Triages an internally reported security concern for Open Collective codebases (engineering, ops, or security team) - validates reproducibility and impact, asserts the finding with a clear confidence level, and proposes a fix plan when applicable. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including `issue.md` (assertion and verdict), optional `plan.md` when there is a fix to plan, plus a minimal runnable PoC for full confirmation. Offers optional production impact analysis (`impact.md`) at the end when queryable traces may exist. Updates `security/memory.md` after full triage. No external researcher reply or bounty policy. Use when the user describes an internal finding, asks to validate a suspected vulnerability from the team, or wants an engineering handoff without security@ or bounty workflow.
Triages an incoming security report for Open Collective codebases - searches `priv/security-issues` and opencollective/opencollective-security first for existing documentation, validates reproducibility and impact when new, maps to official bounty policy, proposes fixes, and drafts contributor replies. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including up to three core markdown files (`reply.md`, optional `issue.md` when fully confirmed, optional `plan.md` when there is a fix to plan), plus a minimal runnable PoC for full confirmation. Updates `security/memory.md` after full triage. After triage, offers optional production impact analysis (`impact.md`) and filing on opencollective/opencollective-security. Use when the user pastes or describes a security report, asks to investigate a vulnerability, assess bounty eligibility, or draft a response to security@opencollective.com reporters.
Drafts user-facing documentation in opencollective-documentation for a requested frontend feature, then offers to commit and open a PR. Pulls latest docs first, checks open PRs via GitHub MCP for duplicates, verifies against frontend code and GitBook. Use when the user invokes /documentation-feature-pr, asks to document a feature, update user docs, or open a documentation PR for a specific workflow.
Generates a concise, end-user-oriented markdown report of Open Collective achievements for a completed engineering cycle. Pulls planned work from org project 5 and opencollective/opencollective milestone issues, then supplements with API and frontend commit history for work not tracked on the board. Use when the user invokes /generate-cycle-report, asks for a cycle recap, achievements report, or what shipped in the past cycle.
Drafts paste-ready email replies to Open Collective support tickets by researching user-facing documentation and product behavior. Searches GitBook docs and the local documentation repo for relevant pages and includes links when helpful. Use when the user pastes a support ticket, asks to reply to a support email, draft a help desk response, or invokes /support-ticket-reply.
Batches translation of opencollective-frontend locale JSON using show-untranslated and set-translation scripts, with codebase lookup for message IDs when context is unclear. Use when the user asks to translate frontend strings, reduce untranslated entries for a locale, or apply translation rules to lang files.
Performs a structured security review of a specific feature, PR, or code change in the Open Collective codebase. Validates findings with a minimal runnable PoC when claiming full confirmation. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including `issue.md` per finding, optional `plan.md`, optional `impact.md`, plus PoC code. Use when asked to review the security of a new feature, a pull request, or a code change.
Drafts a product/engineering pitch from raw notes, GitHub issues, and Slack threads using the Open Collective pitch template. Use when the user invokes /generate-pitch, asks for a pitch, project brief, or scoping doc from discussion artifacts.