is present. Use when the user explicitly says they are depleted, overwhelmed, unable to start, or asks for the minimum viable version of a task.

Create a truthful activation bridge for a task that has low urgency, novelty, interest, challenge, or immediate feedback. Use when the user says they are stuck or avoiding a known task despite understanding it.

Reduce language, sensory, and uncertainty load while preserving complete information. Use when the user requests direct or scannable communication, has low capacity, is navigating a new flow, or needs explicit expectations and examples.

Turn a vague, oversized, or initiation-resistant outcome into an executable sequence with a visible first action and definition of done. Use when dependencies are hidden, the task spans multiple systems, or the user cannot identify where to begin.

Externalize time, checkpoints, stopping rules, and context transitions. Use when estimates are uncertain, a task may expand indefinitely, the user is switching topics, or an interruption risks losing the current state.

Move task state out of conversation and into a compact durable working surface. Use when the user must remember several dependencies, a task spans multiple turns or agents, or interruptions and context switching could lose the thread.

Scan dependencies for known CVEs across ecosystems — npm audit, cargo audit, osv-scanner (multi-ecosystem, catches what npm audit misses), pip-audit. Triage by reachability (runtime vs dev) and severity before mass-bumping.

Static application security testing of YOUR code (not deps) — semgrep with the security rulesets, CodeQL for deeper dataflow. Find injection, path traversal, unsafe exec, hardcoded crypto. Triage false positives by tracing reachability, don't blanket-ignore.

Find committed secrets before they ship. gitleaks over full history + staged, Vanta's own secret-scan, plus the remediation order (rotate FIRST, then scrub). Run before any repo goes public or any release tag.

The composed security gate before going public or cutting a release: secret-scan + dependency-audit + sast-scan, in order, with a clear pass/triage report. The security sibling of ship-preflight — refuses to wave through unrotated secrets or shipped-runtime CVEs.

Use when generating ideas, framing a problem, breaking a fixation, or validating a plan and you want ONE deliberate creative method instead of generic brainstorming. Routes a problem's signals (phase / domain / specificity / feasibility↔creativity balance) to ONE of 22 named methods from artists, scientists, and designers — Eno, Dalí-adjacent Jarry, Cage, de Bono, Pólya, Alexander, Meadows, Vonnegut, Tharp and more — and runs its procedure. Backed by a deterministic, tested router (src/solutioning/ideation.ts), so the choice is reproducible, not vibes. Feeds the solutioning / cofounder pillar.

Build or update an organized operator profile in Vanta's brain so Vanta can draft in the operator's voice, review documents and websites to their standard, and recommend purchases by their criteria. Gathers ONLY from authorized sources (Vanta brain/memory, mounted vault, files the operator names, public web, the live conversation), self-scores sufficiency against those three goals, and saves to the user_model brain region. NEVER stores IDs, payment data, passwords, tokens, or secrets. Use when the operator says "learn about me", "build my profile", "remember everything about me", or asks Vanta to write in their voice or review to their standard.

Pre-deploy gate: typecheck (must exit 0) -> full test suite (all pass) -> build. Any red = stop and report which gate failed. Green = print the deploy command, never run it.

4-phase root cause debugging: understand bugs before fixing.

Design any review/retention schedule to beat the forgetting curve: expanding intervals + active recall, distributed not massed. Load before building a study plan, an onboarding drip, a doc/skill re-review cadence, or a flashcard/retention feature.

First 10 minutes of an incident — stabilize, then diagnose

Reproduce and isolate a flaky test before fixing it

Turn a range of commits into a user-facing changelog

Use when asked to create, generate, author, or bootstrap a NEW skill from a natural-language description. Turns "make me a skill that does X" into a stored SKILL.md by drafting valid frontmatter + body and writing it with the existing write_skill tool — dogfooding the skill system.

Run a large, parallelizable code change across many worker agents in isolated git worktrees, opening one PR per completed task.

Use when adding a new swappable Vanta capability, provider, backend, transport, model route, registry, scorer, evaluator, or tool family. Prescribe the port+adapter pattern: define an interface, implement concrete adapters behind one resolver, keep consumers typed to the port, and add tests/boundaries so new code does not deepen concrete coupling.

The judgment layer for building in the agentic era (Boris Cherny): what to point the machinery at - coding-is-solved, product overhang, build-for-the-next-model, domain > coding, one-week planning, generalist + route-to-specialists, and which moats AI shifts.

Scaffold a new MCP server from a tool description, build it, and mount it into the active Vanta session.

Design and run a safe standing job (loop / routine) in Vanta: the inspect-act-guard-report shape, the Never-gate, an explicit stop condition, and how to schedule it. Load before building any keep-green / prod-watch / cluster-feedback job.

Cross-examine a non-trivial decision in-flight — before it stands — with a fresh-context reviewer biased to disprove. The in-flight complement to adversarial-verify (which refutes finished output). Use for branching logic, boundary crossings, properties the compiler can't check (thread-safety, idempotence, ordering, invariants), or irreversible blast radius (deploy, migration, public API).

Ground framework- and library-specific code in official documentation, not training data. Detect the installed version, fetch the relevant doc page, implement to the documented pattern, cite the source with a deep link, and flag anything you could not verify. Use when correctness depends on a specific framework or library version (routing, data fetching, forms, auth, state, build config).

Use after completing any Vanta build slice, phase, or structural change (new module, layer, tool, provider, command, env var, API route, or locked decision). Keeps the per-level AGENTS.md context files, README, PRD checkboxes, and project memory accurate and dense so future sessions and subagents don't re-derive context or burn tokens trusting stale docs.

Idea-stage skill: designs a complete customer discovery system — target profile, interview framework, question set, post-interview synthesis. Use when someone says: customer discovery, user interviews, who should I talk to, design interview questions, synthesize interview notes, build outreach list.

Launch/Scale-stage skill: audits every workflow, decision, and approval currently routed through the founder, then categorizes each as automate / delegate / keep. Produces a bottleneck map and automation candidates list. Use when someone says: founder bottleneck, I'm the bottleneck, audit my workflows, what can I automate, operational audit, delegation map, build systems to replace me.

Scale-stage skill: builds GTM function resources from scratch — market segmentation, messaging architecture, sales playbook, analyst/investor narrative. Use when someone says: build GTM, go to market, sales playbook, messaging, market segmentation, investor narrative, analyst briefing, enterprise sales, grow beyond organic.

MVP-stage skill: creates a locked scope document defining exactly what the MVP does, what it deliberately does not do, and the specific user-evidence threshold for adding anything new. Use when someone says: define MVP scope, what should I build, scope document, mvp definition, what's in scope, prevent scope creep, define done.

MVP-stage skill: diagnoses whether genuine product-market fit exists or if traction is a false positive. Runs Sean Ellis test, effort test, and iteration analysis. Returns a verdict: stay / adjust / pivot / back-to-idea. Use when someone says: do we have PMF, is this real traction, should I pivot, product-market fit check, analyze retention, what do my numbers mean.

Idea-stage skill: sharpens a vague problem statement into a testable hypothesis, then runs adversarial pressure-testing and surfaces disconfirming evidence. Use when someone says: validate my idea, pressure-test this, is this problem real, help me find problem-solution fit, devil's advocate, sharpen my hypothesis.

Auto-minimalism: before writing code, climb the YAGNI→stdlib→native→dep→one-line ladder; prefer reuse and deletion over new code; mark deliberate shortcuts with their ceiling. Generative discipline applied while building — complements cc-simplify (post-hoc review).

Weekly engineering retrospective. Analyzes commit history, work patterns, and code quality metrics with persistent history and trend tracking. Team-aware with per-person contributions, praise, and growth areas. Use when asked for weekly retro, what shipped this week, or engineering retrospective.

Review changed code for correctness bugs and reuse/simplification cleanups. High-confidence findings only.

Launch and drive this project's app to see a change working in context.

Review changed code for reuse, simplification, efficiency, and altitude cleanups. Quality only — no bug hunt.

Verify a code change actually works by running the app and observing behavior. Tests pass ≠ change works.