find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable ski
skill-creatorCreate new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better t
anti-sycophancyActivate when the user is sharing a decision, plan, interpretation, or work and wants their thinking pressure-tested — not executed. Signals — pushback asks ("devil's advocate", "punch holes", "challenge me", "be brutal", "don't tell me it's a good idea"); commitment framings ("I'm planning", "we're
clear-and-shortUse when the user asks for shorter, simpler, less repetitive, or less AI-sounding chat replies, or invokes /clear-and-short: "be brief", "keep it short", "from now on keep it short", "too many words", "shorter answers", "you are too verbose", "stop repeating yourself", "use fewer tokens", "stop narr
convert-plan-to-featureBreak an approved plan into separately-trackable, per-feature implementation specs under a dedicated `docs/plans/{initiative}/` subfolder — a REQUIREMENTS.md index plus one `features/NN - {name}.md` file per unit of work, each with requirements, technical steps (real file paths), dependencies, and a
dead-code-removalRe-check a dated dead-code analysis and its removal plan against today's code with read-only subagents, record new verdicts (VALID, CHANGED, INVALID, GONE) in the plan and a new re-check file, and, once the user approves, delete statically proven dead code step by step in a git worktree, running the
delegation-promptWrite a paste-ready prompt that briefs a DIFFERENT session, agent, or teammate to carry out a follow-up task on work this session just finished. Use whenever the user asks for "a prompt for another session", "write me a prompt to review this", "give me something to paste into a fresh session so it c
document-generateWrite documentation FILES — Diataxis tutorials, how-to guides, reference pages, and explanations — for a named feature, module, file, or whole project, grounded in end-to-end code research done before a word of prose; also adds a short cross-link line in the README or docs index. Use whenever the us
execute-changeAutonomous execution of a plan brief in an OpenSpec-managed repo: one lead session drives the feature routine in fresh subagents, committing per checkpoint and stopping after the local commits. Takes a plan-brief path or a free-text idea, on the full route or the light one, chosen at preflight. Paus
healthRun every quality gate the project already has — typecheck, lint, tests, dead-code, shell lint — through a bundled script that scores each gate 0–10, computes a weighted composite health score, and tracks the trend against saved history; every number is computed by the script, never estimated. Trigg
live-app-security-auditRuntime security audit of any deployed, live web application. Use proactively whenever the user asks to audit a live URL, scan a deployed app, check the production posture of a running site, vet a "vibe-coded" app, pentest a live or deployed app, or run any of the seven checks on a running target: s
new-featureInvestigative Q&A workflow that turns a fuzzy feature request into a fully-specified design before any code is written. Research the relevant code + current (as-of-today) best practices first, then surface every ambiguous design decision as categorized questions with [REC]-marked default options, lo
plan-eng-reviewStructured engineering review of a WRITTEN implementation plan — the plan-mode draft, a plan file under docs/plans/, or a plan pasted into the chat — run BEFORE any code is written. Challenges scope, checks every proposed helper against what already exists, reviews four dimensions (architecture, cod
pr-reviewReview a Bitbucket pull request in any repository end to end - fetch it, pin a checkout of its head commit, run the parallel diff pass and the claim-verification pass, write the full report to docs/reviews/, and post one self-contained summary comment once the user approves it. Reads and comments on
repo-change-summarySummarize how much a git repository changed in a given month across ALL branches: lines added, lines deleted, total lines changed (added + deleted), distinct files modified, total file-touches, commits, pull requests merged, and authors — each commit counted once, merges excluded from the line/file/
retroGenerate a data-grounded engineering retrospective from the repo's git history — commits, velocity, work sessions, commit-type mix, churn hotspots, test ratio, PR sizes, focus score, streaks, per-author stats, AI-assisted share — where every number is computed by a bundled script, never estimated. T
scaffold-claudeUse when the user wants to create, draft, or scaffold a CLAUDE.md file for a project from scratch. Triggers on "scaffold CLAUDE.md", "write a CLAUDE.md", "set up CLAUDE.md", "create project instructions for Claude", "bootstrap CLAUDE.md", "/scaffold-claude", or any request to author project-level Cl
security-vulnerability-scanSecurity vulnerability scanner for any application (static source only — for a running or deployed URL use live-app-security-audit). Use proactively whenever the user asks to perform a security review, scan for vulnerabilities, harden security, check for OWASP issues, find hardcoded secrets, review
session-cleanupUse when a piece of work is finished, merged, or deployed and its leftovers need removing: "clean up", "tidy up", "clean up after yourself", "remove the merged branches", "delete the temp files", "delete the scratch files", "kill the processes you started", "what is left over", "delete the plan file
session-handoffCreates comprehensive handoff documents for seamless AI agent session transfers. Triggered when: (1) user requests handoff/memory/context save, (2) context window approaches capacity, (3) major task milestone completed, (4) work session ending, (5) user says 'save state', 'create handoff', 'I need t
sonar-issue-checkUse this skill to look up and REPORT SonarCloud or SonarQube findings already analyzed for the current repo — list, pull, show, summarize, or dump the issues, without changing any code. By default report the NEW issues in the current branch's or PR's new code (the pre-commit / pre-PR "did I introduc
sonar-issue-fixUse this skill to FIX and clear SonarCloud / SonarQube findings on a branch or PR by editing the code — the companion to sonar-issue-check, which only reports. Triage the new-code issues by rule, apply behavior-preserving mechanical fixes, and for cognitive-complexity (S3776) refactors write charact
stdlib-firstReuse-before-build discipline for writing NEW TypeScript/Node or C#/.NET code. Trigger at two decision moments: (1) about to write a new function, utility, helper, wrapper, service, or algorithm in TS or C# — "write a helper to X", "implement retry / date-parsing / validation logic", "create a servi
systematic-debuggingUse this skill when debugging any failure before proposing a fix — a bug, test failure, flaky test, regression, build break, crash, slow/latency symptom, or unexpected behavior. It enforces a four-phase discipline: investigate the root cause first, analyze the pattern/context, test ONE hypothesis at
test-driven-developmentUse this skill ONLY when the user has opted into test-first development for the work at hand — they explicitly ask for TDD / test-driven / "write the test first" / red-green-refactor, OR they are starting a brand-new feature, module, or component and say they want it built test-driven. It guides the
trim-initial-bundleFind and defer vendor libraries that ship in a React + Vite app's initial JavaScript load but are only needed behind lazy routes/components — shrinking first-load size, LCP, and TTI. Works by inspecting the *built* `dist`, never assumptions. Use this whenever the user wants to reduce / shrink / trim
unslopEdit human-facing prose to remove the patterns that mark text as AI-written: puffery, AI vocabulary ("delve", "crucial", "landscape"), "not just X, but Y", forced groups of three, em-dash and colon overuse, bold-label lists, title-case headings, chatbot phrases, filler, hedging, abstract metaphor no
update-dependenciesSafely update dependencies in any JavaScript/TypeScript project — npm, pnpm, yarn, or bun, single package or monorepo: discover outdated packages, research release notes for breaking changes, migrate code where needed, and verify with a clean rebuild. Use when the user asks to update, upgrade, or bu
verify-frontend-changeUse this skill EVERY time a frontend/UI change is about to be called done, fixed, or working — in a web app, a successful edit, a clean build, or an HMR reload is NOT evidence. It verifies the change in a real Chrome via the Chrome DevTools MCP server (console errors and a performance trace), with a
verify-implementationAdversarially verifies completed work against the claim that it is done: audits the implementer's report against the actual diff, re-derives every acceptance criterion from evidence, reads every new test body and re-runs mutation proofs to catch tautological guards, re-runs the project's own quality
windows-disk-cleanupFind what fills a Windows machine's disk and what can be removed without harm, give the user the commands to remove it, and re-measure after they run them. Measures with a bundled read-only PowerShell script (reported size AND real on-disk size, so cloud placeholders, sparse and compressed files are