security-audit-secure-sdlc
Activate when assessing security posture, performing threat modelling, reviewing secure coding practices, evaluating dependency hygiene, auditing secrets management, designing security gates for CI/CD pipelines, or mapping practices to compliance frameworks (NIST SSDF, OWASP, SOC 2). Use for security architecture reviews, STRIDE analysis, SAST/DAST/SCA tool selection, secure design principle enforcement, vulnerability triage, penetration test scoping, supply chain security, build integrity, and producing security findings reports. Covers both proactive design-time security and reactive incident-response readiness.
Repository SourceNeeds Review
ai-assisted-engineering
Activate when engineers want to use AI tools more effectively in daily work — coding, review, debugging, refactoring, test generation. Use when establishing team norms for AI tool use, reviewing AI-generated code for correctness and security, diagnosing why AI tool results are poor quality, or deciding which tasks belong to Claude vs Cursor/Copilot vs human. Applies to Claude Code, Cursor, GitHub Copilot, MCP integrations, and agentic coding workflows.
Repository SourceNeeds Review
code-implementer
Activate when the user wants to implement code from a design document, break a technical design into ordered implementation tasks, generate code phase by phase following the DESIGN.md, write code that satisfies BDD acceptance criteria, implement APIs to their OpenAPI/Protobuf specs, or drive implementation with inline security and quality checkpoints. Also trigger for: "implement this", "write the code", "build it", "start coding", "implement the design", "code the feature", "implement phase 1", "write the service", "generate the implementation", "build from the design doc", "implement the spec".
Repository SourceNeeds Review
devops-pipeline-governance
Activate when designing or reviewing CI/CD pipelines, evaluating pipeline security and integrity, defining deployment strategies, establishing environment promotion policies, setting up release automation, governing infrastructure-as-code practices, defining rollback procedures, or troubleshooting pipeline failures blocking a release. Use for pipeline architecture, build reproducibility, deployment safety, environment parity, and the controls that ensure only reviewed and tested code reaches production.
Repository SourceNeeds Review