security-audit-secure-sdlc
Activate when assessing security posture, performing threat modelling, reviewing secure coding practices, evaluating dependency hygiene, auditing secrets management, designing security gates for CI/CD pipelines, or mapping practices to compliance frameworks (NIST SSDF, OWASP, SOC 2). Use for security architecture reviews, STRIDE analysis, SAST/DAST/SCA tool selection, secure design principle enforcement, vulnerability triage, penetration test scoping, supply chain security, build integrity, and producing security findings reports. Covers both proactive design-time security and reactive incident-response readiness.
Repository SourceNeeds Review
code-implementer
Activate when the user wants to implement code from a design document, break a technical design into ordered implementation tasks, generate code phase by phase following the DESIGN.md, write code that satisfies BDD acceptance criteria, implement APIs to their OpenAPI/Protobuf specs, or drive implementation with inline security and quality checkpoints. Also trigger for: "implement this", "write the code", "build it", "start coding", "implement the design", "code the feature", "implement phase 1", "write the service", "generate the implementation", "build from the design doc", "implement the spec".
Repository SourceNeeds Review
devops-pipeline-governance
Activate when designing or reviewing CI/CD pipelines, evaluating pipeline security and integrity, defining deployment strategies, establishing environment promotion policies, setting up release automation, governing infrastructure-as-code practices, defining rollback procedures, or troubleshooting pipeline failures blocking a release. Use for pipeline architecture, build reproducibility, deployment safety, environment parity, and the controls that ensure only reviewed and tested code reaches production.
Repository SourceNeeds Review
feature-flag-lifecycle
feature flag, flag lifecycle, flag debt, flag cleanup, stale flags, release flag, flag registry, rolling out a flag, flag removal, dark launch, kill switch, gradual rollout, flag expiry, flag audit, feature toggle
Repository SourceNeeds Review