Essential command-line tools and system utilities.
Analyze incoming user requests to detect intent, request type (design/validate/debug/document), complexity level, and identify vague requirements or buzzwords that need clarification. Use when cto-orchestrator receives new requests that need classification before routing to specialist agents.
Implement Convex runtime features: HTTP actions, file storage, search (full text + vector), scheduling (crons + scheduled functions), and RAG patterns. Use for webhooks, uploads, search indexes, vectorSearch actions, and background workflows. Use proactively when users mention HTTP endpoints, files, search, embeddings, or cron/schedule. Examples: - user: "Add full text search" โ define searchIndex + withSearchIndex query - user: "Upload files" โ generate upload URL and persist storageId - user: "Vector search" โ action with ctx.vectorSearch and doc fetch - user: "Run cleanup nightly" โ cronJobs + function reference
Create and refine OpenCode agents via guided Q&A. Use proactively for agent creation, performance improvement, or configuration design. Examples: - user: "Create an agent for code reviews" โ ask about scope, permissions, tools, model preferences, generate AGENTS.md frontmatter - user: "My agent ignores context" โ analyze description clarity, allowed-tools, permissions, suggest improvements - user: "Add a database expert agent" โ gather requirements, set convex-database-expert in subagent_type, configure permissions - user: "Make my agent faster" โ suggest smaller models, reduce allowed-tools, tighten permissions
Architect and refine OpenCode skills to extend agent capabilities. Handles directory scaffolding, SKILL.md authoring, frontmatter optimization, and resource organization (scripts/references/assets). Use proactively for creating new skills, updating existing workflows, or fixing skill discovery issues. Examples: - user: "Create a new skill for database management" โ scaffold directory and initial SKILL.md - user: "My skill isn't triggering correctly" โ analyze and refine frontmatter description - user: "Add a python script to the image-processing skill" โ structure scripts/ directory - user: "How should I structure a skill for API docs?" โ design references/ layout
Create and refine OpenCode agents via guided Q&A. Use proactively for agent creation, performance improvement, or configuration design. Examples: - user: "Create an agent for code reviews" โ ask about scope, permissions, tools, model preferences, generate AGENTS.md frontmatter - user: "My agent ignores context" โ analyze description clarity, allowed-tools, permissions, suggest improvements - user: "Add a database expert agent" โ gather requirements, set convex-database-expert in subagent_type, configure permissions - user: "Make my agent faster" โ suggest smaller models, reduce allowed-tools, tighten permissions
Expert prompt engineering for AI systems. Use when the user wants to write or review prompts for AI, create instructions for AI systems, build system prompts, review or improve existing prompts, optimize AI instructions, or create any form of written communication intended for AI consumption (Claude, GPT, or other LLMs).
Recommend technology stacks based on project requirements, team expertise, and constraints. Use when selecting frameworks, languages, databases, and infrastructure for new projects.
Find, install, and configure OpenCode plugins from the catalog or community. Use proactively when user asks about plugins, requests new capabilities, or mentions extending OpenCode functionality. Examples: - user: "Is there a plugin for Tailwind CSS?" โ list catalog, read tailwind plugin details, install if available - user: "How do I add a custom slash command?" โ suggest command-creator skill or guide through opencode.json setup - user: "What plugins are available for database work?" โ list catalog, filter for database-related plugins - user: "Install the playwright plugin" โ read plugin file, add to opencode.json, verify installation
Guide OAK constitution maintenance with amendment workflows, validation frameworks, semantic versioning, and agent instruction synchronization.
Manipulates Android devices via ADB with emphasis on Wear OS. Provides scripts for screenshots, screen recording, tile management, WearableService inspection, package operations, and device configuration. Use when working with adb, Android devices, Wear OS watches, tiles, wearable data layer, dumpsys, or device debugging.
Maintain repository integrity and documentation. Use for auditing structure, checking config validity, and reviewing inventory. Use proactively to validate the repository or sync documentation. Examples: - user: "Validate the repo" โ run audit_repo.py - user: "Check agents" โ run audit_repo.py, review errors - user: "Update documentation" โ run sync_docs.py - user: "Check for issues" โ run full audit
Review Express.js security audit patterns for middleware and routes. Use for auditing Helmet.js, CORS, body-parser limits, and auth middleware. Use proactively when reviewing Express.js apps. Examples: - user: "Secure my Express app" โ add Helmet.js and disable x-powered-by - user: "Check Express CORS config" โ verify origin allowlists and credentials - user: "Review Express auth middleware" โ check route order and coverage - user: "Scan for Express path traversal" โ verify path normalization and validation - user: "Audit Express session config" โ check secure, httpOnly, and sameSite flags
Review secret detection patterns and scanning workflows. Use for identifying high-signal secrets like AWS keys, GitHub tokens, and DB passwords. Use proactively during all security audits to scan code and history. Examples: - user: "Scan for secrets in this repo" โ run high-signal rg patterns and gitleaks - user: "Check for AWS keys" โ scan for AKIA patterns and server-side exposure - user: "Audit my .env files" โ ensure secrets are gitignored and not committed - user: "Verify secret redaction" โ check that reported secrets follow 4+4 format - user: "Scan build artifacts for keys" โ search dist/ and build/ for secret patterns
Edit opencode.json, AGENTS.md, and config files. Use proactively for provider setup, permission changes, model config, formatter rules, or environment variables. Examples: - user: "Add Anthropic as a provider" โ edit opencode.json providers, add API key baseEnv var, verify with opencode run test - user: "Restrict this agent's permissions" โ add permission block to agent config, set deny/allow for tools/fileAccess - user: "Set GPT-5 as default model" โ edit global or agent-level model preference, verify model name format - user: "Disable gofmt formatter" โ edit formatters section, set languages.gofmt.enabled = false
Perform TypeScript refactoring using ts-morph AST manipulation. Use for renaming symbols, moving declarations, propagating interface changes, adding methods to implementations, renaming parameters, or setting return types across the codebase. Requires ts-morph package.
Review Vite security audit patterns for SPA and dev server security. Use for auditing VITE_* exposure, build-time secrets, and proxy configs. Use proactively when reviewing Vite apps (vite.config.ts present). Examples: - user: "Audit Vite env vars" โ check for secrets with VITE_ prefix - user: "Check Vite build config" โ verify define block and source maps - user: "Review Vite dev server" โ check host binding and proxy security - user: "Scan Vite bundles" โ search dist/ for leaked API keys or secrets - user: "Audit Vite SPA auth" โ verify server-side auth vs client route guards
Analyze TypeScript code structure using ts-morph. Use for summarizing class/interface APIs, listing exports, showing inheritance hierarchies, or extracting interfaces from classes. Outputs signatures without implementation details.
Review Next.js security audit patterns for App Router and Server Actions. Use for auditing NEXT_PUBLIC_* exposure, Server Action auth, and middleware matchers. Use proactively when reviewing Next.js apps. Examples: - user: "Scan Next.js env vars" โ find leaked secrets with NEXT_PUBLIC_ prefix - user: "Audit Server Actions" โ check for missing auth and input validation - user: "Review Next.js middleware" โ verify matcher coverage for protected routes - user: "Check Next.js API routes" โ verify auth in app/api and pages/api - user: "Secure Next.js headers" โ audit next.config.js for security headers
Review Bun runtime security audit patterns. Use for auditing Bun-specific vulnerabilities including shell injection, SQL injection, server security, and process spawning. Use proactively when reviewing Bun apps (bun.lockb, bunfig.toml, or bun:* imports present). Examples: - user: "Review this Bun shell script" โ audit `$` usage and argument injection - user: "Check my bun:sqlite queries" โ verify `sql` tagged template usage - user: "Audit my Bun.serve() setup" โ check path traversal and request limits - user: "Is my Bun.spawn() usage safe?" โ audit command injection and input validation - user: "Review WebSocket security in Bun" โ check authentication before upgrade
Interactive debugging via DAP-MCP for multiple languages with natural language commands
Find, install, and configure MCP servers. Use proactively for MCP discovery, OAuth setup, env vars, stdio vs SSE transport, or troubleshooting MCP connections. Examples: - user: "Add the filesystem MCP server" โ read server file, add to mcpServers in opencode.json, verify transport type - user: "How do I use MCP with GitHub?" โ check catalog, install @modelcontextprotocol/server-github, configure OAuth token - user: "MCP not connecting" โ check transport type (stdio/SSE), verify args/command, check env vars are passed - user: "What MCPs are available?" โ run list_mcps.py, show catalog with auth types and install commands
Enhanced list of custom Claude commands for iOS and macOS Swift projects with examples and output locations.
Use kuri-browse for quick terminal-based web browsing โ fetch and read web pages as markdown, follow links, search in-page. No Chrome needed. Use when the user wants to quickly read a webpage, check documentation, or browse without launching a full browser. Trigger phrases include "read this page", "fetch the docs", "browse to", "what does this page say".
