bigpowers 2.43.0 → 2.43.2

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.43.0",
+  "version": "2.43.2",
   "description": "72 skills — 70 agent skills for spec-driven, test-first software development by solo developers",
   "keywords": [
     "pi-package"

package/.pi/prompts/plan-release.md

@@ -6,7 +6,6 @@ description: "RELEASE-INDEX BUILDER — Sequence elaborated epics into specs/rel
 # Plan Release
 
 > **HARD GATE** — Do NOT run this skill unless `elaborate-spec` has produced a clear spec or the user has already defined the feature in detail. If the problem is still fuzzy, run `elaborate-spec` first.
-
 > **HARD GATE** — `specs/product/SCOPE_LATEST.yaml` (or legacy `specs/product/SCOPE_LATEST.yaml`) must exist. If missing, run `scope-work` first.
 
 Synthesize the conversation context into `specs/release-plan.yaml` (index) and shard detail under `specs/epics/`. No new interview — only clarify if something is genuinely ambiguous.
@@ -35,7 +34,7 @@ specs/epics/e01-auth-system/
 └── e01s02-tasks.yaml      # Decoupled task checklist
 ```
 
-**Rationale:** Capsule dirs achieve change isolation (C9), enable archive pruning (C2/C6), and enforce SRP by decoupling spec `.md` from execution `-tasks.yaml` (C1). See `sdd-adequacy-ranking.md` for the full 10-criteria scoring.
+**Rationale:** Capsule dirs achieve change isolation (C9), enable archive pruning (C2/C6), and enforce SRP by decoupling spec `.md` from execution `-tasks.yaml` (C1).
 
 ## Process
 
@@ -139,7 +138,6 @@ tasks:
 ```bash
 bash scripts/sync-status-from-epics.sh
 ```
-
 ### 9. Snapshot on planning close (optional)
 
 Copy to `specs/product/snapshots/release-<version>/` when the user approves the plan.

package/.pi/skills/plan-release/SKILL.md

@@ -8,7 +8,6 @@ model: sonnet
 # Plan Release
 
 > **HARD GATE** — Do NOT run this skill unless `elaborate-spec` has produced a clear spec or the user has already defined the feature in detail. If the problem is still fuzzy, run `elaborate-spec` first.
-
 > **HARD GATE** — `specs/product/SCOPE_LATEST.yaml` (or legacy `specs/product/SCOPE_LATEST.yaml`) must exist. If missing, run `scope-work` first.
 
 Synthesize the conversation context into `specs/release-plan.yaml` (index) and shard detail under `specs/epics/`. No new interview — only clarify if something is genuinely ambiguous.
@@ -37,7 +36,7 @@ specs/epics/e01-auth-system/
 └── e01s02-tasks.yaml      # Decoupled task checklist
 ```
 
-**Rationale:** Capsule dirs achieve change isolation (C9), enable archive pruning (C2/C6), and enforce SRP by decoupling spec `.md` from execution `-tasks.yaml` (C1). See `sdd-adequacy-ranking.md` for the full 10-criteria scoring.
+**Rationale:** Capsule dirs achieve change isolation (C9), enable archive pruning (C2/C6), and enforce SRP by decoupling spec `.md` from execution `-tasks.yaml` (C1).
 
 ## Process
 
@@ -141,7 +140,6 @@ tasks:
 ```bash
 bash scripts/sync-status-from-epics.sh
 ```
-
 ### 9. Snapshot on planning close (optional)
 
 Copy to `specs/product/snapshots/release-<version>/` when the user approves the plan.

package/.pi/skills/security-review/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: security-review
 description: "> AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files. Use when reviewing pending changes, before release-branch, during verify-work Phase 5, during build-epic Step 0 threat modeling, or when the user says \"security review\" or \"scan for vulns\"."
+model: sonnet
 ---
 
 

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.43.2](https://github.com/danielvm-git/bigpowers/compare/v2.43.1...v2.43.2) (2026-07-02)
+
+
+### Bug Fixes
+
+* **ci:** resolve doctrine drift — stale count and line cap ([4930391](https://github.com/danielvm-git/bigpowers/commit/49303917543a56feb6dd47e92641f90bea289cb4))
+
+## [2.43.1](https://github.com/danielvm-git/bigpowers/compare/v2.43.0...v2.43.1) (2026-07-02)
+
+
+### Bug Fixes
+
+* **scripts:** replace declare -A with case for bash 3.2 compatibility ([92dacb6](https://github.com/danielvm-git/bigpowers/commit/92dacb6151a207f659edd2d4f48efc084936fc40))
+
 # [2.43.0](https://github.com/danielvm-git/bigpowers/compare/v2.42.1...v2.43.0) (2026-06-29)
 
 

package/CONTRIBUTING.md

@@ -0,0 +1,119 @@
+# Contributing to bigpowers
+
+Thanks for your interest in contributing! bigpowers is an open-source system of 69+ AI agent skills for spec-driven, test-first software development. This guide will help you get started.
+
+## Code of Conduct
+
+Be respectful, constructive, and patient. We're building tools for developers — treat each other like the professionals we are.
+
+## Before You Start
+
+1. **Read the docs.** Start with [`README.md`](README.md), [`CLAUDE.md`](CLAUDE.md), and [`CONVENTIONS.md`](CONVENTIONS.md). These define the project's architecture, conventions, and engineering standards.
+2. **Run bigpowers.** Install with `npx bigpowers` and walk through the experience as a user before contributing as a developer.
+3. **Understand the lifecycle.** bigpowers follows a 6-phase methodology: Discover → Elaborate → Plan → Build → Verify → Release. Read [`docs/WORKFLOW-SOP-v2.md`](docs/WORKFLOW-SOP-v2.md) for the full SOP.
+
+## How to Contribute
+
+### Reporting Bugs
+
+- Search [existing issues](https://github.com/danielvm-git/bigpowers/issues) first.
+- Use the bug report template if one exists.
+- Include: what you did, what you expected, what happened, your OS, Node version, and any error output.
+- If the bug is in a specific skill, name the skill.
+
+### Proposing Features
+
+- Open a [discussion](https://github.com/danielvm-git/bigpowers/discussions) before opening a PR for a new feature. We want to align on the approach before you invest time.
+- New skills must follow the [verb-noun kebab-case naming convention](CONVENTIONS.md#skill-naming--conventions-and-exceptions) (ADR-0001).
+- New features should include: a description of the problem, the proposed solution, and any alternatives considered.
+
+### Proposing a New Skill
+
+Skills are the core of bigpowers. To propose a new one:
+
+1. **Check the index.** [`SKILL-INDEX.md`](SKILL-INDEX.md) lists all 69+ active skills. Make sure your idea doesn't overlap with an existing skill.
+2. **Identify the phase.** Every skill belongs to one of 7 phases: Discover, Design, Plan, Build, Verify, Release, Sustain.
+3. **Write a SKILL.md draft.** Follow the structure of existing skills. Every SKILL.md needs: a description, phase, instructions, and references.
+4. **Open a discussion.** Share your SKILL.md draft in a GitHub discussion. We'll review whether it fits the roadmap before you invest in a full PR.
+5. **Once approved,** open a PR with:
+   - A new directory: `[verb]-[noun]/` containing `SKILL.md`
+   - Evidence that you ran `bash scripts/sync-skills.sh` to regenerate artifacts
+   - A Conventional Commit: `feat(skills): add [verb]-[noun] skill`
+
+### Pull Request Process
+
+1. **Branch from main.** Use `kickoff-branch` or create a feature branch manually.
+2. **Follow CONVENTIONS.md.** F.I.R.S.T tests. SOLID. Boy Scout Rule. No `any` types. Functions under 20 lines.
+3. **Run sync.** After any SKILL.md change, run `bash scripts/sync-skills.sh` to regenerate generated artifacts. Do not edit `.cursor/rules` or `.gemini/extensions/` directly.
+4. **Validate YAML.** Run `bash scripts/validate-specs-yaml.sh` if you've changed any `specs/*.yaml` files.
+5. **Write Conventional Commits.** Format: `type(scope): description`. See [CONVENTIONS.md](CONVENTIONS.md#conventional-commits--semantic-versioning) for the full spec.
+6. **Open a PR.** Use `gh pr create`. Include: what you changed, why, how to verify, and any open questions.
+7. **Wait for review.** A maintainer will review within a few days. Be responsive to feedback.
+
+### Writing Documentation
+
+Documentation is a first-class contribution. You don't need to write code to help.
+
+- **README improvements:** Clearer install instructions, better examples, fixed typos.
+- **Skill docs:** Every SKILL.md should be clear enough for a new user to understand without asking.
+- **Guides and tutorials:** Walkthroughs for specific use cases (e.g., "Using bigpowers with a Next.js project").
+- **Translations:** Help make bigpowers accessible to non-English-speaking developers.
+
+## Development Setup
+
+```bash
+# Clone the repo
+git clone https://github.com/danielvm-git/bigpowers.git
+cd bigpowers
+
+# Install dependencies + run postinstall sync
+npm install
+
+# Or manually:
+bash scripts/install.sh
+npm run sync
+```
+
+### Prerequisites
+
+- **Bash** — required for all scripts
+- **Node.js** v14+
+- **jq** — highly recommended for YAML validation scripts
+- **An AI coding tool** — Claude Code, Cursor, Gemini CLI, or pi (to test skills end-to-end)
+
+### Project Structure
+
+```
+bigpowers/
+├── [skill-name]/       # Each skill has its own directory with SKILL.md
+├── scripts/            # Install, sync, validation, and compliance scripts
+├── specs/              # YAML cockpit — state.yaml, release-plan.yaml, epics/
+├── docs/               # Guides and references
+├── profiles/           # Stack-specific conventions (TypeScript+Vue, Node Service, etc.)
+├── .cursor/rules/      # Generated — do not edit directly
+├── .gemini/extensions/ # Generated — do not edit directly
+└── .pi/skills/         # Generated — do not edit directly
+```
+
+**Never edit generated files.** Always edit the source `SKILL.md` and run `bash scripts/sync-skills.sh`.
+
+## Testing
+
+- **Skill validation:** `bash scripts/sync-skills.sh` validates SKILL.md syntax and structure.
+- **YAML validation:** `bash scripts/validate-specs-yaml.sh` checks the YAML cockpit for correctness.
+- **Compliance check:** `npm run compliance` runs a comprehensive check of the repo.
+- **Manual testing:** The best test of a skill is using it with an AI coding tool. After changes, run `survey-context` or invoke the skill to verify it works.
+
+## Getting Help
+
+- **Questions?** Open a [GitHub discussion](https://github.com/danielvm-git/bigpowers/discussions).
+- **Bug?** Open an [issue](https://github.com/danielvm-git/bigpowers/issues).
+- **Want to chat?** [Link to Discord/Slack — to be added]
+
+## Recognition
+
+All contributors are recognized in the README and release notes. Significant contributions (new skills, major features) get a shoutout in the changelog and on social media. We believe in giving credit where it's due.
+
+---
+
+*bigpowers is MIT-licensed. By contributing, you agree that your contributions will be licensed under the same terms.*

package/SKILL-INDEX.md

@@ -3,7 +3,7 @@
 > **DO NOT EDIT** — This file is auto-generated by `scripts/generate-skill-index.sh`.
 > Edit `SKILL.md` source files or `skills-lock.json` instead. Run `bash scripts/sync-skills.sh` to regenerate.
 
-**Generated:** 2026-06-29T16:34:20Z
+**Generated:** 2026-07-02T12:07:54Z
 **Skills:** 72
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.43.0",
+  "version": "2.43.2",
   "description": "70 agent skills for spec-driven, test-first software development by solo developers",
   "main": "index.js",
   "scripts": {

package/plan-release/SKILL.md

@@ -7,7 +7,6 @@ description: "RELEASE-INDEX BUILDER — Sequence elaborated epics into specs/rel
 # Plan Release
 
 > **HARD GATE** — Do NOT run this skill unless `elaborate-spec` has produced a clear spec or the user has already defined the feature in detail. If the problem is still fuzzy, run `elaborate-spec` first.
-
 > **HARD GATE** — `specs/product/SCOPE_LATEST.yaml` (or legacy `specs/product/SCOPE_LATEST.yaml`) must exist. If missing, run `scope-work` first.
 
 Synthesize the conversation context into `specs/release-plan.yaml` (index) and shard detail under `specs/epics/`. No new interview — only clarify if something is genuinely ambiguous.
@@ -36,7 +35,7 @@ specs/epics/e01-auth-system/
 └── e01s02-tasks.yaml      # Decoupled task checklist
 ```
 
-**Rationale:** Capsule dirs achieve change isolation (C9), enable archive pruning (C2/C6), and enforce SRP by decoupling spec `.md` from execution `-tasks.yaml` (C1). See `sdd-adequacy-ranking.md` for the full 10-criteria scoring.
+**Rationale:** Capsule dirs achieve change isolation (C9), enable archive pruning (C2/C6), and enforce SRP by decoupling spec `.md` from execution `-tasks.yaml` (C1).
 
 ## Process
 
@@ -140,7 +139,6 @@ tasks:
 ```bash
 bash scripts/sync-status-from-epics.sh
 ```
-
 ### 9. Snapshot on planning close (optional)
 
 Copy to `specs/product/snapshots/release-<version>/` when the user approves the plan.

package/scripts/add-model-frontmatter.sh

@@ -3,72 +3,20 @@
 set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 
-declare -A MODELS=(
-  [using-bigpowers]=sonnet
-  [orchestrate-project]=sonnet
-  [survey-context]=haiku
-  [research-first]=sonnet
-  [elaborate-spec]=opus
-  [map-codebase]=sonnet
-  [model-domain]=sonnet
-  [define-language]=sonnet
-  [grill-me]=sonnet
-  [grill-with-docs]=opus
-  [deepen-architecture]=sonnet
-  [design-interface]=opus
-  [assess-impact]=sonnet
-  [change-request]=sonnet
-  [scope-work]=sonnet
-  [slice-tasks]=sonnet
-  [define-success]=sonnet
-  [plan-work]=opus
-  [plan-refactor]=sonnet
-  [plan-release]=sonnet
-  [spike-prototype]=sonnet
-  [kickoff-branch]=haiku
-  [guard-git]=haiku
-  [hook-commits]=haiku
-  [seed-conventions]=sonnet
-  [develop-tdd]=sonnet
-  [enforce-first]=haiku
-  [delegate-task]=sonnet
-  [dispatch-agents]=sonnet
-  [execute-plan]=haiku
-  [wire-observability]=sonnet
-  [verify-work]=haiku
-  [run-evals]=sonnet
-  [investigate-bug]=sonnet
-  [diagnose-root]=sonnet
-  [validate-fix]=haiku
-  [audit-code]=haiku
-  [request-review]=opus
-  [respond-review]=sonnet
-  [trace-requirement]=haiku
-  [commit-message]=haiku
-  [release-branch]=haiku
-  [inspect-quality]=sonnet
-  [organize-workspace]=haiku
-  [stocktake-skills]=sonnet
-  [evolve-skill]=opus
-  [terse-mode]=haiku
-  [craft-skill]=sonnet
-  [edit-document]=sonnet
-  [session-state]=haiku
-  [migrate-spec]=sonnet
-  [visual-dashboard]=sonnet
-  [write-document]=sonnet
-  [setup-environment]=haiku
-  [reset-baseline]=haiku
-  [search-skills]=haiku
-  [compose-workflow]=sonnet
-  [simulate-agents]=sonnet
-)
+# Bash 3.2-compatible model mapping (no declare -A)
+get_model() {
+  case "$1" in
+    survey-context|verify-work|validate-fix|audit-code|enforce-first|trace-requirement|commit-message|release-branch|kickoff-branch|guard-git|hook-commits|execute-plan|organize-workspace|terse-mode|session-state|search-skills|setup-environment|reset-baseline) echo "haiku" ;;
+    elaborate-spec|grill-with-docs|design-interface|plan-work|request-review|evolve-skill) echo "opus" ;;
+    *) echo "sonnet" ;;
+  esac
+}
 
 for skill_dir in "$REPO_ROOT"/*/; do
   skill_md="$skill_dir/SKILL.md"
   [[ -f "$skill_md" ]] || continue
   name=$(basename "$skill_dir")
-  model="${MODELS[$name]:-sonnet}"
+  model=$(get_model "$name")
   if grep -q '^model:' "$skill_md" 2>/dev/null; then
     continue
   fi

package/scripts/generate-skill-index.sh

@@ -14,85 +14,25 @@ if [[ ! -f "$LOCKFILE" ]]; then
 fi
 
 # Phase categorization — maps each skill to a lifecycle phase
-declare -A PHASE_MAP
-PHASE_MAP=(
-  # Discover
-  [survey-context]="Discover"
-  [research-first]="Discover"
-  [search-skills]="Discover"
-  [using-bigpowers]="Discover"
-  [map-codebase]="Discover"
-  [elaborate-spec]="Discover"
-  [audit-plan]="Discover"
-  # Elaborate / Design
-  [model-domain]="Design"
-  [define-language]="Design"
-  [grill-me]="Design"
-  [grill-with-docs]="Design"
-  [deepen-architecture]="Design"
-  [design-interface]="Design"
-  [define-success]="Design"
-  # Plan
-  [scope-work]="Plan"
-  [slice-tasks]="Plan"
-  [plan-work]="Plan"
-  [plan-release]="Plan"
-  [plan-refactor]="Plan"
-  [assess-impact]="Plan"
-  [change-request]="Plan"
-  [run-planning]="Plan"
-  [seed-conventions]="Plan"
-  # Build
-  [develop-tdd]="Build"
-  [kickoff-branch]="Build"
-  [execute-plan]="Build"
-  [build-epic]="Build"
-  [spike-prototype]="Build"
-  [craft-skill]="Build"
-  [quick-fix]="Build"
-  [setup-environment]="Build"
-  [wire-observability]="Build"
-  [wire-ci]="Build"
-  [publish-package]="Build"
-  [align-grid]="Build"
-  [orchestrate-project]="Build"
-  [guard-git]="Build"
-  [hook-commits]="Build"
-  [deploy]="Build"
-  [smoke-test]="Build"
-  [validate-contracts]="Build"
-  # Verify
-  [verify-work]="Verify"
-  [validate-fix]="Verify"
-  [audit-code]="Verify"
-  [enforce-first]="Verify"
-  [run-evals]="Verify"
-  [investigate-bug]="Verify"
-  [diagnose-root]="Verify"
-  [fix-bug]="Verify"
-  [inspect-quality]="Verify"
-  [request-review]="Verify"
-  [respond-review]="Verify"
-  [trace-requirement]="Verify"
-  # Release
-  [release-branch]="Release"
-  [commit-message]="Release"
-  # Sustain
-  [session-state]="Sustain"
-  [edit-document]="Sustain"
-  [write-document]="Sustain"
-  [organize-workspace]="Sustain"
-  [reset-baseline]="Sustain"
-  [stocktake-skills]="Sustain"
-  [evolve-skill]="Sustain"
-  [run-benchmark]="Sustain"
-  [terse-mode]="Sustain"
-  [delegate-task]="Sustain"
-  [dispatch-agents]="Sustain"
-  [simulate-agents]="Sustain"
-  [compose-workflow]="Sustain"
-  [migrate-spec]="Sustain"
-)
+# Uses a case statement for bash 3.2 compatibility (macOS default bash lacks declare -A)
+get_phase() {
+  case "$1" in
+    # Discover
+    survey-context|research-first|search-skills|using-bigpowers|map-codebase|elaborate-spec|audit-plan) echo "Discover" ;;
+    # Design
+    model-domain|define-language|grill-me|grill-with-docs|deepen-architecture|design-interface|define-success) echo "Design" ;;
+    # Plan
+    scope-work|slice-tasks|plan-work|plan-release|plan-refactor|assess-impact|change-request|run-planning|seed-conventions) echo "Plan" ;;
+    # Build
+    develop-tdd|kickoff-branch|execute-plan|build-epic|spike-prototype|craft-skill|quick-fix|setup-environment|wire-observability|wire-ci|publish-package|align-grid|orchestrate-project|guard-git|hook-commits|deploy|smoke-test|validate-contracts) echo "Build" ;;
+    # Verify
+    verify-work|validate-fix|audit-code|enforce-first|run-evals|investigate-bug|diagnose-root|fix-bug|inspect-quality|request-review|respond-review|trace-requirement) echo "Verify" ;;
+    # Release
+    release-branch|commit-message) echo "Release" ;;
+    # Sustain
+    session-state|edit-document|write-document|organize-workspace|reset-baseline|stocktake-skills|evolve-skill|run-benchmark|terse-mode|delegate-task|dispatch-agents|simulate-agents|compose-workflow|migrate-spec) echo "Sustain" ;;
+  esac
+}
 
 # Phase order for display
 PHASE_ORDER=("Discover" "Design" "Plan" "Build" "Verify" "Release" "Sustain")
@@ -123,7 +63,7 @@ DESC_COL_WIDTH=56
   for phase in "${PHASE_ORDER[@]}"; do
     phase_skills=()
     for name in $(jq -r '.skills | keys[]' "$LOCKFILE" | sort); do
-      [[ "${PHASE_MAP[$name]:-}" == "$phase" ]] && phase_skills+=("$name")
+      [[ "$(get_phase "$name")" == "$phase" ]] && phase_skills+=("$name")
     done
     count=${#phase_skills[@]}
     total=$((total + count))
@@ -144,7 +84,7 @@ DESC_COL_WIDTH=56
   row=0
   for phase in "${PHASE_ORDER[@]}"; do
     for name in $(jq -r '.skills | keys[]' "$LOCKFILE" | sort); do
-      [[ "${PHASE_MAP[$name]:-}" != "$phase" ]] && continue
+      [[ "$(get_phase "$name")" != "$phase" ]] && continue
       row=$((row + 1))
       desc=$(jq -r --arg n "$name" '.skills[$n].description // ""' "$LOCKFILE" | head -c 80)
       echo "| $row | $phase | \`$name\` | $desc | ✅ Active |"

package/scripts/regenerate-lockfile.sh

@@ -20,7 +20,12 @@ for skill_dir in "$REPO_ROOT"/*/; do
     | tr -d '\n' | sed -E 's/[[:space:]]+/ /g')
 
   # Compute SHA-256 of full SKILL.md content (first 16 hex chars for compact uniqueness)
-  sha256=$(sha256sum "$skill_md" | cut -c1-16)
+  # Falls back to shasum for macOS where sha256sum is not installed by default
+  if command -v sha256sum &>/dev/null; then
+    sha256=$(sha256sum "$skill_md" | cut -c1-16)
+  else
+    sha256=$(shasum -a 256 "$skill_md" | cut -c1-16)
+  fi
 
   # Relative path from repo root
   relpath="${skill_dir#$REPO_ROOT/}SKILL.md"

package/scripts/sync-skills.sh

@@ -230,6 +230,13 @@ if [[ -f "$validate_script" ]] && command -v python3 &>/dev/null; then
   fi
 fi
 
+# Regression guard (BUG-2026-07-02T103911): no bash 4+ features in install-chain scripts
+# macOS ships bash 3.2 which lacks declare -A (associative arrays)
+if grep -rn '^declare -A\|^[[:space:]]*declare -A' scripts/sync-skills.sh scripts/generate-skill-index.sh scripts/regenerate-lockfile.sh scripts/build-skill-index.sh 2>/dev/null; then
+  echo "sync-skills: FAIL — bash 4+ features detected in install-chain scripts (not macOS-compatible)" >&2
+  exit 1
+fi
+
 # Regenerate derived reference tables from live SKILL.md frontmatter
 # Only in dev context (with .git) — not during consumer npm install where docs/ is excluded
 if [[ -d "$REPO_ROOT/.git" ]]; then

package/security-review/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: security-review
+model: sonnet
 description: >
   AI-powered security analysis of code changes — traces data flow, detects
   injection, auth bypass, secrets exposure, and unsafe deserialization across

package/skills-lock.json

@@ -193,7 +193,7 @@
     },
     "plan-release": {
       "description": "\"RELEASE-INDEX BUILDER — Sequence elaborated epics into specs/release-plan.yaml with WSJF ordering and BCP baselines. NOT a planning-spine substitute: it does not scope work (scope-work) or write story tasks (plan-work). Use after elaborate-spec when the user wants a versioned release index of epics.\"",
-      "sha256": "d664fde0d07e88ba",
+      "sha256": "6a47658098abc342",
       "path": "plan-release/SKILL.md"
     },
     "plan-work": {
@@ -263,7 +263,7 @@
     },
     "security-review": {
       "description": "> AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files. Use when reviewing pending changes, before release-branch, during verify-work Phase 5, during build-epic Step 0 threat modeling, or when the user says \"security review\" or \"scan for vulns\".",
-      "sha256": "24aeeed072282d0c",
+      "sha256": "8fe9fa518af2aaa6",
       "path": "security-review/SKILL.md"
     },
     "seed-conventions": {