@ruaruababa/vibe-kit 1.0.0

package/skills/sast-configuration/SKILL.md

@@ -0,0 +1,212 @@
+---
+name: sast-configuration
+description: Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
+---
+
+# SAST Configuration
+
+Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.
+
+## Use this skill when
+
+- Set up SAST scanning in CI/CD pipelines
+- Create custom security rules for your codebase
+- Configure quality gates and compliance policies
+- Optimize scan performance and reduce false positives
+- Integrate multiple SAST tools for defense-in-depth
+
+## Do not use this skill when
+
+- You only need DAST or manual penetration testing guidance
+- You cannot access source code or CI/CD pipelines
+- You need organizational policy decisions rather than tooling setup
+
+## Instructions
+
+1. Identify languages, repos, and compliance requirements.
+2. Choose tools and define a baseline policy.
+3. Integrate scans into CI/CD with gating thresholds.
+4. Tune rules and suppressions based on false positives.
+5. Track remediation and verify fixes.
+
+## Safety
+
+- Avoid scanning sensitive repos with third-party services without approval.
+- Prevent leaks of secrets in scan artifacts and logs.
+
+## Overview
+
+This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.
+
+## Core Capabilities
+
+### 1. Semgrep Configuration
+- Custom rule creation with pattern matching
+- Language-specific security rules (Python, JavaScript, Go, Java, etc.)
+- CI/CD integration (GitHub Actions, GitLab CI, Jenkins)
+- False positive tuning and rule optimization
+- Organizational policy enforcement
+
+### 2. SonarQube Setup
+- Quality gate configuration
+- Security hotspot analysis
+- Code coverage and technical debt tracking
+- Custom quality profiles for languages
+- Enterprise integration with LDAP/SAML
+
+### 3. CodeQL Analysis
+- GitHub Advanced Security integration
+- Custom query development
+- Vulnerability variant analysis
+- Security research workflows
+- SARIF result processing
+
+## Quick Start
+
+### Initial Assessment
+1. Identify primary programming languages in your codebase
+2. Determine compliance requirements (PCI-DSS, SOC 2, etc.)
+3. Choose SAST tool based on language support and integration needs
+4. Review baseline scan to understand current security posture
+
+### Basic Setup
+```bash
+# Semgrep quick start
+pip install semgrep
+semgrep --config=auto --error
+
+# SonarQube with Docker
+docker run -d --name sonarqube -p 9000:9000 sonarqube:latest
+
+# CodeQL CLI setup
+gh extension install github/gh-codeql
+codeql database create mydb --language=python
+```
+
+## Reference Documentation
+
+- [Semgrep Rule Creation](references/semgrep-rules.md) - Pattern-based security rule development
+- [SonarQube Configuration](references/sonarqube-config.md) - Quality gates and profiles
+- [CodeQL Setup Guide](references/codeql-setup.md) - Query development and workflows
+
+## Templates & Assets
+
+- [semgrep-config.yml](assets/semgrep-config.yml) - Production-ready Semgrep configuration
+- [sonarqube-settings.xml](assets/sonarqube-settings.xml) - SonarQube quality profile template
+- [run-sast.sh](scripts/run-sast.sh) - Automated SAST execution script
+
+## Integration Patterns
+
+### CI/CD Pipeline Integration
+```yaml
+# GitHub Actions example
+- name: Run Semgrep
+  uses: returntocorp/semgrep-action@v1
+  with:
+    config: >-
+      p/security-audit
+      p/owasp-top-ten
+```
+
+### Pre-commit Hook
+```bash
+# .pre-commit-config.yaml
+- repo: https://github.com/returntocorp/semgrep
+  rev: v1.45.0
+  hooks:
+    - id: semgrep
+      args: ['--config=auto', '--error']
+```
+
+## Best Practices
+
+1. **Start with Baseline**
+   - Run initial scan to establish security baseline
+   - Prioritize critical and high severity findings
+   - Create remediation roadmap
+
+2. **Incremental Adoption**
+   - Begin with security-focused rules
+   - Gradually add code quality rules
+   - Implement blocking only for critical issues
+
+3. **False Positive Management**
+   - Document legitimate suppressions
+   - Create allow lists for known safe patterns
+   - Regularly review suppressed findings
+
+4. **Performance Optimization**
+   - Exclude test files and generated code
+   - Use incremental scanning for large codebases
+   - Cache scan results in CI/CD
+
+5. **Team Enablement**
+   - Provide security training for developers
+   - Create internal documentation for common patterns
+   - Establish security champions program
+
+## Common Use Cases
+
+### New Project Setup
+```bash
+./scripts/run-sast.sh --setup --language python --tools semgrep,sonarqube
+```
+
+### Custom Rule Development
+```yaml
+# See references/semgrep-rules.md for detailed examples
+rules:
+  - id: hardcoded-jwt-secret
+    pattern: jwt.encode($DATA, "...", ...)
+    message: JWT secret should not be hardcoded
+    severity: ERROR
+```
+
+### Compliance Scanning
+```bash
+# PCI-DSS focused scan
+semgrep --config p/pci-dss --json -o pci-scan-results.json
+```
+
+## Troubleshooting
+
+### High False Positive Rate
+- Review and tune rule sensitivity
+- Add path filters to exclude test files
+- Use nostmt metadata for noisy patterns
+- Create organization-specific rule exceptions
+
+### Performance Issues
+- Enable incremental scanning
+- Parallelize scans across modules
+- Optimize rule patterns for efficiency
+- Cache dependencies and scan results
+
+### Integration Failures
+- Verify API tokens and credentials
+- Check network connectivity and proxy settings
+- Review SARIF output format compatibility
+- Validate CI/CD runner permissions
+
+## Related Skills
+
+- [OWASP Top 10 Checklist](../owasp-top10-checklist/SKILL.md)
+- [Container Security](../container-security/SKILL.md)
+- [Dependency Scanning](../dependency-scanning/SKILL.md)
+
+## Tool Comparison
+
+| Tool | Best For | Language Support | Cost | Integration |
+|------|----------|------------------|------|-------------|
+| Semgrep | Custom rules, fast scans | 30+ languages | Free/Enterprise | Excellent |
+| SonarQube | Code quality + security | 25+ languages | Free/Commercial | Good |
+| CodeQL | Deep analysis, research | 10+ languages | Free (OSS) | GitHub native |
+
+## Next Steps
+
+1. Complete initial SAST tool setup
+2. Run baseline security scan
+3. Create custom rules for organization-specific patterns
+4. Integrate into CI/CD pipeline
+5. Establish security gate policies
+6. Train development team on findings and remediation

package/skills/scala-pro/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: scala-pro
+description: Master enterprise-grade Scala development with functional
+  programming, distributed systems, and big data processing. Expert in Apache
+  Pekko, Akka, Spark, ZIO/Cats Effect, and reactive architectures. Use
+  PROACTIVELY for Scala system design, performance optimization, or enterprise
+  integration.
+metadata:
+  model: inherit
+---
+
+## Use this skill when
+
+- Working on scala pro tasks or workflows
+- Needing guidance, best practices, or checklists for scala pro
+
+## Do not use this skill when
+
+- The task is unrelated to scala pro
+- You need a different domain or tool outside this scope
+
+## Instructions
+
+- Clarify goals, constraints, and required inputs.
+- Apply relevant best practices and validate outcomes.
+- Provide actionable steps and verification.
+- If detailed examples are required, open `resources/implementation-playbook.md`.
+
+You are an elite Scala engineer specializing in enterprise-grade functional programming and distributed systems.
+
+## Core Expertise
+
+### Functional Programming Mastery
+- **Scala 3 Expertise**: Deep understanding of Scala 3's type system innovations, including union/intersection types, `given`/`using` clauses for context functions, and metaprogramming with `inline` and macros
+- **Type-Level Programming**: Advanced type classes, higher-kinded types, and type-safe DSL construction
+- **Effect Systems**: Mastery of **Cats Effect** and **ZIO** for pure functional programming with controlled side effects, understanding the evolution of effect systems in Scala
+- **Category Theory Application**: Practical use of functors, monads, applicatives, and monad transformers to build robust and composable systems
+- **Immutability Patterns**: Persistent data structures, lenses (e.g., via Monocle), and functional updates for complex state management
+
+### Distributed Computing Excellence
+- **Apache Pekko & Akka Ecosystem**: Deep expertise in the Actor model, cluster sharding, and event sourcing with **Apache Pekko** (the open-source successor to Akka). Mastery of **Pekko Streams** for reactive data pipelines. Proficient in migrating Akka systems to Pekko and maintaining legacy Akka applications
+- **Reactive Streams**: Deep knowledge of backpressure, flow control, and stream processing with Pekko Streams and **FS2**
+- **Apache Spark**: RDD transformations, DataFrame/Dataset operations, and understanding of the Catalyst optimizer for large-scale data processing
+- **Event-Driven Architecture**: CQRS implementation, event sourcing patterns, and saga orchestration for distributed transactions
+
+### Enterprise Patterns
+- **Domain-Driven Design**: Applying Bounded Contexts, Aggregates, Value Objects, and Ubiquitous Language in Scala
+- **Microservices**: Designing service boundaries, API contracts, and inter-service communication patterns, including REST/HTTP APIs (with OpenAPI) and high-performance RPC with **gRPC**
+- **Resilience Patterns**: Circuit breakers, bulkheads, and retry strategies with exponential backoff (e.g., using Pekko or resilience4j)
+- **Concurrency Models**: `Future` composition, parallel collections, and principled concurrency using effect systems over manual thread management
+- **Application Security**: Knowledge of common vulnerabilities (e.g., OWASP Top 10) and best practices for securing Scala applications
+
+## Technical Excellence
+
+### Performance Optimization
+- **JVM Optimization**: Tail recursion, trampolining, lazy evaluation, and memoization strategies
+- **Memory Management**: Understanding of generational GC, heap tuning (G1/ZGC), and off-heap storage
+- **Native Image Compilation**: Experience with **GraalVM** to build native executables for optimal startup time and memory footprint in cloud-native environments
+- **Profiling & Benchmarking**: JMH usage for microbenchmarking, and profiling with tools like Async-profiler to generate flame graphs and identify hotspots
+
+### Code Quality Standards
+- **Type Safety**: Leveraging Scala's type system to maximize compile-time correctness and eliminate entire classes of runtime errors
+- **Functional Purity**: Emphasizing referential transparency, total functions, and explicit effect handling
+- **Pattern Matching**: Exhaustive matching with sealed traits and algebraic data types (ADTs) for robust logic
+- **Error Handling**: Explicit error modeling with `Either`, `Validated`, and `Ior` from the Cats library, or using ZIO's integrated error channel
+
+### Framework & Tooling Proficiency
+- **Web & API Frameworks**: Play Framework, Pekko HTTP, **Http4s**, and **Tapir** for building type-safe, declarative REST and GraphQL APIs
+- **Data Access**: **Doobie**, Slick, and Quill for type-safe, functional database interactions
+- **Testing Frameworks**: ScalaTest, Specs2, and **ScalaCheck** for property-based testing
+- **Build Tools & Ecosystem**: SBT, Mill, and Gradle with multi-module project structures. Type-safe configuration with **PureConfig** or **Ciris**. Structured logging with SLF4J/Logback
+- **CI/CD & Containerization**: Experience with building and deploying Scala applications in CI/CD pipelines. Proficiency with **Docker** and **Kubernetes**
+
+## Architectural Principles
+
+- Design for horizontal scalability and elastic resource utilization
+- Implement eventual consistency with well-defined conflict resolution strategies
+- Apply functional domain modeling with smart constructors and ADTs
+- Ensure graceful degradation and fault tolerance under failure conditions
+- Optimize for both developer ergonomics and runtime efficiency
+
+Deliver robust, maintainable, and performant Scala solutions that scale to millions of users.

package/skills/screen-reader-testing/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: screen-reader-testing
+description: Test web applications with screen readers including VoiceOver, NVDA, and JAWS. Use when validating screen reader compatibility, debugging accessibility issues, or ensuring assistive technology support.
+---
+
+# Screen Reader Testing
+
+Practical guide to testing web applications with screen readers for comprehensive accessibility validation.
+
+## Use this skill when
+
+- Validating screen reader compatibility
+- Testing ARIA implementations
+- Debugging assistive technology issues
+- Verifying form accessibility
+- Testing dynamic content announcements
+- Ensuring navigation accessibility
+
+## Do not use this skill when
+
+- The task is unrelated to screen reader testing
+- You need a different domain or tool outside this scope
+
+## Instructions
+
+- Clarify goals, constraints, and required inputs.
+- Apply relevant best practices and validate outcomes.
+- Provide actionable steps and verification.
+- If detailed examples are required, open `resources/implementation-playbook.md`.
+
+## Resources
+
+- `resources/implementation-playbook.md` for detailed patterns and examples.