agentbrief 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (137) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +141 -0
  3. package/briefs/code-reviewer/brief.yaml +8 -0
  4. package/briefs/code-reviewer/knowledge/review-standards.md +32 -0
  5. package/briefs/code-reviewer/personality.md +19 -0
  6. package/briefs/code-reviewer/skills/architecture-review/SKILL.md +76 -0
  7. package/briefs/code-reviewer/skills/review-process/SKILL.md +41 -0
  8. package/briefs/code-reviewer/skills/verification/SKILL.md +47 -0
  9. package/briefs/data-analyst/brief.yaml +8 -0
  10. package/briefs/data-analyst/knowledge/metrics-reference.md +43 -0
  11. package/briefs/data-analyst/personality.md +23 -0
  12. package/briefs/data-analyst/skills/metrics-framework/SKILL.md +90 -0
  13. package/briefs/data-analyst/skills/sql-query-builder/SKILL.md +115 -0
  14. package/briefs/devops-sre/brief.yaml +12 -0
  15. package/briefs/devops-sre/knowledge/runbook.md +69 -0
  16. package/briefs/devops-sre/personality.md +18 -0
  17. package/briefs/devops-sre/skills/ci-cd-github-actions/SKILL.md +114 -0
  18. package/briefs/devops-sre/skills/monitoring-observability/SKILL.md +394 -0
  19. package/briefs/devops-sre/skills/systematic-debugging/SKILL.md +46 -0
  20. package/briefs/devops-sre/skills/verification/SKILL.md +47 -0
  21. package/briefs/frontend-design/brief.yaml +8 -0
  22. package/briefs/frontend-design/knowledge/design-principles.md +43 -0
  23. package/briefs/frontend-design/personality.md +19 -0
  24. package/briefs/frontend-design/skills/design-review-checklist/SKILL.md +151 -0
  25. package/briefs/frontend-design/skills/web-design-guidelines/SKILL.md +39 -0
  26. package/briefs/fullstack-dev/brief.yaml +9 -0
  27. package/briefs/fullstack-dev/personality.md +18 -0
  28. package/briefs/growth-engineer/brief.yaml +8 -0
  29. package/briefs/growth-engineer/knowledge/growth-framework.md +83 -0
  30. package/briefs/growth-engineer/personality.md +19 -0
  31. package/briefs/growth-engineer/skills/analytics-setup/SKILL.md +109 -0
  32. package/briefs/growth-engineer/skills/brainstorming/SKILL.md +55 -0
  33. package/briefs/growth-engineer/skills/content-strategy/SKILL.md +93 -0
  34. package/briefs/growth-engineer/skills/seo-audit/SKILL.md +412 -0
  35. package/briefs/growth-engineer/skills/seo-audit/evals/evals.json +136 -0
  36. package/briefs/growth-engineer/skills/seo-audit/references/ai-writing-detection.md +200 -0
  37. package/briefs/nextjs-fullstack/brief.yaml +12 -0
  38. package/briefs/nextjs-fullstack/knowledge/conventions.md +57 -0
  39. package/briefs/nextjs-fullstack/personality.md +19 -0
  40. package/briefs/nextjs-fullstack/skills/next-best-practices/SKILL.md +153 -0
  41. package/briefs/nextjs-fullstack/skills/next-best-practices/async-patterns.md +87 -0
  42. package/briefs/nextjs-fullstack/skills/next-best-practices/bundling.md +180 -0
  43. package/briefs/nextjs-fullstack/skills/next-best-practices/data-patterns.md +297 -0
  44. package/briefs/nextjs-fullstack/skills/next-best-practices/debug-tricks.md +105 -0
  45. package/briefs/nextjs-fullstack/skills/next-best-practices/directives.md +73 -0
  46. package/briefs/nextjs-fullstack/skills/next-best-practices/error-handling.md +227 -0
  47. package/briefs/nextjs-fullstack/skills/next-best-practices/file-conventions.md +140 -0
  48. package/briefs/nextjs-fullstack/skills/next-best-practices/font.md +245 -0
  49. package/briefs/nextjs-fullstack/skills/next-best-practices/functions.md +108 -0
  50. package/briefs/nextjs-fullstack/skills/next-best-practices/hydration-error.md +91 -0
  51. package/briefs/nextjs-fullstack/skills/next-best-practices/image.md +173 -0
  52. package/briefs/nextjs-fullstack/skills/next-best-practices/metadata.md +301 -0
  53. package/briefs/nextjs-fullstack/skills/next-best-practices/parallel-routes.md +287 -0
  54. package/briefs/nextjs-fullstack/skills/next-best-practices/route-handlers.md +146 -0
  55. package/briefs/nextjs-fullstack/skills/next-best-practices/rsc-boundaries.md +159 -0
  56. package/briefs/nextjs-fullstack/skills/next-best-practices/runtime-selection.md +39 -0
  57. package/briefs/nextjs-fullstack/skills/next-best-practices/scripts.md +141 -0
  58. package/briefs/nextjs-fullstack/skills/next-best-practices/self-hosting.md +371 -0
  59. package/briefs/nextjs-fullstack/skills/next-best-practices/suspense-boundaries.md +67 -0
  60. package/briefs/nextjs-fullstack/skills/tdd/SKILL.md +53 -0
  61. package/briefs/product-manager/brief.yaml +8 -0
  62. package/briefs/product-manager/knowledge/pm-toolkit.md +51 -0
  63. package/briefs/product-manager/personality.md +19 -0
  64. package/briefs/product-manager/skills/brainstorming/SKILL.md +55 -0
  65. package/briefs/product-manager/skills/specification/SKILL.md +76 -0
  66. package/briefs/qa-engineer/brief.yaml +11 -0
  67. package/briefs/qa-engineer/knowledge/testing-patterns.md +54 -0
  68. package/briefs/qa-engineer/personality.md +24 -0
  69. package/briefs/qa-engineer/skills/qa-test-and-fix/SKILL.md +101 -0
  70. package/briefs/qa-engineer/skills/regression-testing/SKILL.md +95 -0
  71. package/briefs/security-auditor/brief.yaml +12 -0
  72. package/briefs/security-auditor/knowledge/code-patterns.md +49 -0
  73. package/briefs/security-auditor/knowledge/owasp-cheatsheet.md +75 -0
  74. package/briefs/security-auditor/personality.md +23 -0
  75. package/briefs/security-auditor/skills/security-review/SKILL.md +29 -0
  76. package/briefs/security-auditor/skills/systematic-debugging/SKILL.md +46 -0
  77. package/briefs/security-auditor/skills/verification/SKILL.md +47 -0
  78. package/briefs/startup-builder/brief.yaml +8 -0
  79. package/briefs/startup-builder/knowledge/startup-phases.md +64 -0
  80. package/briefs/startup-builder/personality.md +18 -0
  81. package/briefs/startup-builder/skills/ceo-review/SKILL.md +95 -0
  82. package/briefs/startup-builder/skills/launch-strategy/SKILL.md +353 -0
  83. package/briefs/startup-builder/skills/launch-strategy/evals/evals.json +91 -0
  84. package/briefs/startup-builder/skills/tdd/SKILL.md +53 -0
  85. package/briefs/startup-builder/skills/verification/SKILL.md +47 -0
  86. package/briefs/startup-kit/brief.yaml +9 -0
  87. package/briefs/startup-kit/personality.md +18 -0
  88. package/briefs/tech-writer/brief.yaml +8 -0
  89. package/briefs/tech-writer/knowledge/style-guide.md +54 -0
  90. package/briefs/tech-writer/personality.md +19 -0
  91. package/briefs/tech-writer/skills/api-documentation/SKILL.md +390 -0
  92. package/briefs/tech-writer/skills/plan-and-execute/SKILL.md +54 -0
  93. package/briefs/tech-writer/skills/release-notes/SKILL.md +77 -0
  94. package/briefs/typescript-strict/brief.yaml +8 -0
  95. package/briefs/typescript-strict/knowledge/type-patterns.md +117 -0
  96. package/briefs/typescript-strict/personality.md +23 -0
  97. package/briefs/typescript-strict/skills/typescript-advanced-types/SKILL.md +717 -0
  98. package/dist/brief.d.ts +13 -0
  99. package/dist/brief.d.ts.map +1 -0
  100. package/dist/brief.js +90 -0
  101. package/dist/brief.js.map +1 -0
  102. package/dist/cli.d.ts +3 -0
  103. package/dist/cli.d.ts.map +1 -0
  104. package/dist/cli.js +180 -0
  105. package/dist/cli.js.map +1 -0
  106. package/dist/compiler.d.ts +25 -0
  107. package/dist/compiler.d.ts.map +1 -0
  108. package/dist/compiler.js +253 -0
  109. package/dist/compiler.js.map +1 -0
  110. package/dist/index.d.ts +54 -0
  111. package/dist/index.d.ts.map +1 -0
  112. package/dist/index.js +255 -0
  113. package/dist/index.js.map +1 -0
  114. package/dist/injector.d.ts +17 -0
  115. package/dist/injector.d.ts.map +1 -0
  116. package/dist/injector.js +76 -0
  117. package/dist/injector.js.map +1 -0
  118. package/dist/lock.d.ts +8 -0
  119. package/dist/lock.d.ts.map +1 -0
  120. package/dist/lock.js +50 -0
  121. package/dist/lock.js.map +1 -0
  122. package/dist/resolver.d.ts +24 -0
  123. package/dist/resolver.d.ts.map +1 -0
  124. package/dist/resolver.js +135 -0
  125. package/dist/resolver.js.map +1 -0
  126. package/dist/types.d.ts +61 -0
  127. package/dist/types.d.ts.map +1 -0
  128. package/dist/types.js +15 -0
  129. package/dist/types.js.map +1 -0
  130. package/package.json +64 -0
  131. package/registry.yaml +91 -0
  132. package/templates/default/brief.yaml +7 -0
  133. package/templates/default/knowledge/.gitkeep +0 -0
  134. package/templates/default/personality.md +12 -0
  135. package/templates/security/brief.yaml +6 -0
  136. package/templates/security/knowledge/.gitkeep +0 -0
  137. package/templates/security/personality.md +20 -0
@@ -0,0 +1,61 @@
1
+ export interface BriefSpec {
2
+ name: string;
3
+ version: string;
4
+ description?: string;
5
+ /** Relative path to personality markdown file. Default: "personality.md" */
6
+ personality?: string;
7
+ /** Scale / operational constraints */
8
+ scale?: ScaleConfig;
9
+ /** Relative paths to knowledge files or directories */
10
+ knowledge?: string[];
11
+ /** Relative paths to skill directories */
12
+ skills?: string[];
13
+ /** Extend other briefs — inherit their knowledge and skills */
14
+ extends?: string[];
15
+ }
16
+ export interface ScaleConfig {
17
+ concurrency?: number;
18
+ timeout?: number;
19
+ engine?: string;
20
+ model?: string;
21
+ }
22
+ export interface LockFile {
23
+ version: 1;
24
+ briefs: LockEntry[];
25
+ }
26
+ export interface LockEntry {
27
+ name: string;
28
+ source: string;
29
+ version: string;
30
+ ref?: string;
31
+ sha?: string;
32
+ applied_at: string;
33
+ }
34
+ export interface BriefSource {
35
+ type: "local" | "github" | "registry";
36
+ /** Absolute local path to the brief directory */
37
+ path: string;
38
+ /** Original source string as provided by user */
39
+ original: string;
40
+ ref?: string;
41
+ sha?: string;
42
+ }
43
+ export interface SkillMeta {
44
+ name: string;
45
+ description?: string;
46
+ /** Relative path to the skill file within the brief */
47
+ path: string;
48
+ }
49
+ export type TrustLevel = "official" | "verified" | "community";
50
+ export interface RegistryEntry {
51
+ source: string;
52
+ description?: string;
53
+ trust: TrustLevel;
54
+ }
55
+ export type Registry = Record<string, RegistryEntry>;
56
+ export type EngineTarget = "claude-code" | "cursor" | "opencode" | "codex";
57
+ /** Maps engine name → instruction file path (relative to project root) */
58
+ export declare const ENGINE_FILES: Record<EngineTarget, string>;
59
+ /** Reverse mapping: instruction file → engine targets that use it */
60
+ export declare const FILE_ENGINES: Record<string, EngineTarget[]>;
61
+ //# sourceMappingURL=types.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAID,MAAM,WAAW,QAAQ;IACxB,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,SAAS,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;IACtC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAID,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACb;AAID,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAIrD,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;AAE3E,0EAA0E;AAC1E,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAKrD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAIvD,CAAC"}
package/dist/types.js ADDED
@@ -0,0 +1,15 @@
1
+ // ── Brief spec (brief.yaml) ─────────────────────────────
2
+ /** Maps engine name → instruction file path (relative to project root) */
3
+ export const ENGINE_FILES = {
4
+ "claude-code": "CLAUDE.md",
5
+ cursor: ".cursorrules",
6
+ opencode: "AGENTS.md",
7
+ codex: "AGENTS.md",
8
+ };
9
+ /** Reverse mapping: instruction file → engine targets that use it */
10
+ export const FILE_ENGINES = {
11
+ "CLAUDE.md": ["claude-code"],
12
+ ".cursorrules": ["cursor"],
13
+ "AGENTS.md": ["opencode", "codex"],
14
+ };
15
+ //# sourceMappingURL=types.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,2DAA2D;AA8E3D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAiC;IACzD,aAAa,EAAE,WAAW;IAC1B,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,WAAW;IACrB,KAAK,EAAE,WAAW;CAClB,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,YAAY,GAAmC;IAC3D,WAAW,EAAE,CAAC,aAAa,CAAC;IAC5B,cAAc,EAAE,CAAC,QAAQ,CAAC;IAC1B,WAAW,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;CAClC,CAAC"}
package/package.json ADDED
@@ -0,0 +1,64 @@
1
+ {
2
+ "name": "agentbrief",
3
+ "version": "0.1.0",
4
+ "description": "Pluggable role definitions for AI coding agents",
5
+ "type": "module",
6
+ "main": "./dist/index.js",
7
+ "types": "./dist/index.d.ts",
8
+ "exports": {
9
+ ".": {
10
+ "import": "./dist/index.js",
11
+ "types": "./dist/index.d.ts"
12
+ }
13
+ },
14
+ "bin": {
15
+ "agentbrief": "./dist/cli.js"
16
+ },
17
+ "scripts": {
18
+ "build": "tsc",
19
+ "dev": "tsx src/cli.ts",
20
+ "test": "vitest run",
21
+ "test:watch": "vitest",
22
+ "lint": "biome check src/",
23
+ "lint:fix": "biome check --write src/",
24
+ "format": "biome format --write src/",
25
+ "prepublishOnly": "pnpm run build"
26
+ },
27
+ "dependencies": {
28
+ "commander": "^13.0.0",
29
+ "js-yaml": "^4.1.0"
30
+ },
31
+ "devDependencies": {
32
+ "@biomejs/biome": "^2.4.6",
33
+ "@types/js-yaml": "^4.0.9",
34
+ "@types/node": "^22.0.0",
35
+ "tsx": "^4.0.0",
36
+ "typescript": "^5.7.0",
37
+ "vitest": "^4.0.18"
38
+ },
39
+ "files": [
40
+ "dist",
41
+ "!dist/__tests__",
42
+ "templates",
43
+ "briefs",
44
+ "registry.yaml"
45
+ ],
46
+ "keywords": [
47
+ "ai",
48
+ "agent",
49
+ "role",
50
+ "persona",
51
+ "brief",
52
+ "claude-code",
53
+ "cursor",
54
+ "opencode",
55
+ "codex",
56
+ "coding-agent"
57
+ ],
58
+ "license": "MIT",
59
+ "repository": {
60
+ "type": "git",
61
+ "url": "https://github.com/0xranx/agentbrief"
62
+ },
63
+ "homepage": "https://github.com/0xranx/agentbrief#readme"
64
+ }
package/registry.yaml ADDED
@@ -0,0 +1,91 @@
1
+ # AgentBrief Official Registry
2
+ #
3
+ # Maps short names to GitHub sources.
4
+ # Users can type `agentbrief use <name>` instead of the full GitHub path.
5
+ #
6
+ # Official briefs are bundled in the npm package (briefs/ directory) and
7
+ # resolve locally without network access. The GitHub source below serves
8
+ # as a fallback and canonical URL for reference.
9
+ #
10
+ # Trust levels:
11
+ # official — Maintained by the AgentBrief team
12
+ # verified — Community briefs reviewed and approved via PR
13
+ # community — Listed but not reviewed (shown with warning)
14
+
15
+ # ── Development ──────────────────────────────────────────
16
+
17
+ security-auditor:
18
+ source: github:0xranx/agentbrief/briefs/security-auditor
19
+ description: OWASP/CWE security review specialist
20
+ trust: official
21
+
22
+ code-reviewer:
23
+ source: github:0xranx/agentbrief/briefs/code-reviewer
24
+ description: Rigorous PR review — naming, tests, architecture
25
+ trust: official
26
+
27
+ typescript-strict:
28
+ source: github:0xranx/agentbrief/briefs/typescript-strict
29
+ description: TypeScript type safety guardian — zero any
30
+ trust: official
31
+
32
+ nextjs-fullstack:
33
+ source: github:0xranx/agentbrief/briefs/nextjs-fullstack
34
+ description: Next.js 15 + App Router + React 19 + Tailwind
35
+ trust: official
36
+
37
+ frontend-design:
38
+ source: github:0xranx/agentbrief/briefs/frontend-design
39
+ description: React + Tailwind + shadcn/ui design engineering
40
+ trust: official
41
+
42
+ # ── Operations ───────────────────────────────────────────
43
+
44
+ devops-sre:
45
+ source: github:0xranx/agentbrief/briefs/devops-sre
46
+ description: Infrastructure monitoring, incident response, IaC
47
+ trust: official
48
+
49
+ tech-writer:
50
+ source: github:0xranx/agentbrief/briefs/tech-writer
51
+ description: Technical documentation with style guide adherence
52
+ trust: official
53
+
54
+ # ── Business ─────────────────────────────────────────────
55
+
56
+ growth-engineer:
57
+ source: github:0xranx/agentbrief/briefs/growth-engineer
58
+ description: CRO, SEO, analytics, growth engineering
59
+ trust: official
60
+
61
+ product-manager:
62
+ source: github:0xranx/agentbrief/briefs/product-manager
63
+ description: PRD generation, user stories, prioritization
64
+ trust: official
65
+
66
+ startup-builder:
67
+ source: github:0xranx/agentbrief/briefs/startup-builder
68
+ description: Idea validation → MVP → launch workflow
69
+ trust: official
70
+
71
+ qa-engineer:
72
+ source: github:0xranx/agentbrief/briefs/qa-engineer
73
+ description: Automated QA — find bugs, write tests, fix with atomic commits
74
+ trust: official
75
+
76
+ data-analyst:
77
+ source: github:0xranx/agentbrief/briefs/data-analyst
78
+ description: Business intelligence — metrics, SQL, dashboards, data storytelling
79
+ trust: official
80
+
81
+ # ── Combo Packs ──────────────────────────────────────────
82
+
83
+ fullstack-dev:
84
+ source: github:0xranx/agentbrief/briefs/fullstack-dev
85
+ description: Full-stack TypeScript developer — extends typescript-strict + nextjs + design + review
86
+ trust: official
87
+
88
+ startup-kit:
89
+ source: github:0xranx/agentbrief/briefs/startup-kit
90
+ description: Startup builder kit — extends startup + product + growth + security
91
+ trust: official
@@ -0,0 +1,7 @@
1
+ name: my-agent
2
+ version: "0.1.0"
3
+ description: My agent brief
4
+ personality: personality.md
5
+ knowledge:
6
+ - knowledge/
7
+ skills: []
File without changes
@@ -0,0 +1,12 @@
1
+ ## Role
2
+
3
+ Describe the role and responsibilities of this agent.
4
+
5
+ ## Tone & Style
6
+
7
+ Describe the communication style, tone, and language preferences.
8
+
9
+ ## Constraints
10
+
11
+ - List behavioral constraints here
12
+ - Things the agent must not do
@@ -0,0 +1,6 @@
1
+ name: security-auditor
2
+ version: "0.1.0"
3
+ description: Security review specialist
4
+ personality: personality.md
5
+ knowledge:
6
+ - knowledge/
File without changes
@@ -0,0 +1,20 @@
1
+ ## Role
2
+
3
+ You are a security auditor. Review code changes for vulnerabilities using OWASP Top 10 and CWE classification.
4
+
5
+ ## Review Checklist
6
+
7
+ - Injection flaws (SQL, NoSQL, OS command)
8
+ - Broken authentication and session management
9
+ - Sensitive data exposure
10
+ - Broken access control
11
+ - Security misconfiguration
12
+ - Cross-Site Scripting (XSS)
13
+ - Hardcoded secrets (API keys, passwords, tokens)
14
+
15
+ ## Constraints
16
+
17
+ - Never approve code with known injection vectors
18
+ - Always cite CWE identifiers in findings
19
+ - Flag hardcoded credentials as Critical severity
20
+ - When uncertain about severity, escalate