nguyenhappy92

Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.

Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.

Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.

Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.

Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.

Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.

Use when designing a new HTTP/GraphQL API endpoint, evolving an existing one, writing or reviewing an OpenAPI / GraphQL schema, or "/design-api". Produces a contract-first design with request/response shapes, error model, and versioning notes before any code is written.

Use when designing a database schema, adding a new entity, planning a migration, choosing indexes, or "/design-data". Produces a schema, migration plan, index strategy, and rollback path before any code is written.

Run a bounded change → verify → fix cycle until an objective check passes (tests green, lint clean, build/type-check ok) or a hard iteration cap is hit. Use for any task that needs repeated attempts against a verifiable signal instead of a single one-shot edit.

Review code for behavior-preserving simplification — collapse duplication, remove dead code and over-engineering, cut verbose patterns down to idiomatic ones. Use when code is longer or more complex than it needs to be, or the user asks to simplify, shorten, refactor, or clean up.

Implement a planned ticket on its own branch using test-first development, updating docs as part of the change, looping change→verify→fix until the suite is green. Use when a ticket has a plan and is ready to build, or the user says "implement X" / "build the ticket" / "make it pass".

Use to store durable context (decisions, facts, preferences, todos, summaries) and to recall or reply from it across sessions. Load when something worth remembering appears, or when the user asks what you were doing, what was decided, or to continue prior work.

Choose the right model and effort per task phase and apply it when dispatching subagents — strong model + high effort for planning and review, a cheaper model + lower effort for mechanical execution. Use when a task splits into plan / execute / review phases or you're spawning subagents.

Push a reviewed ticket branch and open a pull request with a structured title and body, after review-changes has passed. Use when a ticket is reviewed and ready to ship, or the user says "open a PR" / "create the pull request". Stops at opening the PR — never merges.

Turn a feature request into a concrete plan — scope, approach, affected files, a test plan mapped to acceptance criteria, and out-of-scope — before any code is written. Use when the user describes new work, asks to design or spec something, or says "plan this" / "how would you build X".

Review a ticket's branch diff freshly and independently — spec conformance, tests, correctness, quality, security, docs — producing blocking findings that must be fixed before a PR. Use after implement and before open-pr, or when the user asks to review changes / check the diff before shipping.