@raishin/vanguard-frontier-agentic 3.6.0 → 3.7.0

package/skills/finance/fpa-forecasting-advisor/metadata.json

@@ -7,7 +7,7 @@
   "summary": "Reference framework for financial planning and analysis (FP&A) covering driver-based budgeting, rolling forecasts, zero-based budgeting (ZBB), scenario and sensitivity analysis, budget-versus-actual variance analysis, long-range planning (LRP), integrated P&L/balance sheet/cash flow modeling, xP&A, FP&A technology platforms (Anaplan, Adaptive Insights/Workday Adaptive Planning, OneStream, Vena, IBM TM1/Planning Analytics, Oracle EPM), and MD&A narrative support. Applicable across US GAAP, IFRS, and UK FRS 102 reporting contexts.",
   "source_type": "original",
   "path": "skills/finance/fpa-forecasting-advisor",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "last_verified": "2026-06-03",
   "lifecycle": "experimental",

package/skills/finance/transfer-pricing-pillar-two-advisor/SKILL.md

@@ -3,7 +3,7 @@ name: transfer-pricing-pillar-two-advisor
 description: Multi-jurisdiction reference framework for OECD transfer pricing (arm's length principle, five TP methods, BEPS Action 13 documentation, CbCR) and OECD Pillar Two GloBE rules (IIR, UTPR, QDMTT, ETR computation, SBIE carve-outs, safe harbors, deferred tax divergence under IAS 12 vs. ASC 740). Advisory only — never files tax returns, submits CbCR, or engages in competent authority proceedings.
 allowed-tools: Skill Read WebFetch Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-02"
   category: finance

package/skills/finance/transfer-pricing-pillar-two-advisor/metadata.json

@@ -7,7 +7,7 @@
   "summary": "Multi-jurisdiction reference framework for OECD transfer pricing (arm's length principle Art. 9 OECD Model, five TP methods — CUP/resale-minus/cost-plus/TNMM/profit-split, BEPS Action 13 three-tier documentation, CbCR threshold and Form 8975) and OECD Pillar Two GloBE rules (IIR, UTPR, QDMTT, ETR computation, SBIE payroll and tangible asset carve-outs, transitional safe harbors, deferred tax divergence under IAS 12.4A vs. ASC 740). Covers US §482/GILTI/FDII, EU ATAD, UK TIOPA/DPT, Germany § 1 AStG, Japan Articles 66-4, China SAT Announcement 2016 No.42, and India Section 92-92F.",
   "source_type": "original",
   "path": "skills/finance/transfer-pricing-pillar-two-advisor",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "last_verified": "2026-06-02",
   "lifecycle": "experimental",

package/skills/finance/treasury-liquidity-advisor/SKILL.md

@@ -3,7 +3,7 @@ name: treasury-liquidity-advisor
 description: Multi-jurisdiction reference framework for corporate treasury operations, cash and liquidity management, FX and currency risk, hedge accounting qualification (ASC 815 / IFRS 9), FX translation (ASC 830 / IAS 21), Basel III LCR/NSFR, Dodd-Frank and EMIR derivatives reporting, and country-specific cash repatriation and capital control regimes (China SAFE, India FEMA, Brazil IOF, Argentina BCRA). Advisory only — never executes transactions or writes to any system of record.
 allowed-tools: Skill Read WebFetch Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-01"
   category: finance

package/skills/finance/treasury-liquidity-advisor/metadata.json

@@ -7,7 +7,7 @@
   "summary": "Multi-jurisdiction reference framework for corporate treasury operations, cash and liquidity management, FX and currency risk, hedge accounting qualification (ASC 815 / IFRS 9), FX translation (ASC 830 / IAS 21), Basel III LCR/NSFR, Dodd-Frank and EMIR derivatives reporting, and country-specific cash repatriation and capital control regimes (China SAFE, India FEMA, Brazil IOF, Argentina BCRA).",
   "source_type": "original",
   "path": "skills/finance/treasury-liquidity-advisor",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "last_verified": "2026-06-01",
   "lifecycle": "experimental",

package/skills/finance/variance-analysis-advisor/SKILL.md

@@ -3,7 +3,7 @@ name: variance-analysis-advisor
 description: Variance decomposition framework and SEC Regulation S-K Item 303 MD&A commentary guidance for FP&A and corporate finance teams. Provides driver decomposition methodology (Volume/Price/Rate/Mix/One-Time), MD&A structural requirements with regulatory citations, restatement-risk trigger catalog, sensitivity analysis templates, and materiality threshold guidance. Advisory only — all draft commentary requires CFO certification and legal review before filing.
 allowed-tools: Skill Read WebFetch Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-01"
   category: finance

package/skills/finance/variance-analysis-advisor/metadata.json

@@ -4,7 +4,7 @@
   "type": "skill",
   "category": "finance",
   "version": "0.1.0",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "lifecycle": "experimental",
   "path": "skills/finance/variance-analysis-advisor",
   "description": "Complete variance decomposition framework and SEC Reg S-K Item 303 MD&A commentary guidance. Includes driver decomposition methodology, MD&A structural requirements with regulatory citations, restatement-risk triggers, sensitivity templates, and materiality threshold guidance.",

package/skills/finance/working-capital-advisor/SKILL.md

@@ -3,7 +3,7 @@ name: working-capital-advisor
 description: Multi-jurisdiction reference framework for working capital management — cash conversion cycle (CCC) optimization, accounts receivable management (collections, credit policy, aging analysis, factoring, invoice discounting, AR securitization, ASC 860 / IFRS 9 SPPI derecognition), accounts payable optimization (payment term extension, dynamic discounting, supply chain finance / reverse factoring, IAS 7.44A / ASU 2022-04 classification), inventory management (EOQ, JIT, safety stock, ABC analysis, IAS 2 vs. ASC 330), 13-week rolling cash forecasting (IAS 7 direct method), and working capital financing (ABL, receivables financing, SCF platforms, trade finance). Advisory only — never writes to ERP, AR/AP systems, or any system of record.
 allowed-tools: Skill Read WebFetch Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-03"
   category: finance

package/skills/finance/working-capital-advisor/metadata.json

@@ -7,7 +7,7 @@
   "summary": "Multi-jurisdiction reference framework for working capital management — cash conversion cycle (CCC) optimization, accounts receivable management (collections, credit policy, aging analysis framework, factoring, invoice discounting, AR securitization, ASC 860 / IFRS 9 SPPI derecognition), accounts payable optimization (payment term extension, dynamic discounting, supply chain finance / reverse factoring, IAS 7.44A / ASU 2022-04 classification), inventory management (EOQ, JIT, safety stock, ABC analysis, IAS 2 vs. ASC 330), 13-week rolling cash forecasting (IAS 7 / ASC 230), and working capital financing (ABL, receivables financing, SCF platforms, trade finance). Covers US GAAP, IFRS, and APAC jurisdictions.",
   "source_type": "original",
   "path": "skills/finance/working-capital-advisor",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "last_verified": "2026-06-03",
   "lifecycle": "experimental",

package/skills/finops/carbon-cost-pair/SKILL.md

@@ -3,7 +3,7 @@ name: carbon-cost-pair
 description: Pair every cloud spend value with a kgCO2e estimate by region and service category for CSRD and SEC climate disclosure. Input is region, service category, and dollar value; output is paired kgCO2e with confidence label (vendor-published, third-party, or estimated) and source citation. Defaults to electricity-only Scope 2 market-based factors.
 allowed-tools: Read Grep Glob WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.1"
   updated: "2026-05-13"
   category: finops

package/skills/finops/carbon-cost-pair/metadata.json

@@ -21,7 +21,7 @@
   "security_notes": "No cloud credentials, billing account IDs, sustainability API tokens, or tenant-specific data are accepted or required. All carbon factors are fetched from public provider sustainability pages or third-party data sources. No write operations to any system are performed.",
   "last_verified": "2026-05-13",
   "path": "skills/finops/carbon-cost-pair",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.1",
   "lifecycle": "experimental"
 }

package/skills/finops/fetch-foundation-model-pricing/SKILL.md

@@ -3,7 +3,7 @@ name: fetch-foundation-model-pricing
 description: Fetch live per-token, per-image, and per-GPU-hour prices for foundation models across Anthropic, OpenAI, Google, AWS Bedrock, Azure OpenAI, OCI Generative AI, and Vertex AI. Supports single-model lookup and comparative multi-provider tables. Every price is labeled with source URL and ISO 8601 fetch timestamp. No credentials accepted.
 allowed-tools: Read Grep Glob WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.1"
   updated: "2026-05-13"
   category: finops

package/skills/finops/fetch-foundation-model-pricing/metadata.json

@@ -24,7 +24,7 @@
   "security_notes": "All provider pricing pages are public and unauthenticated. Never accept or request API keys, billing account IDs, cost export access, tenant IDs, or any cloud credentials to fetch list prices.",
   "last_verified": "2026-05-13",
   "path": "skills/finops/fetch-foundation-model-pricing",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.1",
   "lifecycle": "experimental"
 }

package/skills/finops/finops-cloud-price-advisor/SKILL.md

@@ -3,7 +3,7 @@ name: finops-cloud-price-advisor
 description: Fetch live public prices and build cost estimates for AWS, Azure, OCI, Scaleway, Gandi, Alibaba Cloud, and Tencent Cloud using each provider's public pricing API or official documentation. Supports live-environment cost analysis and prototype cost planning. Currency defaults to USD; EUR and CNY supported natively.
 allowed-tools: Read Grep Glob WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.2.1"
   updated: "2026-05-13"
   category: finops

package/skills/finops/finops-cloud-price-advisor/metadata.json

@@ -26,7 +26,7 @@
   "security_notes": "AWS, Azure, OCI, and Scaleway pricing APIs are public and require no authentication. Gandi requires a user-provided API key (never stored by the agent; discarded after single use). Alibaba Cloud and Tencent Cloud pricing is fetched via scrape-based fallback from official pricing pages — no credentials required or accepted.",
   "last_verified": "2026-05-13",
   "path": "skills/finops/finops-cloud-price-advisor",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.2.1",
   "lifecycle": "experimental"
 }

package/skills/finops/finops-maestro/SKILL.md

@@ -3,7 +3,7 @@ name: finops-maestro
 description: Route FinOps tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know the specialist. Not for direct FinOps answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any live mutation specialist.
 allowed-tools: Agent Skill Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.1"
   updated: "2026-05-13"
   category: ai

package/skills/finops/finops-maestro/metadata.json

@@ -20,7 +20,7 @@
   "security_notes": "Read-only routing skill. Never accepts cloud credentials, billing account IDs, cost export access, or tenant-specific data. No live-guard agents exist in v1; any mutation request is refused and escalated to a human operator.",
   "last_verified": "2026-05-13",
   "path": "skills/finops/finops-maestro",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.1",
   "lifecycle": "experimental"
 }

package/skills/finops/focus-spec-normalizer/SKILL.md

@@ -3,7 +3,7 @@ name: focus-spec-normalizer
 description: Normalize vendor-specific billing rows (AWS CUR, Azure Cost Management, GCP Billing Export, OCI) into FOCUS v1.2 columns from user-pasted CSV or JSON input. Refuses to invent column values not derivable from the input. No credentials accepted; operates on user-supplied data only.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.1"
   updated: "2026-05-13"
   category: finops

package/skills/finops/focus-spec-normalizer/metadata.json

@@ -20,7 +20,7 @@
   "security_notes": "No cloud credentials, billing account IDs, tenant IDs, or service principal data are accepted or required. The skill operates on user-pasted de-identified billing data only. No live cloud API connections are made.",
   "last_verified": "2026-05-13",
   "path": "skills/finops/focus-spec-normalizer",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.1",
   "lifecycle": "experimental"
 }

package/skills/finops/kubernetes-allocation-report/SKILL.md

@@ -3,7 +3,7 @@ name: kubernetes-allocation-report
 description: Produce OpenCost-compatible namespace, pod, and workload cost allocation tables from user-supplied cluster shape data and public cloud pricing. Input is cluster topology provided by the caller; no cluster credentials or live API access are required or accepted. Output maps to FOCUS v1.2 columns.
 allowed-tools: Read Grep Glob WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.2"
   updated: "2026-05-13"
   category: finops

package/skills/finops/kubernetes-allocation-report/metadata.json

@@ -20,7 +20,7 @@
   "security_notes": "No cluster credentials, kubeconfig, bearer tokens, service account JWTs, or cloud IAM credentials are accepted or required. All cluster topology data is user-supplied. Node pricing is fetched from public, unauthenticated cloud pricing APIs only.",
   "last_verified": "2026-05-13",
   "path": "skills/finops/kubernetes-allocation-report",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.2",
   "lifecycle": "experimental"
 }

package/skills/finops/rightsize-recommendation/SKILL.md

@@ -3,7 +3,7 @@ name: rightsize-recommendation
 description: Emit pod CPU and memory request/limit recommendations from user-pasted p50, p95, and p99 utilization metrics over a 7-14 day window. Outputs recommended requests at p95 plus 20% headroom, limits at p99 plus 30%, estimated monthly savings, and Karpenter consolidation eligibility flag. Read-only, no kubectl.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.2"
   updated: "2026-05-13"
   category: finops

package/skills/finops/rightsize-recommendation/metadata.json

@@ -21,7 +21,7 @@
   "security_notes": "No cluster credentials, kubeconfig, bearer tokens, service account JWTs, or cloud IAM credentials are accepted or required. All calculations are performed on user-supplied metric inputs only. No live cluster or metric API connection is made.",
   "last_verified": "2026-05-13",
   "path": "skills/finops/rightsize-recommendation",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.2",
   "lifecycle": "experimental"
 }

package/skills/fluxcd/fluxcd-kustomization-helmrelease-review/SKILL.md

@@ -3,7 +3,7 @@ name: fluxcd-kustomization-helmrelease-review
 description: Use this skill when reviewing FluxCD Kustomization, HelmRelease, GitRepository, HelmRepository, or OCIRepository resources. Trigger when the user asks whether a Flux configuration is safe for production, whether SOPS encryption is required, whether prune is safe on a given workload, whether commit signature verification is enabled, or whether a Flux multi-tenant setup uses least-privilege ServiceAccounts.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: delivery

package/skills/fluxcd/fluxcd-kustomization-helmrelease-review/metadata.json

@@ -17,6 +17,6 @@
   "security_notes": "Plaintext Kubernetes Secret manifests committed to a FluxCD Git source are exposed to anyone with repo read access — including CI systems, PR participants, and auditors. GitRepository sources without commit signature verification allow any commit (including injected ones) to deploy to production.",
   "last_verified": "2026-05-02",
   "path": "skills/fluxcd/fluxcd-kustomization-helmrelease-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/ai-generated-frontend-code-review/SKILL.md

@@ -3,7 +3,7 @@ name: ai-generated-frontend-code-review
 description: Apply an elevated review pass to AI or LLM-generated frontend code changes, checking specifically for hallucinated framework APIs, slopsquatted or non-existent dependency names, unsanitized dynamic-HTML sinks, and missing accessibility semantics before the diff is merged.
 allowed-tools: Read Grep Glob WebFetch WebSearch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: ai

package/skills/frontend/ai-generated-frontend-code-review/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "Treat all AI-generated code as untrusted input requiring verification, not a lower-scrutiny fast path. Check every new dependency name against the real package registry before approving install (slopsquat defense). Check every dynamic-HTML sink for sanitization. Never execute exploit payloads against live/staging systems; static-review-only skill (Read/Grep/Glob/WebFetch/WebSearch, no mutation, no live target traffic). Never reproduce discovered secrets/tokens verbatim in findings output.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/ai-generated-frontend-code-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/angular-architecture-signals-review/SKILL.md

@@ -3,7 +3,7 @@ name: angular-architecture-signals-review
 description: Statically review Angular component and service architecture for correct Signals usage (signal/computed/effect boundaries and purity), appropriate change-detection strategy (OnPush vs default), and service/DI boundary design, grounded in Angular's own Signals, change-detection, and dependency-injection guidance.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: architecture

package/skills/frontend/angular-architecture-signals-review/metadata.json

@@ -23,6 +23,6 @@
   "security_notes": "No direct security-primitive concern in this skill's scope; escalate any bypassSecurityTrust* usage discovered incidentally to the angular-ssr-hydration-review skill or a security reviewer rather than handling it here. Static-review-only skill: it reads and greps component/service source but never executes, builds, or runs application code. Treat any API key or token found hardcoded in component/service state or default values as a HIGH-severity finding requiring immediate escalation, not a style note.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/angular-architecture-signals-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/angular-ssr-hydration-review/SKILL.md

@@ -3,7 +3,7 @@ name: angular-ssr-hydration-review
 description: Statically review Angular SSR bootstrap configuration and component templates for hydration-mismatch risk (NG0500-class errors), unjustified ngSkipHydration usage, and direct-DOM-manipulation patterns that bypass Angular's template-owned DOM model, grounded in Angular's own hydration guide and error catalog.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: architecture

package/skills/frontend/angular-ssr-hydration-review/metadata.json

@@ -23,6 +23,6 @@
   "security_notes": "Direct DOM manipulation combined with dynamic string content (innerHTML-equivalent native calls) bypasses Angular's built-in sanitization pipeline -- treat any such pattern touching user-influenced data as an XSS-class finding, escalated to HIGH, in addition to the hydration-correctness finding. Static-review-only skill: it reads and greps bootstrap configuration and component source but never executes, builds, or runs application code.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/angular-ssr-hydration-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/angular-template-sanitizer-security-review/SKILL.md

@@ -3,7 +3,7 @@ name: angular-template-sanitizer-security-review
 description: Statically review Angular templates and components for injection via DomSanitizer bypass calls (bypassSecurityTrustHtml, bypassSecurityTrustUrl, bypassSecurityTrustResourceUrl), unsanitized [innerHTML] bindings, and dynamically bound iframe security attributes such as [attr.sandbox], grounded in Angular's own sanitizer and NG0910 documentation.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-03"
   category: security

package/skills/frontend/angular-template-sanitizer-security-review/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "This skill's entire scope is security-critical: DomSanitizer bypass calls and unsanitized [innerHTML] bindings are XSS vectors, and dynamically bound iframe security attributes are a sandbox-escape vector Angular's own NG0910 check exists to reject. Every finding defaults to HIGH severity unless proven otherwise with concrete validation/sanitizer evidence on the traced path. Static-review-only skill: it reads and greps components and templates but never executes, builds, or runs application code, and never sends live requests.",
   "last_verified": "2026-07-03",
   "path": "skills/frontend/angular-template-sanitizer-security-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/api-integration-contract-review/SKILL.md

@@ -3,7 +3,7 @@ name: api-integration-contract-review
 description: Reviews frontend-to-backend API contracts — BFF route handlers and direct backend calls — for data-minimization, server-side object-level authorization enforcement, error-shape leakage, CORS misconfiguration, and backward-compatible versioning before they ship.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: architecture

package/skills/frontend/api-integration-contract-review/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "Static-review-only skill: it reads and greps route handler code, authorization middleware, and contract documentation but never executes, builds, or runs application code, and never issues live requests. Every finding of client-side-only authorization or excessive data exposure is treated as a security-severity finding, not a style note. Wildcard CORS combined with credentialed requests is an automatic blocking finding. Raw upstream error forwarding to the client is a blocking finding.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/api-integration-contract-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/browser-compatibility-review/SKILL.md

@@ -3,7 +3,7 @@ name: browser-compatibility-review
 description: Audit JS/CSS/HTML feature usage against the project's declared Browserslist/supported-browser matrix using Baseline and caniuse status data, flag unguarded non-Baseline usage, and verify feature-detection or polyfill fallback coverage, with per-feature caniuse/Baseline lookups loaded only for features actually in question.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: platform

package/skills/frontend/browser-compatibility-review/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "Static review only; never recommends disabling security-relevant browser defaults (mixed-content blocking, SameSite cookie defaults) as a compatibility workaround.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/browser-compatibility-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/build-tooling-vite-webpack-review/SKILL.md

@@ -3,7 +3,7 @@ name: build-tooling-vite-webpack-review
 description: Reviews Vite and Webpack build/chunking configuration and bundle-size composition for duplicate dependencies, unsplit vendor chunks, and tree-shaking failures, always version-labeling config since Vite 8 replaced Rollup-era manualChunks with Rolldown-based codeSplitting.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: compute

package/skills/frontend/build-tooling-vite-webpack-review/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "Bundle-analyzer output shared outside the org must not include source maps that reveal internal API paths or accidentally-inlined environment values. Any dependency with an install-time script that runs during the build must be reviewed before it's allowed to affect the production bundle. Static-review-only skill: it reads and greps build config and source; it does not execute builds, install dependencies, or run bundler CLIs. Treat any credential-shaped string found in a pasted build config, CI job definition, or analyzer report as unsafe to echo in the transcript.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/build-tooling-vite-webpack-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/bundle-budget-code-splitting-review/SKILL.md

@@ -3,7 +3,7 @@ name: bundle-budget-code-splitting-review
 description: Reviews JavaScript/CSS bundle composition against explicit numeric budgets, evaluates route- and component-level code-splitting boundaries, and requires a CI-enforced budget before endorsing any size fix as resolved.
 allowed-tools: Read Grep Glob Bash(npm run build:*) Bash(du:*)
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: operational

package/skills/frontend/bundle-budget-code-splitting-review/metadata.json

@@ -24,6 +24,6 @@
   "security_notes": "Do not recommend inlining third-party scripts to save a request without disclosing the CSP/subresource-integrity trade-off of inlined vs. externally loaded, SRI-checkable code. Flag any dynamic import() of a module specifier built from unsanitized user input as a code-injection risk, not merely a performance concern. Do not accept or echo any credential-shaped string found in a pasted build config or analyzer report as if it were safe to keep in the transcript.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/bundle-budget-code-splitting-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/core-web-vitals-triage/SKILL.md

@@ -3,7 +3,7 @@ name: core-web-vitals-triage
 description: Decomposes LCP, INP, and CLS regressions into their documented sub-phases using lab and field evidence, and refuses to declare a metric fixed without a field-data or CI-budget verification path.
 allowed-tools: Read Grep Glob Bash(lighthouse:*) WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: operational

package/skills/frontend/core-web-vitals-triage/metadata.json

@@ -28,6 +28,6 @@
   "security_notes": "Do not request production analytics credentials or raw customer session data; accept only sanitized/aggregated field exports (CrUX API responses, exported web-vitals RUM aggregates). Do not recommend removing accessible loading-state semantics (aria-live, role=status, visible focus indicators) as a CLS/INP fix. Do not accept or echo any credential-shaped string found in a pasted trace/config as if it were safe to keep in the transcript.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/core-web-vitals-triage",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/critical-rendering-path-review/SKILL.md

@@ -3,7 +3,7 @@ name: critical-rendering-path-review
 description: Review page-load resource sequencing, render-blocking CSS/JS, layout-shift sources, and Core Web Vitals (LCP/CLS/INP) budget adherence against the critical rendering path model, explicitly separating lab/synthetic measurement (Lighthouse) from field/real-user measurement (CrUX/RUM) so performance claims are evidence-graded rather than asserted from a single synthetic run.
 allowed-tools: Read Grep Glob Bash(git diff:*) WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: operational

package/skills/frontend/critical-rendering-path-review/metadata.json

@@ -26,6 +26,6 @@
   "security_notes": "Flag preload/prefetch/preconnect resource hints pointed at third-party origins without considering the information-leakage/timing implications of establishing early connections to those origins. Flag any performance 'optimization' that removes Subresource Integrity (SRI) from a script/style tag to save a round trip — integrity checks are not a discretionary performance cost. Do not recommend inlining third-party scripts to avoid a network request in a way that bypasses CSP script-src allow-listing.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/critical-rendering-path-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/css-architecture-design-system-review/SKILL.md

@@ -3,7 +3,7 @@ name: css-architecture-design-system-review
 description: Review CSS for specificity and cascade-layer discipline, design-token (custom-property) conformance, and responsive strategy correctness (container queries vs. media queries), catching specificity wars, hardcoded-value token drift, and non-reflowing layouts that fail WCAG 1.4.10/1.4.4 before they compound into unmaintainable stylesheets.
 allowed-tools: Read Grep Glob Bash(git diff:*) WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: architecture

package/skills/frontend/css-architecture-design-system-review/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "Do not treat CSS visibility/display properties as an access-control mechanism — hiding an element with CSS never substitutes for server-side authorization; flag any pattern that relies on it as a security control. Flag attribute-selector-plus-background-image patterns that could exfiltrate user-controlled attribute values via network requests (CSS-based data-exfiltration vector). Flag third-party @import without SRI/CSP style-src consideration.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/css-architecture-design-system-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/design-token-governance-review/SKILL.md

@@ -3,7 +3,7 @@ name: design-token-governance-review
 description: Reviews design-token source of truth and build pipelines for hardcoded-value drift and resolved WCAG 1.4.3/1.4.11 contrast compliance across theme variants (light, dark, high-contrast), grounded in the W3C Design Tokens format and current WCAG success criteria.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: compliance

package/skills/frontend/design-token-governance-review/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "Token-source pipelines pulling from Figma/Tokens Studio APIs must use scoped, rotatable personal access tokens stored only in CI secrets, never committed to token-source config files.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/design-token-governance-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/e2e-testing-playwright-review/SKILL.md

@@ -3,7 +3,7 @@ name: e2e-testing-playwright-review
 description: Reviews Playwright end-to-end test configuration -- fixtures, storageState/auth setup, CI sharding and parallelism, and toHaveScreenshot visual-assertion options -- for reliability and correct gating, grounded in current, version-specific Playwright API docs.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: delivery

package/skills/frontend/e2e-testing-playwright-review/metadata.json

@@ -23,6 +23,6 @@
   "security_notes": "Playwright storageState.json fixtures can capture real session cookies/auth tokens if generated against a live authenticated session; require these be generated against a dedicated test account and treated as sensitive (not committed to a public repo). HAR-file recordings used for network mocking can capture real API keys in request headers -- scrub before committing.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/e2e-testing-playwright-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/edge-cache-data-bleed-review/SKILL.md

@@ -3,7 +3,7 @@ name: edge-cache-data-bleed-review
 description: Statically review Next.js App Router caching surfaces -- route-level revalidate exports, cache-boundary directives on server functions reading cookies(), generateStaticParams on personalized routes, and Cache-Control/Vary response headers -- for defects that let one user's authenticated response be cached and served back to a different user.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-03"
   category: security

package/skills/frontend/edge-cache-data-bleed-review/metadata.json

@@ -23,6 +23,6 @@
   "security_notes": "This skill's entire scope is security-critical: a shared cache entry (ISR revalidate window, an uncached-boundary server function, or a CDN/proxy edge cache) serving one user's session-derived response to a different user is a cross-user data-exposure defect, not a performance bug. Every finding in this skill defaults to HIGH severity unless proven otherwise with a concrete 'use cache: private' or Cache-Control: private boundary on the traced path. Static-review-only skill: it reads and greps route files, server functions, and response-header call sites but never executes, builds, or runs application code, and never sends live requests.",
   "last_verified": "2026-07-03",
   "path": "skills/frontend/edge-cache-data-bleed-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/enterprise-red-team-review/SKILL.md

@@ -3,7 +3,7 @@ name: enterprise-red-team-review
 description: Run a mandatory adversarial review pass against Tier-1 specialist verdicts for frontend security review, AI-generated code review, and production incident workflows, hunting for exploit paths, WCAG failures automated tooling cannot catch, and prompt-injection artifacts in AI-generated code. Use before a change with security, accessibility, or AI-generated-code implications is allowed to reach the Board Chair.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: security

package/skills/frontend/enterprise-red-team-review/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "Static/findings-only review - never execute exploit code or mutate the reviewed codebase; never accept an unverifiable 'already mitigated' claim as resolved; escalate secret/PII exposure paths and AI-code prompt-injection artifacts immediately as CONFIRMED findings.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/enterprise-red-team-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/framework-upgrade-risk-review/SKILL.md

@@ -3,7 +3,7 @@ name: framework-upgrade-risk-review
 description: Assess breaking-change and regression risk for a same-framework major-version upgrade (React, Next.js, Angular, Vue, or core build tooling), grounding every claimed breaking change in the framework's official release notes/migration guide, and separate upgrade-blocking issues from cosmetic deprecation noise.
 allowed-tools: Read Grep Glob WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: resilience

package/skills/frontend/framework-upgrade-risk-review/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "Prioritize any breaking change tied to a security advisory (e.g. a CVE fixed by the new major version) as a forced-upgrade driver, and flag if the current pinned version is past its security-support window regardless of migration effort. Never invent codemod names, CLI flags, or config keys.",
   "last_verified": "2026-07-02",
   "path": "skills/frontend/framework-upgrade-risk-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/frontend/frontend-auth-session-security-review/SKILL.md

@@ -3,7 +3,7 @@ name: frontend-auth-session-security-review
 description: Review client-side authentication and session-management code for token-storage location, cookie-flag correctness, CSRF/open-redirect exposure, and OAuth/OIDC flow choice for browser-based apps against OWASP ASVS and Session Management Cheat Sheet guidance, with the OAuth-for-browsers reference loaded only when an OAuth/OIDC flow is in scope.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-02"
   category: security