security-audit
Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology
Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology
Code review a pull request for bugs and CLAUDE.md compliance. MUST use when asked to review code.
Code review a pull request for bugs and CLAUDE.md compliance. MUST use when asked to review code.
Rust coding guidelines for the Windmill backend. MUST use when writing or modifying Rust code in the backend directory.
Svelte coding guidelines for the Windmill frontend. MUST use when writing or modifying code in the frontend directory.
MUST use when writing Deno/TypeScript scripts.
MUST use when writing R scripts.
Reviews code to ensure agent-native parity -- any action a user can take, an agent can also take. Use after adding UI features, agent tools, or system prompts.
Analyzes code changes from an architectural perspective for pattern compliance and design integrity. Use when reviewing PRs, adding services, or evaluating structural refactors.
Final review pass to ensure code is as simple and minimal as possible. Use after implementation is complete to identify YAGNI violations and simplification opportunities.
Always-on code-review persona. Reviews code for logic errors, edge cases, state management bugs, error propagation failures, and intent-vs-implementation mismatches.
Always-on code-review persona. Reviews code for premature abstraction, unnecessary indirection, dead code, coupling between unrelated modules, and naming that obscures intent.
Always-on code-review persona. Audits changes against the project's own CLAUDE.md and AGENTS.md standards -- frontmatter rules, reference inclusion, naming conventions, cross-platform portability, and tool selection policies.
Resolve PR review feedback by evaluating validity and fixing issues in parallel. Use when addressing PR review comments, resolving review threads, or fixing code review feedback.
Review whole-repo test quality, rerun coverage, score remaining worth-testing files, inspect slow-drift and stale test debt, and publish the next testing batch. Use every few weeks or before large breaking changes and rearchitecture.
Use when adding or changing validation for Python controls (dataclasses) in sdk/python/packages/, including Annotated/V rules, __validation_rules__, and property Raises docstrings.
Use when asked to create or update integration tests for any Flet control in sdk/python/packages/flet/integration_tests, including visual goldens and interactive behavior tests.
Use when asked to run integration tests.
Verify a released archon binary works end-to-end via a specific install path. Use when: cutting a new release, reproducing a user bug report on the released version, or validating that a hotfix binary actually works after a re-tag. Triggers: "test the release", "test 0.3.1 via brew", "verify the curl install", "smoke test the binary", "did the release binary work", "run /test-release", "verify the release". NOT for: testing dev work (use bun link directly), testing unreleased changes (build locally via scripts/build-binaries.sh first), or running the full validate suite (bun run validate is separate).
Fix BE (C++) code formatting issues using clang-format
Run clang-tidy on newly added/modified BE C++ code