@raishin/vanguard-frontier-agentic 3.6.0 → 3.7.0

package/skills/azure/azure-role-selector/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "Prefer built-in job-function roles before custom roles, minimize assignment scope, separate control-plane and data-plane permissions, and do not default to Owner, Contributor, or wildcard custom roles for routine access requests.",
   "last_verified": "2026-06-05",
   "path": "skills/azure/azure-role-selector",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.2"
 }

package/skills/azure/azure-security-posture-hardening/SKILL.md

@@ -3,7 +3,7 @@ name: azure-security-posture-hardening
 description: Use this skill for Azure security posture review, baseline hardening, managed identity adoption, Key Vault posture, private access decisions, Azure Policy guardrails, and logging or audit gap analysis. Trigger when the user asks how to harden an Azure workload or platform without defaulting to broad access or public exposure.
 allowed-tools: Read Grep Glob
 metadata:
-  author: github: Raishin
+  author: github: VincentChuWaiChow
   version: 0.1.2
   updated: "2026-06-05"
   category: security

package/skills/azure/azure-security-posture-hardening/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "Do not recommend broad admin roles, stored secrets, legacy Key Vault access policies, or public exposure by default. Prefer managed identities, scoped RBAC, policy-enforced controls, private access where justified, soft delete/purge protection, and verified logging coverage.",
   "last_verified": "2026-06-05",
   "path": "skills/azure/azure-security-posture-hardening",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.2"
 }

package/skills/azure/azure-subscription-resource-organization/SKILL.md

@@ -3,7 +3,7 @@ name: azure-subscription-resource-organization
 description: Use this skill for Azure management-group hierarchy, subscription placement, resource-group boundary, and platform-versus-workload ownership decisions that affect governance, operations, and landing-zone scale.
 allowed-tools: Read Grep Glob
 metadata:
-  author: github: Raishin
+  author: github: VincentChuWaiChow
   version: 0.1.2
   updated: "2026-06-05"
   category: compliance

package/skills/azure/azure-subscription-resource-organization/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "Do not recommend flat hierarchies, fake isolation via resource groups, or subscription moves without proving governance, ownership, policy inheritance, RBAC, cost, quota, and operational blast-radius implications.",
   "last_verified": "2026-06-05",
   "path": "skills/azure/azure-subscription-resource-organization",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.2"
 }

package/skills/azure/azure-waf-cost-optimization-review/SKILL.md

@@ -3,7 +3,7 @@ name: azure-waf-cost-optimization-review
 description: "Review Azure workload cost posture against the Well-Architected Framework Cost Optimization pillar: cost modeling, rightsizing, reservations, hybrid benefit, storage lifecycle, and idle resource elimination."
 allowed-tools: Read Grep Glob
 metadata:
-  author: github: Raishin
+  author: github: VincentChuWaiChow
   version: 0.1.2
   updated: "2026-06-05"
   category: finops

package/skills/azure/azure-waf-cost-optimization-review/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "Read-only advisory by default. Do not delete resources, cancel commitments, modify billing configuration, buy reservations or savings plans, or alter budgets without explicit approval, owner confirmation, and current inventory evidence.",
   "last_verified": "2026-06-05",
   "path": "skills/azure/azure-waf-cost-optimization-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.2"
 }

package/skills/azure/azure-waf-reliability-review/SKILL.md

@@ -3,7 +3,7 @@ name: azure-waf-reliability-review
 description: "Review Azure workload reliability against the Well-Architected Framework Reliability pillar: availability targets, AZ/region topology, health monitoring, data resilience, deployment safety, and chaos testing."
 allowed-tools: Read Grep Glob
 metadata:
-  author: github: Raishin
+  author: github: VincentChuWaiChow
   version: 0.1.2
   updated: "2026-06-05"
   category: resilience

package/skills/azure/azure-waf-reliability-review/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "Read-only advisory by default. Do not modify autoscaling, backup, failover, traffic routing, deployment, or recovery settings without explicit approval, current-state evidence, blast-radius review, and rollback or failback plan.",
   "last_verified": "2026-06-05",
   "path": "skills/azure/azure-waf-reliability-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.2"
 }

package/skills/azure/azure-waf-security-review/SKILL.md

@@ -3,7 +3,7 @@ name: azure-waf-security-review
 description: "Review Azure workload security posture against the Well-Architected Framework Security pillar: identity and access, segmentation, data protection, threat detection, secure development lifecycle, incident response, and policy compliance."
 allowed-tools: Read Grep Glob
 metadata:
-  author: github: Raishin
+  author: github: VincentChuWaiChow
   version: 0.1.1
   updated: "2026-06-05"
   category: security

package/skills/azure/azure-waf-security-review/metadata.json

@@ -24,6 +24,6 @@
   "security_notes": "Read-only advisory by default. Do not modify Entra ID, Conditional Access, RBAC, PIM, Azure Policy, Defender, Sentinel, network controls, Key Vault, or production diagnostics without explicit approval, current-state evidence, blast-radius review, and rollback plan.",
   "last_verified": "2026-06-05",
   "path": "skills/azure/azure-waf-security-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.1"
 }

package/skills/backstage/backstage-scaffolder-template-review/SKILL.md

@@ -3,7 +3,7 @@ name: backstage-scaffolder-template-review
 description: Use this skill when reviewing Backstage Scaffolder software templates. Trigger when the user asks whether a template is safe for developer self-service, whether template RBAC gates are in place, whether input parameters are validated, whether a step action has excessive blast radius, or whether template outputs expose secrets.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: delivery

package/skills/backstage/backstage-scaffolder-template-review/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "Backstage Scaffolder templates without RBAC gate and without input validation allow any developer to trigger infrastructure provisioning actions. Templates that provision cloud resources via Terraform or Crossplane CRDs effectively grant cloud-write to all Backstage users.",
   "last_verified": "2026-05-02",
   "path": "skills/backstage/backstage-scaffolder-template-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cert-manager/cert-manager-issuer-trust-review/SKILL.md

@@ -3,7 +3,7 @@ name: cert-manager-issuer-trust-review
 description: Use this skill when reviewing cert-manager PKI configuration for Kubernetes clusters. Trigger when the user asks about Issuer or ClusterIssuer scope, CertificateRequestPolicy coverage, certificate SAN or duration risks, trust-manager bundle distribution, SPIFFE mesh CA integration, cert-manager webhook health, or cloud CA authentication method.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: security

package/skills/cert-manager/cert-manager-issuer-trust-review/metadata.json

@@ -17,6 +17,6 @@
   "security_notes": "A ClusterIssuer backed by a corporate Private CA with no CertificateRequestPolicy means any namespace can issue certs for any DNS name trusted by the corporate CA, enabling MITM against internal mTLS services.",
   "last_verified": "2026-05-02",
   "path": "skills/cert-manager/cert-manager-issuer-trust-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cilium/cilium-network-policy-review/SKILL.md

@@ -3,7 +3,7 @@ name: cilium-network-policy-review
 description: Use this skill for Cilium network policy review across the three policy formats (Kubernetes NetworkPolicy, CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy), L7 policy via embedded Envoy, ClusterMesh cross-cluster semantics, Hubble flow observability, and CiliumEgressGatewayPolicy. Trigger when the user asks whether a network policy is too broad, whether default-deny is in place, whether L7 rules will actually be enforced, whether ClusterMesh policy semantics are correct, or whether an egress gateway IP collision is possible.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: security

package/skills/cilium/cilium-network-policy-review/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "Removal of default-deny NetworkPolicy collapses namespace isolation. Unrestricted egress (0.0.0.0/0) is a documented exfiltration path. ClusterMesh policy-default-local-cluster flag flip changes cross-cluster semantics for every existing policy globally. CiliumEgressGatewayPolicy IP collisions cause silent connection breakage.",
   "last_verified": "2026-05-01",
   "path": "skills/cilium/cilium-network-policy-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/contabo/contabo-capacity-planner/SKILL.md

@@ -3,7 +3,7 @@ name: contabo-capacity-planner
 description: Advisory skill for Contabo resource planning across regions (EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND), instance tiers (VPS, VDS, Storage VPS), and add-ons (Private Networking, Additional IPs, Extra Storage, Custom Images). Includes Cloud-Init userData strategy and SSH key management via secret IDs. Use when the user needs to plan new deployments, evaluate region coverage, or compare instance tiers.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-10"
   category: platform

package/skills/contabo/contabo-capacity-planner/metadata.json

@@ -21,6 +21,6 @@
   "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — never cache or log them. Credentials must remain in environment variables. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual periods (1, 3, 6, 12 months) are binding at instance creation — capacity plans must declare the period and its billing impact. SSH keys are managed as secret IDs; never expose raw key material in plans or API calls.",
   "last_verified": "2026-05-10",
   "path": "skills/contabo/contabo-capacity-planner",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/contabo/contabo-cost-optimization-analyst/SKILL.md

@@ -3,7 +3,7 @@ name: contabo-cost-optimization-analyst
 description: Advisory skill for analyzing Contabo cost posture across contract periods, VPS/VDS product tiers, Storage VPS options, and add-ons including Private Networking, Additional IPs, Extra Storage, and Custom Images. Use when the user asks to reduce, explain, or optimize Contabo spending or when evaluating billing impact of period or sizing changes.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-10"
   category: finops

package/skills/contabo/contabo-cost-optimization-analyst/metadata.json

@@ -21,6 +21,6 @@
   "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — never cache or log them. Store CONTABO_CLIENT_ID, CONTABO_CLIENT_SECRET, CONTABO_API_USER, CONTABO_API_PASSWORD in environment variables only. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual billing periods (1, 3, 6, 12 months) create irreversible obligations — always surface billing impact before any sizing or period recommendation.",
   "last_verified": "2026-05-10",
   "path": "skills/contabo/contabo-cost-optimization-analyst",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/contabo/contabo-live-instance-lifecycle-guard/SKILL.md

@@ -3,7 +3,7 @@ name: contabo-live-instance-lifecycle-guard
 description: Live-guard skill for Contabo VPS and VDS lifecycle operations including instance creation with product selection and region, reinstallation with image and Cloud-Init userData, and cancellation. Requires mandatory contract period acknowledgment (1, 3, 6, or 12 months), billing impact confirmation, and a rollback plan before any mutation. Hard-stops any lifecycle action that lacks explicit period acknowledgment or rollback documentation.
 allowed-tools: Read Grep Glob Bash
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-10"
   category: platform

package/skills/contabo/contabo-live-instance-lifecycle-guard/metadata.json

@@ -20,6 +20,6 @@
   "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — refresh handling must not log token values. Credentials must remain in environment variables. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API with curl + jq. Contractual periods (1, 3, 6, 12 months) are binding at creation — cancellation may incur early-termination billing. x-request-id (UUIDv4) is mandatory for all mutation calls. Hard-stop on any lifecycle action without explicit period acknowledgment and rollback plan.",
   "last_verified": "2026-05-10",
   "path": "skills/contabo/contabo-live-instance-lifecycle-guard",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/contabo/contabo-live-storage-operations-guard/SKILL.md

@@ -3,7 +3,7 @@ name: contabo-live-storage-operations-guard
 description: Live-guard skill for Contabo Object Storage (S3-compatible) bucket operations including inventory audit, access policy review, retention policy enforcement, and deletion workflows. Hard-stops any bucket deletion requested without verified backup evidence and a documented rollback plan. Use when the user needs to manage, audit, or delete Contabo Object Storage buckets or objects.
 allowed-tools: Read Grep Glob Bash
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-10"
   category: platform

package/skills/contabo/contabo-live-storage-operations-guard/metadata.json

@@ -20,6 +20,6 @@
   "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — refresh handling must not log token values. Credentials must remain in environment variables. Contabo Object Storage is S3-compatible — S3 access key and secret key must be stored as environment variables, never hardcoded. x-request-id (UUIDv4) is mandatory for Contabo REST API calls. Hard-stop on any bucket deletion without verified backup evidence. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API with curl + jq and S3-compatible tools for Object Storage.",
   "last_verified": "2026-05-10",
   "path": "skills/contabo/contabo-live-storage-operations-guard",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/contabo/contabo-maestro/SKILL.md

@@ -3,7 +3,7 @@ name: contabo-maestro
 description: Router skill for classifying Contabo tasks and delegating to the narrowest specialist for cost analysis, capacity planning, security hardening, VPS/VDS lifecycle operations, or Object Storage management. Use when the user asks a Contabo question that spans multiple domains or needs triage before specialist engagement.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-10"
   category: platform

package/skills/contabo/contabo-maestro/metadata.json

@@ -20,6 +20,6 @@
   "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — never cache or log them. Credentials must remain in environment variables. The x-request-id UUIDv4 header is mandatory for support traceability. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual periods (1, 3, 6, 12 months) create billing obligations — never route lifecycle changes without explicit period acknowledgment.",
   "last_verified": "2026-05-10",
   "path": "skills/contabo/contabo-maestro",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/contabo/contabo-security-hardening/SKILL.md

@@ -3,7 +3,7 @@ name: contabo-security-hardening
 description: Advisory skill for hardening Contabo infrastructure security: SSH key management via secret IDs, default root and admin user policy, firewall posture review, OAuth2 credential hygiene including token short TTL and environment variable storage, and x-request-id UUIDv4 traceability for audit compliance. Use when the user needs to assess or improve Contabo instance or API security posture.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-10"
   category: security

package/skills/contabo/contabo-security-hardening/metadata.json

@@ -20,6 +20,6 @@
   "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — short TTL reduces exposure window but refresh logic must not log tokens. Credentials (CONTABO_CLIENT_ID, CONTABO_CLIENT_SECRET, CONTABO_API_USER, CONTABO_API_PASSWORD) must never be hardcoded. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. SSH keys are referenced via secret IDs — raw private key material must never appear in API payloads, scripts, or recommendations. The x-request-id UUIDv4 header is mandatory for audit traceability.",
   "last_verified": "2026-05-10",
   "path": "skills/contabo/contabo-security-hardening",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/audit-evidence-mapping-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: audit-evidence-mapping-protocol
 description: Use this skill when compliance controls must be mapped to audit evidence, when evidence collection, retention policy, and legal-hold status need to be assessed across Microsoft 365 workloads, or when an attestation package must be assembled for an auditor or regulator. Defines the end-to-end flow from control identification through evidence discovery, gap analysis, retention verification, legal-hold confirmation, and attestation sign-off. Does not serve as an authorization to release evidence to external parties; that requires a human compliance or legal owner. Does not replace qualified legal or audit counsel.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: compliance

package/skills/cross-functional/audit-evidence-mapping-protocol/metadata.json

@@ -15,6 +15,6 @@
   "security_notes": "Protocol is recommendation and orchestration only — never an authorization to release evidence to external parties or to modify retention policies, legal holds, or eDiscovery cases. All production-impacting steps (retention policy changes, legal-hold placement, evidence transmission to external auditors) must be escalated to the Purview compliance administrator and the human legal or compliance owner. Never requests credentials, tenant IDs, session tokens, or customer personal data to perform evidence discovery; works from sanitized control and workload scope signals only. Evidence touching legally privileged communications is flagged and routed to legal counsel before inclusion in any package. Special-category personal data triggers a jurisdiction confirmation gate before proceeding.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/audit-evidence-mapping-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/case-to-resolution-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: case-to-resolution-protocol
 description: Use this skill when a customer service case must be triaged, routed to the right team, driven to resolution, and captured as reusable knowledge in Dynamics 365 Customer Service. Covers intake-to-routing, SLA tracking, escalation gates, knowledge capture, and post-resolution CSAT. Orchestrates the d365-customer-service-contact-center-agent as primary and invokes human escalation when SLA risk or knowledge gaps are detected. Does not make final resolution decisions or override customer service policies; all production-impacting steps escalate to the relevant service owner or quality team.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: operational

package/skills/cross-functional/case-to-resolution-protocol/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "This protocol is a recommendation and orchestration aid only; it is never an authorisation to resolve, escalate, or close a case. It never requests customer credentials, session IDs, PII, or production Dynamics 365 org IDs to classify or route a case. Cases involving regulated personal data (health, financial) require compliance owner confirmation before proceeding. Knowledge articles produced by this protocol are submitted for human review before publishing and are never auto-published. Production configuration changes (SLA rules, routing rules, queue setup) escalate to the relevant service owner. CSAT data is handled in aggregate and is never used to identify individual representatives without HR and privacy-team approval.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/case-to-resolution-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/change-request-to-go-live-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: change-request-to-go-live-protocol
 description: Use this skill when a Dynamics 365 change request must be structured and progressed through impact assessment, fit-gap analysis, UAT sign-off, go/no-go decision, go-live execution, and hypercare using the Success by Design framework. Defines the full change-to-go-live flow — change request intake, solution blueprint alignment, testing gates, cutover plan verification, go/no-go decision, deployment, and hypercare. Does not authorize go-live, cutover execution, or production deployments; all production-impacting actions require human approval from the project sponsor, release manager, and Microsoft FastTrack for Dynamics 365 team (where engaged). Does not replace a qualified Dynamics 365 architect or implementation partner.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: delivery

package/skills/cross-functional/change-request-to-go-live-protocol/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "Protocol is recommendation and orchestration only — never an authorization for go-live, cutover execution, or production deployments. All production-impacting decisions (go/no-go, cutover initiation, rollback authorization) require explicit human approval from the project sponsor and release manager, recorded before any action is initiated. UAT sign-off is mandatory and cannot be bypassed. Rollback criteria must be defined before go-live begins; any blocking issue meeting rollback criteria requires immediate human escalation rather than a continue-over-risk decision by any agent. Never requests credentials, service principal secrets, tenant IDs, or production customer data to assess go-live readiness; works from sanitized test results, checklist signals, and change request documentation only.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/change-request-to-go-live-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/close-to-report-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: close-to-report-protocol
 description: Use this skill to coordinate the financial period close and reporting process across Dynamics 365 Finance and Microsoft Fabric / Power BI. It orchestrates subledger close, general ledger reconciliation, currency revaluation, consolidation, financial statement preparation, and report certification. The skill defines stage gates for subledger close, reconciliation sign-off, and report certification, and enforces structured handoffs between d365-finance-close-to-report-agent and fabric-power-bi-business-insights-governance-agent. It does not post journal entries, modify financial data, certify financial statements, or access live ledger credentials; all production-impacting steps are escalated to the relevant specialist or human finance owner.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: finance

package/skills/cross-functional/close-to-report-protocol/metadata.json

@@ -14,6 +14,6 @@
   "security_notes": "This protocol is a recommendation and orchestration guide only — it is never an authorization to post journal entries, modify financial data, re-open closed periods, or certify financial statements. All production-impacting steps require confirmation by the relevant human finance owner. The protocol never requests live ledger credentials, chart of accounts with actual balances, consolidation schedules with customer-level data, or tenant IDs. Report publication via fabric-power-bi-business-insights-governance-agent is blocked until the finance owner completes reconciliation sign-off and report certification. Manual journal entries without supporting documentation and human approval are refused. Backdated consolidation adjustments are refused and escalated.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/close-to-report-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/copilot-data-readiness-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: copilot-data-readiness-protocol
 description: Use this skill before enabling Microsoft 365 Copilot for any user population. Runs an oversharing assessment, applies sensitivity labels and DLP controls, validates permissions baseline, and confirms a secure data foundation exists. Orchestrates m365-copilot-readiness-governance-agent as primary, m365-identity-zero-trust-agent for identity-layer controls, and copilot-governance-maestro-agent for cross-pillar sign-off. Hard refusal: Microsoft 365 Copilot must not be enabled for any user until the oversharing baseline is established and remediated. Never requests credentials, tenant IDs, or customer data. Production-impacting steps escalate to the relevant data owner or compliance team.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: ai

package/skills/cross-functional/copilot-data-readiness-protocol/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "This protocol is a recommendation and orchestration aid only; it is never an authorisation to enable Microsoft 365 Copilot or to change data access permissions. Enabling Copilot without an oversharing baseline is a hard refusal — no exception. It never requests credentials, tenant IDs, or customer PII to perform assessments; all inputs are aggregate governance signals. Critical-risk sites without interim protection (SAM Restricted Content Discovery, Purview DLP) block the enablement recommendation until remediated or accepted by the data owner. Sensitivity label coverage and DLP guardrails must be confirmed by the data owner and security team before any go recommendation. Production SharePoint, Purview, or Entra configuration changes escalate to the relevant service owner. This protocol does not publish knowledge articles, modify sharing settings, or change Conditional Access policies autonomously.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/copilot-data-readiness-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/data-classification-to-dlp-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: data-classification-to-dlp-protocol
 description: Use this skill when sensitive data must be discovered, classified with Microsoft Purview sensitivity labels, protected by Data Loss Prevention policies, and monitored for label adoption and DLP policy effectiveness across Microsoft 365 and Power Platform environments. Defines the end-to-end flow from data discovery through classification taxonomy design, sensitivity label deployment, DLP policy coverage, and adoption monitoring. Does not authorize the creation or modification of sensitivity labels, DLP policies, or auto-labeling policies; all production-impacting policy changes require human approval from the Purview compliance administrator and the data owner. Does not replace qualified information protection or compliance counsel.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: compliance

package/skills/cross-functional/data-classification-to-dlp-protocol/metadata.json

@@ -15,6 +15,6 @@
   "security_notes": "Protocol is recommendation and orchestration only — never an authorization to create, modify, or delete sensitivity labels, DLP policies, or auto-labeling policies. All production-impacting policy changes require explicit approval from the Purview compliance administrator and the data owner. Encryption settings on sensitivity labels covering regulated data must not be removed without legal and compliance owner review. Never requests credentials, tenant IDs, session tokens, or customer personal data to perform the classification assessment; works from sanitized taxonomy and policy summary signals only. Special-category personal data (health, biometric, genetic) triggers a jurisdiction and privacy owner confirmation gate. Deliberate under-classification of regulated personal data to evade regulatory obligations is a hard refusal trigger. Planned escalation target: purview-information-protection-specialist-agent (not yet built); current escalation routes to m365-maestro-agent.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/data-classification-to-dlp-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/environment-to-production-release-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: environment-to-production-release-protocol
 description: Use this skill when a Power Platform or Dynamics 365 solution must progress through a structured dev-to-test-to-production release pipeline using managed solutions and Power Platform pipelines, when rollback readiness must be verified before go-live, or when a deployment approval gate must be enforced. Defines the full ALM release flow — solution packaging, pipeline stage progression, pre-deployment validation, approval, deployment, rollback verification, and post-deployment confirmation. Does not authorize production deployments directly; all production-impacting actions require human approval from the environment owner or release manager. Does not replace a qualified Power Platform admin or ALM specialist.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: delivery

package/skills/cross-functional/environment-to-production-release-protocol/metadata.json

@@ -15,6 +15,6 @@
   "security_notes": "Protocol is recommendation and orchestration only — never an authorization for production deployments. All production-impacting deployment actions require explicit human approval from the environment owner or release manager, recorded before the deployment is initiated. Only managed solutions may be deployed to test or production environments; unmanaged solutions targeting non-development environments are a hard refusal trigger. Never requests credentials, service principal secrets, tenant IDs, or customer data to validate or initiate a deployment; works from sanitized pipeline configuration and solution metadata signals only. Rollback plan must be documented and acknowledged before production deployment proceeds.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/environment-to-production-release-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/erp-crm-cutover-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: erp-crm-cutover-protocol
 description: Use this skill when a Dynamics 365 ERP or CRM implementation is approaching go-live and must progress through mock migration, data reconciliation, cutover runbook execution, rollback testing, and the Success by Design go-live gate before production switchover. Orchestrates d365-data-migration-cutover-agent as primary, d365-success-by-design-governance-agent for SbD gate sign-off, and d365-security-sod-governance-agent for separation-of-duties validation. Gates include reconciliation sign-off, rollback readiness, and SbD go-live gate. Never makes the go/no-go decision autonomously; all production-impacting steps require human owner and Microsoft FastTrack confirmation where applicable.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: data

package/skills/cross-functional/erp-crm-cutover-protocol/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "This protocol is a recommendation and orchestration aid only; it is never an authorisation to execute a production migration, cutover, or go-live. It never requests production environment credentials, database connection strings, org IDs, or customer data as protocol inputs. The go/no-go decision requires explicit sign-off from the human project steering committee and Microsoft FastTrack (where applicable). Reconciliation sign-off must come from the named data owner; estimated or assumed sign-off is refused. Rollback plans that have not been rehearsed in a sandbox block the cutover recommendation unconditionally. Separation-of-duties violations in production security roles must be remediated before go-live is recommended. All SbD blocking issues require the named issue owner to confirm resolution before the SbD gate is cleared.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/erp-crm-cutover-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/field-service-to-cash-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: field-service-to-cash-protocol
 description: Use this skill to orchestrate the field service to cash process (service to deliver) across Dynamics 365 Field Service and Dynamics 365 Finance, covering work order creation through service delivery, parts and inventory consumption, invoicing, and accounts receivable settlement. The skill defines stage gates, agent handoff rules, and escalation triggers so that service work is verified before invoicing, inventory is accurately consumed, and revenue is recognized correctly. It does not create or modify work orders, post invoices, approve service completions, or access field engineer credentials; all production-impacting steps are escalated to the relevant specialist or human owner.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: operational

package/skills/cross-functional/field-service-to-cash-protocol/metadata.json

@@ -14,6 +14,6 @@
   "security_notes": "This protocol is a recommendation and orchestration guide only — it is never an authorization to create or close work orders, post invoices, approve service completions, modify inventory records, or execute live financial transactions. All production-impacting steps require confirmation by the relevant human owner or specialist agent. The protocol never requests customer PII, field technician credentials, service contract financial terms with customer-specific pricing, or Dynamics 365 tenant IDs. Invoicing for incomplete work orders and backdated work order completions are explicitly refused. Inventory adjustments without corresponding work order consumption records are refused.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/field-service-to-cash-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/identity-to-data-access-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: identity-to-data-access-protocol
 description: Use this skill when an identity lifecycle event (joiner, mover, leaver) or an access request must be evaluated end-to-end across Microsoft Entra identity, Conditional Access policy, and data access governance under a Zero Trust posture. Orchestrates m365-identity-zero-trust-agent as primary and m365-copilot-readiness-governance-agent for data-layer governance. Gates include access review sign-off and least-privilege validation before any access grant is recommended. Does not approve access; all recommendations require human owner confirmation. Never requests credentials, tenant IDs, or customer data.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: security

package/skills/cross-functional/identity-to-data-access-protocol/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "This protocol is a recommendation and orchestration aid only; it is never an authorisation to grant, deny, or modify access. It never requests credentials, session tokens, tenant IDs, or customer PII to evaluate an identity or access request. Standing Global Administrator or equivalent assignments without PIM are unconditionally blocked as a recommendation — escalate to the identity owner. Separation-of-duties violations block any access recommendation and escalate to the security owner. All access recommendations require human identity or security owner sign-off before any provisioning action. Data governance findings from the data-layer agent are always preserved and never discarded. Production identity or Conditional Access configuration changes escalate to the relevant identity admin.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/identity-to-data-access-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/incident-to-remediation-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: incident-to-remediation-protocol
 description: Use this skill when a security incident must be triaged, contained, remediated, and reviewed in a Zero Trust assume-breach posture across Microsoft 365 and Dynamics 365 environments. Defines the end-to-end flow from detection through severity triage, containment approval, investigation, remediation, and post-incident review. Applies Zero Trust principles — verify explicitly, use least privilege, assume breach — throughout. Does not serve as an authorization to isolate devices, block users, or make configuration changes; all containment and remediation actions require human approval from the security owner or incident commander. Does not replace a qualified SecOps team or Microsoft Defender XDR specialist.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: security

package/skills/cross-functional/incident-to-remediation-protocol/metadata.json

@@ -15,6 +15,6 @@
   "security_notes": "Protocol is recommendation and orchestration only — never an authorization for containment or remediation actions. All actions that isolate devices, disable users, block IPs or domains, or revoke sessions require explicit human approval from the incident commander or security owner before execution. Zero Trust assume-breach posture is mandatory throughout: scope of compromise is never minimized. Never requests credentials, session tokens, OAuth tokens, or personal data to perform investigation; works from sanitized incident signals and audit log references only. Data breach scenarios with regulatory notification obligations must be escalated to the privacy owner and legal counsel; this protocol does not govern breach notification timelines or obligations. Planned escalation target: defender-xdr-secops-agent (not yet built); current escalation routes to microsoft-maestro-agent.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/incident-to-remediation-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/lead-to-cash-protocol/SKILL.md

@@ -3,7 +3,7 @@ name: lead-to-cash-protocol
 description: Use this skill to orchestrate the end-to-end lead-to-cash business process across Dynamics 365 Sales, Supply Chain Management, and Finance. It coordinates the journey from a qualified sales opportunity through order creation, fulfillment, invoicing, and final revenue recognition. The skill defines stage gates, agent handoff rules, escalation triggers, and decision logic for cross-functional coordination. It does not make business decisions, approve credit limits, authorize revenue recognition treatments, or execute any system transactions; all production-impacting steps are escalated to the relevant specialist or human owner.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: operational

package/skills/cross-functional/lead-to-cash-protocol/metadata.json

@@ -14,6 +14,6 @@
   "security_notes": "This protocol is a recommendation and orchestration guide only — it is never an authorization for system transactions, credit approvals, revenue recognition treatments, or pricing changes. All production-impacting steps must be confirmed by the relevant human owner or specialist agent. The protocol never requests customer credentials, tenant IDs, payment card data, or personal customer data. Credit limit overrides require documented approval before any agent proceeds. Revenue recognition ambiguity triggers an immediate pause and human escalation rather than an agent judgment call.",
   "last_verified": "2026-06-16",
   "path": "skills/cross-functional/lead-to-cash-protocol",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/legal-hr-case-capsule/SKILL.md

@@ -3,7 +3,7 @@ name: legal-hr-case-capsule
 description: Use this skill when a Legal or HR agent must hand a matter to another agent and the context, uncertainty, evidence quality, privilege posture, and privacy posture must survive the handoff. It defines the shared legal-hr-case-capsule — a controlled, auditable exchange record with redacted identifiers, risk labels, privilege and privacy labels, a decision-owner field, and an explicit do-not-do list. It does not give legal or HR advice and does not authorize any action.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-18"
   category: compliance

package/skills/cross-functional/legal-hr-case-capsule/metadata.json

@@ -14,6 +14,6 @@
   "security_notes": "Defines a minimum-necessary handoff record; never carries medical records, government IDs, credentials, privileged email text, or protected-class data beyond what the matter requires. Never authorizes action; flags privilege and privacy posture and routes decisions to a named human owner.",
   "last_verified": "2026-05-18",
   "path": "skills/cross-functional/legal-hr-case-capsule",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/cross-functional/legal-hr-risk-taxonomy/SKILL.md

@@ -3,7 +3,7 @@ name: legal-hr-risk-taxonomy
 description: Use this skill to assign consistent risk labels to a Legal or HR matter — severity ratings, privilege and privacy sensitivity labels, retaliation and discrimination risk labels, matter-type classes, escalation-gate triggers, and the audit-log schema. It standardizes the vocabulary every Legal and HR agent and case capsule uses so risk is rated the same way across the ecosystem. It does not give legal or HR advice and never concludes that a matter is safe or compliant.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-18"
   category: compliance

package/skills/cross-functional/legal-hr-risk-taxonomy/metadata.json

@@ -14,6 +14,6 @@
   "security_notes": "A risk rating is an opinion on exposure, never a clearance; never records a matter as compliant or safe. The audit-log schema is minimum-necessary and carries labels and summaries, never raw medical, privileged, credential, or protected-class content. Rates Unknown and escalates when facts are missing.",
   "last_verified": "2026-05-18",
   "path": "skills/cross-functional/legal-hr-risk-taxonomy",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }