Use when a test is failing, a production issue occurs, or unexpected behavior needs systematic root cause analysis. Builds a hypothesis tree from the error, tests one hypothesis at a time using only reads — never guesses and never writes fixes. Hands off to the implementer skill once root cause is confirmed.
Use before planning any feature that handles authentication, authorization, user data, multi-tenancy, secrets, financial transactions, or external integrations. Interrogates the security design one question at a time until every threat vector is modeled and every trust boundary is explicit — before any code is written.
Use when the user says "grill me", wants to stress-test a plan, needs rigorous pre-implementation interrogation, or wants to resolve design ambiguity before building. Relentlessly interviews the user on every branch of the design until full shared understanding is reached.
Use during implementation phase, after planner has produced an approved plan. Writes code following project conventions. Test-first, small incremental commits, refuses to exceed the plan's scope.
Use when starting any non-trivial implementation work — new packages, subsystems, schema changes, protocol changes, phase transitions, or multi-file changes. Produces a concrete plan and refuses to code until user approves.
Use before opening a PR or marking a phase-milestone complete. Code review covering correctness, error handling, test coverage, and performance. Security is handled by the separate security-auditor skill.
Use for security review before PR merge or phase-milestone close. Mirrors Claude Code's /security-review and the official anthropics/claude-code-security-review GitHub Action. Analyzes changes for vulnerabilities with severity, CWE classification, and remediation code. Hard-blocks on CRITICAL findings.