Use proactively before merging changes that touch authentication, authorization, plugin execution, API routes, JWT handling, or the marketplace install bridge. Read-only security audit focused on the WWV attack surface. Triggers on "security review", "check for vulnerabilities", "audit the auth flow", "review before…
Use when making significant architectural decisions, adding new patterns, or altering core workflows. This skill ensures that all major technical choices are documented via ADRs.
End-to-end pipeline that takes a WorldWideView plugin from idea to npm-published and cleaned up. Conducts an isolated worktree + scaffold, GSD research/plan/build/UAT, dual-repo PRs (plugin + seeder), npm publish, and teardown, with user gates only at plan approval, UAT sign-off, npm publish, and teardown. Use when…
Code review of a pull request diff and thread for the WorldWideView repository, run by Gremlin in CI. Loaded when a comment requests a review (e.g. "/oc review this PR"). Defines review scope, prompt-injection trust boundary, evidence discipline, and the output format for the PR review comment. Triggers on "review"…
Use when tasked with creating a new git worktree, building features in isolation, setting up parallel branches, or provisioning a safe sandbox environment to test architectural changes.
Use when creating a new plugin, adding a new data source, or debugging missing plugin data in the WorldWideView project. Triggers on seeder creation, WebSocket streaming issues, plugin registration failures, manifest validation errors, GeoEntity rendering problems, or data engine integration.