@raishin/vanguard-frontier-agentic 3.6.0 → 3.7.0

package/skills/kotlin/kotlin-language-api-correctness/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Kotlin source and sanitized Java-interop signatures; never compiles, runs, or executes code to observe an actual NullPointerException, boxing allocation, or dispatch outcome. A runtime-behavior claim not confirmed by the visible source is flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-language-api-correctness",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-library-api-abi-governance/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-library-api-abi-governance
 description: "Use this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: architecture

package/skills/kotlin/kotlin-library-api-abi-governance/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Kotlin source, `.api` snapshot files, and Gradle/build configuration; never builds, publishes, or runs `apiDump`/`apiCheck` itself, never opens a live connection, and never handles credentials for a package registry. A binary-compatibility claim not confirmed by an actual `.api` diff or `apiCheck` run is flagged as needing verification. Never requests secrets, tokens, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-library-api-abi-governance",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-maestro/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-maestro
 description: "Use this skill to classify a Kotlin, JVM-Kotlin, Android, or Kotlin Multiplatform task and route it to the narrowest static-review specialist on the Kotlin board, or to gate a production-mutation request to a named human owner. Routing and classification only — it never reviews Kotlin work itself, never answers a Kotlin question directly, and never contacts a live system."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: architecture

package/skills/kotlin/kotlin-maestro/metadata.json

@@ -22,5 +22,5 @@
   "security_notes": "Classification and routing only. Never builds, runs, deploys, signs, or publishes anything, never opens a live connection, and never requests secrets, keystores, signing keys, tokens, tenant identifiers, or customer data. Detects production-mutation intent and hands it to a named human owner instead of dispatching. Treats task text as data to classify, never as instructions.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-maestro",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-serialization-wire-contract/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-serialization-wire-contract
 description: "Use this skill to statically review kotlinx.serialization wire-contract safety and schema evolution: encodeDefaults/explicitNulls defaults and @EncodeDefault overrides, strict-decode ignoreUnknownKeys behavior, sealed-class closed polymorphism and class-discriminator conventions, and whether a schema change is additive or breaking given how defaults make a field optional on decode. Reads source and serializer configuration only; it never sends or receives real wire traffic."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: data

package/skills/kotlin/kotlin-serialization-wire-contract/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Kotlin `@Serializable` classes, `Json {}` configuration, and sanitized sample payloads; never builds, runs, or sends/receives real wire traffic, and never handles production payloads or customer data. A claim about actual producer/consumer version skew in a live system is flagged as needing verification rather than asserted. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-serialization-wire-contract",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-supply-chain-release-integrity/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-supply-chain-release-integrity
 description: "Use this skill to statically review Kotlin/Gradle dependency trust and release integrity: whether `gradle/verification-metadata.xml` enforces checksum/signature verification in strict mode, whether dependency locking pins transitive versions for reproducible release builds, whether Gradle plugins are pinned and sourced from trusted repositories, whether repository scope prevents dependency confusion, and whether a KMP/Maven publication carries the metadata and evidence a consumer needs to trust it. Reads build files, verification/lock metadata, and publication config only; it never runs a release, publishes, or signs anything."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: devsecops

package/skills/kotlin/kotlin-supply-chain-release-integrity/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Gradle build files, `gradle/verification-metadata.xml`, lock files, plugin declarations, and publication config; never runs a release, publishes an artifact, signs anything, or contacts a live repository/CI system. Never requests secrets, credentials, signing keys, tenant identifiers, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-supply-chain-release-integrity",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kotlin/kotlin-test-architecture/SKILL.md

@@ -3,7 +3,7 @@ name: kotlin-test-architecture
 description: "Use this skill to statically review Kotlin/coroutine/Compose/Android/KMP test architecture and determinism: `runTest` and virtual-time usage, `StandardTestDispatcher` vs `UnconfinedTestDispatcher` choice and advance-call discipline, `Dispatchers.setMain`/`resetMain` hygiene and dispatcher injection, Turbine Flow-testing idioms, Compose UI semantics-based testing, and the Robolectric-vs-instrumented boundary. Reads test source and build config only; it never runs the suite or a device/emulator."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-07-21"
   category: delivery

package/skills/kotlin/kotlin-test-architecture/metadata.json

@@ -23,5 +23,5 @@
   "security_notes": "Static review only — reads Kotlin/Android test source, Gradle test configuration, and sanitized CI logs; never runs the test suite, invokes a device/emulator, or opens a live connection. A claim that a specific flake is caused by real-time dependence rather than another factor is flagged as needing reproduction to confirm. Never requests secrets, credentials, or customer data.",
   "last_verified": "2026-07-21",
   "path": "skills/kotlin/kotlin-test-architecture",
-  "author": "github: Raishin"
+  "author": "github: VincentChuWaiChow"
 }

package/skills/kubernetes/external-secrets-operator-review/SKILL.md

@@ -3,7 +3,7 @@ name: external-secrets-operator-review
 description: Use this skill when reviewing External Secrets Operator (ESO) configuration, including SecretStore, ClusterSecretStore, ExternalSecret, and PushSecret resources. Trigger when a user provides ESO YAML manifests, asks about secret rotation interval compliance, questions whether ClusterSecretStore scope is too broad, or wants to audit the auth method used to reach an external secret store (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, HashiCorp Vault, 1Password).
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: security

package/skills/kubernetes/external-secrets-operator-review/metadata.json

@@ -17,6 +17,6 @@
   "security_notes": "ClusterSecretStore with no namespace selector grants every namespace access to every external secret reachable by the store credentials. Static credentials in SecretStore auth create a credential-to-access-credentials chain where compromise of the K8s Secret gives full access to the external store.",
   "last_verified": "2026-05-02",
   "path": "skills/kubernetes/external-secrets-operator-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kubernetes/kubecost-chargeback-allocation-review/SKILL.md

@@ -3,7 +3,7 @@ name: kubecost-chargeback-allocation-review
 description: Use this skill when reviewing a Kubecost or OpenCost installation for enterprise chargeback readiness. Trigger when the user asks whether cost allocation is accurate, whether label taxonomy is complete enough for chargeback, whether idle cost is properly attributed, whether the cost API is secured, or whether savings recommendations are being actioned.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: finops

package/skills/kubernetes/kubecost-chargeback-allocation-review/metadata.json

@@ -17,6 +17,6 @@
   "security_notes": "Kubecost cost allocation API without authentication exposes team-level spend data to any pod in the cluster. Multi-cluster Kubecost aggregation requires cross-cluster network access — review whether the aggregation network path is private or exposed.",
   "last_verified": "2026-05-02",
   "path": "skills/kubernetes/kubecost-chargeback-allocation-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kubernetes/kubernetes-live-network-architecture-mutation-guard/SKILL.md

@@ -3,7 +3,7 @@ name: kubernetes-live-network-architecture-mutation-guard
 description: Guard live kubectl apply, patch, or create operations on Kubernetes networking *architecture* surface — Service spec (`internalTrafficPolicy`, `externalTrafficPolicy`, `topology-mode`, `trafficDistribution`), CoreDNS Corefile, NodeLocal DNSCache install, Gateway API resources (Gateway / HTTPRoute / GRPCRoute / TLSRoute / ReferenceGrant), and ClusterMesh peer Secrets. HARD REFUSE one-way doors (CNI replacement, kube-proxy mode swap, MTU change, Pod / Service CIDR resize, namespace deletion). Pre-flight `kubectl auth can-i` matrix against a least-privilege ServiceAccount before any write. Use only when an intentional architecture-level networking mutation is requested against a confirmed cluster target with a documented rollback path.
 allowed-tools: Bash Read Edit Grep Glob WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-08"
   category: networking

package/skills/kubernetes/kubernetes-live-network-architecture-mutation-guard/metadata.json

@@ -28,6 +28,6 @@
   "security_notes": "This skill is bound to a ServiceAccount with deliberately omitted verbs: no `delete` cluster-wide, no operations on `namespaces` / `customresourcedefinitions` / `kube-system` DaemonSets and Deployments / broad `secrets`. Pre-flight `kubectl auth can-i` matrix MUST run before any mutation; refuses if any must-not check returns `yes` (binding over-scoped) or if operator is in `system:masters` (RBAC bypass). HARD REFUSE list covers one-way doors that are out-of-scope for any agent: CNI replacement, kube-proxy mode swap, MTU change, Pod / Service CIDR resize. CoreDNS Corefile changes require backup capture and post-mutation reload verification within 2 minutes. Gateway resources require GatewayClass controller liveness check before creation. ClusterMesh peer Secret data fields must never be printed or logged.",
   "last_verified": "2026-05-08",
   "path": "skills/kubernetes/kubernetes-live-network-architecture-mutation-guard",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kubernetes/kubernetes-live-rbac-mutation-guard/SKILL.md

@@ -3,7 +3,7 @@ name: kubernetes-live-rbac-mutation-guard
 description: Guard live kubectl apply, create, or delete operations on Kubernetes RBAC objects — Roles, ClusterRoles, RoleBindings, ClusterRoleBindings — with privilege-escalation verb detection, scope assessment, current-state diff, and explicit approval before any write. Use only when an intentional RBAC mutation is requested against a confirmed cluster target.
 allowed-tools: Read Grep Glob WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: security

package/skills/kubernetes/kubernetes-live-rbac-mutation-guard/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "Capture current RBAC object state before every mutation — there is no built-in rollback. Block escalate, bind, and impersonate verbs without explicit platform-team approval. Never approve wildcard verb or resource grants. Deleting a ClusterRoleBinding does not immediately revoke cached service account tokens.",
   "last_verified": "2026-05-01",
   "path": "skills/kubernetes/kubernetes-live-rbac-mutation-guard",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kubernetes/kubernetes-maestro/SKILL.md

@@ -3,7 +3,7 @@ name: kubernetes-maestro
 description: Route Kubernetes tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know the specialist. Not for direct Kubernetes answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any live mutation specialist.
 allowed-tools: Agent Skill Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: ai

package/skills/kubernetes/kubernetes-maestro/metadata.json

@@ -19,6 +19,6 @@
   "security_notes": "Live-guard gate is non-negotiable: kubernetes-live-rbac-mutation-guard-agent, kubernetes-live-admission-policy-guard-agent, kubernetes-live-mesh-policy-guard-agent, kubernetes-live-argocd-sync-guard-agent, and kubernetes-live-network-policy-guard-agent must never be auto-dispatched. Always surface blast-radius and rollback path and require explicit written human confirmation before routing to any live-guard agent.",
   "last_verified": "2026-05-01",
   "path": "skills/kubernetes/kubernetes-maestro",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kubernetes/kubernetes-network-architecture-review/SKILL.md

@@ -3,7 +3,7 @@ name: kubernetes-network-architecture-review
 description: Use this skill for Kubernetes cluster network architecture review across the dataplane (CNI choice, kube-proxy mode, IPAM, MTU, encapsulation, dual-stack), service routing surface (Service types, EndpointSlices, internalTrafficPolicy/externalTrafficPolicy, topology-aware routing, Ingress, Gateway API), in-cluster DNS (CoreDNS, NodeLocal DNSCache, ndots), multi-cluster topology (ClusterMesh, Submariner, MCS-API design choices), and connectivity observability and troubleshooting. Trigger when the user asks how to choose or change a CNI, why pod-to-pod or pod-to-service traffic fails, whether to migrate from Ingress to Gateway API, why DNS latency is high, how to size Pod or Service CIDRs, or how to design multi-cluster networking. Does NOT review NetworkPolicy content (delegate to cilium-network-policy-review) or perform live mutations (delegate to kubernetes-live-network-policy-guard / kubernetes-live-mesh-policy-guard).
 allowed-tools: Read Grep Glob WebFetch
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-07"
   category: networking

package/skills/kubernetes/kubernetes-network-architecture-review/metadata.json

@@ -29,6 +29,6 @@
   "security_notes": "CNI and Pod CIDR are one-way architectural choices on most stacks — resizing requires cluster rebuild. kube-proxy mode swap can break in-flight connections. MTU mismatch between underlay and overlay is a silent payload-stall failure. externalTrafficPolicy: Local preserves source IP but black-holes traffic when no local endpoint exists. NodeLocal DNSCache OOM produces a node-wide DNS outage via stale packet-filter redirect. Multi-cluster pod CIDR collisions break any cross-cluster scheme regardless of policy correctness. ndots:5 plus search path is the dominant cluster DNS load on most installations.",
   "last_verified": "2026-05-07",
   "path": "skills/kubernetes/kubernetes-network-architecture-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kubernetes/kubernetes-pod-security-admission-review/SKILL.md

@@ -3,7 +3,7 @@ name: kubernetes-pod-security-admission-review
 description: Use this skill for Kubernetes Pod Security Admission (PSA) review covering namespace labels for the three profiles (privileged, baseline, restricted), enforce/audit/warn modes, version pinning, and the migration path from deprecated PodSecurityPolicy. Trigger when the user asks whether a namespace label flip is safe, whether a workload meets a stricter profile, whether the audit/warn modes should be promoted to enforce, or whether an exemption is justified.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: security

package/skills/kubernetes/kubernetes-pod-security-admission-review/metadata.json

@@ -23,6 +23,6 @@
   "security_notes": "A production namespace with no PSA label inherits cluster default which is privileged unless overridden. enforce-version latest changes semantics on every Kubernetes minor upgrade. audit and warn without enforce only log violations. PSP migration via kubectl-psp-to-psa shifts enforcement boundary; verify before disabling PSP webhooks.",
   "last_verified": "2026-05-01",
   "path": "skills/kubernetes/kubernetes-pod-security-admission-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kubernetes/kubernetes-pod-spec-review/SKILL.md

@@ -3,7 +3,7 @@ name: kubernetes-pod-spec-review
 description: Use this skill when reviewing a Kubernetes Pod spec, Deployment spec, or StatefulSet spec for correctness, security posture, and production-readiness. Trigger on any request to audit, validate, or score a workload manifest.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: platform

package/skills/kubernetes/kubernetes-pod-spec-review/metadata.json

@@ -17,6 +17,6 @@
   "security_notes": "Secrets mounted as environment variables appear in kubectl describe pod output and in /proc/self/environ, accessible to any process in the container. Root containers can write to host paths if hostPath volumes are present. Missing runAsNonRoot allows container breakout to node if combined with hostPath or privileged mode.",
   "last_verified": "2026-05-02",
   "path": "skills/kubernetes/kubernetes-pod-spec-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kubernetes/kubernetes-rbac-review/SKILL.md

@@ -3,7 +3,7 @@ name: kubernetes-rbac-review
 description: Use this skill for Kubernetes RBAC, Role, ClusterRole, RoleBinding, ClusterRoleBinding, ServiceAccount, workload identity, or least-privilege review tasks. Trigger when the user asks whether cluster access is too broad, how to grant workload permissions safely, or how to audit RBAC state.
 allowed-tools: Read Grep Glob
 metadata:
-  author: github: Raishin
+  author: github: VincentChuWaiChow
   version: 0.1.0
   updated: "2026-05-05"
   category: security

package/skills/kubernetes/kubernetes-rbac-review/metadata.json

@@ -22,6 +22,6 @@
   "security_notes": "Do not recommend ClusterAdmin or wildcard bindings unless explicitly justified. Prefer namespace-scoped Roles over ClusterRoles for workloads that do not need cluster-wide access. Do not auto-mount service account tokens unless the workload requires API server access.",
   "last_verified": "2026-05-01",
   "path": "skills/kubernetes/kubernetes-rbac-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kubernetes/kubernetes-workload-identity-review/SKILL.md

@@ -3,7 +3,7 @@ name: kubernetes-workload-identity-review
 description: Use this skill for Kubernetes workload identity review covering AWS IRSA (IAM Roles for Service Accounts), Azure Workload Identity, GCP Workload Identity Federation, and the underlying ServiceAccount token volume projection plus OIDC issuer trust. Trigger when the user asks how a pod should authenticate to cloud services, whether long-lived credentials in a Secret can be replaced, whether the OIDC trust policy is correctly scoped, or whether ServiceAccount token reuse is a risk.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: security

package/skills/kubernetes/kubernetes-workload-identity-review/metadata.json

@@ -24,6 +24,6 @@
   "security_notes": "Workload identity OIDC trust policy with wildcard sub claim allows any ServiceAccount in the cluster to assume the role. Pods with both a workload-identity SA and a long-lived credential Secret typically fall back to the static credential. Tokens with audiences not pinned to the cloud target are reusable elsewhere.",
   "last_verified": "2026-05-01",
   "path": "skills/kubernetes/kubernetes-workload-identity-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/kyverno/kyverno-policy-review/SKILL.md

@@ -3,7 +3,7 @@ name: kyverno-policy-review
 description: Use this skill for Kyverno policy review across the stable policies.kyverno.io/v1 API surface — ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy, and ImageValidatingPolicy. Trigger when the user asks whether an admission policy is safe, whether a PolicyException is justified, whether a policy should be enforced or audited, whether a Kyverno policy should be replaced by a native ValidatingAdmissionPolicy (CEL), or whether image signature verification is correctly configured.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-05"
   category: security

package/skills/kyverno/kyverno-policy-review/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "Treat failureAction Audit on production policies as a critical finding. Every PolicyException is a documented bypass requiring an owner, reason, and expiry. ImageValidatingPolicy must verify signatures with mutateDigest true. Prefer native ValidatingAdmissionPolicy when CEL alone is sufficient.",
   "last_verified": "2026-05-01",
   "path": "skills/kyverno/kyverno-policy-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/legal/legal-counsel-review/SKILL.md

@@ -3,7 +3,7 @@ name: legal-counsel-review
 description: Use this skill when reviewing legal, contractual, regulatory, privacy, litigation, compliance, or risk-governance questions for an enterprise legal function. Trigger when a user provides a contract excerpt, a policy, a compliance question, a privacy-risk question, or a legal intake item and wants risks, evidence gaps, decision options, and escalation paths surfaced. This skill is an adversarial risk-review discipline; it does not provide legal advice, form an attorney-client relationship, or issue binding legal conclusions.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-18"
   category: compliance

package/skills/legal/legal-counsel-review/metadata.json

@@ -24,6 +24,6 @@
   "security_notes": "Static review only — works from sanitized excerpts; never requests secrets, credentials, personal data, employee medical detail, or trade secrets. Does not issue binding legal conclusions; flags privileged material and recommends escalation to qualified counsel.",
   "last_verified": "2026-05-18",
   "path": "skills/legal/legal-counsel-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/marketing/ai-advertising-targeting-fairness-review/SKILL.md

@@ -3,7 +3,7 @@ name: ai-advertising-targeting-fairness-review
 description: Use this skill when reviewing ad-platform audience targeting configurations and declared AI feature usage for protected-class discrimination risk. Trigger when a user provides a Meta Ads Manager audience definition, Google Ads targeting layer export, DSP deal config, or any ad platform audience spec annotated with AI features enabled (Advantage+ Audience, broad match, automated bidding, lookalike seeds). Use when a campaign is in housing, credit, employment, or insurance verticals, or when automated bidding or AI audience expansion is active on any campaign reaching the US or EU and the user needs to assess Fair Housing Act, ECOA, or EU AI Act Article 5 exposure.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: ai

package/skills/marketing/ai-advertising-targeting-fairness-review/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "Ad-platform AI features that optimize on historical converter populations can propagate protected-class disparate impact without explicit discriminatory intent. Review works from sanitized audience spec exports and declared AI feature annotations only; never request live campaign credentials, ad-account access tokens, or real user audience data.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/ai-advertising-targeting-fairness-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/marketing/analytics-data-minimization-review/SKILL.md

@@ -3,7 +3,7 @@ name: analytics-data-minimization-review
 description: Use this skill when reviewing analytics platform configuration — GA4 property settings, BigQuery export schema, custom event-parameter definitions, and user-property declarations — for data-minimization violations, excessive collection, and storage-period over-retention. Trigger when a user provides a GA4 property configuration export, a BigQuery raw-event export schema, a custom event or user-property inventory, data-retention settings, or asks whether their analytics setup collects more personal data than necessary, retains data longer than required, or converts an analytics platform into a personal-data processor. Distinct from marketing-pixel-data-leakage-review: this skill reviews what analytics platforms collect and retain internally, not outbound pixel payloads to ad networks.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: data

package/skills/marketing/analytics-data-minimization-review/metadata.json

@@ -16,7 +16,7 @@
   "security_notes": "Read-only static review of sanitized analytics configuration exports and schema definitions only. Never request live analytics data, raw event exports containing real user identifiers, GA4 admin credentials, or BigQuery service-account keys. Findings may indicate cross-border data transfer violations requiring DPA notification — route remediation and legal assessment to qualified privacy counsel before acting on findings.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/analytics-data-minimization-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "lifecycle": "experimental"
 }

package/skills/marketing/email-sender-authentication-review/SKILL.md

@@ -3,7 +3,7 @@ name: email-sender-authentication-review
 description: Use this skill when reviewing DNS sender-authentication records for a marketing domain to identify policy gaps exposing campaigns to rejection, spoofing, or inbox displacement. Trigger when a user provides DNS TXT record exports for SPF, DKIM, DMARC, or BIMI, or asks whether their email authentication posture meets Google/Yahoo bulk-sender requirements, DMARC enforcement standards, CISA BOD 18-01 obligations, PCI DSS v4.0 Req 5.3.3, or whether their transactional or marketing emails are at risk of spoofing or bulk-sender quarantine.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: compliance

package/skills/marketing/email-sender-authentication-review/metadata.json

@@ -16,7 +16,7 @@
   "security_notes": "Email authentication reviews work from sanitized DNS TXT record exports only. Never request live DMARC aggregate report XML, ESP account credentials, or sending-platform API keys. SPF, DKIM, and DMARC records are publicly resolvable; the artifact is the domain's own export, not live lookups against production DNS.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/email-sender-authentication-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "lifecycle": "experimental"
 }

package/skills/marketing/eu-ai-act-marketing-system-review/SKILL.md

@@ -3,7 +3,7 @@ name: eu-ai-act-marketing-system-review
 description: Use this skill when reviewing a marketing AI system's description card against EU AI Act risk-tier criteria to classify the system (prohibited / high-risk / limited-risk / minimal-risk), flag documentation obligations, and identify deployment-readiness gaps before the August 2, 2026 full-enforcement date. Trigger when a user provides an AI system description card covering system purpose, input data types, output decisions, human-oversight mechanism, deployment geography, and whether it profiles natural persons — or when they ask whether their marketing AI tool, lead-scoring model, content personalization engine, or automated ad-decisioning system requires a conformity assessment or transparency notice under EU AI Act Regulation 2024/1689.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: compliance

package/skills/marketing/eu-ai-act-marketing-system-review/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "EU AI Act classification determines conformity assessment, CE marking, and EU AI database registration obligations — misclassification is itself a compliance gap. Review works from sanitized AI system description cards only; never request model weights, training datasets, internal performance logs, or vendor system-access credentials. Legal determination of Article 5 prohibited practices is routed to qualified counsel.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/eu-ai-act-marketing-system-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/marketing/influencer-disclosure-compliance-review/SKILL.md

@@ -3,7 +3,7 @@ name: influencer-disclosure-compliance-review
 description: Use this skill when reviewing an influencer campaign audit pack — campaign brief, creator agreement excerpt, platform post descriptions or screenshot descriptions, and the disclosure format and placement specification — against FTC Endorsement Guides to identify undisclosed material connections, inadequate disclosure placement, and brand liability exposure. Trigger when a user provides a structured influencer campaign audit pack and asks whether disclosures meet FTC requirements, whether the brief contains problematic instructions, or whether the brand faces liability for creator conduct under 16 CFR Part 255.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: compliance

package/skills/marketing/influencer-disclosure-compliance-review/metadata.json

@@ -16,7 +16,7 @@
   "security_notes": "Review works from a structured influencer campaign audit pack only — brief, contract excerpt, post descriptions, and disclosure spec. Never accept raw personal data about creators, unpublished negotiations, or brand financial terms beyond what is needed to assess disclosure adequacy. This is a static compliance review; it does not generate campaign content or creator instructions.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/influencer-disclosure-compliance-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "lifecycle": "experimental"
 }

package/skills/marketing/lookalike-audience-upload-compliance-review/SKILL.md

@@ -3,7 +3,7 @@ name: lookalike-audience-upload-compliance-review
 description: Use this skill when reviewing custom-audience and lookalike-audience upload specifications for hashing adequacy, PII field scope, consent-basis validity, and platform data-sharing restrictions before the upload is submitted to Meta, Google, LinkedIn, or TikTok. Trigger when a user provides an audience upload field-mapping specification (CSV schema or platform upload template), declared hashing method, consent-basis documentation, or originating list segment metadata — or when they ask whether their customer list upload or lookalike seed list is compliant with GDPR, CCPA/CPRA, or platform terms before uploading.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: data

package/skills/marketing/lookalike-audience-upload-compliance-review/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "Custom-audience uploads transmit hashed personal data to ad platforms under data-sharing arrangements that must have a lawful basis, appropriate consent scope, and adequate pseudonymization. Review works from sanitized field-mapping specifications, declared hashing methods, and consent-basis documentation only; never request actual audience files, real customer records, or platform API credentials.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/lookalike-audience-upload-compliance-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/marketing/marketing-consent-data-collection-review/SKILL.md

@@ -3,7 +3,7 @@ name: marketing-consent-data-collection-review
 description: Use this skill when reviewing a marketing site's consent and data-collection posture — cookie/consent banner (CMP) configuration, tag-manager container exports, Google Consent Mode wiring, or a cookie policy. Trigger when a user provides a CMP configuration, a tag manager container JSON, a consent-banner screenshot description, or asks whether their marketing tracking is GDPR/CCPA/ePrivacy compliant, whether tags fire before consent, or whether their opt-out path is valid.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: compliance

package/skills/marketing/marketing-consent-data-collection-review/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "Marketing tags that fire before a consent signal collect personal data with no lawful basis and expose the controller to GDPR/ePrivacy enforcement and CCPA class actions. Consent banners with non-symmetric choice or pre-ticked boxes invalidate consent. Review works from sanitized configuration only; never request real visitor data, consent-string archives, or analytics account credentials.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/marketing-consent-data-collection-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/marketing/marketing-conversion-flow-dark-pattern-review/SKILL.md

@@ -3,7 +3,7 @@ name: marketing-conversion-flow-dark-pattern-review
 description: Use this skill when reviewing marketing conversion flow specifications — subscription sign-up, upsell interstitial, free-trial enrollment, and cancellation path — for dark-pattern practices that invalidate consent or constitute unfair or deceptive acts under FTC Section 5 and state privacy laws. Trigger when a user provides a UX flow specification including step-by-step page descriptions, annotated wireframes, CTA labels, pre-checked options, visual weight of accept vs decline paths, countdown timer specs, or cancellation flow step counts. Scope is limited to marketing conversion flows; consent banner review is handled by a separate skill.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: compliance

package/skills/marketing/marketing-conversion-flow-dark-pattern-review/metadata.json

@@ -16,7 +16,7 @@
   "security_notes": "Read-only static review of sanitized UX flow specifications and annotated wireframes only. Never request real payment credentials, live user-session data, or production A/B-test results. Findings may indicate violations of FTC rules carrying civil penalties — route remediation and enforcement-risk assessment to qualified legal counsel before acting on findings.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/marketing-conversion-flow-dark-pattern-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "lifecycle": "experimental"
 }

package/skills/marketing/marketing-email-list-retention-review/SKILL.md

@@ -3,7 +3,7 @@ name: marketing-email-list-retention-review
 description: Use this skill when reviewing marketing email list segment metadata, consent-record completeness, suppression-list coverage, and documented data-retention schedules for GDPR storage-limitation, CASL record-keeping, and CCPA deletion-right compliance. Trigger when a user provides a CRM or ESP export of list segment metadata fields — consent source, consent timestamp, last-engagement date, subscription status, suppression-list entries — plus the organization's documented email data-retention policy, and asks whether the stored list inventory and retention posture meets regulatory obligations.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: compliance

package/skills/marketing/marketing-email-list-retention-review/metadata.json

@@ -16,7 +16,7 @@
   "security_notes": "Review works from sanitized CRM/ESP exports only — placeholder values for email addresses, subscriber IDs, and timestamps. Never accept real subscriber PII, live CRM credentials, or ESP API keys. Findings of missing consent records or absent suppression-list sync may constitute an ongoing GDPR or CASL violation requiring legal escalation.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/marketing-email-list-retention-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "lifecycle": "experimental"
 }

package/skills/marketing/marketing-gpc-signal-honoring-review/SKILL.md

@@ -3,7 +3,7 @@ name: marketing-gpc-signal-honoring-review
 description: Use this skill when reviewing the technical path by which a Global Privacy Control opt-out signal travels through the tag stack and CMP to determine whether ad tags, server-side forwarding, and conversion APIs actually cease firing. Trigger when a user provides a tag-manager container export, a CMP opt-out configuration, a server-side tag configuration, or asks whether their GPC implementation actually stops ad tags from firing, whether CPRA opt-out obligations are met technically, or whether the CMP acknowledges GPC but fails to suppress downstream tag execution.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: compliance

package/skills/marketing/marketing-gpc-signal-honoring-review/metadata.json

@@ -16,7 +16,7 @@
   "security_notes": "GPC honoring reviews work from sanitized tag-manager container exports and CMP configuration exports only. Never request live CMP consent logs, visitor opt-out records, or ad-platform credentials. Findings of non-compliance may constitute evidence in an enforcement proceeding — route legal determinations to qualified privacy counsel, not to this skill.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/marketing-gpc-signal-honoring-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "lifecycle": "experimental"
 }

package/skills/marketing/marketing-maestro/SKILL.md

@@ -3,7 +3,7 @@ name: marketing-maestro
 description: Route marketing-governance review tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know which marketing-governance specialist you need. Not for direct answers; Maestro classifies, dispatches, and synthesizes only. Dispatches a single agent for focused tasks or a parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard or mutating agents — requires explicit human confirmation with blast-radius and rollback before any live mutation.
 allowed-tools: Agent Skill Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: ai

package/skills/marketing/marketing-maestro/metadata.json

@@ -20,7 +20,7 @@
   "security_notes": "Read-only routing skill. Never accepts real visitor data, consent-string archives, ad-platform credentials, API keys, OAuth tokens, or tenant-specific data. No live-guard agents exist in v1; any mutation request is refused and escalated to a human operator.",
   "last_verified": "2026-05-17",
   "path": "skills/marketing/marketing-maestro",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "lifecycle": "experimental"
 }