happy-cowork

Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.

Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.

Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.

Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.

Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.

Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.

Use when designing a new HTTP/GraphQL API endpoint, evolving an existing one, writing or reviewing an OpenAPI / GraphQL schema, or "/design-api". Produces a contract-first design with request/response shapes, error model, and versioning notes before any code is written.

Use when designing a database schema, adding a new entity, planning a migration, choosing indexes, or "/design-data". Produces a schema, migration plan, index strategy, and rollback path before any code is written.

Use when reviewing a React / Vue / Svelte / Solid component for correctness, accessibility, performance, state, and types, or "/frontend-review". Produces a structured review with file:line citations.

Use when aggregating findings from multiple security scans (secret-scan, dependency-scan, image-scan, DAST, cloud-posture, IAM review) into a single severity-grouped report for the security team or stakeholders, or "/pentest-report".

Use when asked to investigate a slow page, slow API, or "this feels sluggish", or "/perf-check". Produces a structured performance review across Web Vitals (frontend) and P95 latency (backend) with concrete remediations.

Use when starting a new full-stack feature and needing a vertical slice (UI + API + DB + tests) scaffolded in one pass, or "/scaffold-feature". Produces an ordered file plan with stub contents, not full implementations.

Use when scanning a repo or filesystem for committed secrets (API keys, tokens, private keys, passwords) with gitleaks or trufflehog, or "/secret-scan". Flags exposed credentials with file:line and remediation steps including key rotation.

Use when threat-modeling a new feature, service, or architecture using STRIDE and a basic attack tree, or "/threat-model". Produces a list of threats, mitigations, and gaps mapped to data-flow trust boundaries.

Use when asked to write unit tests for a function, class, or module — table-driven where possible, edge cases enumerated, mocks minimized, or "/write-tests". Produces test files that test behavior, not implementation.

Use when reviewing an AWS IAM policy, role, or trust document, checking for over-broad permissions, privilege escalation paths, or "/iam-review-aws". Audits a policy JSON for least-privilege violations.

Use when reviewing Azure RBAC role assignments, custom role definitions, or management-group scope, checking for over-broad permissions, or "/rbac-review-azure". Audits Azure RBAC for least-privilege violations.

Use when reviewing cloud network design across AWS VPC, Azure VNet, or GCP VPC — security groups, NSGs, firewall rules, peering, private endpoints — or "/network-review". Flags over-broad ingress, missing egress controls, and cross-cloud connectivity risks.

Use when reviewing GCP IAM bindings, custom roles, or service-account permissions, checking for over-broad grants or impersonation paths, or "/iam-review-gcp". Audits GCP IAM for least-privilege violations.

Use when reviewing a `helm diff upgrade` or ArgoCD diff output before applying a Kubernetes release, or "/helm-diff". Flags destructive changes, image rollbacks, and risky manifest mutations.

Use when asked about cost impact of a change, "what does this cost", "cost estimate", or "/cost-check". Summarizes the AWS/GCP/cloud cost implications of an infra or code change.

Use when asked "is this safe to deploy", "pre-deploy check", "deploy checklist", or "/deploy-check". Runs a pre-deployment safety checklist: diff review, rollback plan, dependencies, and go/no-go decision.

Use when asked to write a runbook, document a procedure, or create an ops playbook for a service or alert. Produces a structured runbook with context, steps, rollback, and escalation.

Use when asked to check cluster health, "what's wrong in k8s", "check pods", or "/k8s-health". Runs a structured Kubernetes health check across nodes, workloads, and recent events.

Use when asked to review a Terraform plan, check blast radius, assess infra change risk, or uses /review-plan. Reads a terraform plan output and flags destructive changes, resource replacements, and policy concerns.

Use when the user says "triage this alert", "what's on fire", "incident", or "/triage". Structures an incident triage: severity, blast radius, likely cause, immediate mitigation steps, and who to page.

Use when the user asks to create a PR, open a pull request, or uses /create-pr. Opens a GitHub pull request with a well-structured summary using the gh CLI, optionally checking out a new branch from current changes and targeting dev or main based on the user's prompt.

Use when the user says "standup", "what did I do yesterday", or "/standup". Summarizes recent git activity across repositories into a standup-ready bullet list covering yesterday, today's plan, and blockers.

Use when the user says /rebase, "rebase onto dev", "rebase onto main", "sync with main", or "update my branch from dev". Rebases the current branch onto a target branch, fetching latest, and handles conflicts by reporting them clearly.

Use when the user says "draft release notes", "/release-notes", or "changelog for v<x>". Generates release notes from a git range by grouping commits/PRs into Features, Fixes, and Chores.

Use when the user says /review-pr, "review this PR", or "review PR <number/url>". Reviews a GitHub Pull Request using the gh CLI, analyzing code quality, logic correctness, security, and adherence to project conventions.

Use when the user says "triage issues", "/triage", or "what should I work on next". Pulls open GitHub issues assigned to or authored by the user and groups them by priority, staleness, and required action.