code-ai-installer 1.5.6 → 2.1.0

package/locales/en/.agents/skills/cloud-infrastructure-security/SKILL.md

@@ -0,0 +1,185 @@
+---
+name: cloud-infrastructure-security
+description: Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR.
+---
+
+# Skill: Cloud Infrastructure Security Review
+
+Security review for cloud environments, infrastructure as code, and CI/CD pipelines.
+
+**Sections:**
+1. [Workflow](#1-workflow)
+2. [Checklist (Cloud Security Baseline)](#2-checklist)
+3. [Verification Methods](#3-methods)
+4. [Red Flags](#4-red-flags)
+5. [Output Template](#5-output)
+
+---
+
+## 1. Workflow
+
+```
+1. Get the architecture context (from $architecture-doc & $deployment-ci-plan)
+   └── Hosting platform, CI/CD tools, external services
+
+2. For each cloud security domain:
+   a. IAM & Authentication
+   b. Secrets Management
+   c. Network Security & Boundaries
+   d. Logging & Monitoring
+   e. Compute & Container Security
+   f. CI/CD Supply Chain Security
+
+3. Review configuration files (IaC, manifests, workflow files)
+   └── Search for hardcoded secrets, misconfigurations
+
+4. Formulate the Security Gap Report (Output Template)
+```
+
+---
+
+## 2. Checklist (Cloud Security Baseline)
+
+### 2.1 IAM & Authentication
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| CLOUD-01 | Principle of Least Privilege (PoLP) enforced for all roles | 🔴 P0 | ☐ |
+| CLOUD-02 | No shared accounts/credentials used | 🔴 P0 | ☐ |
+| CLOUD-03 | MFA enforced for all console access | 🔴 P0 | ☐ |
+| CLOUD-04 | Service Accounts instead of user credentials for automation | 🔴 P0 | ☐ |
+
+### 2.2 Secrets Management
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| CLOUD-05 | Secrets stored in a dedicated Secret Manager (Vault, AWS Secrets, GitHub Secrets) | 🔴 P0 | ☐ |
+| CLOUD-06 | NO hardcoded credentials in source code or `Dockerfile` | 🔴 P0 | ☐ |
+| CLOUD-07 | Environment variables not exposing secrets (e.g., in React frontend code) | 🔴 P0 | ☐ |
+| CLOUD-08 | Audit trail for secret access enabled | 🟠 P1 | ☐ |
+
+### 2.3 Network Security & Boundaries
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| CLOUD-09 | Default deny inbound traffic rules | 🔴 P0 | ☐ |
+| CLOUD-10 | Databases NOT exposed to the public internet | 🔴 P0 | ☐ |
+| CLOUD-11 | WAF / DDoS protection active for public endpoints | 🟠 P1 | ☐ |
+| CLOUD-12 | TLS 1.2+ enforced for all in-transit data (HTTPS) | 🔴 P0 | ☐ |
+| CLOUD-13 | Private network/VPC/Subnets used to isolate layers | 🟠 P1 | ☐ |
+
+### 2.4 Logging & Monitoring
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| CLOUD-14 | Centralized logging for all infrastructure components | 🟠 P1 | ☐ |
+| CLOUD-15 | Access logs enabled on storage buckets / databases | 🟡 P2 | ☐ |
+| CLOUD-16 | Alerts configured for critical security events (failed logins, root access) | 🟠 P1 | ☐ |
+
+### 2.5 Compute & Container Security
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| CLOUD-17 | Containers do NOT run as `root` user | 🔴 P0 | ☐ |
+| CLOUD-18 | Minimal base images used (e.g., `alpine`, `distroless`) | 🟠 P1 | ☐ |
+| CLOUD-19 | Read-only root filesystem where possible | 🟡 P2 | ☐ |
+
+### 2.6 CI/CD & Supply Chain
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| CLOUD-20 | Dependency scanning (SCA) active in CI | 🔴 P0 | ☐ |
+| CLOUD-21 | SAST (Static Analysis) tools running on PRs | 🟠 P1 | ☐ |
+| CLOUD-22 | Secrets scanning active (preventing commits with secrets) | 🔴 P0 | ☐ |
+| CLOUD-23 | Branch protection rules: Require PR reviews, disallow direct commits to `main` | 🔴 P0 | ☐ |
+
+---
+
+## 3. Verification Methods
+
+### Grep patterns for misconfigurations
+
+```bash
+# 🔴 P0: Detect Hardcoded Secrets (General patterns)
+grep_search: Query="password\s*=\s*[\"'][^\"']+[\"']" IsRegex=true
+grep_search: Query="secret\s*=\s*[\"'][^\"']+[\"']" IsRegex=true
+grep_search: Query="token\s*=\s*[\"'][a-zA-Z0-9_\-]+[\"']" IsRegex=true
+grep_search: Query="api[_-]?key\s*=\s*[\"'][a-zA-Z0-9_\-]+[\"']" IsRegex=true
+
+# 🔴 P0: Dockerfile running as root
+grep_search: Query="USER root" Includes=["Dockerfile*"]
+# Verify if there is a 'USER node' (or similar non-root) at the end of Dockerfile
+
+# 🔴 P0: Exposed database ports in Docker Compose
+grep_search: Query="\"27017:27017\"" Includes=["docker-compose.yml"]
+grep_search: Query="\"5432:5432\"" Includes=["docker-compose.yml"]
+
+# 🟠 P1: Missing SCA/vuln checks in GitHub Actions
+grep_search: Query="npm audit" Includes=[".github/workflows/*"]
+grep_search: Query="dependabot" Includes=[".github/workflows/*"]
+```
+
+---
+
+## 4. Red Flags
+
+| Red Flag | Description | Severity | Fix |
+|----------|-------------|----------|-----|
+| **Public Database** | DB port (e.g., 5432, 27017) bound to `0.0.0.0` or open in Security Group | 🔴 P0 | Bind to localhost (`127.0.0.1`) or inside private VPC. |
+| **Secrets in code** | AWS keys, API tokens committed to repository | 🔴 P0 | Revoke immediately. Use `.env` file + secret manager. |
+| **Full Admin IAM** | Workloads or user roles have `AdministratorAccess` wildcard (`*`) | 🔴 P0 | Scope down to specific actions and resources (PoLP). |
+| **Root Containers** | Docker images running as default `root` | 🔴 P0 | Add `USER node` (or equivalent) in Dockerfile. |
+| **No Branch Protection** | Main branch accepts direct commits without review | 🔴 P0 | Enforce PRs and 1+ reviewers in GitHub settings. |
+
+---
+
+## 5. Output Template
+
+```markdown
+# Cloud Infrastructure Security Review
+
+**Scope:** <Infrastructure repo / CI/CD pipeline / Module>
+**Reviewer:** Reviewer Agent
+**Date:** YYYY-MM-DD
+**Reference:** $deployment-ci-plan, $docker-kubernetes-architecture
+
+## Findings Summary
+
+- **Total Checks Assessed:** X
+- **P0 Blockers:** Y
+- **P1 Concerns:** Z
+- **P2 Recommendations:** W
+
+## Detailed Findings
+
+| # | Severity | Check Code | File/Component | Finding Description | Fix Recommended |
+|---|----------|------------|----------------|---------------------|-----------------|
+| 1 | 🔴 P0 | CLOUD-06 | `docker-compose.yml` | DB password hardcoded (`MYSQL_PASSWORD=root`) | Inject via `.env` file and Docker Secrets. |
+| 2 | 🔴 P0 | CLOUD-17 | `Dockerfile` | Image runs as root | Add `USER node` before `CMD`. |
+| 3 | 🟠 P1 | CLOUD-21 | `.github/workflows/ci.yml` | No SAST/SCA step in pipeline | Add `npm audit` or CodeQL step to CI. |
+| 4 | 🟡 P2 | CLOUD-19 | `deployment.yaml` | Root FS is writable | Mount specific paths as writeable, set `readOnlyRootFilesystem: true`. |
+
+## Compliance Overview (by Domain)
+
+| Domain | Status |
+|--------|:------:|
+| IAM & Auth | ✅ |
+| Secrets Management | ❌ |
+| Network Security | ✅ |
+| Logging & Monitoring | ⚠️ |
+| Compute/Containers | ❌ |
+| CI/CD & Supply Chain | ⚠️ |
+
+## Verdict
+- [ ] **PASS** - Cloud baseline met. Safe to deploy.
+- [ ] **WARN** - Minor deviations (P1/P2). Fix before next release.
+- [x] **FAIL** - Critical P0 issues found. Do NOT deploy until fixed.
+```
+
+---
+
+## See also
+- `$deployment-ci-plan` — The plan this review acts upon.
+- `$docker-kubernetes-architecture` — Best practices for containerization.
+- `$dependency-supply-chain-review` — Deeper dive into SCA and dependencies.
+- `$security-review-baseline` — AppSec layer (complementary to this Cloud/Infra layer).

package/locales/en/.agents/skills/cloud-infrastructure-security/agents/claude.json

@@ -0,0 +1,19 @@
+{
+  "name": "cloud-infrastructure-security",
+  "display_name": "Cloud Infrastructure Security Review",
+  "description": "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR.",
+  "default_prompt": "Use $cloud-infrastructure-security when the task matches the \"Cloud Infrastructure Security Review\" skill.",
+  "triggers": [
+    "cloud-infrastructure-security",
+    "cloud infrastructure security",
+    "Cloud Infrastructure Security Review",
+    "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR"
+  ],
+  "capabilities": [
+    "cloud",
+    "infrastructure",
+    "security"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/cloud-infrastructure-security/agents/copilot.json

@@ -0,0 +1,19 @@
+{
+  "name": "cloud-infrastructure-security",
+  "display_name": "Cloud Infrastructure Security Review",
+  "description": "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR.",
+  "default_prompt": "Use $cloud-infrastructure-security when the task matches the \"Cloud Infrastructure Security Review\" skill.",
+  "triggers": [
+    "cloud-infrastructure-security",
+    "cloud infrastructure security",
+    "Cloud Infrastructure Security Review",
+    "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR"
+  ],
+  "capabilities": [
+    "cloud",
+    "infrastructure",
+    "security"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/cloud-infrastructure-security/agents/gemini.json

@@ -0,0 +1,19 @@
+{
+  "name": "cloud-infrastructure-security",
+  "display_name": "Cloud Infrastructure Security Review",
+  "description": "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR.",
+  "default_prompt": "Use $cloud-infrastructure-security when the task matches the \"Cloud Infrastructure Security Review\" skill.",
+  "triggers": [
+    "cloud-infrastructure-security",
+    "cloud infrastructure security",
+    "Cloud Infrastructure Security Review",
+    "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR"
+  ],
+  "capabilities": [
+    "cloud",
+    "infrastructure",
+    "security"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/cloud-infrastructure-security/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "Cloud Infrastructure Security Review"
+  short_description: "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply c…"
+  default_prompt: "Use $cloud-infrastructure-security when the task matches the \"Cloud Infrastructure Security Review\" skill."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true

package/locales/en/.agents/skills/cloud-infrastructure-security/agents/qwen.json

@@ -0,0 +1,19 @@
+{
+  "name": "cloud-infrastructure-security",
+  "display_name": "Cloud Infrastructure Security Review",
+  "description": "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR.",
+  "default_prompt": "Use $cloud-infrastructure-security when the task matches the \"Cloud Infrastructure Security Review\" skill.",
+  "triggers": [
+    "cloud-infrastructure-security",
+    "cloud infrastructure security",
+    "Cloud Infrastructure Security Review",
+    "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR"
+  ],
+  "capabilities": [
+    "cloud",
+    "infrastructure",
+    "security"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/cloud-infrastructure-security/agents/skill.yaml

@@ -0,0 +1,23 @@
+version: 1
+name: "cloud-infrastructure-security"
+display_name: "Cloud Infrastructure Security Review"
+description: "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR."
+default_prompt: "Use $cloud-infrastructure-security when the task matches the \"Cloud Infrastructure Security Review\" skill."
+triggers:
+  - "cloud-infrastructure-security"
+  - "cloud infrastructure security"
+  - "Cloud Infrastructure Security Review"
+  - "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR"
+capabilities:
+  - "cloud"
+  - "infrastructure"
+  - "security"
+tools: []
+invocation:
+  explicit: true
+  implicit: true
+localization:
+  default_locale: "en"
+  available_locales:
+    - "ru"
+    - "en"

package/locales/en/.agents/skills/code-review-checklist/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: code-review-checklist
+description: Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done.
+---
+
+# Skill: Universal Code Review Checklist
+
+Checklist for the Reviewer Agent or self-review before handoff.
+
+**Sections:**
+1. [When to use](#1-when-to-use)
+2. [Checklist](#2-checklist)
+3. [Reviewer's Output Format](#3-reviewer-output)
+4. [Anti-patterns](#4-anti-patterns)
+
+---
+
+## 1. When to use
+
+Use this checklist *after* the Senior Full Stack developer has finished coding, but *before* passing the task to QA (Tester) or closing it.
+
+The Reviewer Agent uses this checklist as the primary framework.
+
+---
+
+## 2. Checklist
+
+### 2.1 Definition of Done (DoD)
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| REV-01 | PRD requirements are met (no missing scope) | 🔴 P0 | ☐ |
+| REV-02 | Code runs without crashing (no obvious syntax errors) | 🔴 P0 | ☐ |
+| REV-03 | UX Spec visually matched (no missing UI elements) | 🔴 P0 | ☐ |
+| REV-04 | No `console.log` or debug code left behind | 🟠 P1 | ☐ |
+
+### 2.2 Architecture & Contracts
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| REV-05 | Code follows `$architecture-doc` layers | 🔴 P0 | ☐ |
+| REV-06 | API implementation matches `$api-contracts` exactly | 🔴 P0 | ☐ |
+| REV-07 | New data model (if any) is documented | 🟠 P1 | ☐ |
+| REV-08 | ADR created if a significant architectural choice was made | 🟠 P1 | ☐ |
+
+### 2.3 Code Quality & Best Practices
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| REV-09 | ESLint / Type checking passes (no red squiggles) | 🔴 P0 | ☐ |
+| REV-10 | Meaningful variable/function naming (no `data1`, `temp`) | 🟠 P1 | ☐ |
+| REV-11 | JSDoc present for all functions | 🔴 P0 | ☐ |
+| REV-12 | Functions are short and focused (< 40 lines ideally) | 🟠 P1 | ☐ |
+| REV-13 | No magic numbers or hardcoded strings | 🟠 P1 | ☐ |
+| REV-14 | React: No useless re-renders, correct memoization | 🟠 P1 | ☐ |
+| REV-15 | Go: correct error handling (`if err != nil`), no hidden panics | 🔴 P0 | ☐ |
+
+### 2.4 Error Handling & Logging
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| REV-16 | Errors are caught (try/catch or `.catch()`) and handled | 🔴 P0 | ☐ |
+| REV-17 | Error format follows contract (`{ error: { code, message } }`) | 🔴 P0 | ☐ |
+| REV-18 | Structured logging used for significant events (not just `console.error`) | 🟠 P1 | ☐ |
+
+### 2.5 Security Basics
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| REV-19 | Inputs are validated against boundary schemas (e.g., Zod) | 🔴 P0 | ☐ |
+| REV-20 | Protected routes check Auth properly | 🔴 P0 | ☐ |
+| REV-21 | No secrets (API keys, passwords) in code or frontend bundle | 🔴 P0 | ☐ |
+| REV-22 | Safe HTML rendering (dangerouslySetInnerHTML only if sanitized) | 🔴 P0 | ☐ |
+
+### 2.6 Testing
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| REV-23 | Unit tests written or updated for new logic | 🔴 P0 | ☐ |
+| REV-24 | Tests pass successfully | 🔴 P0 | ☐ |
+| REV-25 | Edge cases and error paths tested | 🟠 P1 | ☐ |
+
+---
+
+## 3. Reviewer's Output Format
+
+If passing the review:
+
+```markdown
+# Code Review: Approved
+
+All checks passed.
+- **DoD:** Met
+- **Code Quality:** Good, proper TDD cycle used.
+- **Contracts:** API matches spec perfectly.
+
+**Next Action:** Handoff to Tester Agent.
+```
+
+If requesting changes:
+
+```markdown
+# Code Review: Changes Requested
+
+## P0 Blockers (Must Fix)
+- **REV-11 (JSDoc):** `calculateTotal()` in `src/utils/cart.js:45` is missing JSDoc.
+- **REV-19 (Security):** `POST /checkout` is missing Zod body validation.
+
+## P1 Recommendations (Should Fix)
+- **REV-13 (Code Quality):** Hardcoded tax rate `0.2` in `cart.js:52`. Extract to constant.
+- **REV-14 (React):** Define `fetchData` outside `useEffect` or wrap in `useCallback` in `Cart.tsx:20`.
+
+**Next Action:** Return to Senior Full Stack to fix P0/P1 issues.
+```
+
+---
+
+## 4. Anti-patterns
+
+| ❌ Anti-pattern | ✅ Solution |
+|----------------|-----------|
+| **Rubber stamping** | Actually run `npm run test` or check the code logic. Don't just say "LGTM". |
+| **Nitpicking without P0/P1 labels** | Clearly separate blockers (P0) from stylistic suggestions (P2). |
+| **Ignoring the contract** | The code might be beautiful but if it returns HTTP 200 instead of 201 as per `$api-contracts`, it's a bug. |
+| **Skipping security checks** | Always check for input validation and auth boundaries. |
+
+---
+
+## See also
+- `$api-contract-compliance-review` — Deeper dive into API contracts.
+- `$architecture-compliance-review` — Deeper dive into layer boundaries.
+- `$security-review` — Deeper dive into AppSec.
+- `$tests-quality-review` — Deeper dive into test quality.

package/locales/en/.agents/skills/code-review-checklist/agents/claude.json

@@ -0,0 +1,19 @@
+{
+  "name": "code-review-checklist",
+  "display_name": "Universal Code Review Checklist",
+  "description": "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done.",
+  "default_prompt": "Use $code-review-checklist when the task matches the \"Universal Code Review Checklist\" skill.",
+  "triggers": [
+    "code-review-checklist",
+    "code review checklist",
+    "Universal Code Review Checklist",
+    "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done"
+  ],
+  "capabilities": [
+    "code",
+    "review",
+    "checklist"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/code-review-checklist/agents/copilot.json

@@ -0,0 +1,19 @@
+{
+  "name": "code-review-checklist",
+  "display_name": "Universal Code Review Checklist",
+  "description": "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done.",
+  "default_prompt": "Use $code-review-checklist when the task matches the \"Universal Code Review Checklist\" skill.",
+  "triggers": [
+    "code-review-checklist",
+    "code review checklist",
+    "Universal Code Review Checklist",
+    "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done"
+  ],
+  "capabilities": [
+    "code",
+    "review",
+    "checklist"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/code-review-checklist/agents/gemini.json

@@ -0,0 +1,19 @@
+{
+  "name": "code-review-checklist",
+  "display_name": "Universal Code Review Checklist",
+  "description": "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done.",
+  "default_prompt": "Use $code-review-checklist when the task matches the \"Universal Code Review Checklist\" skill.",
+  "triggers": [
+    "code-review-checklist",
+    "code review checklist",
+    "Universal Code Review Checklist",
+    "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done"
+  ],
+  "capabilities": [
+    "code",
+    "review",
+    "checklist"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/code-review-checklist/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "Universal Code Review Checklist"
+  short_description: "Universal review checklist — code quality, readability, testability, security, contracts, Defin…"
+  default_prompt: "Use $code-review-checklist when the task matches the \"Universal Code Review Checklist\" skill."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true

package/locales/en/.agents/skills/code-review-checklist/agents/qwen.json

@@ -0,0 +1,19 @@
+{
+  "name": "code-review-checklist",
+  "display_name": "Universal Code Review Checklist",
+  "description": "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done.",
+  "default_prompt": "Use $code-review-checklist when the task matches the \"Universal Code Review Checklist\" skill.",
+  "triggers": [
+    "code-review-checklist",
+    "code review checklist",
+    "Universal Code Review Checklist",
+    "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done"
+  ],
+  "capabilities": [
+    "code",
+    "review",
+    "checklist"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/code-review-checklist/agents/skill.yaml

@@ -0,0 +1,23 @@
+version: 1
+name: "code-review-checklist"
+display_name: "Universal Code Review Checklist"
+description: "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done."
+default_prompt: "Use $code-review-checklist when the task matches the \"Universal Code Review Checklist\" skill."
+triggers:
+  - "code-review-checklist"
+  - "code review checklist"
+  - "Universal Code Review Checklist"
+  - "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done"
+capabilities:
+  - "code"
+  - "review"
+  - "checklist"
+tools: []
+invocation:
+  explicit: true
+  implicit: true
+localization:
+  default_locale: "en"
+  available_locales:
+    - "ru"
+    - "en"