Margaret
Skill:skills/margaret. Triggers on the slash command, or on phrases like “margaret”, “be lean”, “lean mode”, “simplest solution”, “yagni”, “do less”, “shortest path”, or mentions of over-engineering/bloat/boilerplate/unnecessary dependencies.
Runs the 7-filter screen described in Overview before writing code. Three intensity levels — see Configuration.
Margaret Scan
Skill:skills/margaret-scan. Hunts exclusively for complexity that doesn’t earn its keep — never correctness, security, or performance.
Scopes:
- diff (default): only the current change.
- repo (pass
repo, or ask for an “audit”): walks the whole tree, biggest win first.
L<line>: <tag> <finding>. <fix>. — prefixed with <file>: for multi-file diffs or repo scans.
Tags:
Ends with
net: -<N> lines possible. (repo scope also reports -<M> deps possible.). Nothing to cut: Already lean. Ship it. Reports findings only, applies nothing, doesn’t touch the active mode.
Margaret Review
Not a skill of its own — a session-level persona switch like/margaret lean|full|max. Once active, every reply is a complexity scan, never a rewrite. Revert with /margaret full or “stop margaret”.
Margaret Guard
Skill:skills/margaret-guard, command: commands/margaret-guard.md. High-confidence, exploitable findings only — not a general code review.
Categories: input validation (SQL/command/XXE/template/NoSQL injection, path traversal) · auth (bypass, privilege escalation, session/JWT flaws) · crypto/secrets (hardcoded keys, weak algorithms, bad key storage/randomness, cert bypass) · code execution (insecure deserialization, eval injection, XSS) · data exposure (secrets/PII in logs, endpoint leakage, debug info).
Only reports what’s >80% confident to be exploitable. Local-network-only still counts as HIGH. Never reports: DOS/resource exhaustion, secrets on disk if otherwise secured, rate limiting, missing best-practice hardening with no concrete exploit path, test-only files, outdated third-party libraries.
Optional repo config (both no-op if missing):
.margaret/security-instructions.md— extra categories/context folded into the standard set..margaret/security-exclude— one path glob per line (e.g.vendor/**); matching findings are dropped.
/margaret-guard) runs the full procedure: gathers diff context from git status/git diff/git log, finds candidates in one sub-task, then filters false positives in a parallel sub-task against hard exclusions and a confidence scale, keeping only findings scored 8+/10. Output per finding: file:line, severity (HIGH/MEDIUM only), category, description, exploit scenario, fix.
Margaret Design
Skill:skills/margaret-design. Delegates to the sibling figma plugin’s own skills rather than reimplementing Figma access — this skill only routes to the right one and supplies project context (existing tokens, stack, component conventions).
Generate:
- design (default) →
figma:figma-generate-design - diagram →
figma:figma-generate-diagram, orfigma:figma-use-figjamfor an explicit FigJam brainstorm board
- code →
figma:figma-design-to-code— matches this project’s existing stack/conventions, reuses existing design tokens instead of hardcoding - context →
figma:figma-use— summarizes structure/tokens/spacing/components, no code generated - connect →
figma:figma-code-connect— links code components to their Figma counterparts - motion →
figma:figma-implement-motion— reads the motion spec and implements it with whatever animation approach the project already uses
figma plugin isn’t connected, says so and stops.
Margaret Help
Skill:skills/margaret-help. One-shot display of this table plus levels and setup — doesn’t switch modes or persist anything.