Review

Turn a PR, branch, commit, or working-tree diff into one self-contained HTML recap page with before/after wireframes, contract summaries, a file map, and annotated diffs. Use for "recap this PR", "visual recap", "review this diff visually", "show me what this branch changed", "critique this change", or before any large or UI-heavy review. Not for small single-file diffs.

Run OpenAI's agentic security scanner (`@openai/codex-security`) over a repo, PR, or diff, then triage, patch, and gate on its findings. Use for 'run a codex security scan', 'find vulnerabilities in this PR', 'export findings as SARIF', 'fix that security finding', 'compare this scan to the last one', or when a pattern sweep came back thin. Not for dependency CVEs, secrets, or licenses (code-audit-scripts, bun audit).

Produce one self-contained, theme-aware HTML page led by grounded diagrams for work that has not been built. Use for "make a visual proposal", "present these options visually", "diagram the trade-offs", "turn this plan into something reviewable", or a shareable design pitch, RFC, or options comparison. Use visual-review for completed code changes.

Explore a running app on randomized unscripted paths to surface new bugs, broken flows, and confusing UX, then file deduplicated tickets. Use for "free roam", "explore the app", "monkey test", "exploratory testing", "find issues I don't know about", or "discovery loop". Respects a never-touch list and blast-radius boundary. Not for scripted regression tests.

Run deterministic code security and quality scans — secret detection, debug artifact cleanup, and TODO/FIXME tracking. Use this skill before any security review, code audit, PR review, or when the user says 'scan for secrets', 'find debug logs', 'check for TODOs', 'audit this code', 'security scan', or 'clean up before shipping'. Also use proactively before deployments or when reviewing unfamiliar codebases. Runs all scans in parallel for speed.

This skill should be used when the user asks to 'find bugs', 'do a thorough code review', 'run a security audit', 'hunt for bugs', 'check for correctness issues', or 'review this code for edge cases'. Orchestrates a three-phase adversarial review using three isolated agents — Jerry (Hunter), Kayle (Skeptic), Jason (Referee) — to neutralize sycophancy and produce high-fidelity bug reports. User-facing command: /bug-hunt