@raishin/vanguard-frontier-agentic 3.6.0 → 3.6.1

package/skills/istio/istio-ambient-mesh-review/SKILL.md

@@ -3,7 +3,7 @@ name: istio-ambient-mesh-review
 description: Use this skill for Istio service mesh review across both sidecar mode and ambient mode (ztunnel L4 + optional waypoint L7). Covers PeerAuthentication, AuthorizationPolicy, RequestAuthentication, Gateway, VirtualService, DestinationRule, Sidecar, and waypoint placement. Trigger when the user asks whether an Istio policy is correct, whether mTLS is strict, whether L7 AuthorizationPolicy will actually be enforced in ambient mode, or whether a mesh-wide PeerAuthentication change is safe.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: security

package/skills/istio/istio-ambient-mesh-review/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "L7 AuthorizationPolicy rules in ambient mode are silently ignored when no waypoint is deployed — ztunnel only enforces L4. PeerAuthentication PERMISSIVE or DISABLE in production breaks mesh zero-trust. Mesh-wide root-namespace PeerAuthentication change has cluster-wide blast radius.",
   "last_verified": "2026-05-01",
   "path": "skills/istio/istio-ambient-mesh-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/java/java-application-server-exit/SKILL.md

@@ -3,7 +3,7 @@ name: java-application-server-exit
 description: Use this skill when producing a board-legible replatform-vs-renew (modernize/rehost/replatform/retire) recommendation for a proprietary Java application server (WebLogic, WebSphere, JBoss EAP or legacy JBoss) and/or an Oracle-JDK estate. Trigger when a user supplies specialist inventory findings (JDK lifecycle/support-boundary exposure, jakarta namespace debt, EJB/JAX-WS/SOAP usage, container-readiness) plus cost figures (current licence/support spend, target-state run cost, one-time migration/labor estimate) and asks whether to exit the platform, renew, or modernize in place, wanting a payback period, wave plan, and confidence level. This is a portfolio/business decision, not a code review — it consumes specialist findings and user-supplied costs as inputs and never re-derives them. Static/read-only: reads inventory exports, specialist reports, and sanitized cost figures only; never builds, runs, or contacts a live system, and never hardcodes vendor licence pricing. Refuses to produce a dollar figure without user-supplied cost inputs.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: cost-management

package/skills/java/java-application-server-exit/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads inventory exports, specialist agent reports, sanitized configuration, and user-supplied cost figures; never builds, runs, invokes a JDK, or contacts a live application server, license-management system, or vendor account. Never requests or embeds licence pricing, subscription tiers, contract terms, or customer/tenant headcount — those are user-supplied inputs only, never assumed or hardcoded.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-application-server-exit",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-application-server-exit/references/vendor-lifecycle-sources.md

@@ -40,7 +40,7 @@ If a cell cannot be verified against the primary source during the review, write
 
 ## Refresh protocol
 
-- **Refresh owner:** the Java board maintainer (`github: Raishin`) or a named delegate.
+- **Refresh owner:** the Java board maintainer (`github: VincentChuWaiChow`) or a named delegate.
 - **Cadence:** re-verify any boundary cited in an active review against its primary source at the time of that review — this reference does not cache dates. Re-read this file's source-page list at least quarterly for URL drift (vendors restructure support pages).
 - **On refresh:** update `last_verified` in the skill's `metadata.json` when the source-page list itself changes; record the read-on date in any table cell touched during a review.
 - This engine never consults the wall clock — behavior changes only when a committed reference changes or a user supplies a verified date. Do not encode "as of today" logic.

package/skills/java/java-concurrency-and-virtual-thread/SKILL.md

@@ -3,7 +3,7 @@ name: java-concurrency-and-virtual-thread
 description: Use this skill when statically reviewing Java concurrency and Project Loom virtual-thread adoption for correctness and safety at scale — pooling or capping virtual threads, a virtual-thread migration that strips a bound on a limited downstream resource (connection pool, rate-limited API) without re-imposing it via a Semaphore, JDK-version-gated carrier-pinning risk from synchronized blocks (materially reduced from JDK 24 onward by JEP 491 versus JDK 21's JEP 444), ThreadLocal cost at millions-of-threads scale, StructuredTaskScope's preview status, and classic concurrency hygiene (visibility/atomicity, unbounded ExecutorService queues, ThreadLocal leaks in pooled executors). Trigger when a user provides Java source using Thread.ofVirtual/Executors.newVirtualThreadPerTaskExecutor, ExecutorService construction, synchronized blocks, or JFR pinning output and asks whether their virtual-thread usage or concurrency code is correct. Reads source and sanitized configuration only; it never runs a build, invokes a JDK, attaches a profiler, or contacts a live system.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: compute

package/skills/java/java-concurrency-and-virtual-thread/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Java source (Thread.ofVirtual/newVirtualThreadPerTaskExecutor call sites, ExecutorService construction, synchronized blocks, ThreadLocal usage) and sanitized configuration (pool-size properties, rate-limiter config, any JFR/trace text the user pastes as plain text); never runs a build, invokes a JDK, attaches a profiler or JFR recorder, or opens a live thread dump/DB/broker connection. Never requests connection strings, credentials, tenant identifiers, or customer data.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-concurrency-and-virtual-thread",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-container-and-kubernetes-readiness/SKILL.md

@@ -3,7 +3,7 @@ name: java-container-and-kubernetes-readiness
 description: Use this skill when statically reviewing whether a JVM is correctly sized and configured for the container it runs in — UseContainerSupport and cgroup v1/v2 detection, -XX:MaxRAMPercentage or a fixed -Xmx sized to leave off-heap headroom (metaspace, thread stacks, direct/NIO buffers, code cache) under the container memory limit, ActiveProcessorCount vs CPU limits driving GC and thread-pool (ForkJoinPool) sizing, the interaction between GC stop-the-world pause time and Kubernetes liveness-probe timeouts (which causes kill/restart loops), the need for a startupProbe on slow JVM cold start, and heap-to-limit ratio. Trigger when a user provides a Dockerfile, JVM flags/env, a Kubernetes pod spec or Helm values (resources, probes), or reports OOMKilled pods, CPU throttling, or a probe-triggered restart loop on a Java service. Reads source and sanitized configuration only; it never opens a JDK, runs or profiles the workload, or reads live cgroup/proc filesystem state.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: platform

package/skills/java/java-container-and-kubernetes-readiness/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review of source, Dockerfiles, JVM flags/env, GC logs, and sanitized Kubernetes manifests or Helm values only; never opens a JDK, runs or profiles the workload, or reads live /proc or cgroup filesystem state. Never requests or accepts connection strings, credentials, tenant identifiers, cluster kubeconfigs, or customer data — ask for sanitized excerpts with placeholders.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-container-and-kubernetes-readiness",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-database-migration-safety/SKILL.md

@@ -3,7 +3,7 @@ name: java-database-migration-safety
 description: Use this skill when statically reviewing a Flyway or Liquibase schema-migration PR for rolling or blue-green deploy safety — immutable applied-migration discipline (checksum/history-table drift on an edited already-applied migration), expand-contract phasing for column/table drops and renames, destructive DDL (drop column/table, type narrowing, NOT NULL without a default on a populated table) landing in the same release that stops using it, long-locking DDL on large tables, out-of-order migrations, non-idempotent repeatable migrations, and a stated rollback/backfill plan. Trigger when a user provides migration scripts or changelogs, a schema diff, or asks whether a migration is safe to ship, safe to roll back, or safe to run alongside an older application version during rollout. Reads migration files and sanitized schema/config only; it never opens a database connection, runs a migration, or queries live schema state.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: database

package/skills/java/java-database-migration-safety/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads migration scripts (Flyway versioned/repeatable SQL or Java migrations) or Liquibase changelogs (XML/YAML/JSON/SQL), sanitized DDL/schema snapshots, and the application source that reads or writes the affected columns; never opens a database connection, runs a migration, or queries live schema state. Never requests connection strings, database credentials, tenant identifiers, or customer data — ask for migration files and schema snapshots with placeholders.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-database-migration-safety",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-deserialization-and-parser-security/SKILL.md

@@ -3,7 +3,7 @@ name: java-deserialization-and-parser-security
 description: Use this skill when statically reviewing the JVM's untrusted-deserialization and data-parsing surface for remote-code-execution and injection risk — Java native ObjectInputStream gadget chains (and the ObjectInputFilter/JEP 290 control), SnakeYAML bare Constructor, Jackson polymorphic default typing without a PolymorphicTypeValidator, XML external-entity (XXE) exposure across every parser factory, and reflective/expression sinks fed by untrusted input. Trigger when a user provides code that deserializes bytes or parses YAML/JSON/XML from a request, message, uploaded file, or external API, or asks whether a parser is safe. Reads source and sanitized configuration only; it never executes code or deserializes a payload.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: security

package/skills/java/java-deserialization-and-parser-security/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads source, deserialization/parsing call sites, and sanitized configuration; never executes code, deserializes a payload, or contacts a live system. Never requests secrets, tokens, or customer data.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-deserialization-and-parser-security",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-framework-production-readiness/SKILL.md

@@ -3,7 +3,7 @@ name: java-framework-production-readiness
 description: Use this skill when statically reviewing a Spring Boot, Quarkus, or Micronaut service for production readiness — externalized configuration, health/readiness/liveness endpoint wiring, graceful shutdown, jakarta namespace correctness plus the framework's JDK floor, build-time DI/AOT reflection safety, profile/config validation, and dependency BOM alignment. Trigger when a user provides a build file (pom.xml/build.gradle), application.properties/application.yml (sanitized), or source annotations and asks whether a service is ready to ship, what a pre-production checklist should cover, or why a rolling deploy drops requests or a native build fails at runtime. Reads source and sanitized configuration only; it never builds, runs, invokes a JDK, opens a live connection, or asserts framework EOL dates from memory.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: architecture

package/skills/java/java-framework-production-readiness/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads build files (pom.xml/build.gradle), application.properties/application.yml and profile variants, source annotations, and CI/Dockerfile config; never builds, runs, invokes a JDK, opens a database/broker connection, or contacts a live health endpoint. Never requests live secret values, connection strings, credentials, tenant identifiers, or customer data — ask for sanitized files with values redacted/placeholdered. Framework EOL/support-window facts are fail-closed: cited from the companion skill's verified reference or marked unknown, never asserted from memory.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-framework-production-readiness",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-framework-production-readiness/references/framework-support-and-eol-boundaries.md

@@ -37,7 +37,7 @@ If a cell cannot be verified against the primary source during the review, write
 
 ## Refresh protocol
 
-- **Refresh owner:** the Java board maintainer (`github: Raishin`) or a named delegate.
+- **Refresh owner:** the Java board maintainer (`github: VincentChuWaiChow`) or a named delegate.
 - **Cadence:** re-verify every boundary in this file against its primary source at least quarterly, and immediately when a user reports a discrepancy or a framework announces an EOL/support-window change.
 - **On refresh:** update the companion skill's `metadata.json` `last_verified` field, and record the read-on date in any table cell touched.
 - This reference never consults the wall clock — behavior changes only when the committed content changes. Encode the source and the read-on date, never "as of today" logic.

package/skills/java/java-jdk-lifecycle-and-upgrade/SKILL.md

@@ -3,7 +3,7 @@ name: java-jdk-lifecycle-and-upgrade
 description: Use this skill when statically reviewing a Java estate's JDK lifecycle and upgrade posture — identifying the JDK vendor and version, mapping them to support and license boundaries, finding language/API upgrade blockers, and prescribing a phased, evidence-gated upgrade path. Trigger when a user provides build files (pom.xml, build.gradle), toolchain/CI config, or a Dockerfile and asks whether their JDK is supported, what an upgrade will break, or how to sequence it. Reads build files and source only; it never runs a build, invokes a JDK, or asserts vendor lifecycle dates from memory.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.2.0"
   updated: "2026-07-17"
   category: platform

package/skills/java/java-jdk-lifecycle-and-upgrade/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads build files, toolchain/CI config, Dockerfile base images, and source; never runs a build, invokes a JDK, or contacts a live system. Never requests license keys, account identifiers, or contract/pricing data. Vendor lifecycle dates are cited from the verified reference (primary source = the vendor roadmap), never asserted from memory.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-jdk-lifecycle-and-upgrade",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-jdk-lifecycle-and-upgrade/references/jdk-support-and-license-boundaries.md

@@ -50,7 +50,7 @@ If a cell cannot be verified against the primary source during the review, write
 
 ## Refresh protocol
 
-- **Refresh owner:** the Java board maintainer (`github: Raishin`) or a named delegate.
+- **Refresh owner:** the Java board maintainer (`github: VincentChuWaiChow`) or a named delegate.
 - **Cadence:** re-verify every boundary in this file against its primary source at least quarterly, and immediately when a user reports a discrepancy or a new JDK LTS reaches GA.
 - **On refresh:** update the `last_verified` in the skill's `metadata.json`, and record the read-on date in any table cell you touch.
 - This engine never consults the wall clock — behavior changes only when this committed reference changes. Do not encode "as of today" logic; encode the source and the read-on date.

package/skills/java/java-jpa-hibernate-performance/SKILL.md

@@ -3,7 +3,7 @@ name: java-jpa-hibernate-performance
 description: Use this skill when statically reviewing JPA/Hibernate data access for fetch-strategy correctness and reliability — N+1 exposure, JOIN FETCH vs @EntityGraph vs @BatchSize vs DTO projection, LazyInitializationException and open-in-view misuse, pagination combined with a collection fetch (cartesian product), MultipleBagFetchException, and HikariCP connection-pool sizing. Trigger when a user provides entity classes, mappings, Spring Data repositories, or JPQL/Criteria queries and asks why queries are slow, why a page loads too much, or whether their data access is correct. Reads source and mapping only; it never opens a database connection, runs a query, or executes migrations.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: database

package/skills/java/java-jpa-hibernate-performance/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads entity classes, mappings, repository/query code, and sanitized configuration; never opens a database connection, runs a query, or executes migrations. Never requests connection strings, database credentials, tenant identifiers, or customer data.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-jpa-hibernate-performance",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-jvm-performance-and-gc/SKILL.md

@@ -3,7 +3,7 @@ name: java-jvm-performance-and-gc
 description: Use this skill when statically reviewing a proposed JVM garbage-collector or performance change — collector selection (G1, ZGC/Generational ZGC, Shenandoah, Parallel), allocation-pressure source patterns, heap-sizing/GC-flag configuration, and OOM/memory-leak triage. Trigger when a user proposes or has made a GC-collector switch, tunes GC/heap flags, shares JVM startup flags or a Dockerfile/K8s manifest with memory limits, or supplies GC logs, a JFR recording, or heap-dump analysis output and asks whether a change is justified or what a leak/OOM's root cause is. This is a static, source-only board: it cannot obtain live p99/p99.9 pause telemetry and refuses to issue a positive GC-switch recommendation without supplied pause-time or allocation evidence. Reads source and sanitized configuration only; never opens a live process, profiler, or heap dump.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: operational

package/skills/java/java-jvm-performance-and-gc/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Java/Kotlin source, JVM startup-flag configuration (launch scripts, Dockerfiles, systemd units, K8s manifests), and user-supplied GC logs, JFR recordings, and heap-dump analysis output (dominator-tree/leak-suspects text, not a raw .hprof binary). Never opens a live process, attaches a profiler or debugger, invokes a JDK tool against a running JVM, or requests/opens a live heap dump. Never requests credentials, connection strings, tenant identifiers, or customer data — ask for sanitized excerpts with placeholders.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-jvm-performance-and-gc",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-kafka-reliability/SKILL.md

@@ -3,7 +3,7 @@ name: java-kafka-reliability
 description: Use this skill when statically reviewing a Kafka producer/consumer pipeline for whether it actually delivers the delivery semantics it claims — idempotent-producer-vs-exactly-once conflation, transactional read-process-write wiring (transactional.id, initTransactions, sendOffsetsToTransaction, consumer isolation.level=read_committed), at-least-once with or without an idempotent consumer, commit-before-process message loss, ordering (max.in.flight.requests.per.connection combined with idempotence), consumer lag as the operational SLA signal, max.poll.interval.ms rebalance stalls, DLQ/retry-topic design, and acks=all plus min.insync.replicas durability. Trigger when a user provides producer/consumer configuration, Kafka client or Spring @KafkaListener code, or a topic/partition design and asks whether messages can be lost, duplicated, reordered, or stuck, or whether an "exactly-once" claim actually holds. Reads source and sanitized configuration only; it never opens a broker connection, produces or consumes a live message, or creates, alters, or deletes a topic.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: messaging

package/skills/java/java-kafka-reliability/metadata.json

@@ -22,5 +22,5 @@
   "security_notes": "Static review only — reads producer/consumer code, Kafka client configuration (acks, enable.idempotence, transactional.id, isolation.level, max.poll.* settings), topic durability settings, and sanitized application config; never opens a broker connection, produces/consumes a live message, creates/alters/deletes a topic, or runs a consumer group against a live cluster. Never requests broker bootstrap credentials, SASL/mTLS secrets, tenant identifiers, or customer data — ask for source and config with placeholders.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-kafka-reliability",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-maestro/SKILL.md

@@ -3,7 +3,7 @@ name: java-maestro
 description: Java Maestro routing skill. Classify the user's Java/JVM task, select the narrowest static-review specialist from the Java board (or the smallest team, max 4), and dispatch. Trigger when a user brings a Java, JVM, Spring, Jakarta EE, JDK-upgrade, JPA/Hibernate, or Java-security task and it is not yet clear which specialist should handle it. Routes only — never answers Java questions itself, never runs code, never requests secrets.
 allowed-tools: Agent Skill Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: ai

package/skills/java/java-maestro/metadata.json

@@ -22,5 +22,5 @@
   "security_notes": "Routing only — performs no review, never runs code, never requests secrets, connection strings, tokens, keystores, tenant identifiers, or customer data. Every dispatched Java specialist is static-review.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-maestro",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-resilience-pattern/SKILL.md

@@ -3,7 +3,7 @@ name: java-resilience-pattern
 description: Use this skill when statically reviewing resilience4j + Spring composition on a Java code path: decorator/aspect order between @Retry, @CircuitBreaker, @RateLimiter, @TimeLimiter, and @Bulkhead; retry safety on non-idempotent write paths (idempotency/dedup keys); TimeLimiter and total retry timeout-budget coherence; Bulkhead isolation strategy (semaphore vs thread pool); RateLimiter blocking/timeout behavior; fallback correctness (must not swallow the failure signal); bounded queues/backpressure; and retry composed with @Transactional (retry must wrap, not sit inside, the transaction). Trigger when a user provides resilience4j annotations/configuration or Decorators functional-chaining code and asks whether their resilience composition is correct, why a circuit breaker trips unexpectedly, why a timeout doesn't seem to apply, or whether a retry is safe on a given path. Reads source and sanitized configuration only; it never builds, runs, invokes a JDK, or opens a live connection.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: resilience

package/skills/java/java-resilience-pattern/metadata.json

@@ -24,5 +24,5 @@
   "security_notes": "Static review only — reads Java/Kotlin source, resilience4j annotations and Decorators functional-chaining code, and sanitized resilience4j.* application.yml/properties configuration; never builds, runs, invokes a JDK, opens a database/broker connection, or calls a live circuit-breaker, metrics, or actuator endpoint. Never requests credentials, connection strings, tenant identifiers, or customer data.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-resilience-pattern",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-spring-security/SKILL.md

@@ -3,7 +3,7 @@ name: java-spring-security
 description: Use this skill when statically reviewing a Spring Security 6 service's authorization and endpoint-exposure posture — multiple SecurityFilterChain beans and securityMatcher disjointness/ordering, authorizeHttpRequests matcher sequencing (first-match-wins, permitAll before authenticated, anyRequest() last), request-level vs @PreAuthorize/@PostAuthorize/@Secured method-security precedence, AuthorizationManager delegation and fail-closed behavior, CSRF on state-changing endpoints, and Spring Boot Actuator exposure (management.endpoints.web.exposure.include, EndpointRequest, securing /actuator). Trigger when a user provides Spring Security configuration (HttpSecurity/SecurityFilterChain beans, method-security annotations, actuator properties) or asks whether an endpoint or actuator surface is safely secured. Reads source and sanitized configuration only; it never builds, runs, or contacts a live system.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: security

package/skills/java/java-spring-security/metadata.json

@@ -22,5 +22,5 @@
   "security_notes": "Static review only — reads Java/Kotlin source, SecurityFilterChain bean definitions, and sanitized application.yml/properties; never builds, runs, or invokes a JDK, never opens a live HTTP/DB/broker connection, and never authenticates against a running application or calls a live /actuator endpoint. Never requests secrets, credentials, tokens, or customer data. This agent owns the Spring Security filter-chain and endpoint-exposure verdict for the board; it references but does not own untrusted-deserialization/parser RCE findings.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-spring-security",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-test-architecture/SKILL.md

@@ -3,7 +3,7 @@ name: java-test-architecture
 description: Use this skill when statically reviewing a JVM test suite's architecture for soundness and non-flakiness: JUnit 5 lifecycle and isolation (shared mutable static state, test-instance lifecycle, order dependence, time/locale/timezone dependence, and unguarded junit.jupiter.execution.parallel usage), Testcontainers discipline (singleton-container-with-Ryuk-reuse vs per-test @Container, explicit Wait strategies vs Thread.sleep), ArchUnit layering/cycle rules including FreezingArchRule brownfield adoption, and test-quality smells (assertion-free tests, over-mocking, coverage theater, missing negative tests) expressed via AssertJ/Mockito. Also trigger when a user reports a flaky JVM test and wants root-cause triage. Reads test source, ArchUnit rule definitions, and sanitized build/test configuration only; it never invokes a JDK, runs mvn/gradle test, starts a JUnit runner, or opens a Testcontainers/Docker daemon connection.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: delivery

package/skills/java/java-test-architecture/metadata.json

@@ -24,5 +24,5 @@
   "security_notes": "Static review only — reads JUnit 5 test source, Testcontainers module usage, ArchUnit rule definitions, and sanitized build/test configuration (pom.xml/build.gradle test blocks, junit-platform.properties, ~/.testcontainers.properties excerpts); never invokes a JDK, runs mvn/gradle test, starts a JUnit runner, opens a Docker/Testcontainers daemon connection, hits a database or broker, or contacts any live system. Never requests connection strings, database credentials, tenant identifiers, or customer data — ask for source with placeholders.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-test-architecture",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/java/java-transaction-and-consistency/SKILL.md

@@ -3,7 +3,7 @@ name: java-transaction-and-consistency
 description: Use this skill when statically reviewing Spring @Transactional boundary correctness — propagation (REQUIRED joining an existing transaction and silently ignoring an inner isolation/timeout; REQUIRES_NEW suspending it), isolation levels, readOnly, rollbackFor (checked exceptions do not roll back by default), proxy self-invocation bypass, and over-wide boundaries that hold a connection through an external call — plus cross-resource/cross-service consistency: the save()-then-send() dual-write anti-pattern (a DB commit and a broker publish are not atomic), the transactional-outbox/relay remedy, post-commit side effects that must use TransactionSynchronization or a separate REQUIRES_NEW step, and sagas with compensating actions versus fragile cross-service XA/2PC. Trigger when a user provides Spring service/repository code with @Transactional annotations, a call graph where a database write is followed by a message publish or another service call, or asks whether a transaction boundary, rollback rule, or cross-service consistency design is correct. Reads source and sanitized configuration only; it never opens a database or broker connection, starts a transaction, or executes code.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-17"
   category: data

package/skills/java/java-transaction-and-consistency/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Spring @Transactional-annotated classes, service/repository call graphs, and sanitized transaction-manager/datasource/broker configuration; never opens a database or broker connection, starts or commits a transaction, or executes code. Never requests connection strings, credentials, tenant identifiers, or customer data; ask for source with placeholders.",
   "last_verified": "2026-07-17",
   "path": "skills/java/java-transaction-and-consistency",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-android-architecture/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-android-architecture
 description: "Use this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: architecture

package/skills/kotlin/kotlin-android-architecture/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Kotlin/Compose source, ViewModel and lifecycle declarations, and sanitized configuration; never builds, runs, or instruments an app on a device, and never observes actual configuration-change or process-death behavior at runtime. Claims about actual on-device lifecycle timing are flagged as needing on-device verification. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-android-architecture",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-android-performance-reliability/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-android-performance-reliability
 description: "Use this skill to statically review measured Android runtime performance and reliability evidence: cold/warm startup via StartupTimingMetric and CompilationMode, frame jank via FrameTimingMetric/JankStats against the 60fps budget, Baseline Profile coverage, ANR root-causing against the main-thread-blocking threshold, and Macrobenchmark P50/P90/P99 regression-gating. Reads benchmark reports and source only; it never runs a benchmark or instruments a device."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: resilience

package/skills/kotlin/kotlin-android-performance-reliability/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Macrobenchmark/JankStats reports, Baseline Profile rules, and Kotlin/Gradle source; never runs a benchmark, builds an APK, or instruments a device itself, and never asserts a performance number that isn't backed by a supplied report. Any performance or reliability claim without a supplied benchmark artifact is flagged as unknown rather than asserted. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-android-performance-reliability",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-android-security-privacy/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-android-security-privacy
 description: "Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: security

package/skills/kotlin/kotlin-android-security-privacy/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads AndroidManifest.xml, Kotlin/Java source, Gradle config, and sanitized resource files; never builds, installs, runs, or instruments an app, never opens a live connection, and never handles real secrets or user data. Findings about runtime behavior (what an installed app actually exposes) are flagged as needing on-device verification. Never requests keystores, signing keys, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-android-security-privacy",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-backend-production-readiness/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-backend-production-readiness
 description: "Use this skill to statically review production readiness for Ktor servers and the Kotlin-on-Spring coroutine surface: server lifecycle/monitoring events, Netty/CIO graceful-shutdown configuration, StatusPages typed exception mapping, DI/AutoCloseable resource cleanup on shutdown, and correctly routing the coroutine-context-loss hazard behind suspend WebFlux handlers to its root-cause owner. Reads source and sanitized configuration only; it never runs or deploys a server."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: delivery

package/skills/kotlin/kotlin-backend-production-readiness/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Ktor/Spring Kotlin source, routing/plugin configuration, and sanitized YAML/config; never builds, runs, deploys, or opens a live connection to a server, and never observes actual shutdown/startup timing. A readiness claim that depends on runtime behavior (actual drain time, real health-check response) is flagged as needing verification against a running instance rather than asserted. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-backend-production-readiness",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-compose-ui-quality-accessibility/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-compose-ui-quality-accessibility
 description: "Use this skill to statically review Jetpack Compose UI correctness and accessibility: recomposition stability (@Stable/@Immutable, unstable parameters cascading recomposition), correct side-effect API usage with required cleanup, remember/derivedStateOf for recomposition scope, state hoisting and rememberSaveable, and mandatory semantics/contentDescription plus touch-target sizing for accessibility. Reads source only; it never renders or profiles the UI."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: delivery

package/skills/kotlin/kotlin-compose-ui-quality-accessibility/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Compose source and sanitized resources; never builds, runs, or renders the UI, never captures a live Layout Inspector or recomposition-count trace, and never invokes a device or emulator. Claims about actual measured recomposition counts or frame timing are flagged as needing profiler/Macrobenchmark verification rather than asserted. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-compose-ui-quality-accessibility",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-coroutines-flow-reliability/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-coroutines-flow-reliability
 description: "Use this skill to statically review Kotlin coroutine and Flow reliability — structured concurrency and cancellation cooperation, dispatcher selection and blocking-call confinement, cold Flow vs hot StateFlow/SharedFlow semantics and backpressure, and context propagation (transaction, trace, MDC, security) across suspension and dispatcher switches. Reads source only; it never runs coroutine code or profiles live timing."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: resilience

package/skills/kotlin/kotlin-coroutines-flow-reliability/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Kotlin source and sanitized configuration; never builds, runs, or invokes a JVM/Android runtime, never opens a live connection, and never executes coroutine code to observe timing. Runtime-ordering and race claims that cannot be confirmed from source are flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-coroutines-flow-reliability",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-estate-modernization-governor/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-estate-modernization-governor
 description: "Use this skill to statically review Java-to-Kotlin migration strategy and mixed-codebase governance: strangler-fig / module-by-module vs file-by-file sequencing, the mixed Java/Kotlin interop boundary and its platform-type null-safety debt, reversibility of each migration step, when a module should NOT be migrated, and governance of J2K automatic-converter output (review required, never merge as-is). Reads module inventories, dependency graphs, and sanitized diffs only; it never runs the converter, merges, or deploys."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: architecture

package/skills/kotlin/kotlin-estate-modernization-governor/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads module inventories, dependency graphs, sanitized source diffs, and J2K converter output; never builds, runs, or executes the actual migration (invoking the converter, merging, deploying), never opens a live connection, and never requests real credentials. Claims about a module's actual runtime churn, ownership, or business justification are flagged as needing confirmation from the owning team rather than asserted from the artifacts alone. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-estate-modernization-governor",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-gradle-build-engineering/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-gradle-build-engineering
 description: "Use this skill to statically review Gradle build-graph quality and CI throughput for Kotlin/KMP projects: configuration-cache compatibility (no execution-time Project access), build-cache correctness (@CacheableTask annotation completeness and relocatable/reproducible output), kapt vs KSP annotation-processing configuration and incremental opt-in, configuration-avoidance API usage, and convention-plugin (build-logic included build) centralization. Reads Gradle build files and build-scan evidence only; it never invokes Gradle or measures a live build."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: delivery

package/skills/kotlin/kotlin-gradle-build-engineering/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Gradle build files, convention-plugin sources, and sanitized build-scan/cache-hit evidence; never invokes Gradle, runs a build, or reads a live build-cache node. Throughput claims (cache-hit rate, build-time improvement) that are not backed by build-scan evidence are flagged as needing measurement rather than asserted. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-gradle-build-engineering",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-kmp-boundary-interop/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-kmp-boundary-interop
 description: "Use this skill to statically review Kotlin Multiplatform source-set architecture, expect/actual design and pairing completeness, platform-API-leakage prevention, cross-target dependency compatibility, Swift/Objective-C interop (suspend-to-async, @Throws, @ObjCName), and Kotlin/Native runtime correctness (new memory manager, freezing deprecation). Reads source and build configuration only; it never compiles or runs a target."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: architecture

package/skills/kotlin/kotlin-kmp-boundary-interop/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Kotlin Multiplatform source, Gradle source-set configuration, and sanitized build files; never builds, compiles, or runs a target (JVM/Native/JS/Wasm), never invokes Xcode or an iOS toolchain, and never executes generated Swift/Objective-C bridging code. Claims about a specific Kotlin/Gradle version's behavior that aren't confirmed by the supplied build files are flagged as assumption. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-kmp-boundary-interop",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-kmp-portfolio-decision/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-kmp-portfolio-decision
 description: "Use this skill to decide whether a product should adopt Kotlin Multiplatform at all, and how much to share, by weighing org topology and team ownership, product-roadmap alignment, platform-differentiation risk, skills/hiring constraints, lifecycle/maintenance cost, and reversibility. This skill can and must be able to recommend against KMP; it reasons from user-supplied context and never designs the expect/actual implementation."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: architecture

package/skills/kotlin/kotlin-kmp-portfolio-decision/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static analysis only — reasons from user-supplied product, team, and codebase context; never runs, builds, or migrates code, and never has access to real org data beyond what the user provides in the conversation. Claims about team capacity, roadmap timelines, or business priority that aren't confirmed by the user are flagged as assumption. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-kmp-portfolio-decision",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-language-api-correctness/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-language-api-correctness
 description: "Use this skill to statically review Kotlin language-level correctness: nullability and Java-interop platform types, inline functions with reified type parameters past JVM erasure, @JvmInline value-class boxing behavior, statically-dispatched extension functions vs member precedence, and lateinit use-before-init hazards. Reads source only; it never compiles or runs code to observe runtime null-pointer or boxing behavior."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: architecture

package/skills/kotlin/kotlin-language-api-correctness/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Kotlin source and sanitized Java-interop signatures; never compiles, runs, or executes code to observe an actual NullPointerException, boxing allocation, or dispatch outcome. A runtime-behavior claim not confirmed by the visible source is flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-language-api-correctness",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-library-api-abi-governance/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-library-api-abi-governance
 description: "Use this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: architecture