opencode-config

Set up SBOM vulnerability scanning with Trivy in GitHub Actions CI. Use when the user wants to add SBOM scanning, supply chain security, Trivy CI, vulnerability scanning, SPDX generation, or SARIF reporting to their GitHub project. Detects GitHub repos, generates workflow files, and automates setup via gh CLI when available.

Handle security vulnerabilities (CVE/CWE) in projects. Use when a CVE is discovered via Dependabot, Trivy, Semgrep, or manual review. Guides through identifying the CWE category, writing site-wide E2E tests for the weakness class, fixing the specific CVE in an isolated branch, version-locking overrides, and documenting the approach in the PR description.

Guide users through writing agile features including user stories, acceptance criteria, story splitting, estimation, and definition of done. Use when the user asks to plan a feature, write user stories, create acceptance criteria, define requirements, break down work, do sprint planning, agile planning, story mapping, backlog grooming, create product backlog items, or define epic/story/task breakdown.