* Add OWASP Security Skills agent
* feat: Add OWASP Comprehensive Security Skills
* Update .claude-plugin/skills/owasp-security/README.md
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update .claude-plugin/skills/owasp-security/SKILL.md
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update .claude-plugin/skills/owasp-security/SKILL.md
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update .claude-plugin/skills/owasp-security/SKILL.md
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update .claude-plugin/skills/owasp-security/SKILL.md
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Remove accidental submodule reference at .claude/agents/owasp-security
* Address review feedback: SKILL.md frontmatter + cubic findings
Owner-requested change:
- Add YAML frontmatter (name, description) to SKILL.md so the skill loader
can register it.
Documentation/manifest consistency:
- Point all references from the non-existent owasp-comprehensive-security-skills.md
to the actual SKILL.md (examples, README, instructions, skill.json).
- Correct example section anchors (k8s -> ...-2025-draft, api -> ...-2023).
- Rename owasp-css.instructions.md -> owasp-css-instructions.md (kebab-case) and
update skill.json references.
- skill.json: drop missing CONTRIBUTING.md core key; set prompt-injection example
language to Text (file is .txt).
- README: fix symlink instructions to target the directory containing SKILL.md.
Example correctness fixes:
- cryptographic-failures.js: align .env var name with process.env.ENCRYPTION_KEY,
remove unused https import, redirect via configured CANONICAL_HOST instead of the
client-controlled Host header (host-header injection / open redirect).
- api-auth-bypass.js: move vulnerable handlers to /vulnerable/* paths so the secure
/secure/* routes are reachable rather than shadowed dead code.
- k8s-rbac.yaml: replace invalid runAsRoot with runAsUser: 0.
- broken-access-control.py: correct docstring to reflect missing authentication AND
authorization (not just IDOR among authenticated users).
- logging-monitoring-failures.py: emit pure-JSON log lines (%(message)s) so the
Logstash /^{.*}$/ filter matches; extract user_id from kwargs for audit attribution.
- security-misconfiguration.py: replace app.run() with gunicorn guidance; fix the
multi-stage Dockerfile to carry deps over via a copied virtualenv.
SKILL.md content fixes:
- Resolve MASVS L3 WebView double-negative.
- Split ValidatingAdmissionPolicy into a valid Policy + Binding.
- Add caveat that sanitize_input is input hygiene, not prompt-injection prevention.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Update .claude-plugin/skills/owasp-security/examples/cryptographic-failures.js
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Sync owasp-security skill with upstream source repo updates
Brings the PR in line with the latest mfkocalar/OWASP-Security-Skills, which
has since had accuracy and content improvements (commits "Polish for public
release" and "Standardize OWASP version labels").
Version labels standardized on the accurate published editions:
- OWASP Top 10: 2025 -> 2021 (Section 1's content uses the 2021 category
codes/ordering; 2021 is the accurate label).
- Kubernetes Top 10: 2025 -> 2022 (2022 is the only published edition).
- Agentic Applications: drop "(Preview)"; released Dec 2025 as the 2026 edition.
- XSS example: A07 -> A03 (A07 was the 2017 code; XSS is under Injection in 2021).
Applied across SKILL.md (headings, anchors, frontmatter), skill.json, README,
owasp-css-instructions.md, and every example cross-reference.
Fuller/better example content pulled from the source repo:
- injection.js: adds parameterized-query and validated (/^\d+$/) secure variants
(was a vulnerable-only stub).
- xss.html: adds textContent and DOMPurify secure variants, IIFE-scoped blocks.
- broken-access-control.py: adds current-user existence checks in secure handlers.
- logging-monitoring-failures.py: pure-JSON log lines; kwargs/positional user_id
extraction for audit attribution.
- prompt-injection.txt: raises PermissionError on unauthorized tool use; injects
the llm dependency instead of a global.
- security-misconfiguration.py: obvious fake API-key placeholder.
skill.json example line counts and total updated to match; the local
CANONICAL_HOST guard in cryptographic-failures.js and the /vulnerable//secure/
route split in api-auth-bypass.js (both ahead of source) were preserved.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Update .claude-plugin/skills/owasp-security/SKILL.md
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update .claude-plugin/skills/owasp-security/examples/injection.js
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* Update .claude-plugin/skills/owasp-security/SKILL.md
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* improve: enhance graphql-security-specialist based on automated review
- Add model, color, and permissionMode to frontmatter; add Glob and Edit to tools
- Rewrite description with <example>/<commentary> blocks matching sibling agents
- Add alias/batching overload ("battering ram") and CSRF attack coverage
- Add Recommended Security Tooling section (graphql-armor, graphql-cop, InQL)
- Fix Input Sanitization: clarify DOMPurify is XSS-only, add SQL/NoSQL injection prevention guidance
- Extend Query Allowlisting with Automatic Persisted Queries / trusted documents pattern
- Add closing "Integration with other agents" section
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: correct CSRF comment and remove fabricated Apollo plugin import
Addresses cubic-dev-ai review on PR #679:
- CSRF middleware comment now accurately describes rejecting all GET
requests lacking the preflight header, not just mutations
- Replaced non-existent ApolloServerPluginPersistedDocuments import
with a manual requestDidStart/didResolveOperation hook, which is a
real documented Apollo Server 4 plugin API
---------
Co-authored-by: Claude <noreply@anthropic.com>
Syncs the skill with its canonical source at context-architecture.dev. The
previous version described eight principles and a retrofit-only/metabolism
framing; the current methodology is one rule, a write/verify loop, and nine
principles, applied to both greenfield and brownfield repositories.
Authored by Sergio Azocar, CC BY 4.0. Faithful copy of the source SKILL.md.
Compared all skills tracked in ANTHROPIC_ATTRIBUTION.md against
anthropics/skills. Content (docx, pptx, xlsx, pdf, artifacts-builder,
etc.) is already in sync. The only drift was two skills still carrying
the unfilled Apache-2.0 copyright placeholder in LICENSE.txt; every
other tracked skill already reads "Copyright 2026 Anthropic, PBC."
- development/artifacts-builder/LICENSE.txt
- development/webapp-testing/LICENSE.txt
claude-api, doc-coauthoring, and frontend-design also exist locally
under the same names as upstream Anthropic skills, but git history
shows they were migrated from a different marketplace source, so they
were left untouched to avoid overwriting differently-sourced content.
Catalog regeneration was skipped for this change: LICENSE.txt is not
part of the generated index, and running the generator in this
environment reset download counts and dropped an unrelated skill
(database/postgres-schema-design) from the index, which would have
been an unrelated regression.
Claude-Session: https://claude.ai/code/session_019nn9iHjwpu6g5Fc6HM8hJR
Co-authored-by: Claude <noreply@anthropic.com>
- Add TR flag to CountryFlag.tsx so Turkey renders correctly in the
trending "Top Countries" list instead of falling back to the generic
placeholder icon.
- Wrap the "Promote your component" button on mobile so it no longer
overflows the Featured Integrations card.
- Fix Vercel/Anthropic footer icons being invisible in dark mode: they
relied on currentColor (which doesn't apply to <img> sources) and on
Tailwind's dark: variant, which is media-query based here while the
site's theme is toggled via a class on <html>. Now fetch fixed white
icons and invert them under html.light via a dedicated oss-icon class.
Filter toolbar (search/category/filters/sort) wrapped awkwardly on mobile,
leaving the sort dropdown orphaned to the right via ml-auto. Featured
integrations grid jumped from 1 to 3 columns right at the md breakpoint,
cramming card text. The mobile hamburger button also sat flush against
the search input with no gap.
- Renamed Thinking-Beast-Mode.md -> thinking-beast-mode.md (kebab-case)
and moved from api-graphql/ to development-tools/ (no GraphQL/API
content; it's a generic autonomous engineering-task agent)
- Added required model field plus color/permissionMode, matching
sibling agent conventions
- Replaced non-existent tool references (fetch_webpage,
sequential_thinking, get_errors) with real Claude Code tools
(WebFetch, WebSearch, Bash for lint/test)
- Rewrote the marketing-fluff description into a concrete,
example-driven trigger description
- Stripped "quantum cognitive architecture" roleplay language and
consolidated the workflow into Investigate -> Plan -> Implement ->
Verify -> Report, keeping the legitimately good discipline (root
cause debugging, rigorous verification, don't stop until truly done)
- Added explicit guardrails (ask before destructive commands, stop on
genuine blockers)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
The pagination safety limit (1,000,000 records) was cutting off before
reaching the end of the table (1,382,542 records total), and since
pagination orders by id ascending (oldest first), the cutoff always
excluded the most recent ~380k downloads — exactly the data needed to
compute today/week/month trending correctly. This produced suspicious
output where todayDownloads == weeklyDownloads == monthlyDownloads
(94,484 each), which should be mathematically near-impossible.
Raised the limit to 10,000,000 (plenty of headroom over the current
table size) and regenerated both trending-data.json copies. New numbers
show the expected progression: today (132,189) < week (152,849) <
month (227,654) < total (1,340,064).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Placeholder while the logo gets a proper redesign — swaps the pink
"AITMPL" image for a minimal terminal-style icon (>_) matching the site's
mono/terminal aesthetic and accent color, instead of leaving it blank.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The mobile hamburger button called toggleSidebar(), a function that was
never defined anywhere — a silent ReferenceError, so the button did
nothing. The sidebar itself was also `hidden` on mobile with no mechanism
to show it at all.
- Implements toggleSidebar() as a real slide-in drawer with a dark overlay
(closes on overlay tap, on navigating to a link, or on resize to desktop
width). Desktop collapse-to-icons behavior is untouched.
- Fixing the drawer surfaced a pre-existing horizontal overflow bug on
mobile (previously invisible since the sidebar never rendered): the
filter toolbar in ComponentGrid.tsx (search + category + sort) was a
flex row with no wrap, forcing the whole page to scroll horizontally
and clip content on narrow viewports. Added flex-wrap plus min-w-0/
min-w on the flex children so they stack instead of overflowing, and
min-w-0 on #main-content + overflow-x-hidden on <body> as defense in
depth against the same class of bug elsewhere.
Confirmed via browser console (scrollWidth > clientWidth check) that no
element overflows the mobile viewport after the fix.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Companies wanting to pay for a promoted slot need a way to apply. Adds a
button-style link next to the section title pointing to the public Google
Form (aitmpl.com Ads), styled with the site's accent color so it's visible
enough to notice — an earlier plain-text version was nearly invisible.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The daily-health-report worker now closes the loop the user asked for:
review Sentry issues on a routine and clean up what's noise. Deliberately
conservative — an issue is auto-resolved ONLY if its title matches a known
verification-noise pattern (NOISE_TITLE_PATTERNS in index.js); every other
issue (i.e. any real production error) is left untouched and always listed
in the Telegram digest for human review. Never widen this to "resolve
everything automatically" — that would hide real bugs instead of
surfacing them.
Verified end-to-end: sent one event matching the noise pattern and one
simulating a real error. The worker auto-resolved only the former (Sentry
confirmed 0 → 1 → 0 unresolved) and kept the latter open and reported.
Also manually cleaned up the 5 pre-existing test issues from today's
Sentry setup verification, now that this routine exists to keep the
projects clean going forward.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a proactive daily heartbeat, since the existing Telegram flows
(docs-monitor, pulse) only notify on change/error/weekly schedule and never
confirm "everything's fine." Runs at 14:00 UTC (10:00 AM EDT) and reports:
- Dashboard site health (reuses the existing /api/health-check endpoint)
- Unresolved Sentry issues from the last 24h across all 3 Sentry projects
(aitmpl-workers, aitmpl-dashboard, aitmpl-cli)
Does NOT poll the other 3 workers' /status endpoints directly — Cloudflare
blocks Worker-to-Worker fetches over the public *.workers.dev hostname
within the same account (error 1042, confirmed via wrangler dev --remote).
Their health is covered by their own Sentry Cron Monitor check-ins instead.
Also adds a /status endpoint to aitmpl-crons (cloudflare-workers/crons/index.js)
for consistency with the other workers, even though it isn't polled here.
Verified end-to-end: manual /trigger call returns a clean report and
successfully delivers to Telegram (message_id confirmed). Sentry summary
section requires SENTRY_AUTH_TOKEN + SENTRY_ORG_SLUG secrets (pending —
degrades gracefully to "not configured" until set).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Completes the error tracking rollout: aitmpl-dashboard and aitmpl-cli Sentry
projects now exist alongside aitmpl-workers, and all three are verified
end-to-end (manual test events returned HTTP 200 and appeared in each
project's Issues dashboard).
- Dashboard: SENTRY_DSN set as a Cloudflare Pages secret on aitmpl-dashboard
(production). No code change needed — error-tracking.ts already read it.
- CLI: the aitmpl-cli DSN is public by design (send-only), so it ships as
DEFAULT_SENTRY_DSN in error-reporting.js instead of requiring every user
to configure their own Sentry project. Reporting itself stays opt-in
(CCT_ERROR_REPORTING=true), unaffected by this change.
- .env.example and CLAUDE.md updated to match reality; removed a stale
Vercel Deployment block left over from the Cloudflare Pages migration.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Documents the Vercel→Cloudflare Pages/Workers migration (already live) and
the new split dashboard JSON artifacts (counts.json, components/{type}.json,
search-index.json) from the components.json payload optimization.
Adds an Error Tracking section recording the real state: Sentry is live and
verified end-to-end on the 3 Cloudflare Workers, but the dashboard and CLI
still need their own Sentry projects + DSNs before captureApiError()/
captureCliError() do more than no-op.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds free-tier Sentry error reporting to close the biggest observability
gap: automated cron/worker failures were previously invisible (aitmpl-crons
had no error handling at all). Uses a dependency-free fetch()-based Sentry
envelope client (cloudflare-workers/*/sentry.js, dashboard error-tracking.ts,
cli-tool error-reporting.js) instead of the official SDKs, to keep the
zero-dependency worker style and avoid Cloudflare Pages SSR friction.
- Cloudflare Workers: report failures + Cron Monitor check-ins in crons,
pulse, and docs-monitor (complementing, not replacing, existing Telegram
alerts). Also drops the pulse Vercel collector (VERCEL_API/collectVercel),
since the dashboard no longer deploys to Vercel.
- Dashboard: captureApiError() wired into claude-code-check, health-check,
and the three track-* endpoints.
- CLI: opt-in only crash reporting (CCT_ERROR_REPORTING=true), always
deferring to the existing CCT_NO_TRACKING/CCT_NO_ANALYTICS/CI opt-outs.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The dashboard is on Cloudflare Pages with a 24h edge cache already in
place, but every island still downloaded the full ~1.9MB index (327KB
gz) — even the sidebars/plugins/collection pages that only need per-type
counts. This splits the index into purpose-built artifacts so the
browser fetches only what each surface needs.
Generator (scripts/generate_components_json.py):
- Decouple the docs and dashboard index writes (they were a byte copy).
docs/components.json keeps `security` (the legacy site renders it);
the dashboard index drops both `content` and `security` (unused there)
→ ~13% smaller.
- Emit dashboard/public/counts.json (per-type counts, ~150 bytes),
components/{type}.json (per-type slices), and search-index.json
(flat name/description/category/type/path for global search).
Dashboard islands:
- ComponentGrid loads only the active type via fetchComponentsByType,
re-fetching on type switch (per-type in-memory cache).
- SearchModal (Cmd+K) uses the lighter search-index.json.
- Sidebar + plugins index/detail + collection pages fetch counts.json
instead of the full index just to read array lengths.
- data.ts gains fetchComponentsByType/fetchSearchIndex (additive);
fetchComponents() stays for the SSR detail page and Discord bot.
Fix: SendToRepoModal read `match.content` off an index that no longer
carries content, so "Send to repo" produced empty PRs / threw "No
component content found". buildFileMap now pulls each item's content via
fetchComponentContent (the per-component files), which also removes its
full-index fetch.
_headers: cache/CORS blocks for counts.json, components/*, search-index.json.
Payload (gzip on-the-wire): sidebars/plugins/collection 327KB → ~124B;
grid default type (agents) 327KB → 145KB; Cmd+K 327KB → 260KB.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* improve: enhance data-engineer based on automated review
- Add dbt transformation frameworks section (dbt Core, Fusion, tests, contracts, Semantic Layer)
- Add managed EL ingestion and CDC tooling (Fivetran, Airbyte, Meltano, Debezium)
- Name concrete data-quality/observability tools and data contracts (Great Expectations, Soda, Monte Carlo, Elementary, ODCS)
- Modernize orchestration section (Airflow 3.x, Dagster asset-centric model, mark Luigi as legacy)
- Add AI/LLM data pipeline expertise (vector DBs, embeddings, RAG data prep)
- Align frontmatter/structure with sibling data-scientist.md (model field, clarifying-questions preamble)
- Strengthen description for automatic delegation with PROACTIVELY phrasing and key tool names
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: use neutral Luigi label per review feedback
cubic flagged the unsourced "maintenance mode" claim about Luigi in
the orchestration section; use a neutral label instead.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add HikerAPI MCP server to web-data (Instagram data API)
* Add LamaTok MCP server to web-data (TikTok data API)
* Add DataLikers hosted MCP server to web-data (Instagram & TikTok data)
Add missing model field, sharpen proactive-use description, add AI
search/GEO visibility guidance, update Core Web Vitals to INP-based
thresholds, and cross-reference search-ai-optimization-expert.
Claude-Session: https://claude.ai/code/session_01GoWck91RfDye9q46JZDGUk
Co-authored-by: Claude <noreply@anthropic.com>
- Add missing model: sonnet frontmatter field to match sibling agents
- Rewrite system prompt to be Claude-specific: XML tag structuring,
role framing, multishot examples, extended thinking/effort parameter,
prompt caching, and grounded long-context answers
- Remove outdated JSON "Communication Protocol" handshake pattern in
favor of a plain-language Requirements Gathering step
- Add explicit boundaries vs. llm-architect, model-evaluator, and
task-decomposition-expert to reduce delegation ambiguity
- Reframe hardcoded example metrics (accuracy %, latency, cost) as
illustrative targets to confirm with the user rather than universal
thresholds
- Regenerate component catalog entries for prompt-engineer
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
- Add required model field (sonnet) and color field to frontmatter
- Add Write/Edit tools so the agent can produce the test plans/docs it describes
- Rewrite QA excellence and excellence checklists as concrete, verifiable criteria instead of vague adjectives
- Replace hardcoded fake metrics in progress tracking and delivery notification with placeholder templates and explicit anti-fabrication guidance
- Replace speculative JSON "Communication Protocol" context-manager pattern with plain-language context-gathering guidance
- Add AI-assisted and agentic testing practices section covering risk-based test planning and delegation to test-automator/playwright-tester
- Regenerate component catalog (docs/components.json, dashboard/public/components.json)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
- Add error handling and run-status checks (try/catch, ApifyApiError, run.status) to JS/TS and Python examples
- Expand Apify MCP tools list with run management, storage access, and discovery tools (get-actor-log, get-dataset-items, get-key-value-store*, add-actor, rag-web-browser, etc.)
- Add webhook guidance (event types, `webhooks` call parameter, 200 response requirement)
- Add proxy configuration guidance (proxyConfiguration, RESIDENTIAL/DATACENTER groups, checkAccess opt-out)
- Add input schema validation step to the recommended workflow
- Add production deployment notes (scheduling, memory/timeout, idempotency) and testing/mocking examples for both languages
- Cover key-value store OUTPUT record retrieval alongside dataset pagination guidance
- Add model/color frontmatter fields and a "use proactively" trigger phrase to the description
- Fix duplicate H1 headings and refresh a stale example date
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Daniel Avila