ai-developer-skill-os 8.2.1 → 8.3.1

package/.agents/skills/qk-refactor/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: qk-refactor
+version: 8.3.1
+status: stable
+description: "Tái cấu trúc và dọn dẹp mã nguồn để dễ bảo trì hơn mà không làm thay đổi logic hoạt động bên ngoài."
+platforms: [antigravity, claude-code, cursor, windsurf, kilo-code]
+
+type: capability
+
+intent:
+  - refactoring
+  - code-cleanup
+  - complexity-reduction
+
+complexity:
+  level: medium
+  criteria:
+    files_affected: "2-5"
+    has_behavior_change: false
+    has_external_dependency: false
+    has_breaking_change: false
+
+triggers:
+  - refactor
+  - tái cấu trúc
+  - clean up this code
+  - simplify
+  - reduce complexity
+  - dẫn cấu trúc code
+
+selection:
+  priority: medium
+  confidence_threshold: 0.80
+
+workflow: refactor
+
+rules:
+  - global
+  - coding
+  - safety
+
+tools:
+  - filesystem
+  - terminal
+
+related_skills:
+  - qk-engineering-standard
+  - qk-project-health
+
+knowledge_scope:
+  owns:
+    - refactoring-patterns
+    - code-smells
+  references:
+    - architecture
+    - coding-standards
+
+verification:
+  required: true
+  strategy: refactor
+
+examples: []
+learnings: []
+
+execution_mode: deterministic
+cost: medium
+latency: medium
+risk: medium
+side_effects: edit_files
+produces: [code, report]
+consumes: [source-code]
+
+token_budget:
+  max_files_read: 3
+  max_lines_per_read: 150
+  max_shell_commands: 2
+  stop_early: true
+
+exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
+---
+
+# qk-refactor - Safe Refactor
+
+> Language rule: Code, identifiers, file names → English. Explanations, summaries → Vietnamese.
+
+## Preconditions
+- [ ] Target file(s) or module(s) are specified
+- [ ] Tests exist for the target code (or can be created)
+
+On missing precondition:
+  EXIT: BLOCKED
+  Message: "Missing: target files or test coverage"
+
+## Scope
+- Improve internal code quality without changing external behavior
+- Reduce complexity, improve naming, extract functions
+- Remove dead code and duplication
+
+## Non-Goals
+- Add new functionality
+- Change public API signatures
+- Modify behavior or business logic
+
+## Workflow
+1. Establish baseline (current behavior + tests)
+2. Plan refactor steps
+3. Execute step by step
+4. Verify behavior unchanged
+5. Run validation gate
+
+## Exit Codes
+| Code | Meaning |
+|------|---------|
+| SUCCESS | Refactor complete, behavior preserved, tests pass |
+| PARTIAL | Refactor done, some tests need attention |
+| BLOCKED | Missing preconditions |
+| FAILED | Behavior changed or tests broken |

package/.agents/skills/qk-refactor/capability.yaml

@@ -0,0 +1,26 @@
+schema_version: 1
+id: "qk-refactor"
+version: "8.3.1"
+description: "Tái cấu trúc và dọn dẹp mã nguồn để dễ bảo trì hơn mà không làm thay đổi logic hoạt động bên ngoài."
+dependencies:
+  - "refactor"
+tools:
+  - "filesystem"
+  - "terminal"
+knowledge:
+  owns:
+    - "refactoring-patterns"
+    - "code-smells"
+  references:
+    - "architecture"
+    - "coding-standards"
+eval:
+  scorecard: "evals/scorecard.yaml"
+decision_boundary:
+  owns:
+    - "refactoring-patterns"
+  does_not_own:
+    - "new-functionality"
+    - "api-changes"
+  conflicts_with: []
+  delegates_to: []

package/.agents/skills/qk-refactor/evals/scorecard.yaml

@@ -0,0 +1,27 @@
+name: qk-refactor-eval
+description: Đánh giá an toàn và hiệu quả của tiến trình Refactor
+version: 8.3.1
+threshold: 90 # Yêu cầu an toàn rất cao, refactor không được làm hỏng tính năng
+
+metrics:
+  - id: behavior_preservation
+    name: Bảo toàn Logic (Behavior Preservation)
+    description: Tái cấu trúc có làm thay đổi logic hoạt động hoặc API public không?
+    weight: 40
+    criteria:
+      - Tuyệt đối không thêm tính năng mới trong quá trình refactor (20đ)
+      - Không thay đổi chữ ký (signature) của các public API (20đ)
+
+  - id: test_coverage_precondition
+    name: Tiền điều kiện Kiểm thử (Tests)
+    description: Agent có từ chối refactor nếu không có Tests bảo vệ không?
+    weight: 35
+    criteria:
+      - Chặn (BLOCKED) và yêu cầu viết test nếu code chưa có coverage (35đ)
+
+  - id: complexity_reduction
+    name: Giảm Độ phức tạp (Complexity Reduction)
+    description: Kết quả refactor có thực sự làm code sạch và dễ bảo trì hơn không?
+    weight: 25
+    criteria:
+      - Tách hàm, loại bỏ code chết, giảm cyclomatic complexity rõ rệt (25đ)

package/.agents/skills/qk-security-audit/SKILL.md

@@ -1,135 +1,259 @@
----
-# ── Identity ───────────────────────────────────────────────
-name: qk-security-audit
-version: 8.1.0
-status: experimental
-description: "Security audit (OWASP, dependency security, secret detection, permission model)."
-platforms: [antigravity, claude-code, cursor, windsurf, kilo-code]
-
-# ── V8: Classification ─────────────────────────────────────
-type: capability
-
-intent:
-  - security-audit
-  - vulnerability-scan
-  - secret-detection
-  - permission-review
-
-complexity:
-  level: high
-  criteria:
-    files_affected: "1-10"
-    has_behavior_change: true
-    has_external_dependency: true
-    has_breaking_change: false
-
-triggers:
-  - "kiểm tra bảo mật"
-  - "scan lỗ hổng"
-  - "audit code"
-  - "tìm secret leak"
-
-# ── V8: References ─────────────────────────────────────────
-workflow: security-audit
-
-rules:
-  - global
-  - security
-
-tools:
-  - filesystem
-  - terminal
-
-related_skills:
-  - qk-access-policy
-
-knowledge_scope:
-  domain:
-    - security-practices
-    - vulnerability-detection
-  concepts:
-    - owasp
-    - secret-detection
-  references:
-    - architecture
-
-decision_boundary:
-  owns:
-    - application-security
-    - agent-security
-    - prompt-injection
-    - dependency-risk
-  does_not_own:
-    - access control implementation
-    - penetration testing
-    - compliance certification
-  conflicts_with: []
-  delegates_to:
-    - qk-validation-gate
-
-# ── V8: Verification ───────────────────────────────────────
-verification:
-  required: true
-  strategy: feature
-
-lifecycle:
-  promotion_gate:
-    requirements:
-      tests:
-        minimum_pass_rate: 0.95
-      usage:
-        minimum_runs: 20
-      conflicts:
-        zero_boundary_violation: true
-      evidence:
-        required:
-          - evaluation_report
-          - usage_history
-          - boundary_audit
-  demotion_gate:
-    triggers:
-      - repeated_failure
-      - boundary_violation
-      - outdated_reference
-    action:
-      change_status: "stable -> experimental"
-
-selection:
-  priority: high
-  confidence_threshold: 0.85
-
-examples: []
-learnings: []
-
-# ── V7 Runtime ─────────────────────────────────────────────
-execution_mode: deterministic
-cost: medium
-latency: slow
-risk: low
-side_effects: read_only
-produces: [report, security_fixes]
-consumes: [user-description]
-
-token_budget:
-  max_files_read: 10
-  max_lines_per_read: 150
-  max_shell_commands: 2
-  stop_early: true
-
-exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
----
-
-# qk-security-audit — Security Auditor
-
-> **Language rule:** Code, identifiers, file names → English. Explanations, summaries → Vietnamese.
-
-## Preconditions
-- [ ] Tuân thủ `security.md`.
-- [ ] Xác định phạm vi codebase cần audit.
-
-## Scope
-- Quét và phát hiện các rủi ro bảo mật từ dependencies bên thứ ba.
-- Nhận diện secret bị hardcode/leak (API keys, passwords, tokens).
-- Rà soát mô hình phân quyền (RBAC, ABAC) và kiểm tra lỗ hổng logic (BOLA, Broken Auth).
-- Check dựa trên OWASP Top 10.
-- Khuyến nghị bản vá bảo mật tương ứng.
+---
+# ── Identity ───────────────────────────────────────────────
+name: qk-security-audit
+version: 8.3.1
+status: experimental
+description: "Security audit (OWASP, dependency security, secret detection, permission model)."
+platforms: [antigravity, claude-code, cursor, windsurf, kilo-code]
+
+# ── V8: Classification ─────────────────────────────────────
+type: capability
+
+intent:
+  - security-audit
+  - vulnerability-scan
+  - secret-detection
+  - permission-review
+
+complexity:
+  level: high
+  criteria:
+    files_affected: "1-10"
+    has_behavior_change: true
+    has_external_dependency: true
+    has_breaking_change: false
+
+triggers:
+  - "kiểm tra bảo mật"
+  - "scan lỗ hổng"
+  - "audit code"
+  - "tìm secret leak"
+
+# ── V8: References ─────────────────────────────────────────
+workflow: security-audit
+
+rules:
+  - global
+  - security
+
+tools:
+  - filesystem
+  - terminal
+
+related_skills:
+  - qk-access-policy
+
+knowledge_scope:
+  domain:
+    - security-practices
+    - vulnerability-detection
+  concepts:
+    - owasp
+    - secret-detection
+  references:
+    - architecture
+    - security
+    - anti-patterns
+
+decision_boundary:
+  owns:
+    - application-security
+    - agent-security
+    - prompt-injection
+    - dependency-risk
+  does_not_own:
+    - access control implementation
+    - penetration testing
+    - compliance certification
+  conflicts_with: []
+  delegates_to:
+    - qk-validation-gate
+
+# ── V8: Verification ───────────────────────────────────────
+verification:
+  required: true
+  strategy: feature
+
+lifecycle:
+  promotion_gate:
+    requirements:
+      tests:
+        minimum_pass_rate: 0.95
+      usage:
+        minimum_runs: 20
+      conflicts:
+        zero_boundary_violation: true
+      evidence:
+        required:
+          - evaluation_report
+          - usage_history
+          - boundary_audit
+  demotion_gate:
+    triggers:
+      - repeated_failure
+      - boundary_violation
+      - outdated_reference
+    action:
+      change_status: "stable -> experimental"
+
+selection:
+  priority: high
+  confidence_threshold: 0.85
+
+examples: []
+learnings: []
+
+# ── V7 Runtime ─────────────────────────────────────────────
+execution_mode: deterministic
+cost: medium
+latency: slow
+risk: low
+side_effects: read_only
+produces: [report, security_fixes]
+consumes: [user-description]
+
+token_budget:
+  max_files_read: 10
+  max_lines_per_read: 150
+  max_shell_commands: 2
+  stop_early: true
+
+exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
+---
+
+# qk-security-audit — Security Auditor
+
+> **Language rule:** Code, identifiers, file names → English. Explanations, summaries → Vietnamese.
+
+## Preconditions
+- [ ] Tuân thủ `security.md`.
+- [ ] Xác định phạm vi codebase cần audit.
+
+## Scope
+- Quét và phát hiện các rủi ro bảo mật từ dependencies bên thứ ba.
+- Nhận diện secret bị hardcode/leak (API keys, passwords, tokens).
+- Rà soát mô hình phân quyền (RBAC, ABAC) và kiểm tra lỗ hổng logic (BOLA, Broken Auth).
+- **Quét lỗ hổng Prompt Injection và xác minh ranh giới Zero-Trust theo đúng R-SEC-04.**
+- Check dựa trên OWASP Top 10.
+- Khuyến nghị bản vá bảo mật tương ứng.
+
+## Non-Goals
+- ❌ Provide implementation outside of Security Vulnerability Detection scope
+- ❌ Override explicit user directives without explanation
+- ❌ Guess ambiguous requirements without asking
+
+## Priority Order
+
+| Priority | Task | Skip Threshold |
+|----------|------|----------------|
+| P1 | Core Security Vulnerability Detection analysis and decision making | Never |
+| P2 | Validation of existing patterns | Budget < 30% |
+| P3 | Detailed documentation generation | Budget < 50% |
+| P4 | Edge case exploration | Budget < 70% |
+
+## Workflow
+
+### Phase 1 — Context Loading
+**Steps:**
+1. Read existing configuration and requirements related to Security Vulnerability Detection.
+2. Check for missing preconditions.
+
+**Decision:**
+```
+IF context is clear
+  → Confidence: HIGH → go to Phase 2
+ELSE
+  → EXIT: BLOCKED — ask user
+```
+
+### Phase 2 — Analysis & Strategy
+**Steps:**
+1. Analyze the current state against Security Vulnerability Detection best practices.
+2. Formulate strategy or audit report based on findings.
+
+**Decision:**
+```
+IF strategy/audit is complete
+  → Confidence: HIGH → go to Phase 3
+ELSE IF minor gaps exist
+  → Confidence: MEDIUM → proceed with assumptions noted
+```
+
+### Phase 3 — Finalization
+**Steps:**
+1. Generate final report or configuration.
+2. Prepare handoff data for subsequent skills.
+
+## Confidence Model
+
+| Level | Condition | Action |
+|-------|-----------|--------|
+| HIGH | All preconditions met, context fully understood | Proceed directly |
+| MEDIUM | Some context missing but safe defaults exist | Proceed and note assumptions |
+| LOW | Core requirements missing | EXIT: BLOCKED |
+
+## Severity (for findings)
+
+| Level | Definition |
+|-------|-----------|
+| CRITICAL | Severe violation of Security Vulnerability Detection principles |
+| HIGH | Significant risk or technical debt |
+| MEDIUM | Suboptimal pattern but functional |
+| LOW | Minor style or documentation issue |
+
+## Evidence Format
+
+```
+[SEVERITY] Context/File
+Issue:      [what was found]
+Confidence: HIGH
+Recommendation: [actionable advice]
+```
+
+## Retry Policy
+```
+Task fails due to missing context
+  └─ Ask user for clarification
+       ├─ Provided → Retry Phase 1
+       └─ Not provided → EXIT: BLOCKED
+```
+
+## Escalation Rules
+
+```
+BLOCKED: Missing critical context for Security Vulnerability Detection
+Missing:
+  - [Specific requirement]
+Questions:
+  1. Bạn có thể cung cấp thêm thông tin về yêu cầu này không?
+  2. Mục tiêu chính của bạn là gì?
+Recommended Assumptions: none
+```
+
+## Handoff Contract
+
+### Consumes
+```json
+{
+  "from": "user or qk-orchestrator",
+  "required_fields": ["context"],
+  "optional_fields": ["existing_config"]
+}
+```
+
+### Produces
+```json
+{
+  "to": "user or downstream skill",
+  "output_fields": ["strategy_report", "exit_code"]
+}
+```
+
+## Exit Codes
+
+| Code | Meaning | When |
+|------|---------|------|
+| SUCCESS | Security Vulnerability Detection task completed successfully | Strategy/audit generated |
+| PARTIAL | Task completed with assumptions | Medium confidence |
+| BLOCKED | Missing context | Cannot proceed |
+| FAILED | Critical conflict or error | Unresolvable constraint |

package/.agents/skills/qk-security-audit/capability.yaml

@@ -0,0 +1,30 @@
+# Auto-generated from SKILL.md frontmatter
+schema_version: 1
+id: "qk-security-audit"
+version: "8.3.1"
+description: "Security audit (OWASP, dependency security, secret detection, permission model)."
+tools:
+  - "filesystem"
+  - "terminal"
+knowledge:
+  owns:
+    - "qk-security-audit"
+  references:
+    - "architecture"
+    - "security"
+    - "anti-patterns"
+eval:
+  scorecard: "evals/scorecard.yaml"
+decision_boundary:
+  owns:
+    - "application-security"
+    - "agent-security"
+    - "prompt-injection"
+    - "dependency-risk"
+  does_not_own:
+    - "access control implementation"
+    - "penetration testing"
+    - "compliance certification"
+  conflicts_with: []
+  delegates_to:
+    - "qk-validation-gate"

package/.agents/skills/qk-security-audit/evals/scorecard.yaml

@@ -0,0 +1,27 @@
+name: qk-security-audit-eval
+description: Đánh giá chất lượng Kiểm toán Bảo mật
+version: 8.3.1
+threshold: 95 # Threshold gần như tuyệt đối vì đây là lưới lọc bảo mật cuối cùng
+
+metrics:
+  - id: secret_leak_detection
+    name: Nhận diện rò rỉ Secret (Secret Leak)
+    description: Agent có phát hiện được API keys/Passwords bị hardcode không?
+    weight: 40
+    criteria:
+      - Rà quét và chỉ điểm chính xác file/line chứa secret bị hardcode (40đ)
+
+  - id: r_sec_04_enforcement
+    name: Rà soát Zero-Trust & Phân quyền
+    description: Có kiểm tra các lỗ hổng RBAC/ABAC và Prompt Injection không?
+    weight: 35
+    criteria:
+      - Đánh giá mô hình quyền hạn xem có lỗ hổng BOLA hoặc Broken Auth không (15đ)
+      - Quét nguy cơ Prompt Injection (nếu có LLM integration) theo chuẩn R-SEC-04 (20đ)
+
+  - id: owasp_and_dependencies
+    name: Lỗ hổng OWASP & Dependencies
+    description: Có kiểm tra các thư viện lỗi thời hoặc lỗ hổng phổ biến không?
+    weight: 25
+    criteria:
+      - Đưa ra danh sách cảnh báo dựa trên OWASP Top 10 và Dependency Tree (25đ)