fix: add missing name field and allowed-tools to all 20 slash commands

[xiaolai]

Automated audit: This PR was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the diff on its merits.

What this fixes

Bug 1 — Missing name field (all 20 commands)

Every slash command file in commands/ was missing the required name frontmatter field. Without an explicit name, Claude Code falls back to filename-based registration only — which works for basic use but breaks discoverability in any registry or tooling that reads frontmatter directly. The context-forge/ commands already include a name field; this PR brings the root-level commands into parity.

Bug 2 — Missing allowed-tools: Task (14 agent-dispatch commands)

Fourteen commands that dispatch to sub-agents were missing the allowed-tools declaration. Without it, Claude has no signal about which tools are permitted when executing the command. The three commands that already had allowed-tools: Task (review, security-scan, test) follow the correct pattern; this PR adds the same declaration to the 14 that were missing it.

Changes

• Added name: <command> to all 20 command files
• Added allowed-tools: Task to the 14 agent-dispatch commands that were missing it (api-docs, api, content, deploy, devops, frontend, marketing, plan, product, requirements, shadcn, tdd, test-first, ui)
• No body text, agent wiring, or logic changed

---

Note

Low Risk
Low risk: metadata-only frontmatter additions to command markdown files; no execution logic or agent prompts changed beyond registration/permissions fields.

Overview
Adds missing frontmatter name to all slash-command files under commands/, aligning registration with tools that read command metadata.

Also standardizes tool permissions by adding allowed-tools: Task to the agent-dispatch commands that were missing it (keeping existing command bodies/prompts unchanged).

^{Reviewed by Cursor Bugbot for commit 297403a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 297403a. Configure here.}

[cursor]

Frontmatter name overrides conflict-avoidance filename prefix

Medium Severity

When installing into a context-forge project, install.js deliberately renames command files to agent-${command}.md to avoid conflicts (line 135–137). The listSlashCommands function in contextForgeDetector.js resolves names via frontmatter.name || item.name.replace('.md', ''). Previously, with no name field, a file installed as agent-api.md would register as agents:agent-api. Now that name: api exists in frontmatter, the same file registers as agents:api, silently defeating the conflict-avoidance renaming. This affects all 14 agent-dispatch commands when installed at project scope in context-forge projects.

Additional Locations (1)

• commands/deploy.md#L1-L2

 

^{Reviewed by Cursor Bugbot for commit 297403a. Configure here.}