@raishin/vanguard-frontier-agentic 3.0.2 → 3.1.0

package/catalog/skills.json

@@ -85,6 +85,33 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "ai-generated-frontend-code-review",
+    "name": "AI-Generated Frontend Code Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Applies an elevated review pass specifically to AI/LLM-generated frontend diffs, checking for hallucinated framework APIs, slopsquatted dependency names, unsanitized dynamic-HTML sinks, and missing accessibility semantics — the failure patterns unique to generated-but-plausible-looking code — before merge.",
+    "source_type": "original",
+    "official_docs": [
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
+      "https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html",
+      "https://www.w3.org/WAI/ARIA/apg/",
+      "https://react.dev/reference/rules"
+    ],
+    "security_notes": "Treat all AI-generated code as untrusted input requiring verification, not a lower-scrutiny fast path. Check every new dependency name against the real package registry before approving install (slopsquat defense). Check every dynamic-HTML sink for sanitization. Never execute exploit payloads against live/staging systems; static-review-only skill (Read/Grep/Glob/WebFetch/WebSearch, no mutation, no live target traffic). Never reproduce discovered secrets/tokens verbatim in findings output.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/ai-generated-frontend-code-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "alibaba-ack-container-platform-operator",
     "name": "Alibaba Cloud ACK Container Platform Operator",
@@ -1239,6 +1266,114 @@
     "version": "0.1.0",
     "lifecycle": "experimental"
   },
+  {
+    "id": "angular-architecture-signals-review",
+    "name": "Angular Architecture & Signals Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Angular component/service architecture for correct Signals usage, computed/effect semantics, and change-detection strategy, using Angular's own Signals, change-detection, and dependency-injection guidance loaded progressively and grounded via Context7 against the repo's confirmed Angular version.",
+    "source_type": "original",
+    "official_docs": [
+      "https://angular.dev/guide/signals",
+      "https://angular.dev/guide/signals/linked-signal",
+      "https://angular.dev/guide/components/change-detection",
+      "https://angular.dev/guide/di/dependency-injection"
+    ],
+    "security_notes": "No direct security-primitive concern in this skill's scope; escalate any bypassSecurityTrust* usage discovered incidentally to the angular-ssr-hydration-review skill or a security reviewer rather than handling it here. Static-review-only skill: it reads and greps component/service source but never executes, builds, or runs application code. Treat any API key or token found hardcoded in component/service state or default values as a HIGH-severity finding requiring immediate escalation, not a style note.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/angular-architecture-signals-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "angular-ssr-hydration-review",
+    "name": "Angular SSR & Hydration Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Angular SSR bootstrap configuration and component templates for hydration-mismatch risk (NG0500-class errors), unjustified ngSkipHydration usage, and direct-DOM-manipulation patterns that bypass Angular's template-owned DOM model, using Angular's own hydration guide and error catalog loaded progressively and grounded via Context7 against the repo's confirmed Angular version.",
+    "source_type": "original",
+    "official_docs": [
+      "https://angular.dev/guide/hydration",
+      "https://angular.dev/errors/NG0500",
+      "https://angular.dev/api/platform-browser/provideClientHydration",
+      "https://www.w3.org/WAI/WCAG22/quickref/"
+    ],
+    "security_notes": "Direct DOM manipulation combined with dynamic string content (innerHTML-equivalent native calls) bypasses Angular's built-in sanitization pipeline -- treat any such pattern touching user-influenced data as an XSS-class finding, escalated to HIGH, in addition to the hydration-correctness finding. Static-review-only skill: it reads and greps bootstrap configuration and component source but never executes, builds, or runs application code.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/angular-ssr-hydration-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "angular-template-sanitizer-security-review",
+    "name": "Angular Template Sanitizer Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Angular templates and components for injection via DomSanitizer bypass calls (bypassSecurityTrustHtml, bypassSecurityTrustUrl, bypassSecurityTrustResourceUrl), unsanitized [innerHTML] bindings, and dynamically bound iframe security attributes such as [attr.sandbox], grounding claims via Context7 and Angular's own sanitizer and NG0910 documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://angular.dev/best-practices/security",
+      "https://angular.dev/errors/NG0910",
+      "https://owasp.org/www-project-top-ten/",
+      "https://owasp.org/www-community/attacks/xss/"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: DomSanitizer bypass calls and unsanitized [innerHTML] bindings are XSS vectors, and dynamically bound iframe security attributes are a sandbox-escape vector Angular's own NG0910 check exists to reject. Every finding defaults to HIGH severity unless proven otherwise with concrete validation/sanitizer evidence on the traced path. Static-review-only skill: it reads and greps components and templates but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/angular-template-sanitizer-security-review",
+    "author": "github: Raishin",
+    "version": "0.1.0"
+  },
+  {
+    "id": "api-integration-contract-review",
+    "name": "API Integration Contract Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews frontend-to-backend API contracts for data-minimization, authorization enforcement, versioning safety, and error-shape leakage before they ship, using OWASP API Security Top 10 grounding, server-side object-level authorization checks, and CORS/versioning gates loaded progressively and validated via Context7 against the repo's confirmed framework versions.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nextjs.org/docs/app/building-your-application/routing/route-handlers",
+      "https://owasp.org/www-project-api-security/",
+      "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS",
+      "https://tanstack.com/query/latest/docs/framework/react/guides/query-keys"
+    ],
+    "security_notes": "Static-review-only skill: it reads and greps route handler code, authorization middleware, and contract documentation but never executes, builds, or runs application code, and never issues live requests. Every finding of client-side-only authorization or excessive data exposure is treated as a security-severity finding, not a style note. Wildcard CORS combined with credentialed requests is an automatic blocking finding. Raw upstream error forwarding to the client is a blocking finding.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/api-integration-contract-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "argo-rollouts-progressive-delivery-review",
     "name": "Argo Rollouts Progressive Delivery Review",
@@ -3778,6 +3913,89 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "browser-compatibility-review",
+    "name": "Browser Compatibility Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for auditing web-platform feature usage against the org's declared browser support matrix using Baseline/caniuse status, verifying graceful-degradation or polyfill coverage for any non-Baseline feature.",
+    "source_type": "original",
+    "official_docs": [
+      "https://web-platform-dx.github.io/web-features/",
+      "https://web.dev/baseline",
+      "https://caniuse.com/",
+      "https://github.com/browserslist/browserslist"
+    ],
+    "security_notes": "Static review only; never recommends disabling security-relevant browser defaults (mixed-content blocking, SameSite cookie defaults) as a compatibility workaround.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/browser-compatibility-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "build-tooling-vite-webpack-review",
+    "name": "Build Tooling (Vite/Webpack) Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Vite and Webpack build configuration, code-splitting/chunking strategy, and bundle-size budgets, version-labeling every recommendation because Vite 8's Rolldown-based codeSplitting API replaced the Rollup-era manualChunks option.",
+    "source_type": "original",
+    "official_docs": [
+      "https://vite.dev/guide/build.html",
+      "https://vite.dev/guide/migration.html",
+      "https://webpack.js.org/guides/code-splitting/",
+      "https://webpack.js.org/plugins/split-chunks-plugin/"
+    ],
+    "security_notes": "Bundle-analyzer output shared outside the org must not include source maps that reveal internal API paths or accidentally-inlined environment values. Any dependency with an install-time script that runs during the build must be reviewed before it's allowed to affect the production bundle. Static-review-only skill: it reads and greps build config and source; it does not execute builds, install dependencies, or run bundler CLIs. Treat any credential-shaped string found in a pasted build config, CI job definition, or analyzer report as unsafe to echo in the transcript.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/build-tooling-vite-webpack-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "bundle-budget-code-splitting-review",
+    "name": "Bundle Budget & Code-Splitting Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews JavaScript/CSS bundle composition against explicit numeric budgets, ranks analyzer contributors by byte weight and main-thread execution cost, evaluates route- and component-level code-splitting boundaries against version-confirmed bundler chunking APIs, and requires a CI-enforced budget before endorsing any size fix as resolved, loaded progressively.",
+    "source_type": "original",
+    "official_docs": [
+      "https://web.dev/articles/reduce-javascript-payloads-with-code-splitting",
+      "https://web.dev/articles/your-first-performance-budget",
+      "https://vite.dev/guide/build.html",
+      "https://webpack.js.org/guides/code-splitting/",
+      "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules/Dynamic_module_loading",
+      "https://webpack.js.org/plugins/split-chunks-plugin/"
+    ],
+    "security_notes": "Do not recommend inlining third-party scripts to save a request without disclosing the CSP/subresource-integrity trade-off of inlined vs. externally loaded, SRI-checkable code. Flag any dynamic import() of a module specifier built from unsanitized user input as a code-injection risk, not merely a performance concern. Do not accept or echo any credential-shaped string found in a pasted build config or analyzer report as if it were safe to keep in the transcript.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/bundle-budget-code-splitting-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "business-combinations-advisor",
     "name": "Business Combinations Advisor",
@@ -4348,6 +4566,100 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "core-web-vitals-triage",
+    "name": "Core Web Vitals Triage",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Decomposes LCP, INP, and CLS regressions into their documented web.dev/W3C sub-phases (TTFB/resource-load-delay/resource-load-duration/render-delay for LCP; input-delay/processing-time/presentation-delay for INP; element-level trigger attribution for CLS), grades findings by lab-vs-field evidence tier, and refuses to declare a metric fixed without a field-data or CI-budget verification path, loaded progressively.",
+    "source_type": "original",
+    "official_docs": [
+      "https://web.dev/articles/vitals",
+      "https://web.dev/articles/lcp",
+      "https://web.dev/articles/optimize-lcp",
+      "https://web.dev/articles/inp",
+      "https://web.dev/articles/optimize-inp",
+      "https://web.dev/articles/cls",
+      "https://web.dev/articles/optimize-cls",
+      "https://developer.chrome.com/docs/crux",
+      "https://www.w3.org/TR/largest-contentful-paint/",
+      "https://www.w3.org/TR/event-timing/"
+    ],
+    "security_notes": "Do not request production analytics credentials or raw customer session data; accept only sanitized/aggregated field exports (CrUX API responses, exported web-vitals RUM aggregates). Do not recommend removing accessible loading-state semantics (aria-live, role=status, visible focus indicators) as a CLS/INP fix. Do not accept or echo any credential-shaped string found in a pasted trace/config as if it were safe to keep in the transcript.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/core-web-vitals-triage",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "critical-rendering-path-review",
+    "name": "Critical Rendering Path Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews page load sequencing — resource loading order, render-blocking CSS/JS, layout-shift risk, and Core Web Vitals budget adherence — separating lab (Lighthouse/synthetic) data from field (CrUX/RUM) data so performance claims are evidence-graded rather than asserted.",
+    "source_type": "original",
+    "official_docs": [
+      "https://web.dev/articles/critical-rendering-path",
+      "https://web.dev/articles/optimize-lcp",
+      "https://web.dev/articles/cls",
+      "https://web.dev/articles/inp",
+      "https://web.dev/vitals",
+      "https://developer.mozilla.org/en-US/docs/Web/Performance/Guides/Critical_rendering_path",
+      "https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/link",
+      "https://developer.chrome.com/docs/lighthouse/overview"
+    ],
+    "security_notes": "Flag preload/prefetch/preconnect resource hints pointed at third-party origins without considering the information-leakage/timing implications of establishing early connections to those origins. Flag any performance 'optimization' that removes Subresource Integrity (SRI) from a script/style tag to save a round trip — integrity checks are not a discretionary performance cost. Do not recommend inlining third-party scripts to avoid a network request in a way that bypasses CSP script-src allow-listing.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/critical-rendering-path-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "css-architecture-design-system-review",
+    "name": "CSS Architecture & Design System Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews CSS for specificity/cascade-layer discipline, design-token conformance, and responsive strategy (container queries vs. media queries), catching specificity wars, token drift, and non-reflowing layouts before they compound into unmaintainable stylesheets.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.mozilla.org/en-US/docs/Web/CSS",
+      "https://www.w3.org/TR/css-cascade-5/",
+      "https://www.w3.org/TR/css-variables-1/",
+      "https://www.w3.org/TR/css-contain-3/",
+      "https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_cascade/Cascade_layers",
+      "https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_containment/Container_queries",
+      "https://www.w3.org/TR/WCAG22/#visual-presentation"
+    ],
+    "security_notes": "Do not treat CSS visibility/display properties as an access-control mechanism — hiding an element with CSS never substitutes for server-side authorization; flag any pattern that relies on it as a security control. Flag attribute-selector-plus-background-image patterns that could exfiltrate user-controlled attribute values via network requests (CSS-based data-exfiltration vector). Flag third-party @import without SRI/CSP style-src consideration.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/css-architecture-design-system-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "d365-commerce",
     "name": "D365 Commerce",
@@ -4949,6 +5261,33 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "design-token-governance-review",
+    "name": "Design Token Governance Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews design-token source of truth, build/transform pipelines, and resolved contrast ratios against WCAG 1.4.3/1.4.11 to stop hardcoded values and inaccessible token pairings from shipping across themes.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.w3.org/community/design-tokens/",
+      "https://www.w3.org/TR/WCAG21/#contrast-minimum",
+      "https://www.w3.org/TR/WCAG21/#non-text-contrast",
+      "https://amzn.github.io/style-dictionary/#/"
+    ],
+    "security_notes": "Token-source pipelines pulling from Figma/Tokens Studio APIs must use scoped, rotatable personal access tokens stored only in CI secrets, never committed to token-source config files.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/design-token-governance-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "dotnet-aspire-cloud-native-review",
     "name": ".NET Aspire Cloud-Native Review",
@@ -5223,6 +5562,62 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "e2e-testing-playwright-review",
+    "name": "E2E Testing (Playwright) Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Playwright end-to-end test configuration, fixtures, sharding, and screenshot-assertion setup for reliability, CI parallelism, and accurate visual/behavioral gating, grounded in current Playwright API docs.",
+    "source_type": "original",
+    "official_docs": [
+      "https://playwright.dev/docs/best-practices",
+      "https://playwright.dev/docs/ci",
+      "https://playwright.dev/docs/test-snapshots",
+      "https://playwright.dev/docs/api/class-pageassertions#page-assertions-to-have-screenshot-1",
+      "https://playwright.dev/docs/test-parallel"
+    ],
+    "security_notes": "Playwright storageState.json fixtures can capture real session cookies/auth tokens if generated against a live authenticated session; require these be generated against a dedicated test account and treated as sensitive (not committed to a public repo). HAR-file recordings used for network mocking can capture real API keys in request headers -- scrub before committing.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/e2e-testing-playwright-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "edge-cache-data-bleed-review",
+    "name": "Edge Cache Data-Bleed Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Next.js App Router caching surfaces -- route-level revalidate exports, 'use cache: private' boundaries on cookies()-reading server functions, generateStaticParams on personalized routes, and Cache-Control/Vary response headers -- for defects that let one user's authenticated response be cached and replayed to a different user, grounding claims via Context7 and Next.js's own caching documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nextjs.org/docs/app/api-reference/directives/use-cache-private",
+      "https://nextjs.org/docs/app/guides/incremental-static-regeneration",
+      "https://nextjs.org/docs/app/api-reference/file-conventions/route-segment-config",
+      "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Vary",
+      "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: a shared cache entry (ISR revalidate window, an uncached-boundary server function, or a CDN/proxy edge cache) serving one user's session-derived response to a different user is a cross-user data-exposure defect, not a performance bug. Every finding in this skill defaults to HIGH severity unless proven otherwise with a concrete 'use cache: private' or Cache-Control: private boundary on the traced path. Static-review-only skill: it reads and greps route files, server functions, and response-header call sites but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/edge-cache-data-bleed-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "email-sender-authentication-review",
     "name": "Email Sender Authentication Review",
@@ -5252,6 +5647,33 @@
     "version": "0.1.0",
     "lifecycle": "experimental"
   },
+  {
+    "id": "enterprise-red-team-review",
+    "name": "Enterprise Red Team Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Adversarial second-pass review skill that hunts for what Tier-1 specialists missed on security, accessibility, and AI-generated frontend code before a change reaches the Board Chair for adjudication.",
+    "source_type": "original",
+    "official_docs": [
+      "https://owasp.org/www-project-top-ten/",
+      "https://owasp.org/www-project-application-security-verification-standard/",
+      "https://www.w3.org/WAI/ARIA/apg/",
+      "https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/CSP"
+    ],
+    "security_notes": "Static/findings-only review - never execute exploit code or mutate the reviewed codebase; never accept an unverifiable 'already mitigated' claim as resolved; escalate secret/PII exposure paths and AI-code prompt-injection artifacts immediately as CONFIRMED findings.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/enterprise-red-team-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "environment-to-production-release-protocol",
     "name": "Environment-to-Production Release Protocol",
@@ -5779,27 +6201,351 @@
     "security_notes": "Advisory only. Never accepts MNPI or confidential budget figures."
   },
   {
-    "id": "fx-translation-advisor",
-    "name": "FX Translation Advisor",
+    "id": "framework-upgrade-risk-review",
+    "name": "Framework Upgrade Risk Review",
     "type": "skill",
-    "provider": "accounting",
+    "provider": "frontend",
     "harnesses": [
       "claude-code",
-      "codex",
       "cursor",
+      "codex",
       "gemini",
       "kiro",
       "other"
     ],
-    "summary": "Multi-jurisdiction reference framework for foreign currency translation and remeasurement. Covers functional currency determination (ASC 830-10-45 / IAS 21.9–21.14), translation vs. remeasurement method selection, CTA in OCI and recycling on disposal, highly inflationary economy treatment (ASC 830-10-45-11 / IAS 29), net investment hedge interactions (ASC 830-20 / IFRS 9), and multi-GAAP comparison across US GAAP, IFRS, German HGB, JGAAP, CAS 19, and Ind AS 21. Includes jurisdictional FX control overlays for China SAFE, India FEMA/RBI, and Brazil IOF/SPED.",
+    "summary": "Assesses the breaking-change and regression risk of a same-framework major-version upgrade (React, Angular, Vue, Next.js, build tooling) by grounding every claimed breaking change in the framework's official changelog/migration guide via Context7, and separates upgrade-blocking issues from cosmetic deprecation warnings.",
     "source_type": "original",
-    "category": "finance",
-    "execution_tier": "read-only-runtime",
-    "oauth_scopes": [],
-    "mcp_servers": [],
-    "run_as_permissions": {
-      "required": [],
-      "denied": []
+    "official_docs": [
+      "https://react.dev/blog",
+      "https://nextjs.org/docs/app/guides/upgrading",
+      "https://angular.dev/reference/releases",
+      "https://vuejs.org/guide/introduction.html"
+    ],
+    "security_notes": "Prioritize any breaking change tied to a security advisory (e.g. a CVE fixed by the new major version) as a forced-upgrade driver, and flag if the current pinned version is past its security-support window regardless of migration effort. Never invent codemod names, CLI flags, or config keys.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/framework-upgrade-risk-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-auth-session-security-review",
+    "name": "Frontend Auth & Session Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews client-side authentication and session-management implementations for token-storage location, session-cookie-flag correctness, CSRF/open-redirect exposure, and OAuth/OIDC flow choice (PKCE authorization code vs deprecated implicit grant) for browser-based apps, grounding claims via Context7 against the OWASP Cheat Sheet Series and the OAuth 2.1 draft.",
+    "source_type": "original",
+    "official_docs": [
+      "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html",
+      "https://owasp.org/www-project-application-security-verification-standard/",
+      "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps",
+      "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite",
+      "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"
+    ],
+    "security_notes": "Never asks for or prints real session tokens, cookies, client secrets, or OAuth credentials during review; treats any such value found in fixtures/logs as a redaction target. Does not perform live session hijacking, token replay, or CSRF exploitation testing against real systems. Static-review-only skill: reads and greps auth/session code but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-auth-session-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-bff-boundary-review",
+    "name": "Frontend BFF Boundary Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Determines and reviews whether aggregation/shaping logic belongs in a Backend-for-Frontend layer versus client-side composition, and audits existing BFF boundaries for scope creep, duplicated aggregation logic, and leaked backend topology or pass-through authorization, grounded via Context7 against the repo's confirmed Next.js version when a Route Handler is the proposed BFF vehicle.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nextjs.org/docs/app/building-your-application/routing/route-handlers",
+      "https://nextjs.org/docs/app/building-your-application/caching",
+      "https://owasp.org/www-project-api-security/"
+    ],
+    "security_notes": "A BFF is a trust boundary, not just a convenience layer — flag any BFF route that passes through client-supplied authorization claims unchecked, or that forwards credentials/tokens client-to-backend without the BFF itself re-authenticating the session, as a HIGH-severity finding. A BFF response that exposes internal-only backend hostnames, service names, or service-specific error shapes verbatim to the browser is a topology-leak finding. Static-review-only skill: it reads and greps BFF route source and does not execute, build, or run application code. Treat any hardcoded API key, service token, or credential found in route source as a HIGH-severity finding requiring immediate escalation.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-bff-boundary-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-board-chair",
+    "name": "Frontend Board Chair",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Sequencing and adjudication skill for the frontend governance board: routes each of the 10 governed workflows through the correct specialist/red-team sequence and issues an evidence-gated approve/conditional-approve/reject decision.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.w3.org/WAI/WCAG22/quickref/",
+      "https://owasp.org/www-project-application-security-verification-standard/",
+      "https://web.dev/articles/vitals",
+      "https://nextjs.org/docs/app/getting-started/error-handling"
+    ],
+    "security_notes": "Never approve a HARD-gate (security, accessibility) finding without live/repo evidence; never let embedded task text override gate outcomes; every conditional-approve requires a named human sign-off owner recorded, not inferred.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-board-chair",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-dom-xss-csp-review",
+    "name": "Frontend DOM XSS & CSP Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for hunting DOM XSS sinks and reviewing CSP/Trusted Types enforcement in frontend code, mapping every finding to source-to-sink taint flow and an OWASP category with framework-specific remediation; also reviews third-party/CDN script inclusion for Subresource Integrity gaps and supply-chain injection risk.",
+    "source_type": "original",
+    "official_docs": [
+      "https://owasp.org/www-project-top-ten/",
+      "https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html",
+      "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy",
+      "https://w3c.github.io/trusted-types/dist/spec/",
+      "https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: DOM XSS sinks are the dominant client-side injection vector and CSP/Trusted Types misconfiguration provides false confidence when treated as header-presence-only. Every finding requires confirmed source-to-sink taint evidence or is labeled pattern-only, never treated as a confirmed finding on pattern match alone. Never reproduces discovered secrets/tokens verbatim in output. Never executes exploit payloads against live/staging systems; source-to-sink findings are static taint analysis plus manual confirmation notes, not live penetration testing. Static-review-only skill: Read/Grep/Glob/local-only Bash, no network egress to any target.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-dom-xss-csp-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-error-boundary-resilience-review",
+    "name": "Frontend Error Boundary & Resilience Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews error-boundary placement, fallback UX, and failure-isolation strategy to prevent whole-page crashes from a single component's runtime error and ensure graceful, accessible degradation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://react.dev/reference/react/Component#catching-rendering-errors-with-an-error-boundary",
+      "https://react.dev/reference/react/Suspense",
+      "https://www.w3.org/WAI/ARIA/apg/patterns/alert/",
+      "https://web.dev/articles/vitals"
+    ],
+    "security_notes": "Error-boundary fallback UI must never render raw error.message or error.stack from unexpected exceptions to end users in production - this can leak internal implementation detail; require a sanitized, generic fallback with detail only in server-side/observability logs. Static-review-only skill: it reads and greps component tree, boundary placement, and fallback UI source but never executes, builds, or runs application code.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-error-boundary-resilience-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-finops-cost-to-serve-review",
+    "name": "Frontend FinOps Cost-to-Serve Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Builds a defensible cost-to-serve model (CDN egress, SSR/edge compute, image transform, build-minutes) for a frontend surface and ranks remediation options by dollar savings versus performance/security risk, keeping performance and cloud spend tied together instead of reviewed separately.",
+    "source_type": "adapted",
+    "official_docs": [
+      "https://web.dev/articles/total-byte-weight",
+      "https://nextjs.org/docs/app/guides/self-hosting",
+      "https://www.finops.org/framework/principles/",
+      "https://developer.chrome.com/docs/crux"
+    ],
+    "security_notes": "Never recommend disabling CSP, WAF, image-pipeline security scanning, or TLS termination purely to cut cost; any such trade-off requires explicit security-owner sign-off, not a default recommendation.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-finops-cost-to-serve-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-maestro",
+    "name": "Frontend Maestro",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Routing skill that classifies an inbound frontend governance task against the frontend taxonomy and dispatches to the narrowest specialist(s), following the same live-guard-gate discipline as the existing per-provider maestro skills in this repo.",
+    "source_type": "original",
+    "official_docs": [
+      "https://react.dev/learn",
+      "https://nextjs.org/docs",
+      "https://www.w3.org/WAI/WCAG22/quickref/"
+    ],
+    "security_notes": "Follows this repo's existing live-guard-gate convention: any specialist capable of a live/production mutation is listed under live_guards and never auto-dispatched; requires explicit human confirmation, blast-radius assessment, and rollback path before live-guard-gate dispatch. No live-guard-capable specialist currently exists in the frontend catalog; Maestro must say so rather than fabricate one until that changes. Never asks for secrets, credentials, tokens, or environment-specific identifiers.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-migration-modernization-plan",
+    "name": "Frontend Migration & Modernization Plan",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Builds a phased strangler-fig migration/modernization plan for legacy frontend stacks (jQuery/Backbone/AngularJS, old bundlers, framework major versions) with rollback gates, exit criteria, and business-risk-first sequencing, loading legacy-pattern, risk, and rollback references progressively rather than dumping the whole migration playbook into every prompt.",
+    "source_type": "original",
+    "official_docs": [
+      "https://react.dev/learn/react-compiler/incremental-adoption",
+      "https://nextjs.org/docs/app/guides/migrating",
+      "https://vitejs.dev/guide/migration",
+      "https://angular.dev/reference/migrations"
+    ],
+    "security_notes": "Never propose a migration phase that merges auth/session state across old and new stacks without a named security review gate. Treat every phase's rollback path as a hard requirement, not optional documentation.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-migration-modernization-plan",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-observability-rum-instrumentation",
+    "name": "Frontend Observability RUM Instrumentation",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for designing and reviewing Real User Monitoring instrumentation using the web-vitals attribution build and OpenTelemetry Web, with explicit sampling, cardinality, and PII-in-telemetry controls and lab-vs-field evidence labeling.",
+    "source_type": "adapted",
+    "official_docs": [
+      "https://web.dev/articles/vitals",
+      "https://github.com/GoogleChrome/web-vitals",
+      "https://opentelemetry.io/docs/languages/js/",
+      "https://opentelemetry.io/docs/specs/semconv/"
+    ],
+    "security_notes": "Never recommends capturing full URLs with query strings, user identifiers, or free-text form values as span/metric attributes without explicit scrubbing. Read-only review of existing instrumentation; does not deploy telemetry config changes to production without explicit human sign-off logged outside this skill.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-observability-rum-instrumentation",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-platform-architecture-review",
+    "name": "Frontend Platform Architecture Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews cross-cutting frontend architecture decisions (module boundaries, rendering topology, technology adoption) against a rewrite-averse, evidence-grounded standard before they are approved, using duplication checks, incremental-migration requirements, and Core Web Vitals/a11y/security gates loaded progressively and grounded via Context7 against the repo's confirmed framework versions.",
+    "source_type": "original",
+    "official_docs": [
+      "https://react.dev/learn/thinking-in-react",
+      "https://nextjs.org/docs/app/building-your-application/routing",
+      "https://web.dev/articles/vitals",
+      "https://www.w3.org/WAI/WCAG22/quickref/"
+    ],
+    "security_notes": "Static-review-only skill: it reads and greps proposal documents, config, and source but never executes, builds, or runs application code. Flag any architecture proposal that stores secrets/tokens in client-reachable bundles or build-time-inlined env vars, allows postinstall scripts from unpinned/unaudited dependencies, or introduces a CSP-incompatible pattern (unsafe-eval, dynamic Function()) as a blocking finding, not a note.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-platform-architecture-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "frontend-testing-strategy-review",
+    "name": "Frontend Testing Strategy Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews unit/component/integration/E2E test-pyramid shape, coverage of critical user journeys, and flaky-test governance for a frontend codebase using Vitest/Jest, Testing Library, and Playwright/Cypress, loading framework-specific reference guidance only when needed.",
+    "source_type": "original",
+    "official_docs": [
+      "https://playwright.dev/docs/best-practices",
+      "https://vitest.dev/guide/",
+      "https://testing-library.com/docs/queries/about/#priority",
+      "https://docs.cypress.io/app/core-concepts/best-practices"
+    ],
+    "security_notes": "Never accept or request real credentials/session tokens for test fixtures; require synthetic data or mocked network layers (MSW, cy.intercept, Playwright route interception). Flag any test-only auth/CSRF bypass flag that could ship enabled in a production build as a hard-gate finding.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/frontend-testing-strategy-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "fx-translation-advisor",
+    "name": "FX Translation Advisor",
+    "type": "skill",
+    "provider": "accounting",
+    "harnesses": [
+      "claude-code",
+      "codex",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Multi-jurisdiction reference framework for foreign currency translation and remeasurement. Covers functional currency determination (ASC 830-10-45 / IAS 21.9–21.14), translation vs. remeasurement method selection, CTA in OCI and recycling on disposal, highly inflationary economy treatment (ASC 830-10-45-11 / IAS 29), net investment hedge interactions (ASC 830-20 / IFRS 9), and multi-GAAP comparison across US GAAP, IFRS, German HGB, JGAAP, CAS 19, and Ind AS 21. Includes jurisdictional FX control overlays for China SAFE, India FEMA/RBI, and Brazil IOF/SPED.",
+    "source_type": "original",
+    "category": "finance",
+    "execution_tier": "read-only-runtime",
+    "oauth_scopes": [],
+    "mcp_servers": [],
+    "run_as_permissions": {
+      "required": [],
+      "denied": []
     },
     "official_docs": [
       "https://asc.fasb.org/830",
@@ -7194,6 +7940,35 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "graphql-client-security-review",
+    "name": "GraphQL Client Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Statically reviews Apollo Client (and urql-equivalent) GraphQL client configuration for production devtools/introspection exposure, normalized cache not cleared across user sessions, missing persisted-query allowlisting against client-driven query abuse, auth headers attached without CSRF protection, and sensitive fields normalized into the cache unmasked -- grounded in Apollo Client's own configuration, authentication, and caching documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.apollographql.com/docs/react/development-testing/developer-tooling",
+      "https://www.apollographql.com/docs/react/networking/authentication",
+      "https://www.apollographql.com/docs/react/api/link/apollo-link-context",
+      "https://www.apollographql.com/docs/react/caching/advanced-topics",
+      "https://www.apollographql.com/docs/react/api/link/persisted-queries",
+      "https://owasp.org/www-project-top-ten/"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: production-enabled devtools expose full schema introspection and the normalized cache inspector, an uncleared cache after logout is a cross-user/cross-tenant data-exposure defect, unallowlisted client-driven queries are a denial-of-service/cost-abuse vector, an auth header with no CSRF token weakens mutation-endpoint protection, and unmasked sensitive fields in the normalized cache are exposed to the devtools inspector for the life of the cache entry. Every finding in this skill defaults to HIGH severity unless proven otherwise with concrete configuration evidence. Static-review-only skill: it reads and greps GraphQL client setup, link chains, and cache configuration but never executes, builds, or runs application code, and never sends live GraphQL requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/graphql-client-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "hedge-accounting-advisor",
     "name": "Hedge Accounting Advisor",
@@ -7442,6 +8217,35 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "html-semantics-accessibility-review",
+    "name": "HTML Semantics & Accessibility Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews markup for correct native-element usage, valid heading/landmark structure, and WAI-ARIA APG-conformant custom-widget patterns, producing a WCAG-grounded verdict with APG citations for every custom interactive element and flags for anything needing live assistive-technology verification.",
+    "source_type": "original",
+    "official_docs": [
+      "https://html.spec.whatwg.org/multipage/",
+      "https://www.w3.org/WAI/ARIA/apg/",
+      "https://www.w3.org/TR/wai-aria-1.2/",
+      "https://www.w3.org/TR/WCAG22/",
+      "https://developer.mozilla.org/en-US/docs/Web/HTML",
+      "https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA"
+    ],
+    "security_notes": "Do not hardcode or request user PII, real screen-reader session logs, or authenticated-app URLs in review examples. Flag markup that binds unsanitized user content directly into the DOM (innerHTML/outerHTML/document.write) as an XSS-adjacent finding even though the primary fix is JS-side. Treat WCAG conformance findings as compliance-relevant (ADA/Section 508/EN 301 549 exposure) and label them as such rather than 'style nitpicks'.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/html-semantics-accessibility-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "huawei-cce-container-platform-operator",
     "name": "Huawei CCE Container Platform Operator",
@@ -8559,6 +9363,34 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "i18n-l10n-readiness-review",
+    "name": "i18n/l10n Readiness Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for auditing i18n architecture (ICU MessageFormat, Intl-based formatting, CLDR pluralization, RTL layout) so a frontend is structurally translation-ready before any translation vendor engagement.",
+    "source_type": "adapted",
+    "official_docs": [
+      "https://www.w3.org/International/",
+      "https://cldr.unicode.org/",
+      "https://tc39.es/ecma402/",
+      "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl",
+      "https://www.w3.org/International/articles/article-text-direction"
+    ],
+    "security_notes": "Static review only; never fabricates or inserts translated strings (that is a human/vendor task). Does not process real user-submitted locale/PII data.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/i18n-l10n-readiness-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "identity-to-data-access-protocol",
     "name": "Identity to Data Access Protocol",
@@ -8868,6 +9700,35 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "javascript-runtime-async-review",
+    "name": "JavaScript Runtime & Async Correctness Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews JavaScript for event-loop/microtask ordering correctness, unhandled Promise rejections, DOM event-listener lifecycle, and race-condition risk in rapid-repeated-async UI patterns, tracing actual browser scheduling behavior rather than assumed synchronous-style reasoning.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Using_promises",
+      "https://developer.mozilla.org/en-US/docs/Web/API/HTML_DOM_API/Microtask_guide",
+      "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/await",
+      "https://html.spec.whatwg.org/multipage/webappapis.html#event-loops",
+      "https://developer.mozilla.org/en-US/docs/Web/API/AbortController",
+      "https://tc39.es/ecma262/"
+    ],
+    "security_notes": "Flag unhandled Promise rejections on authorization/permission-check code paths — a rejected check that isn't awaited/caught can fail open. Flag eval, new Function(), and string-argument setTimeout/setInterval as code-injection surfaces. Flag window/document message-event listeners without an origin check on postMessage payloads. Require AbortController-based cancellation for lifecycle-bound fetches to prevent stale-response race conditions that can leak one user's data into another user's view after a fast session switch.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/javascript-runtime-async-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "kubecost-chargeback-allocation-review",
     "name": "Kubecost Chargeback and Allocation Review",
@@ -9278,6 +10139,33 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "legacy-jquery-to-modern-framework-review",
+    "name": "Legacy jQuery to Modern Framework Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews a legacy jQuery/Backbone-era codebase for the specific hidden behaviors (implicit global event delegation, direct DOM mutation outside any render cycle, undocumented plugin side effects, ad-hoc accessibility shims) that a mechanical framework port will silently drop, producing an inventory that a migration plan can actually rely on.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.mozilla.org/en-US/docs/Web/API/EventTarget/addEventListener",
+      "https://api.jquery.com/category/events/event-handler-attachment/",
+      "https://www.w3.org/WAI/ARIA/apg/",
+      "https://react.dev/reference/rules"
+    ],
+    "security_notes": "Legacy jQuery plugins frequently construct HTML via string concatenation and .html(); flag every such call as a potential unsanitized-injection point that a naive port might carry forward unchanged, or worse, replace with dangerouslySetInnerHTML/v-html without adding sanitization. Static-review-only skill: Read/Grep/Glob, no Bash execution, no network egress, no code mutation.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/legacy-jquery-to-modern-framework-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "legal-counsel-review",
     "name": "Legal Counsel Review",
@@ -10041,6 +10929,32 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "microfrontend-boundary-review",
+    "name": "Micro-Frontend Boundary Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews micro-frontend/module-federation boundary contracts for shared-dependency versioning safety, runtime isolation, and ownership clarity before adoption or extension, grounded via Context7 against official React docs for same-runtime multi-root composition.",
+    "source_type": "original",
+    "official_docs": [
+      "https://react.dev/reference/react-dom/client/createRoot",
+      "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy",
+      "https://web.dev/articles/vitals"
+    ],
+    "security_notes": "Micro-frontend boundaries that share a JavaScript runtime (module federation, build-time composition, or any non-iframe composition) collapse the CSP trust boundary between teams' code — a vulnerability, XSS, or broken bundle in one remote can affect the host and sibling remotes sharing that runtime. Require an explicit shared-dependency version-compatibility contract and a documented blast-radius statement (error-boundary isolation, independent deploy/rollback) for any non-iframe-isolated micro-frontend adoption, and require iframe isolation or an equivalent mitigation for any remote handling data that should not share a trust boundary with lower-trust remotes. Static-review-only skill: it reads and greps composition config and does not execute, build, or run application code, dev servers, or bundler configs. Treat any hardcoded credential, API key, or token found in a remote's config or example fixture as a HIGH-severity finding requiring immediate escalation.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/microfrontend-boundary-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "microsoft-business-impact-value-realization",
     "name": "Microsoft Business Impact & Value Realization",
@@ -10097,6 +11011,38 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "monorepo-package-governance-review",
+    "name": "Monorepo & Package Governance Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews monorepo task-graph configuration (Turborepo/Nx) and dependency/version governance (pnpm catalogs, npm overrides, lockfile integrity) together to stop false-green CI cache reuse and unpinned supply-chain exposure, with config-key claims grounded in Context7-sourced docs and progressive reference loading. Also covers npm dependency-confusion review: .npmrc scope-to-registry mapping, package-lock.json commitment/frozen-install (npm ci) enforcement, and allowScripts lifecycle-script gating.",
+    "source_type": "original",
+    "official_docs": [
+      "https://turborepo.com/docs/crafting-your-repository/configuring-tasks",
+      "https://turborepo.com/docs/crafting-your-repository/caching",
+      "https://nx.dev/concepts/task-pipeline-configuration",
+      "https://pnpm.io/catalogs",
+      "https://pnpm.io/pnpm-workspace_yaml",
+      "https://github.com/npm/cli/blob/latest/docs/lib/content/using-npm/scope.md",
+      "https://github.com/npm/cli/blob/latest/docs/lib/content/configuring-npm/npmrc.md",
+      "https://github.com/npm/cli/blob/latest/docs/lib/content/commands/npm-ci.md",
+      "https://github.com/npm/cli/blob/latest/docs/lib/content/commands/npm-approve-scripts.md"
+    ],
+    "security_notes": "Static-review-only skill: reads and greps turbo.json, nx.json, package.json, pnpm-workspace.yaml, .npmrc, and lockfiles but never runs install, build, or CI commands. Remote-cache and registry auth tokens must be CI-scoped secrets, never committed to turbo.json/nx.json/.npmrc; any token-shaped literal found in a config file is an automatic blocking finding, and any .npmrc credential key (_auth/_authToken/_password/etc.) not scoped to a specific registry host/path is a blocking finding regardless of the token's live validity. Any dependency lifecycle script (postinstall/preinstall/prepare) introduced in the same PR as a workspace-topology change warrants extra scrutiny and must be quoted verbatim in the finding, not summarized from the package name; cross-reference it against the root package.json's allowScripts field. A scoped package (@scope/name) referenced in package.json with no matching @scope:registry mapping in .npmrc is a dependency-confusion finding.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/monorepo-package-governance-review",
+    "version": "0.2.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "netsuite-administrator-skill",
     "name": "NetSuite Administrator Skill",
@@ -10815,6 +11761,121 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "nextjs-app-router-data-fetching-review",
+    "name": "Next.js App Router Data Fetching Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Server/Client Component boundaries and Server Action authorization trust for data-fetching correctness and security, using Next.js's own Server Components/Server Actions documentation loaded progressively and grounded via Context7 against the repo's confirmed Next.js version.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nextjs.org/docs/app/building-your-application/rendering/server-components",
+      "https://nextjs.org/docs/app/building-your-application/rendering/client-components",
+      "https://nextjs.org/docs/app/building-your-application/data-fetching/server-actions-and-mutations",
+      "https://owasp.org/www-project-top-ten/"
+    ],
+    "security_notes": "A Server Action that derives an authorization decision from client-supplied form data instead of the server-side session is a Broken Access Control finding (OWASP A01) and must be escalated as HIGH, not filed as a style note. A Client Component whose import graph reaches a server-only module (DB client, non-NEXT_PUBLIC_ env access, server-only-guarded module) is a HIGH-severity bundle-leak finding. Static-review-only skill: it reads and greps component/action source but never executes, builds, or runs application code. Treat any hardcoded API key, token, or credential found in a Server Action or Client Component as a HIGH-severity finding requiring immediate escalation.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/nextjs-app-router-data-fetching-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "nextjs-rendering-caching-review",
+    "name": "Next.js Rendering & Caching Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Next.js App Router rendering-mode selection and fetch()/Data-Cache configuration for staleness and cross-user data-leakage risk, using Next.js's own caching documentation loaded progressively and grounded via Context7 against the repo's confirmed Next.js version.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nextjs.org/docs/app/building-your-application/caching",
+      "https://nextjs.org/docs/app/building-your-application/data-fetching/fetching-caching-and-revalidating",
+      "https://nextjs.org/docs/app/guides/incremental-static-regeneration",
+      "https://nextjs.org/docs/app/api-reference/functions/revalidateTag"
+    ],
+    "security_notes": "Cross-user Data Cache leakage (caching a per-user response as if it were shared/public) is a data-exposure defect, not merely a performance nit — this skill escalates such findings to HIGH severity and requires a security-review sign-off, not just a caching-strategy note. Static-review-only skill: it reads and greps route/fetch source but never executes, builds, or runs application code. Treat any hardcoded API key, token, or credential found in a fetch() call or header as a HIGH-severity finding requiring immediate escalation.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/nextjs-rendering-caching-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "nextjs-server-security-review",
+    "name": "Next.js Server Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Next.js middleware, Server Actions, next.config.js, and environment-variable files for middleware matcher exclusions that silently skip auth on Server Functions, Server Actions missing allowedOrigins CSRF protection, secrets leaked via NEXT_PUBLIC_ prefixes, and SSRF/open-redirect via dangerouslyAllowLocalIP or unvalidated rewrite destinations, grounding claims via Context7 and Next.js's own documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nextjs.org/docs/app/building-your-application/authentication",
+      "https://nextjs.org/docs/app/guides/data-security",
+      "https://nextjs.org/docs/app/guides/environment-variables",
+      "https://nextjs.org/docs/app/api-reference/file-conventions/proxy",
+      "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery",
+      "https://owasp.org/www-community/attacks/xss/"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: a middleware matcher exclusion is a zero-trust boundary defect (authorization silently skipped on excluded paths), a missing serverActions.allowedOrigins is a CSRF gap, a NEXT_PUBLIC_-prefixed secret is a build-time data exposure with no runtime remediation once shipped, and dangerouslyAllowLocalIP or an unvalidated rewrite destination is a server-side request forgery / open-redirect vector. Every finding in this skill defaults to HIGH severity unless proven otherwise with concrete repo evidence. Static-review-only skill: it reads and greps middleware, Server Action, config, and environment files but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/nextjs-server-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "nuxt-fullstack-security-review",
+    "name": "Nuxt Fullstack Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Nuxt 3/4 full-stack code for private secrets exposed via runtimeConfig.public/NUXT_PUBLIC_* env vars, useState/module-scope cross-request state pollution in Nitro, server-route SSRF via $fetch/ofetch with blind useRequestHeaders/credential forwarding, NuxtPayload/useState serialization reaching an XSS sink, and missing security response headers (routeRules headers, the nuxt-security module), grounding claims via Context7 and Nuxt's own documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nuxt.com/docs/guide/going-further/runtime-config",
+      "https://nuxt.com/docs/getting-started/state-management",
+      "https://nuxt.com/docs/guide/directory-structure/server",
+      "https://nuxt.com/docs/getting-started/data-fetching",
+      "https://nuxt.com/docs/api/composables/use-request-headers",
+      "https://nuxt.com/docs/api/composables/use-response-header",
+      "https://nuxt.com/docs/guide/concepts/rendering",
+      "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery",
+      "https://owasp.org/www-community/attacks/xss/"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: a runtimeConfig.public/NUXT_PUBLIC_* secret is a client-bundle credential leak, useState/module-scope pollution in Nitro is a cross-tenant/cross-user data-exposure defect, server-route SSRF and blind header forwarding can leak credentials or reach internal network targets, payload/useState reaching an unsanitized sink is XSS, and missing security response headers weakens the app's baseline browser-side defenses. Every finding in this skill defaults to HIGH severity unless proven otherwise with concrete evidence (a private key correctly scoped, an allowlisted outbound host, a sanitizer visibly on the traced path, or documented header coverage of the routes in scope). Static-review-only skill: it reads and greps nuxt.config.ts, composables/plugins/server code, and templates but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/nuxt-fullstack-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "nvidia-agentic-ai-platform-review",
     "name": "NVIDIA Agentic AI Platform Review",
@@ -12518,6 +13579,33 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "pci-payment-ui-security-review",
+    "name": "PCI Payment UI Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews payment-collection frontend code for the PCI-DSS-relevant frontend defect classes: raw PAN/CVV collection in self-controlled inputs instead of Stripe hosted fields, card data persisted client-side or to analytics, raw card data POSTed to a first-party endpoint before tokenization, and third-party scripts loaded without Subresource Integrity — grounded via Context7 Stripe documentation and PCI-DSS v4 script-security requirements (standard-based).",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.stripe.com/js/elements_object/create",
+      "https://docs.stripe.com/security/guide#validating-pci-compliance",
+      "https://www.pcisecuritystandards.org/document_library/",
+      "https://www.pcisecuritystandards.org/documents/SAQ-A-r2-v4_0.pdf"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: raw PAN/CVV collection outside a Stripe-controlled iframe, client-side persistence of cardholder data, and unsigned third-party scripts on payment pages are all cardholder-data-exposure or code-tampering vectors. Every finding in this skill defaults to HIGH severity unless proven otherwise with concrete evidence of iframe isolation, tokenization-before-POST, or a visible integrity attribute. This is the FRONTEND slice of PCI-DSS only — it is NOT a full PCI-DSS audit; server-side cardholder-data-environment segmentation, network controls, and key management are explicitly out of scope. Static-review-only skill: it reads and greps payment-page source but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/pci-payment-ui-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "playwright-e2e-execution-run",
     "name": "Playwright E2E Execution Run",
@@ -12777,6 +13865,35 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "product-analytics-experimentation-review",
+    "name": "Product Analytics & Experimentation Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews frontend analytics instrumentation and A/B/multivariate experiment setups for event-schema correctness, sample-ratio-mismatch risk, valid statistical stopping rules, and consent-gated privacy compliance before an experiment or tracking change ships.",
+    "source_type": "adapted",
+    "official_docs": [
+      "https://web.dev/articles/vitals-business-impact",
+      "https://developers.google.com/analytics/devguides/collection/ga4",
+      "https://gdpr.eu/cookies/",
+      "https://www.w3.org/TR/permissions/",
+      "https://developers.google.com/tag-platform/security/guides/consent",
+      "https://iabeurope.eu/iab-europe-transparency-consent-framework/"
+    ],
+    "security_notes": "Require consent-gate verification before any non-essential tracking call is approved; require PII scrubbing/hashing review on every new event schema field before it is marked shippable. Also check IAB TCF v2.2 purpose/vendor-granular consent, Google Consent Mode v2 synchronous default-denied timing, GPC/Do-Not-Track honoring, cookie categorization/expiry, and analytics-endpoint data residency. Read-only static review; does not execute experiment code, query a live analytics backend, or change a live feature-flag/experiment configuration.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/product-analytics-experimentation-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "programmatic-supply-chain-integrity-review",
     "name": "Programmatic Supply Chain Integrity Review",
@@ -12810,28 +13927,138 @@
     "id": "prometheus-alerting-cardinality-review",
     "name": "Prometheus Alerting and Cardinality Review",
     "type": "skill",
-    "provider": "prometheus",
+    "provider": "prometheus",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Review Prometheus and AlertManager configuration for cardinality explosion, recording rules, alert expression correctness, routing, scrape security, and retention.",
+    "source_type": "original",
+    "official_docs": [
+      "https://prometheus.io/docs/prometheus/latest/querying/basics/",
+      "https://prometheus.io/docs/practices/naming/",
+      "https://prometheus.io/docs/practices/alerting/",
+      "https://prometheus.io/docs/alerting/latest/alertmanager/",
+      "https://prometheus.io/docs/prometheus/latest/storage/",
+      "https://prometheus.io/docs/practices/remote_write/"
+    ],
+    "security_notes": "honor_labels: true on untrusted scrape targets allows the scraped workload to override job/instance labels, enabling metric spoofing. Scrape configs pointing to external HTTP endpoints are SSRF candidates.",
+    "last_verified": "2026-05-02",
+    "path": "skills/prometheus/prometheus-alerting-cardinality-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "pwa-offline-readiness-review",
+    "name": "PWA Offline Readiness Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Validates installability against W3C manifest criteria and tests real offline navigation behavior end to end, rejecting a manifest-schema-valid but practically non-installable or non-functional-offline PWA.",
+    "source_type": "original",
+    "official_docs": [
+      "https://w3c.github.io/manifest/",
+      "https://web.dev/articles/installable-manifest",
+      "https://web.dev/articles/offline-fallback-page",
+      "https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Manifest",
+      "https://developer.mozilla.org/en-US/docs/Web/API/BeforeInstallPromptEvent",
+      "https://web.dev/articles/lighthouse-pwa"
+    ],
+    "security_notes": "Manifest and service-worker files must be served over HTTPS (a hard W3C/browser installability requirement, not a preference); flag any start_url or icon reference pointing to an HTTP origin or third-party CDN without integrity guarantees. Do not recommend caching the offline-fallback page's embedded data if it contains anything user-specific/authenticated -- the fallback route must be static/public content only.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/pwa-offline-readiness-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "react-component-architecture-review",
+    "name": "React Component Architecture Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews React component trees for composition, prop-interface, and separation-of-concerns defects that erode testability and maintainability, using React's own composition guidance (component decomposition, lifting state, context) loaded progressively and grounded via Context7 against the repo's confirmed React version.",
+    "source_type": "original",
+    "official_docs": [
+      "https://react.dev/learn/thinking-in-react",
+      "https://react.dev/learn/passing-props-to-a-component",
+      "https://react.dev/learn/sharing-state-between-components",
+      "https://react.dev/reference/rules/rules-of-hooks"
+    ],
+    "security_notes": "Static-review-only skill: it reads and greps component source but never executes, builds, or runs application code. Do not review or execute application secrets; treat any API key or token found hardcoded in component props or default values as a HIGH-severity finding requiring immediate escalation, not a style note.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/react-component-architecture-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "react-rsc-data-boundary-review",
+    "name": "React RSC Data Boundary Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews React Server Components code for data leaks across the server-to-client serialization boundary: secrets passed as props to Client Components, server-only modules missing the server-only guard, use server actions with no authorization check, non-public environment variables read in use client modules, and tainted values crossing the boundary unnarrowed, grounding claims via Context7 and React's and Next.js's own documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://react.dev/reference/rsc/server-components",
+      "https://react.dev/reference/react/experimental_taintUniqueValue",
+      "https://nextjs.org/docs/app/getting-started/server-and-client-components",
+      "https://nextjs.org/docs/app/guides/data-security"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: a secret crossing the server-to-client serialization boundary is a data-exposure defect (potential credential/token leakage to every browser rendering the page), a missing server-only guard risks accidental client-bundle inclusion of secret-reading code, an unauthorized use server action is a mutation/IDOR vector, and non-public env exposure in a use client module signals a broken trust boundary. Every finding in this skill defaults to HIGH severity unless proven otherwise with concrete guard/narrowing evidence. Static-review-only skill: it reads and greps Server/Client Component source and server actions but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/react-rsc-data-boundary-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "react-state-effects-review",
+    "name": "React State & Effects Review",
+    "type": "skill",
+    "provider": "frontend",
     "harnesses": [
-      "codex",
       "claude-code",
       "cursor",
+      "codex",
       "gemini",
       "kiro",
       "other"
     ],
-    "summary": "Review Prometheus and AlertManager configuration for cardinality explosion, recording rules, alert expression correctness, routing, scrape security, and retention.",
+    "summary": "Reviews useState/useEffect/useReducer usage for the documented anti-patterns (unneeded effects, missing cleanup, race conditions, stale closures), classifying each effect against React's own 'You Might Not Need an Effect' catalog and grounding every claim via Context7 against the repo's confirmed React version.",
     "source_type": "original",
     "official_docs": [
-      "https://prometheus.io/docs/prometheus/latest/querying/basics/",
-      "https://prometheus.io/docs/practices/naming/",
-      "https://prometheus.io/docs/practices/alerting/",
-      "https://prometheus.io/docs/alerting/latest/alertmanager/",
-      "https://prometheus.io/docs/prometheus/latest/storage/",
-      "https://prometheus.io/docs/practices/remote_write/"
+      "https://react.dev/learn/you-might-not-need-an-effect",
+      "https://react.dev/learn/synchronizing-with-effects",
+      "https://react.dev/reference/react/useEffect",
+      "https://react.dev/learn/removing-effect-dependencies"
     ],
-    "security_notes": "honor_labels: true on untrusted scrape targets allows the scraped workload to override job/instance labels, enabling metric spoofing. Scrape configs pointing to external HTTP endpoints are SSRF candidates.",
-    "last_verified": "2026-05-02",
-    "path": "skills/prometheus/prometheus-alerting-cardinality-review",
+    "security_notes": "Static-review-only skill: it reads and greps component source but never executes, builds, or runs application code. Flag effects that perform authenticated writes (mutations) without idempotency/cancellation guards — a race condition here can cause duplicate financial or state-changing operations, not just a UI bug — as a HIGH-severity finding requiring immediate escalation, not a style note.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/react-state-effects-review",
     "version": "0.1.0",
     "author": "github: Raishin"
   },
@@ -12899,6 +14126,33 @@
     "version": "0.1.2",
     "lifecycle": "experimental"
   },
+  {
+    "id": "routing-navigation-review",
+    "name": "Routing & Navigation Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews route-tree structure, loader/action placement, code-splitting, and navigation-blocking/focus-management for correctness, security enforcement, and accessibility conformance.",
+    "source_type": "original",
+    "official_docs": [
+      "https://reactrouter.com/start/framework/route-module",
+      "https://reactrouter.com/start/data/actions",
+      "https://nextjs.org/docs/app/building-your-application/routing/dynamic-routes",
+      "https://www.w3.org/WAI/ARIA/apg/patterns/"
+    ],
+    "security_notes": "Client-side-only route guards (hiding a nav link, redirecting in a component) are UX only; treat any route lacking a paired server-side enforcement point (loader auth check, middleware, or BFF authorization) as a blocking security finding. Static-review-only skill: it reads and greps route source but never executes, builds, or runs application code.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/routing-navigation-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "rpa-workflow-resilience-review",
     "name": "RPA Workflow Resilience Review",
@@ -15981,6 +17235,35 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "service-worker-cache-strategy-review",
+    "name": "Service Worker Cache Strategy Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews service-worker route-matching and caching-strategy choices (precache vs. cache-first vs. network-first vs. stale-while-revalidate) against request type and security sensitivity, rejecting uniform blanket strategies and flagging authenticated/PII responses cached in the Cache API.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.chrome.com/docs/workbox/",
+      "https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API",
+      "https://developer.mozilla.org/en-US/docs/Web/API/Cache",
+      "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Vary",
+      "https://web.dev/articles/service-worker-caching-and-http-caching",
+      "https://owasp.org/www-community/attacks/Cache_Poisoning"
+    ],
+    "security_notes": "Hard-block caching of any response carrying Set-Cookie, an echoed Authorization value, or clearly PII/payment-bearing JSON without explicit, reviewed justification. Hard-block a service-worker scope broader than the routes it is meant to control unless justified. Flag cache.put() calls on opaque (no-cors) cross-origin responses as an unreviewable-content risk per OWASP cache-poisoning concerns. Do not paste real user session data, cookies, or authenticated response bodies into review examples.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/service-worker-cache-strategy-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "sigstore-cosign-supply-chain-review",
     "name": "Sigstore Cosign Supply Chain Review",
@@ -16094,6 +17377,146 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "ssr-hydration-streaming-diagnosis",
+    "name": "SSR Hydration & Streaming Diagnosis",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Diagnoses hydration-mismatch errors and streaming/Suspense-boundary placement issues to their root cause, using framework-version-specific evidence rather than guesswork, with root-cause-before-fix and auth-before-stream as hard gates.",
+    "source_type": "original",
+    "official_docs": [
+      "https://react.dev/reference/react-dom/client/hydrateRoot",
+      "https://react.dev/reference/react/Suspense",
+      "https://react.dev/reference/react/use",
+      "https://nextjs.org/docs/app/building-your-application/rendering/server-components",
+      "https://web.dev/articles/optimize-lcp"
+    ],
+    "security_notes": "Never accept suppressHydrationWarning as the fix without a documented, unavoidable non-determinism justification; treat it as a rejected finding when used without an identified root cause. Treat streaming that flushes page structure or content before an authorization check resolves as a potential information-disclosure finding requiring escalation, not a performance note. Static-review-only skill: it reads and greps component/boundary source and reported error text but never executes, builds, or runs application code.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/ssr-hydration-streaming-diagnosis",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "state-management-decision-review",
+    "name": "State Management Decision Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews whether data is correctly classified as server state vs. client state vs. derived state, and whether the resulting store/cache design (query keys, invalidation triggers, optimistic-update rollback, SSR instantiation, selector shape) avoids duplication, stale-data bugs, and unnecessary re-render cascades, grounding every TanStack Query and Zustand claim via Context7 against the repo's confirmed installed version.",
+    "source_type": "original",
+    "official_docs": [
+      "https://tanstack.com/query/latest/docs/framework/react/guides/important-defaults",
+      "https://tanstack.com/query/latest/docs/framework/react/guides/optimistic-updates",
+      "https://tanstack.com/query/latest/docs/framework/react/guides/ssr",
+      "https://zustand.docs.pmnd.rs/getting-started/introduction",
+      "https://zustand.docs.pmnd.rs/hooks/use-shallow",
+      "https://zustand.docs.pmnd.rs/middlewares/persist",
+      "https://react.dev/learn/managing-state"
+    ],
+    "security_notes": "Static-review-only skill: it reads and greps source but never executes, builds, or runs application code. Reject any store design that persists auth tokens, session identifiers, or PII to localStorage/sessionStorage without an explicit encryption/expiry justification or a documented partialize exclusion, and reject any SSR queryClient/store pattern that instantiates as a module-level singleton, which risks cross-request/cross-user data leakage. Missing optimistic-update rollback and SSR singleton instantiation are treated as HARD STOP findings, not style notes.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/state-management-decision-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "sveltekit-actions-load-security-review",
+    "name": "SvelteKit Actions & Load Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews SvelteKit form actions, load functions, and cookie/HTML bindings for CSRF origin-check bypass, unauthenticated data exposure through load(), auth guards that live only in +layout.server.js without a parent() call in child pages, insecure cookies.set() options, and unsanitized {@html} bindings, grounding claims via Context7 and SvelteKit's own CSRF, cookies, load, and authentication documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://svelte.dev/docs/kit/configuration#csrf",
+      "https://svelte.dev/docs/kit/load#Cookies",
+      "https://svelte.dev/docs/kit/load#Implications-for-authentication",
+      "https://svelte.dev/docs/kit/@sveltejs-kit#Cookies",
+      "https://svelte.dev/docs/svelte/@html"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: a disabled/bypassed CSRF check enables cross-site form submission, an unguarded load() or action leaking data via a raw cookie value is an authentication-bypass/data-exposure defect, an auth guard living only in +layout.server.js is a structural auth-boundary gap when a child page's load skips await parent() or hooks.server.js does not enforce the check first, an insecure cookies.set() call (missing/false httpOnly, secure, or sameSite, or a missing path) is a session-hijacking-adjacent cookie-policy defect, and unsanitized {@html} on user-reachable input is a stored/reflected XSS vector. Every finding in this skill defaults to HIGH severity unless proven otherwise with concrete guard/sanitizer evidence on the exact traced path. Static-review-only skill: it reads and greps svelte.config.js, +page.server.js/+layout.server.js/+server.js, form action code, and .svelte templates but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/sveltekit-actions-load-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "sveltekit-progressive-enhancement-review",
+    "name": "SvelteKit Progressive Enhancement Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews SvelteKit forms and actions for functional resilience without JavaScript and for use:enhance error-handling correctness.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kit.svelte.dev/docs/form-actions",
+      "https://svelte.dev/docs/kit/form-actions",
+      "https://www.w3.org/WAI/WCAG22/quickref/",
+      "https://owasp.org/www-project-top-ten/"
+    ],
+    "security_notes": "A custom use:enhance SubmitFunction that bypasses the form's native action/method to call a hand-rolled fetch() may skip SvelteKit's built-in CSRF-relevant origin checks applied to form actions — flag any such bypass for security review rather than treating it as a pure UX nit. Static-review-only skill: it reads and greps form/action source but never executes, builds, or runs application code.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/sveltekit-progressive-enhancement-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "sveltekit-routing-load-review",
+    "name": "SvelteKit Routing & Load Function Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews SvelteKit route files for correct universal-vs-server load placement, preventing server-only logic from executing in the browser.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kit.svelte.dev/docs/load",
+      "https://kit.svelte.dev/docs/routing",
+      "https://svelte.dev/docs/kit/load",
+      "https://svelte.dev/docs/kit/routing"
+    ],
+    "security_notes": "Server-only secrets, database clients, or privileged third-party API keys reachable from a +page.js/+layout.js (universal load, which runs in the browser too) is a credential-exposure defect — escalate as HIGH, not a style preference. Static-review-only skill: it reads and greps route source but never executes, builds, or runs application code.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/sveltekit-routing-load-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "tax-provision-advisor",
     "name": "Tax Provision Advisor",
@@ -16284,6 +17707,63 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "tree-shaking-dead-code-review",
+    "name": "Tree-Shaking & Dead-Code Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Verifies that a bundler's tree-shaking actually eliminated dead code by inspecting output bytes, module format, and sideEffects/treeshake configuration against a production-mode before/after diff, rather than trusting a clean build as proof of elimination, loaded progressively.",
+    "source_type": "original",
+    "official_docs": [
+      "https://webpack.js.org/guides/tree-shaking/",
+      "https://developer.mozilla.org/en-US/docs/Glossary/Tree_shaking",
+      "https://rollupjs.org/configuration-options/#treeshake",
+      "https://nodejs.org/api/packages.html#packagejson-and-file-extensions",
+      "https://web.dev/articles/reduce-javascript-payloads-with-tree-shaking"
+    ],
+    "security_notes": "Do not recommend blanket sideEffects: false on a package the reviewer has not verified is actually side-effect-free (e.g., polyfills, CSS imports, analytics auto-init) -- this silently drops required initialization code, which is a correctness bug, not just a size issue, and can remove security-relevant setup such as CSP nonce injection or sanitizer initialization. Require a runtime smoke test, not just a rebuild, after any sideEffects: false change. Do not accept or echo any credential-shaped string found in a pasted build config, package.json, or analyzer report as if it were safe to keep in the transcript.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/tree-shaking-dead-code-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "typescript-contracts-review",
+    "name": "TypeScript Contracts Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews tsconfig strictness posture, any/assertion usage at trust boundaries, and exported public-API type surfaces so type signatures are enforced runtime-shape guarantees rather than decorative annotations, requiring paired runtime validation wherever external data enters the type system.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://www.typescriptlang.org/docs/handbook/2/basic-types.html",
+      "https://www.typescriptlang.org/docs/handbook/release-notes/typescript-4-4.html",
+      "https://www.typescriptlang.org/docs/handbook/release-notes/typescript-4-1.html",
+      "https://www.typescriptlang.org/docs/handbook/declaration-files/introduction.html",
+      "https://typescript-eslint.io/rules/"
+    ],
+    "security_notes": "Flag any, as, and non-null assertions (!) at trust boundaries (parsed JSON, third-party SDK responses, postMessage payloads, URL/query-param parsing) without paired runtime validation — a type annotation is erased at compile time and enforces nothing against a malformed or malicious payload. Flag @ts-ignore/@ts-expect-error without an adjacent justification comment, especially on security-relevant code. Flag any proposal to loosen tsconfig strictness (removing strict, disabling strictNullChecks) without an explicit, separately-reviewed migration plan.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/typescript-contracts-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "variance-analysis-advisor",
     "name": "Variance Analysis Advisor",
@@ -16348,6 +17828,174 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "visual-regression-storybook-review",
+    "name": "Visual Regression (Storybook) Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Storybook-based visual regression and accessibility gating (test-runner, a11y addon, Chromatic integration) to ensure visually-critical components have deterministic pixel-diff and axe-core coverage before merge.",
+    "source_type": "original",
+    "official_docs": [
+      "https://storybook.js.org/docs/writing-tests/visual-testing",
+      "https://storybook.js.org/docs/writing-tests/integrations/test-runner",
+      "https://storybook.js.org/docs/writing-tests/accessibility-testing",
+      "https://www.w3.org/TR/WCAG21/#contrast-minimum"
+    ],
+    "security_notes": "Chromatic/Percy project tokens used in CI must be scoped per-project secrets, not account-wide credentials, and never committed to `chromatic.config.json` or `.storybook/main.js`. Screenshot baselines must not capture real user PII from a staging environment seeded with production-like data.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/visual-regression-storybook-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "vue-composition-api-architecture-review",
+    "name": "Vue Composition API Architecture Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Vue 3 composables and script-setup components for reactivity-boundary correctness (ref/reactive/computed usage, destructuring-loses-reactivity pitfalls, toRef/toRefs/unref interop, lifecycle-hook synchronous-registration timing) and composable extraction quality, grounding claims via Context7 against Vue's own composables and reactivity documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://vuejs.org/guide/extras/composition-api-faq.html",
+      "https://vuejs.org/guide/reusability/composables.html",
+      "https://vuejs.org/api/reactivity-core.html",
+      "https://vuejs.org/guide/essentials/reactivity-fundamentals.html"
+    ],
+    "security_notes": "Static-review-only skill: it reads and greps composable/component source but never executes, builds, or runs application code. No direct security-primitive concern; if a composable is found managing auth tokens, session state, or other credential material, flag it out of scope and recommend the vue-ssr-security-review skill instead of performing credential-handling review here.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/vue-composition-api-architecture-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "vue-router-navigation-security-review",
+    "name": "Vue Router Navigation Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Statically reviews Vue Router navigation guards, redirect flows, dynamic link bindings, and route configuration for client-side guards used as the sole authorization boundary, open redirects via route.query.redirect/returnUrl, javascript:/data: scheme injection through dynamic :to/:href bindings, reflected XSS from route params/query reaching v-html/innerHTML, guard-induced redirect loops, and catch-all/history-mode misconfiguration, grounding claims via Context7 against Vue Router's own documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://router.vuejs.org/guide/advanced/navigation-guards.html",
+      "https://router.vuejs.org/guide/essentials/redirect-and-alias.html",
+      "https://router.vuejs.org/guide/essentials/dynamic-matching.html",
+      "https://router.vuejs.org/guide/essentials/history-mode.html",
+      "https://vuejs.org/guide/best-practices/security.html",
+      "https://owasp.org/www-community/attacks/xss/",
+      "https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: a client-side-only navigation guard treated as an authorization boundary is a broken access control defect, an unvalidated route.query.redirect/returnUrl is an open-redirect vector, an unvalidated dynamic :to/:href is a javascript:/data:-scheme injection vector, and route params/query reaching v-html/innerHTML is reflected XSS. Every finding in this skill defaults to HIGH severity unless proven otherwise with concrete evidence (a confirmed server-side check, a same-origin allowlist, a protocol allowlist, or a sanitizer call on the exact traced path). Static-review-only skill: it reads and greps router configuration, guards, and template bindings but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/vue-router-navigation-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "vue-ssr-security-review",
+    "name": "Vue SSR Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Vue 3 SSR entry points and templates for cross-request state pollution (module-scope reactive state, non-per-request app/store/router creation) and injection via unsanitized v-html or unvalidated dynamic href/src bindings, grounding claims via Context7 and Vue's own SSR and security best-practices documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://vuejs.org/guide/scaling-up/ssr.html",
+      "https://vuejs.org/guide/best-practices/security.html",
+      "https://owasp.org/www-project-top-ten/",
+      "https://owasp.org/www-community/attacks/xss/"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: cross-request state pollution is a data-exposure defect (potential cross-tenant/cross-user leakage) and unsanitized v-html is a stored/reflected XSS vector. Every finding in this skill defaults to HIGH severity unless proven otherwise with concrete sanitizer evidence. Static-review-only skill: it reads and greps SSR entry points and template source but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/vue-ssr-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "vue-state-store-security-review",
+    "name": "Vue State Store Security Review",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reviews Pinia and legacy Vuex state stores for sensitive data persisted to localStorage/sessionStorage without scoping, untrusted server-payload hydration (window.__pinia/__INITIAL_STATE__) with un-escaped state serialization, SSR store-singleton cross-request pollution, store plugins/$subscribe/$onAction acting on untrusted payloads, client-held role flags used as an authorization source of truth, and devtools state exposure in production builds, grounding claims via Context7 and each library's own documentation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://pinia.vuejs.org/ssr/",
+      "https://pinia.vuejs.org/core-concepts/plugins.html",
+      "https://github.com/prazdevs/pinia-plugin-persistedstate/blob/main/docs/guide/config.md",
+      "https://vuex.vuejs.org/guide/modules.html",
+      "https://vuex.vuejs.org/api/",
+      "https://owasp.org/www-project-top-ten/",
+      "https://owasp.org/www-community/attacks/xss/"
+    ],
+    "security_notes": "This skill's entire scope is security-critical: unscoped client-side persistence of tokens/PII is an XSS-exfiltratable data-exposure vector, untrusted/un-escaped state hydration is an XSS and data-integrity vector, SSR store-singleton pollution is a cross-tenant/cross-user data-exposure defect, untrusted payload handling in store plugins/hooks can drive unsanitized writes or calls, client-held role flags used as an authorization source of truth is a broken-access-control defect, and production devtools exposure leaks the full state tree to any user with browser devtools open. Every finding in this skill defaults to HIGH severity unless proven otherwise with concrete evidence (a pick/paths scope, an escaping call, a per-request creation trace, a server-side re-check). Static-review-only skill: it reads and greps store definitions, persistence config, SSR entry points, and plugin/hook code but never executes, builds, or runs application code, and never sends live requests.",
+    "last_verified": "2026-07-03",
+    "path": "skills/frontend/vue-state-store-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "wcag-22-accessibility-audit",
+    "name": "WCAG 2.2 Accessibility Audit",
+    "type": "skill",
+    "provider": "frontend",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Progressive-disclosure skill for auditing frontend markup/components against WCAG 2.2 A/AA success criteria and ARIA APG patterns, separating automated-detectable failures from manual-verification items with legal-exposure flags.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.w3.org/TR/WCAG22/",
+      "https://www.w3.org/WAI/WCAG22/quickref/",
+      "https://www.w3.org/WAI/ARIA/apg/",
+      "https://www.w3.org/WAI/standards-guidelines/act/rules/"
+    ],
+    "security_notes": "Redact PII found in audited fixtures before including in reports. Never represent automated-only scan results as full WCAG conformance; axe-core-class tooling documents ~30-50% detection coverage. Do not treat this skill's static-review output as a substitute for a legal accessibility conformance opinion.",
+    "last_verified": "2026-07-02",
+    "path": "skills/frontend/wcag-22-accessibility-audit",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "working-capital-advisor",
     "name": "Finance Working Capital Advisor",