ai-playbook 1.0.0

package/skills/security/skill.md

@@ -0,0 +1,223 @@
+# 🤖 Security Skill
+
+## Purpose
+
+This document defines the knowledge, capabilities, and best practices for designing, implementing, and maintaining secure software systems that protect against threats, vulnerabilities, and attacks while maintaining compliance with security standards and regulations.
+
+The AI should be capable of conducting threat modeling, identifying vulnerabilities, designing secure systems, responding to incidents, and ensuring compliance with security best practices.
+
+---
+
+# Table of Contents
+
+1. Security Fundamentals
+2. Secure Development
+3. Authentication & Authorization
+4. Encryption & Cryptography
+5. Vulnerability Management
+6. Threat Modeling & Risk Assessment
+7. Security Testing
+8. Incident Response
+9. Compliance & Audit
+10. Security Tools & Technologies
+11. Best Practices
+12. Deliverables
+
+---
+
+# 1. Security Fundamentals
+
+| Concept                | Description                          | Application                      |
+| ---------------------- | ------------------------------------ | -------------------------------- |
+| Confidentiality         | Data accessible only to authorized   | Encryption, access control       |
+| Integrity               | Data not modified without permission | Hashing, digital signatures       |
+| Availability            | Systems accessible when needed       | Redundancy, DDoS protection      |
+| Threat Modeling         | Identify and mitigate threats        | Design-time security             |
+| Attack Surface          | All points where system can be attacked | Minimize through design       |
+| Defense in Depth        | Multiple security layers             | Assume each layer can fail       |
+| Least Privilege         | Grant minimum required access        | Reduce blast radius              |
+
+---
+
+# 2. Secure Development
+
+Practice:
+
+* Secure coding standards
+* Input validation and sanitization
+* Output encoding
+* Error handling without exposing sensitive info
+* Secure configuration management
+* Safe dependency management
+* Security in CI/CD pipeline
+* Code security scanning (SAST)
+
+---
+
+# 3. Authentication & Authorization
+
+Implement:
+
+* Strong password policies
+* Multi-factor authentication (MFA)
+* OAuth2 / OpenID Connect
+* SAML for SSO
+* Session management
+* Token-based authentication
+* Role-based access control (RBAC)
+* Attribute-based access control (ABAC)
+
+---
+
+# 4. Encryption & Cryptography
+
+Use:
+
+* TLS/SSL for data in transit
+* AES-256 for data at rest
+* Strong key management
+* Proper algorithm selection
+* Secure random number generation
+* Password hashing (bcrypt, Argon2)
+* Digital signatures
+* Perfect forward secrecy
+
+---
+
+# 5. Vulnerability Management
+
+Perform:
+
+* Vulnerability scanning
+* Dependency scanning
+* Code analysis
+* Penetration testing
+* Security testing
+* CVE tracking and patching
+* Remediation verification
+* Regression testing
+
+---
+
+# 6. Threat Modeling & Risk Assessment
+
+Conduct:
+
+* Asset identification
+* Threat identification
+* Vulnerability assessment
+* Risk calculation
+* Mitigation planning
+* Control implementation
+* Monitoring
+* Regular review
+
+---
+
+# 7. Security Testing
+
+Execute:
+
+* Input validation testing
+* SQL injection testing
+* Cross-site scripting (XSS) testing
+* Cross-site request forgery (CSRF) testing
+* Authentication/authorization testing
+* Session management testing
+* Encryption verification
+* API security testing
+
+---
+
+# 8. Incident Response
+
+Handle:
+
+* Incident detection
+* Severity assessment
+* Containment
+* Evidence collection
+* Investigation
+* Eradication
+* Recovery
+* Post-incident analysis
+
+---
+
+# 9. Compliance & Audit
+
+Ensure:
+
+* Regulatory compliance (GDPR, HIPAA, PCI-DSS)
+* Standards compliance (ISO 27001, NIST)
+* Audit readiness
+* Documentation
+* Evidence collection
+* Controls mapping
+* Regular assessments
+* Continuous monitoring
+
+---
+
+# 10. Security Tools & Technologies
+
+Use:
+
+* SAST (SonarQube, Checkmarx)
+* DAST (Burp Suite, OWASP ZAP)
+* Dependency scanning (Snyk, npm audit)
+* Container scanning (Trivy)
+* SIEM (Splunk, ELK)
+* WAF (CloudFlare, AWS WAF)
+* Secrets management (HashiCorp Vault, AWS Secrets Manager)
+* Vulnerability scanning (Nessus, Qualys)
+
+---
+
+# 11. Best Practices
+
+Always:
+
+* Follow secure coding standards
+* Validate and sanitize input
+* Use strong encryption
+* Implement MFA
+* Keep dependencies updated
+* Conduct security reviews
+* Test for vulnerabilities
+* Respond to incidents quickly
+* Maintain audit logs
+* Train on security
+
+Never:
+
+* Hardcode credentials
+* Use weak encryption
+* Trust user input
+* Ignore security warnings
+* Skip security testing
+* Delay security patches
+* Log sensitive data
+* Skip compliance checks
+* Build without threat modeling
+
+---
+
+# 12. Deliverables
+
+* Threat models
+* Security designs
+* Security test reports
+* Vulnerability assessments
+* Incident response plans
+* Compliance documentation
+* Security architecture diagrams
+* Remediation plans
+* Security training
+* Audit reports
+
+---
+
+# Success Criteria
+
+Successful security reduces vulnerabilities, maintains compliance, enables rapid incident response, and maintains user trust.

package/skills/software-development/README.md

@@ -0,0 +1,239 @@
+# Software Development
+
+## Overview
+
+The **Software Development** skill enables AI models to function as experienced software engineers capable of designing, implementing, debugging, testing, reviewing, documenting, and maintaining production-ready software.
+
+This skill focuses on delivering reliable, maintainable, secure, and scalable code while respecting the existing architecture, coding standards, and business requirements.
+
+It is designed to be model-agnostic and can be used with Claude Code, Codex, Gemini CLI, Cursor, Warp, Continue, Aider, OpenAI, and other AI development tools.
+
+---
+
+# Goals
+
+The primary goals of this skill are:
+
+* Build production-quality software
+* Fix bugs safely
+* Minimize technical debt
+* Follow project conventions
+* Write maintainable code
+* Improve system reliability
+* Ensure security best practices
+* Optimize performance when necessary
+* Produce comprehensive tests
+* Generate clear technical documentation
+
+---
+
+# Capabilities
+
+This skill can assist with:
+
+## Development
+
+* Feature implementation
+* Backend development
+* Frontend development
+* Full-stack development
+* API development
+* Database development
+* Microservices
+* Cloud-native applications
+
+## Code Quality
+
+* Code reviews
+* Refactoring
+* Static analysis
+* Code cleanup
+* Technical debt reduction
+
+## Testing
+
+* Unit tests
+* Integration tests
+* API tests
+* Regression tests
+* Test automation
+
+## Debugging
+
+* Root cause analysis
+* Production issue investigation
+* Performance troubleshooting
+* Memory leak detection
+* Exception analysis
+
+## Architecture Support
+
+* Design improvements
+* API design
+* Database design
+* Design pattern recommendations
+* Scalability improvements
+
+---
+
+# Skill Files
+
+| File          | Purpose                          |
+| ------------- | -------------------------------- |
+| `README.md`   | Overview of the skill            |
+| `skill.md`    | Defines how the AI should behave |
+| `examples.md` | Real-world usage examples        |
+
+Future additions may include:
+
+* `checklists.md`
+* `commands.md`
+* `patterns.md`
+* `anti-patterns.md`
+* `templates.md`
+
+---
+
+# When to Use
+
+Use this skill when working on:
+
+* New feature development
+* Bug fixes
+* Code reviews
+* Refactoring
+* Performance improvements
+* Security improvements
+* Testing
+* API development
+* Database changes
+* Production incidents
+* Technical documentation
+
+---
+
+# Expected Workflow
+
+The Software Development skill follows this workflow:
+
+```text
+Understand Requirements
+        ↓
+Analyze Existing Code
+        ↓
+Design Solution
+        ↓
+Implement
+        ↓
+Test
+        ↓
+Review
+        ↓
+Document
+        ↓
+Ready for Deployment
+```
+
+---
+
+# Inputs
+
+Typical inputs include:
+
+* User stories
+* Feature requests
+* Bug reports
+* Existing source code
+* Stack traces
+* Pull requests
+* API specifications
+* Database schemas
+* Architecture diagrams
+
+---
+
+# Outputs
+
+Typical outputs include:
+
+* Production-ready code
+* Refactored implementations
+* Bug fixes
+* Test suites
+* Code review feedback
+* Technical documentation
+* Performance recommendations
+* Security improvements
+* Implementation summaries
+
+---
+
+# Related Skills
+
+This skill commonly works alongside:
+
+* Architecture
+* Design Architecture
+* DevOps
+* QA
+* SRE
+* Security
+* Support Engineering
+
+---
+
+# Best Practices
+
+Always:
+
+* Understand the problem before coding.
+* Reuse existing project patterns.
+* Keep implementations simple.
+* Write maintainable code.
+* Add or update tests.
+* Handle errors explicitly.
+* Consider security.
+* Consider performance.
+* Document significant changes.
+* Minimize unrelated modifications.
+
+---
+
+# Success Criteria
+
+A successful implementation should:
+
+* Solve the requested problem.
+* Follow project conventions.
+* Be secure.
+* Be maintainable.
+* Be well tested.
+* Be production ready.
+* Be easy for other engineers to understand.
+* Be ready for code review and deployment.
+
+---
+
+# Example Usage
+
+```
+Use the Software Development skill.
+
+Task:
+Implement user profile management.
+
+Requirements:
+- Follow existing architecture.
+- Add unit tests.
+- Add integration tests.
+- Keep changes minimal.
+- Explain implementation decisions.
+```
+
+---
+
+# Version
+
+**Version:** 1.0
+
+This skill is intended to evolve over time as new engineering practices, AI capabilities, and project conventions are introduced.