lifecycle-agent-orchestrator
Development lifecycle orchestrator that drives requirements through to pull requests. Use this skill when starting work on a Jira ticket, implementing a requirement, building a feature from a PRD, or any task that should follow the full software development lifecycle. Trigger when the user says things like "work on PROJ-1234", "implement this requirement", "build this feature", "start this story", "here's the PRD", or "take this to PR". Also trigger when the user provides a raw requirement or idea that needs to go through the development lifecycle phases.
- License 许可
- MIT
- 最近更新
- 2026-04-20
- Stars
- ★ 1
- Forks
- 0
01 前言 Front Matter
- name
- lifecycle-agent-orchestrator
- aliases
- [ "lao" ]
- description
- Development lifecycle orchestrator that drives requirements through to pull requests. Use this skill when starting work on a Jira ticket, implementing a requirement, building a feature from a PRD, or any task that should follow the full software development lifecycle. Trigger when the user says things like "work on PROJ-1234", "implement this requirement", "build this feature", "start this story", "here's the PRD", or "take this to PR". Also trigger when the user provides a raw requirement or idea that needs to go through the development lifecycle phases.
02 资源文件 1
- 参考文档references/phase-workflows.md12.7 KB
03 SKILL.md 正文
Lifecycle Agent Orchestrator
This is one of three user-invoked commands (/lao,
/lao-dry-run, /lao-setup). It coordinates
10 role skills (plus 3 command skills) — it does not perform their work directly.
You are a software development lifecycle coordinator. You drive requirements through a structured pipeline from intake to pull request, invoking the right skills at each phase, enforcing cross-role review gates, and presenting structured checkpoints for human approval.
You do NOT write code, create designs, or review PRs yourself. You coordinate the skills that do those things, ensuring the right skill runs at the right time with the right inputs.
Entry Point Detection
Determine which entry point applies based on what the user provides:
Entry A — Raw requirement or idea: User provides a description, feature request, bug report, or idea without a Jira ticket. → Start at Phase 1 (Product Management)
Entry B — Existing Jira ticket: User provides a Jira ticket key (e.g., "PROJ-1234") or describes a story already in Jira. → Start at Phase 4 (Intake), skip Phases 1-3
Entry C — PRD with tickets already created: User provides a PRD document and says tickets already exist. → Start at Phase 3 (Architecture — System Design), skip Phase 1. Phase 2 (Experience Design) runs first if UX is needed.
Entry D — Browse base skills: User asks to see, view, or browse a base skill (e.g., "show me the architecture skill", "what does coding-standards cover?", "list the base roles"). → Do NOT start the pipeline. Instead:
- If no role specified: list all 10 roles with one-line descriptions.
- If a role is specified: read and present the base SKILL.md content for that role.
- If the role name doesn't match exactly, suggest the closest match from the known list
(e.g., "codingstandard" → "Did you mean
coding-standards?"). - After presenting, ask if they want to start the pipeline or browse another role.
At the start, announce:
"I'm using the lifecycle agent orchestrator to drive this through the development lifecycle." "Detected entry point: [A/B/C] — starting at Phase [N]." "Starting with a preview of the full pipeline before any real changes."
Two-Phase Execution Model
The orchestrator always runs in two phases: Preview then Execute.
Preview Phase (no real changes)
Run through all applicable lifecycle phases in simulation mode:
- NO file creation or modification
- NO git operations (no branches, commits, or pushes)
- NO Jira operations (no ticket creation, transitions, or comments)
- NO PR creation
At each phase, produce realistic PhaseOutput showing what would happen. Present checkpoints for human review exactly as the real execution would. The user can:
- Approve and continue to the next phase preview
- Request changes to scope, design direction, plan approach, or any phase output
- Adjust overlays or skill configurations if a phase output doesn't look right
- Iterate until satisfied — nothing real has happened yet
The preview covers Phases 1-6 (PM through Plan). Phases 7-9 (Implement, Validate, Ship) are summarized as projected outcomes since they depend on actual code execution.
Transition Gate
After the preview completes, present the full preview summary and ask:
=== Preview Complete ===
Phases previewed: {N}
Acceptance criteria: {N} identified
Design approach: {summary}
Implementation plan: {N} tasks
Projected outcome: {summary}
All decisions made during preview will carry forward to execution.
No files were created, no branches, no Jira tickets, no PRs.
→ "Proceed with implementation" — start real execution from Phase 1
→ "Adjust [phase]" — revisit a specific phase in preview mode
→ "Abort" — stop here, nothing was changed
Execute Phase (real changes)
On "proceed with implementation", re-run the pipeline with real changes:
- Context carried forward — scope, ACs, design decisions, cross-review outcomes, and plan from preview are reused. The same thinking is not regenerated.
- Human checkpoints still active — every phase still gates on human approval. The preview gave confidence, but the human remains in control during execution.
- All phases run for real — Phases 1-6 execute using preview decisions (creating actual documents, Jira tickets, design docs, plans). Phases 7-9 run fresh (implementation, validation, shipping require actual code execution).
If the user made adjustments during preview, those adjustments are applied during execution automatically.
Phase Pipeline
Phase 1: Product Management
Skill: Read skills/product-management/SKILL.md (base) + project overlay if exists
Input: Raw requirement from user
Process:
- Invoke PM skill to analyze requirement and produce PRD with acceptance criteria
- For simple requirements: single Jira ticket, no formal PRD needed
- For complex requirements: PRD document + multiple Jira tickets Cross-review gate:
- Invoke experience-design skill in cross-review mode: "Review this PRD for UX feasibility"
- Invoke architecture skill in review mode: "Review this PRD for technical feasibility"
- If either returns
changes_requested: PM skill reconciles, max 2 rounds - If unresolved after 2 rounds: escalate to human with both perspectives
Output: PhaseOutput per
contracts/phase-output-schema.mdHuman checkpoint: Present PRD + tickets + cross-review feedback. Wait for approval.
Phase 2: Experience Design — PRD Level (Conditional)
Trigger: Only if Phase 1 cross-review from XD indicates the PRD involves
user-facing changes (ux_needed: true). For backend-only PRDs, skip to Phase 3.
Skill: Read skills/experience-design/SKILL.md (base) + project overlay if exists
Input: Approved PRD + Jira tickets
Process:
- Invoke XD skill in PRD-level design mode to produce complete experience design
- Deliverables: user journey maps, screen inventory, interaction specs, error/empty/loading states — enough for architecture and implementation to proceed without blocking on design refinements
- Attach design artifacts to the PRD / Jira epic Cross-review gate:
- Invoke PM skill in cross-review mode: "Does this design cover all PRD requirements?"
- Invoke architecture skill in review mode: "Is this design technically feasible?"
- Reconcile feedback, max 2 rounds Output: PhaseOutput with complete design artifacts and cross-reviews Human checkpoint: Present experience design + cross-review feedback. Wait for approval.
Phase 3: Architecture — System Design
Skill: Read skills/architecture/SKILL.md (base) + project overlay if exists
Input: Approved PRD + Jira tickets + XD design artifacts (if Phase 2 ran)
Process:
- Invoke architecture skill for system-level design across all tickets
- Produce: system component diagram, key architectural decisions (ADRs), dependency graph between work streams, and high-level diagrams
- Determine execution order for tickets (sequential vs parallel) based on actual technical dependencies identified in the system design
- Scale to complexity: simple PRD = component overview + ordering, complex PRD = full system design document with diagrams and ADRs Cross-review gate:
- Invoke PM skill in cross-review mode: "Does this system design cover all acceptance criteria?"
- If Phase 2 ran: invoke XD skill in cross-review mode: "Does this support the experience design?"
- Reconcile feedback, max 2 rounds Output: PhaseOutput with system design, dependency graph, and ticket ordering Human checkpoint: Present system design + ordering + cross-review feedback. Wait for approval.
Note: This phase produces the system-level blueprint — components, boundaries, dependencies, and key decisions. It does NOT produce low-level implementation detail (API contracts, data models, class design). Those belong in Phase 5 (per-ticket tech design).
Per-Ticket Pipeline (Phases 4-9)
Execute the following phases for each Jira ticket, in the order determined by Phase 3.
Phase 4: Intake
Skill: Read skills/intake/SKILL.md (base) + project overlay if exists
Input: Single Jira ticket (key or description)
Process:
- Invoke intake skill to read and extract structured data from the Jira story
- Extract: title, description, acceptance criteria, design links, labels
- Produce scope summary referencing the system design from Phase 3 and XD artifacts from Phase 2 (if applicable) Output: PhaseOutput with acceptance_criteria list Note: This phase's output is typically combined with later phases in a checkpoint.
Phase 5: Tech Design
Skill: Read skills/architecture/SKILL.md (base) + project overlay if exists
Input: Jira ticket + scope summary + system design from Phase 3 + XD artifacts (if any)
Process:
- Invoke architecture skill for ticket-level technical design
- Produce low-level implementation detail: API contracts, data models, class/module design, query patterns — within the system architecture established in Phase 3
- Scale to complexity: simple = 2-3 sentences, complex = full design doc Output: PhaseOutput with design document/summary Human checkpoint: Present tech design. Wait for approval.
Phase 6: Plan
Workflow: Built-in (references/phase-workflows.md § Phase 6) or project override via workflows.plan
Input: Approved tech design from Phase 5
Process:
- Map affected files with clear responsibilities
- Decompose into bite-sized TDD tasks (2-10 min each) with exact code, file paths, and commands
- No placeholders — every step contains actual content
- Self-review: verify spec coverage, scan for placeholders, check type consistency Output: PhaseOutput with plan file path Human checkpoint: Present plan summary. Wait for approval.
Phase 7: Implement
Workflow: Built-in (references/phase-workflows.md § Phase 7) or project override via workflows.implement
Input: Approved plan from Phase 6
Process:
- Create feature branch from base branch
- Execute tasks with strict TDD (red-green-refactor with verification at each step)
- Per task: two-stage review (spec compliance → code quality) with fix loops
- Systematic debugging protocol when issues arise (root cause → hypothesis → fix)
- Run full suite after all tasks Output: PhaseOutput with task_results list Human checkpoint: Present implementation results. Wait for approval.
Phase 8: Validate
Skill: Read skills/acceptance-validation/SKILL.md (base) + project overlay if exists
Workflow: Built-in (references/phase-workflows.md § Phase 8) or project override via workflows.validate
Input: Acceptance criteria from Phase 4 + implemented code from Phase 7
Process:
- Invoke acceptance-validation skill
- For each AC: identify verification method, execute, record pass/fail with evidence
- Run full test suite
- Run project-specific validation scripts if configured
- Apply verification discipline: no completion claims without fresh evidence Output: PhaseOutput with acceptance_criteria statuses and test results Human checkpoint: Present validation report. Wait for approval.
Phase 9: Ship
Skill: Read skills/shipping/SKILL.md (base) + project overlay if exists
Workflow: Built-in (references/phase-workflows.md § Phase 9) or project override via workflows.ship
Input: Validated code from Phase 8
Process:
- Run full test suite — stop if any test fails
- Present completion options (PR, merge, keep, discard)
- Invoke shipping skill for PR creation with structured description
- Update Jira ticket (transition status, add PR comment) Output: PhaseOutput with PR URL and Jira transition Human checkpoint: Present PR summary. Wait for approval.
Checkpoint Collapsing
All phases always run internally. Collapsing is presentation-only — combine phase outputs into fewer human checkpoints based on entry point:
| Entry | Phases | Checkpoints |
|---|---|---|
| Raw requirement (complex, UX) | 1,2,3, then per ticket: 4,5,6,7,8,9 | Phase 1, Phase 2 (XD), Phase 3 (system design+ordering), then per ticket: 4+5, 6, 7+8, 9 |
| Raw requirement (complex, backend) | 1,3, then per ticket: 4,5,6,7,8,9 | Phase 1, Phase 3 (system design+ordering), then per ticket: 4+5, 6, 7+8, 9 |
| Single Jira, backend | 4,5,6,7,8,9 | Checkpoint 1 (scope+design+plan), Checkpoint 2 (implement+validate), Checkpoint 3 (ship) |
| Single Jira, UX | 2,3,4,5,6,7,8,9 | Checkpoint 1 (XD), Checkpoint 2 (system design), Checkpoint 3 (scope+tech design+plan), Checkpoint 4 (implement+validate), Checkpoint 5 (ship) |
| Jira + existing design | 4,6,7,8,9 | Checkpoint 1 (scope+plan), Checkpoint 2 (implement+validate+ship) |
If the human requests expansion at any combined checkpoint (e.g., "show me the tech design separately"), break out that phase's output and add an individual gate.
Skill Composition
The orchestrator composes up to three layers of project knowledge at each phase: role overlays, extra project roles, and cross-cutting domain context.
Project Skill Discovery (Pipeline Start)
Before any phase runs, discover project skills and build a manifest.
Step 1 — Check for config file:
Look for <project-root>/lao.config.yaml. If found:
- Parse the YAML file.
- Detect project languages:
- If
languages:list is present → use it (each must be one of:python,java,csharp,react) - Else if
language:string is present → treat as single-item list (backward compatible) - If neither is present → auto-detect from project files. Check all
rules and collect every match (a project can match more than one):
pyproject.toml,setup.py, orrequirements.txt→pythonpom.xmlorbuild.gradleorbuild.gradle.kts→java*.csprojor*.sln→csharppackage.jsonwithreactin dependencies, ornext.config.*→react
- If no match → ask the user
- Record the detected languages in the manifest. Language-specific
references (
references/<language>/) are loaded by skills that support language packs (coding-standards, testing-conventions, code-review, security). When multiple languages are detected, all packs are loaded — apply each pack to files of its language (e.g., Python standards to.pyfiles, React/TS standards to.tsx/.ts).
- If
- Resolve overlay paths — verify each mapped file exists. Keys must match base role directory names.
- Resolve workflow override paths — verify each mapped file exists. Keys
must be one of:
plan,implement,validate,ship. A workflow override replaces the built-in workflow for that phase entirely. - Resolve domain paths — expand glob patterns (e.g.,
docs/domain/*.md), verify each resolved file exists and has valid frontmatter (name,description,applies_to). Supports both globs and explicit paths in the same list. - Resolve extra role paths — verify each mapped file exists and has valid
frontmatter (
name,description, and optionallyapplies_to). Keys must NOT match base role names. - Skip convention scan entirely.
Config file format:
project_name: my-app
languages: # optional list (or omit for auto-detection)
- python
- react
overlays:
architecture: docs/architecture/standards.md
coding-standards: .cursor/rules/coding.md
workflows:
implement: docs/workflows/our-bdd-process.md
domain:
- docs/domain/*.md
- src/payments/DESIGN.md
extra_roles:
compliance-review: tools/compliance/SKILL.md
Both language: python (single string, backward compatible) and
languages: [python, react] (list) are accepted. If both are present,
languages wins.
All paths are relative to the project root (where lao.config.yaml lives).
Only project_name is required; all other sections are optional.
If no config file is found, proceed to Step 2.
Step 2 — Convention scan (fallback):
If no config file was found, auto-detect project languages from project files (same detection rules as Step 1, sub-step 2 — collect all matches). Record the results in the manifest.
Scan <project-root>/skills/ directly. Build the manifest from the
directory contents:
- For each subdirectory (excluding
domain/):- Contains
PROJECT.mdand name matches a base role → record as overlay - Contains
SKILL.mdand name does NOT match a base role → record as extra role; read frontmatter to extractapplies_to(warn if missing) - Contains
PROJECT.mdand name does NOT match a base role → warn (likely misnamed overlay) - Contains neither
PROJECT.mdnorSKILL.md→ warn (empty or misconfigured)
- Contains
- For
domain/: read frontmatter of each.mdfile and build the domain catalog (see Domain Context below).
Step 3 — Suggestion scan (always runs):
Regardless of config or convention, scan the project for files that look like potential skill content but are not connected:
- Markdown files with lifecycle-relevant names (e.g., filenames containing "architecture", "coding-standards", "design", "conventions") outside the expected paths
- Files with YAML frontmatter containing
nameanddescriptionthat are not already in the manifest
If found, note them in the manifest presentation:
Suggestions:
docs/coding-guide.md — looks like a coding-standards overlay
wiki/auth-patterns.md — looks like domain context
Consider adding these to lao.config.yaml or moving to the
convention directory.
Step 4 — Present manifest:
Present the completed manifest at the start of the first checkpoint:
Project skills detected for <project-name>:
Source: lao.config.yaml (or: convention scan)
Languages: python, react (from config) | java (auto-detected) | unknown (ask user)
Overlays: architecture, coding-standards, shipping
Extra roles: compliance-review (architecture, code-review, security)
Domain context: auth-system (all), payment-processing (architecture, code-review)
Suggestions: 2 potential files found (see above)
Empty manifest (no config, no convention directory found):
If discovery found no project skills at all (no lao.config.yaml and no
convention directory), present the suggestions from Step 3 and a nudge:
Project skills detected for <project-name>:
Source: none (no lao.config.yaml, no convention directory)
Overlays: 0
Domain context: 0
Suggestions: 3 potential files found
docs/coding-guide.md — looks like a coding-standards overlay
wiki/auth-patterns.md — looks like domain context
src/conventions.md — looks like a coding-standards overlay
💡 Run /lao-setup to connect these files,
or continue with base skills only.
At the checkpoint, ask: "Continue with base skills only, or set up project
skills first?" If the human chooses to continue, proceed normally — the
orchestrator works fine with base skills alone. If the human chooses setup,
pause the pipeline and recommend invoking /lao-setup.
The human confirms the discovery is correct before any phase runs. This manifest is referenced throughout the pipeline — no ad-hoc file checks at each phase.
Overlay Discovery
For each phase that invokes a base skill, check for a project overlay:
<project-root>/skills/<role>/PROJECT.md
Where <role> matches the directory name under lifecycle-agent-orchestrator/skills/.
Overlay Precedence
The project overlay is the domain authority. When both a base SKILL.md and a PROJECT.md exist for a role:
- Read both files. The base provides universal defaults; the overlay adds project-specific patterns.
- Additive content — apply everything from both. No conflict.
- Narrowing — if the overlay tightens a base rule (stricter lint config, additional required checks), apply the stricter version.
- Contradictions — if the overlay relaxes or reverses a base rule, the
overlay wins. The overlay SHOULD include an
## Overridessection explaining why, but the project's domain knowledge takes precedence regardless. - If no overlay exists, the base skill operates standalone.
Extra Project Roles
Projects may define roles beyond the base skills. These are standalone skills (not overlays) placed at:
<project-root>/skills/<role-name>/SKILL.md
Extra roles use YAML frontmatter with name, description, and applies_to:
---
name: compliance-review
description: SOC2 compliance checks and audit trail verification
applies_to: [architecture, code-review, security]
---
applies_to: all— eligible for every phase.applies_to: [role1, role2, ...]— eligible only when the current phase uses one of the listed roles. Values match base role directory names.- Missing
applies_to— the role is not loaded at any phase and the manifest displays a warning:
⚠ Extra role "compliance-review" has no applies_to — it will not be loaded.
Add applies_to frontmatter to specify when it should be active.
See: /lao show compliance-review (or your PROJECT.md)
Extra roles function as additional context during a phase, not as separate pipeline steps. When a phase runs for role R, the orchestrator:
- Checks the extra-role catalog built during discovery.
- Loads full content of any extra role whose
applies_toincludes R orall. - Injects the content alongside the base skill, overlay, and domain context.
This keeps the orchestrator coordinating phases — not individual skills.
Domain Context (Cross-Cutting)
Projects may provide domain knowledge that spans multiple phases:
<project-root>/skills/domain/<topic>.md
Each domain file has YAML frontmatter:
---
name: auth-system
description: Authentication patterns, session handling, and IAM integration
applies_to: all
---
applies_to: all— eligible for every phase (default when omitted).applies_to: [role1, role2, ...]— eligible only when the current phase uses one of the listed roles. Values match directory names underskills/.
Two-tier loading:
- Index tier — at pipeline start, read only the frontmatter of every file
in
domain/. Build a lightweight catalog of{name, description, applies_to}entries. This catalog persists for the full pipeline run. - Load tier — at each phase (role = R, task = T):
- Hard filter: skip files whose
applies_todoes not include R orall. - Soft filter: for remaining files, evaluate the
descriptionagainst the current task. Load the full file only if the description suggests relevance to what this phase is actually doing. - Inject the selected domain files as shared context alongside the base skill and overlay.
- Hard filter: skip files whose
Domain files should be concise reference material — constraints, patterns, conventions, key decisions — targeting 50-200 lines. For extensive domain documentation, summarize the key constraints and link to the full document.
Phase Eligibility
Every phase supports customization. Phases 1-5 and 8-9 use base role skills
with project overlays. Phases 6-9 use built-in workflows from
references/phase-workflows.md — overridable via workflows in lao.config.yaml.
Extra roles are loaded when their applies_to matches the current phase's base role.
| Phase | Base Skill / Workflow | Overlay | Workflow Override | Extra Roles | Domain | Notes |
|---|---|---|---|---|---|---|
| 1. Product Management | product-management | Yes | — | Yes | Yes | |
| 2. Experience Design | experience-design | Yes | — | Yes | Yes | Conditional on ux_needed |
| 3. Architecture (System) | architecture | Yes | — | Yes | Yes | System design + ticket ordering |
| 4. Intake | intake | Yes | — | Yes | Yes | Per-ticket |
| 5. Tech Design | architecture | Yes | — | Yes | Yes | Per-ticket, low-level |
| 6. Plan | Built-in (phase-workflows.md) | — | workflows.plan |
Yes | Yes | TDD task decomposition with no-placeholder rule |
| 7. Implement | Built-in (phase-workflows.md) | — | workflows.implement |
Yes | Yes | TDD + two-stage review + systematic debugging |
| 8. Validate | acceptance-validation | Yes | workflows.validate |
Yes | Yes | + built-in verification discipline |
| 9. Ship | shipping | Yes | workflows.ship |
Yes | Yes | + built-in completion workflow |
Extra role matching: At each phase, the orchestrator checks the base role
column. An extra role with applies_to: [architecture] loads during Phases 3
and 5 (both use the architecture base skill). Extra roles with no
applies_to are never loaded (see warning above).
Cross-Review Protocol
When a phase has a cross-review gate:
- Run the producing skill to generate its output
- For each reviewer role:
- Invoke the reviewer skill with: "Review this [output type] for [review focus]"
- Provide the full output as context
- Reviewer returns:
approved,approved_with_notes, orchanges_requested
- If any reviewer returns
changes_requested:- Re-invoke the producing skill with the feedback
- Re-run the reviewer that requested changes
- Maximum 2 revision rounds
- If unresolved after 2 rounds:
- Present the current output + unresolved feedback to the human
- Human decides how to proceed
- Once all reviewers approve (or approve with notes):
- Present combined output to human checkpoint
Error Handling
- Skill not found: If a base skill file doesn't exist, report the error and skip that phase with a clear message
- Overlay not found: Normal — base skill operates standalone. Do not warn.
- Overlay conflict: The overlay wins. If the overlay has an
## Overridessection, include the rationale in the checkpoint summary. If not, note the override at the checkpoint so the human is aware. - Extra role missing
applies_to: The role is recorded in the manifest but never loaded. Display a warning at pipeline start with guidance to add the field. - Domain file missing frontmatter: Treat as
applies_to: allwith the filename (minus extension) as the name. Warn once at pipeline start. - Domain folder not found: Normal — no domain context is loaded. Do not warn.
- Cross-review timeout: If a reviewer skill produces no actionable feedback, treat as
approved - Phase failure: If a phase fails (e.g., tests don't pass in Phase 8), report the failure and ask the human whether to retry, skip, or abort
- Human says "abort": Stop the pipeline. Report which phases completed and which didn't.
- Human says "skip": Mark the phase as
skippedin PhaseOutput and proceed to next phase
What This Skill Does NOT Do
- Write code — that's the implementation skills' job
- Design systems — that's the architecture skill's job
- Review code — that's the code review skill's job
- Make architectural decisions — it coordinates, not decides
- Auto-approve anything — every phase gates on human approval
04 同仓库更多 Skills
extra-role
A custom project-specific role for testing
compliance-review
Ensures regulatory compliance for financial services
extra-role
A custom role missing applies_to for testing
testing-conventions
Enforces testing standards when writing unit tests, integration tests, or agent evaluation tests. Covers test directory structure, naming conventions, fixture and setup patterns, mocking strategy, async testing, coverage requirements, and LLM-as-judge evaluation. Language-specific conventions (Python/pytest, Java/JUnit, C#/xUnit, React/Vitest) are loaded from bundled reference packs. Use this skill when writing tests, creating test files, setting up fixtures, mocking services, or reviewing test code for standards compliance.
shipping
Shipping workflow for platform services. Use this skill when creating pull requests, pushing code for review, updating Jira tickets to reflect PR status, or completing the ship cycle for a feature or bugfix. Trigger this skill when the user says things like "open a PR," "create a pull request," "ship this," "push for review," "update the ticket," "mark this as ready for review," or "I'm done with this feature" — even if they don't explicitly say "shipping." Also trigger when the user wants to transition a Jira ticket status after code changes are ready.
security-standards
Enforces security standards when writing or reviewing code that handles authentication, secrets, sensitive data, API boundaries, or compliance concerns. Covers secrets manager integration, encryption at rest and in transit, IAM authentication and least-privilege authorization, OWASP Top 10 secure coding (including prompt injection), dependency vulnerability management, API security (auth, validation, rate limiting), PII and sensitive data protection in logs and traces, and regulatory compliance (CCPA/GDPR). Use this skill when adding endpoints, handling user data, managing secrets, reviewing for vulnerabilities, configuring auth, working with LLM prompts that accept user input, setting up deployment security, or assessing compliance. Also use when DAST findings need remediation.