
Validate completed work against acceptance criteria, architecture design, and customer requirements. Use as a quality gate before marking stories as passed.
Generate API documentation from code endpoints. Use when APIs are added or changed to produce Markdown or OpenAPI docs.
Review authentication and authorization design including OAuth, JWT, token expiration, RBAC/ABAC, and privilege escalation risks.
Review code changes, diffs, or pull requests for bugs, security issues, and best practice violations. Use after code changes or before merging PRs.
Scan application code for OWASP Top 10 vulnerabilities, injection flaws, XSS, CSRF, hardcoded secrets, and unsafe cryptography.
Generate conventional commit messages from staged git changes. Use after staging files before committing.
Update project README based on current project structure and code. Use when project structure changes.
Review Terraform code for module structure, state management, provider versioning, security, and operational best practices.
Generate unit and integration tests for project code. Use when new code is written or test coverage needs improvement.
Perform STRIDE threat modeling on application architecture to identify spoofing, tampering, repudiation, info disclosure, DoS, and elevation of privilege threats.
Audit cloud and infrastructure configurations for open security groups, missing encryption, excessive permissions, and missing WAF or rate limiting.
Validate secret storage practices and rotation policies. Check for secrets in code, Vault usage, and rotation schedules.
Audit project dependencies for vulnerabilities, outdated versions, license compatibility, and supply-chain risk. Use before releases or periodically.