@raishin/vanguard-frontier-agentic 3.6.0 → 3.7.0

package/skills/microsoft/m365-defender-xdr-security-operations/metadata.json

@@ -25,7 +25,7 @@
   "security_notes": "Never recommend initiating device isolation, disabling user accounts, blocking files or URLs, or changing automated investigation and response automation levels without explicit SecOps owner approval and blast-radius assessment. Containment actions (isolate device, disable user, block indicator), automated-response policy changes, and live hunting queries executed against production environments are live-guard gated and require explicit human confirmation. Do not ask for secrets, tenant IDs, admin credentials, API keys, certificates, or customer data. Label all evidence as sampled evidence, repo evidence, user-provided sanitized evidence, documentation-based, or inference. Apply Zero Trust assume-breach: treat every incident as active until proven otherwise.",
   "last_verified": "2026-06-17",
   "path": "skills/microsoft/m365-defender-xdr-security-operations",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "security",
   "companion_agents": ["m365-defender-xdr-security-operations-agent"]

package/skills/microsoft/m365-exchange-sharepoint-information-governance/SKILL.md

@@ -3,7 +3,7 @@ name: m365-exchange-sharepoint-information-governance
 description: Review and advise on Exchange Online and SharePoint Online plus OneDrive information governance covering mailbox and site lifecycle, external and anonymous sharing controls, SharePoint Advanced Management (Restricted Content Discovery, site access reviews, data access governance reports), retention and records management via Microsoft Purview, oversharing remediation feeding Microsoft 365 Copilot readiness, and information architecture. Cert anchor MS-102. Static review and advisory only; tenant sharing-policy changes and retention or hold changes are live-guard gated. Refuses to weaken sharing controls or remove holds for convenience.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-17"
   category: data

package/skills/microsoft/m365-exchange-sharepoint-information-governance/metadata.json

@@ -25,7 +25,7 @@
   "security_notes": "Never recommend weakening tenant-wide sharing policies, disabling retention holds, or removing Restricted Content Discovery controls for convenience, delivery pressure, or Copilot rollout speed. Tenant sharing-policy changes, retention or hold changes, and site access restriction policy changes are live-guard gated and require explicit human confirmation, blast-radius assessment, and rollback path. Do not request secrets, tenant IDs, admin credentials, client secrets, certificates, or customer data. Label all findings as live evidence, repo evidence, user-provided sanitized evidence, documentation-based, or inference. Challenge Anyone sharing links, EEEU (Everyone Except External Users) oversharing, missing site ownership, inactive sites without lifecycle policy, and retention gaps ahead of Copilot enablement.",
   "last_verified": "2026-06-17",
   "path": "skills/microsoft/m365-exchange-sharepoint-information-governance",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "data",
   "companion_agents": ["m365-exchange-sharepoint-information-governance-agent"]

package/skills/microsoft/m365-identity-zero-trust/SKILL.md

@@ -3,7 +3,7 @@ name: m365-identity-zero-trust
 description: Review Microsoft Entra identity posture, Conditional Access policy design, MFA coverage, Privileged Identity Management (PIM) configuration, access reviews, and least-privilege role assignments against the Zero Trust identity pillar. Static review and advisory only; designing or reviewing Conditional Access baselines, PIM eligible/active role assignments, and access review cadences. Refuse to weaken MFA or Conditional Access for convenience. Escalate live-tenant configuration changes to live-guard gate.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: security

package/skills/microsoft/m365-identity-zero-trust/metadata.json

@@ -23,7 +23,7 @@
   "security_notes": "Never recommend weakening MFA or Conditional Access policies for convenience, exemption scope creep, or delivery pressure. Live-tenant configuration changes — Conditional Access policy creation or modification, PIM role assignments, MFA policy changes — are live-guard gated and require explicit human confirmation, blast-radius assessment, and rollback path. Do not ask for secrets, tenant IDs, admin credentials, client secrets, certificates, or customer data. Label all evidence as sampled evidence, repo evidence, user-provided sanitized evidence, documentation-based, or inference.",
   "last_verified": "2026-06-16",
   "path": "skills/microsoft/m365-identity-zero-trust",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "security",
   "companion_agents": ["m365-identity-zero-trust-agent"]

package/skills/microsoft/m365-intune-endpoint-management/SKILL.md

@@ -3,7 +3,7 @@ name: m365-intune-endpoint-management
 description: Review and advise on Microsoft Intune endpoint management posture covering device enrollment, compliance policies, configuration profiles, app protection (MAM) policies, Conditional Access device-compliance signal, Windows Autopilot, update rings, and endpoint security baselines. Applies Zero Trust device-health-as-signal principles. Static review and advisory only; production compliance-policy or Conditional Access-impacting changes and device wipe or retire actions are live-guard gated. Refuses to weaken device compliance or Conditional Access requirements for convenience.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-17"
   category: platform

package/skills/microsoft/m365-intune-endpoint-management/metadata.json

@@ -25,7 +25,7 @@
   "security_notes": "Never recommend weakening device compliance policies or Conditional Access device-compliance requirements for convenience, delivery pressure, or broad exclusions. Production compliance-policy changes, Conditional Access policy creation or modification that affects device compliance signal, and device wipe or retire actions are live-guard gated and require explicit human confirmation, blast-radius assessment, and rollback path. Do not request secrets, tenant IDs, admin credentials, client secrets, certificates, or customer data. Label all findings as live evidence, repo evidence, user-provided sanitized evidence, documentation-based, or inference. Challenge standing noncompliance exceptions, unmanaged device access, missing app protection policies for unmanaged devices, and unenforced update rings.",
   "last_verified": "2026-06-17",
   "path": "skills/microsoft/m365-intune-endpoint-management",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "platform",
   "companion_agents": ["m365-intune-endpoint-management-agent"]

package/skills/microsoft/m365-licensing-ea-optimization/SKILL.md

@@ -3,7 +3,7 @@ name: m365-licensing-ea-optimization
 description: Review Microsoft 365 licensing posture and Enterprise Agreement optimization — SKU and plan fit analysis across E3, E5, F-SKUs and add-ons; group-based licensing assignment hygiene; unassigned and over-assigned license detection; true-up planning guidance; and cost-versus-capability analysis for EA, CSP, and MCA contract types. Advisory only; never make purchase commitments or guarantee savings. Group-based-licensing changes in production are live-guard gated.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-17"
   category: cost-management

package/skills/microsoft/m365-licensing-ea-optimization/metadata.json

@@ -23,7 +23,7 @@
   "security_notes": "Advisory only — never make or imply purchase commitments, guarantee specific cost savings, or provide binding contract pricing. Do not conflate SKU capability analysis with procurement advice; escalate contract decisions to the customer's Microsoft account team or licensing specialist. Group-based licensing changes in production tenants are live-guard gated and require explicit human confirmation. Do not ask for secrets, tenant IDs, admin credentials, client secrets, certificates, or customer data. Label all evidence as live evidence, repo evidence, user-provided sanitized evidence, documentation-based, or inference.",
   "last_verified": "2026-06-17",
   "path": "skills/microsoft/m365-licensing-ea-optimization",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "cost-management",
   "companion_agents": ["m365-licensing-ea-optimization-agent"]

package/skills/microsoft/m365-live-identity-posture-guard/SKILL.md

@@ -3,7 +3,7 @@ name: m365-live-identity-posture-guard
 description: Live read-only Microsoft Entra identity and Conditional Access posture discovery — enumerate CA policies, MFA coverage gaps, privileged role assignments and PIM configuration, risky sign-ins, and stale guest accounts — then propose least-privilege hardening steps with blast-radius assessment and rollback plan. Phase A read-only-runtime only; no mutation.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-17"
   category: security

package/skills/microsoft/m365-live-identity-posture-guard/metadata.json

@@ -16,7 +16,7 @@
   "security_notes": "Operates with read-only Microsoft Graph application permissions only (admin-consented). No write scopes. Credential posture: certificate or managed identity, never client secret. Never prints credential values. Phase A only — no mutation.",
   "last_verified": "2026-06-17",
   "path": "skills/microsoft/m365-live-identity-posture-guard",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "companion_agents": ["m365-live-identity-posture-guard-agent"]
 }

package/skills/microsoft/m365-live-sensitivity-label-apply-guard/SKILL.md

@@ -3,7 +3,7 @@ name: m365-live-sensitivity-label-apply-guard
 description: Mutating-runtime live-guard for applying ONE Microsoft Purview sensitivity label to ONE specified item (file/driveItem) via the Microsoft Graph assignSensitivityLabel action. Strictly scoped — one item, one label application. Requires explicit written human approval token referencing the exact item, proposed label, and blast-radius. PREFLIGHT reads the item's current label before any write. Fully reversible — prior label captured; re-apply prior label is the rollback. Gate-only; never auto-dispatched. Phase B mutating-runtime.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-17"
   category: compliance

package/skills/microsoft/m365-live-sensitivity-label-apply-guard/metadata.json

@@ -16,7 +16,7 @@
   "security_notes": "Mutating-runtime Phase B. Narrowest label-apply Graph permission scopes only (InformationProtectionPolicy.Read.All + Sites.Selected or equivalent — verify against Graph permissions reference). Directory.ReadWrite.All, Sites.FullControl.All, Files.ReadWrite.All (broad), InformationProtectionPolicy.ReadWrite.All, and bulk labeling are all explicitly denied. Requires written human approval token referencing exact item + label + blast-radius. PREFLIGHT current-label capture required before any write. Prior label retained for ROLLBACK re-apply. Output signed with idempotency key and audit-logged.",
   "last_verified": "2026-06-17",
   "path": "skills/microsoft/m365-live-sensitivity-label-apply-guard",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "companion_agents": ["m365-live-sensitivity-label-apply-guard-agent"]
 }

package/skills/microsoft/m365-maestro/SKILL.md

@@ -3,7 +3,7 @@ name: m365-maestro
 description: Route Microsoft 365 tasks to the narrowest M365 specialist from the catalog. Use when you do not already know the specialist. Not for direct M365 answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any agent that changes live tenant configuration.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: platform

package/skills/microsoft/m365-maestro/metadata.json

@@ -23,7 +23,7 @@
   "security_notes": "Live-guard gate is non-negotiable: never auto-dispatch any agent that changes live tenant configuration (Conditional Access, MFA, mailbox or SharePoint sharing policies, sensitivity label publishing) without explicit human confirmation, blast-radius assessment, and rollback path. Do not ask for secrets, tenant IDs, or environment-specific values.",
   "last_verified": "2026-06-16",
   "path": "skills/microsoft/m365-maestro",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "platform",
   "companion_agents": ["m365-maestro-agent"]

package/skills/microsoft/m365-purview-data-security-compliance/SKILL.md

@@ -3,7 +3,7 @@ name: m365-purview-data-security-compliance
 description: Review Microsoft Purview data security and compliance posture — sensitivity labels and information protection, Data Loss Prevention (DLP including Endpoint DLP and Adaptive Protection), data lifecycle and retention policies, Insider Risk Management, eDiscovery and legal hold, Audit (Premium), and Data Security Posture Management (DSPM) for AI oversharing. Cert anchor: SC-401 Information Security Administrator Associate (replaced SC-400 on 2025-05-31). Static review and advisory only; production label, DLP, retention policy changes, eDiscovery holds, and Insider Risk policy changes are live-guard gated. Refuse to weaken DLP, retention, or legal-hold controls for convenience.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-17"
   category: compliance

package/skills/microsoft/m365-purview-data-security-compliance/metadata.json

@@ -25,7 +25,7 @@
   "security_notes": "Never recommend weakening DLP policies, removing retention labels, releasing legal holds, or reducing Insider Risk Management signal coverage for convenience, deadline pressure, or VIP exceptions. Production label and DLP policy changes, eDiscovery hold creation or release, retention policy modifications, and Insider Risk policy changes are live-guard gated and require explicit human confirmation, blast-radius assessment, and rollback path. Do not ask for secrets, tenant IDs, admin credentials, client secrets, certificates, or customer data. Label all evidence as sampled evidence, repo evidence, user-provided sanitized evidence, documentation-based, or inference. SC-401 (Information Security Administrator Associate) replaced SC-400 on 2025-05-31.",
   "last_verified": "2026-06-17",
   "path": "skills/microsoft/m365-purview-data-security-compliance",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "compliance",
   "companion_agents": ["m365-purview-data-security-compliance-agent"]

package/skills/microsoft/m365-teams-collaboration-governance/SKILL.md

@@ -3,7 +3,7 @@ name: m365-teams-collaboration-governance
 description: Review and advise on Microsoft Teams collaboration and communications governance covering Teams and Microsoft 365 group lifecycle and sprawl, external access and guest sharing controls, sensitivity labels on Teams and groups, meeting and messaging policies, phone and voice governance, and app permission policies. Cert anchor MS-700 Teams Administrator. Static review and advisory only; tenant-wide external-access or sharing-policy changes are live-guard gated. Refuses to weaken guest sharing or external access controls for convenience.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-17"
   category: platform

package/skills/microsoft/m365-teams-collaboration-governance/metadata.json

@@ -24,7 +24,7 @@
   "security_notes": "Never recommend weakening tenant-wide external access or guest sharing policies for convenience, delivery pressure, or broad exceptions. Tenant-wide external-access or sharing-policy changes, sensitivity label publishing changes affecting Teams, and phone system or voice routing configuration changes are live-guard gated and require explicit human confirmation, blast-radius assessment, and rollback path. Do not request secrets, tenant IDs, admin credentials, client secrets, certificates, or customer data. Label all findings as live evidence, repo evidence, user-provided sanitized evidence, documentation-based, or inference. Challenge unchecked Teams sprawl, missing expiration policies, guest access without review cadence, and overly permissive app permission policies.",
   "last_verified": "2026-06-17",
   "path": "skills/microsoft/m365-teams-collaboration-governance",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "platform",
   "companion_agents": ["m365-teams-collaboration-governance-agent"]

package/skills/microsoft/m365-tenant-governance/SKILL.md

@@ -3,7 +3,7 @@ name: m365-tenant-governance
 description: Review Microsoft 365 tenant governance posture — admin role and RBAC sprawl, service change and release governance via Message Center, organization-wide settings, Microsoft Secure Score governance actions, delegated admin and GDAP least-privilege configuration, and multi-workload policy coordination. Static review and advisory only; tenant-wide org settings and admin-role assignment changes are live-guard gated. Aligned to MS-102 governance domain.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-17"
   category: platform

package/skills/microsoft/m365-tenant-governance/metadata.json

@@ -23,7 +23,7 @@
   "security_notes": "Never recommend assigning Global Administrator for tasks achievable with a least-privileged role. Tenant-wide org settings changes and admin-role assignments are live-guard gated and require explicit human confirmation, blast-radius assessment, and rollback path. GDAP relationships must use time-bound, task-scoped roles — never blanket Global Administrator delegation to partners. Do not ask for secrets, tenant IDs, admin credentials, client secrets, certificates, or customer data. Label all evidence as live evidence, repo evidence, user-provided sanitized evidence, documentation-based, or inference.",
   "last_verified": "2026-06-17",
   "path": "skills/microsoft/m365-tenant-governance",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "platform",
   "companion_agents": ["m365-tenant-governance-agent"]

package/skills/microsoft/microsoft-business-impact-value-realization/SKILL.md

@@ -3,7 +3,7 @@ name: microsoft-business-impact-value-realization
 description: Review Microsoft 365 and Copilot value realization — license-to-value, adoption measurement, and ROI. Covers Copilot Control System measurement and reporting, Copilot Analytics and the Copilot Dashboard, Adoption Score and AI adoption score, the Microsoft 365 Copilot readiness/usage reports, license assignment optimization, and FastTrack adoption guidance. Use to turn license spend into measurable productivity and business outcomes. Advisory only; never makes licensing purchase commitments.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: finance

package/skills/microsoft/microsoft-business-impact-value-realization/metadata.json

@@ -23,7 +23,7 @@
   "security_notes": "Advisory only. Never make or imply a licensing purchase commitment, contract term, or guaranteed savings figure. Do not invent adoption percentages, usage metrics, or ROI numbers; require evidence from Microsoft 365 admin center usage reports, Adoption Score, or Copilot Analytics. Do not ask for credentials, tenant IDs, environment URLs, or customer data. Treat assigned-but-inactive licenses, un-instrumented rollouts, and value claims without a baseline as wasted spend until reviewed.",
   "last_verified": "2026-06-16",
   "path": "skills/microsoft/microsoft-business-impact-value-realization",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "finance",
   "companion_agents": ["microsoft-business-impact-value-realization-agent"]

package/skills/microsoft/microsoft-maestro/SKILL.md

@@ -3,7 +3,7 @@ name: microsoft-maestro
 description: Route Microsoft SaaS tasks to the right sub-maestro (m365-maestro-agent, d365-maestro-agent, power-platform-maestro-agent, copilot-governance-maestro-agent) or directly to a specialist. Use when you do not already know the specialist. Not for direct Microsoft answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single sub-maestro or agent for focused tasks, parallel team (max 4) for multi-domain tasks. Refuses Azure IaaS and infrastructure tasks and deflects to azure-maestro. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any live-tenant-mutation agent.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: platform

package/skills/microsoft/microsoft-maestro/metadata.json

@@ -23,7 +23,7 @@
   "security_notes": "Cross-cloud deflection is mandatory: Azure IaaS, compute, networking, or infrastructure tasks must be refused and redirected to azure-maestro. Live-guard gate is non-negotiable: never auto-dispatch any agent that mutates live tenant configuration without explicit human confirmation, blast-radius assessment, and rollback path. Do not ask for secrets, tenant IDs, or environment-specific values.",
   "last_verified": "2026-06-16",
   "path": "skills/microsoft/microsoft-maestro",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "platform",
   "companion_agents": ["microsoft-maestro-agent"]

package/skills/microsoft/power-automate-automation-risk-review/SKILL.md

@@ -3,7 +3,7 @@ name: power-automate-automation-risk-review
 description: Review Power Automate cloud flow risk and governance — flow ownership and sharing (run-only vs co-owner), connector and DLP exposure, maker-vs-run-only security segmentation, error handling and retry/terminate patterns, monitoring and alerting, credential/connection lifecycle, and Center of Excellence auditing. Use to harden fragile, unowned, or over-privileged business-critical automations. Static review only; production DLP and flow-ownership changes are escalated.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: compliance

package/skills/microsoft/power-automate-automation-risk-review/metadata.json

@@ -23,7 +23,7 @@
   "security_notes": "Static review only. Do not modify production DLP policies, flow ownership/sharing, or connector configurations; these are escalated to a Power Platform administrator with a rollback plan. Prefer run-only sharing over co-ownership and keep run-only users out of the Environment Maker role. Do not ask for credentials, connection secrets, tenant IDs, environment URLs, or customer data. Treat single-owner business-critical flows, broad co-ownership, unscoped connectors, missing error handling, and unmonitored flows as operational and data-exposure risks until reviewed.",
   "last_verified": "2026-06-16",
   "path": "skills/microsoft/power-automate-automation-risk-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "compliance",
   "companion_agents": ["power-automate-automation-risk-review-agent"]

package/skills/microsoft/power-platform-alm-pipelines/SKILL.md

@@ -3,7 +3,7 @@ name: power-platform-alm-pipelines
 description: Review Power Platform application lifecycle management health across managed and unmanaged solutions, Power Platform Pipelines, environment strategy (dev/test/prod), solution layering, connection references, environment variables, source control via Git integration, and deployment gates. Use to detect unhealthy ALM patterns, missing rollback paths, and ungoverned production deployments. Static review only; production pipeline and deployment-configuration changes are escalated.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: delivery

package/skills/microsoft/power-platform-alm-pipelines/metadata.json

@@ -24,7 +24,7 @@
   "security_notes": "Static review only. Never approve unmanaged solutions in production environments or recommend deployment stage bypass regardless of urgency. Do not recommend production pipeline configuration changes, deployment stage removals, or Managed Environment policy changes without documented owner sign-off, blast-radius assessment, and a tested rollback path. Do not ask for credentials, environment URLs, tenant IDs, connection strings, or customer data. Treat missing connection references, hardcoded environment-specific values, and ungoverned pipeline stages as deployment integrity risks until reviewed.",
   "last_verified": "2026-06-16",
   "path": "skills/microsoft/power-platform-alm-pipelines",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "delivery",
   "companion_agents": ["power-platform-alm-pipelines-agent"]

package/skills/microsoft/power-platform-governance-dataverse-security/SKILL.md

@@ -3,7 +3,7 @@ name: power-platform-governance-dataverse-security
 description: Review and advise on Power Platform environment strategy, Data Loss Prevention (DLP) policy design, Dataverse security model, business unit hierarchy, security roles and teams, table/row/column-level permissions, connector governance, and Center of Excellence (CoE) alignment. Flags environment sprawl, weak DLP, unmanaged connectors, over-privileged Dataverse roles, insecure ad-hoc sharing, and misaligned business unit design. Static review only — no live tenant mutations. Escalates production DLP changes through the live-guard gate.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: security

package/skills/microsoft/power-platform-governance-dataverse-security/metadata.json

@@ -24,7 +24,7 @@
   "security_notes": "Production DLP policy changes are live-guard gated and must never be auto-applied. Never request or accept tenant IDs, environment IDs, connection strings, service principal secrets, or customer data. Refuse requests to disable or broadly relax DLP for convenience. All privilege grants in Dataverse are additive and accumulative — over-permissioning cannot be hidden by app-level controls alone. Connector classification disputes must document business justification before any reclassification.",
   "last_verified": "2026-06-16",
   "path": "skills/microsoft/power-platform-governance-dataverse-security",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "security",
   "companion_agents": ["power-platform-governance-dataverse-security-agent"]

package/skills/microsoft/power-platform-maestro/SKILL.md

@@ -3,7 +3,7 @@ name: power-platform-maestro
 description: Route Power Platform tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know the specialist. Not for direct Power Platform answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any production environment deployment or tenant-wide DLP policy change.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-16"
   category: platform

package/skills/microsoft/power-platform-maestro/metadata.json

@@ -23,7 +23,7 @@
   "security_notes": "Live-guard gate is non-negotiable: never auto-dispatch to production environment deployment or tenant-wide DLP policy change operations without explicit human confirmation, blast-radius assessment, and rollback path. Do not ask for secrets, tenant IDs, or environment-specific values.",
   "last_verified": "2026-06-16",
   "path": "skills/microsoft/power-platform-maestro",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "category": "platform",
   "companion_agents": ["power-platform-maestro-agent"]

package/skills/netsuite/README.md

@@ -134,5 +134,5 @@ This enforces the advisory boundary: judgment without destructive capability.
 
 **Version:** 0.1.0  
 **Provider:** netsuite  
-**Source:** github: Raishin  
+**Source:** github: VincentChuWaiChow  
 **Last updated:** 2026-06-09

package/skills/netsuite/netsuite-administrator-skill/SKILL.md

@@ -3,7 +3,7 @@ name: netsuite-administrator-skill
 description: "Flashlight skill for reviewing NetSuite account administration configurations aligned to the Administrator Professional certification (N16291GC10). T0 static review — no live account connection required, never Administrator role. TRIGGER when: user asks to review accounting preferences, tax nexus setup, currency management, user provisioning policy, email template defaults, sandbox refresh procedures, release preview planning, or account-level system preferences in NetSuite. Trigger phrases: review account setup, audit user provisioning, check accounting preferences, validate tax configuration, sandbox refresh checklist, release preview prep, administrator review. DO NOT TRIGGER when: request concerns OAuth 2.0 or TBA authentication flows (use netsuite-sso-oauth-tba-agent), role permission and SoD matrix design (use netsuite-identity-access-role-permission-agent), financial close controls or posting periods (use netsuite-financial-foundations-agent), SuiteScript code review (use netsuite-application-developer-agent), or any live mutation in a production account is requested."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: platform

package/skills/netsuite/netsuite-administrator-skill/metadata.json

@@ -31,6 +31,6 @@
   "security_notes": "Static review only — works exclusively from sanitized configuration exports; never requests or accepts credentials, tokens, session IDs, consumer keys, or any authentication material. Does not connect to, query, or mutate any NetSuite account. The Administrator role is absolutely prohibited — custom roles are always derived from standard roles with View-only permissions. OAuth 2.0 sandbox isolation requirements (re-authorization after each refresh) are surfaced in every sandbox governance review. SOAP deprecation risks (2026.1 / 2027.1 / 2028.2 milestones) are flagged for any integration posture identified during review.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-administrator-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/netsuite/netsuite-ai-connector-mcp-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Flashlight skill for reviewing the security and governance posture
 license: UPL-1.0
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: security

package/skills/netsuite/netsuite-ai-connector-mcp-skill/metadata.json

@@ -30,7 +30,7 @@
   "security_notes": "Static review only. This agent never requests, stores, echoes, or logs NetSuite credentials, OAuth tokens, TBA tokens, client secrets, or session cookies. The AI Connector role reviewed must never be the Administrator role (evidence row 6a). Exact permission names are critical: 'MCP Server Connection' and 'Log in using OAuth 2.0 Access Tokens' (evidence rows 6b, 6c). HIPAA/BAA healthcare accounts cannot use the AI Connector (evidence row 6e). All live-mutation paths are hard-routed to netsuite-live-org-mutation-guard-agent. No org connection is established at any point.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-ai-connector-mcp-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "source_attribution": "Adapted from oracle/netsuite-suitecloud-sdk packages/agent-skills/netsuite-ai-connector-instructions (Universal Permissive License UPL-1.0; Copyright (c) 2019, 2023 Oracle and/or its affiliates; https://oss.oracle.com/licenses/upl). Oracle upstream skill provides tool-selection decision trees, SuiteQL safety checklist, output formatting standards, multi-subsidiary/multi-currency scoping, and SafeWords security principles. Vanguard additions: harness routing and intake classification, tool-call logging and retry governance, prompt-injection testing review workflow, HIPAA/BAA restriction gate, and exact-permission-name verification gate."
 }

package/skills/netsuite/netsuite-ai-foundations-skill/SKILL.md

@@ -3,7 +3,7 @@ name: netsuite-ai-foundations-skill
 description: "Flashlight skill for reviewing NetSuite AI feature enablement and AI Connector Service configuration posture, aligned to the AI Foundations Associate certification (N16765GC10, available). T0 static review — no live account connection required. NOTE: AI Specialist and AI Professional certifications are COMING SOON and are not yet available; this skill does not cover those levels. TRIGGER when: user asks to review NetSuite AI feature enablement (bill matching, anomaly detection, text enhancement, predicted risk), AI Connector Service configuration, MCP Server Connection permission setup, OAuth 2.0 Access Tokens permission for AI roles, HIPAA/BAA restriction for healthcare accounts, or AI governance and PII exposure controls. Trigger phrases: AI Foundations review, AI Connector configuration, MCP Server Connection permission, NetSuite AI features, AI bill matching, AI anomaly detection, HIPAA AI restriction, AI governance review, Log in using OAuth 2.0 Access Tokens. DO NOT TRIGGER when: request is about AI Connector MCP tool execution or SuiteQL query safety (use netsuite-ai-connector-mcp-agent); OAuth 2.0 authentication setup beyond the AI role (use netsuite-sso-oauth-tba-agent); SuiteScript code security (use netsuite-suitescript-secure-code-review-agent); or live account mutation is required (use netsuite-live-org-mutation-guard-agent). Never assert that AI Specialist or AI Professional certifications are available — they are COMING SOON."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: ai

package/skills/netsuite/netsuite-ai-foundations-skill/metadata.json

@@ -31,6 +31,6 @@
   "security_notes": "Static review only — works exclusively from sanitized configuration excerpts; never requests or accepts credentials, tokens, consumer keys, client secrets, or any authentication material. Does not connect to, query, or mutate any NetSuite account. AI Connector role must never be Administrator; required permissions are MCP Server Connection and Log in using OAuth 2.0 Access Tokens only. HIPAA/BAA restriction for healthcare customers is a hard gate. AI Specialist and AI Professional certifications are COMING SOON — never claimed as available.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-ai-foundations-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/netsuite/netsuite-application-developer-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Reviews NetSuite SuiteScript 2.x code, SuiteFlow workflows, SuiteB
 license: UPL-1.0
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: platform

package/skills/netsuite/netsuite-application-developer-skill/metadata.json

@@ -29,7 +29,7 @@
   "security_notes": "Static review only — never deploys, activates, or modifies any script, workflow, or customization in any NetSuite account. No credentials, session tokens, or API keys are requested or processed. Script run-as accounts reviewed must follow least-privilege posture with Administrator role explicitly forbidden.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-application-developer-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "source_attribution": "Adapted with DEPENDENCY on oracle/netsuite-suitecloud-sdk packages/agent-skills/netsuite-suitescript-records-reference and netsuite-uif-spa-reference (UPL-1.0, Copyright (c) 2019, 2023 Oracle and/or its affiliates). Vanguard additions: [FACT]/[ASSUMPTION]/[INFERENCE] evidence labeling, governance-limit severity classification, explicit SuiteScript 1.0 detection and escalation path, least-privilege run-as role enforcement, and Vanguard harness routing integration."
 }

package/skills/netsuite/netsuite-audit-controls-sox-skill/SKILL.md

@@ -3,7 +3,7 @@ name: netsuite-audit-controls-sox-skill
 description: "Flashlight skill for reviewing NetSuite financial governance and SOX internal control configurations. T0 static review — no live account connection required. TRIGGER when: user asks to review segregation of duties, SoD conflicts, posting period controls, period-close procedures, revenue recognition schedules, approval workflow chains for journal entries or vendor bills, audit trail completeness, or SOX walkthrough evidence in NetSuite. Trigger phrases: SOX review, segregation of duties, SoD conflict, posting period locked, period close checklist, revenue recognition schedule, journal entry approval, audit trail, SOX material weakness, internal controls review. DO NOT TRIGGER when: request is about routine AP/AR transaction processing without a SOX angle (use netsuite-financial-foundations-agent), OAuth or TBA authentication setup (use netsuite-sso-oauth-tba-agent), SuiteFlow workflow syntax or builder mechanics (use netsuite-suiteflow-automation-agent), SuiteScript code security (use netsuite-suitescript-secure-code-review-agent), or live account mutation is required (use netsuite-live-org-mutation-guard-agent)."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: compliance

package/skills/netsuite/netsuite-audit-controls-sox-skill/metadata.json

@@ -31,6 +31,6 @@
   "security_notes": "Static review only — works exclusively from sanitized configuration excerpts; never requests or accepts credentials, tokens, session IDs, consumer keys, or any authentication material. Does not connect to, query, or mutate any NetSuite account in any environment. Role recommendations explicitly exclude the Administrator role. 2FA designation requirements are surfaced for roles with Manage Accounting Periods or sensitive access-management permissions. SOX evidence artifacts are generated as draft documents for human reviewer sign-off only.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-audit-controls-sox-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/netsuite/netsuite-bi-reporting-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Reviews and designs NetSuite reports, dashboards, and KPI definiti
 license: UPL-1.0
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: data

package/skills/netsuite/netsuite-bi-reporting-skill/metadata.json

@@ -30,7 +30,7 @@
   "security_notes": "Static review only — never connects to, queries, or mutates any NetSuite account. No credentials, session tokens, or API keys are requested or processed. All review output is a draft artifact requiring human validation before any dashboard or report is published or shared.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-bi-reporting-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "source_attribution": "Adapted from oracle/netsuite-suitecloud-sdk packages/agent-skills/netsuite-finance-analyst (UPL-1.0, Copyright (c) 2019, 2023 Oracle and/or its affiliates). Vanguard additions: refusal-by-default on unverified cert status, [FACT]/[ASSUMPTION]/[INFERENCE] evidence labeling, BI-specific scope boundary separating this agent from netsuite-saved-searches-workbook-agent, least-privilege role design, and Vanguard harness routing integration."
 }

package/skills/netsuite/netsuite-data-governance-privacy-skill/SKILL.md

@@ -3,7 +3,7 @@ name: netsuite-data-governance-privacy-skill
 description: "Flashlight skill for auditing PII exposure paths, data retention and purge policies, field-level access restrictions, privacy controls, and export configurations in NetSuite. T0 static review — no live account connection or actual personal data required. TRIGGER when: user asks to review PII field access, audit data retention settings, check field-level security on sensitive records, assess privacy controls, identify PII in saved searches, review export control permissions, or evaluate GDPR/CCPA readiness of a NetSuite configuration. Trigger phrases: PII exposure, field-level security, data retention policy, GDPR compliance, personal data access, export controls, consent tracking, sensitive field access. DO NOT TRIGGER when: the user needs role and permission architecture review beyond PII fields (use netsuite-identity-access-role-permission-skill), SOX audit trail review (use netsuite-audit-controls-sox-skill), integration data-flow security (use netsuite-integration-migration-skill), subsidiary data segregation (use netsuite-oneworld-multisubsidiary-skill), or SuiteScript code PII handling review (use netsuite-suitescript-secure-code-review-skill)."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: compliance

package/skills/netsuite/netsuite-data-governance-privacy-skill/metadata.json

@@ -29,6 +29,6 @@
   "security_notes": "Static review only. This agent never accepts, stores, echoes, or processes actual personal data. All inputs containing real PII are refused. No live NetSuite credentials, OAuth tokens, TBA tokens, or session cookies are accepted. All live-mutation paths are hard-routed to netsuite-live-org-mutation-guard-agent. No org connection is established at any point.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-data-governance-privacy-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/netsuite/netsuite-enterprise-architecture-skill/SKILL.md

@@ -3,7 +3,7 @@ name: netsuite-enterprise-architecture-skill
 description: "Reviews NetSuite enterprise architecture decisions — SuiteCloud platform design, integration topology (REST/RESTlet/SOAP migration), OneWorld multi-subsidiary layout, SDF project structure, SuiteScript governance, and AI Connector MCP integration patterns — against Oracle best practices and the SOAP removal timeline. Produces risk-rated findings and structured architecture decision records. T0 static review — no org connection required. TRIGGER when: user requests an architecture review, asks for integration protocol selection advice, asks about OneWorld or multi-subsidiary design, needs SDF project structure guidance, needs SuiteScript version strategy, asks about AI Connector MCP design, or needs cross-domain design arbitration. Trigger phrases: NetSuite architecture, should I use REST or SOAP, OneWorld design, SuiteCloud architecture, SDF project structure, customization strategy, integration topology, architecture decision record, ADR, multi-subsidiary. DO NOT TRIGGER when: the request is a live deployment (use netsuite-live-org-mutation-guard-agent); request is specifically about SOX audit controls (use netsuite-audit-controls-sox-agent); request is specifically about role and permission SoD (use netsuite-identity-access-role-permission-agent); request is a SOAP-to-REST migration program rather than architecture advice (use netsuite-integration-migration-agent)."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: architecture

package/skills/netsuite/netsuite-enterprise-architecture-skill/metadata.json

@@ -34,6 +34,6 @@
   "security_notes": "Static review only. This agent analyses architecture documents and configuration excerpts; it never connects to a live NetSuite account, requests credentials, or executes any deployment or configuration change. All recommendations are advisory and require human review before implementation. SOAP architecture dependencies are flagged as migration-risk with explicit timeline citations.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-enterprise-architecture-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/netsuite/netsuite-erp-consultant-skill/SKILL.md

@@ -3,7 +3,7 @@ name: netsuite-erp-consultant-skill
 description: "Flashlight skill for reviewing NetSuite ERP implementation configurations aligned to the ERP Consultant Professional certification (N16302GC10). T0 static review — no live account connection required. TRIGGER when: user asks to review order-to-cash configuration, procure-to-pay workflow, inventory management setup, pricing rule design, fulfillment or receipt workflow, item record configuration, or implementation gap analysis in NetSuite. Trigger phrases: review OTC setup, audit procure to pay, check inventory configuration, validate pricing rules, review fulfillment workflow, implementation gap analysis, ERP consultant review. DO NOT TRIGGER when: request concerns financial close controls or posting periods (use netsuite-financial-foundations-agent), SOX control design (use netsuite-audit-controls-sox-agent), custom SuiteScript code (use netsuite-application-developer-agent), multi-subsidiary intercompany transactions (use netsuite-oneworld-multisubsidiary-agent), or any live account mutation is required."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: platform

package/skills/netsuite/netsuite-erp-consultant-skill/metadata.json

@@ -30,6 +30,6 @@
   "security_notes": "Static review only — works exclusively from sanitized ERP configuration exports; never requests or accepts credentials, tokens, session IDs, or authentication material. Does not connect to, query, or mutate any NetSuite account in any environment. Administrator role is prohibited in all recommendations. SOAP deprecation risks against the 2026.1 / 2027.1 / 2028.2 timeline are surfaced for any integration configuration reviewed. Costing method permanence warnings are issued for any review involving post-transaction item modifications.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-erp-consultant-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/netsuite/netsuite-evidence-release-drift-skill/SKILL.md

@@ -3,7 +3,7 @@ name: netsuite-evidence-release-drift-skill
 description: "Assigns Vanguard evidence hierarchy labels (LIVE_EVIDENCE through BLOCKED) to NetSuite claims and performs biannual release-drift audits against Oracle NetSuite milestone releases. Tracks SOAP removal (2026.1 REST+OAuth2 default; 2027.1 new SOAP blocked; 2028.2 all SOAP disabled) and TBA deprecation timelines. T0 static review — no org connection required. TRIGGER when: a NetSuite agent claim needs an evidence label, a portfolio drift audit is requested, a release-sensitive claim (SOAP, TBA, OAuth2, cert status) needs verification, or a coming-soon certification status needs confirmation. Trigger phrases: evidence label, release drift, SOAP deprecation timeline, is this cert available, verify NetSuite claim, 2026.1 release, 2027.1 release, biannual audit, UNVERIFIED claim. DO NOT TRIGGER when: the request is about live org operations (use netsuite-live-org-mutation-guard-agent); request is about integration architecture design without evidence labelling (use netsuite-web-services-integration-agent); request is about SOX audit evidence gathering (use netsuite-audit-controls-sox-agent)."
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-06-09"
   category: compliance

package/skills/netsuite/netsuite-evidence-release-drift-skill/metadata.json

@@ -31,6 +31,6 @@
   "security_notes": "Static review only. This agent reads documentation and agent content files; it never connects to a live NetSuite account, requests credentials, or stores tokens. All evidence labelling operates on sanitized text. No live identity is provisioned. Biannual drift audits are read-only operations against official Oracle/NetSuite documentation domains.",
   "last_verified": "2026-06-09",
   "path": "skills/netsuite/netsuite-evidence-release-drift-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }