@raishin/vanguard-frontier-agentic 3.5.0 → 3.6.0

package/catalog/skills.json

@@ -14923,6 +14923,937 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "python-application-security",
+    "name": "python-application-security",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python application-security defects: unsafe deserialization (pickle, yaml.load), dynamic execution (eval/exec), subprocess and shell injection, SSRF, path traversal and unsafe archive/file handling, secrets exposure, cryptography misuse, and fail-open exception handling. Reads source only; never runs code or exploits.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/pickle.html",
+      "https://docs.python.org/3/library/subprocess.html#security-considerations",
+      "https://docs.python.org/3/library/secrets.html",
+      "https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data",
+      "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html"
+    ],
+    "security_notes": "Static review only — reads Python source, sanitized configuration, and dependency manifests to locate injection, deserialization, SSRF, secrets, and cryptography defects; never runs the code, never executes or writes a proof-of-concept exploit, and never opens a live connection. A vulnerability that cannot be confirmed from the visible source is reported as a candidate needing confirmation, not asserted as exploitable. Never requests, stores, or echoes secrets, credentials, tokens, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-application-security",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-async-concurrency-reliability",
+    "name": "python-async-concurrency-reliability",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python asyncio reliability: blocking calls that stall the event loop, cancellation correctness, missing timeouts on external awaits, task lifecycle and structured concurrency, backpressure on unbounded fan-out, and context propagation across executor and thread boundaries. Reads source only; never runs code or measures timing.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/asyncio-task.html",
+      "https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.run_in_executor",
+      "https://docs.python.org/3/library/asyncio-task.html#timeouts",
+      "https://docs.python.org/3/library/asyncio-task.html#task-groups"
+    ],
+    "security_notes": "Static review only — reads Python async source and sanitized configuration to locate event-loop blocking, cancellation, timeout, and backpressure defects; never runs the service, never starts an event loop, and never measures actual latency, throughput, or deadlock behavior. A timing or throughput claim not derivable from the source is flagged as needing measurement rather than asserted. Never requests secrets, credentials, or a live connection.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-async-concurrency-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-business-critical-automation-governance",
+    "name": "python-business-critical-automation-governance",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of business-critical Python automation governance — unowned scripts, notebooks, bots, and schedulers whose failure creates financial, regulatory, or operational exposure — mapping ownership, controls, and a continue / harden / replatform / retire recommendation. Reads automation source, config, and process description only; makes no accounting/legal/regulatory conclusions.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://csrc.nist.gov/glossary/term/separation_of_duty",
+      "https://docs.python.org/3/library/logging.html",
+      "https://peps.python.org/pep-0020/"
+    ],
+    "security_notes": "Static review only — reads automation source, scheduling/configuration, and process descriptions (owner, trigger, inputs/outputs) to map ownership and controls; never runs the automation, connects to a live system, or requests secrets, credentials, or customer data. This agent makes no accounting, legal, or regulatory conclusion — those determinations route to the accounting/finance and legal boards; it maps controls, quantifies exposure, and recommends continue / harden / replatform / retire.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-business-critical-automation-governance",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-container-serverless-runtime",
+    "name": "python-container-serverless-runtime",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of containerized/serverless Python runtime behavior: PID 1 and signal handling, worker/process model, graceful shutdown, read-only-filesystem and cold-start assumptions, and dependency footprint. Reads Dockerfiles, process/server config, and source only; never builds or runs a container.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.gunicorn.org/en/stable/signals.html",
+      "https://www.uvicorn.org/deployment/",
+      "https://docs.python.org/3/library/signal.html",
+      "https://docs.docker.com/reference/dockerfile/"
+    ],
+    "security_notes": "Static review only — reads Dockerfiles, entrypoint scripts, and gunicorn/uvicorn process/server configuration to assess signal-handling, worker-model, and runtime-assumption correctness; never builds, runs, or deploys a container image. A claim about actual signal delivery, shutdown timing, or cold-start latency is flagged as needing confirmation by building and running the container. Never requests credentials, secrets, or registry access.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-container-serverless-runtime",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-data-access-transaction",
+    "name": "python-data-access-transaction",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python database access and transactions (SQLAlchemy, Django ORM, DB-API): session and transaction scope, commit/rollback boundaries, N+1 and lazy-loading, connection-pool sizing, migration safety, and multi-tenancy scoping. Reads source, models, and migrations only; never connects to a database or runs a migration.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.sqlalchemy.org/en/20/orm/session_basics.html",
+      "https://docs.sqlalchemy.org/en/20/orm/session_transaction.html",
+      "https://docs.sqlalchemy.org/en/20/orm/queryguide/relationships.html",
+      "https://alembic.sqlalchemy.org/en/latest/"
+    ],
+    "security_notes": "Static review only — reads ORM models, query code, session/engine configuration, and migration scripts to assess transaction and data-access correctness; never opens a database connection, runs a query, or applies a migration. A claim about actual query counts, lock behavior, or migration runtime is flagged as needing measurement against a real database. Never requests connection strings, database credentials, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-data-access-transaction",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-data-pipeline-reliability",
+    "name": "python-data-pipeline-reliability",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python data-pipeline reliability (Airflow, Dagster, Prefect, PySpark): task idempotency and safe backfills, partitioning, schema evolution and data contracts, checkpointing, late/duplicate data, and data-quality gates. Reads DAG/pipeline source and config only; never runs a pipeline or backfill.",
+    "source_type": "original",
+    "official_docs": [
+      "https://airflow.apache.org/docs/apache-airflow/stable/core-concepts/tasks.html",
+      "https://airflow.apache.org/docs/apache-airflow/stable/authoring-and-scheduling/catchup.html",
+      "https://airflow.apache.org/docs/apache-airflow/stable/best-practices.html",
+      "https://spark.apache.org/docs/latest/"
+    ],
+    "security_notes": "Static review only — reads DAG/pipeline source, task and scheduling configuration, and data-quality/lineage artifacts to assess pipeline reliability; never runs a pipeline, triggers a backfill, or connects to a warehouse/cluster. A claim about actual row counts, backfill duration, or data-quality results is flagged as needing observation against a real pipeline run. Never requests warehouse credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-data-pipeline-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-developer-tooling-build",
+    "name": "python-developer-tooling-build",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python developer tooling and build configuration — whether linters/type-checkers/tests are wired to catch meaningful defects (not stylistic noise), CI gate coverage, build-backend and monorepo layout, and developer feedback loops. Reads tool/CI/build config only; never runs the tools.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.astral.sh/ruff/",
+      "https://mypy.readthedocs.io/en/stable/config_file.html",
+      "https://tox.wiki/en/stable/",
+      "https://pre-commit.com/"
+    ],
+    "security_notes": "Static review only — reads linter, type-checker, test-runner, CI, and build-backend configuration to assess whether quality gates would catch a real defect; never runs ruff, mypy, tox, pre-commit, or the CI pipeline itself, and never connects to a live runner. A claim about actual lint/type/test/CI output is flagged as needing a real run to confirm. Never requests CI tokens or credentials.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-developer-tooling-build",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-distributed-task-reliability",
+    "name": "python-distributed-task-reliability",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python distributed task systems (Celery, RQ, Dramatiq): idempotency under at-least-once delivery, retry policy and backoff, dead-letter and poison-message handling, duplicate execution, acknowledgement timing, scheduling, and transactional-outbox boundaries. Reads task and config source only; never enqueues or runs a task.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.celeryq.dev/en/stable/userguide/tasks.html",
+      "https://docs.celeryq.dev/en/stable/userguide/optimizing.html",
+      "https://docs.celeryq.dev/en/stable/faq.html",
+      "https://docs.celeryq.dev/en/stable/userguide/configuration.html"
+    ],
+    "security_notes": "Static review only — reads task definitions, retry/ack configuration, and broker/result-backend settings to assess delivery reliability; never enqueues, runs, or acknowledges a task, and never connects to a broker or result backend. A claim about actual delivery counts, duplicate execution, or retry behavior is flagged as needing observation against a real broker. Never requests broker credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-distributed-task-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-estate-modernization-governor",
+    "name": "python-estate-modernization-governor",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python runtime-estate support posture and upgrade sequencing: end-of-life/unsupported interpreters, deprecation exposure, dependency/framework compatibility for an upgrade, and ownership/business-criticality gaps. Reads inventory, manifests, and config only; never runs an upgrade or installs an interpreter.",
+    "source_type": "original",
+    "official_docs": [
+      "https://devguide.python.org/versions/",
+      "https://peps.python.org/pep-0602/",
+      "https://docs.python.org/3/whatsnew/index.html",
+      "https://packaging.python.org/en/latest/"
+    ],
+    "security_notes": "Static review only — reads runtime/dependency inventories, Dockerfiles, lockfiles, and manifests to assess support posture and upgrade sequencing; never installs, upgrades, or runs an interpreter, and never connects to a live system. A claim about a specific end-of-life date, deprecation-removal date, or compatibility result is flagged as needing confirmation against the official CPython schedule and the dependencies' own documentation. Never requests credentials, secrets, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-estate-modernization-governor",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-free-threading-parallelism",
+    "name": "python-free-threading-parallelism",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python free-threaded (no-GIL) adoption: invalidated GIL thread-safety assumptions, shared-state races, C-extension compatibility, and synchronization needs — producing an evidence-based adopt / pilot / defer verdict. Reads source, build config, and extension manifests only; never builds or runs the free-threaded interpreter.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/howto/free-threading-python.html",
+      "https://docs.python.org/3/howto/free-threading-extensions.html",
+      "https://peps.python.org/pep-0703/",
+      "https://docs.python.org/3/whatsnew/3.13.html"
+    ],
+    "security_notes": "Static review only — reads application source, build configuration, and native-extension manifests to assess free-threaded (no-GIL) readiness; never builds, installs, or runs the free-threaded interpreter or an extension against it. A claim about an actual race, speedup, or extension crash under free-threading is flagged as needing confirmation on a real free-threaded build. Never requests credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-free-threading-parallelism",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-language-contracts-typing",
+    "name": "python-language-contracts-typing",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python type contracts and gradual typing: Any propagation across public boundaries, Protocol and structural typing, generics and variance soundness, overload consistency, TypedDict and dataclass contracts, and the separation of static typing from runtime validation. Reads source and type-checker config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/typing.html",
+      "https://typing.readthedocs.io/en/latest/spec/",
+      "https://mypy.readthedocs.io/en/stable/",
+      "https://peps.python.org/pep-0484/"
+    ],
+    "security_notes": "Static review only — reads Python source, type annotations, and type-checker configuration to assess type-contract soundness; never runs mypy/Pyright or the code to observe a checker result or a runtime type error. A claim about what a checker reports is flagged as needing the user's actual checker output rather than asserted. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-language-contracts-typing",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-change-plan",
+    "name": "python-live-change-plan",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Produces normalized change plans, diffs, rollback procedures, verification criteria, and action digests. Has no production credentials.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://docs.python.org/3/",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
+    ],
+    "security_notes": "Read-only-runtime: produces change plans, diffs, rollback procedures, verification criteria, and action digests from supplied artifacts only; holds no production credentials and executes nothing. Emits an audit event for every plan produced, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields from any artifact quoted in the plan.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-change-plan",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-code-remediation",
+    "name": "python-live-code-remediation",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Creates a branch and pull request and runs approved isolated validation for a code/dependency remediation. Cannot merge, deploy, or weaken policy.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://packaging.python.org/en/latest/",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
+    ],
+    "security_notes": "Mutating-runtime, limited to creating a branch/pull request and running approved isolated non-production validation: never merges, deploys, or weakens a policy/gate/test. Emits an audit event for every branch/PR creation and validation result, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields from any artifact quoted in the PR. Requires an external, target-bound approval, target-scoped just-in-time credentials, and a pre-approved rollback (revert) before creating the branch/PR or running validation.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-code-remediation",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-continuous-control-testing",
+    "name": "python-live-continuous-control-testing",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Periodically checks whether controls continue operating. Read-only by default. Opens findings with owners and due dates rather than silently remediating high-risk failures.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.nist.gov/cyberframework",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
+    ],
+    "security_notes": "Read-only-runtime by default: tests whether controls continue operating and opens findings with named owners and due dates; never mutates or silently remediates a production failure. Emits an immutable audit event for every observation; never uses shared or standing credentials; never retrieves raw secret values; redacts PII in captured evidence.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-continuous-control-testing",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-control-evidence",
+    "name": "python-live-control-evidence",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Collects, hashes, and stores control evidence in an approved destination and maps it to controls. Cannot approve or execute.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services",
+      "https://docs.python.org/3/library/hashlib.html"
+    ],
+    "security_notes": "Read-only-runtime: collects, hashes, and seals control evidence to an approved destination and maps it to controls; never mutates a live system, approves, or executes. Emits an immutable audit event for every observation; never uses shared or standing credentials; never retrieves raw secret values; redacts and tokenizes PII/sensitive fields before sealing, and never persists secrets.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-control-evidence",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-data-change-control",
+    "name": "python-live-data-change-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Governs migrations, backfills, pipeline reprocessing, and bounded data correction. Requires ownership, data classification, reconciliation evidence, and rollback evidence.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://gdpr-info.eu/",
+      "https://docs.python.org/3/library/decimal.html"
+    ],
+    "security_notes": "Mutating-runtime: executes an approved, bounded migration, backfill, pipeline reprocessing, or data correction. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts and tokenizes PII/regulated fields in captured evidence. Requires an external signed approval bound to the exact target and plan digest, JIT credentials, a pre-approved rollback, and reconciliation evidence before any action, and acts on exactly one bounded record/partition scope per approval — never an unbounded or expanded scope.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-data-change-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-exception-governance",
+    "name": "python-live-exception-governance",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Records policy exceptions and confirms owner, scope, expiration, compensating controls, and review date. Cannot approve its own exception. Automatically flags expired exceptions.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.iso.org/standard/27001",
+      "https://csrc.nist.gov/glossary/term/separation_of_duty"
+    ],
+    "security_notes": "Read-only-runtime: records and reviews policy exceptions and flags expired or incomplete ones; never approves, executes, or mutates a live system. Emits an immutable audit event for every observation; never uses shared or standing credentials; never retrieves raw secret values; redacts PII in captured evidence.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-exception-governance",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-governance-maestro",
+    "name": "python-live-governance-maestro",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Router for the Python live control plane. Classifies runtime, business process, data class, environment, and control profile, and routes to the narrowest live specialist. Routes only — cannot mutate, cannot approve, cannot declare compliance.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.nist.gov/cyberframework",
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
+      "https://docs.python.org/3/"
+    ],
+    "security_notes": "Read-only-runtime: classifies and routes only, never mutates, approves, or executes anything itself. Emits an audit event for every routing decision, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields from any task text or artifact it classifies.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-governance-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-identity-authority",
+    "name": "python-live-identity-authority",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Confirms active identity, role, credential age, target scope, JIT status, and approval authority before any gated action. Read-only. Blocks shared identities, unidentified principals, standing administrative credentials, and requester-as-approver conflicts.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://csrc.nist.gov/glossary/term/separation_of_duty",
+      "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
+    ],
+    "security_notes": "Read-only-runtime: verifies identity, credential currency, JIT scope, and approval authority via allowlisted identity/access queries only; never grants, elevates, or approves an action itself. Emits an audit event for every verification, never uses shared or standing credentials, never retrieves raw secret values or credential material, and redacts personally identifiable fields from captured evidence.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-identity-authority",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-job-control",
+    "name": "python-live-job-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Operates distributed jobs and business automation. Requires technical and business idempotency, and separates process completion from business completion.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://docs.celeryq.dev/en/stable/userguide/tasks.html",
+      "https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services"
+    ],
+    "security_notes": "Mutating-runtime: operates an approved, bounded distributed job or business-automation retry/requeue. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts PII in captured evidence. Requires an external signed approval bound to the exact target and plan digest, JIT credentials, a pre-approved rollback, and business-outcome reconciliation before any action, and acts on exactly one bounded job/retry scope per approval — never a blind mass-retry or expanded scope.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-job-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-model-promotion-control",
+    "name": "python-live-model-promotion-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Promotes exactly one immutable model artifact. Requires risk classification, evaluation evidence, monitoring, and rollback.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.nist.gov/itl/ai-risk-management-framework",
+      "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
+      "https://www.iso.org/standard/81230.html"
+    ],
+    "security_notes": "Mutating-runtime: promotes exactly one immutable, integrity-verified model artifact per approval. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts PII in captured evidence. Requires an external signed approval bound to the exact target and plan digest, JIT credentials, a pre-approved rollback to the prior artifact, and evaluation/monitoring reconciliation before any action, and acts on exactly one bounded artifact-promotion scope per approval — never multiple artifacts or an expanded scope.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-model-promotion-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-policy-gate",
+    "name": "python-live-policy-gate",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Evaluates machine-readable policies and control applicability against an action and its recorded inputs. Cannot create exceptions or approvals.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.nist.gov/cyberframework",
+      "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"
+    ],
+    "security_notes": "Read-only-runtime: evaluates the versioned policy bundle and applicability inputs to produce candidate control results only; never creates an exception or an approval. Emits an audit event recording the policy_bundle_version for every evaluation, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields from evaluation inputs.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-policy-gate",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-release-control",
+    "name": "python-live-release-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Executes one bounded release, canary increment, rollback, or single-instance restart. Requires independent approval and just-in-time credentials.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services",
+      "https://docs.python.org/3/"
+    ],
+    "security_notes": "Mutating-runtime: executes exactly one bounded release, canary increment, rollback, or single-instance restart per independent approval. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts PII in captured evidence. Requires an external signed approval bound to the exact target and plan digest, JIT credentials, a pre-approved rollback, and reconciliation before any action, and acts on exactly one bounded scope per approval — never a fleet-wide, unbounded, or expanded scope.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-release-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-rollback-and-recovery",
+    "name": "python-live-rollback-and-recovery",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Executes only previously approved rollback procedures. Cannot invent a rollback during an active failure. Requires the exact affected target and rollback authority.",
+    "source_type": "original",
+    "official_docs": [
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",
+      "https://www.nist.gov/cyberframework",
+      "https://docs.python.org/3/"
+    ],
+    "security_notes": "Mutating-runtime: executes only a previously approved, tested rollback procedure against the exact affected target. Emits an immutable audit event for every observation and action; never uses shared or standing credentials — only target-scoped, time-bound JIT credentials; never retrieves raw secret values; redacts PII in captured evidence. Requires an external signed approval bound to the exact affected target, JIT credentials, confirmation the rollback procedure was itself pre-approved and tested, and post-rollback reconciliation before executing, and acts on exactly one bounded affected-target scope per approval — never an improvised rollback or an additional target.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-rollback-and-recovery",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-runtime-control",
+    "name": "python-live-runtime-control",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Reads live interpreter, process, worker, task, thread, memory, and health state and performs allowlisted diagnostics. Cannot change application state.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/sys.html",
+      "https://docs.python.org/3/library/gc.html",
+      "https://docs.python.org/3/library/faulthandler.html"
+    ],
+    "security_notes": "Read-only-runtime: captures interpreter, process, worker, thread, memory, and health state via allowlisted read-only diagnostics only (sys, gc, faulthandler) and never restarts, kills, scales, or reconfigures a process. Emits an audit event for every diagnostic read, never uses shared or standing credentials, never retrieves raw secret values, and redacts personally identifiable fields captured in a diagnostic dump.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-runtime-control",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-live-system-inventory",
+    "name": "python-live-system-inventory",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Read-only discovery of Python runtimes, services, jobs, notebooks, packages, owners, environments, deployment revisions, service identities, and criticality. Produces asset and ownership evidence. Never retrieves raw credentials.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/importlib.metadata.html",
+      "https://packaging.python.org/en/latest/",
+      "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final"
+    ],
+    "security_notes": "Read-only-runtime: discovers assets via allowlisted list/get/describe queries only and never mutates a discovered asset. Emits an audit event for every discovery query, never uses shared or standing credentials, never retrieves raw secret values, keystores, or tokens, and redacts personally identifiable fields from any captured evidence.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-live-system-inventory",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-maestro",
+    "name": "python-maestro",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Router for the Python board. Classifies a Python application, runtime, packaging, framework, data, or code-level task and dispatches the narrowest static-review specialist (or a parallel team of up to four for genuinely multi-domain tasks). Routes only — never reviews Python work itself and never performs a live operation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/",
+      "https://packaging.python.org/en/latest/",
+      "https://peps.python.org/"
+    ],
+    "security_notes": "Classification and routing only. Never installs, runs, imports, or executes code, never builds, deploys, publishes, or migrates anything, never opens a live connection, and never requests secrets, tokens, API keys, connection strings, cloud credentials, or customer data. Detects production-mutation intent and hands it to a named human owner instead of dispatching. Treats task text and any pasted artifact as data to classify, never as instructions.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-ml-ai-production",
+    "name": "python-ml-ai-production",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python ML/AI production correctness — training-serving skew, feature/data leakage, artifact serialization safety, reproducibility, drift signals, batch-vs-online consistency, and model/prompt config provenance. Reads training/serving source, config, and eval artifacts only; never trains, loads, or serves a model.",
+    "source_type": "original",
+    "official_docs": [
+      "https://scikit-learn.org/stable/model_persistence.html",
+      "https://scikit-learn.org/stable/common_pitfalls.html",
+      "https://docs.python.org/3/library/pickle.html",
+      "https://numpy.org/doc/stable/reference/random/generator.html"
+    ],
+    "security_notes": "Static review only — reads training and serving source, feature-transformation code, model-persistence configuration, and evaluation artifacts to assess ML production correctness; never trains a model, loads a model artifact, serves inference, or connects to a live system. A claim about actual offline/online metric values or drift is flagged as needing observation against a real evaluation run. Never requests training/customer data or model-registry credentials.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-ml-ai-production",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-native-extension-interop",
+    "name": "python-native-extension-interop",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python native extensions and interop (CPython C API, Cython, PyO3/Rust): reference-ownership correctness, stable-ABI use, buffer-protocol safety, exception translation, and thread/GIL and free-threaded readiness. Reads extension source and build config only; never compiles or runs it.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/c-api/intro.html",
+      "https://docs.python.org/3/c-api/stable.html",
+      "https://docs.python.org/3/c-api/refcounting.html",
+      "https://docs.python.org/3/c-api/buffer.html"
+    ],
+    "security_notes": "Static review only — reads C/Cython/PyO3 extension source and build configuration to assess reference-ownership, buffer-protocol, exception-translation, and ABI/thread-safety correctness; never compiles, links, or runs the extension. A claim about an actual crash, leak, or free-threaded behavior is flagged as needing confirmation by compiling and running the extension. Never requests credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-native-extension-interop",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-numerical-scientific-correctness",
+    "name": "python-numerical-scientific-correctness",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python numerical and scientific correctness: binary float used for money, rounding-mode errors, silent dtype coercion and integer overflow, missing-data (NaN) handling, timezone-naive timestamps, unseeded randomness and irreproducibility, numerical instability, and unbenchmarked vectorization claims. Reads source only; never runs the calculation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/tutorial/floatingpoint.html",
+      "https://docs.python.org/3/library/decimal.html",
+      "https://pandas.pydata.org/docs/user_guide/timeseries.html#time-zone-handling",
+      "https://numpy.org/doc/stable/reference/random/generator.html"
+    ],
+    "security_notes": "Static review only — reads Python/pandas/numpy source and sanitized sample schemas to locate money-as-float, rounding, dtype-coercion, timezone, and reproducibility defects; never runs the calculation, notebook, or benchmark and never observes an actual numeric result or timing. A claim about a computed value or a performance improvement is flagged as needing execution/benchmark evidence rather than asserted. Never requests production data or a live database/warehouse connection.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-numerical-scientific-correctness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-observability-sre",
+    "name": "python-observability-sre",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of in-application Python observability — structured logs, metrics, traces, context propagation and correlation, error taxonomy, metric/label cardinality, PII exposure, and SLO-supporting instrumentation. Reads application instrumentation code only; routes collector/dashboard infrastructure to the platform boards.",
+    "source_type": "original",
+    "official_docs": [
+      "https://opentelemetry-python.readthedocs.io/en/stable/",
+      "https://opentelemetry.io/docs/concepts/context-propagation/",
+      "https://opentelemetry.io/docs/specs/semconv/",
+      "https://docs.python.org/3/library/logging.html"
+    ],
+    "security_notes": "Static review only — reads application instrumentation code (logging, metrics, and tracing calls) and telemetry configuration to assess observability correctness and safety; never runs the application, connects to a live telemetry backend, or emits telemetry itself. A claim about actual cardinality, cost, or trace completeness is flagged as needing observation against a real backend. Never requests telemetry-backend credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-observability-sre",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-packaging-supply-chain",
+    "name": "python-packaging-supply-chain",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python packaging and software supply-chain integrity: pyproject build metadata, dependency locking and hash-checking, index trust and dependency confusion, build isolation, dependency specifiers, license metadata, and CI release-token exposure. Reads manifests and lockfiles only; never installs packages or resolves environments.",
+    "source_type": "original",
+    "official_docs": [
+      "https://packaging.python.org/en/latest/specifications/pyproject-toml/",
+      "https://pip.pypa.io/en/stable/topics/secure-installs/",
+      "https://pip.pypa.io/en/stable/topics/repeatable-installs/",
+      "https://packaging.python.org/en/latest/specifications/dependency-specifiers/"
+    ],
+    "security_notes": "Static review only — reads `pyproject.toml`, `requirements`/constraints files, lockfiles, and CI definitions to assess locking, hashing, index trust, and build-isolation posture; never runs `pip install`, never resolves or downloads a package, and never contacts an index. A claim that a specific version is vulnerable is flagged as needing confirmation against an advisory source rather than asserted. Never requests index credentials, publish tokens, or customer data, and never installs an unreviewed package to inspect it.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-packaging-supply-chain",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-performance-memory",
+    "name": "python-performance-memory",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python performance and memory claims: CPU profiling vs benchmarking rigor, memory growth and allocation patterns, GC pressure, algorithmic complexity, and serialization/import/startup cost — refusing intuition as evidence. Reads source, profiles, and benchmark artifacts only; never runs the profiler or benchmark itself.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.python.org/3/library/profile.html",
+      "https://docs.python.org/3/library/tracemalloc.html",
+      "https://docs.python.org/3/library/gc.html",
+      "https://docs.python.org/3/library/timeit.html"
+    ],
+    "security_notes": "Static review only — reads source, profiler output (cProfile), benchmark artifacts (timeit/pytest-benchmark), and tracemalloc snapshots to assess performance and memory claims; never runs the profiler, the benchmark, or the application itself. A claim about actual latency, throughput, or memory growth with no supplied profile/benchmark/tracemalloc evidence is flagged as unsupported rather than accepted. Never requests credentials or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-performance-memory",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-testing-quality-engineering",
+    "name": "python-testing-quality-engineering",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Python test-suite quality (pytest, hypothesis): fixture scope and isolation, mock misuse and wrong-target patching, control of time/randomness/environment, flakiness sources, assertion quality, coverage theater, async-test correctness, and property-based-testing signal. Reads test and source code only; never runs the suite.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.pytest.org/en/stable/how-to/fixtures.html",
+      "https://docs.pytest.org/en/stable/how-to/monkeypatch.html",
+      "https://docs.python.org/3/library/unittest.mock.html",
+      "https://hypothesis.readthedocs.io/en/latest/"
+    ],
+    "security_notes": "Static review only — reads test code, fixtures, and the code under test to assess whether the suite reduces risk; never runs pytest, executes a test, or measures coverage. A claim about a test's actual pass/fail, coverage number, or flakiness rate is flagged as needing execution by the user. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-testing-quality-engineering",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "python-web-service-production-readiness",
+    "name": "python-web-service-production-readiness",
+    "type": "skill",
+    "provider": "python",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Framework-aware static review of Python web-service production readiness (FastAPI, Starlette, Django, Flask, ASGI/WSGI): sync-vs-async endpoint blocking, request validation, authentication and authorization boundaries, middleware order, worker model, timeouts, graceful shutdown, and health checks. Reads source and config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://fastapi.tiangolo.com/async/",
+      "https://www.starlette.io/",
+      "https://docs.djangoproject.com/en/stable/topics/security/",
+      "https://flask.palletsprojects.com/en/stable/"
+    ],
+    "security_notes": "Static review only — reads web-framework source, route and middleware definitions, and sanitized configuration to assess production readiness; never starts the server, sends a request, or observes runtime latency, worker behavior, or shutdown timing. A claim about actual request-handling or shutdown behavior is flagged as needing runtime confirmation. Never requests secrets, credentials, or a live connection. Framework-specific reference is loaded only when the framework is detected.",
+    "last_verified": "2026-07-26",
+    "path": "skills/python/python-web-service-production-readiness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "react-component-architecture-review",
     "name": "React Component Architecture Review",