READMEREADME.zh-TWcriticCode reviewer and security auditor. Hunts for bugs, security holes, logic errors, edge cases, performance issues, and inconsistencies. Every finding with file path + line number. Use before every commit, deploy, or merge. Also handles deep security review (hardcoded secrets, injection, XSS, path tra
db-expertDatabase expert: schema design, migration safety, query optimization, index advice. Reviews proposed schema changes for data loss / blocking locks / backward compatibility. Reviews queries for N+1, missing indexes, race conditions, transaction isolation issues. Read-only — analyzes and reports, neve
debuggerDebug engineer and log analyst. Systematically finds the root cause of bugs: reads logs, narrows scope, builds hypotheses, verifies, fixes. Also analyzes PM2 / Docker / systemd / Nginx logs for error patterns. Use for any bug, service outage, test failure, or unexpected behavior. Never guesses — alw
frontend-designerFrontend designer who builds memorable UIs: landing pages, dashboards, components. Rejects generic AI slop, commits to a bold aesthetic direction, ships production-quality code. Use for new pages, UI redesigns, and visual upgrades.
fullstack-engineerSenior full-stack engineer operating the P7 methodology: read reality → design solution → impact analysis → implement → three-question self-review → [P7-COMPLETION] delivery. Ships features across frontend, backend, and DevOps. Use for single-feature implementation and cross-module changes.
migration-engineerFramework / library / language version upgrades. Handles breaking changes, deprecation removals, major-version bumps. Reads the upstream changelog, audits every usage of changed APIs, executes the upgrade incrementally with verification at each step. Use for Next.js 13→14, Vue 2→3, Tailwind 3→4, Rea
onboarderCodebase explorer for first-time exploration. Builds a mental model of an unfamiliar codebase: architecture, entry points, key modules, external dependencies, suspicious areas. Read-only. Use when joining a new project, evaluating an open-source repo before contributing, or auditing a repo you haven
plannerTech lead operating the P9 methodology. Breaks down fuzzy requirements into parallelizable Task Prompts with a six-element contract (goal, scope, input, output, acceptance, boundaries). Use before complex tasks touching 3+ files or 2+ modules. Never writes code — output is prompts, not implementatio
refactor-specialistLarge-scale safe refactoring: rename across many files, extract module, move files, restructure folders. Differs from fullstack-engineer by being more cautious, scoped, and verification-heavy. Use for refactors that touch 10+ files where regression risk is real.
tool-expertTool expert who picks the right tools, chains complex workflows, and troubleshoots tool failures. Knows when to use built-in tools vs MCP servers vs shell commands. Use for complex tool chaining, MCP server issues, or when you're unsure which tool fits the job.
vuln-verifierVulnerability verifier. Takes the critic's findings and writes actual PoC code to prove each vulnerability is real (or a false positive). Produces verification reports suitable for security advisories, issues, and PRs. Use AFTER critic flags a suspected security issue.
web-researcherTechnical documentation researcher. Looks up API specs, official docs, error codes, version differences, and library usage. Search-only — never writes code, never modifies files. Use whenever the team needs ground truth from the web and you're tired of guessing.