Build, run, and improve a Security Operations Center — alert prioritization, runbook authoring, escalation criteria, on-call structure, alert tuning workflow, MTTD / MTTR / fidelity KPIs, analyst tiering, and shift handoffs. Use when the user mentions 'SOC,' 'security operations,' 'SOC analyst,' 'alert triage workflow,' 'runbook,' 'escalation,' 'on-call,' 'SOC tiering,' 'tier 1 / tier 2,' 'MTTD,' 'MTTR,' 'alert fatigue,' 'alert tuning,' 'shift handoff,' 'SOAR,' or wants to design or improve a security operations team.

Build a throwaway prototype to flush out a design before committing. Routes between two branches — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route. Use when the user wants to prototype, sanity-check a data model or state machine, mock up a UI, explore design options, or says "prototype this", "let me play with it", "try a few designs".

Evaluate or develop strategy using Richard Rumelt's kernel of good strategy — Diagnosis, Guiding Policy, and Coherent Actions. Use when you need to cut through vague strategic plans and get to the hard choices, or when you suspect your "strategy" is actually just a list of goals.

Summarize experiment results, call a winner, and draft a stakeholder-ready recommendation. Use when an A/B test is complete and you need to communicate results.

Visit each competitor's homepage, features page, pricing page, and blog using Chrome MCP, then write a structured competitive intelligence report saved to Google Drive. Use for a standing weekly competitive pulse or an on-demand deep-dive.

Define a North Star Metric and its input metrics. Classify the game your product plays, evaluate candidates against quality criteria, and build a connected metric system. Use when choosing a North Star, evaluating an existing one, or setting up a metrics framework.

Diagnose where and why users churn, identify natural usage frequency, build cohort retention curves, and find the behaviors that drive long-term retention. Use when a PM needs to understand churn, improve retention curves, or identify what makes users stick.

Diagnose where new users fail to activate, identify the aha moment, measure time-to-value, and build a sized plan to move activation rate. Use when a PM needs to understand why signups don't convert to active users, find the aha moment, reduce time-to-value, or improve onboarding.

Diagnose where users come from, measure channel efficiency, identify organic vs. paid mix health, calculate CAC by segment, and find the highest-leverage acquisition channels. Use when a PM needs to understand acquisition economics, optimize channel mix, or figure out why growth is stalling at the top of the funnel.

All AI CLI tools × available models × required subscriptions × Bloom max capability. Reference table for choosing which models to use in multi-agent-shogun. Trigger: "model list", "what models", "model comparison", "which models can I use", "モデル一覧", "モデル比較", "どのモデルが使える"

Use when the user (or a sibling skill via --wt flag) wants to spin up an isolated git worktree for a task — wraps the worktrunk `wt` CLI when present, falls back to native `git worktree`, switches the Bash session cwd into the new worktree, auto-applies docker isolation when profile present (skip with --no-isolate), and emits a machine-readable result envelope

Use when the user wants to apply a visual design system to a project, references a specific brand's style (Linear-like, Stripe-like, Claude-like), asks for a DESIGN.md, or describes aesthetic intent (warm editorial, dark minimal, stark futuristic) for AI UI generation

Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when the user wants to stress-test a plan against their project's language and documented decisions, or asks to "grill me with docs" or "interview me about this".

Migrates Kotlin Multiplatform (KMP) projects to Android Gradle Plugin 9.0+. Handles plugin replacement (com.android.kotlin.multiplatform.library), module splitting, DSL migration, and the new default project structure. Use when upgrading AGP, when build fails due to KMP+AGP incompatibility, or when the user mentions AGP 9.0, android multiplatform plugin, KMP migration, or com.android.kotlin.multiplatform.library.

Make a web app feel native on a phone — the small CSS and meta-tag fixes that separate "a website in a browser" from something that feels installed. Covers sticky hover states, tap highlight flashes, the 100vh bug, inputs that zoom the page, laggy taps, pull-to-refresh hijacking scroll, content under the notch, long-press selecting button text, carousels that scroll the wrong way, mismatched status bars, and the rule that you test on real hardware. Use when a web app is being built for or reviewed on mobile, when something "works in Chrome but feels wrong on my phone", when building a PWA, a bottom sheet, a carousel, a full-screen layout, or any touch interaction. For motion itself use animate; for React Native use animate-expo.

Triage and act on a code review. Takes reviewer feedback - from a human, a PR, or an external agent that lacked your plan and chat history - and works through it without assuming the reviewer is right. Verifies each item against the actual current code, applies the straightforward, valid, relevant, small, and uncontested fixes directly, and escalates the load-bearing or risky ones - anything that affects performance, backward compatibility, public API/behavior, or needs a larger refactor - to you as easy-to-read options, then runs the project's quality gates before reporting. Use when you say "address this review", "apply the review feedback", "go through the review comments", "handle the PR feedback", "act on this code review", "fix what the reviewer found", or after /code-review or an external agent produces findings. Do NOT use to *produce* a review (use code-review or high-stakes for that), nor to apply every suggested change blindly without verifying.

Writes portable POSIX sh scripts with getoptions argument parsing, single-file builds, and production patterns (traps, temp files, logging, pipelines). Triggers: shell script, sh script, bash script, CLI tool, command-line tool, getoptions, argument parsing, Makefile recipe, cron job, init script, git hook, CI/CD shell step, deployment script, automation task. Do NOT activate for Python, Node.js, or other non-shell scripting tasks.

Translates C/C++ into Lean 4 for interactive theorem proving — deep verification where automated tools fail. Use when Dafny's automation isn't enough, when proving mathematical properties of an algorithm, or when building a machine-checked proof for publication or certification.

Uses failing test results as signals to guide bug search and narrow down candidate fault locations. Use when one or more tests are failing and the user wants to understand what's broken, when CI reports failures, or when triaging a batch of test failures after a change.

Automatically synthesizes code patches to fix identified bugs, leveraging the bug location and surrounding context. Use when a bug has been localized and the user wants an automated fix, when generating candidate patches for review, or when the user asks to fix a specific bug.