JCE-Opencode-Tools

Framework-agnostic website security audit and authorized pentest methodology (OWASP, red-team attacker mindset, white-hat reporting). Use for web pentest, vulnerability assessment, attack-surface review, bug bounty prep, or security audit of any web stack.

Critical path identification, risk-adjusted effort sizing, complexity detection, and execution strategy selection. Use when scoping a task, deciding direct-vs-planned execution, breaking down large work, or assessing how many steps something really needs.

Multi-phase workflows, state machines, DAG task execution, checkpoint/resume, and saga patterns for complex multi-step or multi-session work. Use when a task spans 5+ steps, multiple files, multiple sessions, or has irreversible phases.

Understanding legacy and unfamiliar code, git blame/history analysis, dependency archaeology, and reconstructing intent behind existing code. Use when working in unfamiliar codebases, investigating "why was this written this way", or before changing code you didn't write.

Retry strategies, rollback protocols, circuit breakers for delegations, escalation chains, and failure budgets. Use when verification fails, a fix doesn't work, a sub-agent returns weak output, or you are stuck in a failure loop.

Production incident triage, rollback procedures, blast radius assessment, severity classification, and post-mortem templates. Use when production is down, a deploy broke something, users are impacted, or you need to stabilize before fixing root cause.

Consensus protocols, conflict resolution between sub-agents, evidence merging, parallel evaluation, and delegation output grading. Use when coordinating multiple sub-agents, resolving contradictory findings, or making high-stakes decisions that warrant independent verification.

UI design, frontend, dashboard, landing page, component, Tailwind, Figma, generated AI, human-crafted interface. Use when designing or reviewing frontend UI so output avoids generic AI-looking visuals while staying accessible and backend-aware.

UI pattern catalog for frontend, dashboard, landing page, SaaS, fintech, ecommerce, developer tools, admin, marketplace, healthcare, mobile web, forms, tables, onboarding, settings, and empty states. Use when choosing product-specific interface patterns.

Visual QA, screenshot review, browser review, Playwright, responsive QA, accessibility QA, UI polish, design review, visual regression, anti-AI UI rubric. Use when validating frontend visuals or reviewing screenshots.

Safe Git workflow guardrails. Use when committing, pushing, branching, merging, rebasing, tagging, or blocking dangerous git operations.

Plan challenge with docs, domain language, context files, and ADRs. Use when reviewing plans, architecture choices, PRDs, domain models, or decisions before implementation.

Throwaway prototype workflow for uncertain UI, product, or business logic. Use when exploring designs, testing feasibility, or comparing alternatives before production implementation.

Break PRD, plan, feature, or refactor into independently grabbable issues. Use when creating GitHub issues, task breakdowns, milestones, or vertical slices.

Convert conversation, idea, or feature request into a concise product requirements document. Use when user asks for PRD, spec, requirements, scope, acceptance criteria, or product plan.

Issue and bug triage workflow. Use when classifying reports, prioritizing bugs, assigning labels, identifying repro steps, or deciding whether work is ready.

Author or improve OpenCode/JCE skills with correct frontmatter, trigger descriptions, progressive disclosure, and verification. Use when creating, editing, auditing, or packaging skills.

SOLID, 12-Factor, performance engineering, feature flags. Use when working on advanced-patterns tasks, related files, debugging, implementation, review, or verification workflows.

RAG, embeddings, vector DB, prompt engineering, LLM evaluation. Use when working on ai-llm-engineering tasks, related files, debugging, implementation, review, or verification workflows.

Token efficiency, model selection, prompt engineering. Use when working on ai-optimization tasks, related files, debugging, implementation, review, or verification workflows.

Angular, signals, RxJS, standalone components. Use when working on angular tasks, related files, debugging, implementation, review, or verification workflows.

REST maturity, GraphQL schema, gRPC, versioning, pagination, OpenAPI. Use when working on api-design-patterns tasks, related files, debugging, implementation, review, or verification workflows.

API design, databases, system design, caching, resilience. Use when working on architecture tasks, related files, debugging, implementation, review, or verification workflows.

Astro, Remix, islands architecture, SSR/SSG hybrid, loaders/actions. Use when working on astro-remix tasks, related files, debugging, implementation, review, or verification workflows.

OAuth2, OIDC, JWT, RBAC/ABAC, MFA, zero-trust, secrets rotation. Use when working on auth-identity tasks, related files, debugging, implementation, review, or verification workflows.

Solidity, gas optimization, ERC standards, DeFi, Foundry/Hardhat. Use when working on blockchain-web3 tasks, related files, debugging, implementation, review, or verification workflows.

Repository mapping, impact scanning, entry point discovery, and audit orientation. Use when working on codebase-intelligence tasks, related files, debugging, implementation, review, or verification workflows.

GDPR, SOC2, audit logging, PII handling, privacy by design. Use when working on compliance-governance tasks, related files, debugging, implementation, review, or verification workflows.

Maintaining project context across sessions. Use when working on context-preservation tasks, related files, debugging, implementation, review, or verification workflows.

C/C++, CMake, modern C++. Use when working on cpp tasks, related files, debugging, implementation, review, or verification workflows.

C#, .NET, ASP.NET Core. Use when working on csharp tasks, related files, debugging, implementation, review, or verification workflows.

High-quality sub-agent delegation, output contracts, evidence review, and follow-up discipline. Use when working on delegation-quality tasks, related files, debugging, implementation, review, or verification workflows.

Design tokens, Storybook, theming, component API, variants. Use when working on design-systems tasks, related files, debugging, implementation, review, or verification workflows.

LSP, linting, formatting, project structure, code generation. Use when working on developer-tooling tasks, related files, debugging, implementation, review, or verification workflows.

Docker, CI/CD, deployment, monitoring, infrastructure. Use when working on devops tasks, related files, debugging, implementation, review, or verification workflows.

Event-driven, saga, CQRS, Kafka, RabbitMQ, circuit breakers. Use when working on distributed-systems tasks, related files, debugging, implementation, review, or verification workflows.

Django, DRF, FastAPI, Pydantic. Use when working on django-fastapi tasks, related files, debugging, implementation, review, or verification workflows.

Elixir, Phoenix, LiveView, OTP. Use when working on elixir tasks, related files, debugging, implementation, review, or verification workflows.

Express.js, NestJS, Node.js APIs. Use when working on express-nestjs tasks, related files, debugging, implementation, review, or verification workflows.

Flutter, Dart, widgets, Riverpod. Use when working on flutter-dart tasks, related files, debugging, implementation, review, or verification workflows.