Quality

Performs initial reconnaissance of a codebase for security assessments, mapping technology stack, architecture, entry points, data flows, and trust boundaries. Produces an architecture report to guide subsequent vulnerability detection.

Consolidates findings from multiple SAST result files into a final security report ranked by severity and confidentiality impact. Use after running individual vulnerability scans to generate a comprehensive assessment summary.

Automatically detects SQL injection vulnerabilities in a codebase using a three-phase SAST approach with parallel subagents. Use when asked to find SQLi or database injection bugs.

Detect Server-Side Request Forgery (SSRF) vulnerabilities in codebases using a three-phase approach: recon, batched verification, and merging results. Use for security assessments when asked to find SSRF bugs.

Detects Server-Side Template Injection (SSTI) vulnerabilities by scanning for dynamic template rendering sites, then tracing user input flows in parallel to verify exploitability, and consolidating results. Use when auditing for template injection bugs.

Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon, batched verify, and merge. Use when asked to find XXE or XML injection bugs.

Fixing Underperforming Teams helps users identify why a team is struggling and implement a structured recovery plan addressing leadership gaps, individual performance, and structural misalignments.

Caliber Testing writes Vitest tests following project patterns: __tests__ directories, vi.mock() with vi.hoisted(), global LLM mock, environment save/restore, and cleanup in afterEach. Use when asked to write tests, add coverage, or debug test failures.

Scoring Checks adds new deterministic checks in src/scoring/checks/ that evaluate AI agent config quality. Use it when adding or modifying scoring criteria, ensuring checks follow the Check[] return pattern and point constants from src/scoring/constants.ts.

AGTX Review examines completed work for correctness, edge cases, and code quality, then writes findings to .agtx/review.md and stops.

Debug Agent reproduces, diagnoses, and fixes bugs with minimal code changes and regression tests. Use it when an error, crash, regression, or performance issue needs root cause analysis and a scoped fix.

Deepsec drives Vercel's deepsec agent-powered vulnerability scanner to bootstrap a workspace, run calibrated scans, triage and revalidate findings, and set up per-PR CI security gates. Use it for first-time setup, scoped scans, project-specific matchers, or diagnosing scanner failures.