@raishin/vanguard-frontier-agentic 3.1.1 → 3.3.0

package/catalog/skill-manifest.json

@@ -5202,6 +5202,38 @@
         }
       ]
     },
+    {
+      "id": "composer-audit-supply-chain-review",
+      "path": "skills/php/composer-audit-supply-chain-review",
+      "aggregate_sha256": "c3377c8d185099569bf553fd2322dbbdef16c66adde647e63ba326f6a1308a23",
+      "files": [
+        {
+          "path": "skills/php/composer-audit-supply-chain-review/SKILL.md",
+          "sha256": "62f84bf9a976b1930ed7982191b260b7e9bb1d6b0dcf977fb006ac42dda2c1fe",
+          "bytes": 9850
+        },
+        {
+          "path": "skills/php/composer-audit-supply-chain-review/metadata.json",
+          "sha256": "2ccbf8ee09124cfff6c7baa6ca53fee811a5b548cd1f05547893856d0d4cdd76",
+          "bytes": 1257
+        },
+        {
+          "path": "skills/php/composer-audit-supply-chain-review/references/abandoned-and-advisory-governance.md",
+          "sha256": "496dee36096d54bb84e89e043d1ac37314db99bedb729feaef015f55a268aeb2",
+          "bytes": 4580
+        },
+        {
+          "path": "skills/php/composer-audit-supply-chain-review/references/composer-audit-policy.md",
+          "sha256": "d4c972b8d119c741a4b0bdd39e11789f844cc3a14ac7c9a67d1e7078b74c6e45",
+          "bytes": 4087
+        },
+        {
+          "path": "skills/php/composer-audit-supply-chain-review/references/lockfile-integrity.md",
+          "sha256": "b54f9ae05130466abebe8f60f1ae10985c95e964ee1ec2bf92401bd1e304f045",
+          "bytes": 3899
+        }
+      ]
+    },
     {
       "id": "consolidation-intercompany-advisor",
       "path": "skills/accounting/consolidation-intercompany-advisor",
@@ -7934,12 +7966,12 @@
     {
       "id": "gcp-firebase-developer",
       "path": "skills/gcp/gcp-firebase-developer",
-      "aggregate_sha256": "0fd9c972fec268d93ce0fe5c6627473b4d3f2cb66b61e0f3dc98756cc1451b7e",
+      "aggregate_sha256": "13bb47e825caea1f232efa782939a67431499f5df3d36329456d41ea11940172",
       "files": [
         {
           "path": "skills/gcp/gcp-firebase-developer/SKILL.md",
-          "sha256": "354984dca52b3cd7e266bb644c5b0d7f9f2eaa07704e4ee4aec4eb19323b1530",
-          "bytes": 3941
+          "sha256": "ce51fc92c462987684cf9582dbfbe5c8f86d07205e715f2d71f839d7c4fd4354",
+          "bytes": 3978
         },
         {
           "path": "skills/gcp/gcp-firebase-developer/metadata.json",
@@ -7995,12 +8027,12 @@
     {
       "id": "gcp-gke-platform-operator",
       "path": "skills/gcp/gcp-gke-platform-operator",
-      "aggregate_sha256": "07344007b02ed6fda023660bc6645dae23e37e30d6eed913580dbefa3a777d95",
+      "aggregate_sha256": "e5a920c41a155e227629a1dffb32684bfefb1cd171ee8849901cc57de5b0e8f1",
       "files": [
         {
           "path": "skills/gcp/gcp-gke-platform-operator/SKILL.md",
-          "sha256": "dca85f97eb3462864d94394d50f4fcb97ce0583a314f57c104978727d9224d6f",
-          "bytes": 6979
+          "sha256": "7d277f1cdcf12b1be7c5568f82d4f5ff749f223661041aa589a9a349b1036319",
+          "bytes": 7026
         },
         {
           "path": "skills/gcp/gcp-gke-platform-operator/assets/default-deny-netpol.yaml",
@@ -15429,6 +15461,97 @@
         }
       ]
     },
+    {
+      "id": "php-maestro",
+      "path": "skills/php/php-maestro",
+      "aggregate_sha256": "17e9b03cb320fc090abe5e52581bf77d5a20a4ceb7cd478a6206a9e02634fa2e",
+      "files": [
+        {
+          "path": "skills/php/php-maestro/SKILL.md",
+          "sha256": "535c601d6081c2a9209e777d415d8760039a7207a0d58171974bdac878374a80",
+          "bytes": 4876
+        },
+        {
+          "path": "skills/php/php-maestro/metadata.json",
+          "sha256": "c89893c0bc106406765a54a4b671cb9124260a28ad4173d5a6e21be2d9725149",
+          "bytes": 1175
+        },
+        {
+          "path": "skills/php/php-maestro/references/hard-gates-and-escalation.md",
+          "sha256": "ba6f3c5cde7a17a81a880b4cce8e9451a4042a17f2ef58128e3e8ac49b8cdfdd",
+          "bytes": 8276
+        },
+        {
+          "path": "skills/php/php-maestro/references/routing-and-dispatch.md",
+          "sha256": "c0acf57da526b9c778ba81edcbc0638e8ac8d39382d363ba3cbe2477448e00b8",
+          "bytes": 6424
+        }
+      ]
+    },
+    {
+      "id": "php-runtime-eol-opcache-fpm-review",
+      "path": "skills/php/php-runtime-eol-opcache-fpm-review",
+      "aggregate_sha256": "2cd92ae849faa02a57746e060eed0d7ad4004c6f18df5dfbac4cd4ece610532d",
+      "files": [
+        {
+          "path": "skills/php/php-runtime-eol-opcache-fpm-review/SKILL.md",
+          "sha256": "c1e2af8494d0deaf98826c5fc8804c3778e03ca88d197b8035330dfdc9b7498f",
+          "bytes": 10212
+        },
+        {
+          "path": "skills/php/php-runtime-eol-opcache-fpm-review/metadata.json",
+          "sha256": "e7fcb85afe025d84a66215136946b502560def68587ae7c2200c21c98a6eddd0",
+          "bytes": 1323
+        },
+        {
+          "path": "skills/php/php-runtime-eol-opcache-fpm-review/references/opcache-production-config.md",
+          "sha256": "b754752212b66f86626081648258626c9d7c4963de19edd19cbb148a5afa638c",
+          "bytes": 5289
+        },
+        {
+          "path": "skills/php/php-runtime-eol-opcache-fpm-review/references/php-fpm-pool-tuning.md",
+          "sha256": "15a3deda73ab94043b9f622b36474786a44dd0bad51474fe13808584f858efed",
+          "bytes": 5221
+        },
+        {
+          "path": "skills/php/php-runtime-eol-opcache-fpm-review/references/php-version-lifecycle.md",
+          "sha256": "bc1321ec5373830826045a1c50e4ef93df3b39411a6211ead1c84c0a716a17a6",
+          "bytes": 5290
+        }
+      ]
+    },
+    {
+      "id": "php-session-upload-deserialization-review",
+      "path": "skills/php/php-session-upload-deserialization-review",
+      "aggregate_sha256": "41bf2ca365eb9ca89e45b4ab6b1448cb1a802ca39d9e546a1ab0c34e81034681",
+      "files": [
+        {
+          "path": "skills/php/php-session-upload-deserialization-review/SKILL.md",
+          "sha256": "99ce28f016c9b6f08cd197050652cb9a1b1f39de0561da9c2a3a5dcaeebbfc3c",
+          "bytes": 11062
+        },
+        {
+          "path": "skills/php/php-session-upload-deserialization-review/metadata.json",
+          "sha256": "e9fc492c9ff291fcd00ffe3d50aa4a568392ade1a701886d33e18b21ec9196df",
+          "bytes": 1399
+        },
+        {
+          "path": "skills/php/php-session-upload-deserialization-review/references/file-upload-security.md",
+          "sha256": "4c9ccc9d573a57659047e18e5e62ed6ca4a1571dae4e1eeb0bcf0f703d26865e",
+          "bytes": 6685
+        },
+        {
+          "path": "skills/php/php-session-upload-deserialization-review/references/session-security.md",
+          "sha256": "f4b87684505736a5e2669f5c4b4b98d1b1508100e76338ebf07b14d93f65eb79",
+          "bytes": 7438
+        },
+        {
+          "path": "skills/php/php-session-upload-deserialization-review/references/unserialize-object-injection.md",
+          "sha256": "f948371da8cd628a514e9442feba66b4ac465b7c3273db086d69adc3180d6917",
+          "bytes": 7828
+        }
+      ]
+    },
     {
       "id": "playwright-e2e-execution-run",
       "path": "skills/qa/playwright-e2e-execution-run",
@@ -15881,6 +16004,53 @@
         }
       ]
     },
+    {
+      "id": "revenue-critical-journey-integrity-review",
+      "path": "skills/cross-functional/revenue-critical-journey-integrity-review",
+      "aggregate_sha256": "b0489cf2102b6d5bcb5b42d9bf9d244d79b9fa4fe1df56b728a634b7a728f709",
+      "files": [
+        {
+          "path": "skills/cross-functional/revenue-critical-journey-integrity-review/SKILL.md",
+          "sha256": "f613ce3dba633095f5b9e5606c56f77544f7576fb0f623efae6ca362ba86069f",
+          "bytes": 8610
+        },
+        {
+          "path": "skills/cross-functional/revenue-critical-journey-integrity-review/metadata.json",
+          "sha256": "822c9e6b6a694fa84be9a0cb2c0df2ea8d955fad270465febee47db858fbedcb",
+          "bytes": 1938
+        },
+        {
+          "path": "skills/cross-functional/revenue-critical-journey-integrity-review/references/idempotency-and-safe-retries.md",
+          "sha256": "1cc074f778e8c4e5aba9ec17b7e3b5778e2cfcd27594b073b18ea5bcc998d0a8",
+          "bytes": 8792
+        },
+        {
+          "path": "skills/cross-functional/revenue-critical-journey-integrity-review/references/official-sources.md",
+          "sha256": "ab78b9b45954bc4fd5f9a776745b761ecca3bfb7bf0604123690c21da9780491",
+          "bytes": 9440
+        },
+        {
+          "path": "skills/cross-functional/revenue-critical-journey-integrity-review/references/pci-saq-scope-boundaries.md",
+          "sha256": "be944693687316cbbc02e603e89a686e84dc8248a928aea37d932c47dd617486",
+          "bytes": 7386
+        },
+        {
+          "path": "skills/cross-functional/revenue-critical-journey-integrity-review/references/server-side-revalidation-trust-boundary.md",
+          "sha256": "be5aa9b4be7724f0a0ab9a9344a5b3eb7e7cc125af1d89a8142e707bd3a84257",
+          "bytes": 7285
+        },
+        {
+          "path": "skills/cross-functional/revenue-critical-journey-integrity-review/references/webhook-delivery-dedup-ordering.md",
+          "sha256": "bdfc18424c90c3534efb3dff4b65a93223249e8f3a2913604d7ba813c21141fb",
+          "bytes": 8085
+        },
+        {
+          "path": "skills/cross-functional/revenue-critical-journey-integrity-review/references/workflow-and-output.md",
+          "sha256": "c78c79b98c5536a757e61f7dcdc051e24dbcfebfe631363ac66f71827b1c4c7e",
+          "bytes": 5892
+        }
+      ]
+    },
     {
       "id": "revenue-recognition-advisor",
       "path": "skills/accounting/revenue-recognition-advisor",
@@ -16029,12 +16199,12 @@
     {
       "id": "salesforce-agentforce-stdm-observer-skill",
       "path": "skills/salesforce/salesforce-agentforce-stdm-observer-skill",
-      "aggregate_sha256": "019d2e3b966fa1546247dbd71843845569efb13d007db327554f040d97ff3782",
+      "aggregate_sha256": "a9a424f037b374542814f2a07e7bb78779a0d8240774309a67d4f1292f7aa645",
       "files": [
         {
           "path": "skills/salesforce/salesforce-agentforce-stdm-observer-skill/SKILL.md",
-          "sha256": "ca4dd3173e73618a1c9e90ae72a4edca0b0d86901d4d828a461fbe875dbd9878",
-          "bytes": 25359
+          "sha256": "87d016f4015459fee8f3dba9d5bc59fe6e25cd06a4e438b1819a89012a4d6fbe",
+          "bytes": 25402
         },
         {
           "path": "skills/salesforce/salesforce-agentforce-stdm-observer-skill/metadata.json",
@@ -16093,12 +16263,12 @@
     {
       "id": "salesforce-apex-log-analyzer-skill",
       "path": "skills/salesforce/salesforce-apex-log-analyzer-skill",
-      "aggregate_sha256": "2dc74c299a51a80226817c326335eca74a0703a1acb9132b319dde91d781571e",
+      "aggregate_sha256": "4b2d78e2bb92311c34d00bd077eee5d72e183a5b4270c2be5eb6d06230e797f6",
       "files": [
         {
           "path": "skills/salesforce/salesforce-apex-log-analyzer-skill/SKILL.md",
-          "sha256": "7ba1f9c37f1a21d24703bfac285d699e971356109d15b80ee026276cbf1c7d75",
-          "bytes": 15064
+          "sha256": "278bc31b69cfa2de5dc2010188f463d3eb8632b8dea1ebfacb04a5a7ed4ae03d",
+          "bytes": 15087
         },
         {
           "path": "skills/salesforce/salesforce-apex-log-analyzer-skill/metadata.json",
@@ -16189,12 +16359,12 @@
     {
       "id": "salesforce-apex-test-runner-skill",
       "path": "skills/salesforce/salesforce-apex-test-runner-skill",
-      "aggregate_sha256": "8e713288e2a065282f99f766af7e976d76c304e2a25f14853ac83b5337245496",
+      "aggregate_sha256": "58b5db96582f9a45d5fcf7f8da3ff1797a9d85c0aef50a3918a01248ccf0ece1",
       "files": [
         {
           "path": "skills/salesforce/salesforce-apex-test-runner-skill/SKILL.md",
-          "sha256": "73485bf51862577bf88e54900aafafd157202f9347247e9544dc797531ff3bda",
-          "bytes": 14244
+          "sha256": "788abd552e8397fd3caa9415a9ad710958ba375541b4fa223d8f03a46971400a",
+          "bytes": 14246
         },
         {
           "path": "skills/salesforce/salesforce-apex-test-runner-skill/metadata.json",
@@ -16754,12 +16924,12 @@
     {
       "id": "salesforce-soql-explorer-skill",
       "path": "skills/salesforce/salesforce-soql-explorer-skill",
-      "aggregate_sha256": "bd81df1fee07cee811d894d1e21259df4127b13f8b68ff5f6727b25c7e45c56c",
+      "aggregate_sha256": "ea59c236676db10d51bac129fa8de9f9228df8e03a7d36636181aefcace9b34d",
       "files": [
         {
           "path": "skills/salesforce/salesforce-soql-explorer-skill/SKILL.md",
-          "sha256": "fd91f2a3eb92397c56b4fe9cdf2342f4557f5f5dff30e1789eb507fdf788b346",
-          "bytes": 16240
+          "sha256": "f313edf1aa2d0a431062d2b62ce1edb426e0529b5c78a5c34a1560a0ed515f55",
+          "bytes": 16279
         },
         {
           "path": "skills/salesforce/salesforce-soql-explorer-skill/metadata.json",
@@ -19580,6 +19750,38 @@
         }
       ]
     },
+    {
+      "id": "wordpress-rest-block-security-review",
+      "path": "skills/php/wordpress-rest-block-security-review",
+      "aggregate_sha256": "cf9bd2d1a606930912139e6be2e54f732c05fe933459b38d8c42ee55c3b873bd",
+      "files": [
+        {
+          "path": "skills/php/wordpress-rest-block-security-review/SKILL.md",
+          "sha256": "6e954dea89dae85879253af108a024285249448dbef430b9c02113c5d884c51f",
+          "bytes": 9742
+        },
+        {
+          "path": "skills/php/wordpress-rest-block-security-review/metadata.json",
+          "sha256": "a6957fbc423c31a327882fdead0f9f9515be4089d142e223d915c05c47505a03",
+          "bytes": 1482
+        },
+        {
+          "path": "skills/php/wordpress-rest-block-security-review/references/dynamic-block-output-escaping.md",
+          "sha256": "33ccadd8ea180193d0b4bcdf955e4e21758d93555e9813c4da6c20f141d5c277",
+          "bytes": 4855
+        },
+        {
+          "path": "skills/php/wordpress-rest-block-security-review/references/input-sanitize-output-escape.md",
+          "sha256": "28f793cab2597635984f2df2bb381da452ad7f548b567a84b8ed8de2762efb60",
+          "bytes": 9985
+        },
+        {
+          "path": "skills/php/wordpress-rest-block-security-review/references/rest-api-permission-callback.md",
+          "sha256": "b96e69dfeec5691ce96af5e6d6a57c44128c96c57cab2a64ad16e0ea9801a1a0",
+          "bytes": 6800
+        }
+      ]
+    },
     {
       "id": "working-capital-advisor",
       "path": "skills/finance/working-capital-advisor",

package/catalog/skills.json

@@ -4294,6 +4294,33 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "composer-audit-supply-chain-review",
+    "name": "Composer Audit & Supply-Chain Review",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing Composer dependency supply-chain posture: composer audit advisory scanning and CI exit-code gating, config.policy advisory/abandoned settings, and composer.lock integrity and drift, so a vulnerable or abandoned Packagist dependency cannot reach production ungated.",
+    "source_type": "original",
+    "official_docs": [
+      "https://getcomposer.org/doc/03-cli.md",
+      "https://getcomposer.org/doc/06-config.md",
+      "https://getcomposer.org/doc/01-basic-usage.md",
+      "https://owasp.org/www-project-top-ten/"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no network mutation. Never installs, updates, or requires packages. Reports composer audit posture from configuration and lockfile evidence, never fabricates advisory identifiers, and treats any credential in auth.json or configuration as a redact-and-flag finding.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/composer-audit-supply-chain-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "consolidation-intercompany-advisor",
     "name": "Consolidation & Intercompany Advisor",
@@ -13606,6 +13633,86 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "php-maestro",
+    "name": "PHP Maestro",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Routing skill for the PHP board: classifies an incoming PHP task and dispatches to the narrowest specialist (application security, Composer supply-chain, runtime/EOL and OPcache/FPM, or WordPress security), caps parallel dispatch, enforces the blocking hard-gate taxonomy, and refuses live-mutation requests.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.php.net/docs.php",
+      "https://www.php.net/supported-versions.php",
+      "https://getcomposer.org/doc/03-cli.md",
+      "https://developer.wordpress.org/apis/security/"
+    ],
+    "security_notes": "Routing only; performs no review and makes no code changes. Refuses destructive/live-mutation requests and requires human confirmation. Never fabricates a routing target outside the registered PHP board, preserves specialist evidence labels, and never requests or echoes secrets or customer data.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/php-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "php-runtime-eol-opcache-fpm-review",
+    "name": "PHP Runtime EOL, OPcache & PHP-FPM Review",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing PHP runtime upgrade readiness and production hardening: EOL and security-only version exposure against php.net's four-year support lifecycle, OPcache production configuration (validate_timestamps, memory sizing), and PHP-FPM pool tuning (pm, max_children, max_requests), treating an EOL runtime as a blocking finding.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.php.net/supported-versions.php",
+      "https://www.php.net/manual/en/opcache.configuration.php",
+      "https://www.php.net/manual/en/install.fpm.configuration.php"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no configuration changes. PHP version lifecycle dates are encoded only from php.net's supported-versions page as fixed ground truth (never invented, rounded, or extrapolated); a version's current lifecycle phase is determined by comparing those published dates against the review date.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/php-runtime-eol-opcache-fpm-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "php-session-upload-deserialization-review",
+    "name": "PHP Session, Upload & Deserialization Security Review",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing PHP application-security seams: user-reachable unserialize() object injection (allowed_classes is insufficient), session fixation/hijacking hardening (session_regenerate_id, use_strict_mode, cookie flags), and unsafe file-upload handling, each mapped to an OWASP category and the php.net-documented fix.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.php.net/manual/en/function.unserialize.php",
+      "https://www.php.net/manual/en/session.security.php",
+      "https://www.php.net/manual/en/features.file-upload.common-pitfalls.php",
+      "https://owasp.org/www-project-top-ten/"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no network. Never runs deserialization payloads, uploads, or exploits against any live or staging system. Any credential- or PII-shaped string is a redact-and-flag finding, never echoed. Every unserialize()/session/upload claim is grounded in current php.net documentation, not memory.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/php-session-upload-deserialization-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "playwright-e2e-execution-run",
     "name": "Playwright E2E Execution Run",
@@ -14062,6 +14169,35 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "revenue-critical-journey-integrity-review",
+    "name": "Revenue-Critical Journey Integrity Review",
+    "type": "skill",
+    "provider": "generic",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing the cross-tier seams of revenue-critical journeys (checkout, payment, account creation, login): idempotency of money-moving and account-creating requests, server-side re-validation of client-enforced rules, webhook duplicate/out-of-order handling, retry-storm safeguards, and advisory PCI DSS SAQ-scope judgment for the integration model in use.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.stripe.com/api/idempotent_requests",
+      "https://docs.stripe.com/webhooks/best-practices",
+      "https://www.pcisecuritystandards.org/faqs/1443/",
+      "https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a",
+      "https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/rel_mitigate_interaction_failure_limit_retries.html",
+      "https://baymard.com/lists/cart-abandonment-rate"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no network egress to any payment system. Never requests, transmits, stores, or reproduces cardholder data (PAN/CVV), API keys, session tokens, or webhook signing secrets — any such string is a redact-and-flag finding, never echoed. PCI DSS SAQ-scope output is an advisory scoping opinion to inform a Qualified Security Assessor or the merchant's own validation, never a compliance attestation or assessment of record. Never executes payment flows or replays webhooks against live, sandbox, or staging systems.",
+    "last_verified": "2026-07-16",
+    "path": "skills/cross-functional/revenue-critical-journey-integrity-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "revenue-recognition-advisor",
     "name": "Revenue Recognition Advisor",
@@ -17996,6 +18132,33 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "wordpress-rest-block-security-review",
+    "name": "WordPress REST & Block Security Review",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing WordPress plugin and theme security: REST register_rest_route permission_callback enforcement (required since WordPress 5.5) and nonce/capability checks, dynamic-block render_callback output escaping, and the validate-on-input, escape-on-output discipline behind the plugin-dominated WordPress CVE surface.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.wordpress.org/apis/security/",
+      "https://developer.wordpress.org/rest-api/extending-the-rest-api/routes-and-endpoints/",
+      "https://developer.wordpress.org/block-editor/getting-started/fundamentals/static-dynamic-rendering/",
+      "https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no live WordPress access. Flags missing permission_callback, unescaped output, and missing nonce/capability checks from source only; treats any credential- or PII-shaped string as a redact-and-flag finding; grounds REST and block-editor API claims in current developer.wordpress.org documentation.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/wordpress-rest-block-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "working-capital-advisor",
     "name": "Finance Working Capital Advisor",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "3.1.1",
+  "version": "3.3.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -45,8 +45,10 @@
     "validate:catalog": "python3 tests/validate-catalog.py",
     "validate:links": "python3 tests/validate-links.py --offline",
     "validate:allowed-tools": "python3 tests/validate-skill-allowed-tools.py",
+    "validate:skill-coherence": "python3 tests/validate-skill-coherence.py",
     "validate:skill-schema": "python3 tests/validate-skill-frontmatter-schema.py",
     "validate:agent-schema": "python3 tests/validate-agent-frontmatter-schema.py",
+    "validate:model-policy": "node scripts/model-policy.mjs check",
     "validate:asset-integrity": "python3 tests/validate-asset-integrity.py",
     "validate:mcp-trust-matrix": "python3 tests/validate-mcp-trust-matrix.py",
     "validate:no-lifecycle-scripts": "python3 tests/validate-no-lifecycle-scripts.py",
@@ -69,12 +71,15 @@
     "cursor-plugin:write": "node scripts/generate-cursor-plugin.mjs",
     "kiro-powers:write": "node scripts/generate-kiro-powers.mjs",
     "asset-integrity:write": "python3 tests/validate-asset-integrity.py --write",
+    "model-policy:check": "node scripts/model-policy.mjs check",
+    "model-policy:apply": "node scripts/model-policy.mjs apply",
+    "model-policy:report": "node scripts/model-policy.mjs report",
     "manifest:write:all": "npm run manifest:write & npm run plugin-manifest:write & npm run cursor-plugin:write & npm run kiro-powers:write & npm run asset-integrity:write & npm run readme-counts:write & wait",
     "test:copilot-bundling": "python3 tests/test-copilot-skill-bundling.py",
     "test:gemini-bundling": "python3 tests/test-gemini-skill-bundling.py",
     "test:cursor-kiro-notices": "node tests/export-cursor-kiro-skill-notice.test.mjs",
     "test:fuzz": "node tests/fuzz-properties.test.mjs",
-    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:links && npm run validate:asset-integrity && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures && npm run validate:readme-counts && npm run validate:qa-cluster && npm run validate:frontend-security-detection",
+    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-coherence && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:model-policy && npm run validate:links && npm run validate:asset-integrity && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures && npm run validate:readme-counts && npm run validate:qa-cluster && npm run validate:frontend-security-detection",
     "release:sbom": "command -v syft >/dev/null 2>&1 && syft scan dir:. -o spdx-json=sbom.spdx.json || echo 'syft not installed; SBOM is generated in CI by anchore/sbom-action'",
     "lint:md": "npx --yes markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#.code-review-graph\" \"#CHANGELOG.md\"",
     "lint:spell": "codespell",

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "3.1.1",
+  "version": "3.3.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "Raishin",

package/powers/README.md

@@ -1,6 +1,6 @@
 # `powers/` — Kiro Powers
 
-This directory holds **40 Kiro Powers** for `vanguard-frontier-agentic`, one
+This directory holds **41 Kiro Powers** for `vanguard-frontier-agentic`, one
 per cloud/platform/IaC provider. Each Power is a directory containing a
 `POWER.md` file with strict-5 frontmatter and steering content.
 
@@ -41,6 +41,7 @@ powers/
 ├── vanguard-oci/POWER.md
 ├── vanguard-opentelemetry/POWER.md
 ├── vanguard-ovhcloud/POWER.md
+├── vanguard-php/POWER.md
 ├── vanguard-prometheus/POWER.md
 ├── vanguard-salesforce/POWER.md
 ├── vanguard-sap/POWER.md
@@ -84,7 +85,7 @@ cd vanguard-frontier-agentic
 ## How to update
 
 ```bash
-# Regenerate the 40 Powers from catalog/agents.json + per-provider config:
+# Regenerate the 41 Powers from catalog/agents.json + per-provider config:
 npm run kiro-powers:write
 
 # Then verify everything is in sync:

package/powers/vanguard-generic/POWER.md

@@ -32,7 +32,7 @@ Live-guard agents enforce approval, target confirmation, evidence capture, and r
 
 ## Where the agents live
 
-Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/generic/` in that repository. 9 of 10 agents in this provider ship a Kiro adapter; the rest provide steering context only.
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/generic/` in that repository. 10 of 11 agents in this provider ship a Kiro adapter; the rest provide steering context only.
 
 ## Companion install paths
 

package/powers/vanguard-php/POWER.md

@@ -0,0 +1,40 @@
+---
+name: "vanguard-php"
+displayName: "Vanguard Frontier — Php"
+description: "Curated Php agents for composer supply chain, php application security, php runtime upgrade readiness, wordpress security. Routes via php-maestro-agent to specialist agents based on task scope. Static review only; no live mutations."
+keywords: ["php", "static-review", "configuration-audit", "best-practices"]
+author: "Raishin"
+---
+# Vanguard Frontier — Php
+
+Curated Php agents for composer supply chain, php application security, php runtime upgrade readiness, wordpress security. Routes via php-maestro-agent to specialist agents based on task scope. Static review only; no live mutations.
+
+## When to engage this Power
+
+Activate when the task references Php services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`php-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- *(none — this provider has no live-mutation guards in the catalog)*
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Route all tasks through php-maestro-agent for proper classification and dispatch.
+- Static review only -- agents analyze configuration and provide findings without mutating live systems.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/php/` in that repository. All 5 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider php --repo .`

package/schemas/agent.schema.json

@@ -61,7 +61,8 @@
         "sap",
         "microsoft",
         "databricks",
-        "snowflake"
+        "snowflake",
+        "php"
       ]
     },
     "harnesses": {