Command
Keeps code documentation in sync with the implemented code: inline comments, API documentation, changes to README or CONTRIBUTING, and updates to technical specifications if the code deviates from them. Called after implementing a feature.
Command
Writes the minimal production code that makes the existing tests green. No over-engineering.
Command
Writes unit tests for a feature BEFORE production code exists. Tests must fail.
Command
Improves code quality without changing behavior. All tests must continue to pass.
Command
Implements a feature in the TDD cycle: Red → Green → Refactor. Each phase is its own sub-skill with a focused agent call.
Command
Collects small clean-up TODOs accumulated during the sprint (from /p5-review, /p5-acceptance, /p5-bugfix, TODO/FIXME comments) that do not justify a full story but make the next sprint easier. Triages each item into polish-now, backlog, handover, or drop. Optionally executes polish-now items directly (TDD mini-cycle…
Command
Checks code for quality, clean code, logic errors and test coverage. Delivers review findings with severity level.
Command
Checks code against the security checklist. Focus on OWASP Top 10, injection, auth and data handling.
Command
Runs ONE final code review over the entire sprint at sprint end, with a stronger model, to catch issues that single-story reviews structurally cannot see: cross-story interactions, the schema/data model as a whole, conformance to ADRs and Constitution Inviolables, and consistency with prior lessons/instincts.
Command
Conducts a structured code review: first code quality, then security. Each dimension is its own sub-skill.
Command
Checks full keyboard operability: tab order, focus indicator, Enter/Space, Escape, focus trap.
Command
Checks screen reader compatibility: semantic HTML, ARIA attributes, alt texts, live regions.
Command
Checks colour contrast (WCAG AA), colour-independence of information presentation, and dark mode conformance.
Command
Systematically checks the application for accessibility. Each A11y dimension is a separate sub-skill.
Command
Compares the auth implementation against the requirements in SECURITY.md: JWT, sessions, RBAC, password hashing.
Command
Checks security headers, CORS, DB access, secrets management, and server configuration.
Command
Checks all dependencies for known vulnerabilities (CVEs), outdated packages, and maintenance status.
Command
Compares the implementation against the DSGVO initial assessment: data subject rights, data minimisation, deletion deadlines, data processing agreements.
Command
Checks source code for injection vulnerabilities, insecure cryptography, secrets in code, and insecure error handling.
Command
Conducts a defensive security audit. Each audit area is a separate sub-skill.
Command
Fixes bugs and vulnerabilities found during the QA phase (functional tests, exploratory tests, accessibility check, security audit, pentest). Each fix is secured by a regression test.
Command
Conducts unstructured, experience-based tests that automated tests and defined test cases do not cover. The goal is to find unexpected behaviours, usability issues, and hidden bugs that remain invisible in structured testing.
Command
Tests critical user journeys end-to-end – from start to the expected final result.
Command
Tests the interaction between system components: API against DB, middleware chains, external services against mocks.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: