- Add required model field (sonnet) to frontmatter
- Name specific database engines (PostgreSQL, MySQL, MongoDB, Redis) in description and Focus Areas
- Add credential-safety instruction to Approach (env vars / secrets manager)
- Add Glob, Grep to tools field for locating existing config files
- Add differentiation/handoff note vs postgres-pro and database-optimizer
- Name concrete per-engine monitoring commands and schema migration tooling
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
- Resolve name collision: rename cli-tool/components/agents/deep-research-team/search-specialist.md
to multi-source-searcher.md (both filename and frontmatter name field), since it
duplicated the canonical, higher-adoption ai-specialists/search-specialist.md and
both installed to the same .claude/agents/search-specialist.md target path.
Updated the cross-reference in research-analyst.md accordingly.
- Tighten WebFetch guidance in ai-specialists/search-specialist.md to request
verbatim extraction and note that WebFetch only returns raw text unmodified for
Markdown sources under ~100K characters (otherwise a smaller model paraphrases it).
- Add a "Handling Untrusted Content" section instructing the agent to treat fetched
page content as untrusted data, not instructions, and flag rather than act on
embedded directive-like text (prompt-injection hardening).
- Clarify that allowed_domains/blocked_domains are mutually exclusive per WebSearch call.
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance llms-maintainer based on automated review
- Make content-discovery directories framework-aware (Astro/Nuxt/Next/SvelteKit) instead of a fixed generic list
- Add detection and scan paths for Docusaurus, VitePress, and Jekyll
- Raise maxTurns from 20 to 50 and add a batching/graceful-truncation strategy for large sites
- Add "Use PROACTIVELY" to the description for reliable automatic delegation
- Gate automatic git commits behind explicit user confirmation, consistent with the deletion-confirmation safety rule
- Add optional llms-full.txt companion generation, opt-in only
- Clarify that description/title length limits and the blockquote/H2 sections are house-style conventions, not llms.txt spec requirements
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: use detected output path when staging llms.txt, not hard-coded public/llms.txt
Addresses Greptile review feedback on PR #794: the Step 8 git-add command
was hard-coded to public/llms.txt, which misses the actual output path for
SvelteKit/Hugo/Docusaurus (static/llms.txt), VitePress (<srcDir>/public/llms.txt),
Jekyll (llms.txt at repo root), and the optional llms-full.txt companion.
Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: resolve Next.js hybrid-router ambiguity and Jekyll _posts/ ignore-rule conflict
Addresses cubic review feedback on PR #794:
- The two separate Next.js detection bullets were not mutually exclusive;
a hybrid app/+pages/ setup would have legacy pages/ routes silently
omitted. Now scans both when both exist, preferring app/ for output.
- Step 3's blanket "/_*" ignore rule would have silently skipped every
Jekyll post, since _posts/ starts with an underscore. Added an explicit
exception for _posts/ while still ignoring other Jekyll internals.
Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: extend Jekyll ignore-rule exception to configured collection dirs
Addresses cubic review feedback on PR #794: the underscore-path exception
only covered _posts/, but Step 1 also tells the agent to scan Jekyll's
configured collections (e.g. _projects/, _team/), which are similarly
underscore-prefixed and were getting silently filtered by Step 3's ignore
rule.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance sales-engineer based on automated review
- Add required `model: sonnet` field to frontmatter
- Replace vestigial "context manager" pattern with explicit "When Invoked" user-ask step
- Remove fabricated metrics (demo/win-rate figures); use session-grounded placeholders instead
- Add Human-in-the-Loop Pause Criteria for pricing, SLA, compliance, and POC sign-off
- Add Source Boundaries for Research (public sources only, citations, no pretexting)
- Add Anti-Fabrication section for compliance certifications, benchmarks, SLAs
- Consolidate redundant bullet sections into a single Core Practices section
- Modernize qualification methodology to MEDDIC/MEDDPICC with BANT as secondary reference
- Add time-boxed POC guidance with upfront success criteria and decision gates
- Add scope-boundary note to description (hand off pricing/contracts and compliance drafting)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* address review: avoid redundant discovery questions when context is already supplied
Per Greptile review comment on PR #791.
* address review: drop dangling "(below)" cross-reference in Anti-Fabrication section
Per cubic review comment on PR #791.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance hackathon-ai-strategist agent based on automated review
- Expand tools to Glob, Grep, Write for codebase exploration and saving deliverables
- Instruct WebSearch/WebFetch use for current model releases, sponsor API changes, and recent winning techniques
- Add Boundaries with Related Agents / Integration with Other Agents sections
- Merge duplicated Strategic Guidance / Optimizing for Constraints sections
- Add AI-assisted rapid-prototyping tools (Lovable, Bolt.new, v0, Replit Agent) to strategic guidance
- Add submission-format context gathering question and cross-reference in Phase 5
- Instruct confirming actual published judging rubric before defaulting to fixed weights
- Add solo-hacker and virtual/remote-hackathon callouts
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: add fallback when submission-format details are unavailable
Addresses review feedback on PR #790: the new context-gathering
question about submission platform/format could stall the agent's
advice when the event hasn't published those details yet. Fall back
to a conservative default (~3 min cap, public repo) and flag it as
an assumption to confirm later, instead of blocking.
* fix: scale pitch outline to the actual submission cap
Addresses cubic review feedback on PR #790: Phase 5 told the agent
not to assume a 3-minute cap, but the only pitch outline provided
was hard-coded to exactly 3 minutes with no scaling guidance. Reframe
it as a 3-minute baseline with an explicit proportional-scaling rule.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance api-architect agent based on automated review
- Add idempotency-key guidance (Idempotency-Key header) for retry/backoff on non-idempotent methods
- Update auth guidance from OAuth 2.0 to OAuth 2.1 (PKCE S256, Client Credentials, no Implicit/ROPC)
- Resolve REST/GraphQL/gRPC scope inconsistency (gRPC recommendations hand off to api-designer)
- Adopt RFC 9457 Problem Details as the REST error contract
- Reference standard rate-limit headers (RateLimit, RateLimit-Policy, Retry-After) in resilience/security guidance
- Add cursor/offset pagination guidance for GET-all
- Add OpenTelemetry tracing guidance for the resilience layer
- Add Deliverables, Bash Usage Constraint, and Integration with Other Agents sections (mirroring api-designer.md conventions)
- Scope Bash tool access to output validation (redocly lint, graphql-inspector validate)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address PR review findings in api-architect
- Add PATCH to the REST methods intake list — the new idempotency
default already referenced POST/PATCH but PATCH wasn't selectable
- Fix rate-limit header mismatch: client-side backoff now parses the
RateLimit header's reset parameter instead of a nonexistent
RateLimit-Reset header, matching what the security checklist tells
servers to emit
Addresses review-bot findings on PR #789.
* fix: correct RateLimit header parameter name to t
draft-ietf-httpapi-ratelimit-headers-11 uses the t parameter
(effective window in seconds) on the RateLimit header, not a
"reset" parameter. Addresses greptile-apps follow-up finding on
PR #789.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance ml-engineer based on automated review
- Modernize tooling ecosystem with named, current tools (KServe, vLLM/Triton, Feast/Tecton/Hopsworks, Evidently/WhyLabs/Arize) and note Seldon Core v2's BSL license
- Ground bare "Data validation" bullets in named tools (Great Expectations, Pandera)
- Add scope-clarifying sentence distinguishing this agent from machine-learning-engineer and mlops-engineer
- Reframe hardcoded performance targets as illustrative/configurable SLAs
- Name fairness/explainability tooling (Fairlearn, Aequitas, SHAP, LIME) and add model card/regulatory awareness note
- Add ML-specific security bullets: artifact integrity, training data PII/leakage checks, adversarial robustness testing
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: move ml-engineer scope boundaries into frontmatter description
Agent auto-selection reads the frontmatter description, not the body
prompt text, so the scope-clarifying sentence added in the previous
commit had no effect on delegation. Move it into the description
field where it can actually reduce ambiguity with machine-learning-
engineer, mlops-engineer, and ai-engineer.
Addresses review feedback from greptile-apps[bot] on PR #787.
* fix: route prompt-text optimization to prompt-engineer, not ai-engineer
ai-engineer's own description explicitly hands off prompt-text-only
optimization on an already-chosen model to prompt-engineer (ai-specialists
category). ml-engineer's scope note was steering all "prompting work" to
the generalist ai-engineer instead, which could reintroduce the routing
ambiguity this review is meant to reduce.
Addresses review feedback from cubic-dev-ai[bot] on PR #787.
* fix: resolve contradiction between ml-engineer's example and its own delegation boundary
Example 2 in the frontmatter description depicted ml-engineer handling
pure inference-serving optimization (quantization, serving-strategy
comparison, canary rollout) - exactly the work the new scope note says
to delegate to machine-learning-engineer. Rewrote the example so
ml-engineer owns the training-pipeline root cause (feature drift,
retraining) and explicitly hands off the serving-side optimization,
following the same hand-off pattern already used in ai-engineer.md's
examples.
Addresses review feedback from greptile-apps[bot] on PR #787.
* clarify: distinguish model-level lifecycle work from platform infra in Example 3
Sharpens Example 3's commentary to explicitly frame deployment/
monitoring/retraining as model-level lifecycle ownership (a specific
model's own rollout and retraining loop), distinct from the underlying
platform/infrastructure automation (CI/CD, GPU orchestration, cross-model
versioning) that mlops-engineer.md's own description already claims.
Full disambiguation between the three sibling agents' descriptions would
require editing mlops-engineer.md and machine-learning-engineer.md too,
which is out of scope for this single-file review.
Addresses review feedback from greptile-apps[bot] on PR #787.
* fix: remove ambiguous "performance optimization" from opening invocation trigger
The opening sentence of the frontmatter description is the first thing
agent selection matches against, and it still claimed raw "performance
optimization" as ml-engineer's trigger even though the same description
delegates deep inference-serving optimization to machine-learning-engineer
later on. Reworded the opening trigger to fold the redirect in directly,
so a pure serving-latency-optimization request no longer matches
ml-engineer's own invocation criteria.
Addresses review feedback from greptile-apps[bot] on PR #787.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance data-scientist based on automated review
- Replace pinned model claude-sonnet-4-5 with alias sonnet
- Add WebSearch to tools (needed for literature review/methodology selection tasks already in the prompt)
- Name concrete libraries: Fairlearn/AIF360 (bias/fairness), SHAP/LIME (interpretation), DoWhy/EconML/CausalML (causal inference), Optuna/Ray Tune/Hyperopt (hyperparameter tuning), DVC (versioning)
- Tighten data science checklist to measurable/testable criteria instead of vague adverbial items
- Upgrade pre-analysis clarifying questions into a structured, numbered gate that blocks proposing a model/methodology until key unknowns are resolved
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: repair double-escaped newlines in data-scientist description
Pre-existing bug where the description field used \\n instead of \n,
rendering as literal backslash-n text in the agent picker/dashboard.
Also tightens grammar in the pre-analysis gate added in the prior commit.
* fix: scope modeling requirements to modeling tasks in data-scientist gate
Addresses Greptile review feedback: the clarification gate and checklist
required a success-metric threshold and held-out-test/cross-validation
steps even for pure exploratory profiling, visualization, and clustering
work the agent explicitly supports.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance droid agent based on automated review
- Fix frontmatter to use valid Claude Code subagent conventions (tools: Read, Grep, Glob, Bash, WebFetch, WebSearch instead of GitHub Copilot aliases; model: sonnet instead of pinned dated ID)
- Remove GitHub Copilot Integration section (contradicted actual .claude/agents/ install path) and replace with a Claude Code usage section
- Fix outdated --enabled-tools flag to current --restrict-tools/--additional-tools/--disabled-tools
- Remove stale hardcoded model IDs from droid exec --model examples, point to docs.factory.ai/models instead
- Add missing droid exec flags: --fork, -w/--worktree, --use-spec, -r/--reasoning-effort
- Add <example>/<commentary> blocks to the description frontmatter matching sibling agent conventions
- Clarify autonomy tier boundaries (medium = no push, high = push/deploy with safety checks)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: remove dangling model-ID hint from GitHub Actions example
The parenthetical referenced a --model flag that was removed from
the command in an earlier edit, leaving a confusing dangling hint.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B3THSCtx7huxkRFmmUXne7
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance llm-architect based on automated review
- Add Glob and Grep to tools list (parity with sibling agents)
- Add SGLang to serving framework selection; remove stale vLLM version gates
- Add Anthropic Contextual Retrieval technique and Voyage AI embedding option
- Add GraphRAG/agentic retrieval escalation callout for multi-hop queries
- Add Unsloth as fine-tuning library option for LoRA/QLoRA
- Add ORPO and KTO preference-alignment methods to method-selection table
- Add "verify current model IDs" disclaimer to multi-model routing section
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: clarify ORPO vs DPO/KTO selection criterion in llm-architect
Both rows now key off dataset format (paired vs unpaired preferences)
instead of mixing in GPU count, so ORPO no longer overlaps with the
adjacent DPO/KTO rows.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Eckv6ssk3XuRXpbAzCxPgA
* fix: split DPO and GRPO into separate rows with correct prerequisites
GRPO is a reward/verifier-driven RL method, not a paired-preference
method — the previous merge wrongly implied it needs paired preference
data and a prior SFT checkpoint like DPO does.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Eckv6ssk3XuRXpbAzCxPgA
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Update retired model ids in settings components and docs
* Fix CLI default and sync generated dashboard copies
Two gaps from the first commit:
1. evaluation.py only had the function signature default updated. The
argparse `--model` default still pointed at the retired model, and
since `args.model` is always passed explicitly to run_evaluation, that
CLI value overrode the new default. Anyone running the script without
-m still got the retired model, so the change had no practical effect.
The usage example and reference/evaluation.md carried the same stale
ID.
2. The settings components under cli-tool/ were updated but their
generated copies under dashboard/public/component-content/ were not,
so the public dashboard would keep serving the retired IDs. Copies are
now regenerated from their sources rather than hand-edited.
---------
Co-authored-by: kasparovabi <kasparovabi@users.noreply.github.com>
* Add avoid-ai-writing skill (productivity)
Vendors the SKILL.md from conorbronsdon/avoid-ai-writing at tag v3.22.2
(MIT) plus its licence. The skill audits and rewrites prose to remove AI
writing patterns, with detect / rewrite / edit-in-place modes and optional
voice and context profiles.
Everything below the frontmatter is byte-identical to upstream. The
frontmatter is reshaped for this repo's catalog: author promoted from
metadata, tags promoted and rewritten into the bracketed list
generate_components_json.py can parse, repo added, and the openclaw emoji
and compatibility lines dropped.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Remove the three upstream-only references from the vendored skill
All three resolved nowhere in this repo, so a user who installs the skill
here gets instructions that fail or point at nothing:
- "until **this repo** measures the ratios itself" -- vendored here,
"this repo" reads as claude-code-templates, which is not what measures
anything. Now states the condition without the repo-relative pointer.
- "(see `detector/CATEGORIES.md` §C)" -- that file does not exist here.
The sentence keeps its point: the structural detector for that rule was
reverted, which is why the tolerance matrix is the wrong home for it.
- The optional `node detector/validate.js` block -- the engine does not
ship in this repo, and the "If the repo ships the detector engine" guard
covered the command but not the surrounding claim. Replaced with the
same checks written as a manual verification step, so edit mode keeps
the preservation contract without depending on a binary that is not
here.
This gives up byte-identity with upstream v3.22.2 below the frontmatter,
which the PR description claimed. A future re-sync now needs these three
spans reapplied rather than a straight copy. That is the right trade: the
byte-identity was a maintenance convenience for me, and a pointer that
goes nowhere is a defect for whoever installs this.
Catalog parse re-checked after the edit -- version, author, repo,
license, keywords, and references all still resolve, no empty fields.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Re-vendor from upstream v3.22.3: five prose-contract clarifications
Upstream applied the five applicable findings from cubic's review of
this PR (conorbronsdon/avoid-ai-writing#97, released as v3.22.3):
tables join the edit-mode flag-don't-fix list, the rewrite job line
scopes 'all AI-isms removed' to editable ones, edit mode gets an
explicit instruction boundary, the tracking-parameter fix leaves the
rest of the query string alone, and the second-pass audit must say
when its text supersedes section 2. Same vendoring transform as
before: frontmatter rewrite plus the three documented body spans.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* improve: enhance ai-engineer based on automated review
- Reposition scope as generalist for both classical ML and generative-AI/LLM engineering, with explicit handoffs to llm-architect, ml-engineer/machine-learning-engineer, and prompt-engineer
- Add Generative AI / LLM Engineering section (LLM API providers, RAG basics, agentic patterns, fine-tuning, evaluation frameworks)
- Add model: sonnet and WebSearch tool to frontmatter
- Replace fictional context-manager protocol with a concrete Requirements Gathering step
- Replace vague adjective checklists with measurable criteria and named tools/thresholds
- Sharpen frontmatter description examples with concrete frameworks and a boundary-clarifying example
- Disambiguate the "prompt-engineer" cross-reference (ai-specialists vs data-ai)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: remove stray content marker, make requirements gathering conditional
Addresses Greptile review feedback on PR #775: an unmatched </content>
marker leaked into the installed prompt, and the requirements-gathering
step re-asked for details the user had already supplied.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QS1SncnafSWXMRXQa1yVBA
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance ai-ethics-advisor based on automated review
- Fix malformed YAML frontmatter: description examples were bare unindented
text outside the description field, breaking YAML parsing / delegation
matching. Merged into a single quoted description scalar per sibling
convention.
- Add missing model: sonnet field, consistent with other ai-specialists agents
- Add NIST AI 600-1 (Generative AI Profile) subsection with the 12 GenAI risk
categories
- Add EU AI Act compliance-timeline caveat with current/pending deadlines
- Cite OWASP Top 10 for LLM Applications (LLM01, LLM06) in Agentic AI Ethics
- Add LLM/Generative System Explainability subsection (chain-of-thought
faithfulness caveat, citation-grounded transparency)
- Add Aequitas toolkit, 80% disparate-impact rule, and Bash least-privilege
clarification
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* chore: sync generated content for ai-ethics-advisor
Regenerate only the per-component content artifact for
ai-ethics-advisor so the dashboard detail view reflects the updated
frontmatter/body. Full catalog regeneration (docs/components.json,
counts, search-index, download stats) is left to the scheduled
update-json-data workflow, since a local run here pulled stale/wrong
download counts that would have clobbered production data.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018wpuLQJaC6qskfDwUSioLF
---------
Co-authored-by: Claude <noreply@anthropic.com>
Adds the PatentFig AI skill: generate patent-office-compliant figures
from text (PNG or SVG line art), vectorize drawings to SVG/DXF/vector
PDF, AI-upscale, and convert to filing-ready formats via the PatentFig
REST API. Mirrors github.com/TopLocalAI/patentfig-skill.
Claude-Session: https://claude.ai/code/session_01Eh5mM5VPK3Rqf19GnLxSBJ
Co-authored-by: davie <davie@daviechen.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* improve: enhance product-manager based on automated review
- Remove fabricated JSON "protocol" blocks and invented metrics (fake agent-to-agent JSON requests, +$4.2M/84% satisfaction canned numbers) that don't map to real Claude Code mechanics and risk priming fabricated outputs
- Add model: sonnet to frontmatter (required field for agents)
- Replace ~20 flat keyword-list sections with concrete worked frameworks: RICE scoring formula, OKR worksheet, discovery-to-launch checklist with exit criteria, one-page PRD template, and stakeholder communication cadence
- Add explicit "How This Differs From Related Agents" section disambiguating from product-strategist (market/positioning strategy) and se-product-manager-advisor (GitHub issue creation), mirrored in description examples
- Fix cross-reference from "customer-success" to the actual component name "customer-success-manager"
- Add explicit Write/Edit output guidance (PRD/roadmap markdown documents) and anti-fabrication guidance for progress reporting
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: restore component download counts reset by catalog regeneration
The prior commit regenerated the catalog without Supabase credentials,
resetting download counts to 0 for ~1800 unrelated components. Restore
each file's original download counts from main while keeping the
product-manager description update.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012oa4wnU6RLfRH4gFWLFumC
* fix: soften product-manager/product-strategist disambiguation
product-strategist's own description explicitly covers feature
prioritization and roadmap planning, so the prior wording (claiming it
handles only market/positioning docs) contradicted the referenced
agent. Acknowledge the overlap instead, per cubic review feedback.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012oa4wnU6RLfRH4gFWLFumC
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: rename risk-manager to trading-risk-manager, add model field
- Resolve name collision with finance/risk-manager.md by renaming this
trading/portfolio-focused agent to trading-risk-manager (frontmatter
name + filename), sharpening the description to distinguish it from
the enterprise ERM-focused finance/risk-manager
- Add required model: sonnet field (was missing, failed component-reviewer
checklist)
- Add "When Invoked" context-gathering step and Human-in-the-Loop Pause
Criteria (account size, risk tolerance, leverage/derivatives, full-Kelly
requests)
- Add financial-advice disclaimer as a required Output element
- Add <example> blocks to description for reliable auto-invocation
- Recommend fractional (half/quarter) Kelly over full Kelly, and add
tail-risk hedging / leverage-liquidation risk / Sharpe-Sortino-Calmar
focus areas
- Add "Integration with Other Agents" section
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* chore: regenerate component catalog for trading-risk-manager rename
Propagates the risk-manager -> trading-risk-manager rename (and the
model/content updates) into the generated catalog artifacts so
browse/search/install no longer reference the deleted
business-marketing/risk-manager.md path. Also removes the now-orphaned
component-content JSON for the deleted path.
Addresses review feedback on PR #765.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance backend-developer based on automated review
- Replace fictional context-manager JSON RPC messaging with concrete
Glob/Grep/Read-based discovery steps (matches api-designer's pattern)
- Update runtime baselines: Node.js 22+/24+, Python 3.12+ (3.13/3.14
fluency), Go 1.24+
- Reference OWASP API Security Top 10 (2023) explicitly, naming BOLA
and Broken Object Property Level Authorization, plus secret
management and short-lived token/MFA guidance
- Cross-reference backend-architect for upfront design decisions and
add it to Integration with other agents
- Add model: sonnet and color: green to frontmatter
- Add "Use PROACTIVELY" framing to the description
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address PR review feedback on backend-developer agent
Make manifest discovery Glob patterns recursive (**/package.json etc.)
so nested services in monorepos are found, and reword the two
"service boundary" checklist bullets so they consume/confirm
backend-architect's design instead of contradicting the new
architecture handoff note.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019vHEpW64LEdeoV7jhZGRPR
* fix: remove remaining architecture-ownership claims from description examples
The <example> blocks in the frontmatter description still had
backend-developer "architect this service decomposition" and "design
service boundaries", contradicting the handoff to backend-architect
introduced earlier in this PR. Reworded both examples and the
"full stack from architecture decisions" commentary line so the
description is consistent with the body's ownership split.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019vHEpW64LEdeoV7jhZGRPR
* fix: make remaining discovery glob patterns recursive
openapi.yaml and docker-compose.yml were the only patterns in the
Discovery Protocol Glob step without the **/ prefix, inconsistent
with the monorepo-nested-service rationale applied to the other
patterns.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019vHEpW64LEdeoV7jhZGRPR
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance market-researcher based on automated review
- Add missing model: sonnet frontmatter field
- Forbid fabricated statistics in progress tracking and delivery notification (no more baked-in sample figures)
- Replace fictional "context manager" protocol with direct user-scoping questions
- Add Human-in-the-Loop Pause Criteria for ambiguous scope, conflicting data, unsourced estimates, and single-source claims
- Add Ethical & Legal Boundaries section (public sources only, no paywalled/login-gated access, cite sources and as-of dates, no implied primary research)
- Consolidate flat keyword lists into a "Core Practices" section and merge four redundant checklists into one Excellence checklist
- Add data-freshness guidance for market-size/growth/share figures
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address greptile review feedback on market-researcher
- Only ask clarifying questions when the user hasn't already provided
target market/objective/scope, avoiding redundant interruptions on
fully-specified single-turn requests
- Don't pause for confirmation on every single-source claim (common
in market research); flag them instead per Ethical & Legal Boundaries
Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: make research-planning confirmation conditional too
The Research Planning step still unconditionally required confirming
scope/market/objectives with the user, reintroducing the redundant-
interaction issue already fixed in the When Invoked step. Now only
confirms when something is still missing or ambiguous.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add three Ansvar EU compliance skills to security category
* docs: note that inline tool mentions are shorthand, not full calls
Ground rule 8 now states that prose mentions such as
`get_provision NIS2:art_2`, `get_cve_details`, and `check_kev_status`
name the tool and its key argument only, and that every actual call
carries the full argument object under *Verified call shapes*.
Addresses the two review comments that read the prose shorthand as
calls missing required arguments. No tool name, argument,
canonical_ref, or verified call shape changes; the text matches the
canonical skill repo byte for byte.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: note that inline CVE tool mentions are shorthand, not full calls
Ground rule 2 now states that prose mentions such as `get_cve_details`,
`check_kev_status`, and `get_epss_score` name the tool and at most its
key argument, and that every actual call carries the full argument
object under *Verified call shapes*. This is also the file's first
in-prose pointer to that section.
Same clarification as the preceding commit applied to
incident-reporting-navigator, adapted to this skill's CVE-family
shorthand. No tool name, argument, canonical_ref, or verified call
shape changes; the text matches the canonical skill repo byte for byte.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude (Jeffrey von Rotz) <jeffrey.von.rotz@ansvar.eu>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* improve: enhance legal-advisor based on automated review
- Add required model field (sonnet)
- Add Human-in-the-Loop Pause Criteria for unconfirmed jurisdiction/facts
- Rewrite description with scenario-driven examples for auto-delegation
- Add When Invoked section to gather jurisdiction/data facts before drafting
- Add WebFetch tool and expand Key Regulations for 2026 (EU AI Act, US state laws, DPDPA)
- Move disclaimer into Output as a required document element
- Add Integration with Other Agents section
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: correct double-escaped newlines in legal-advisor description
The description field used \\n (literal backslash-n) instead of \n
(YAML newline escape), which rendered the <example>/<commentary>
blocks as a single wall of text.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance react-specialist based on automated review
- Update React version framing to React 19+; add React Compiler and
React 19 Actions/hooks guidance (use(), useActionState, useOptimistic,
useFormStatus)
- Remove Recoil (archived by Meta, unmaintained); add prioritized state
management guidance (TanStack Query, Zustand, Jotai, Redux Toolkit)
- Modernize testing stack: Vitest as default runner, MSW for mocking,
Playwright for E2E
- Add Vite/Next.js/Remix tooling guidance, note CRA deprecation
- Add concrete TypeScript compiler flags and WCAG 2.2 AA accessibility
criteria with tooling
- Trim redundant filler (duplicated Portals/error boundary/Suspense
bullets) and update ecosystem list (shadcn/ui, Radix UI)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: correct WCAG 2.4.11 criterion citation in react-specialist
2.4.11 is "Focus Not Obscured (Minimum)" (Level AA), not "Focus
Appearance" (that's 2.4.13, Level AAA). The mislabeled guidance would
have led the agent to check focus indicator styling instead of
whether focused elements are hidden by overlapping content, while
still reporting AA compliance.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JbrpDkpsMuh5ckdeWiuqCU
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add missing model: sonnet field to frontmatter
- Remove fictional "context manager" / Communication Protocol JSON scaffolding, replaced with a direct ask-user-first invocation flow
- Replace fabricated example telemetry (invented revenue/NPS numbers) with instructions to report only actual confirmed session findings
- Add Human-in-the-Loop Pause Criteria section for health/churn classification, renewal/pricing decisions, and financial interventions
- Reframe the success checklist as illustrative reference points rather than assumed-achieved facts
- Note the industry shift toward ML-based/real-time health scoring and NRR as a headline metric
- Add a Source Boundaries section governing WebSearch/WebFetch use (public sources only, no pretexting, respect robots.txt, cite sources)
- Narrow tools list by dropping Edit (Read, Write, Glob, Grep, WebFetch, WebSearch)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance marketing-attribution-analyst based on automated review
- Add required model field and rewrite description with Use-when framing
plus 3 <example> blocks that disambiguate from content-marketer,
business-analyst, and market-researcher
- Fix tools to match sibling analyst agents (drop Bash, add Glob/WebFetch/
WebSearch) since this is a research/analysis role, not a shell-execution one
- Add a "When Invoked" context-gathering step so the agent asks for the
user's real tracking stack, attribution window, and data sources before
producing any numbers
- Add a Measurement Strategy Framework (MMM + incrementality + MTA
triangulation) with spend-tier guidance
- Update GA4 attribution model guidance (Data-Driven Attribution is now the
default/only selectable model in most reports since 2023)
- Update tracking infrastructure guidance for Consent Mode v2, server-side
tagging, and Enhanced Conversions/server-side conversion APIs
- Correct cookie/privacy framing (Chrome reversed third-party cookie
deprecation; Privacy Sandbox trials shut down Oct 2025; Safari/Firefox
still block by default)
- Reference Google Meridian and Meta's Robyn as current standard MMM tools
- Expand the single-line Privacy Compliance bullet into concrete guidance
(Consent Mode v2 signals, data clean rooms, first-party data strategy)
- Add data-provenance caveats to report/dashboard templates so figures are
never fabricated
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address Greptile review findings on attribution analyst
- Scope Consent Mode v2 to applicable Google Ads/Analytics features
rather than claiming it's mandatory for every EEA-facing site
- Add explicit consent-state/regional-rules boundary to Enhanced
Conversions / server-side conversion API guidance
- Soften spend-tier MMM guidance to depend on data history/variance
rather than spend level alone
- Define the previously-missing apply_saturation() helper used by
the MMM code example
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TXNgB3pCBw9SaHktzQWoFc
* fix: address second round of Greptile findings
- Ask for data-history length and channel spend variance during
intake, not just spend level, so MMM fitness can be assessed
before it's recommended
- Scope the Data Quality Monitoring consent checklist to applicable
Google Ads/Analytics features and include the ad_storage signal
- Guard apply_saturation() against zero-spend channels (max=0) to
avoid producing NaN features
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TXNgB3pCBw9SaHktzQWoFc
* fix: address cubic review findings on attribution analyst
- Correct GA4 attribution note to list the three current selectable
reports (Data-Driven Attribution, Paid and organic last click,
Google paid channels last click) instead of implying DDA is the
only selectable model
- Distinguish Google Meridian (genuinely Bayesian, posterior credible
intervals) from Meta's Robyn (ridge regression, bootstrapped
confidence intervals) in both the prose and the matching code
comment, which previously still lumped both under "Bayesian"
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TXNgB3pCBw9SaHktzQWoFc
* fix: close remaining checklist gaps flagged by Greptile
- Require confirmed data fitness (not spend tier alone) before the
Analysis Framework checklist marks MMM as the matched approach
- Require consent-state propagation and suppression of ineligible
events/identifiers as part of the conversion-API checklist item,
not just "configured where applicable"
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TXNgB3pCBw9SaHktzQWoFc
* fix: guard MMM example against missing spend observations
calculate_adstock() carries values forward recursively, so a single
NaN in a spend column poisons every subsequent period's adstock
value; since that's a plain numpy array (not a pandas Series), the
existing zero-guard in apply_saturation() doesn't catch it because
max() on an array containing NaN returns NaN, not 0. Fill missing
spend values before computing adstock so the illustrative pipeline
runs on real-world data with gaps.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TXNgB3pCBw9SaHktzQWoFc
* fix: stop silently imputing missing spend as zero in MMM example
Blanket fillna(0) conflated genuinely missing observations with
confirmed zero spend, which can materially bias adstock/attribution
for the affected channel. Fail loudly instead and require the caller
to make an explicit, documented choice per Greptile/cubic feedback.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TXNgB3pCBw9SaHktzQWoFc
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance content-marketer agent based on automated review
- Add model: sonnet frontmatter field for category consistency
- Replace duplicate "Content types" section with distinct emerging/high-ROI formats list
- Add "AI search & generative engine visibility" section (AI Overviews, LLM citation, llms.txt)
- Add "Owned audience strategy" section (zero-party/first-party data, privacy-first)
- Expand "Content quality" with explicit E-E-A-T signals and named-entity writing guidance
- Add "Limitations" section scoping Write/Edit usage and handoffs
- Add handoff lines to marketing-attribution-analyst, search-ai-optimization-expert, seo-specialist
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: correct seo-specialist handoff scope in content-marketer
seo-specialist has no Write/Edit/Bash access (audit/strategy only), so
routing technical SEO *implementation* to it left that work with no
actual owner. Split the handoff: audits/recommendations to
seo-specialist, implementation to frontend-developer or
wordpress-master.
Addresses Greptile review comment on PR #744.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance accessibility-tester agent based on automated review
- Fix broken automated-scan command: npx axe-core-cli -> npx @axe-core/cli --exit (with WCAG tag flag guidance)
- Correct inaccurate legal-compliance framing; map each framework to its actual referenced WCAG version (Section 508 -> 2.0 AA, ADA Title II/III -> 2.1 AA, EAA/EN 301 549 -> approx 2.1 AA)
- Add Track 1b: scripted keyboard/focus/ARIA-state testing via @axe-core/playwright
- Qualify the automated-coverage statistic (30-40% industry-wide, axe-core ~57%) instead of an unqualified 40%
- Note WCAG 3.0 is still a W3C Working Draft, not expected before ~2029
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* address review feedback: fix missing AxeBuilder import, stale frontmatter examples
- Add missing `import { AxeBuilder } from '@axe-core/playwright'` to the
Track 1b code snippet so it's copy-pasteable
- Update the frontmatter description's second example to drop a now-past
"EAA June 2025 deadline" reference and match the per-framework WCAG
version mapping already used in the body
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsDjHUg19zLAPpSYuQxH5A
* fix: add missing assertion to Track 1b Playwright example
The snippet collected axe results but never asserted on them, so a
copied test would exit 0 regardless of violations found.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsDjHUg19zLAPpSYuQxH5A
* fix: expand Track 1b withTags to full WCAG 2.0/2.1/2.2 scope
withTags(['wcag22aa']) only activated the 9 new WCAG 2.2 criteria,
silently skipping the WCAG 2.0/2.1 rules that Track 1 already covers
via --tags wcag2a,wcag2aa,wcag21aa,wcag22aa. Align the two tracks.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsDjHUg19zLAPpSYuQxH5A
* fix: add missing wcag21a tag to accessibility scan commands
The --tags/withTags lists omitted wcag21a (WCAG 2.1 Level A), causing
axe-core to skip rules like Character Key Shortcuts, Pointer Gestures,
Pointer Cancellation, Label in Name, and Motion Actuation. Applied to
both Track 1 (@axe-core/cli) and Track 1b (@axe-core/playwright).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsDjHUg19zLAPpSYuQxH5A
---------
Co-authored-by: Claude <noreply@anthropic.com>
Adds a 'doordash' category of components built on doordash-oss/doordash-cli
(dd-cli), focused on what plain prompting cannot deliver: persistent state,
deterministic enforcement, and multi-person coordination.
- dd-order-playbooks: named saved orders with mandatory cart-diff on recall
- dd-spend-guard: budget caps enforced by dd-guard.sh wrapper + PreToolUse
hook denying bypasses (per-order/daily/weekly/monthly, cooldown, hours)
- dd-allergy-shield: persistent dietary profile, vetted-cart dumps re-grepped
by a deterministic checkout gate for anaphylaxis-tier allergens
- dd-group-orders: team roster, person-to-cart-item-id ledger, cost split,
payer rotation, live allergen re-check at group checkout
- dd-order-ledger: PostToolUse audit log (secrets stripped) + /dd-report
All hook/wrapper scripts behaviorally tested with stubs (block/allow paths,
staleness state machine, attribution, secret stripping). Real-binary testing
pending on Apple Silicon (dd-cli is darwin-arm64 only).
Also: cloudflare-pages-deployment-monitor statusline (self-contained bash,
env-based config) and a testing-gate step in the component workflow docs.
* improve: enhance competitive-analyst based on automated review
- Remove fabricated example statistics from progress/delivery templates
- Replace fictional context-manager JSON protocol with explicit
user-questions step and Human-in-the-Loop Pause Criteria
- Add Ethical & Legal Boundaries section for competitive intelligence
- Add model: sonnet to match sibling agents in business-marketing
- Consolidate repetitive bullet lists into denser Core Practices prose
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: resolve wording conflicts flagged by cubic review on PR #737
- Analysis step now allows sourced findings with explicit uncertainty
labels instead of an absolute corroboration requirement, matching the
later "flag single-source claims" guidance.
- Non-public/paywalled competitor access is now an outright refusal with
a redirect to public sources, not a pause-for-confirmation item (which
implied it was user-authorizable, conflicting with the absolute
prohibition in Ethical & Legal Boundaries).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PgWKsHrXsL4B1ZdaKgkCvk
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance legacy-modernizer based on automated review
- Add missing model: sonnet frontmatter field (was required but absent)
- Add explicit ownership/hand-off statement clarifying scope vs
architecture-modernizer, refactoring-specialist, cloud-migration-specialist,
and database-optimizer
- Add concrete "Common legacy stacks & upgrade paths" section (COBOL,
Java EE/WebLogic, .NET Framework, AngularJS, Python 2, PHP 5/7)
- Add "AI-assisted analysis" guidance (dependency mapping, codemods,
auto-generated characterization tests)
- Replace vague filler bullets ("Team trained effectively", "Celebrate wins",
"Business value delivered continuously") with concrete, actionable deliverables
- Diversify description examples: replaced a redundant strangler-fig example
with a distinct mainframe/COBOL + version-upgrade-only scenario
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address greptile review feedback on legacy-modernizer
Align the third description example's context with what it actually
demonstrates (.NET Framework version-upgrade only), and de-duplicate
the implementation-approach bullets that repeated the checklist items
verbatim.
* fix: address cubic review feedback on legacy-modernizer accuracy
Scope the .NET Framework upgrade path (Web Forms/WCF have no direct
Upgrade Assistant port and need separate plans), note 2to3 was removed
in Python 3.13+, and clarify that Grep/Glob only inventories
dependencies rather than producing a validated call graph.
* fix: soften zero-risk claim in legacy-modernizer example commentary
Version-only upgrades can still change runtime/dependency/batch
behavior; describe risk minimization via validation and rollback
instead of guaranteeing zero production risk.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance bettoredge-value-finder based on automated review
- Fix name to kebab-case (bettoredge-value-finder) matching filename
- Add required tools/model frontmatter, scoped to Read + mcp__bettoredge__*
- Add system-prompt persona and "When invoked" workflow
- Add Guardrails section enforcing bankroll limits, no fabricated results,
and legal-age confirmation
- Caveat the bid/ask-midpoint value-detection methodology
- Add credential-handling guidance for live account login env vars
- Bump version to 1.0.1 to match published npm package
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address PR review feedback on bettoredge-value-finder
- Remove unnecessary Read from tools frontmatter (agent only calls
MCP tools, none of which touch the filesystem)
- Fix bootstrap paradox: step 1 no longer unconditionally calls
bettoredge_setup, which only exists once the MCP server is running
- Move credential-handling warning ahead of the first instruction
that has users embed BETTOREDGE_EMAIL/PASSWORD
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: clarify bettoredge_status is read-only in guardrail wording
bettoredge_status only surfaces current bankroll limits; it can't
change them. Point users to the BettorEdge platform for that instead
of implying the agent can modify limits through this tool.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add missing required `model: sonnet` frontmatter field
- Rewrite description with a "Use PROACTIVELY" trigger phrase and three <example> blocks for better delegation matching, dropping the unsupported "research-backed" claim (tools have no WebSearch/WebFetch)
- Fix broken "See Also" references: professional-effective-communication -> professional-communication skill, /compose-email command -> email-composer skill, remove non-existent tech-talks-craft skill and /feedback-composer command, add difficult-workplace-conversations skill for roleplay scenarios
- Add persona-drift resistance guidance to Roleplay Mode so simulated personas stay consistently resistant/motivated across an exchange instead of becoming generically agreeable
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* Fix unauthenticated command injection (RCE) in Studio server
The `--studio` server (cli-tool/src/sandbox-server.js) bound to 0.0.0.0
with wildcard CORS and no authentication, and passed request-body fields
into spawn(..., { shell: true }). Because shell:true makes Node join the
argv array into a single `sh -c` string, the fields were parsed by the
shell, allowing OS command injection (RCE) via POST /api/execute (prompt)
and POST /api/install-agent (agentName), reachable from the LAN or a
malicious web page (wildcard CORS).
- Remove shell:true from all three spawns so arguments stay discrete argv
entries; shell metacharacters can no longer inject commands.
- Validate agentName against ^[A-Za-z0-9._/-]+$ before use.
- Bind the server to 127.0.0.1 only (removes the LAN vector).
- Restrict CORS to the local UI origin and reject cross-origin requests
(removes the drive-by browser vector).
Fixes GHSA-79wm-x847-7cvg.
Co-Authored-By: Claude Opus <noreply@anthropic.com>
* security: Windows-safe spawns + release bump on top of GHSA-79wm-x847-7cvg fix
Builds on @spartan8806's fix (advisory-fix-1). Adds the two pieces that fix
lacked:
- Resolve npx/claude via their .cmd shims on Windows (NPX_CMD/CLAUDE_CMD).
Without shell:true, bare spawn('npx'/'claude') fails with ENOENT on win32,
which would break agent install/local execution. This keeps the security fix
cross-platform.
- Bump version to 1.29.4 (root + cli-tool package.json) and add the 1.29.4
Security entry to CHANGELOG for the patched release.
Refs GHSA-79wm-x847-7cvg.
---------
Co-authored-by: spartan8806 <spartan8806@users.noreply.github.com>
Co-authored-by: Claude Opus <noreply@anthropic.com>
Co-authored-by: Dani <dan.avila7@gmail.com>
* Add mac-storage-cleaner skill (productivity)
* Address cubic-dev-ai review (3x P3): match the App-caches emptiness check to the four scanned dir names; guard unquoted * globs against a literal-* path on empty dirs; surface an unwritable audit log instead of proceeding silently unlogged.
Reviews a PRD/spec/design brief before implementation and surfaces holes by
attacking what the document is silent about — undefined edge cases, missing
states, policy gaps. Rules Approve / Conditional / Reject and turns each hole
into a forwardable question.
Co-authored-by: dhha22 <10957270+dhha22@users.noreply.github.com>
* improve: enhance smart-contract-specialist based on automated review
- Narrow scope to architecture/design-pattern advisory role, resolving overlap with blockchain-developer
- Add model: sonnet and tools: Read, Grep, Glob, WebSearch, WebFetch frontmatter (least-privilege, no Write/Edit/Bash)
- Add "When to Stop and Ask" guardrails section
- Add 2026 EVM/Solidity coverage: EIP-1153 transient storage, EIP-7201 namespaced storage, EIP-7702 (Pectra) EOA delegation, via_ir pipeline
- Add security/verification toolchain advisory section (Slither, Aderyn, Echidna, Medusa, Certora, Halmos, forge snapshot)
- Add anti-hallucination delivery-summary instruction
- Add "Integration with Other Agents" section documenting handoff to blockchain-developer and smart-contract-auditor
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: remove unsourced gas-savings percentage for via_ir pipeline
Addresses cubic review feedback on PR #713 — the "10-30% gas reduction"
figure isn't backed by official Solidity docs, which only describe
via-IR as producing "better gas-optimized code" without a specific
percentage. Replaced with qualitative language consistent with the
file's own anti-hallucination guardrail.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Packages the self-hosted stargazers-chart solution as a reusable skill so any
repo can add a star history chart that never breaks. Includes the generator
script (repo auto-detected from git remote / GITHUB_REPOSITORY) and a weekly
GitHub Actions workflow template.
Also points the README chart link to the skill's page on aitmpl.com.
- Add required tools and model frontmatter fields (audit-only allowlist: Read, Grep, Glob, Bash, WebSearch, WebFetch)
- Modernize security toolchain with Foundry, Aderyn, Echidna/Medusa, Certora Prover/Halmos
- Reference OWASP Smart Contract Top 10 and add explicit severity classification (Critical/High/Medium/Low/Informational)
- Cover cross-chain bridge exploits and business logic/tokenomics attack categories
- Add Integration with Other Agents section and When to Stop and Ask guardrail
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Claude