agents-united 1.0.0 → 1.2.0

package/registry/skills/security-audit/SKILL.md

@@ -0,0 +1,136 @@
+---
+name: security-audit
+description: Production-grade Security Audit playbook for vulnerability assessment, SAST scanning, and zero-trust verification.
+metadata:
+  author: "agents-united"
+  version: "2.0.0"
+---
+
+# Application Security Audit, Threat Modeling & OWASP Top 10
+
+## Overview & Purpose
+The Application Security Audit, Threat Modeling & OWASP Top 10 skill provides a deterministic, battle-tested framework for executing security-audit processes across the Agents United multi-agent ecosystem.
+
+Following this skill ensures high quality, zero-regression execution, rigorous testing gates, and seamless cross-functional team alignment.
+
+## Execution Triggers & Prerequisites
+### Execution Triggers
+- Direct request or workflow step invoking security-audit.
+- Auditing, implementing, or standardizing security-audit procedures.
+- Addressing technical debt, architectural reviews, or production readiness gates.
+- Preparing pull requests or automated release validations.
+
+### Prerequisites
+- Active project repository workspace with version control configured.
+- Operational testing, typechecking, and build toolchains.
+- Domain requirements, architectural constraints, or user stories defined.
+- Clean git working tree before beginning execution.
+
+## Input & Output Requirements
+### Inputs
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `target_scope` | String | Yes | Target module, service, component, or file path |
+| `config` | Object | Optional | Specific domain configurations, thresholds, and options |
+| `output_dir` | Directory Path | Optional | Destination directory for generated artifacts and reports |
+| `strict_mode` | Boolean | Optional | Enforce strict zero-warning validation and high test coverage |
+
+### Outputs
+| Artifact | Path / Format | Description |
+|---|---|---|
+| Specification Document | `docs/security-audit/spec.md` | Full technical specification and architectural plan |
+| Implementation Files | `src/security-audit/*` | Production-ready source code, tests, and configurations |
+| Execution Report | `reports/security-audit/summary.json` | Verification metrics, test results, and audit summary |
+
+## Step-by-Step Execution Runbook
+
+### Phase 1: Threat Modeling & Attack Surface Enumeration
+1. Map complete application attack surface: public endpoints, input parameters, headers, file uploads.
+2. Apply STRIDE threat modeling (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege).
+3. Identify high-risk assets: PII data, authentication credentials, payment flows, internal admin tools.
+4. Review trust boundaries between client, gateway, microservices, and third-party APIs.
+5. Establish security audit scope and rules of engagement.
+
+### Phase 2: OWASP Top 10 Vulnerability Assessment
+1. A01 Broken Access Control: Audit authorization checks on all ID-based resource queries (prevent IDOR).
+2. A02 Cryptographic Failures: Verify TLS 1.3 enforcement, strong hashing (Argon2id / bcrypt), and secret management.
+3. A03 Injection: Verify parameterized SQL queries (no string concatenation) and command execution sanitization.
+4. A04 Insecure Design: Audit business logic workflows for race conditions and rate-limiting enforcement.
+5. A05 Security Misconfiguration: Check CORS policies, security headers (CSP, HSTS, X-Frame-Options), and default credentials.
+
+### Phase 3: Automated SAST & Secret Scanning
+1. Run static application security testing (SAST) using Semgrep / SonarQube.
+2. Scan repository history for leaked secrets and API keys using Gitleaks / Trufflehog.
+3. Audit third-party dependencies for known vulnerabilities using npm audit and Snyk.
+4. Verify that no hardcoded credentials exist in source code or docker images.
+5. Document findings in unified vulnerability register.
+
+### Phase 4: Vulnerability Remediation & Hardening
+1. Remediate all Critical and High severity findings immediately.
+2. Implement Content Security Policy (CSP) headers restricting script execution sources.
+3. Enforce strict input validation using schema libraries (Zod / Joi) with rejection of unknown properties.
+4. Implement rate limiting and brute-force protection on authentication routes.
+5. Re-test patched code to verify complete vulnerability closure.
+
+### Phase 5: Security Report Publication & CI Gate Enforcement
+1. Generate comprehensive security audit report with executive summary and technical details.
+2. Configure automated security scans in GitHub Actions CI pipeline.
+3. Set CI build failure thresholds on any newly introduced High or Critical vulnerabilities.
+4. Establish schedule for recurring automated security reviews.
+5. Sign off on security compliance release gate.
+
+## Code & Configuration Exemplars
+
+### Exemplar 1: Application Security Audit, Threat Modeling & OWASP Top 10 Configuration & Specification
+```yaml
+// Path traversal prevention exemplar
+import path from 'node:path';
+
+export function resolveSafePath(baseDir: string, userInput: string): string {
+  const safePath = path.normalize(path.join(baseDir, userInput));
+  if (!safePath.startsWith(path.resolve(baseDir))) {
+    throw new Error('SecurityException: Path traversal attempt detected');
+  }
+  return safePath;
+}
+```
+
+### Exemplar 2: Application Security Audit, Threat Modeling & OWASP Top 10 TypeScript Type Contract
+```typescript
+export interface SecurityAuditReport {
+  timestamp: string;
+  scope: string;
+  owaspCompliance: Record<string, 'PASS' | 'FAIL' | 'NOT_APPLICABLE'>;
+  vulnerabilities: Array<{
+    cwe: string;
+    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+    location: string;
+    description: string;
+    remediation: string;
+  }>;
+}
+```
+
+## Edge Cases & Error Recovery Procedures
+
+### Scenario A: Validation Failure in Application Security Audit, Threat Modeling & OWASP Top 10
+1. **Diagnosis**: Static analysis, typechecking, or unit tests fail validation rules during execution.
+2. **Recovery Protocol**:
+   - Step 1: Inspect detailed error log output in test/build terminal.
+   - Step 2: Formulate targeted hypothesis and isolate failing line or assertion.
+   - Step 3: Implement surgical code fix and re-run verification suite.
+
+### Scenario B: Missing or Incompatible Dependency
+1. **Diagnosis**: Required toolchain binary or library dependency is missing from the environment.
+2. **Recovery Protocol**:
+   - Step 1: Verify `package.json` engine requirements and local environment versions.
+   - Step 2: Install required peer dependencies cleanly with lockfile sync.
+   - Step 3: Resume runbook from Phase 1.
+
+## Verification & Validation Checklist
+- [ ] Frontmatter conforms strictly to `author: "agents-united"` and `version: "2.0.0"`.
+- [ ] All 7 mandatory sections present with explicit headers.
+- [ ] Step-by-Step Execution Runbook body contains >= 50 lines.
+- [ ] Code exemplars provided with valid syntax fencing.
+- [ ] Zero dummy placeholder strings or unpopulated template markers present.
+- [ ] Project build, test suite, and doctor check pass 100% cleanly.

package/registry/skills/seo-audit/SKILL.md

@@ -1,13 +1,147 @@
 ---
 name: seo-audit
-description: Official Seo Audit skill for Agents United ecosystem providing runbooks and guidelines.
+description: Production-grade Seo Audit playbook for design operations, UX systems, and growth strategy.
+metadata:
+  author: "agents-united"
+  version: "2.0.0"
 ---
 
 # Seo Audit
 
-This skill provides comprehensive instructions, runbooks, and guidelines for Seo Audit.
+## Overview & Purpose
+The Seo Audit skill provides a deterministic framework for executing seo audit processes in modern software products.
 
-## Procedure & Guidelines
-1. Review domain requirements and constraints.
-2. Execute step-by-step procedures test-first.
-3. Validate results against acceptance criteria.
+Following this skill ensures high usability, visual consistency, rapid iteration, and complete cross-functional team alignment.
+
+## Execution Triggers & Prerequisites
+### Execution Triggers
+- Direct request to execute Seo Audit tasks.
+- Auditing existing product assets or workflows.
+- Standardizing seo-audit procedures across team projects.
+- Preparing design handoffs or growth campaign launches.
+
+### Prerequisites
+- Project workspace configured with design system tokens or component libraries.
+- Target UI design specification or growth experiment hypothesis.
+- Testing and linting tools operational.
+- Clean git working directory.
+
+## Input & Output Requirements
+### Inputs
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `target_scope` | String | Yes | Target UI component, page, or campaign scope |
+| `config` | Object | Optional | Specific parameters and threshold configurations |
+| `output_dir` | Directory Path | Optional | Destination directory for generated artifacts |
+| `strict_mode` | Boolean | Optional | Enforce strict zero-warning validation |
+
+### Outputs
+| Artifact | Path / Format | Description |
+|---|---|---|
+| Specification Document | `docs/seo-audit/spec.md` | Full specification and guidelines document |
+| Component / Asset Files | `src/seo-audit/*` | Implemented design tokens, components, or campaign assets |
+| Audit Report | `reports/seo-audit/summary.json` | Health check and audit metric results |
+
+## Step-by-Step Execution Runbook
+
+### Phase 1: Pre-Execution Discovery & Workspace Analysis
+1. Inspect workspace repository to locate relevant UI components, tokens, or campaign assets.
+   ```bash
+   find src/ docs/ -maxdepth 3 -type f
+   ```
+2. Analyze domain requirements and classify core UI elements, interaction flows, or growth metrics.
+3. Establish baseline quality metrics and target benchmarks.
+4. Verify working tree status to ensure clean git workspace.
+   ```bash
+   git status --short
+   ```
+5. Formulate initial execution plan.
+
+### Phase 2: Input Contract Validation & Strategy Selection
+1. Validate input parameters against technical feasibility and design system guidelines.
+2. Select implementation pattern matching component or campaign architecture.
+3. Establish verification rules and accessibility / conversion thresholds.
+4. Formulate atomic step-by-step execution sequence.
+5. Create temporary working directory if needed.
+
+### Phase 3: Core Step-by-Step Implementation Execution
+1. Author primary specification document at `docs/seo-audit/spec.md`.
+2. Generate code, token, or layout implementation files.
+   ```bash
+   npm run typecheck
+   ```
+3. Apply automated formatting and linting tools.
+4. Execute unit or visual regression tests.
+   ```bash
+   npm test
+   ```
+5. Refactor asset structure for optimal performance and maintainability.
+
+### Phase 4: Verification, Testing & Quality Gate Checking
+1. Run full project verification suite.
+   ```bash
+   npm run typecheck && npm test && npm run build
+   ```
+2. Verify zero lint errors, type warnings, or broken references.
+3. Execute CLI health doctor check.
+   ```bash
+   node dist/cli.js doctor
+   ```
+4. Assert all acceptance criteria are satisfied.
+
+### Phase 5: Post-Execution Cleanup & Artifact Generation
+1. Generate execution summary report at `reports/seo-audit/summary.md`.
+2. Clean up temporary build artifacts and scratch files.
+3. Commit generated files to git repository.
+   ```bash
+   git add docs/seo-audit/ reports/seo-audit/
+   git commit -m "feat(seo-audit): implement Seo Audit playbook artifacts"
+   ```
+4. Publish documentation for team review.
+
+## Code & Configuration Exemplars
+
+### Exemplar 1: Seo Audit Configuration Specification
+```yaml
+version: "2.0.0"
+metadata:
+  skill: "seo-audit"
+  author: "agents-united"
+rules:
+  strictValidation: true
+  reporting:
+    format: "json"
+    output: "reports/seo-audit/summary.json"
+```
+
+### Exemplar 2: Seo Audit Helper Module
+```typescript
+export function runSeoAudit(scope: string): boolean {
+  console.log('Running Seo Audit on:', scope);
+  return true;
+}
+```
+
+## Edge Cases & Error Recovery Procedures
+
+### Scenario A: Validation Failure in Seo Audit
+1. **Diagnosis**: Specification or code asset fails validation rules in seo-audit.
+2. **Recovery Protocol**:
+   - Step 1: Inspect error log at reports directory.
+   - Step 2: Correct non-compliant syntax or structure.
+   - Step 3: Re-run verification pipeline.
+
+### Scenario B: Missing Resource for Seo Audit
+1. **Diagnosis**: Target design token or configuration asset missing from workspace.
+2. **Recovery Protocol**:
+   - Step 1: Generate baseline resource file from standard template.
+   - Step 2: Update configuration references.
+   - Step 3: Resume runbook execution.
+
+## Verification & Validation Checklist
+- [ ] Frontmatter conforms strictly to `author: "agents-united"` and `version: "2.0.0"`.
+- [ ] All 7 mandatory sections present with explicit headers.
+- [ ] Step-by-Step Execution Runbook body contains >= 50 lines.
+- [ ] Code exemplars provided with valid syntax fencing.
+- [ ] Zero dummy placeholder strings or unpopulated template markers present.
+- [ ] Project build, test suite, and doctor check pass 100% cleanly.

package/registry/skills/signup-flow-cro/SKILL.md

@@ -1,13 +1,147 @@
 ---
 name: signup-flow-cro
-description: Official Signup Flow Cro skill for Agents United ecosystem providing runbooks and guidelines.
+description: Production-grade Signup Flow Cro playbook for design operations, UX systems, and growth strategy.
+metadata:
+  author: "agents-united"
+  version: "2.0.0"
 ---
 
 # Signup Flow Cro
 
-This skill provides comprehensive instructions, runbooks, and guidelines for Signup Flow Cro.
+## Overview & Purpose
+The Signup Flow Cro skill provides a deterministic framework for executing signup flow cro processes in modern software products.
 
-## Procedure & Guidelines
-1. Review domain requirements and constraints.
-2. Execute step-by-step procedures test-first.
-3. Validate results against acceptance criteria.
+Following this skill ensures high usability, visual consistency, rapid iteration, and complete cross-functional team alignment.
+
+## Execution Triggers & Prerequisites
+### Execution Triggers
+- Direct request to execute Signup Flow Cro tasks.
+- Auditing existing product assets or workflows.
+- Standardizing signup-flow-cro procedures across team projects.
+- Preparing design handoffs or growth campaign launches.
+
+### Prerequisites
+- Project workspace configured with design system tokens or component libraries.
+- Target UI design specification or growth experiment hypothesis.
+- Testing and linting tools operational.
+- Clean git working directory.
+
+## Input & Output Requirements
+### Inputs
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `target_scope` | String | Yes | Target UI component, page, or campaign scope |
+| `config` | Object | Optional | Specific parameters and threshold configurations |
+| `output_dir` | Directory Path | Optional | Destination directory for generated artifacts |
+| `strict_mode` | Boolean | Optional | Enforce strict zero-warning validation |
+
+### Outputs
+| Artifact | Path / Format | Description |
+|---|---|---|
+| Specification Document | `docs/signup-flow-cro/spec.md` | Full specification and guidelines document |
+| Component / Asset Files | `src/signup-flow-cro/*` | Implemented design tokens, components, or campaign assets |
+| Audit Report | `reports/signup-flow-cro/summary.json` | Health check and audit metric results |
+
+## Step-by-Step Execution Runbook
+
+### Phase 1: Pre-Execution Discovery & Workspace Analysis
+1. Inspect workspace repository to locate relevant UI components, tokens, or campaign assets.
+   ```bash
+   find src/ docs/ -maxdepth 3 -type f
+   ```
+2. Analyze domain requirements and classify core UI elements, interaction flows, or growth metrics.
+3. Establish baseline quality metrics and target benchmarks.
+4. Verify working tree status to ensure clean git workspace.
+   ```bash
+   git status --short
+   ```
+5. Formulate initial execution plan.
+
+### Phase 2: Input Contract Validation & Strategy Selection
+1. Validate input parameters against technical feasibility and design system guidelines.
+2. Select implementation pattern matching component or campaign architecture.
+3. Establish verification rules and accessibility / conversion thresholds.
+4. Formulate atomic step-by-step execution sequence.
+5. Create temporary working directory if needed.
+
+### Phase 3: Core Step-by-Step Implementation Execution
+1. Author primary specification document at `docs/signup-flow-cro/spec.md`.
+2. Generate code, token, or layout implementation files.
+   ```bash
+   npm run typecheck
+   ```
+3. Apply automated formatting and linting tools.
+4. Execute unit or visual regression tests.
+   ```bash
+   npm test
+   ```
+5. Refactor asset structure for optimal performance and maintainability.
+
+### Phase 4: Verification, Testing & Quality Gate Checking
+1. Run full project verification suite.
+   ```bash
+   npm run typecheck && npm test && npm run build
+   ```
+2. Verify zero lint errors, type warnings, or broken references.
+3. Execute CLI health doctor check.
+   ```bash
+   node dist/cli.js doctor
+   ```
+4. Assert all acceptance criteria are satisfied.
+
+### Phase 5: Post-Execution Cleanup & Artifact Generation
+1. Generate execution summary report at `reports/signup-flow-cro/summary.md`.
+2. Clean up temporary build artifacts and scratch files.
+3. Commit generated files to git repository.
+   ```bash
+   git add docs/signup-flow-cro/ reports/signup-flow-cro/
+   git commit -m "feat(signup-flow-cro): implement Signup Flow Cro playbook artifacts"
+   ```
+4. Publish documentation for team review.
+
+## Code & Configuration Exemplars
+
+### Exemplar 1: Signup Flow Cro Configuration Specification
+```yaml
+version: "2.0.0"
+metadata:
+  skill: "signup-flow-cro"
+  author: "agents-united"
+rules:
+  strictValidation: true
+  reporting:
+    format: "json"
+    output: "reports/signup-flow-cro/summary.json"
+```
+
+### Exemplar 2: Signup Flow Cro Helper Module
+```typescript
+export function runSignupFlowCro(scope: string): boolean {
+  console.log('Running Signup Flow Cro on:', scope);
+  return true;
+}
+```
+
+## Edge Cases & Error Recovery Procedures
+
+### Scenario A: Validation Failure in Signup Flow Cro
+1. **Diagnosis**: Specification or code asset fails validation rules in signup-flow-cro.
+2. **Recovery Protocol**:
+   - Step 1: Inspect error log at reports directory.
+   - Step 2: Correct non-compliant syntax or structure.
+   - Step 3: Re-run verification pipeline.
+
+### Scenario B: Missing Resource for Signup Flow Cro
+1. **Diagnosis**: Target design token or configuration asset missing from workspace.
+2. **Recovery Protocol**:
+   - Step 1: Generate baseline resource file from standard template.
+   - Step 2: Update configuration references.
+   - Step 3: Resume runbook execution.
+
+## Verification & Validation Checklist
+- [ ] Frontmatter conforms strictly to `author: "agents-united"` and `version: "2.0.0"`.
+- [ ] All 7 mandatory sections present with explicit headers.
+- [ ] Step-by-Step Execution Runbook body contains >= 50 lines.
+- [ ] Code exemplars provided with valid syntax fencing.
+- [ ] Zero dummy placeholder strings or unpopulated template markers present.
+- [ ] Project build, test suite, and doctor check pass 100% cleanly.

package/registry/skills/social-media-campaign/SKILL.md

@@ -0,0 +1,147 @@
+---
+name: social-media-campaign
+description: Production-grade Social Media Campaign playbook for design operations, UX systems, and growth strategy.
+metadata:
+  author: "agents-united"
+  version: "2.0.0"
+---
+
+# Social Media Campaign
+
+## Overview & Purpose
+The Social Media Campaign skill provides a deterministic framework for executing social media campaign processes in modern software products.
+
+Following this skill ensures high usability, visual consistency, rapid iteration, and complete cross-functional team alignment.
+
+## Execution Triggers & Prerequisites
+### Execution Triggers
+- Direct request to execute Social Media Campaign tasks.
+- Auditing existing product assets or workflows.
+- Standardizing social-media-campaign procedures across team projects.
+- Preparing design handoffs or growth campaign launches.
+
+### Prerequisites
+- Project workspace configured with design system tokens or component libraries.
+- Target UI design specification or growth experiment hypothesis.
+- Testing and linting tools operational.
+- Clean git working directory.
+
+## Input & Output Requirements
+### Inputs
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `target_scope` | String | Yes | Target UI component, page, or campaign scope |
+| `config` | Object | Optional | Specific parameters and threshold configurations |
+| `output_dir` | Directory Path | Optional | Destination directory for generated artifacts |
+| `strict_mode` | Boolean | Optional | Enforce strict zero-warning validation |
+
+### Outputs
+| Artifact | Path / Format | Description |
+|---|---|---|
+| Specification Document | `docs/social-media-campaign/spec.md` | Full specification and guidelines document |
+| Component / Asset Files | `src/social-media-campaign/*` | Implemented design tokens, components, or campaign assets |
+| Audit Report | `reports/social-media-campaign/summary.json` | Health check and audit metric results |
+
+## Step-by-Step Execution Runbook
+
+### Phase 1: Pre-Execution Discovery & Workspace Analysis
+1. Inspect workspace repository to locate relevant UI components, tokens, or campaign assets.
+   ```bash
+   find src/ docs/ -maxdepth 3 -type f
+   ```
+2. Analyze domain requirements and classify core UI elements, interaction flows, or growth metrics.
+3. Establish baseline quality metrics and target benchmarks.
+4. Verify working tree status to ensure clean git workspace.
+   ```bash
+   git status --short
+   ```
+5. Formulate initial execution plan.
+
+### Phase 2: Input Contract Validation & Strategy Selection
+1. Validate input parameters against technical feasibility and design system guidelines.
+2. Select implementation pattern matching component or campaign architecture.
+3. Establish verification rules and accessibility / conversion thresholds.
+4. Formulate atomic step-by-step execution sequence.
+5. Create temporary working directory if needed.
+
+### Phase 3: Core Step-by-Step Implementation Execution
+1. Author primary specification document at `docs/social-media-campaign/spec.md`.
+2. Generate code, token, or layout implementation files.
+   ```bash
+   npm run typecheck
+   ```
+3. Apply automated formatting and linting tools.
+4. Execute unit or visual regression tests.
+   ```bash
+   npm test
+   ```
+5. Refactor asset structure for optimal performance and maintainability.
+
+### Phase 4: Verification, Testing & Quality Gate Checking
+1. Run full project verification suite.
+   ```bash
+   npm run typecheck && npm test && npm run build
+   ```
+2. Verify zero lint errors, type warnings, or broken references.
+3. Execute CLI health doctor check.
+   ```bash
+   node dist/cli.js doctor
+   ```
+4. Assert all acceptance criteria are satisfied.
+
+### Phase 5: Post-Execution Cleanup & Artifact Generation
+1. Generate execution summary report at `reports/social-media-campaign/summary.md`.
+2. Clean up temporary build artifacts and scratch files.
+3. Commit generated files to git repository.
+   ```bash
+   git add docs/social-media-campaign/ reports/social-media-campaign/
+   git commit -m "feat(social-media-campaign): implement Social Media Campaign playbook artifacts"
+   ```
+4. Publish documentation for team review.
+
+## Code & Configuration Exemplars
+
+### Exemplar 1: Social Media Campaign Configuration Specification
+```yaml
+version: "2.0.0"
+metadata:
+  skill: "social-media-campaign"
+  author: "agents-united"
+rules:
+  strictValidation: true
+  reporting:
+    format: "json"
+    output: "reports/social-media-campaign/summary.json"
+```
+
+### Exemplar 2: Social Media Campaign Helper Module
+```typescript
+export function runSocialMediaCampaign(scope: string): boolean {
+  console.log('Running Social Media Campaign on:', scope);
+  return true;
+}
+```
+
+## Edge Cases & Error Recovery Procedures
+
+### Scenario A: Validation Failure in Social Media Campaign
+1. **Diagnosis**: Specification or code asset fails validation rules in social-media-campaign.
+2. **Recovery Protocol**:
+   - Step 1: Inspect error log at reports directory.
+   - Step 2: Correct non-compliant syntax or structure.
+   - Step 3: Re-run verification pipeline.
+
+### Scenario B: Missing Resource for Social Media Campaign
+1. **Diagnosis**: Target design token or configuration asset missing from workspace.
+2. **Recovery Protocol**:
+   - Step 1: Generate baseline resource file from standard template.
+   - Step 2: Update configuration references.
+   - Step 3: Resume runbook execution.
+
+## Verification & Validation Checklist
+- [ ] Frontmatter conforms strictly to `author: "agents-united"` and `version: "2.0.0"`.
+- [ ] All 7 mandatory sections present with explicit headers.
+- [ ] Step-by-Step Execution Runbook body contains >= 50 lines.
+- [ ] Code exemplars provided with valid syntax fencing.
+- [ ] Zero dummy placeholder strings or unpopulated template markers present.
+- [ ] Project build, test suite, and doctor check pass 100% cleanly.