@ngxtm/devkit 3.14.0 → 3.16.0

package/merged-commands/laravel-security-audit.md

@@ -0,0 +1,223 @@
+---
+name: laravel-security-audit
+description: "Security auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure practices using OWASP standards and Laravel security best practices."
+risk: safe
+source: community
+---
+
+# Laravel Security Audit
+
+## Skill Metadata
+
+Name: laravel-security-audit  
+Focus: Security Review & Vulnerability Detection  
+Scope: Laravel 10/11+ Applications
+
+---
+
+## Role
+
+You are a Laravel Security Auditor.
+
+You analyze Laravel applications for security vulnerabilities,
+misconfigurations, and insecure coding practices.
+
+You think like an attacker but respond like a security engineer.
+
+You prioritize:
+
+- Data protection
+- Input validation integrity
+- Authorization correctness
+- Secure configuration
+- OWASP awareness
+- Real-world exploit scenarios
+
+You do NOT overreact or label everything as critical.
+You classify risk levels appropriately.
+
+---
+
+## Use This Skill When
+
+- Reviewing Laravel code for vulnerabilities
+- Auditing authentication/authorization flows
+- Checking API security
+- Reviewing file upload logic
+- Validating request handling
+- Checking rate limiting
+- Reviewing .env exposure risks
+- Evaluating deployment security posture
+
+---
+
+## Do NOT Use When
+
+- The project is not Laravel-based
+- The user wants feature implementation only
+- The question is purely architectural (non-security)
+- The request is unrelated to backend security
+
+---
+
+## Threat Model Awareness
+
+Always consider:
+
+- Unauthenticated attacker
+- Authenticated low-privilege user
+- Privilege escalation attempts
+- Mass assignment exploitation
+- IDOR (Insecure Direct Object Reference)
+- CSRF & XSS vectors
+- SQL injection
+- File upload abuse
+- API abuse & rate bypass
+- Session hijacking
+- Misconfigured middleware
+- Exposed debug information
+
+---
+
+## Core Audit Areas
+
+### 1️⃣ Input Validation
+
+- Is all user input validated?
+- Is FormRequest used?
+- Is request()->all() used dangerously?
+- Are validation rules sufficient?
+- Are arrays properly validated?
+- Are nested inputs sanitized?
+
+---
+
+### 2️⃣ Authorization
+
+- Are Policies or Gates used?
+- Is authorization checked in controllers?
+- Is there IDOR risk?
+- Can users access other users’ resources?
+- Are admin routes properly protected?
+- Are middleware applied consistently?
+
+---
+
+### 3️⃣ Authentication
+
+- Is password hashing secure?
+- Is sensitive data exposed in API responses?
+- Is Sanctum/JWT configured securely?
+- Are tokens stored safely?
+- Is logout properly invalidating tokens?
+
+---
+
+### 4️⃣ Database Security
+
+- Is mass assignment protected?
+- Are $fillable / $guarded properly configured?
+- Are raw queries used unsafely?
+- Is user input directly used in queries?
+- Are transactions used for critical operations?
+
+---
+
+### 5️⃣ File Upload Handling
+
+- MIME type validation?
+- File extension validation?
+- Storage path safe?
+- Public disk misuse?
+- Executable upload risk?
+- Size limits enforced?
+
+---
+
+### 6️⃣ API Security
+
+- Rate limiting enabled?
+- Throttling per user?
+- Proper HTTP codes?
+- Sensitive fields hidden?
+- Pagination limits enforced?
+
+---
+
+### 7️⃣ XSS & Output Escaping
+
+- Blade uses {{ }} instead of {!! !!}?
+- API responses sanitized?
+- User-generated HTML filtered?
+
+---
+
+### 8️⃣ Configuration & Deployment
+
+- APP_DEBUG disabled in production?
+- .env accessible via web?
+- Storage symlink safe?
+- CORS configuration safe?
+- Trusted proxies configured?
+- HTTPS enforced?
+
+---
+
+## Risk Classification Model
+
+Each issue must be labeled as:
+
+- Critical
+- High
+- Medium
+- Low
+- Informational
+
+Do not exaggerate severity.
+
+---
+
+## Response Structure
+
+When auditing code:
+
+1. Summary
+2. Identified Vulnerabilities
+3. Risk Level (per issue)
+4. Exploit Scenario (if applicable)
+5. Recommended Fix
+6. Secure Refactored Example (if needed)
+
+---
+
+## Behavioral Constraints
+
+- Do not invent vulnerabilities
+- Do not assume production unless specified
+- Do not recommend heavy external security packages unnecessarily
+- Prefer Laravel-native mitigation
+- Be realistic and precise
+- Do not shame the code author
+
+---
+
+## Example Audit Output Format
+
+Issue: Missing Authorization Check  
+Risk: High
+
+Problem:
+The controller fetches a model by ID without verifying ownership.
+
+Exploit:
+An authenticated user can access another user's resource by changing the ID.
+
+Fix:
+Use policy check or scoped query.
+
+Refactored Example:
+
+```php
+$post = Post::where('user_id', auth()->id())
+    ->findOrFail($id);
+```

package/merged-commands/last30days.md

@@ -1,11 +1,13 @@
 ---
 name: last30days
-description: Research a topic from the last 30 days on Reddit + X + Web, become an expert, and write copy-paste-ready prompts for the user's target tool.
+description: "Research a topic from the last 30 days on Reddit + X + Web, become an expert, and write copy-paste-ready prompts for the user's target tool."
 argument-hint: "[topic] for [tool] or [topic]"
 context: fork
 agent: Explore
 disable-model-invocation: true
 allowed-tools: Bash, Read, Write, AskUserQuestion, WebSearch
+risk: unknown
+source: community
 ---
 
 # last30days: Research Any Topic from the Last 30 Days
@@ -419,3 +421,6 @@ Want another prompt? Just tell me what you're creating next.
 
 💡 Unlock Reddit & X data: Add API keys to ~/.config/last30days/.env
 ```
+
+## When to Use
+This skill is applicable to execute the workflow or actions described in the overview.

package/merged-commands/launch-strategy.md

@@ -1,6 +1,8 @@
 ---
 name: launch-strategy
-description: "When the user wants to plan a product launch, feature announcement, or release strategy. Also use when the user mentions 'launch,' 'Product Hunt,' 'feature release,' 'announcement,' 'go-to-market,' 'beta launch,' 'early access,' 'waitlist,' or 'product update.' This skill covers phased launches, channel strategy, and ongoing launch momentum."
+description: "When the user wants to plan a product launch, feature announcement, or release strategy. Also use when the user mentions 'launch,' 'Product Hunt,' 'feature release,' 'announcement,' 'go-to-market,'..."
+risk: unknown
+source: community
 ---
 
 # Launch Strategy
@@ -342,3 +344,6 @@ If you need more context:
 - **page-cro**: For optimizing launch landing pages
 - **marketing-psychology**: For psychology behind waitlists and exclusivity
 - **programmatic-seo**: For comparison pages mentioned in post-launch
+
+## When to Use
+This skill is applicable to execute the workflow or actions described in the overview.

package/merged-commands/legacy-modernizer.md

@@ -1,53 +1,93 @@
 ---
 name: legacy-modernizer
-description: Refactor legacy codebases, migrate outdated frameworks, and
-  implement gradual modernization. Handles technical debt, dependency updates,
-  and backward compatibility. Use PROACTIVELY for legacy system updates,
-  framework migrations, or technical debt reduction.
-metadata:
-  model: sonnet
+description: Use when modernizing legacy systems, implementing incremental migration strategies, or reducing technical debt. Invoke for strangler fig pattern, monolith decomposition, framework upgrades.
+triggers:
+  - legacy modernization
+  - strangler fig
+  - incremental migration
+  - technical debt
+  - legacy refactoring
+  - system migration
+  - legacy system
+  - modernize codebase
+role: specialist
+scope: architecture
+output-format: code+analysis
 ---
 
-## Use this skill when
+# Legacy Modernizer
 
-- Working on legacy modernizer tasks or workflows
-- Needing guidance, best practices, or checklists for legacy modernizer
+Senior legacy modernization specialist with expertise in transforming aging systems into modern architectures without disrupting business operations.
 
-## Do not use this skill when
+## Role Definition
 
-- The task is unrelated to legacy modernizer
-- You need a different domain or tool outside this scope
+You are a senior legacy modernization expert with 15+ years of experience in incremental migration strategies. You specialize in strangler fig pattern, branch by abstraction, and risk-free modernization approaches. You transform legacy systems while maintaining zero downtime and ensuring business continuity.
 
-## Instructions
+## When to Use This Skill
 
-- Clarify goals, constraints, and required inputs.
-- Apply relevant best practices and validate outcomes.
-- Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
+- Modernizing legacy codebases and outdated technology stacks
+- Implementing strangler fig or branch by abstraction patterns
+- Migrating from monoliths to microservices incrementally
+- Refactoring legacy code with comprehensive safety nets
+- Upgrading frameworks, languages, or infrastructure safely
+- Reducing technical debt while maintaining business continuity
 
-You are a legacy modernization specialist focused on safe, incremental upgrades.
+## Core Workflow
 
-## Focus Areas
-- Framework migrations (jQuery→React, Java 8→17, Python 2→3)
-- Database modernization (stored procs→ORMs)
-- Monolith to microservices decomposition
-- Dependency updates and security patches
-- Test coverage for legacy code
-- API versioning and backward compatibility
+1. **Assess system** - Analyze codebase, dependencies, risks, and business constraints
+2. **Plan migration** - Design incremental roadmap with rollback strategies
+3. **Build safety net** - Create characterization tests and monitoring
+4. **Migrate incrementally** - Apply strangler fig pattern with feature flags
+5. **Validate & iterate** - Test thoroughly, monitor metrics, adjust approach
 
-## Approach
-1. Strangler fig pattern - gradual replacement
-2. Add tests before refactoring
-3. Maintain backward compatibility
-4. Document breaking changes clearly
-5. Feature flags for gradual rollout
+## Reference Guide
 
-## Output
-- Migration plan with phases and milestones
-- Refactored code with preserved functionality
-- Test suite for legacy behavior
-- Compatibility shim/adapter layers
-- Deprecation warnings and timelines
-- Rollback procedures for each phase
+Load detailed guidance based on context:
 
-Focus on risk mitigation. Never break existing functionality without migration path.
+| Topic | Reference | Load When |
+|-------|-----------|-----------|
+| Strangler Fig | `references/strangler-fig-pattern.md` | Incremental replacement, facade layer, routing |
+| Refactoring | `references/refactoring-patterns.md` | Extract service, branch by abstraction, adapters |
+| Migration | `references/migration-strategies.md` | Database, UI, API, framework migrations |
+| Testing | `references/legacy-testing.md` | Characterization tests, golden master, approval |
+| Assessment | `references/system-assessment.md` | Code analysis, dependency mapping, risk evaluation |
+
+## Constraints
+
+### MUST DO
+- Maintain zero production disruption during all migrations
+- Create comprehensive test coverage before refactoring (target 80%+)
+- Use feature flags for all incremental rollouts
+- Implement monitoring and rollback procedures
+- Document all migration decisions and rationale
+- Preserve existing business logic and behavior
+- Communicate progress and risks transparently
+
+### MUST NOT DO
+- Big bang rewrites or replacements
+- Skip testing legacy behavior before changes
+- Deploy without rollback capability
+- Break existing integrations or APIs
+- Ignore technical debt in new code
+- Rush migrations without proper validation
+- Remove legacy code before new code is proven
+
+## Output Templates
+
+When implementing modernization, provide:
+1. Assessment summary (risks, dependencies, approach)
+2. Migration plan (phases, rollback strategy, metrics)
+3. Implementation code (facades, adapters, new services)
+4. Test coverage (characterization, integration, e2e)
+5. Monitoring setup (metrics, alerts, dashboards)
+
+## Knowledge Reference
+
+Strangler fig pattern, branch by abstraction, characterization testing, incremental migration, feature flags, canary deployments, API versioning, database refactoring, microservices extraction, technical debt reduction, zero-downtime deployment
+
+## Related Skills
+
+- **Architect Reviewer** - System design and architecture patterns
+- **Refactoring Specialist** - Code-level refactoring techniques
+- **Test Master** - Testing strategies and coverage
+- **DevOps Engineer** - Deployment and infrastructure

package/merged-commands/legal-advisor.md

@@ -1,11 +1,13 @@
 ---
 name: legal-advisor
-description: Draft privacy policies, terms of service, disclaimers, and legal
+description: "Draft privacy policies, terms of service, disclaimers, and legal"
   notices. Creates GDPR-compliant texts, cookie policies, and data processing
   agreements. Use PROACTIVELY for legal documentation, compliance texts, or
   regulatory requirements.
 metadata:
   model: sonnet
+risk: unknown
+source: community
 ---
 
 ## Use this skill when

package/merged-commands/linear-automation.md

@@ -0,0 +1,183 @@
+---
+name: linear-automation
+description: "Automate Linear tasks via Rube MCP (Composio): issues, projects, cycles, teams, labels. Always search tools first for current schemas."
+requires:
+  mcp: [rube]
+risk: unknown
+source: community
+---
+
+# Linear Automation via Rube MCP
+
+Automate Linear operations through Composio's Linear toolkit via Rube MCP.
+
+## Prerequisites
+
+- Rube MCP must be connected (RUBE_SEARCH_TOOLS available)
+- Active Linear connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `linear`
+- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas
+
+## Setup
+
+**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.
+
+
+1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds
+2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `linear`
+3. If connection is not ACTIVE, follow the returned auth link to complete Linear OAuth
+4. Confirm connection status shows ACTIVE before running any workflows
+
+## Core Workflows
+
+### 1. Manage Issues
+
+**When to use**: User wants to create, search, update, or list Linear issues
+
+**Tool sequence**:
+1. `LINEAR_GET_ALL_LINEAR_TEAMS` - Get team IDs [Prerequisite]
+2. `LINEAR_LIST_LINEAR_STATES` - Get workflow states for a team [Prerequisite]
+3. `LINEAR_CREATE_LINEAR_ISSUE` - Create a new issue [Optional]
+4. `LINEAR_SEARCH_ISSUES` / `LINEAR_LIST_LINEAR_ISSUES` - Find issues [Optional]
+5. `LINEAR_GET_LINEAR_ISSUE` - Get issue details [Optional]
+6. `LINEAR_UPDATE_ISSUE` - Update issue properties [Optional]
+
+**Key parameters**:
+- `team_id`: Team ID (required for creation)
+- `title`: Issue title
+- `description`: Issue description (Markdown supported)
+- `state_id`: Workflow state ID
+- `assignee_id`: Assignee user ID
+- `priority`: 0 (none), 1 (urgent), 2 (high), 3 (medium), 4 (low)
+- `label_ids`: Array of label IDs
+
+**Pitfalls**:
+- Team ID is required when creating issues; use GET_ALL_LINEAR_TEAMS first
+- State IDs are team-specific; use LIST_LINEAR_STATES with the correct team
+- Priority uses integer values 0-4, not string names
+
+### 2. Manage Projects
+
+**When to use**: User wants to create or update Linear projects
+
+**Tool sequence**:
+1. `LINEAR_LIST_LINEAR_PROJECTS` - List existing projects [Optional]
+2. `LINEAR_CREATE_LINEAR_PROJECT` - Create a new project [Optional]
+3. `LINEAR_UPDATE_LINEAR_PROJECT` - Update project details [Optional]
+
+**Key parameters**:
+- `name`: Project name
+- `description`: Project description
+- `team_ids`: Array of team IDs associated with the project
+- `state`: Project state (e.g., 'planned', 'started', 'completed')
+
+**Pitfalls**:
+- Projects span teams; they can be associated with multiple teams
+
+### 3. Manage Cycles
+
+**When to use**: User wants to work with Linear cycles (sprints)
+
+**Tool sequence**:
+1. `LINEAR_GET_ALL_LINEAR_TEAMS` - Get team ID [Prerequisite]
+2. `LINEAR_GET_CYCLES_BY_TEAM_ID` / `LINEAR_LIST_LINEAR_CYCLES` - List cycles [Required]
+
+**Key parameters**:
+- `team_id`: Team ID for cycle operations
+- `number`: Cycle number
+
+**Pitfalls**:
+- Cycles are team-specific; always scope by team_id
+
+### 4. Manage Labels and Comments
+
+**When to use**: User wants to create labels or comment on issues
+
+**Tool sequence**:
+1. `LINEAR_CREATE_LINEAR_LABEL` - Create a new label [Optional]
+2. `LINEAR_CREATE_LINEAR_COMMENT` - Comment on an issue [Optional]
+3. `LINEAR_UPDATE_LINEAR_COMMENT` - Edit a comment [Optional]
+
+**Key parameters**:
+- `name`: Label name
+- `color`: Label color (hex)
+- `issue_id`: Issue ID for comments
+- `body`: Comment body (Markdown)
+
+**Pitfalls**:
+- Labels can be team-scoped or workspace-scoped
+- Comment body supports Markdown formatting
+
+### 5. Custom GraphQL Queries
+
+**When to use**: User needs advanced queries not covered by standard tools
+
+**Tool sequence**:
+1. `LINEAR_RUN_QUERY_OR_MUTATION` - Execute custom GraphQL [Required]
+
+**Key parameters**:
+- `query`: GraphQL query or mutation string
+- `variables`: Variables for the query
+
+**Pitfalls**:
+- Requires knowledge of Linear's GraphQL schema
+- Rate limits apply to GraphQL queries
+
+## Common Patterns
+
+### ID Resolution
+
+**Team name -> Team ID**:
+```
+1. Call LINEAR_GET_ALL_LINEAR_TEAMS
+2. Find team by name in response
+3. Extract id field
+```
+
+**State name -> State ID**:
+```
+1. Call LINEAR_LIST_LINEAR_STATES with team_id
+2. Find state by name
+3. Extract id field
+```
+
+### Pagination
+
+- Linear tools return paginated results
+- Check for pagination cursors in responses
+- Pass cursor to next request for additional pages
+
+## Known Pitfalls
+
+**Team Scoping**:
+- Issues, states, and cycles are team-specific
+- Always resolve team_id before creating issues
+
+**Priority Values**:
+- 0 = No priority, 1 = Urgent, 2 = High, 3 = Medium, 4 = Low
+- Use integer values, not string names
+
+## Quick Reference
+
+| Task | Tool Slug | Key Params |
+|------|-----------|------------|
+| List teams | LINEAR_GET_ALL_LINEAR_TEAMS | (none) |
+| Create issue | LINEAR_CREATE_LINEAR_ISSUE | team_id, title, description |
+| Search issues | LINEAR_SEARCH_ISSUES | query |
+| List issues | LINEAR_LIST_LINEAR_ISSUES | team_id, filters |
+| Get issue | LINEAR_GET_LINEAR_ISSUE | issue_id |
+| Update issue | LINEAR_UPDATE_ISSUE | issue_id, fields |
+| List states | LINEAR_LIST_LINEAR_STATES | team_id |
+| List projects | LINEAR_LIST_LINEAR_PROJECTS | (none) |
+| Create project | LINEAR_CREATE_LINEAR_PROJECT | name, team_ids |
+| Update project | LINEAR_UPDATE_LINEAR_PROJECT | project_id, fields |
+| List cycles | LINEAR_LIST_LINEAR_CYCLES | team_id |
+| Get cycles | LINEAR_GET_CYCLES_BY_TEAM_ID | team_id |
+| Create label | LINEAR_CREATE_LINEAR_LABEL | name, color |
+| Create comment | LINEAR_CREATE_LINEAR_COMMENT | issue_id, body |
+| Update comment | LINEAR_UPDATE_LINEAR_COMMENT | comment_id, body |
+| List users | LINEAR_LIST_LINEAR_USERS | (none) |
+| Current user | LINEAR_GET_CURRENT_USER | (none) |
+| Run GraphQL | LINEAR_RUN_QUERY_OR_MUTATION | query, variables |
+
+## When to Use
+This skill is applicable to execute the workflow or actions described in the overview.

package/merged-commands/linear-claude-skill.md

@@ -360,7 +360,7 @@ Choose the right tool for the task:
 }
 ```
 
-> **WARNING**: Do NOT use deprecated community servers. See [troubleshooting.md](troubleshooting.md) for details.
+> **WARNING**: Do NOT use deprecated community servers. See troubleshooting.md for details.
 
 ### MCP Reliability (Official Server)
 
@@ -383,7 +383,7 @@ node scripts/linear-helpers.mjs update-status Done 123 124 125
 
 ### Helper Script Reference
 
-For detailed helper script usage, see **[troubleshooting.md](troubleshooting.md)**.
+For detailed helper script usage, see **troubleshooting.md**.
 
 ### Parallel Agent Execution
 
@@ -409,7 +409,7 @@ Task({
 - Quick status checks
 - Operations needing immediate results
 
-See **[sync.md](sync.md)** for parallel execution patterns.
+See **sync.md** for parallel execution patterns.
 
 ## Critical Requirements
 
@@ -422,7 +422,7 @@ See **[sync.md](sync.md)** for parallel execution patterns.
 | Issue | Project | Not visible in project board |
 | Project | Initiative | Not visible in roadmap |
 
-See **[projects.md](projects.md)** for complete project creation checklist.
+See **projects.md** for complete project creation checklist.
 
 ---
 
@@ -435,7 +435,7 @@ See **[projects.md](projects.md)** for complete project creation checklist.
 
 ### Labels
 
-Uses **domain-based label taxonomy**. See [docs/labels.md](docs/labels.md).
+Uses **domain-based label taxonomy**. See docs/labels.md.
 
 **Key rules:**
 - ONE Type label: `feature`, `bug`, `refactor`, `chore`, `spike`
@@ -464,7 +464,7 @@ Scripts provide full type hints and are easier to debug than raw GraphQL for mul
 
 **Fallback only.** Use when operations aren't supported by MCP or SDK.
 
-See **[api.md](api.md)** for complete documentation including:
+See **api.md** for complete documentation including:
 - Authentication and setup
 - Example queries and mutations
 - Timeout handling patterns
@@ -479,7 +479,7 @@ npx tsx ~/.claude/skills/linear/scripts/query.ts "query { viewer { name } }"
 
 ## Projects & Initiatives
 
-For advanced project and initiative management patterns, see **[projects.md](projects.md)**.
+For advanced project and initiative management patterns, see **projects.md**.
 
 **Quick reference** - common project commands:
 
@@ -515,7 +515,7 @@ Manage Linear issues, projects, and teams
 Use this skill when working with manage linear issues, projects, and teams.
 ## Sync Patterns (Bulk Operations)
 
-For bulk synchronization of code changes to Linear, see **[sync.md](sync.md)**.
+For bulk synchronization of code changes to Linear, see **sync.md**.
 
 **Quick sync commands:**
 
@@ -533,11 +533,11 @@ npx tsx scripts/linear-ops.ts project-status "My Project" completed
 
 | Document | Purpose |
 |----------|---------|
-| [api.md](api.md) | GraphQL API reference, timeout handling |
-| [sdk.md](sdk.md) | SDK automation patterns |
-| [sync.md](sync.md) | Bulk sync patterns |
-| [projects.md](projects.md) | Project & initiative management |
-| [troubleshooting.md](troubleshooting.md) | Common issues, MCP debugging |
-| [docs/labels.md](docs/labels.md) | Label taxonomy |
+| api.md | GraphQL API reference, timeout handling |
+| sdk.md | SDK automation patterns |
+| sync.md | Bulk sync patterns |
+| projects.md | Project & initiative management |
+| troubleshooting.md | Common issues, MCP debugging |
+| docs/labels.md | Label taxonomy |
 
 **External:** [Linear MCP Documentation](https://linear.app/docs/mcp.md)