<!-- Correct: instructions for Claude -->
Review this code for security vulnerabilities including:
- SQL injection
- XSS attacks
- Authentication issues

Provide specific line numbers and severity ratings.

<!-- Wrong: message to user — Claude receives this but has no directive -->
This command will review your code for security issues.
You'll receive a report with vulnerability details.

flowchart TD
    Q{"Where should the<br>command live?"}
    Q -->|"Shared with team"| Proj[".claude/commands/<br>Scope — this project only<br>Label — '(project)' in /help"]
    Q -->|"Personal use<br>across all projects"| User["~/.claude/commands/<br>Scope — all projects<br>Label — '(user)' in /help"]
    Q -->|"Bundled with a plugin"| Plugin["plugin-name/commands/<br>Scope — when plugin installed<br>Label — '(plugin-name)' in /help"]

.claude/commands/
├── review.md           # /review
├── test.md             # /test
└── deploy.md           # /deploy

---
description: Review code for security issues
allowed-tools: Read, Grep, Bash(git:*)
model: sonnet
---

Review this code for security vulnerabilities...

flowchart TD
    Start(["Writing command frontmatter"]) --> D{"Need a description<br>in /help?"}
    D -->|Yes| Desc["description — string, under 60 chars<br>Start with verb — Review, Deploy, Generate"]
    D -->|No| AT{"Need to restrict<br>tool access?"}
    Desc --> AT
    AT -->|Yes| Tools["allowed-tools — comma-separated or array<br>Bash(git:*) for filtered bash access"]
    AT -->|No| M{"Need a specific<br>model?"}
    Tools --> M
    M -->|Yes| Model["model — haiku, sonnet, or opus"]
    M -->|No| AH{"Command takes<br>arguments?"}
    Model --> AH
    AH -->|Yes| Hint["argument-hint — e.g. [pr-number] [priority]"]
    AH -->|No| DMI{"Should only user<br>invoke manually?"}
    Hint --> DMI
    DMI -->|Yes| Disable["disable-model-invocation — true"]
    DMI -->|No| Done(["Frontmatter complete"])
    Disable --> Done

---
description: Review PR with priority and assignee
argument-hint: [pr-number] [priority] [assignee]
---

Review pull request #$1 with priority level $2.
After review, assign to $3 for follow-up.

---
argument-hint: [issue-number]
---

Fix issue #$ARGUMENTS following our coding standards.

Review @$1 for code quality and potential bugs.

---
allowed-tools: Bash(git:*)
---

Files changed: !`git diff --name-only`

Review each file for code quality and potential bugs.

flowchart TD
    Q{"How many commands?"}
    Q -->|"5-15, no clear categories"| Flat["Flat structure<br>.claude/commands/*.md"]
    Q -->|"15+, clear categories"| NS["Namespaced structure<br>.claude/commands/ci/*.md<br>.claude/commands/git/*.md<br>.claude/commands/docs/*.md"]

---
description: Review code changes
allowed-tools: Read, Bash(git:*)
---

Files changed: !`git diff --name-only`

Review each file for:
1. Code quality and style
2. Potential bugs or issues
3. Test coverage
4. Documentation needs

---
description: Run tests for specific file
argument-hint: [test-file]
allowed-tools: Bash(npm:*)
---

Run tests: !`npm test $1`

Analyze results and suggest fixes for failures.

---
description: Complete PR workflow
argument-hint: [pr-number]
allowed-tools: Bash(gh:*), Read
---

PR #$1 Workflow:

1. Fetch PR: !`gh pr view $1`
2. Review changes
3. Run checks
4. Approve or request changes

flowchart TD
    Q{"What kind of<br>user input?"}
    Q -->|"Simple values —<br>file paths, numbers"| Args["Use command arguments<br>argument-hint + positional vars"]
    Q -->|"Complex choices —<br>multiple options with trade-offs"| AUQ["Use AskUserQuestion<br>Include in allowed-tools"]
    Q -->|"Both"| Both["Arguments for known values<br>AskUserQuestion for decisions"]

flowchart TD
    P{"What is the problem?"}
    P -->|"Command not appearing<br>in /help"| NotAppearing["Check file is in correct directory<br>Verify .md extension<br>Ensure valid Markdown format<br>Restart Claude Code"]
    P -->|"Arguments not<br>substituting"| ArgsNotWorking["Verify dollar-sign N syntax<br>Check argument-hint matches usage<br>Ensure no extra spaces"]
    P -->|"Bash execution<br>failing"| BashFail["Check allowed-tools includes Bash<br>Verify command syntax in backticks<br>Test command in terminal first<br>Check required permissions"]
    P -->|"File references<br>not loading"| FileFail["Verify @ syntax correct<br>Check file path is valid<br>Ensure Read tool allowed<br>Use project-relative paths"]