166 skills · sorted by relevance
Add a satisfies link from a DES → REQ, TEST → REQ/DES, or CODE annotation → ID, validating that the target exists in the registry.
The English summary is being prepared. Showing the original description.
Parallel map-reduce bulk ingest for large source sets. Map phase dispatches read-only knowledge-extractor agents (≤N-wide, default Haiku) emitting per-source JSON extracts; Python routes extracts by target library file (fuzzy-merging new topics, pre-allocating new files, flagging oversized topics); reduce phase dispatches one agent-knowledge-updater per file (parallel, one writer per file); single shelf-index rebuild + one log.md entry. Resumable. Supersedes kb-ingest-batch.
The English summary is being prepared. Showing the original description.
Render module-scoped human-readable traceability for a single module — REQs, DESs, TESTs, code locations with anchor links, plus the module-dependency graph as a markdown edge-list.
The English summary is being prepared. Showing the original description.
Spot-check citations in library files for obvious hallucinations. Resolves DOIs against the DOI registry, validates arXiv IDs, checks the format of journal references. Soft-fails on transient lookup failures rather than blocking. Recommended after kb-ingest and as part of periodic library hygiene.
The English summary is being prepared. Showing the original description.
Manage the project's layer vocabulary — list allowed layers with file counts, add new layers, or safely remove unused layers. Reads the shelf-index for usage data; writes CLAUDE.md atomically. No agent dispatch.
The English summary is being prepared. Showing the original description.
Generate a GitHub Actions workflow for Android — JDK + Gradle caching, build, unit + instrumented tests, Android Lint, run the Android pre-flight checks, and (optionally) sign + upload a signed app bundle to a Play track. Use when setting up CI for an Android app.
The English summary is being prepared. Showing the original description.
Pick an existing workflow for a task or author a new one — recommends workflow + team formation, or generates a fresh workflow YAML with command prompts and team validation.
The English summary is being prepared. Showing the original description.
Guide the team through writing a change-impact record for IEC 62304 / FDA / ISO 26262 ASIL C+ projects. Surfaces the affected REQ/DES/TEST/CODE artefacts and captures human-attested verification approach.
The English summary is being prepared. Showing the original description.
Query the project knowledge base. Wraps the research-librarian agent. The librarian reads the shelf-index, identifies the 2-4 most relevant library files for the question, deep-reads only those, and returns structured evidence with citations. Stateless — reads the index fresh on every query.
The English summary is being prepared. Showing the original description.
DevSecOps skill for securing CI/CD pipelines, infrastructure as code, containers, Kubernetes, cloud deployments, secrets handling, dependency management, SAST/DAST/SCA, release gates, supply-chain controls, SBOMs, policy-as-code, and secure SDLC workflows. Use for pipeline hardening, deployment risk reviews, security automation, and remediation planning.
The English summary is being prepared. Showing the original description.
Zero-ceremony atomic task execution. Use for tiny fixes or enhancements (minutes, not hours) that don't warrant SDLC ceremony. Flags: --discuss (disambiguate first), --full (delegate to /pre-commit after execution), --issue N (link commit to GitHub issue).
The English summary is being prepared. Showing the original description.
Use when a task needs the judgment of an Application Security Engineer — checking whether an endpoint verifies object-level authorization (not just authentication), running threat modeling at design time rather than deferring security review to the end, triaging a dependency vulnerability by actual reachability rather than CVSS score alone, combining SAST/DAST/SCA tooling to cover their distinct blind spots, or applying context-specific output encoding to untrusted input. Distinct from an information security analyst — this role works inside the SDLC to prevent vulnerabilities before they ship, not detect and respond to intrusions in production.
The English summary is being prepared. Showing the original description.
Knowledge base from NIST Secure Software Development Framework (SSDF) v1.1 (SP 800-218). Use for secure software development practices, SDLC security integration, software supply chain security, vulnerability disclosure, SBOM, threat modelling, secure coding, build hardening, EO 14028 compliance. Covers the four SSDF practice groups (PO, PS, PW, RV) only; does not cover NIST CSF, SP 800-53 controls, or cloud-specific security frameworks in depth.
The English summary is being prepared. Showing the original description.
Knowledge base from DOE Systems Engineering Methodology (SEM) Version 3 — the DOE SDLC for IT investments. Use for staged systems lifecycle planning through maintenance, Stage Exits, Structured Walkthroughs, In-Stage Assessments, requirements traceability, and CMM-aligned process discipline. Covers SEM3 (2002) guidance only; does not replace modern DevSecOps tooling standards, DOE O 413.3B capital-asset directives, or current CIO policy supersessions.
The English summary is being prepared. Showing the original description.
Teststrategie-Berater für Softwareprojekte — wählt die richtigen Teststufen (Unit/Integration/System/Abnahme), Testarten (funktional, nicht-funktional, änderungsbezogen) und Testentwurfsverfahren (Äquivalenzklassen, Grenzwerte, Entscheidungstabellen, explorativ) für die jeweilige Situation und SDLC-/CI-Phase, inkl. Testpyramide, CI/CD-Gates, Shift-Left und Best Practices. Nutze diesen Skill IMMER, wenn Tests geschrieben, geplant, priorisiert oder bewertet werden sollen — bei "schreibe Tests", "Teststrategie", "Testplan", "Testkonzept", "was/wie soll ich testen", "welche Tests fehlen", "Testabdeckung verbessern", "QA aufsetzen", Fragen zu Regression/Smoke/Sanity/Last/Stress/Security-Tests oder beim Einrichten einer Test-Pipeline — auch wenn "Test" nur beiläufig fällt. Abgrenzung — für die TDD-Schleife selbst superpowers:test-driven-development, für Bug-Diagnose bugfix-protocol, für systematische Bug-Suche bugsweep nutzen.
The English summary is being prepared. Showing the original description.
bu skill covers implementing code signing for build artifacts to ensure integrity and authenticity throughout the software supply chain. It addresses signing binaries, packages, and containers using GPG, Sigstore, and platform-specific signing tools, establishing trust chains, and verifying signatures in Dağıt:ment pipelines.
The English summary is being prepared. Showing the original description.
bu skill covers integrating Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines. It addresses configuring automated code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results to GitHub Advanced Security, and establishing quality gates that block merges when high-severity vulnerabilities are Detected.
The English summary is being prepared. Showing the original description.
bu skill covers implementing Gitleaks for Tespit etme and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.
The English summary is being prepared. Showing the original description.
bu skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD pipelines. It addresses configuring baseline, full, and API scans against running applications, interpreting ZAP Bul:ings, tuning scan policies, and establishing DAST quality gates in GitHub Actions and GitLab CI.
The English summary is being prepared. Showing the original description.
bu skill covers implementing automated security scanning for Infrastructure as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses Tespit etme misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts before Dağıt:ment, establishing policy-based governance, and integrating IaC scanning into CI/CD pipelines to prevent insecure cloud resource provisioning.
The English summary is being prepared. Showing the original description.
bu skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI/CD pipelines. It addresses writing Rego policies, Dağıt:ing OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into Dağıt:ment pipelines.
The English summary is being prepared. Showing the original description.
bu skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure production-ready images.
The English summary is being prepared. Showing the original description.