Edit opencode.json, AGENTS.md, and config files. Use proactively for provider setup, permission changes, model config, formatter rules, or environment variables. Examples: user: "Add Anthropic as a provider" → edit opencode.json providers, add API key baseEnv var, verify with opencode run test user: "Restrict this…
Maintain repository integrity and documentation. Use for auditing structure, checking config validity, and reviewing inventory. Use proactively to validate the repository or sync documentation. Examples: user: "Validate the repo" → run auditrepo.py user: "Check agents" → run auditrepo.py, review errors user: "Update…
AGENTS.md instructions for IgorWarzocha/Opencode-Workflows, covering repository overview, verification commands, process constraints, coding conventions and current workflows.
Apply the formal standard for React component engineering focusing on accessibility, composition, and styling. Use for building professional, composable React artifacts. Use proactively when creating or reviewing React components. Examples: user: "/component-create Button trigger" → build accessible button with…
Create OpenCode plugins using the @opencode-ai/plugin SDK. Use for building custom tools, event hooks, auth providers, or tool execution interception. Use proactively when developing new plugins in .opencode/plugin/ or /.config/opencode/plugin/. Examples: user: "Create a plugin to block dangerous commands" → implement…
Find, install, and configure MCP servers. Use proactively for MCP discovery, OAuth setup, env vars, stdio vs SSE transport, or troubleshooting MCP connections. Examples: user: "Add the filesystem MCP server" → read server file, add to mcpServers in opencode.json, verify transport type user: "How do I use MCP with…
Add new/custom AI models to opencode.json. Use proactively for bleeding-edge releases, non-standard providers, self-hosted models, or custom endpoints. Examples: user: "Add the new Claude 4.5" → websearch for API specs, add provider entry with baseUrl, verify model ID format user: "Use my local Ollama instance" →…
Find, install, and configure OpenCode plugins from the catalog or community. Use proactively when user asks about plugins, requests new capabilities, or mentions extending OpenCode functionality. Examples: user: "Is there a plugin for Tailwind CSS?" → list catalog, read tailwind plugin details, install if available…
Guide for authoring comprehensive PRDs with parallel planning support. Use for drafting technical specifications, defining requirements, and synthesizing planner outputs. Use proactively when creating PRDs, architecture designs, or implementation plans. Examples: user: "Draft a PRD for user auth" → create PRD with…
Generate AGENTS.md for AI agent navigation. Covers build/test commands, coding conventions, task routing, and codebase structure. Use proactively during /init workflow or when creating agent-readable repository documentation. Examples: user: "/init" → full AI navigation AGENTS.md + skill recommendations user: "/init…
Generate AGENTS.md for end-user assistance. Covers setup, installation, running, and troubleshooting. Use proactively when user asks for "getting started" help or during /init user workflow. Examples: user: "/init user" → user assistance AGENTS.md with official docs user: "Create getting started guide" → installation…
Review AI API key leakage patterns and redaction strategies. Use for identifying exposed keys for OpenAI, Anthropic, Gemini, and 10+ other providers. Use proactively when code integrates AI providers or when environment variables/keys are present. Examples: user: "Check for leaked OpenAI keys" → scan for sk- patterns…
Review Bun runtime security audit patterns. Use for auditing Bun-specific vulnerabilities including shell injection, SQL injection, server security, and process spawning. Use proactively when reviewing Bun apps (bun.lockb, bunfig.toml, or bun: imports present). Examples: user: "Review this Bun shell script" → audit $…
Review Convex security audit patterns for authentication and authorization. Use for auditing query/mutation auth, row-level security, and validators. Use proactively when reviewing Convex apps (convex/ directory present). Examples: user: "Audit these Convex mutations" → check for missing ctx.auth and input validators…
Review Django security audit patterns for settings and middleware. Use for auditing SECRETKEY, DEBUG, CSRF, and auth decorators. Use proactively when reviewing Django apps (settings.py or manage.py present). Examples: user: "Audit my Django settings.py" → check SECRETKEY, DEBUG, and ALLOWEDHOSTS user: "Check Django…
Review Docker and container security audit patterns. Use for auditing secrets in layers, port exposure, and non-root users. Use proactively when Dockerfile or docker-compose.yml is present. Examples: user: "Audit this Dockerfile" → check for secrets in ENV/ARG and non-root USER user: "Review docker-compose ports" →…
Review Express.js security audit patterns for middleware and routes. Use for auditing Helmet.js, CORS, body-parser limits, and auth middleware. Use proactively when reviewing Express.js apps. Examples: user: "Secure my Express app" → add Helmet.js and disable x-powered-by user: "Check Express CORS config" → verify…
Review FastAPI security audit patterns for dependencies and middleware. Use for auditing auth dependencies, CORS configuration, and TrustedHost middleware. Use proactively when reviewing FastAPI apps. Examples: user: "Audit FastAPI route security" → check for Depends() and Security() usage user: "Check FastAPI CORS…
Review Next.js security audit patterns for App Router and Server Actions. Use for auditing NEXTPUBLIC exposure, Server Action auth, and middleware matchers. Use proactively when reviewing Next.js apps. Examples: user: "Scan Next.js env vars" → find leaked secrets with NEXTPUBLIC prefix user: "Audit Server Actions" →…
Review secret detection patterns and scanning workflows. Use for identifying high-signal secrets like AWS keys, GitHub tokens, and DB passwords. Use proactively during all security audits to scan code and history. Examples: user: "Scan for secrets in this repo" → run high-signal rg patterns and gitleaks user: "Check…
Review Vite security audit patterns for SPA and dev server security. Use for auditing VITE exposure, build-time secrets, and proxy configs. Use proactively when reviewing Vite apps (vite.config.ts present). Examples: user: "Audit Vite env vars" → check for secrets with VITE prefix user: "Check Vite build config" →…
Implement Convex authentication and authorization patterns with OIDC providers or Convex Auth. Use for auth provider setup, ctx.auth usage, user identity handling, and auth-aware schema patterns. Use proactively when users mention auth, JWT, Clerk/Auth0/WorkOS, or Convex Auth. Examples: user: "Add auth to Convex" →…
Use Convex Components to add isolated backend features and compose component APIs. Use for installing components, calling component APIs, authoring components, and handling component-specific constraints (Id types, env vars, pagination, auth). Use proactively when users mention components, workpool, workflow, agent…