Activate for ANY dependency audit, vulnerability scan, package safety check, pre-deployment/compliance security review, or any request to assess, verify, or provide evidence of the security of third-party packages or libraries — including 'is [library] [version] safe?' queries and remediation of insecure packages. Uses the Meterian CLI (npx @meterian/cli) for cross-language, unified dependency scanning with a shared advisory database covering Node.js, Python, Java, Rust, Go, Ruby, .NET, PHP, Dart, and more. Also activates automatically when the user opens or modifies a manifest file (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, pom.xml, Cargo.toml, go.mod, Gemfile, composer.json, build.gradle, *.csproj, pubspec.yaml, conanfile.txt, conanfile.py, project.clj, deps.edn, Package.swift, pubspec.lock, Package.resolved, Gemfile.lock, poetry.lock, uv.lock, Cargo.lock, composer.lock).

Open and warm up a cv2.VideoCapture reliably, probe for real (non-black) frames before starting the main loop, and handle macOS index enumeration quirks. Use when a VideoCapture call succeeds but returns black/stale frames, when switching between built-in and USB webcams, or when the first ~5 seconds of a pipeline produce zero face detections.

Run expensive per-frame inference (face recognition, emotion classification, ViT embeddings) at a fraction of the capture rate so the camera loop stays responsive. Use when designing a vision pipeline that combines high-rate capture (30fps+) with heavy per-frame work (dlib, ViT, DeepFace) and you don't need every frame to be inferred.

Create tessl tiles containing docs, rules, or skills. Use when a user wants to create a tile, package content for tessl, or needs help with tile.json configuration. Also triggers on "create tile from", "convert to tile", "turn into tile", "make tile from", or "tile this repo" for existing content.

Append context-aware next-step suggestions after every agent response. Generates actionable follow-ups, surfaces unfinished tasks from memory, and includes at least one creative lateral suggestion. Self-learns user preferences for count, categories, and format. Use when: (1) any response is generated and nextsteps is active, (2) user says /nextsteps, "next steps", "what should I do", "suggestions", "what now", (3) user wants to customize suggestion count, categories, or format, (4) user says "disable next steps" or "enable next steps".

Prisma ORM patterns — schema design, migrations, type-safe queries, relations, transactions, connection pooling, error handling, testing, raw SQL safety, and performance. Use when building or reviewing apps with Prisma, when setting up a new database with Prisma, when writing tests for Prisma-backed code, or when debugging query performance.

Apply SOLID principles, detect design anti-patterns, and evaluate architectural tradeoffs for code reviews, design decisions, and refactoring. Use when reviewing code for maintainability issues, evaluating architecture decisions, identifying code smells and technical debt, or refactoring modules with coupling or testability problems.

Execute a strict Red-Green-Refactor TDD cycle for a single requirement at a time, in any language or framework. Use when the user provides a business rule, acceptance criterion, or feature requirement and wants a failing test written first, followed by minimum implementation, then a clean refactor. Works for unit tests, integration tests, UI component tests, and API tests across stacks including TypeScript, JavaScript, React, .NET (C#/xUnit/NUnit), Python, Java, and others. Triggered by phrases like "write a test first", "TDD", "red-green-refactor", "behavioral test", "test-driven", "failing test first", or "write the test before the code".

Extract actionable insights and valuable artifacts from web posts, articles, and technical documentation. Use when summarizing content, extracting key ideas from URLs/articles, preserving code snippets and diagrams, or creating visual summaries. Triggers on requests like "summarize this post", "extract insights from", "distill this article", "what are the key takeaways", or when a URL is shared for analysis.

Use when conducting a security audit, security review, vulnerability assessment, vulnerability check, or secure coding review on Hanami 2.x applications — validate params via the Params DSL in every Action, verify CSRF protection is enabled in config/app.rb, audit authentication checks via explicit `before :authenticate!`, check authorization with role/permission checks, never log passwords/tokens/secrets, use ROM query interface to prevent SQL injection (no string interpolation in `where("...")`), never use `raw` on user input in templates, store secrets in settings not hardcoded, and return generic error messages for auth failures. Validates parameter handling, CSRF, auth integration, XSS, session configuration, and hardening posture.

ASP.NET Core project structure — Clean Architecture layers, minimal APIs vs controllers, IServiceCollection extensions, IOptions pattern, EF Core DbContext configuration, and proper DTO separation. Apply proactively when building any .NET API, even when the user does not ask for structure guidance.