Review code changes following project standards and security guidelines. Checks for lint compliance, type safety, test coverage, and security issues. Use when reviewing PRs, auditing code, checking implementation quality, or running a blind pre-merge review pass before merging your own change. Triggers on "review…
Respond to a reporter-filed GitHub Security Advisory with coordinated disclosure discipline: confidential triage, private-fork patching, simultaneous publish, post-mortem. Use when someone files a security advisory against this repo, OR when our own discovery (via .security-discoveries.jsonl) is escalated to a…
Review and fix security scanning alerts from CodeQL and secret scanning. Run as part of system reviews, after CI runs, or on manual request. Triggers on "security scan", "codeql", "secret scanning", "security alerts".
Score your own output 0-10 across 5 task-appropriate dimensions before emitting it. Anything below band 3 (5-6 Functional) is a regression — fix and rescore. Use as a pre-emit gate when work is complex enough that grade-inflation is a real risk. Triggers on "self-critique", "score my output", "pre-emit review", "grade…
Run a system review to check project health. Use when issues drop below 5, an EPIC closes, or 7+ days since last review. Triggers on "system review", "project health", "review system".
Write failing tests before implementation. The Red-Green-Refactor cycle is a core nexus-agents discipline (CLAUDE.md prime directive). Use when implementing new logic, fixing bugs (Prove-It Pattern), or modifying existing behavior. Triggers on "TDD", "write a test", "test-first", "red-green-refactor", "fixing a bug"…
Generate design systems and implement UX/UI for software products using Astro, Svelte, Tailwind CSS, Material Design 3, and OKLCH color system. Covers style selection, color palettes, typography, layout patterns, accessibility, and frontend code generation. Triggers on "design system", "UI design", "color palette"…
Check that dependencies are current stable versions and not deprecated. Use before adding new dependencies or at project setup. Triggers on "check versions", "verify dependencies", "audit packages".