@kubbisec/ai-linux-x64 0.1.22 → 0.1.24

package/bundled/skills/scanner-trivy/SKILL.md

@@ -1,10 +0,0 @@
----
-name: scanner-trivy
-description: Trivy — SCA, imagens Docker, IaC; upload ASPM e job NAUS.
----
-
-Chame `security_scanner_playbook(scanner="trivy", platform="linux"|"macos"|"windows", topic="install"|"scan"|"upload"|"naus"|"formats"|"all")`.
-
-Relatório típico: `trivy-report.json`. Upload: `aspm upload trivy-report.json -s trivy`.
-
-NAUS: `kind: aspm` com `tool: trivy`; preset `kind: docker` com `aspm.tool: trivy` e gate.

package/bundled/skills/sec-brainstorm/SKILL.md

@@ -1,74 +0,0 @@
----
-name: sec-brainstorm
-description: "Before any implementation: explore context, threat model, design; write .kbs/specs/*.md; HARD-GATE until user approves."
-metadata:
-  kubbisec:
-    category: workflow
-    requires: [session-questionnaire.json]
-    produces: kbs-spec
----
-
-# sec-brainstorm — Design + threat model (KubbiSec)
-
-**Announce:** `Using sec-brainstorm to explore design and write runtime spec.`
-
-<HARD-GATE>
-Do NOT invoke implementation actions (edit/write/bash that mutates repo), domain skills that change code, or claim work complete until:
-
-1. A runtime spec exists at `.kbs/specs/*.md`, AND
-2. The user has explicitly approved it (`approved` / `aprovado`).
-
-Read-only tools (read, grep, ls) are always allowed.
-</HARD-GATE>
-
-## When to use
-
-- New feature, refactor, or security policy change in chat
-- `/mode:plan` or `@plan` with no approved runtime spec yet
-- After `sec-clarify` (or equivalent structured brief)
-
-## When NOT to use
-
-- CVE remediation in `kbs fix` harness
-- Trivial typo-only changes (user must confirm below HARD-GATE threshold in writing)
-- Mid-implementation — use domain skills instead
-
-## Process
-
-1. **Explore context** — read relevant repo paths, `docs/`, recent git log (read-only)
-2. **Clarifying questions** — one at a time, max 5 after clarify if gaps remain
-3. **Propose 2–3 approaches** — security trade-offs; recommend one
-4. **Present design** — section by section; user confirms or revises
-5. **Threat model** — STRIDE-lite table (min 3 rows for auth/network/deps)
-6. **Write spec** — `.kbs/specs/YYYY-MM-DD-<slug>.md` with `status: draft`
-7. **Self-review** — fix placeholders, contradictions inline
-8. **Request approval** — "Revise o arquivo ou responda `approved` para liberar implementação."
-9. **Handoff** — on approval, invoke **`sec-plan` only** (never direct implementation)
-
-## Runtime spec template
-
-Write `.kbs/specs/YYYY-MM-DD-<slug>.md` with these sections:
-
-- **Metadata** — yaml block: `id`, `status: draft`, `created`, `orgId`, `projectId`
-- **Problem statement**
-- **Threat model (required)** — table: Threat | STRIDE | Mitigation in design | Verification
-- **Design** — recommended approach
-- **Out of scope**
-- **Approval** — checkbox for user `approved` / `aprovado`
-
-Slug rules: `YYYY-MM-DD-<kebab-slug>.md`, max 48 chars, `[a-z0-9-]` only.
-
-## Threat model must address
-
-- Injection, authz, secrets handling, supply chain (deps), logging sensitive data
-- Do not propose storing credentials in repo or `.kbs/`
-
-## Anti-patterns
-
-- Skipping HARD-GATE for "simple" changes without user written confirmation
-- Writing app code before `approved`
-- Conflicts with `docs/kubbisec-ai/specs/` — prefer repo product specs as platform truth; note conflicts in spec
-
----
-
-*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/sec-clarify/SKILL.md

@@ -1,53 +0,0 @@
----
-name: sec-clarify
-description: "Chat-only: collect scope via the questionnaire tool before mutations."
-metadata:
-  kubbisec:
-    category: workflow
-    surfaces: [chat]
-    excludes: [fix, watch, run]
----
-
-# sec-clarify — Session scope (KubbiSec)
-
-**Announce briefly:** `A recolher escopo antes de alterações.`
-
-## Primary mechanism
-
-KubbiSec **auto-asks** the next scope question in the panel above the editor when the gate is active. You may still use the **`questionnaire` tool** to `record` prose scope or `complete` when sufficient.
-
-| Action | When |
-|--------|------|
-| `status` | Check missing fields + scenario hints |
-| `record` | User already gave scope in prose — persist fields |
-| `complete` | Scope is sufficient — unblock mutations |
-| `ask` | Rare — auto-ask already queues questions; use only for custom copy |
-
-## Panel UX
-
-- Up to **3 options (A–C)** plus **D) Outro**; user can also type free text below.
-- **Space** toggles selection (multi when relevant, e.g. severity).
-- **Enter** confirms a panel selection; typed text submits as custom answer.
-- **Never** repeat option lists in chat or say "painel acima" unless the panel is actually showing.
-
-## When to use
-
-- Execute/remediation intent without enough scope
-- Before destructive tools or `@plan` when decisions are unclear
-
-## When NOT to use
-
-- Questionnaire already **ready**
-- Factual/docs questions
-- `KUBBISEC_SKIP_CLARIFY=1`
-- Headless `kbs fix` / `watch`
-
-## Common scope fields
-
-- `projectIds`, `severityMin`, `remediationMode` (remediation)
-- `customNotes`, `nausConstraints` (plan/pipeline context)
-- Any extra key → stored in `extras`
-
-## Handoff
-
-When status is **ready**, proceed with remediation, `sec-plan`, or the user request.

package/bundled/skills/sec-debug/SKILL.md

@@ -1,94 +0,0 @@
----
-name: sec-debug
-description: "Systematic root-cause analysis for test failures, harness errors, and failed remediations before proposing fixes."
-metadata:
-  kubbisec:
-    category: workflow
-    surfaces: [chat, fix, watch]
-    follows: [sec-verify]
----
-
-# sec-debug — Systematic debugging (KubbiSec)
-
-**Announce:** `Using sec-debug — Phase 1 investigation.`
-
-## Iron Law
-
-**NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST.**
-
-Even under time pressure, complete Phase 1 summary before any edit.
-
-## When to use
-
-- `sec-verify` reported failures
-- Remediation harness empty diff or retry loop
-- `kbs watch` tick failure
-- Flaky or intermittent CI vs local delta
-
-Pairs with `remediation` after root cause is proven for CVE-scoped work.
-
-## Four phases
-
-| Phase | Name | Activities | Exit criteria |
-|-------|------|------------|---------------|
-| 1 | Root cause investigation | Read errors, reproduce, git diff, recent changes | Written hypothesis with evidence |
-| 2 | Pattern analysis | Compare similar code, search repo, check deps | Hypothesis confirmed or ruled out |
-| 3 | Hypothesis test | Minimal experiment, logging, single-variable change | Root cause proven |
-| 4 | Fix implementation | Minimal fix + `sec-verify` | Verify evidence attached |
-
-Show phase headers to user: `Fase 1/4 — Investigação`.
-
-## Multi-component boundaries (KubbiSec)
-
-| Boundary | Diagnostic action |
-|----------|-------------------|
-| CLI → API | Log HTTP status + request id |
-| API → Prisma | Log query error code |
-| Harness → git | Log diff stat + exit code |
-| Scanner → finding | Log rule id + file path |
-
-## Debug log artifact (optional)
-
-Write `.kbs/context/debug-YYYY-MM-DD-<slug>.md`:
-
-```markdown
-## Symptom
-...
-
-## Reproduction steps
-1. ...
-
-## Evidence
-- command: ...
-- output: ...
-
-## Root cause
-...
-
-## Fix (minimal)
-...
-```
-
-No secrets from `.env` or tokens in reproduction commands. Use test accounts for auth bugs.
-
-## Empty remediation diff playbook
-
-Phase 1: read harness JSON, model tool calls, task XML.
-
-Root cause categories: tool-weak model, wrong branch, permission, prompt drift.
-
-Handoff to `remediation` or config change — not blind retry.
-
-## Escalation
-
-- **3rd failed fix:** Stop auto-retry; escalate human with debug log summary
-- **Cannot reproduce:** Do not fix; list data needed from user
-- **Multiple root causes:** Split debug sessions per cause
-
-## Copy (PT)
-
-`Investigando causa raiz antes de novo patch.`
-
----
-
-*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/sec-plan/SKILL.md

@@ -1,101 +0,0 @@
----
-name: sec-plan
-description: "After approved .kbs/specs: produce bite-sized implementation plan at .kbs/plans/ with verification steps."
-metadata:
-  kubbisec:
-    category: workflow
-    requires: [kbs-spec-approved]
-    produces: kbs-plan
----
-
-# sec-plan — Implementation plan (KubbiSec)
-
-**Announce:** `Using sec-plan to decompose work from <spec-path>.`
-
-## When to use
-
-- `.kbs/specs/*.md` has `status: approved`
-- Handoff from `sec-brainstorm` after user approval
-- User invokes `/skill:sec-plan` or `@plan` with approved spec
-
-## When NOT to use
-
-- Spec still `draft` — refuse; link to sec-brainstorm approval step
-- Headless remediation unless task metadata sets `requirePlan=true`
-- Emergency plan without spec — only with `deferred-spec: true` header + explicit user sign-off (discouraged)
-
-## Process
-
-1. Read approved spec + questionnaire + affected package layout
-2. Draft **file map** (which packages touched; `packages/shared` first if types change)
-3. Write `.kbs/plans/YYYY-MM-DD-<slug>.md` paired with spec (same date + slug)
-4. Present plan summary; user may edit plan file
-5. Implementation begins; mark checkboxes as tasks complete
-6. After each task or batch: run **`sec-verify`** before claiming done
-
-## Plan header (required)
-
-```markdown
-# <Feature> — Implementation Plan
-
-> **Spec:** `.kbs/specs/YYYY-MM-DD-<slug>.md` (approved)
-> **For KubbiSec agents:** Execute tasks in order; run `sec-verify` before marking task done.
-
-**Goal:** <one sentence>
-
-**Architecture:** <2-3 sentences>
-
-**Tech stack:** <e.g. NestJS, Prisma, Vitest, React, NAUS>
-
-**Security notes:** <top mitigations from threat model>
-
----
-```
-
-## Task entry schema
-
-```markdown
-### Task N: <name>
-
-**Files:**
-- Create: `path/to/file`
-- Modify: `path/to/existing.ts:10-40`
-- Test: `path/to/file.test.ts`
-
-- [ ] **Step 1:** <action>
-  - Verify: `pnpm --filter <pkg> test path -v`
-  - Expected: PASS
-
-- [ ] **Step 2:** ...
-```
-
-Optional frontmatter:
-
-```yaml
----
-kbsPlan:
-  specRef: .kbs/specs/2026-05-29-mfa-login.md
-  estimatedTasks: 8
----
-```
-
-## Dispatch reviewer (orchestrator)
-
-After each batch of ~3 tasks (or before merge), dispatch `code-reviewer-sec` subagent — see `sec-review/code-reviewer-sec.md`.
-
-## Rules
-
-- Each task includes ≥1 verify command
-- Reference threat model mitigations for auth, crypto, CI secrets tasks
-- Never embed credentials; reference EnvPack key **names** only
-- NAUS tasks: reference `@naus/validation` and relevant scanner skill
-- If plan exists: ask overwrite vs `-v2` suffix
-- Low-resource mode: cap at 6 tasks
-
-## Handoff copy (PT)
-
-`Plano salvo em .kbs/plans/. Marque cada passo após sec-verify.`
-
----
-
-*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/sec-review/SKILL.md

@@ -1,110 +0,0 @@
----
-name: sec-review
-description: "Review git diffs for OWASP issues, authz bugs, secrets, and supply-chain risks before merge or PR."
-metadata:
-  kubbisec:
-    category: workflow
-    surfaces: [chat, fix]
-    pairsWith: [sec-verify]
----
-
-# sec-review — Security code review (KubbiSec)
-
-**Announce:** `Using sec-review on diff {BASE}..{HEAD}.`
-
-Read-only skill. Do not exfiltrate secrets from diff into `.kbs/` files — redact matches (`***` + line number).
-
-## When to use
-
-- `kbs chat --mode review` or `/skill:sec-review`
-- Before merge / PR after implementation
-- After remediation harness produces non-empty diff (FIX-001)
-- Pairs with `sec-verify` — review alone does not prove merge-safe
-
-## Git commands
-
-```bash
-git diff --stat {BASE}..{HEAD}
-git diff {BASE}..{HEAD}
-git log --oneline {BASE}..{HEAD}   # optional
-```
-
-Default base: `origin/main`. Invalid SHA → ask user or use `HEAD~1`.
-
-## OWASP Top 10:2021 checklist
-
-| ID | Category | Review focus |
-|----|----------|--------------|
-| A01 | Broken Access Control | Guards, IDOR, role checks, BOLA |
-| A02 | Cryptographic Failures | Weak algos, hardcoded keys, TLS |
-| A03 | Injection | SQL/NoSQL/OS/command/template |
-| A04 | Insecure Design | Rate limits, trust boundaries |
-| A05 | Security Misconfiguration | Debug flags, default creds, CORS `*` |
-| A06 | Vulnerable Components | Dep bumps without audit |
-| A07 | Auth Failures | Session fixation, weak MFA, passwords |
-| A08 | Integrity Failures | Unsigned artifacts, unsafe deserialization |
-| A09 | Logging Failures | Sensitive data in logs, missing audit |
-| A10 | SSRF | User-controlled URLs in server fetch |
-
-## KubbiSec-specific checks
-
-| Check | Trigger |
-|-------|---------|
-| Secrets in repo | Regex + gitleaks patterns in diff |
-| EnvPack leakage | `GITHUB_TOKEN`, API keys in tests/fixtures |
-| NAUS pipeline | Unsafe `curl \| bash`, privileged containers |
-| Multi-tenant | `organizationId` scoping on new endpoints |
-
-## Output format
-
-```markdown
-## sec-review — <short title>
-
-**Range:** `<base>..<head>`
-**Spec/plan:** <path or N/A>
-
-### Strengths
-- ...
-
-### OWASP findings
-
-| OWASP | Severity | File:line | Issue | Fix hint |
-|-------|----------|-----------|-------|----------|
-| A03 | Critical | api/foo.ts:42 | ... | ... |
-
-### Other issues
-
-#### Critical (must fix before merge)
-1. ...
-
-#### Important
-1. ...
-
-#### Minor
-1. ...
-
-### Assessment
-**Ready to merge?** Yes / No / With fixes
-**Reasoning:** ...
-```
-
-## Edge cases
-
-- **Empty diff:** Report "no changes"; skip OWASP table except note
-- **Large diff (>500 files):** Prioritize `apps/api`, auth, deps; note scope limit
-- **No git repo:** Review user-pasted patch; warn reduced confidence
-- **Binary diff:** Skip with note
-
-## Subagent template
-
-For orchestrator batch reviews, use `code-reviewer-sec.md` in this directory — same OWASP matrix plus Compliance and Supply chain sections.
-
-## Critical rules
-
-**DO:** Cite file:line; separate severity buckets; acknowledge strengths.
-
-**DON'T:** Approve without reading diff; mark nits Critical; claim tests pass without verify evidence.
-
----
-
-*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/sec-review/code-reviewer-sec.md

@@ -1,176 +0,0 @@
-# KubbiSec Security Code Review Agent
-
-You are reviewing code changes for **production readiness and DevSecOps compliance** on the KubbiSec platform.
-
-**Your task:**
-
-1. Review {WHAT_WAS_IMPLEMENTED}
-2. Compare against {PLAN_OR_REQUIREMENTS}
-3. Run git diff analysis between {BASE_SHA} and {HEAD_SHA}
-4. Apply **Code Quality**, **Security (OWASP)**, **Compliance**, and **Supply chain** checklists
-5. Categorize issues: Critical / Important / Minor
-6. Assess merge readiness — require sec-verify evidence if author claims tests pass
-
-## What Was Implemented
-
-{DESCRIPTION}
-
-## Requirements / Plan / Spec
-
-{PLAN_OR_REQUIREMENTS}
-
-## Finding context (remediation)
-
-{FINDING_CONTEXT}
-
-## Git range
-
-**Base:** {BASE_SHA}  
-**Head:** {HEAD_SHA}
-
-```bash
-git diff --stat {BASE_SHA}..{HEAD_SHA}
-git diff {BASE_SHA}..{HEAD_SHA}
-```
-
----
-
-## Review checklist — Code quality
-
-- Separation of concerns and SRP
-- Error handling and typed exceptions
-- TypeScript types (no unjustified `any`)
-- DRY without premature abstraction
-- Edge cases and null safety
-- Architecture matches plan/spec
-- Tests cover changed behavior
-- Requirements from spec/plan satisfied
-- Production readiness (no debug flags, TODO blockers)
-
----
-
-## Review checklist — Security (OWASP Top 10:2021)
-
-For each category, mark **Pass / Fail / N/A** with file:line refs on Fail:
-
-| ID | Category | Pass/Fail/N/A | Notes |
-|----|----------|---------------|-------|
-| A01 | Broken Access Control | | |
-| A02 | Cryptographic Failures | | |
-| A03 | Injection | | |
-| A04 | Insecure Design | | |
-| A05 | Security Misconfiguration | | |
-| A06 | Vulnerable Components | | |
-| A07 | Auth Failures | | |
-| A08 | Integrity Failures | | |
-| A09 | Logging Failures | | |
-| A10 | SSRF | | |
-
-**KubbiSec-specific:**
-
-- [ ] Multi-tenant `organizationId` / `projectId` scoping on new endpoints
-- [ ] No secrets in code, tests, fixtures, or `.kbs/` artifacts
-- [ ] Platform tools respect RBAC (no privilege escalation via assistant)
-
----
-
-## Review checklist — Compliance
-
-Mark **Pass / Fail / N/A** with rationale (engineering controls only — no legal advice):
-
-| Area | Checks |
-|------|--------|
-| **Data protection** | PII minimization, retention notes, encryption at rest/transit for new fields |
-| **Auditability** | Security-relevant actions logged with actor + tenant ids |
-| **Access control** | Role checks documented; default-deny for new routes |
-| **Regulatory hooks** | If health/finance keywords in spec: flag need for human compliance review |
-| **License** | New deps have compatible licenses; NOTICE updated if required |
-
----
-
-## Review checklist — Supply chain
-
-| Check | Pass/Fail/N/A | Notes |
-|-------|---------------|-------|
-| Dependency changes reviewed (`package.json`, lockfiles) | | |
-| Pinning vs range policy respected | | |
-| CI pipeline changes (`*.yml`, NAUS) — no untrusted scripts | | |
-| Container/base image bumps traced | | |
-| SBOM impact noted if monorepo publishes SBOM | | |
-| Third-party GitHub Actions pinned to SHA | | |
-
----
-
-## Output format
-
-### Strengths
-
-...
-
-### Issues
-
-#### Critical (must fix)
-
-- File:line — issue — why — fix hint
-
-#### Important (should fix)
-
-...
-
-#### Minor (nice to have)
-
-...
-
-### Security summary
-
-| OWASP | Highest severity found |
-|-------|------------------------|
-
-### Compliance summary
-
-...
-
-### Supply chain summary
-
-...
-
-### Recommendations
-
-...
-
-### Assessment
-
-**Ready to merge?** Yes / No / With fixes
-
-**sec-verify required:** List commands author must run if not attached.
-
-**Reasoning:** 1-2 sentences.
-
----
-
-## Critical rules
-
-**DO:** Cite file:line; separate OWASP vs compliance vs supply chain; acknowledge strengths; clear verdict.
-
-**DON'T:** Approve without reading diff; mark nits Critical; claim tests pass without log evidence; provide legal certification.
-
----
-
-## Dispatch protocol
-
-**When to dispatch `code-reviewer-sec`:**
-
-- After each plan task batch (~3 tasks) OR before merge
-- Mandatory after remediation diff (FIX-001)
-- When sec-review findings include any Critical/Important open items
-
-**How:**
-
-1. Resolve BASE_SHA / HEAD_SHA
-2. Spawn subagent with this template
-3. Feed outputs back to implementing agent
-4. Critical → fix immediately; Important → fix before next task
-
----
-
-*Adapted from Superpowers (obra/superpowers) — MIT License. KubbiSec modifications: OWASP Top 10 matrix, Compliance and Supply chain checklists, tenant/secrets rules, sec-verify evidence requirement. Interactive chat equivalent: `/skill:sec-review`.*

package/bundled/skills/sec-using-skills/SKILL.md

@@ -1,81 +0,0 @@
----
-name: sec-using-skills
-description: "Route KubbiSec chat to sec-* workflow skills vs domain skills (naus-pipelines, remediation, scanner-*, aspm-platform). Invoke before choosing a skill path."
-metadata:
-  kubbisec:
-    category: workflow
-    surfaces: [chat]
----
-
-# sec-using-skills — Skill routing (KubbiSec)
-
-Use this skill when the user intent is unclear, when multiple skills could apply, or at the start of a non-trivial session.
-
-**Announce:** `Using sec-using-skills to pick the right workflow.`
-
-## The rule
-
-If a **sec-*** workflow skill might apply, invoke it **before** domain skills or code changes. User explicit `@skill <name>` overrides routing.
-
-## Skill categories
-
-| Category | Examples | Purpose |
-|----------|----------|---------|
-| **workflow** | `sec-clarify`, `sec-brainstorm`, `sec-plan`, `sec-review`, `sec-verify`, `sec-debug` | Specify, plan, review, verify |
-| **domain** | `naus-pipelines`, `remediation`, `aspm-platform`, `github-local` | ASPM, CI, CVE fixes, GitHub |
-| **scanner** | `scanner-semgrep`, `scanner-trivy`, … | Run one scanner per turn |
-
-## Routing matrix
-
-| User intent | Primary skill | Optional secondary | Never combine |
-|-------------|---------------|-------------------|---------------|
-| Vague scope, missing org/project/CVE context | `sec-clarify` | — | `sec-plan` before clarify done |
-| New feature / refactor / policy (chat) | `sec-brainstorm` → `sec-plan` | `naus-pipelines` if CI-only | `remediation` |
-| Implement approved `.kbs/specs/*.md` | `sec-plan` | domain skill for file area | `sec-brainstorm` mid-implementation |
-| Review diff before merge / after fix | `sec-review` | `sec-verify` | `sec-brainstorm` |
-| Claim "done", "tests pass", open PR | `sec-verify` | — | skip verify |
-| Failed remediation / flaky test / regression | `sec-debug` | `remediation` (CVE-scoped) | `sec-plan` |
-| NAUS pipeline YAML | `naus-pipelines` | `sec-review` if auth/secrets touched | — |
-| `naus` CLI (validate/plan/run/register) | `naus-pipelines` | — | invent flags without `naus_pipeline_docs` |
-| `aspm` CLI (scan/upload/doctor) | `aspm-platform` | one `scanner-*` if single tool | invent flags without `aspm_docs` |
-| CVE minimal patch | `remediation` | `sec-verify` on exit | `sec-brainstorm` |
-| ASPM API / findings | `aspm-platform` | — | — |
-| Local GitHub clone/status | `github-local` | — | — |
-| Run Semgrep/Trivy/etc. | one `scanner-*` | — | multiple scanners same turn |
-
-## Invocation surfaces
-
-| Surface | sec-* | Domain |
-|---------|-------|--------|
-| `kbs chat` | Yes (`/skill:sec-*`, `@skill sec-*`) | Yes |
-| `kbs chat --mode plan` | **Required:** clarify → brainstorm → plan | Read-only discovery only |
-| `kbs chat --mode review` | **Prefer** `sec-review` | Read + diff tools |
-| `kbs fix` / remediation harness | `sec-review` + `sec-verify` only | `remediation` implicit |
-| `kbs watch` | `sec-debug` on failure | scanner-* per policy |
-
-## Typical greenfield flow
-
-1. `sec-clarify` — lock org/project/acceptance criteria → `.kbs/context/session-questionnaire.json`
-2. `sec-brainstorm` — threat model + design → `.kbs/specs/YYYY-MM-DD-<slug>.md` (HARD-GATE until `approved`)
-3. `sec-plan` — bite-sized tasks → `.kbs/plans/YYYY-MM-DD-<slug>.md`
-4. Implement with domain skills as needed
-5. `sec-review` on diff, then `sec-verify` with command evidence before PR
-
-## Env / flags
-
-```bash
-KUBBISEC_CHAT_MODE=default|plan|review
-KUBBISEC_FORCE_SKILL=sec-brainstorm   # escape hatch; log warning
-KUBBISEC_SKIP_CLARIFY=1               # skip questionnaire; still log skip
-```
-
-## Anti-patterns
-
-- Loading `sec-brainstorm` + `remediation` in the same turn
-- Running `sec-plan` before spec is `approved`
-- Claiming merge-ready without `sec-review` + `sec-verify`
-- Multiple `scanner-*` skills in one turn
-
----
-
-*Adapted from Superpowers (obra/superpowers) — MIT License.*