Finds the root cause of broken behaviour and names it at file:line, then writes the check that fails for that reason before changing anything. Also resolves merge and rebase conflicts by intent rather than by taking a side. Trigger for "it's not working", "this used to work", "I'm getting an error", "CI is failing"…
Answers questions about this repository by reading it, anchored to file:line, and tours an unfamiliar area for somebody who has just arrived. Trigger for "where does X live", "how does this work", "why does it do that", "what depends on Y", "walk me through", "map this module", "trace this import chain", "onboard me".…
Saves a finding that took real time to reach — a non-obvious behaviour, an integration trap, a workaround and the reason it is needed — as committed markdown, stamped with the commit and the file patterns it describes so that it can be detected as stale later. Searches those notes too. Trigger for "save this", "note…
Finds evidence from outside this repository and reports it with numbered citations, or marks a claim [unsourced] and leaves it marked. Uses only the tools the client actually has: the local floor is always on, web search / Tavily / Exa run only when the client configured them, and NotebookLM deep research runs only…
Six-phase security audit of a codebase — web apps, APIs, services, CLI tools, libraries, and daemons — with adversarial validation: the agent that verifies a finding is never the one that found it. Recon, parallel hunting across 8 attack classes, validation, reporting, schema-validated findings.json, and independent…
Use when work has to be verified — "verify the feature", "did we build what was asked", "review this diff", "is it ready to commit" — by choosing the right verification tier (standalone, embedded, or chain) and producing verdicts with evidence, not impressions. Not for milestone-declared security audits — use…
Turn a PR, branch, commit, or git diff into an interactive visual recap with diagrams, file maps, API/schema summaries, annotated diffs, and focused review notes. Trigger for "recap this PR", "summarize the change for review", "show me what this branch changed". In ai-engineering it runs when CLOSING a milestone (step…
Writes technical documentation for this repository: a README, a wiki page, product documentation, API docs or a technical post. Applies the framework's single writing standard (references/documentation-writer.md) and verifies every document against the tree. Trigger for "write the README", "update the wiki", "document…
Creates, audits and maintains the AGENTS.md a repository owes its coding agents, following the agents.md convention (https://agents.md/). Decides root-only versus nested AGENTS.md files from the repo's real shape, interviews the tree (not the user) for build/test/lint commands, and writes only what an agent cannot…
Research and advise on the best way to approach a software project, including architecture, tech stack, implementation strategy, pricing/operating-cost tradeoffs, benchmark research, and comparisons with similar real-world projects. When the project hinges on a technical mechanism, it can also run a gated arXiv…
Use when the user brings a fuzzy idea that must be pinned down before research or planning — "handshake", "get on the same page", "align on this idea", "let me explain my vision", or before ANY creative work (a feature, a component, a behavior change). One question at a time until the whole idea can be explained in…
Reports a reproducible fault to a team or an upstream project — for ai-engineering itself or for any service the client is building — as a governed payload: closed allow-listed fields, scanned for machine paths, personal data (PII) and secrets before anything is written, draft kept local, and the exact bytes shown…
Use when the work depends on versioned or external behaviour — adding a package, writing setup or config, integrating an SDK or a paid API, debugging a framework change — or on anything involving third-party APIs, libraries, frameworks, CLIs, cloud services, model/provider SDKs, fast-moving product behavior, user…
Turn an unwritten agreement into a checkable spec — pull the requirements out of this conversation, a ticket, a pasted thread, or a design discussion, and write them to the project's spec file as numbered, falsifiable claims. Use before starting a feature, when the user says "write this up", "turn this into a spec"…
Verify that a feature as built actually matches what was asked for — catching requirements that were quietly dropped, built differently than specified, or built without being asked for. Use this whenever you are partway through or wrapping up a feature and about to call it done, and whenever the user says "does this…
Cross-verify a just-finished feature with throwaway browser tests driven by chrome-headless-shell — proves the feature actually does what it was supposed to do, and proves the change didn't break the routes and components that depend on it. Reports a verdict with evidence and never edits app code. Use this whenever a…
Get an independent review of code you just wrote by spawning a fresh reviewer instance — a separate one-shot agent session with read-only tools that cannot see your reasoning. Use this immediately after finishing ANY implementation — a feature, a bugfix, a refactor, a migration, a schema change — before you tell the…
Audit the UI for accessibility defects against WCAG 2.2 AA — semantic structure, keyboard operability, focus management, form labeling, ARIA correctness, contrast, and motion — with each finding tied to the user it locks out. Use when asked to check accessibility or a11y, review UI for screen-reader or keyboard…
Run the project's objective quality gates — typecheck, lint, tests, and a production build, whatever this project actually uses — then diagnose any failure down to the file and root cause. Use before committing, opening a PR, or declaring work done, and whenever asked whether the code compiles, typechecks, lints…
Review code for correctness bugs, concurrency and lifecycle errors, type-safety holes, error handling gaps, API-contract breaks, and maintainability problems, with every finding gated on a concrete failure scenario. Use when asked to review code, check a diff or branch for bugs, look for problems before committing or…
Verify the implementation actually matches design.md — builds a requirement-by-requirement traceability table showing what is implemented, partial, missing, or contradicted, plus undocumented behavior the code added on its own. Use when asked to check code against the design/spec, confirm a feature was built as…
Run every review skill at once — build-check, then design-check, code-audit, security-audit, a11y-audit and perf-audit fanned out across parallel agents — and merge them into one deduplicated, severity-ranked report. Use when asked for a full/complete review, to review everything before shipping or merging, or to run…
Audit performance — payload and bundle size, data-access patterns and waterfalls, caching, assets, and compute cost — reporting only issues with a measurable, user-visible cost. Use when asked about performance, slow loads, slow queries, slow renders, bundle size, memory use, Core Web Vitals, or optimizing the app.
Decide which review lanes a change actually needs, then run exactly those — instead of spawning the whole chain at every diff size. Reads the diff's shape and blast radius, maps the evidence to lanes (code, security, a11y, perf, design, build), estimates the cost, shows the routing decision, and executes it. Use when…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: