monorepo

Triages an internally reported security concern for Open Collective codebases (engineering, ops, or security team) - validates reproducibility and impact, asserts the finding with a clear confidence level, and proposes a fix plan when applicable. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including `issue.md` (assertion and verdict), optional `plan.md` when there is a fix to plan, plus a minimal runnable PoC for full confirmation. Offers optional production impact analysis (`impact.md`) at the end when queryable traces may exist. Updates `security/memory.md` after full triage. No external researcher reply or bounty policy. Use when the user describes an internal finding, asks to validate a suspected vulnerability from the team, or wants an engineering handoff without security@ or bounty workflow.

Triages an incoming security report for Open Collective codebases - searches `priv/security-issues` and opencollective/opencollective-security first for existing documentation, validates reproducibility and impact when new, maps to official bounty policy, proposes fixes, and drafts contributor replies. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including up to three core markdown files (`reply.md`, optional `issue.md` when fully confirmed, optional `plan.md` when there is a fix to plan), plus a minimal runnable PoC for full confirmation. Updates `security/memory.md` after full triage. After triage, offers optional production impact analysis (`impact.md`) and filing on opencollective/opencollective-security. Use when the user pastes or describes a security report, asks to investigate a vulnerability, assess bounty eligibility, or draft a response to security@opencollective.com reporters.

Drafts user-facing documentation in opencollective-documentation for a requested frontend feature, then offers to commit and open a PR. Pulls latest docs first, checks open PRs via GitHub MCP for duplicates, verifies against frontend code and GitBook. Use when the user invokes /documentation-feature-pr, asks to document a feature, update user docs, or open a documentation PR for a specific workflow.

Generates a concise, end-user-oriented markdown report of Open Collective achievements for a completed engineering cycle. Pulls planned work from org project 5 and opencollective/opencollective milestone issues, then supplements with API and frontend commit history for work not tracked on the board. Use when the user invokes /generate-cycle-report, asks for a cycle recap, achievements report, or what shipped in the past cycle.

Drafts paste-ready email replies to Open Collective support tickets by researching user-facing documentation and product behavior. Searches GitBook docs and the local documentation repo for relevant pages and includes links when helpful. Use when the user pastes a support ticket, asks to reply to a support email, draft a help desk response, or invokes /support-ticket-reply.

Batches translation of opencollective-frontend locale JSON using show-untranslated and set-translation scripts, with codebase lookup for message IDs when context is unclear. Use when the user asks to translate frontend strings, reduce untranslated entries for a locale, or apply translation rules to lang files.

Performs a structured security review of a specific feature, PR, or code change in the Open Collective codebase. Validates findings with a minimal runnable PoC when claiming full confirmation. Writes artifacts under `/workspace/priv/security-issues/<unique-folder>/` including `issue.md` per finding, optional `plan.md`, optional `impact.md`, plus PoC code. Use when asked to review the security of a new feature, a pull request, or a code change.

Drafts a product/engineering pitch from raw notes, GitHub issues, and Slack threads using the Open Collective pitch template. Use when the user invokes /generate-pitch, asks for a pitch, project brief, or scoping doc from discussion artifacts.

Creates and documents Open Collective core-team project issues on opencollective/opencollective via GitHub MCP—main `[Project]` issue with milestone and org project 5, plus linked sub-issues with types and optional area/complexity labels. Use when the user invokes /gh-oc-project-create, asks to file an OC project issue, or wants project issues with sub-issues on the OpenCollective GitHub repo.

Reviews the test coverage of a feature in Open Collective and proposes a plan to improve coverage when needed. Use when asked to review tests for a feature, assess test coverage, find coverage gaps, or plan new tests. Covers opencollective-frontend (Jest), opencollective-api (Mocha), opencollective-pdf (Vitest), and opencollective-rest (Jest).

Searches lang/en.json for existing i18n strings in opencollective-frontend. Use when implementing UIs, adding user-facing text, or when the user asks to find or reuse translations.