@raishin/vanguard-frontier-agentic 3.4.0 → 3.6.0

package/catalog/skills.json

@@ -10160,6 +10160,437 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "kotlin-android-architecture",
+    "name": "kotlin-android-architecture",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection, and unidirectional data flow with a single source of truth. Reads source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.android.com/topic/architecture",
+      "https://developer.android.com/topic/libraries/architecture/viewmodel",
+      "https://developer.android.com/topic/libraries/architecture/saving-states",
+      "https://developer.android.com/topic/libraries/architecture/coroutines"
+    ],
+    "security_notes": "Static review only — reads Kotlin/Compose source, ViewModel and lifecycle declarations, and sanitized configuration; never builds, runs, or instruments an app on a device, and never observes actual configuration-change or process-death behavior at runtime. Claims about actual on-device lifecycle timing are flagged as needing on-device verification. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-android-architecture",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-android-performance-reliability",
+    "name": "kotlin-android-performance-reliability",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of measured Android runtime performance and reliability evidence: cold/warm startup via StartupTimingMetric and CompilationMode, frame jank via FrameTimingMetric/JankStats, Baseline Profile coverage, ANR root causes, and Macrobenchmark regression-gating thresholds. Reads benchmark reports and source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.android.com/topic/performance/benchmarking/macrobenchmark-overview",
+      "https://developer.android.com/topic/performance/baselineprofiles/overview",
+      "https://developer.android.com/topic/performance/vitals/anr",
+      "https://developer.android.com/topic/performance/jankstats"
+    ],
+    "security_notes": "Static review only — reads Macrobenchmark/JankStats reports, Baseline Profile rules, and Kotlin/Gradle source; never runs a benchmark, builds an APK, or instruments a device itself, and never asserts a performance number that isn't backed by a supplied report. Any performance or reliability claim without a supplied benchmark artifact is flagged as unknown rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-android-performance-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-android-security-privacy",
+    "name": "kotlin-android-security-privacy",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "MASVS-aligned static review of Android app security and privacy posture: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext-traffic and network-security-config, local storage and secrets, backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://mas.owasp.org/MASVS/",
+      "https://developer.android.com/privacy-and-security/security-tips",
+      "https://developer.android.com/training/articles/security-config",
+      "https://developer.android.com/guide/topics/manifest/manifest-intro"
+    ],
+    "security_notes": "Static review only — reads AndroidManifest.xml, Kotlin/Java source, Gradle config, and sanitized resource files; never builds, installs, runs, or instruments an app, never opens a live connection, and never handles real secrets or user data. Findings about runtime behavior (what an installed app actually exposes) are flagged as needing on-device verification. Never requests keystores, signing keys, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-android-security-privacy",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-backend-production-readiness",
+    "name": "kotlin-backend-production-readiness",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of production readiness for Ktor servers and the Kotlin-on-Spring coroutine surface: server lifecycle/monitoring events, Netty/CIO graceful-shutdown configuration, StatusPages typed error mapping, resource cleanup on shutdown, and correctly routing the coroutine-context-loss hazard behind suspend WebFlux handlers. Reads source and sanitized config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://ktor.io/docs/server-events.html",
+      "https://ktor.io/docs/server-lifecycle.html",
+      "https://docs.spring.io/spring-framework/reference/languages/kotlin/coroutines.html",
+      "https://ktor.io/docs/server-status-pages.html"
+    ],
+    "security_notes": "Static review only — reads Ktor/Spring Kotlin source, routing/plugin configuration, and sanitized YAML/config; never builds, runs, deploys, or opens a live connection to a server, and never observes actual shutdown/startup timing. A readiness claim that depends on runtime behavior (actual drain time, real health-check response) is flagged as needing verification against a running instance rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-backend-production-readiness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-compose-ui-quality-accessibility",
+    "name": "kotlin-compose-ui-quality-accessibility",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Jetpack Compose UI correctness and accessibility: recomposition stability (@Stable/@Immutable, unstable parameters), correct side-effect API usage, remember/derivedStateOf scoping, state hoisting, and mandatory semantics/contentDescription and touch-target accessibility. Reads source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.android.com/develop/ui/compose/performance/stability",
+      "https://developer.android.com/develop/ui/compose/side-effects",
+      "https://developer.android.com/develop/ui/compose/accessibility",
+      "https://developer.android.com/develop/ui/compose/state"
+    ],
+    "security_notes": "Static review only — reads Compose source and sanitized resources; never builds, runs, or renders the UI, never captures a live Layout Inspector or recomposition-count trace, and never invokes a device or emulator. Claims about actual measured recomposition counts or frame timing are flagged as needing profiler/Macrobenchmark verification rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-compose-ui-quality-accessibility",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-coroutines-flow-reliability",
+    "name": "kotlin-coroutines-flow-reliability",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin coroutine and Flow reliability: structured concurrency and cancellation cooperation, dispatcher selection and blocking calls, cold Flow vs hot StateFlow/SharedFlow semantics, backpressure, and context propagation across suspension — including the coroutine-aware persistence and telemetry/MDC/security-context hazards. Reads source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/coroutines-guide.html",
+      "https://kotlinlang.org/docs/flow.html",
+      "https://kotlinlang.org/docs/coroutine-context-and-dispatchers.html",
+      "https://kotlin.github.io/kotlinx.coroutines/"
+    ],
+    "security_notes": "Static review only — reads Kotlin source and sanitized configuration; never builds, runs, or invokes a JVM/Android runtime, never opens a live connection, and never executes coroutine code to observe timing. Runtime-ordering and race claims that cannot be confirmed from source are flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-coroutines-flow-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-estate-modernization-governor",
+    "name": "kotlin-estate-modernization-governor",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Java-to-Kotlin migration strategy: strangler-fig module-by-module vs file-by-file sequencing, the mixed Java/Kotlin interop-boundary null-safety debt, reversibility of each migration step, when a module should not migrate, and J2K converter-output governance. Reads module and dependency inventories only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/mixing-java-kotlin-intellij.html",
+      "https://kotlinlang.org/docs/java-interop.html",
+      "https://kotlinlang.org/docs/comparison-to-java.html",
+      "https://developer.android.com/kotlin/add-kotlin"
+    ],
+    "security_notes": "Static review only — reads module inventories, dependency graphs, sanitized source diffs, and J2K converter output; never builds, runs, or executes the actual migration (invoking the converter, merging, deploying), never opens a live connection, and never requests real credentials. Claims about a module's actual runtime churn, ownership, or business justification are flagged as needing confirmation from the owning team rather than asserted from the artifacts alone. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-estate-modernization-governor",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-gradle-build-engineering",
+    "name": "kotlin-gradle-build-engineering",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Gradle build-graph quality and CI throughput for Kotlin/KMP projects: configuration-cache and build-cache correctness, task-graph/configuration-avoidance, kapt vs KSP annotation processing, and convention-plugin centralization. Reads Gradle build files and build-scan evidence only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.gradle.org/current/userguide/configuration_cache.html",
+      "https://docs.gradle.org/current/userguide/build_cache.html",
+      "https://kotlinlang.org/docs/ksp-overview.html",
+      "https://docs.gradle.org/current/userguide/sharing_build_logic_between_subprojects.html"
+    ],
+    "security_notes": "Static review only — reads Gradle build files, convention-plugin sources, and sanitized build-scan/cache-hit evidence; never invokes Gradle, runs a build, or reads a live build-cache node. Throughput claims (cache-hit rate, build-time improvement) that are not backed by build-scan evidence are flagged as needing measurement rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-gradle-build-engineering",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-kmp-boundary-interop",
+    "name": "kotlin-kmp-boundary-interop",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin Multiplatform source-set architecture, expect/actual design, platform-API-leakage prevention, cross-target dependency compatibility, Swift/Objective-C interop, and Kotlin/Native runtime concerns including the new memory manager and freezing deprecation. Reads source and build config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/native-memory-manager.html",
+      "https://kotlinlang.org/docs/multiplatform-expect-actual.html",
+      "https://kotlinlang.org/docs/native-objc-interop.html",
+      "https://www.jetbrains.com/help/kotlin-multiplatform-dev/multiplatform-hierarchy.html"
+    ],
+    "security_notes": "Static review only — reads Kotlin Multiplatform source, Gradle source-set configuration, and sanitized build files; never builds, compiles, or runs a target (JVM/Native/JS/Wasm), never invokes Xcode or an iOS toolchain, and never executes generated Swift/Objective-C bridging code. Claims about a specific Kotlin/Gradle version's behavior that aren't confirmed by the supplied build files are flagged as assumption. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-kmp-boundary-interop",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-kmp-portfolio-decision",
+    "name": "kotlin-kmp-portfolio-decision",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Decides whether a product and org should adopt Kotlin Multiplatform at all, and how much to share, weighing team topology, roadmap alignment, platform differentiation, hiring/skills, lifecycle cost, and reversibility. Must be able to recommend against KMP; never designs the implementation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/multiplatform.html",
+      "https://www.jetbrains.com/help/kotlin-multiplatform-dev/multiplatform-discover-project.html",
+      "https://kotlinlang.org/docs/multiplatform-expect-actual.html",
+      "https://kotlinlang.org/docs/multiplatform-connect-to-apis.html"
+    ],
+    "security_notes": "Static analysis only — reasons from user-supplied product, team, and codebase context; never runs, builds, or migrates code, and never has access to real org data beyond what the user provides in the conversation. Claims about team capacity, roadmap timelines, or business priority that aren't confirmed by the user are flagged as assumption. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-kmp-portfolio-decision",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-language-api-correctness",
+    "name": "kotlin-language-api-correctness",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin language-level correctness: nullability and Java-interop platform types, inline functions with reified generics past JVM erasure, @JvmInline value-class boxing, statically-dispatched extension functions vs member precedence, and lateinit use-before-init hazards. Reads source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/null-safety.html",
+      "https://kotlinlang.org/docs/java-interop.html",
+      "https://kotlinlang.org/docs/inline-functions.html",
+      "https://kotlinlang.org/docs/inline-classes.html"
+    ],
+    "security_notes": "Static review only — reads Kotlin source and sanitized Java-interop signatures; never compiles, runs, or executes code to observe an actual NullPointerException, boxing allocation, or dispatch outcome. A runtime-behavior claim not confirmed by the visible source is flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-language-api-correctness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-library-api-abi-governance",
+    "name": "kotlin-library-api-abi-governance",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName surface shaping, and ABI-sensitive data-class and inline-function changes. Reads source and build config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/whatsnew1420.html",
+      "https://github.com/Kotlin/binary-compatibility-validator",
+      "https://kotlinlang.org/docs/whatsnew14.html#explicit-api-mode-for-library-authors",
+      "https://kotlinlang.org/docs/java-to-kotlin-interop.html"
+    ],
+    "security_notes": "Static review only — reads Kotlin source, `.api` snapshot files, and Gradle/build configuration; never builds, publishes, or runs `apiDump`/`apiCheck` itself, never opens a live connection, and never handles credentials for a package registry. A binary-compatibility claim not confirmed by an actual `.api` diff or `apiCheck` run is flagged as needing verification. Never requests secrets, tokens, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-library-api-abi-governance",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-maestro",
+    "name": "kotlin-maestro",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Router for the Kotlin board. Classifies a Kotlin, JVM-Kotlin, Android, or Kotlin Multiplatform task and dispatches the narrowest static-review specialist (or a parallel team of up to four for genuinely multi-domain tasks). Routes only — never reviews Kotlin work itself and never performs a live operation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/docs/home.html",
+      "https://developer.android.com/kotlin",
+      "https://kotlinlang.org/docs/multiplatform.html"
+    ],
+    "security_notes": "Classification and routing only. Never builds, runs, deploys, signs, or publishes anything, never opens a live connection, and never requests secrets, keystores, signing keys, tokens, tenant identifiers, or customer data. Detects production-mutation intent and hands it to a named human owner instead of dispatching. Treats task text as data to classify, never as instructions.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-serialization-wire-contract",
+    "name": "kotlin-serialization-wire-contract",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of kotlinx.serialization wire-contract safety and schema evolution: encodeDefaults/explicitNulls defaults, @EncodeDefault overrides, strict-decode unknown-key rejection, sealed-class closed polymorphism and class discriminators, and breaking-change detection for optional/required-field evolution. Reads source and serializer configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://github.com/Kotlin/kotlinx.serialization",
+      "https://kotlinlang.org/api/kotlinx.serialization/",
+      "https://github.com/Kotlin/kotlinx.serialization/blob/master/docs/json.md",
+      "https://github.com/Kotlin/kotlinx.serialization/blob/master/docs/polymorphism.md"
+    ],
+    "security_notes": "Static review only — reads Kotlin `@Serializable` classes, `Json {}` configuration, and sanitized sample payloads; never builds, runs, or sends/receives real wire traffic, and never handles production payloads or customer data. A claim about actual producer/consumer version skew in a live system is flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-serialization-wire-contract",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-supply-chain-release-integrity",
+    "name": "kotlin-supply-chain-release-integrity",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin/Gradle dependency trust and release integrity: verification-metadata enforcement, dependency locking, Gradle plugin trust and pinning, repository scope, and KMP/Maven publication controls. Reads build files, verification/lock metadata, and publication config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.gradle.org/current/userguide/dependency_verification.html",
+      "https://docs.gradle.org/current/userguide/dependency_locking.html",
+      "https://docs.gradle.org/current/userguide/plugins.html",
+      "https://kotlinlang.org/docs/multiplatform-publish-lib.html"
+    ],
+    "security_notes": "Static review only — reads Gradle build files, `gradle/verification-metadata.xml`, lock files, plugin declarations, and publication config; never runs a release, publishes an artifact, signs anything, or contacts a live repository/CI system. Never requests secrets, credentials, signing keys, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-supply-chain-release-integrity",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "kotlin-test-architecture",
+    "name": "kotlin-test-architecture",
+    "type": "skill",
+    "provider": "kotlin",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Kotlin coroutine/Flow/Compose/Android/KMP test architecture and determinism: runTest virtual-time usage, test-dispatcher choice and advance discipline, Dispatchers.setMain/resetMain hygiene, Turbine Flow testing, and Compose/Robolectric-vs-instrumented boundary choice. Reads test source and build config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kotlinlang.org/api/kotlinx.coroutines/kotlinx-coroutines-test/",
+      "https://github.com/cashapp/turbine",
+      "https://developer.android.com/develop/ui/compose/testing",
+      "https://developer.android.com/training/testing/local-tests"
+    ],
+    "security_notes": "Static review only — reads Kotlin/Android test source, Gradle test configuration, and sanitized CI logs; never runs the test suite, invokes a device/emulator, or opens a live connection. A claim that a specific flake is caused by real-time dependence rather than another factor is flagged as needing reproduction to confirm. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-21",
+    "path": "skills/kotlin/kotlin-test-architecture",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "kubecost-chargeback-allocation-review",
     "name": "Kubecost Chargeback and Allocation Review",
@@ -14492,6 +14923,937 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "python-application-security",
+    "name": "python-application-security",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python application-security defects: unsafe deserialization (pickle, yaml.load), dynamic execution (eval/exec), subprocess and shell injection, SSRF, path traversal and unsafe archive/file handling, secrets exposure, cryptography misuse, and fail-open exception handling. Reads source only; never runs code or exploits.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/pickle.html",
+      "https://docs.python.org/3/library/subprocess.html#security-considerations",
+      "https://docs.python.org/3/library/secrets.html",
+      "https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data",
+      "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html"
+    ],
+    "security_notes": "Static review only — reads Python source, sanitized configuration, and dependency manifests to locate injection, deserialization, SSRF, secrets, and cryptography defects; never runs the code, never executes or writes a proof-of-concept exploit, and never opens a live connection. A vulnerability that cannot be confirmed from the visible source is reported as a candidate needing confirmation, not asserted as exploitable. Never requests, stores, or echoes secrets, credentials, tokens, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-application-security",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-async-concurrency-reliability",
+    "name": "python-async-concurrency-reliability",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python asyncio reliability: blocking calls that stall the event loop, cancellation correctness, missing timeouts on external awaits, task lifecycle and structured concurrency, backpressure on unbounded fan-out, and context propagation across executor and thread boundaries. Reads source only; never runs code or measures timing.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/asyncio-task.html",
+      "https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.run_in_executor",
+      "https://docs.python.org/3/library/asyncio-task.html#timeouts",
+      "https://docs.python.org/3/library/asyncio-task.html#task-groups"
+    ],
+    "security_notes": "Static review only — reads Python async source and sanitized configuration to locate event-loop blocking, cancellation, timeout, and backpressure defects; never runs the service, never starts an event loop, and never measures actual latency, throughput, or deadlock behavior. A timing or throughput claim not derivable from the source is flagged as needing measurement rather than asserted. Never requests secrets, credentials, or a live connection.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-async-concurrency-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-business-critical-automation-governance",
+    "name": "python-business-critical-automation-governance",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of business-critical Python automation governance — unowned scripts, notebooks, bots, and schedulers whose failure creates financial, regulatory, or operational exposure — mapping ownership, controls, and a continue / harden / replatform / retire recommendation. Reads automation source, config, and process description only; makes no accounting/legal/regulatory conclusions.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://csrc.nist.gov/glossary/term/separation_of_duty",
+      "https://docs.python.org/3/library/logging.html",
+      "https://peps.python.org/pep-0020/"
+    ],
+    "security_notes": "Static review only — reads automation source, scheduling/configuration, and process descriptions (owner, trigger, inputs/outputs) to map ownership and controls; never runs the automation, connects to a live system, or requests secrets, credentials, or customer data. This agent makes no accounting, legal, or regulatory conclusion — those determinations route to the accounting/finance and legal boards; it maps controls, quantifies exposure, and recommends continue / harden / replatform / retire.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-business-critical-automation-governance",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-container-serverless-runtime",
+    "name": "python-container-serverless-runtime",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of containerized/serverless Python runtime behavior: PID 1 and signal handling, worker/process model, graceful shutdown, read-only-filesystem and cold-start assumptions, and dependency footprint. Reads Dockerfiles, process/server config, and source only; never builds or runs a container.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.gunicorn.org/en/stable/signals.html",
+      "https://www.uvicorn.org/deployment/",
+      "https://docs.python.org/3/library/signal.html",
+      "https://docs.docker.com/reference/dockerfile/"
+    ],
+    "security_notes": "Static review only — reads Dockerfiles, entrypoint scripts, and gunicorn/uvicorn process/server configuration to assess signal-handling, worker-model, and runtime-assumption correctness; never builds, runs, or deploys a container image. A claim about actual signal delivery, shutdown timing, or cold-start latency is flagged as needing confirmation by building and running the container. Never requests credentials, secrets, or registry access.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-container-serverless-runtime",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-data-access-transaction",
+    "name": "python-data-access-transaction",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python database access and transactions (SQLAlchemy, Django ORM, DB-API): session and transaction scope, commit/rollback boundaries, N+1 and lazy-loading, connection-pool sizing, migration safety, and multi-tenancy scoping. Reads source, models, and migrations only; never connects to a database or runs a migration.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.sqlalchemy.org/en/20/orm/session_basics.html",
+      "https://docs.sqlalchemy.org/en/20/orm/session_transaction.html",
+      "https://docs.sqlalchemy.org/en/20/orm/queryguide/relationships.html",
+      "https://alembic.sqlalchemy.org/en/latest/"
+    ],
+    "security_notes": "Static review only — reads ORM models, query code, session/engine configuration, and migration scripts to assess transaction and data-access correctness; never opens a database connection, runs a query, or applies a migration. A claim about actual query counts, lock behavior, or migration runtime is flagged as needing measurement against a real database. Never requests connection strings, database credentials, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-data-access-transaction",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-data-pipeline-reliability",
+    "name": "python-data-pipeline-reliability",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python data-pipeline reliability (Airflow, Dagster, Prefect, PySpark): task idempotency and safe backfills, partitioning, schema evolution and data contracts, checkpointing, late/duplicate data, and data-quality gates. Reads DAG/pipeline source and config only; never runs a pipeline or backfill.",
+    "source_type": "original",
+    "official_docs": [
+      "https://airflow.apache.org/docs/apache-airflow/stable/core-concepts/tasks.html",
+      "https://airflow.apache.org/docs/apache-airflow/stable/authoring-and-scheduling/catchup.html",
+      "https://airflow.apache.org/docs/apache-airflow/stable/best-practices.html",
+      "https://spark.apache.org/docs/latest/"
+    ],
+    "security_notes": "Static review only — reads DAG/pipeline source, task and scheduling configuration, and data-quality/lineage artifacts to assess pipeline reliability; never runs a pipeline, triggers a backfill, or connects to a warehouse/cluster. A claim about actual row counts, backfill duration, or data-quality results is flagged as needing observation against a real pipeline run. Never requests warehouse credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-data-pipeline-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-developer-tooling-build",
+    "name": "python-developer-tooling-build",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python developer tooling and build configuration — whether linters/type-checkers/tests are wired to catch meaningful defects (not stylistic noise), CI gate coverage, build-backend and monorepo layout, and developer feedback loops. Reads tool/CI/build config only; never runs the tools.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.astral.sh/ruff/",
+      "https://mypy.readthedocs.io/en/stable/config_file.html",
+      "https://tox.wiki/en/stable/",
+      "https://pre-commit.com/"
+    ],
+    "security_notes": "Static review only — reads linter, type-checker, test-runner, CI, and build-backend configuration to assess whether quality gates would catch a real defect; never runs ruff, mypy, tox, pre-commit, or the CI pipeline itself, and never connects to a live runner. A claim about actual lint/type/test/CI output is flagged as needing a real run to confirm. Never requests CI tokens or credentials.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-developer-tooling-build",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-distributed-task-reliability",
+    "name": "python-distributed-task-reliability",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python distributed task systems (Celery, RQ, Dramatiq): idempotency under at-least-once delivery, retry policy and backoff, dead-letter and poison-message handling, duplicate execution, acknowledgement timing, scheduling, and transactional-outbox boundaries. Reads task and config source only; never enqueues or runs a task.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.celeryq.dev/en/stable/userguide/tasks.html",
+      "https://docs.celeryq.dev/en/stable/userguide/optimizing.html",
+      "https://docs.celeryq.dev/en/stable/faq.html",
+      "https://docs.celeryq.dev/en/stable/userguide/configuration.html"
+    ],
+    "security_notes": "Static review only — reads task definitions, retry/ack configuration, and broker/result-backend settings to assess delivery reliability; never enqueues, runs, or acknowledges a task, and never connects to a broker or result backend. A claim about actual delivery counts, duplicate execution, or retry behavior is flagged as needing observation against a real broker. Never requests broker credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-distributed-task-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-estate-modernization-governor",
+    "name": "python-estate-modernization-governor",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python runtime-estate support posture and upgrade sequencing: end-of-life/unsupported interpreters, deprecation exposure, dependency/framework compatibility for an upgrade, and ownership/business-criticality gaps. Reads inventory, manifests, and config only; never runs an upgrade or installs an interpreter.",
+    "source_type": "original",
+    "official_docs": [
+      "https://devguide.python.org/versions/",
+      "https://peps.python.org/pep-0602/",
+      "https://docs.python.org/3/whatsnew/index.html",
+      "https://packaging.python.org/en/latest/"
+    ],
+    "security_notes": "Static review only — reads runtime/dependency inventories, Dockerfiles, lockfiles, and manifests to assess support posture and upgrade sequencing; never installs, upgrades, or runs an interpreter, and never connects to a live system. A claim about a specific end-of-life date, deprecation-removal date, or compatibility result is flagged as needing confirmation against the official CPython schedule and the dependencies' own documentation. Never requests credentials, secrets, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-estate-modernization-governor",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-free-threading-parallelism",
+    "name": "python-free-threading-parallelism",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python free-threaded (no-GIL) adoption: invalidated GIL thread-safety assumptions, shared-state races, C-extension compatibility, and synchronization needs — producing an evidence-based adopt / pilot / defer verdict. Reads source, build config, and extension manifests only; never builds or runs the free-threaded interpreter.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/howto/free-threading-python.html",
+      "https://docs.python.org/3/howto/free-threading-extensions.html",
+      "https://peps.python.org/pep-0703/",
+      "https://docs.python.org/3/whatsnew/3.13.html"
+    ],
+    "security_notes": "Static review only — reads application source, build configuration, and native-extension manifests to assess free-threaded (no-GIL) readiness; never builds, installs, or runs the free-threaded interpreter or an extension against it. A claim about an actual race, speedup, or extension crash under free-threading is flagged as needing confirmation on a real free-threaded build. Never requests credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-free-threading-parallelism",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-language-contracts-typing",
+    "name": "python-language-contracts-typing",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python type contracts and gradual typing: Any propagation across public boundaries, Protocol and structural typing, generics and variance soundness, overload consistency, TypedDict and dataclass contracts, and the separation of static typing from runtime validation. Reads source and type-checker config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/typing.html",
+      "https://typing.readthedocs.io/en/latest/spec/",
+      "https://mypy.readthedocs.io/en/stable/",
+      "https://peps.python.org/pep-0484/"
+    ],
+    "security_notes": "Static review only — reads Python source, type annotations, and type-checker configuration to assess type-contract soundness; never runs mypy/Pyright or the code to observe a checker result or a runtime type error. A claim about what a checker reports is flagged as needing the user's actual checker output rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-language-contracts-typing",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-change-plan",
+    "name": "python-live-change-plan",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Produces normalized change plans, diffs, rollback procedures, verification criteria, and action digests. Has no production credentials.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://docs.python.org/3/",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
+    ],
+    "security_notes": "Read-only-runtime: produces change plans, diffs, rollback procedures, verification criteria, and action digests from supplied artifacts only; holds no production credentials and executes nothing. Emits an audit event for every plan produced, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields from any artifact quoted in the plan.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-change-plan",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-code-remediation",
+    "name": "python-live-code-remediation",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Creates a branch and pull request and runs approved isolated validation for a code/dependency remediation. Cannot merge, deploy, or weaken policy.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://packaging.python.org/en/latest/",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
+    ],
+    "security_notes": "Mutating-runtime, limited to creating a branch/pull request and running approved isolated non-production validation: never merges, deploys, or weakens a policy/gate/test. Emits an audit event for every branch/PR creation and validation result, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields from any artifact quoted in the PR. Requires an external, target-bound approval, target-scoped just-in-time credentials, and a pre-approved rollback (revert) before creating the branch/PR or running validation.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-code-remediation",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-continuous-control-testing",
+    "name": "python-live-continuous-control-testing",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Periodically checks whether controls continue operating. Read-only by default. Opens findings with owners and due dates rather than silently remediating high-risk failures.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.nist.gov/cyberframework",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
+    ],
+    "security_notes": "Read-only-runtime by default: tests whether controls continue operating and opens findings with named owners and due dates; never mutates or silently remediates a production failure. Emits an immutable audit event for every observation; never uses shared or standing credentials; never retrieves raw secret values; redacts PII in captured evidence.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-continuous-control-testing",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-control-evidence",
+    "name": "python-live-control-evidence",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Collects, hashes, and stores control evidence in an approved destination and maps it to controls. Cannot approve or execute.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services",
+      "https://docs.python.org/3/library/hashlib.html"
+    ],
+    "security_notes": "Read-only-runtime: collects, hashes, and seals control evidence to an approved destination and maps it to controls; never mutates a live system, approves, or executes. Emits an immutable audit event for every observation; never uses shared or standing credentials; never retrieves raw secret values; redacts and tokenizes PII/sensitive fields before sealing, and never persists secrets.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-control-evidence",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-data-change-control",
+    "name": "python-live-data-change-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Governs migrations, backfills, pipeline reprocessing, and bounded data correction. Requires ownership, data classification, reconciliation evidence, and rollback evidence.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://gdpr-info.eu/",
+      "https://docs.python.org/3/library/decimal.html"
+    ],
+    "security_notes": "Mutating-runtime: executes an approved, bounded migration, backfill, pipeline reprocessing, or data correction. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts and tokenizes PII/regulated fields in captured evidence. Requires an external signed approval bound to the exact target and plan digest, JIT credentials, a pre-approved rollback, and reconciliation evidence before any action, and acts on exactly one bounded record/partition scope per approval — never an unbounded or expanded scope.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-data-change-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-exception-governance",
+    "name": "python-live-exception-governance",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Records policy exceptions and confirms owner, scope, expiration, compensating controls, and review date. Cannot approve its own exception. Automatically flags expired exceptions.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.iso.org/standard/27001",
+      "https://csrc.nist.gov/glossary/term/separation_of_duty"
+    ],
+    "security_notes": "Read-only-runtime: records and reviews policy exceptions and flags expired or incomplete ones; never approves, executes, or mutates a live system. Emits an immutable audit event for every observation; never uses shared or standing credentials; never retrieves raw secret values; redacts PII in captured evidence.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-exception-governance",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-governance-maestro",
+    "name": "python-live-governance-maestro",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Router for the Python live control plane. Classifies runtime, business process, data class, environment, and control profile, and routes to the narrowest live specialist. Routes only — cannot mutate, cannot approve, cannot declare compliance.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.nist.gov/cyberframework",
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
+      "https://docs.python.org/3/"
+    ],
+    "security_notes": "Read-only-runtime: classifies and routes only, never mutates, approves, or executes anything itself. Emits an audit event for every routing decision, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields from any task text or artifact it classifies.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-governance-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-identity-authority",
+    "name": "python-live-identity-authority",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Confirms active identity, role, credential age, target scope, JIT status, and approval authority before any gated action. Read-only. Blocks shared identities, unidentified principals, standing administrative credentials, and requester-as-approver conflicts.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://csrc.nist.gov/glossary/term/separation_of_duty",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
+    ],
+    "security_notes": "Read-only-runtime: verifies identity, credential currency, JIT scope, and approval authority via allowlisted identity/access queries only; never grants, elevates, or approves an action itself. Emits an audit event for every verification, never uses shared or standing credentials, never retrieves raw secret values or credential material, and redacts personally identifiable fields from captured evidence.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-identity-authority",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-job-control",
+    "name": "python-live-job-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Operates distributed jobs and business automation. Requires technical and business idempotency, and separates process completion from business completion.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://docs.celeryq.dev/en/stable/userguide/tasks.html",
+      "https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services"
+    ],
+    "security_notes": "Mutating-runtime: operates an approved, bounded distributed job or business-automation retry/requeue. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts PII in captured evidence. Requires an external signed approval bound to the exact target and plan digest, JIT credentials, a pre-approved rollback, and business-outcome reconciliation before any action, and acts on exactly one bounded job/retry scope per approval — never a blind mass-retry or expanded scope.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-job-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-model-promotion-control",
+    "name": "python-live-model-promotion-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Promotes exactly one immutable model artifact. Requires risk classification, evaluation evidence, monitoring, and rollback.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.nist.gov/itl/ai-risk-management-framework",
+      "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
+      "https://www.iso.org/standard/81230.html"
+    ],
+    "security_notes": "Mutating-runtime: promotes exactly one immutable, integrity-verified model artifact per approval. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts PII in captured evidence. Requires an external signed approval bound to the exact target and plan digest, JIT credentials, a pre-approved rollback to the prior artifact, and evaluation/monitoring reconciliation before any action, and acts on exactly one bounded artifact-promotion scope per approval — never multiple artifacts or an expanded scope.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-model-promotion-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-policy-gate",
+    "name": "python-live-policy-gate",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Evaluates machine-readable policies and control applicability against an action and its recorded inputs. Cannot create exceptions or approvals.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.nist.gov/cyberframework",
+      "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"
+    ],
+    "security_notes": "Read-only-runtime: evaluates the versioned policy bundle and applicability inputs to produce candidate control results only; never creates an exception or an approval. Emits an audit event recording the policy_bundle_version for every evaluation, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields from evaluation inputs.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-policy-gate",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-release-control",
+    "name": "python-live-release-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Executes one bounded release, canary increment, rollback, or single-instance restart. Requires independent approval and just-in-time credentials.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services",
+      "https://docs.python.org/3/"
+    ],
+    "security_notes": "Mutating-runtime: executes exactly one bounded release, canary increment, rollback, or single-instance restart per independent approval. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts PII in captured evidence. Requires an external signed approval bound to the exact target and plan digest, JIT credentials, a pre-approved rollback, and reconciliation before any action, and acts on exactly one bounded scope per approval — never a fleet-wide, unbounded, or expanded scope.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-release-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-rollback-and-recovery",
+    "name": "python-live-rollback-and-recovery",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Executes only previously approved rollback procedures. Cannot invent a rollback during an active failure. Requires the exact affected target and rollback authority.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.nist.gov/cyberframework",
+      "https://docs.python.org/3/"
+    ],
+    "security_notes": "Mutating-runtime: executes only a previously approved, tested rollback procedure against the exact affected target. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts PII in captured evidence. Requires an external signed approval bound to the exact affected target, JIT credentials, confirmation the rollback procedure was itself pre-approved and tested, and post-rollback reconciliation before executing, and acts on exactly one bounded affected-target scope per approval — never an improvised rollback or an additional target.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-rollback-and-recovery",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-runtime-control",
+    "name": "python-live-runtime-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reads live interpreter, process, worker, task, thread, memory, and health state and performs allowlisted diagnostics. Cannot change application state.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/sys.html",
+      "https://docs.python.org/3/library/gc.html",
+      "https://docs.python.org/3/library/faulthandler.html"
+    ],
+    "security_notes": "Read-only-runtime: captures interpreter, process, worker, thread, memory, and health state via allowlisted read-only diagnostics only (sys, gc, faulthandler) and never restarts, kills, scales, or reconfigures a process. Emits an audit event for every diagnostic read, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields captured in a diagnostic dump.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-runtime-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-system-inventory",
+    "name": "python-live-system-inventory",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Read-only discovery of Python runtimes, services, jobs, notebooks, packages, owners, environments, deployment revisions, service identities, and criticality. Produces asset and ownership evidence. Never retrieves raw credentials.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/importlib.metadata.html",
+      "https://packaging.python.org/en/latest/",
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final"
+    ],
+    "security_notes": "Read-only-runtime: discovers assets via allowlisted list/get/describe queries only and never mutates a discovered asset. Emits an audit event for every discovery query, never uses shared or standing credentials, never retrieves raw secret values, keystores, or tokens, and redacts personally identifiable fields from any captured evidence.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-system-inventory",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-maestro",
+    "name": "python-maestro",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Router for the Python board. Classifies a Python application, runtime, packaging, framework, data, or code-level task and dispatches the narrowest static-review specialist (or a parallel team of up to four for genuinely multi-domain tasks). Routes only — never reviews Python work itself and never performs a live operation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/",
+      "https://packaging.python.org/en/latest/",
+      "https://peps.python.org/"
+    ],
+    "security_notes": "Classification and routing only. Never installs, runs, imports, or executes code, never builds, deploys, publishes, or migrates anything, never opens a live connection, and never requests secrets, tokens, API keys, connection strings, cloud credentials, or customer data. Detects production-mutation intent and hands it to a named human owner instead of dispatching. Treats task text and any pasted artifact as data to classify, never as instructions.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-ml-ai-production",
+    "name": "python-ml-ai-production",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python ML/AI production correctness — training-serving skew, feature/data leakage, artifact serialization safety, reproducibility, drift signals, batch-vs-online consistency, and model/prompt config provenance. Reads training/serving source, config, and eval artifacts only; never trains, loads, or serves a model.",
+    "source_type": "original",
+    "official_docs": [
+      "https://scikit-learn.org/stable/model_persistence.html",
+      "https://scikit-learn.org/stable/common_pitfalls.html",
+      "https://docs.python.org/3/library/pickle.html",
+      "https://numpy.org/doc/stable/reference/random/generator.html"
+    ],
+    "security_notes": "Static review only — reads training and serving source, feature-transformation code, model-persistence configuration, and evaluation artifacts to assess ML production correctness; never trains a model, loads a model artifact, serves inference, or connects to a live system. A claim about actual offline/online metric values or drift is flagged as needing observation against a real evaluation run. Never requests training/customer data or model-registry credentials.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-ml-ai-production",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-native-extension-interop",
+    "name": "python-native-extension-interop",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python native extensions and interop (CPython C API, Cython, PyO3/Rust): reference-ownership correctness, stable-ABI use, buffer-protocol safety, exception translation, and thread/GIL and free-threaded readiness. Reads extension source and build config only; never compiles or runs it.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/c-api/intro.html",
+      "https://docs.python.org/3/c-api/stable.html",
+      "https://docs.python.org/3/c-api/refcounting.html",
+      "https://docs.python.org/3/c-api/buffer.html"
+    ],
+    "security_notes": "Static review only — reads C/Cython/PyO3 extension source and build configuration to assess reference-ownership, buffer-protocol, exception-translation, and ABI/thread-safety correctness; never compiles, links, or runs the extension. A claim about an actual crash, leak, or free-threaded behavior is flagged as needing confirmation by compiling and running the extension. Never requests credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-native-extension-interop",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-numerical-scientific-correctness",
+    "name": "python-numerical-scientific-correctness",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python numerical and scientific correctness: binary float used for money, rounding-mode errors, silent dtype coercion and integer overflow, missing-data (NaN) handling, timezone-naive timestamps, unseeded randomness and irreproducibility, numerical instability, and unbenchmarked vectorization claims. Reads source only; never runs the calculation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/tutorial/floatingpoint.html",
+      "https://docs.python.org/3/library/decimal.html",
+      "https://pandas.pydata.org/docs/user_guide/timeseries.html#time-zone-handling",
+      "https://numpy.org/doc/stable/reference/random/generator.html"
+    ],
+    "security_notes": "Static review only — reads Python/pandas/numpy source and sanitized sample schemas to locate money-as-float, rounding, dtype-coercion, timezone, and reproducibility defects; never runs the calculation, notebook, or benchmark and never observes an actual numeric result or timing. A claim about a computed value or a performance improvement is flagged as needing execution/benchmark evidence rather than asserted. Never requests production data or a live database/warehouse connection.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-numerical-scientific-correctness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-observability-sre",
+    "name": "python-observability-sre",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of in-application Python observability — structured logs, metrics, traces, context propagation and correlation, error taxonomy, metric/label cardinality, PII exposure, and SLO-supporting instrumentation. Reads application instrumentation code only; routes collector/dashboard infrastructure to the platform boards.",
+    "source_type": "original",
+    "official_docs": [
+      "https://opentelemetry-python.readthedocs.io/en/stable/",
+      "https://opentelemetry.io/docs/concepts/context-propagation/",
+      "https://opentelemetry.io/docs/specs/semconv/",
+      "https://docs.python.org/3/library/logging.html"
+    ],
+    "security_notes": "Static review only — reads application instrumentation code (logging, metrics, and tracing calls) and telemetry configuration to assess observability correctness and safety; never runs the application, connects to a live telemetry backend, or emits telemetry itself. A claim about actual cardinality, cost, or trace completeness is flagged as needing observation against a real backend. Never requests telemetry-backend credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-observability-sre",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-packaging-supply-chain",
+    "name": "python-packaging-supply-chain",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python packaging and software supply-chain integrity: pyproject build metadata, dependency locking and hash-checking, index trust and dependency confusion, build isolation, dependency specifiers, license metadata, and CI release-token exposure. Reads manifests and lockfiles only; never installs packages or resolves environments.",
+    "source_type": "original",
+    "official_docs": [
+      "https://packaging.python.org/en/latest/specifications/pyproject-toml/",
+      "https://pip.pypa.io/en/stable/topics/secure-installs/",
+      "https://pip.pypa.io/en/stable/topics/repeatable-installs/",
+      "https://packaging.python.org/en/latest/specifications/dependency-specifiers/"
+    ],
+    "security_notes": "Static review only — reads `pyproject.toml`, `requirements`/constraints files, lockfiles, and CI definitions to assess locking, hashing, index trust, and build-isolation posture; never runs `pip install`, never resolves or downloads a package, and never contacts an index. A claim that a specific version is vulnerable is flagged as needing confirmation against an advisory source rather than asserted. Never requests index credentials, publish tokens, or customer data, and never installs an unreviewed package to inspect it.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-packaging-supply-chain",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-performance-memory",
+    "name": "python-performance-memory",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python performance and memory claims: CPU profiling vs benchmarking rigor, memory growth and allocation patterns, GC pressure, algorithmic complexity, and serialization/import/startup cost — refusing intuition as evidence. Reads source, profiles, and benchmark artifacts only; never runs the profiler or benchmark itself.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/profile.html",
+      "https://docs.python.org/3/library/tracemalloc.html",
+      "https://docs.python.org/3/library/gc.html",
+      "https://docs.python.org/3/library/timeit.html"
+    ],
+    "security_notes": "Static review only — reads source, profiler output (cProfile), benchmark artifacts (timeit/pytest-benchmark), and tracemalloc snapshots to assess performance and memory claims; never runs the profiler, the benchmark, or the application itself. A claim about actual latency, throughput, or memory growth with no supplied profile/benchmark/tracemalloc evidence is flagged as unsupported rather than accepted. Never requests credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-performance-memory",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-testing-quality-engineering",
+    "name": "python-testing-quality-engineering",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python test-suite quality (pytest, hypothesis): fixture scope and isolation, mock misuse and wrong-target patching, control of time/randomness/environment, flakiness sources, assertion quality, coverage theater, async-test correctness, and property-based-testing signal. Reads test and source code only; never runs the suite.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.pytest.org/en/stable/how-to/fixtures.html",
+      "https://docs.pytest.org/en/stable/how-to/monkeypatch.html",
+      "https://docs.python.org/3/library/unittest.mock.html",
+      "https://hypothesis.readthedocs.io/en/latest/"
+    ],
+    "security_notes": "Static review only — reads test code, fixtures, and the code under test to assess whether the suite reduces risk; never runs pytest, executes a test, or measures coverage. A claim about a test's actual pass/fail, coverage number, or flakiness rate is flagged as needing execution by the user. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-testing-quality-engineering",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-web-service-production-readiness",
+    "name": "python-web-service-production-readiness",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Framework-aware static review of Python web-service production readiness (FastAPI, Starlette, Django, Flask, ASGI/WSGI): sync-vs-async endpoint blocking, request validation, authentication and authorization boundaries, middleware order, worker model, timeouts, graceful shutdown, and health checks. Reads source and config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://fastapi.tiangolo.com/async/",
+      "https://www.starlette.io/",
+      "https://docs.djangoproject.com/en/stable/topics/security/",
+      "https://flask.palletsprojects.com/en/stable/"
+    ],
+    "security_notes": "Static review only — reads web-framework source, route and middleware definitions, and sanitized configuration to assess production readiness; never starts the server, sends a request, or observes runtime latency, worker behavior, or shutdown timing. A claim about actual request-handling or shutdown behavior is flagged as needing runtime confirmation. Never requests secrets, credentials, or a live connection. Framework-specific reference is loaded only when the framework is detected.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-web-service-production-readiness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "react-component-architecture-review",
     "name": "React Component Architecture Review",