security-audit-runner

Test-driven development, red then green, one vertical slice at a time. Use when building a feature, a rule, a config option or a bug fix test-first, when the user says "TDD", "red-green" or "write the test first", or when a subagent is handed a ticket to build.

Prove a change before claiming it is done - judge lint, typecheck, tests and git push by their exit codes rather than by reading output, and show that a bug fix's regression test fails without the fix. Use before saying "tests pass", "lint is clean", "pushed" or "fixed in <sha>"; before opening or updating a pull request; whenever a command is piped into grep, tail or head; and whenever a bug fix or false-positive fix ships with a new test. For whether a measured number (a score, a timing, an eval result) can be credited to a change, use `explain-the-number`.

Investigate a question against primary sources and capture the findings as one cited Markdown note. Use when the user wants a topic researched, a vendor's docs or API facts gathered, a library's or tool's real behavior confirmed, or reading legwork delegated while the main session keeps working.

Review a finished coding session for what slowed the agent down or let a mistake through, and turn one lesson into a test, check or doc in the project so the next session does not repeat it. Use when the user asks for a retro or retrospective, a post-mortem of a session, or "what should we change so this doesn't happen again". To carry unfinished work into a new session, use `handoff`; to prove a fix before claiming it, use `regression-proof`.

Find skills whose descriptions fight over the same request, so Claude picks one at random or the wrong one, and fix the descriptions. Use when the user asks to audit, clean up or deduplicate their skills, when a skill fires that should not have, after installing a plugin, or before adding a new skill to a large library.

Route a multi-step task across cheaper subagents while the main session keeps the plan, the judgment calls and the verification. Use at the start of any task with more than one step, before spawning a subagent, when picking a model for a subtask, when a subagent fails, or when the user mentions cost, tokens or model choice.

Shorten an existing ticket that is too long or too technical, moving the engineering detail into a Technical notes comment so nothing is lost. Use when the user gives a ticket key or link and asks to trim, condense, simplify or clean it up, or says a product owner or analyst found it hard to read.

Writing documents for agents. Use when creating or editing a skill (its SKILL.md, description or reference files), when modifying AGENTS.md or CLAUDE.md, or when reviewing an agent-facing document that behaves inconsistently across runs. Prose that people read, such as a memo or a one-pager, follows its own rules.

Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized `repro_outputs/` files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

When the user wants help with pricing decisions, packaging, or monetization strategy. Also use when the user mentions 'pricing,' 'pricing tiers,' 'freemium,' 'free trial,' 'packaging,' 'price increase,' 'value metric,' 'Van Westendorp,' 'willingness to pay,' 'monetization,' 'how much should I charge,' 'my pricing is wrong,' 'pricing page,' 'annual vs monthly,' 'per seat pricing,' 'should I offer a free plan,' 'pricing page teardown,' 'pricing page audit,' 'is my pricing page AI-readable,' or 'can AI read my pricing.' Use this whenever someone is figuring out what to charge, how to structure their plans, or wants to audit a pricing page (for humans and for the AI agents that shortlist tools). For in-app upgrade screens, see paywalls. For offer construction (bonuses, guarantees, value framing, naming) on services/courses/coaching/high-ticket B2B, see offers.

Authentication integration guidance — Clerk (native Vercel Marketplace), Better Auth, Descope, and Auth0 setup for Next.js applications, plus Sign in with Vercel, Vercel Passport, and Vercel KMS. Covers server config, route handlers, proxy.ts auth patterns, sign-in/sign-up flows, and Marketplace provisioning. Use when implementing user authentication, sessions, protected routes, or protecting deployments.

Vercel Firewall expert guidance — automatic DDoS mitigation, the Vercel WAF (custom rules, IP blocking, managed rulesets, rate limiting), Attack Mode, system bypass, bot management, and the `vercel firewall` CLI. Use when configuring platform-level security, responding to attacks, or staging firewall rules.

Read Snowflake from an AIDP notebook through the AIDP `aidataplatform` Spark format handler. Use when the user mentions Snowflake, Snowflake warehouse, Basic authentication, KeyPair authentication, private.key.file, or private.key.content. Snowflake writes are not supported in AIDP 4.0.

Show failing Vanta compliance tests, prioritized by what can be fixed from this repository