Security & Auditing Skills

Watch a pull request or review cycle until it is ready to merge. Use when asked to babysit, monitor, or keep checking PR comments, reviews, and CI until all actionable issues are resolved.

Enforce API auth + tenant/user isolation for FastAPI routes when touching headers, session context, installationid/userid filters, webhook/BFF identity flow, or cross-tenant 404/401 behavior.

Maintain CI security/quality gates when changing workflows, dependency tooling, lint/type/test steps, audit policies, or merge-blocking checks for backend/frontend pipelines.

Drafts short PR titles and bodies, summarizes small diffs, merge-readiness checklist, and obvious risks for the Nash AI monorepo. Use when opening or updating a pull request, when the user wants a quick PR summary, or when pairing with automation that needs copy-paste PR text.

Compact PR title and body, small-diff summary, readiness checklist, key risks. Use for PR open/update flows and background automation that need minimal copy-paste PR text. Same workflow as fast-pr with strict brevity. Bodies must be grounded in git log/stat for the actual base/head—no generic integration filler.

Like babysit: triage PR comments, resolve conflicts when clear, fix CI until checks are green—then merge each PR when status checks pass. Optionally, when the user explicitly requests it, run additional merges between named branches in order (e.g. develop into main after checks).

Secure Next.js BFF proxy/auth/session boundaries when editing app/api routes, middleware, cookie/session parsing, header forwarding, APIURL handling, or trusted network assumptions.

Closes or clears open PRs by pattern (branch head names), merges when checks are green, fixes failures in Agent mode until green, updates PR title/body using fastr-pr, and optionally appends [skip-nash-review] to descriptions. Use when the user asks to sweep dependabot/cursor branches, finish an integration branch, or merge/clean PRs between two named branches; ask clarifying questions when scope is ambiguous.

Researches implementation best practices using current chat context and the user's explicit prompt, then proposes a concrete default. Use when the user asks to "research", "read-search", "best practice", or requests a recommended config value grounded in docs.

Preserve LLM research runs across Slack, AutomationMemory, Zotero, and R2. Use for /learn runs that collect papers and /save requests that ask to store research artifacts.

Safely change Alembic schema/RLS policies when modifying tenant or user tables, session context variables, policy SQL, or migration order/rollback behavior.

Govern review context snapshot capture, redaction, retention, and export safety when touching snapshot schema/storage, debug artifacts, eval export, or privacy/compliance paths.

Strengthen ARQ webhook-to-worker reliability and idempotency when changing enqueue logic, duplicate suppression, retry/recovery semantics, or review status transitions.