@softspark/ai-toolkit 1.3.13 → 1.3.15

package/app/skills/security-patterns/SKILL.md

@@ -81,6 +81,16 @@ async def resource():
 
 ---
 
+## Common Rationalizations
+
+| Excuse | Why It's Wrong |
+|--------|----------------|
+| "It's an internal API, security doesn't matter" | Internal APIs get exposed — lateral movement is attackers' primary technique |
+| "The framework handles security" | Frameworks provide tools, not guarantees — misconfiguration is OWASP #5 |
+| "We'll add auth later" | Unauthenticated endpoints in production get discovered within hours |
+| "Nobody would exploit this" | Automated scanners don't care about your threat model — they scan everything |
+| "It's behind a VPN" | VPNs are perimeter defense — zero trust assumes breach already happened |
+
 ## Reference Guides
 
 For authentication patterns (JWT, passwords, token strategy), see [reference/authentication.md](reference/authentication.md).

package/app/skills/tdd/SKILL.md

@@ -172,3 +172,9 @@ Before marking work complete:
 - [ ] Edge cases and errors covered
 
 Can't check all boxes? You skipped TDD. Start over.
+
+## Related Skills
+- Feature complete? → `/review` to get a code review
+- Need to plan the feature first? → `/plan` for task breakdown
+- Want a full test coverage sweep? → `/workflow test-coverage`
+- Debugging a test failure? → `/debug` for systematic root cause analysis

package/app/skills/testing-patterns/SKILL.md

@@ -72,3 +72,13 @@ For PHP PHPUnit patterns, see [reference/php-phpunit.md](reference/php-phpunit.m
 For Go testing patterns, see [reference/go-testing.md](reference/go-testing.md).
 
 For Flutter/Dart testing patterns, see [reference/flutter-testing.md](reference/flutter-testing.md).
+
+## Common Rationalizations
+
+| Excuse | Why It's Wrong |
+|--------|----------------|
+| "It's too simple to test" | Simple code breaks in integration — test the contract, not the complexity |
+| "Tests slow down development" | Tests slow down bugs reaching production — that's the point |
+| "We'll add tests later" | Untested code accumulates — later means never, and coverage gaps compound |
+| "Mocking everything is fine" | Over-mocking tests the mocks, not the code — mock at boundaries only |
+| "100% coverage means no bugs" | Coverage measures execution, not correctness — focus on behavior assertions |

package/app/skills/workflow/SKILL.md

@@ -188,13 +188,13 @@ Agent(subagent_type="code-reviewer",         prompt="Review test quality — no
 # Sequential recon:
 Agent(subagent_type="explorer-agent",        prompt="Map attack surface, entry points, data flows. READ-ONLY.")
 # Parallel audit:
-Agent(subagent_type="security-auditor",      prompt="OWASP Top 10, injection, auth review. READ-ONLY.")
+Agent(subagent_type="security-auditor",      prompt="Run /cve-scan first, then OWASP Top 10, injection, auth review. READ-ONLY.")
 Agent(subagent_type="code-reviewer",         prompt="Secrets in code, error handling, logging gaps. READ-ONLY.")
 Agent(subagent_type="devops-implementer",    prompt="Infra misconfig, Docker hardening, network. READ-ONLY.")
 Agent(subagent_type="database-architect",    prompt="SQL injection vectors, access controls, encryption. READ-ONLY.")
 # Sequential:
-Agent(subagent_type="tech-lead",             prompt="Prioritize findings, assign severity (CVSS).")
-Agent(subagent_type="documenter",            prompt="Security audit report + remediation checklist. Own files: kb/")
+Agent(subagent_type="tech-lead",             prompt="Prioritize findings including CVE scan results, assign severity (CVSS).")
+Agent(subagent_type="documenter",            prompt="Security audit report + CVE inventory + remediation checklist. Own files: kb/")
 ```
 
 **`codebase-onboarding`** — understand an unfamiliar codebase fast (READ-ONLY)

package/kb/reference/architecture-overview.md

@@ -3,9 +3,9 @@ title: "AI Toolkit - Architecture Overview"
 category: reference
 service: ai-toolkit
 tags: [architecture, overview, design, structure]
-version: "1.3.10"
+version: "1.3.15"
 created: "2026-03-23"
-last_updated: "2026-04-07"
+last_updated: "2026-04-08"
 description: "Architecture of ai-toolkit: directory layout, global install model, skill tiers, and integration with projects."
 ---
 
@@ -166,7 +166,7 @@ Three tiers determine how to approach a task:
 | Type | Field | Invocation | Count |
 |------|-------|-----------|-------|
 | Task | `disable-model-invocation: true` | User via `/skill` only | 28 |
-| Hybrid | (neither) | User via `/skill` + agent knowledge | 30 |
+| Hybrid | (neither) | User via `/skill` + agent knowledge | 31 |
 | Knowledge | `user-invocable: false` | Claude auto-loads | 32 |
 
 ## Multi-Agent Execution
@@ -178,6 +178,23 @@ Skills that spawn real parallel agents use:
 
 `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` must be set for Agent Teams (tmux-based) support.
 
+## Quality Guardrails
+
+### Anti-Rationalization Tables
+15 core skills include `## Common Rationalizations` tables — domain-specific excuses with rebuttals that prevent agent drift. Skills: `/review`, `/debug`, `/refactor`, `/tdd`, `/plan`, `/docs`, `/analyze`, `security-patterns`, `testing-patterns`, `api-patterns`, `ci-cd-patterns`, `clean-code`, `performance-profiling`, `git-mastery`, `database-patterns`.
+
+### Confidence Scoring & LLM-as-Judge (`/review`)
+Review findings include per-issue confidence scores (1-10) and severity tiers (critical/major/minor/nit). A self-evaluation pass after review checks for anchoring bias, assumption vs verification, and calibrates confidence.
+
+### Agent Verification Checklists
+10 agents have `## Verification Checklist` — domain-specific exit criteria: `code-reviewer`, `test-engineer`, `security-auditor`, `debugger`, `backend-specialist`, `frontend-specialist`, `database-architect`, `performance-optimizer`, `devops-implementer`, `documenter`.
+
+### Skill Reference Routing
+7 core skills include `## Related Skills` suggesting follow-up skills: `/review`, `/debug`, `/plan`, `/refactor`, `/tdd`, `/docs`, `/analyze`.
+
+### Intent Capture Interview (`/onboard`)
+Step 0 interview — 5 questions to capture undocumented project intent before setup.
+
 ## Component Relationships
 
 ```

package/kb/reference/skills-catalog.md

@@ -3,9 +3,9 @@ title: "AI Toolkit - Skills Catalog"
 category: reference
 service: ai-toolkit
 tags: [skills, domain-knowledge, catalog, task-skills, hybrid-skills]
-version: "1.3.10"
+version: "1.3.15"
 created: "2026-03-23"
-last_updated: "2026-04-07"
+last_updated: "2026-04-08"
 description: "Complete skills catalog with task, hybrid, and knowledge skills. Includes effort levels, skill-scoped hooks, executable scripts, security auditor, and persona presets."
 ---
 
@@ -56,7 +56,7 @@ Task skills execute a specific action. Invoked via slash commands. `disable-mode
 | **prd-to-issues** | `/prd-to-issues` | medium | Break PRD into GitHub issues with vertical slices and HITL/AFK tagging |
 | **skill-audit** | `/skill-audit` | medium | Scan skills and agents for security risks: dangerous patterns, secrets, excessive permissions |
 
-## Hybrid Skills (30)
+## Hybrid Skills (31)
 
 Hybrid skills combine slash-command invocation with domain knowledge that agents reference.
 
@@ -68,6 +68,7 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 | **plan** | `/plan` | high | Create structured plan with task breakdown and agent assignments |
 | **refactor** | `/refactor` | high | Plan and execute code refactoring with safety checks (Tier 1 — single agent) |
 | **analyze** | `/analyze` | medium | Analyze code quality, complexity, and patterns |
+| **cve-scan** | `/cve-scan` | medium | Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, ruby, dart) |
 | **docs** | `/docs` | high | Generate/update docs: README, API docs, architecture notes, changelogs (Tier 1 — single agent) |
 | **search** | `/search` | medium | Search knowledge base (MCP tools with local fallback) |
 | **explain** | `/explain` | medium | Explain architecture of a file/module using Mermaid diagrams |
@@ -170,6 +171,62 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 |-------|-----------|--------|
 | **hive-mind** | `skills/hive-mind/` | Multi-agent aggregation, consensus, swarm patterns |
 
+## Quality Guardrails
+
+### Anti-Rationalization Tables
+
+15 core skills include `## Common Rationalizations` — domain-specific tables of excuses and rebuttals that prevent agent drift and shortcut-taking:
+
+| Skill | Example rationalization blocked |
+|-------|---------------------------------|
+| `/review` | "Small change, quick scan is enough" |
+| `/debug` | "It must be a library bug" |
+| `/refactor` | "It works, don't touch it" |
+| `/tdd` | "Too simple to test" |
+| `/plan` | "Planning is wasted time, just start coding" |
+| `/docs` | "The code is self-documenting" |
+| `/analyze` | "The linter is green, the code is fine" |
+| `security-patterns` | "It's an internal API, security doesn't matter" |
+| `testing-patterns` | "Tests slow down development" |
+| `api-patterns` | "We'll version the API later" |
+| `ci-cd-patterns` | "Manual deploys give us more control" |
+| `clean-code` | "It's readable enough" |
+| `performance-profiling` | "It feels slow, let me optimize this function" |
+| `git-mastery` | "One big commit is simpler" |
+| `database-patterns` | "We'll add indexes later when it's slow" |
+
+### Confidence Scoring (`/review`)
+
+The `/review` skill outputs structured findings with:
+- **Severity**: critical / major / minor / nit
+- **Confidence score**: 1-10 per finding with calibration guide
+- **Evidence requirement**: each finding must include file:line + reasoning
+
+### Self-Evaluation — LLM-as-Judge (`/review`)
+
+After completing a review, the agent performs a self-evaluation pass:
+1. Verify vs assume — did I read actual code for each finding?
+2. Check the inverse — if X is a problem, is NOT-X also a problem elsewhere?
+3. Detect anchoring bias — did early findings bias toward similar patterns?
+4. Check unhappy paths — error handling, edge cases, failure modes
+5. Calibrate confidence — overconfident? re-examine weakest finding
+
+### Agent Verification Checklists
+
+10 key agents include `## Verification Checklist` — exit criteria before presenting results:
+`code-reviewer`, `test-engineer`, `security-auditor`, `debugger`, `backend-specialist`, `frontend-specialist`, `database-architect`, `performance-optimizer`, `devops-implementer`, `documenter`.
+
+### Skill Reference Routing
+
+7 core skills include `## Related Skills` sections suggesting logical follow-up skills:
+`/review`, `/debug`, `/plan`, `/refactor`, `/tdd`, `/docs`, `/analyze`.
+
+### Intent Capture Interview (`/onboard`)
+
+Step 0 interview before setup — 5 targeted questions to capture undocumented project intent, customizing the generated `CLAUDE.md`.
+
+---
+
 ## Advanced Features
 
 ### Effort Levels

package/llms-full.txt

@@ -63,6 +63,7 @@
 - **commit**: Create Conventional Commits with pre-commit validation
 - **council**: 4-perspective decision evaluation for architecture choices. Use when user wants multi-angle analysis, needs to decide between alternatives, or mentions 'council', 'evaluate decision', 'pros cons'.
 - **csharp-patterns**: Loaded when user asks about C# or .NET development patterns
+- **cve-scan**: Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, bundler, dart)
 - **database-patterns**: Loaded when user asks about database schema or query optimization
 - **debug**: Debug errors and trace root causes systematically
 - **debugging-tactics**: Loaded when user is debugging an issue or needs root cause analysis
@@ -933,9 +934,9 @@ title: "AI Toolkit - Architecture Overview"
 category: reference
 service: ai-toolkit
 tags: [architecture, overview, design, structure]
-version: "1.3.10"
+version: "1.3.15"
 created: "2026-03-23"
-last_updated: "2026-04-07"
+last_updated: "2026-04-08"
 description: "Architecture of ai-toolkit: directory layout, global install model, skill tiers, and integration with projects."
 ---
 
@@ -1096,7 +1097,7 @@ Three tiers determine how to approach a task:
 | Type | Field | Invocation | Count |
 |------|-------|-----------|-------|
 | Task | `disable-model-invocation: true` | User via `/skill` only | 28 |
-| Hybrid | (neither) | User via `/skill` + agent knowledge | 30 |
+| Hybrid | (neither) | User via `/skill` + agent knowledge | 31 |
 | Knowledge | `user-invocable: false` | Claude auto-loads | 32 |
 
 ## Multi-Agent Execution
@@ -1108,6 +1109,23 @@ Skills that spawn real parallel agents use:
 
 `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` must be set for Agent Teams (tmux-based) support.
 
+## Quality Guardrails
+
+### Anti-Rationalization Tables
+15 core skills include `## Common Rationalizations` tables — domain-specific excuses with rebuttals that prevent agent drift. Skills: `/review`, `/debug`, `/refactor`, `/tdd`, `/plan`, `/docs`, `/analyze`, `security-patterns`, `testing-patterns`, `api-patterns`, `ci-cd-patterns`, `clean-code`, `performance-profiling`, `git-mastery`, `database-patterns`.
+
+### Confidence Scoring & LLM-as-Judge (`/review`)
+Review findings include per-issue confidence scores (1-10) and severity tiers (critical/major/minor/nit). A self-evaluation pass after review checks for anchoring bias, assumption vs verification, and calibrates confidence.
+
+### Agent Verification Checklists
+10 agents have `## Verification Checklist` — domain-specific exit criteria: `code-reviewer`, `test-engineer`, `security-auditor`, `debugger`, `backend-specialist`, `frontend-specialist`, `database-architect`, `performance-optimizer`, `devops-implementer`, `documenter`.
+
+### Skill Reference Routing
+7 core skills include `## Related Skills` suggesting follow-up skills: `/review`, `/debug`, `/plan`, `/refactor`, `/tdd`, `/docs`, `/analyze`.
+
+### Intent Capture Interview (`/onboard`)
+Step 0 interview — 5 questions to capture undocumented project intent before setup.
+
 ## Component Relationships
 
 ```
@@ -4094,9 +4112,9 @@ title: "AI Toolkit - Skills Catalog"
 category: reference
 service: ai-toolkit
 tags: [skills, domain-knowledge, catalog, task-skills, hybrid-skills]
-version: "1.3.10"
+version: "1.3.15"
 created: "2026-03-23"
-last_updated: "2026-04-07"
+last_updated: "2026-04-08"
 description: "Complete skills catalog with task, hybrid, and knowledge skills. Includes effort levels, skill-scoped hooks, executable scripts, security auditor, and persona presets."
 ---
 
@@ -4147,7 +4165,7 @@ Task skills execute a specific action. Invoked via slash commands. `disable-mode
 | **prd-to-issues** | `/prd-to-issues` | medium | Break PRD into GitHub issues with vertical slices and HITL/AFK tagging |
 | **skill-audit** | `/skill-audit` | medium | Scan skills and agents for security risks: dangerous patterns, secrets, excessive permissions |
 
-## Hybrid Skills (30)
+## Hybrid Skills (31)
 
 Hybrid skills combine slash-command invocation with domain knowledge that agents reference.
 
@@ -4159,6 +4177,7 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 | **plan** | `/plan` | high | Create structured plan with task breakdown and agent assignments |
 | **refactor** | `/refactor` | high | Plan and execute code refactoring with safety checks (Tier 1 — single agent) |
 | **analyze** | `/analyze` | medium | Analyze code quality, complexity, and patterns |
+| **cve-scan** | `/cve-scan` | medium | Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, ruby, dart) |
 | **docs** | `/docs` | high | Generate/update docs: README, API docs, architecture notes, changelogs (Tier 1 — single agent) |
 | **search** | `/search` | medium | Search knowledge base (MCP tools with local fallback) |
 | **explain** | `/explain` | medium | Explain architecture of a file/module using Mermaid diagrams |
@@ -4261,6 +4280,62 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 |-------|-----------|--------|
 | **hive-mind** | `skills/hive-mind/` | Multi-agent aggregation, consensus, swarm patterns |
 
+## Quality Guardrails
+
+### Anti-Rationalization Tables
+
+15 core skills include `## Common Rationalizations` — domain-specific tables of excuses and rebuttals that prevent agent drift and shortcut-taking:
+
+| Skill | Example rationalization blocked |
+|-------|---------------------------------|
+| `/review` | "Small change, quick scan is enough" |
+| `/debug` | "It must be a library bug" |
+| `/refactor` | "It works, don't touch it" |
+| `/tdd` | "Too simple to test" |
+| `/plan` | "Planning is wasted time, just start coding" |
+| `/docs` | "The code is self-documenting" |
+| `/analyze` | "The linter is green, the code is fine" |
+| `security-patterns` | "It's an internal API, security doesn't matter" |
+| `testing-patterns` | "Tests slow down development" |
+| `api-patterns` | "We'll version the API later" |
+| `ci-cd-patterns` | "Manual deploys give us more control" |
+| `clean-code` | "It's readable enough" |
+| `performance-profiling` | "It feels slow, let me optimize this function" |
+| `git-mastery` | "One big commit is simpler" |
+| `database-patterns` | "We'll add indexes later when it's slow" |
+
+### Confidence Scoring (`/review`)
+
+The `/review` skill outputs structured findings with:
+- **Severity**: critical / major / minor / nit
+- **Confidence score**: 1-10 per finding with calibration guide
+- **Evidence requirement**: each finding must include file:line + reasoning
+
+### Self-Evaluation — LLM-as-Judge (`/review`)
+
+After completing a review, the agent performs a self-evaluation pass:
+1. Verify vs assume — did I read actual code for each finding?
+2. Check the inverse — if X is a problem, is NOT-X also a problem elsewhere?
+3. Detect anchoring bias — did early findings bias toward similar patterns?
+4. Check unhappy paths — error handling, edge cases, failure modes
+5. Calibrate confidence — overconfident? re-examine weakest finding
+
+### Agent Verification Checklists
+
+10 key agents include `## Verification Checklist` — exit criteria before presenting results:
+`code-reviewer`, `test-engineer`, `security-auditor`, `debugger`, `backend-specialist`, `frontend-specialist`, `database-architect`, `performance-optimizer`, `devops-implementer`, `documenter`.
+
+### Skill Reference Routing
+
+7 core skills include `## Related Skills` sections suggesting logical follow-up skills:
+`/review`, `/debug`, `/plan`, `/refactor`, `/tdd`, `/docs`, `/analyze`.
+
+### Intent Capture Interview (`/onboard`)
+
+Step 0 interview before setup — 5 targeted questions to capture undocumented project intent, customizing the generated `CLAUDE.md`.
+
+---
+
 ## Advanced Features
 
 ### Effort Levels

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.3.12",
+  "version": "1.3.15",
   "components": {
     "agents": {
       "description": "44 specialized agents (orchestrator, backend, frontend, security, devops, etc.)",
@@ -9,7 +9,7 @@
       "tags": ["core", "agents"]
     },
     "skills": {
-      "description": "90 skills (28 task + 30 hybrid + 32 knowledge)",
+      "description": "91 skills (28 task + 31 hybrid + 32 knowledge)",
       "path": "app/skills",
       "target": ".claude/skills",
       "type": "symlink",
@@ -90,7 +90,7 @@
       "default": true
     },
     "skills": {
-      "description": "90 skills (task, hybrid, knowledge)",
+      "description": "91 skills (task, hybrid, knowledge)",
       "default": true
     },
     "rules-common": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "1.3.13",
-  "description": "Professional-grade AI coding toolkit: 90 skills, 44 agents, multi-platform support (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment), machine-enforced safety constitution, persona presets, skill security auditor, expanded lifecycle hooks, 11 plugin packs, and benchmark tooling.",
+  "version": "1.3.15",
+  "description": "Professional-grade AI coding toolkit: 91 skills, 44 agents, multi-platform support (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment), machine-enforced safety constitution, persona presets, skill security auditor, expanded lifecycle hooks, 11 plugin packs, and benchmark tooling.",
   "keywords": [
     "claude",
     "claude-code",

package/scripts/check_deps.py

@@ -96,6 +96,58 @@ OPTIONAL = [
         },
         "reason": "Running toolkit test suite (npm test)",
     },
+    {
+        "name": "pip-audit",
+        "check": "pip-audit",
+        "packages": {
+            "brew": "pip-audit  # or: pip install pip-audit",
+            "apt": "pip-audit  # pip install pip-audit",
+            "dnf": "pip-audit  # pip install pip-audit",
+            "pacman": "pip-audit  # pip install pip-audit",
+            "apk": "pip-audit  # pip install pip-audit",
+            "zypper": "pip-audit  # pip install pip-audit",
+        },
+        "reason": "CVE scanner (/cve-scan) for Python dependencies",
+    },
+    {
+        "name": "cargo-audit",
+        "check": "cargo-audit",
+        "packages": {
+            "brew": "cargo-audit  # or: cargo install cargo-audit",
+            "apt": "cargo-audit  # cargo install cargo-audit",
+            "dnf": "cargo-audit  # cargo install cargo-audit",
+            "pacman": "cargo-audit  # cargo install cargo-audit",
+            "apk": "cargo-audit  # cargo install cargo-audit",
+            "zypper": "cargo-audit  # cargo install cargo-audit",
+        },
+        "reason": "CVE scanner (/cve-scan) for Rust dependencies",
+    },
+    {
+        "name": "govulncheck",
+        "check": "govulncheck",
+        "packages": {
+            "brew": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "apt": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "dnf": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "pacman": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "apk": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+            "zypper": "govulncheck  # go install golang.org/x/vuln/cmd/govulncheck@latest",
+        },
+        "reason": "CVE scanner (/cve-scan) for Go dependencies",
+    },
+    {
+        "name": "bundle-audit",
+        "check": "bundle-audit",
+        "packages": {
+            "brew": "bundler-audit  # or: gem install bundler-audit",
+            "apt": "bundler-audit  # gem install bundler-audit",
+            "dnf": "bundler-audit  # gem install bundler-audit",
+            "pacman": "bundler-audit  # gem install bundler-audit",
+            "apk": "bundler-audit  # gem install bundler-audit",
+            "zypper": "bundler-audit  # gem install bundler-audit",
+        },
+        "reason": "CVE scanner (/cve-scan) for Ruby dependencies",
+    },
 ]