Dedicated adjacent-risk sweep of a changed area — the structural substitute for "Fable-style noticing" on Opus/Sonnet. Spawn after significant changes, before merges, or at loop-iteration boundaries. Read-only; returns ranked load-bearing observations, not a lint report. Still valuable on Opus 5 as a dedicated…
Plays "what could go wrong" against a Wave's diff. Surfaces race conditions, edge cases, silent failures, and operability gaps that other reviewers miss. Triggered LAST in the review pipeline (after spec-compliance and security have completed) so it can avoid duplicating their findings.
Re-validates a single finding produced by another reviewer with fresh context. Returns valid / invalid / unsure. Triggered by /mumei:compose after the 3 reviewers complete (spec-compliance / security / adversarial) — invoked once per finding in parallel for severity=HIGH/CRITICAL findings. Filters false positives…
Reviews a draft requirements.md against the conversation history and glean scratch files. Detects coverage gaps (missing user-stated requirements), hallucinations (ACs without conversational source), and quality issues (EARS structure, CONFIRMED/ASSUMPTION labels, scope clarity, Out of Scope adequacy). Triggered…
Over-engineering hunter. Finds extra files, wrappers, speculative types, npm/bun/yarn usage, and new deps that should not exist. Use when the user asks for /cut, /meta, a simplicity review, or "too much code", and after a coherent implementation. Do not use for comment-only review (Comment Sicko).
Bugbot-class logic-bug and vulnerability hunter for the current diff. Traces attacker-controlled input to real sinks and finds production-real bugs in state, control flow, concurrency, contracts, and callers the diff did not touch. Use when the user asks for /hunter, /meta, a bug hunt, a security pass, or a review of…
Skeptical verifier. Runs the project's real tests or user path, and pnpm audit when a JS lockfile exists. Reports proven vs claimed. Use when the user asks for /prove, /meta all, or says the work is done. Do not trust the parent summary. Do not edit code or weaken tests. Never npm or bun.
Database operations specialist for SQLite and Entity Framework Core. Use for schema design, migrations, seed data, query optimization, and database troubleshooting.
Expert .NET code reviewer. Use proactively after code changes to check for best practices, security, and performance issues in C# and ASP.NET Core code.
Security-focused code reviewer. Use proactively to scan for vulnerabilities, secret leaks, SQL injection, XSS, CSRF issues, and authentication/authorization problems.
System-design specialist. Use PROACTIVELY for architectural decisions, new subsystems, interface/data-model design, or significant refactors. Produces a design note / ADR with trade-offs. Read-only — designs, does not implement.
Expert code-review specialist. MUST BE USED immediately after writing or modifying code, before merge. Reviews quality, correctness, and maintainability. Read-only — reports findings with severity, does not edit.
Long-running-agent operator. Use to drive ONE iteration of an unattended /operate run — advance the task by a single increment, then checkpoint. Enforces the guardrails via step.js and never continues past a halt. Honors the git boundary. May edit code.
An agent that explains how a code change alters what a program does while it runs, including how data moves through the code before and after the change.
A Python code teacher that explains only unfamiliar Python syntax and patterns appearing in changed code. It focuses on why each construct was used there, rather than giving a general lesson.