200 skills · sorted by relevance
Run Gemini CLI to review code, assess technical plans, and analyze large collections of files. Choose a model and execution settings for the task, then capture findings about security, maintainability, architecture, or technical debt.
Analyze large logs, test results, API responses, and files outside the conversation, then return focused findings. It guides agents to save, process, index, and search outputs while limiting how much raw data enters their working context.
Explore code structure and history using an index of code relationships and meaning-based search. Trace calls, assess change impact, find likely bug locations, generate architecture reports, and review pull requests for risk and conflicts.
Choose a web application stack, generate a starter project, and assess existing code quality. Uses team size, release frequency, audience, and budget to guide recommendations, with reports covering security, complexity, dependencies, and prioritized improvements.
Run a quick first review of code changes with six specialist agents working in parallel. They check logic, input and output, shared state, resources, missing behavior, and API completeness, then combine duplicate findings into a report ranked by confidence.
Investigate Bifrost GitHub issues by examining reports, related code, and library documentation. Produce an implementation plan with impact analysis and regression tests, including a demonstrated failing test for bugs before requesting approval to fix them.
Build a documented understanding of unfamiliar code before a security audit. It records function assumptions, guarantees, dependencies, and open questions, producing a dossier and individual function notes to support later vulnerability analysis.
Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.
Check GitHub pull request review comments against the actual code. Classify findings as valid, invalid, or partially valid, identify similar issues elsewhere, and produce recommended actions, with optional replies after user approval.
Organize work so an expensive AI model handles planning, judgment, and final review while cheaper helper agents perform bounded research, coding, and testing. Define ownership and verification requirements, then inspect the evidence and integrate their results centrally.
Explore code through structured summaries of functions, calls, branches, and variable usage. Use the tldr commands to locate relevant files, trace change impacts, find affected tests, and identify potentially unused code before inspecting the implementation.
Guides authorized source code security reviews across dangerous functions, data flow, authentication, logic flaws, and dependencies. Helps agents prioritize review paths and organize code locations, reproduction evidence, and remediation advice before drawing conclusions.
Compare feature requirements with existing code to identify missing capabilities and integration challenges. Evaluate extending current components, building new ones, or combining both, and save the findings to guide technical design.
Map the load-bearing files, symbols, callers, and dependencies of an unfamiliar codebase before making changes. Use for architecture orientation, impact analysis, what-would-break questions, or finding callers. Uses CodeGraph when available and a dependency-free builtin fallback.
The English summary is being prepared. Showing the original description.
Answers questions about a code repository using source file analysis. Use when the user asks a question about how something works, wants to understand a component, or needs help navigating the codebase.
The English summary is being prepared. Showing the original description.
Feature specification creation from codebase research. Produces requirements, acceptance criteria, architecture decisions, implementation plans, and risk analysis.
The English summary is being prepared. Showing the original description.
Master systematic debugging techniques, profiling tools, and root cause analysis to efficiently track down bugs across any codebase or technology stack. Use when investigating bugs, performance issues, or unexpected behavior.
The English summary is being prepared. Showing the original description.
Generate comprehensive C4 architecture documentation for an existing repository/codebase using a bottom-up analysis approach.
The English summary is being prepared. Showing the original description.
Maintenance orchestrator for the brooks-lint plugin itself. Runs a sequential subagent pipeline — author → eval → QA → trigger-audit → release — to add or edit a skill, refresh the eval suite, keep the four manifests + all README translations + CHANGELOG + AGENTS/GEMINI in sync, audit trigger boundaries, and cut releases. Drives the five agents in .codex/agents/ (skill-author, eval-curator, consistency-qa, trigger-boundary-auditor, release-manager). Triggers when the maintainer asks to work ON brooks-lint itself: "add a new skill", "edit the brooks-debt guide", "update the eval suite", "fix the trigger descriptions", "make this change and validate it", "release brooks-lint", "bump and publish", and follow-ups: "re-run", "re-validate", "update that skill", "redo the audit", "do the X part again". Do NOT trigger for: USING the brooks-lint analysis skills on some target codebase (that's brooks-review / brooks-audit / brooks-debt / brooks-test / brooks-health / brooks-sweep); generic questions about brooks-lint that don't ask to change it; or maintenance of a different plugin.
The English summary is being prepared. Showing the original description.
Maintenance orchestrator for the brooks-lint plugin itself. Runs a sequential subagent pipeline — author → eval → QA → trigger-audit → release — to add or edit a skill, refresh the eval suite, keep the four manifests + all README translations + CHANGELOG + AGENTS/GEMINI in sync, audit trigger boundaries, and cut releases. Drives the five agents in .claude/agents/ (skill-author, eval-curator, consistency-qa, trigger-boundary-auditor, release-manager). Triggers when the maintainer asks to work ON brooks-lint itself: "add a new skill", "edit the brooks-debt guide", "update the eval suite", "fix the trigger descriptions", "make this change and validate it", "release brooks-lint", "bump and publish", and follow-ups: "re-run", "re-validate", "update that skill", "redo the audit", "do the X part again". Do NOT trigger for: USING the brooks-lint analysis skills on some target codebase (that's brooks-review / brooks-audit / brooks-debt / brooks-test / brooks-health / brooks-sweep); generic questions about brooks-lint that don't ask to change it; or maintenance of a different plugin.
The English summary is being prepared. Showing the original description.
Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/jwt-results.md. If no JWT usage is found in Phase 1, Phase 2 is skipped. Use when asked to find JWT, token forgery, or authentication bypass bugs.
The English summary is being prepared. Showing the original description.
Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input to those sites in parallel subagents, up to 3 candidate sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/graphql-results.md. If no GraphQL technology is found in Phase 1, later phases are skipped. Use when asked to find GraphQL injection, unsafe GraphQL document construction, or operation string injection bugs.
The English summary is being prepared. Showing the original description.
Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssrf-results.md. Use when asked to find SSRF or server-side request forgery bugs.
The English summary is being prepared. Showing the original description.
Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to each site in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xxe-results.md. Use when asked to find XXE or XML injection bugs.
The English summary is being prepared. Showing the original description.