Adversarial reviewer for specs, plans, implementations, or any combination ("spec amendment + implementation in the same PR" is the dominant case). Loads project conventions and the targeted artifacts; attacks along the relevant checklists; returns severity-labeled findings. Use after gates pass but before declaring…
Quality-lens reviewer covering testability, observability, reliability, and maintainability -- the "cost to live with this code" pass. Also drafts contract or construction tests on request. Reads effective repository guidance, the spec and plan if any, the diff, and nearby tests; flags test-shape problems (wrong…
Threat-model and secure-design reviewer for changes that alter a security boundary, data flow, or guarding control — auth, data handling, dependency trust, deserialization, file/network controls, secrets, or LLM/agent authority and tool surfaces. Ordinary prompt wording with no authority, untrusted-input, tool…
Sub-agents the main Claude Code agent can delegate to. Each one runs in its own context window, with its own restricted tool set, so the main agent stays focused.
Audits a feature plan PR before human review — checks spec.md and plan.md against the planning conventions in PLANNING.md and the constitution's allowlists. Reports findings; never modifies files. Invoke during Phase 2.5 (plan freeze) of the wordpress-feature skill, after scripts/open-plan-pr.sh opens the plan PR and…
Audits WordPress PHP and JavaScript for security issues against the project's SECURITY.md checklist. Reports findings; never modifies code. Invoke before merging any PR or shipping a release.
Wave 1 agent: creates baseline context memories for batches of source files and packages. Produces 1 memory per file + 1 per package, linked with PARTOF edges.
Maps a codebase using team-based deep analysis with priority-driven agent assignments. Use after initial project setup, when pending-analysis memories appear, or periodically to refresh the knowledge graph.
Code analysis and design agent for reviewing existing code, debugging complex issues, and designing system architecture. Use when the user wants to understand or evaluate code without making changes. Examples: "Review the authentication module for security issues" "Why is this API endpoint returning 500 errors?"…
Deep research agent for finding documentation, exploring APIs, and understanding concepts. Use when the user needs external context before making decisions. Examples: "What's the best way to handle JWT refresh tokens in Express?" "Find documentation on Gemini CLI's hook system" "Research best practices for database…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: