@kubbisec/ai-linux-x64 0.1.25 → 0.1.28

package/bundled/skills/sec-brainstorm/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: sec-brainstorm
+description: "Before any implementation: explore context, threat model, design; write .kbs/specs/*.md; HARD-GATE until user approves."
+metadata:
+  kubbisec:
+    category: workflow
+    requires: [session-questionnaire.json]
+    produces: kbs-spec
+---
+
+# sec-brainstorm — Design + threat model (KubbiSec)
+
+**Announce:** `Using sec-brainstorm to explore design and write runtime spec.`
+
+<HARD-GATE>
+Do NOT invoke implementation actions (edit/write/bash that mutates repo), domain skills that change code, or claim work complete until:
+
+1. A runtime spec exists at `.kbs/specs/*.md`, AND
+2. The user has explicitly approved it (`approved` / `aprovado`).
+
+Read-only tools (read, grep, ls) are always allowed.
+</HARD-GATE>
+
+## When to use
+
+- New feature, refactor, or security policy change in chat
+- `/mode:plan` or `@plan` with no approved runtime spec yet
+- After `sec-clarify` (or equivalent structured brief)
+
+## When NOT to use
+
+- CVE remediation in `kbs fix` harness
+- Trivial typo-only changes (user must confirm below HARD-GATE threshold in writing)
+- Mid-implementation — use domain skills instead
+
+## Process
+
+1. **Explore context** — read relevant repo paths, `docs/`, recent git log (read-only)
+2. **Clarifying questions** — one at a time, max 5 after clarify if gaps remain
+3. **Propose 2–3 approaches** — security trade-offs; recommend one
+4. **Present design** — section by section; user confirms or revises
+5. **Threat model** — STRIDE-lite table (min 3 rows for auth/network/deps)
+6. **Write spec** — `.kbs/specs/YYYY-MM-DD-<slug>.md` with `status: draft`
+7. **Self-review** — fix placeholders, contradictions inline
+8. **Request approval** — "Revise o arquivo ou responda `approved` para liberar implementação."
+9. **Handoff** — on approval, invoke **`sec-plan` only** (never direct implementation)
+
+## Runtime spec template
+
+Write `.kbs/specs/YYYY-MM-DD-<slug>.md` with these sections:
+
+- **Metadata** — yaml block: `id`, `status: draft`, `created`, `orgId`, `projectId`
+- **Problem statement**
+- **Threat model (required)** — table: Threat | STRIDE | Mitigation in design | Verification
+- **Design** — recommended approach
+- **Out of scope**
+- **Approval** — checkbox for user `approved` / `aprovado`
+
+Slug rules: `YYYY-MM-DD-<kebab-slug>.md`, max 48 chars, `[a-z0-9-]` only.
+
+## Threat model must address
+
+- Injection, authz, secrets handling, supply chain (deps), logging sensitive data
+- Do not propose storing credentials in repo or `.kbs/`
+
+## Anti-patterns
+
+- Skipping HARD-GATE for "simple" changes without user written confirmation
+- Writing app code before `approved`
+- Conflicts with `docs/kubbisec-ai/specs/` — prefer repo product specs as platform truth; note conflicts in spec
+
+---
+
+*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/sec-clarify/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: sec-clarify
+description: "Chat-only: collect scope via the questionnaire tool before mutations."
+metadata:
+  kubbisec:
+    category: workflow
+    surfaces: [chat]
+    excludes: [fix, watch, run]
+---
+
+# sec-clarify — Session scope (KubbiSec)
+
+**Announce briefly:** `A recolher escopo antes de alterações.`
+
+## Primary mechanism
+
+KubbiSec **auto-asks** the next scope question in the panel above the editor when the gate is active. You may still use the **`questionnaire` tool** to `record` prose scope or `complete` when sufficient.
+
+| Action | When |
+|--------|------|
+| `status` | Check missing fields + scenario hints |
+| `record` | User already gave scope in prose — persist fields |
+| `complete` | Scope is sufficient — unblock mutations |
+| `ask` | Rare — auto-ask already queues questions; use only for custom copy |
+
+## Panel UX
+
+- Up to **3 options (A–C)** plus **D) Outro**; user can also type free text below.
+- **Space** toggles selection (multi when relevant, e.g. severity).
+- **Enter** confirms a panel selection; typed text submits as custom answer.
+- **Never** repeat option lists in chat or say "painel acima" unless the panel is actually showing.
+
+## When to use
+
+- Execute/remediation intent without enough scope
+- Before destructive tools or `@plan` when decisions are unclear
+
+## When NOT to use
+
+- Questionnaire already **ready**
+- Factual/docs questions
+- `KUBBISEC_SKIP_CLARIFY=1`
+- Headless `kbs fix` / `watch`
+
+## Common scope fields
+
+- `projectIds`, `severityMin`, `remediationMode` (remediation)
+- `customNotes`, `nausConstraints` (plan/pipeline context)
+- Any extra key → stored in `extras`
+
+## Handoff
+
+When status is **ready**, proceed with remediation, `sec-plan`, or the user request.

package/bundled/skills/sec-debug/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: sec-debug
+description: "Systematic root-cause analysis for test failures, harness errors, and failed remediations before proposing fixes."
+metadata:
+  kubbisec:
+    category: workflow
+    surfaces: [chat, fix, watch]
+    follows: [sec-verify]
+---
+
+# sec-debug — Systematic debugging (KubbiSec)
+
+**Announce:** `Using sec-debug — Phase 1 investigation.`
+
+## Iron Law
+
+**NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST.**
+
+Even under time pressure, complete Phase 1 summary before any edit.
+
+## When to use
+
+- `sec-verify` reported failures
+- Remediation harness empty diff or retry loop
+- `kbs watch` tick failure
+- Flaky or intermittent CI vs local delta
+
+Pairs with `remediation` after root cause is proven for CVE-scoped work.
+
+## Four phases
+
+| Phase | Name | Activities | Exit criteria |
+|-------|------|------------|---------------|
+| 1 | Root cause investigation | Read errors, reproduce, git diff, recent changes | Written hypothesis with evidence |
+| 2 | Pattern analysis | Compare similar code, search repo, check deps | Hypothesis confirmed or ruled out |
+| 3 | Hypothesis test | Minimal experiment, logging, single-variable change | Root cause proven |
+| 4 | Fix implementation | Minimal fix + `sec-verify` | Verify evidence attached |
+
+Show phase headers to user: `Fase 1/4 — Investigação`.
+
+## Multi-component boundaries (KubbiSec)
+
+| Boundary | Diagnostic action |
+|----------|-------------------|
+| CLI → API | Log HTTP status + request id |
+| API → Prisma | Log query error code |
+| Harness → git | Log diff stat + exit code |
+| Scanner → finding | Log rule id + file path |
+
+## Debug log artifact (optional)
+
+Write `.kbs/context/debug-YYYY-MM-DD-<slug>.md`:
+
+```markdown
+## Symptom
+...
+
+## Reproduction steps
+1. ...
+
+## Evidence
+- command: ...
+- output: ...
+
+## Root cause
+...
+
+## Fix (minimal)
+...
+```
+
+No secrets from `.env` or tokens in reproduction commands. Use test accounts for auth bugs.
+
+## Empty remediation diff playbook
+
+Phase 1: read harness JSON, model tool calls, task XML.
+
+Root cause categories: tool-weak model, wrong branch, permission, prompt drift.
+
+Handoff to `remediation` or config change — not blind retry.
+
+## Escalation
+
+- **3rd failed fix:** Stop auto-retry; escalate human with debug log summary
+- **Cannot reproduce:** Do not fix; list data needed from user
+- **Multiple root causes:** Split debug sessions per cause
+
+## Copy (PT)
+
+`Investigando causa raiz antes de novo patch.`
+
+---
+
+*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/sec-plan/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: sec-plan
+description: "After approved .kbs/specs: produce bite-sized implementation plan at .kbs/plans/ with verification steps."
+metadata:
+  kubbisec:
+    category: workflow
+    requires: [kbs-spec-approved]
+    produces: kbs-plan
+---
+
+# sec-plan — Implementation plan (KubbiSec)
+
+**Announce:** `Using sec-plan to decompose work from <spec-path>.`
+
+## When to use
+
+- `.kbs/specs/*.md` has `status: approved`
+- Handoff from `sec-brainstorm` after user approval
+- User invokes `/skill:sec-plan` or `@plan` with approved spec
+
+## When NOT to use
+
+- Spec still `draft` — refuse; link to sec-brainstorm approval step
+- Headless remediation unless task metadata sets `requirePlan=true`
+- Emergency plan without spec — only with `deferred-spec: true` header + explicit user sign-off (discouraged)
+
+## Process
+
+1. Read approved spec + questionnaire + affected package layout
+2. Draft **file map** (which packages touched; `packages/shared` first if types change)
+3. Write `.kbs/plans/YYYY-MM-DD-<slug>.md` paired with spec (same date + slug)
+4. Present plan summary; user may edit plan file
+5. Implementation begins; mark checkboxes as tasks complete
+6. After each task or batch: run **`sec-verify`** before claiming done
+
+## Plan header (required)
+
+```markdown
+# <Feature> — Implementation Plan
+
+> **Spec:** `.kbs/specs/YYYY-MM-DD-<slug>.md` (approved)
+> **For KubbiSec agents:** Execute tasks in order; run `sec-verify` before marking task done.
+
+**Goal:** <one sentence>
+
+**Architecture:** <2-3 sentences>
+
+**Tech stack:** <e.g. NestJS, Prisma, Vitest, React, NAUS>
+
+**Security notes:** <top mitigations from threat model>
+
+---
+```
+
+## Task entry schema
+
+```markdown
+### Task N: <name>
+
+**Files:**
+- Create: `path/to/file`
+- Modify: `path/to/existing.ts:10-40`
+- Test: `path/to/file.test.ts`
+
+- [ ] **Step 1:** <action>
+  - Verify: `pnpm --filter <pkg> test path -v`
+  - Expected: PASS
+
+- [ ] **Step 2:** ...
+```
+
+Optional frontmatter:
+
+```yaml
+---
+kbsPlan:
+  specRef: .kbs/specs/2026-05-29-mfa-login.md
+  estimatedTasks: 8
+---
+```
+
+## Dispatch reviewer (orchestrator)
+
+After each batch of ~3 tasks (or before merge), dispatch `code-reviewer-sec` subagent — see `sec-review/code-reviewer-sec.md`.
+
+## Rules
+
+- Each task includes ≥1 verify command
+- Reference threat model mitigations for auth, crypto, CI secrets tasks
+- Never embed credentials; reference EnvPack key **names** only
+- NAUS tasks: reference `@kubbisec/naus-validation` and relevant scanner skill
+- If plan exists: ask overwrite vs `-v2` suffix
+- Low-resource mode: cap at 6 tasks
+
+## Handoff copy (PT)
+
+`Plano salvo em .kbs/plans/. Marque cada passo após sec-verify.`
+
+---
+
+*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/sec-review/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: sec-review
+description: "Review git diffs for OWASP issues, authz bugs, secrets, and supply-chain risks before merge or PR."
+metadata:
+  kubbisec:
+    category: workflow
+    surfaces: [chat, fix]
+    pairsWith: [sec-verify]
+---
+
+# sec-review — Security code review (KubbiSec)
+
+**Announce:** `Using sec-review on diff {BASE}..{HEAD}.`
+
+Read-only skill. Do not exfiltrate secrets from diff into `.kbs/` files — redact matches (`***` + line number).
+
+## When to use
+
+- `kbs chat --mode review` or `/skill:sec-review`
+- Before merge / PR after implementation
+- After remediation harness produces non-empty diff (FIX-001)
+- Pairs with `sec-verify` — review alone does not prove merge-safe
+
+## Git commands
+
+```bash
+git diff --stat {BASE}..{HEAD}
+git diff {BASE}..{HEAD}
+git log --oneline {BASE}..{HEAD}   # optional
+```
+
+Default base: `origin/main`. Invalid SHA → ask user or use `HEAD~1`.
+
+## OWASP Top 10:2021 checklist
+
+| ID | Category | Review focus |
+|----|----------|--------------|
+| A01 | Broken Access Control | Guards, IDOR, role checks, BOLA |
+| A02 | Cryptographic Failures | Weak algos, hardcoded keys, TLS |
+| A03 | Injection | SQL/NoSQL/OS/command/template |
+| A04 | Insecure Design | Rate limits, trust boundaries |
+| A05 | Security Misconfiguration | Debug flags, default creds, CORS `*` |
+| A06 | Vulnerable Components | Dep bumps without audit |
+| A07 | Auth Failures | Session fixation, weak MFA, passwords |
+| A08 | Integrity Failures | Unsigned artifacts, unsafe deserialization |
+| A09 | Logging Failures | Sensitive data in logs, missing audit |
+| A10 | SSRF | User-controlled URLs in server fetch |
+
+## KubbiSec-specific checks
+
+| Check | Trigger |
+|-------|---------|
+| Secrets in repo | Regex + gitleaks patterns in diff |
+| EnvPack leakage | `GITHUB_TOKEN`, API keys in tests/fixtures |
+| NAUS pipeline | Unsafe `curl \| bash`, privileged containers |
+| Multi-tenant | `organizationId` scoping on new endpoints |
+
+## Output format
+
+```markdown
+## sec-review — <short title>
+
+**Range:** `<base>..<head>`
+**Spec/plan:** <path or N/A>
+
+### Strengths
+- ...
+
+### OWASP findings
+
+| OWASP | Severity | File:line | Issue | Fix hint |
+|-------|----------|-----------|-------|----------|
+| A03 | Critical | api/foo.ts:42 | ... | ... |
+
+### Other issues
+
+#### Critical (must fix before merge)
+1. ...
+
+#### Important
+1. ...
+
+#### Minor
+1. ...
+
+### Assessment
+**Ready to merge?** Yes / No / With fixes
+**Reasoning:** ...
+```
+
+## Edge cases
+
+- **Empty diff:** Report "no changes"; skip OWASP table except note
+- **Large diff (>500 files):** Prioritize `apps/api`, auth, deps; note scope limit
+- **No git repo:** Review user-pasted patch; warn reduced confidence
+- **Binary diff:** Skip with note
+
+## Subagent template
+
+For orchestrator batch reviews, use `code-reviewer-sec.md` in this directory — same OWASP matrix plus Compliance and Supply chain sections.
+
+## Critical rules
+
+**DO:** Cite file:line; separate severity buckets; acknowledge strengths.
+
+**DON'T:** Approve without reading diff; mark nits Critical; claim tests pass without verify evidence.
+
+---
+
+*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/sec-review/code-reviewer-sec.md

@@ -0,0 +1,176 @@
+# KubbiSec Security Code Review Agent
+
+You are reviewing code changes for **production readiness and DevSecOps compliance** on the KubbiSec platform.
+
+**Your task:**
+
+1. Review {WHAT_WAS_IMPLEMENTED}
+2. Compare against {PLAN_OR_REQUIREMENTS}
+3. Run git diff analysis between {BASE_SHA} and {HEAD_SHA}
+4. Apply **Code Quality**, **Security (OWASP)**, **Compliance**, and **Supply chain** checklists
+5. Categorize issues: Critical / Important / Minor
+6. Assess merge readiness — require sec-verify evidence if author claims tests pass
+
+## What Was Implemented
+
+{DESCRIPTION}
+
+## Requirements / Plan / Spec
+
+{PLAN_OR_REQUIREMENTS}
+
+## Finding context (remediation)
+
+{FINDING_CONTEXT}
+
+## Git range
+
+**Base:** {BASE_SHA}  
+**Head:** {HEAD_SHA}
+
+```bash
+git diff --stat {BASE_SHA}..{HEAD_SHA}
+git diff {BASE_SHA}..{HEAD_SHA}
+```
+
+---
+
+## Review checklist — Code quality
+
+- Separation of concerns and SRP
+- Error handling and typed exceptions
+- TypeScript types (no unjustified `any`)
+- DRY without premature abstraction
+- Edge cases and null safety
+- Architecture matches plan/spec
+- Tests cover changed behavior
+- Requirements from spec/plan satisfied
+- Production readiness (no debug flags, TODO blockers)
+
+---
+
+## Review checklist — Security (OWASP Top 10:2021)
+
+For each category, mark **Pass / Fail / N/A** with file:line refs on Fail:
+
+| ID | Category | Pass/Fail/N/A | Notes |
+|----|----------|---------------|-------|
+| A01 | Broken Access Control | | |
+| A02 | Cryptographic Failures | | |
+| A03 | Injection | | |
+| A04 | Insecure Design | | |
+| A05 | Security Misconfiguration | | |
+| A06 | Vulnerable Components | | |
+| A07 | Auth Failures | | |
+| A08 | Integrity Failures | | |
+| A09 | Logging Failures | | |
+| A10 | SSRF | | |
+
+**KubbiSec-specific:**
+
+- [ ] Multi-tenant `organizationId` / `projectId` scoping on new endpoints
+- [ ] No secrets in code, tests, fixtures, or `.kbs/` artifacts
+- [ ] Platform tools respect RBAC (no privilege escalation via assistant)
+
+---
+
+## Review checklist — Compliance
+
+Mark **Pass / Fail / N/A** with rationale (engineering controls only — no legal advice):
+
+| Area | Checks |
+|------|--------|
+| **Data protection** | PII minimization, retention notes, encryption at rest/transit for new fields |
+| **Auditability** | Security-relevant actions logged with actor + tenant ids |
+| **Access control** | Role checks documented; default-deny for new routes |
+| **Regulatory hooks** | If health/finance keywords in spec: flag need for human compliance review |
+| **License** | New deps have compatible licenses; NOTICE updated if required |
+
+---
+
+## Review checklist — Supply chain
+
+| Check | Pass/Fail/N/A | Notes |
+|-------|---------------|-------|
+| Dependency changes reviewed (`package.json`, lockfiles) | | |
+| Pinning vs range policy respected | | |
+| CI pipeline changes (`*.yml`, NAUS) — no untrusted scripts | | |
+| Container/base image bumps traced | | |
+| SBOM impact noted if monorepo publishes SBOM | | |
+| Third-party GitHub Actions pinned to SHA | | |
+
+---
+
+## Output format
+
+### Strengths
+
+...
+
+### Issues
+
+#### Critical (must fix)
+
+- File:line — issue — why — fix hint
+
+#### Important (should fix)
+
+...
+
+#### Minor (nice to have)
+
+...
+
+### Security summary
+
+| OWASP | Highest severity found |
+|-------|------------------------|
+
+### Compliance summary
+
+...
+
+### Supply chain summary
+
+...
+
+### Recommendations
+
+...
+
+### Assessment
+
+**Ready to merge?** Yes / No / With fixes
+
+**sec-verify required:** List commands author must run if not attached.
+
+**Reasoning:** 1-2 sentences.
+
+---
+
+## Critical rules
+
+**DO:** Cite file:line; separate OWASP vs compliance vs supply chain; acknowledge strengths; clear verdict.
+
+**DON'T:** Approve without reading diff; mark nits Critical; claim tests pass without log evidence; provide legal certification.
+
+---
+
+## Dispatch protocol
+
+**When to dispatch `code-reviewer-sec`:**
+
+- After each plan task batch (~3 tasks) OR before merge
+- Mandatory after remediation diff (FIX-001)
+- When sec-review findings include any Critical/Important open items
+
+**How:**
+
+1. Resolve BASE_SHA / HEAD_SHA
+2. Spawn subagent with this template
+3. Feed outputs back to implementing agent
+4. Critical → fix immediately; Important → fix before next task
+
+---
+
+*Adapted from Superpowers (obra/superpowers) — MIT License. KubbiSec modifications: OWASP Top 10 matrix, Compliance and Supply chain checklists, tenant/secrets rules, sec-verify evidence requirement. Interactive chat equivalent: `/skill:sec-review`.*

package/bundled/skills/sec-using-skills/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: sec-using-skills
+description: "Route KubbiSec chat to sec-* workflow skills vs domain skills (naus-pipelines, remediation, scanner-*, aspm-platform). Invoke before choosing a skill path."
+metadata:
+  kubbisec:
+    category: workflow
+    surfaces: [chat]
+---
+
+# sec-using-skills — Skill routing (KubbiSec)
+
+Use this skill when the user intent is unclear, when multiple skills could apply, or at the start of a non-trivial session.
+
+**Announce:** `Using sec-using-skills to pick the right workflow.`
+
+## The rule
+
+If a **sec-*** workflow skill might apply, invoke it **before** domain skills or code changes. User explicit `@skill <name>` overrides routing.
+
+## Skill categories
+
+| Category | Examples | Purpose |
+|----------|----------|---------|
+| **workflow** | `sec-clarify`, `sec-brainstorm`, `sec-plan`, `sec-review`, `sec-verify`, `sec-debug` | Specify, plan, review, verify |
+| **domain** | `naus-pipelines`, `remediation`, `aspm-platform`, `github-local` | ASPM, CI, CVE fixes, GitHub |
+| **scanner** | `scanner-semgrep`, `scanner-trivy`, … | Run one scanner per turn |
+
+## Routing matrix
+
+| User intent | Primary skill | Optional secondary | Never combine |
+|-------------|---------------|-------------------|---------------|
+| Vague scope, missing org/project/CVE context | `sec-clarify` | — | `sec-plan` before clarify done |
+| New feature / refactor / policy (chat) | `sec-brainstorm` → `sec-plan` | `naus-pipelines` if CI-only | `remediation` |
+| Implement approved `.kbs/specs/*.md` | `sec-plan` | domain skill for file area | `sec-brainstorm` mid-implementation |
+| Review diff before merge / after fix | `sec-review` | `sec-verify` | `sec-brainstorm` |
+| Claim "done", "tests pass", open PR | `sec-verify` | — | skip verify |
+| Failed remediation / flaky test / regression | `sec-debug` | `remediation` (CVE-scoped) | `sec-plan` |
+| NAUS pipeline YAML | `naus-pipelines` | `sec-review` if auth/secrets touched | — |
+| `naus` CLI (validate/plan/run/register) | `naus-pipelines` | — | invent flags without `naus_pipeline_docs` |
+| `aspm` CLI (scan/upload/doctor) | `aspm-platform` | one `scanner-*` if single tool | invent flags without `aspm_docs` |
+| CVE minimal patch | `remediation` | `sec-verify` on exit | `sec-brainstorm` |
+| ASPM API / findings | `aspm-platform` | — | — |
+| Local GitHub clone/status | `github-local` | — | — |
+| Run Semgrep/Trivy/etc. | one `scanner-*` | — | multiple scanners same turn |
+
+## Invocation surfaces
+
+| Surface | sec-* | Domain |
+|---------|-------|--------|
+| `kbs chat` | Yes (`/skill:sec-*`, `@skill sec-*`) | Yes |
+| `kbs chat --mode plan` | **Required:** clarify → brainstorm → plan | Read-only discovery only |
+| `kbs chat --mode review` | **Prefer** `sec-review` | Read + diff tools |
+| `kbs fix` / remediation harness | `sec-review` + `sec-verify` only | `remediation` implicit |
+| `kbs watch` | `sec-debug` on failure | scanner-* per policy |
+
+## Typical greenfield flow
+
+1. `sec-clarify` — lock org/project/acceptance criteria → `.kbs/context/session-questionnaire.json`
+2. `sec-brainstorm` — threat model + design → `.kbs/specs/YYYY-MM-DD-<slug>.md` (HARD-GATE until `approved`)
+3. `sec-plan` — bite-sized tasks → `.kbs/plans/YYYY-MM-DD-<slug>.md`
+4. Implement with domain skills as needed
+5. `sec-review` on diff, then `sec-verify` with command evidence before PR
+
+## Env / flags
+
+```bash
+KUBBISEC_CHAT_MODE=default|plan|review
+KUBBISEC_FORCE_SKILL=sec-brainstorm   # escape hatch; log warning
+KUBBISEC_SKIP_CLARIFY=1               # skip questionnaire; still log skip
+```
+
+## Anti-patterns
+
+- Loading `sec-brainstorm` + `remediation` in the same turn
+- Running `sec-plan` before spec is `approved`
+- Claiming merge-ready without `sec-review` + `sec-verify`
+- Multiple `scanner-*` skills in one turn
+
+---
+
+*Adapted from Superpowers (obra/superpowers) — MIT License.*