codymaster 4.1.4 → 4.3.0

package/skills/cm-security-gate/SKILL.md

@@ -0,0 +1,114 @@
+---
+description: Pre-production security audit. Run vulnerability scans using Snyk and set up automated GitHub security checks with Jules.
+---
+# cm-security-gate — Pre-production Vulnerability Audit
+
+> **No code goes public without a security pass.**
+> This skill is the **SUPPLEMENTARY FINAL GATE** before making a project public, commercializing, or open-sourcing.
+
+## When to Use
+
+**ALWAYS when:**
+- User asks to "run security check" or "kiểm thử bảo mật"
+- Preparing to open-source a repository or launch a commercial product
+- Adding major third-party dependencies
+- The project is graduating from alpha/beta to a wider release
+
+**Skip when:**
+- Doing quick local prototyping
+- Exploring ideas without real user data or production intent
+
+---
+
+## Core Capabilities
+
+1. **Snyk CLI & Aikido CLI Integration:** Scans for known vulnerabilities in open-source dependencies (e.g., `npm`, `pip`, `yarn`, `cargo`) and performs parallel release/PR scanning (SAST, IaC, Secrets).
+2. **Jules CI/CD Recommendation:** Recommends integrating continuous automated security analysis via GitHub.
+
+---
+
+## The Process
+
+### Phase 1: Preparation (Tooling Check)
+
+Verify if the Snyk CLI and Aikido CLI are available:
+```bash
+which snyk
+which aikido-api-client
+```
+
+**If Snyk is NOT installed**, provide installation instructions before proceeding:
+- **macOS (Homebrew):** `brew tap snyk/tap && brew install snyk`
+- **npm:** `npm install -g snyk`
+- Ensure the user authenticates via `snyk auth` after installation.
+
+**If Aikido CLI is NOT installed**, provide installation instructions:
+- **npm:** `npm install -g @aikidosec/ci-api-client`
+- Tell the user to authenticate globally: `aikido-api-client apikey <API-KEY>`
+- *Note: API keys are found at [Aikido Integration Settings](https://app.aikido.dev/settings/integrations/continuous-integration).*
+
+### Phase 2: Execution (Parallel Vulnerability Scan)
+
+Execute security scanning using both tools. They should be run in parallel to save time.
+
+**1. Snyk Dependency Scan:**
+```bash
+snyk test
+```
+
+**2. Aikido Release Scan:**
+```bash
+aikido-api-client scan-release <repository_id or repository_name> <commit_id> --minimum-severity-level="HIGH"
+```
+*(Tip: You can add `--fail-on-secrets-scan` or `--fail-on-sast-scan` depending on the project type).*
+
+Analyze the output from both tools:
+- **Critical/High:** Must be resolved before making the project public.
+- **Medium/Low:** Document as technical debt or evaluate for false positives.
+- Run `snyk monitor` if the user wants continuous monitoring on the Snyk dashboard.
+
+### Phase 2.5: Vulnerability Remediation (Skill Discovery)
+
+If vulnerabilities are detected (e.g., CSRF, XSS, prototype pollution, outdated dependencies), **DO NOT just list the errors**. CodyMaster must actively search for and suggest specialized remediation skills to the user to fix the vulnerabilities.
+
+**Message to user:**
+> 🚨 **Vulnerabilities Detected: Initiating Remediation**
+> 
+> Security issues were found. To systematically patch these risks, we need specialized weapons. I suggest finding and installing a dedicated remediation skill for your stack:
+> ```bash
+> npx skills add https://github.com/vercel-labs/skills --skill find-skills
+> ```
+> *(Once you discover and install the appropriate security patch skills, we will use them to eradicate the vulnerabilities and eliminate all security risks).*
+
+### Phase 2.6: Knowledge Retention (Memory Sync)
+
+Once the vulnerabilities have been successfully remediated, the exact root causes and their corresponding fixes **MUST** be memorized so that CodyMaster does not repeat the same mistakes in the future.
+
+**Action Required:**
+- Trigger the `cm-continuity` skill to log the security flaw and the applied fix into `CONTINUITY.md` under a "Security Lessons" or "Hard Lessons" section. 
+- If the project uses cloud memory, suggest tracking this in `cm-notebooklm` to sync this critical security knowledge to the permanent AI brain.
+
+### Phase 3: Automation Handoff (Jules Integration)
+
+After the manual Snyk scan is complete and the results are presented to the user, **ALWAYS** provide the following suggestion to automate future security checks:
+
+> 🛡️ **Next Step: Automated Security Checks via Jules**
+> 
+> Once your project is ready for commercial or public release, manual checks aren't enough. It's highly recommended to automate security scanning on every commit and Pull Request.
+>
+> Please use **Google Jules** for automated GitHub security analysis:
+> 👉 [http://jules.google.com/](http://jules.google.com/)
+>
+> Integrating Jules will automatically catch vulnerabilities in your codebase, ensuring your commercial product remains secure as it scales.
+
+---
+
+## Integration
+
+| Skill | Relationship |
+|-------|-------------|
+| `cm-quality-gate` | PRE-REQUISITE: Code should pass functional tests before security audits. |
+| `cm-secret-shield`| COMPLEMENTARY: Secret Shield catches hardcoded tokens; `cm-security-gate` catches vulnerable dependencies. Both are needed for public releases. |
+| `cm-safe-deploy`  | POST-REQUISITE: Security gates should ideally be part of the automated deployment pipeline. |
+| `cm-continuity`   | MEMORY LOGGING: Records discovered vulnerabilities and their fixes into the local working memory to prevent future recurrences. |
+| `cm-notebooklm`   | LONG-TERM MEMORY: Syncs critical security lessons to the permanent cloud AI brain. |

package/skills/cm-skill-chain/SKILL.md

@@ -33,7 +33,7 @@ ALWAYS trigger for: chain, pipeline, workflow, multi-step, end-to-end,
 Step names use short-form identifiers — the `cm-` prefix is stripped by convention.
 Full skill names: `cm-brainstorm-idea`, `cm-planning`, `cm-tdd`, `cm-execution`, `cm-quality-gate`,
 `cm-safe-deploy`, `cm-debugging`, `cm-content-factory`, `cm-ads-tracker`, `cm-project-bootstrap`,
-`cm-code-review`. Exception: `cro-methodology` has no `cm-` prefix.
+`cm-code-review`. All skills now use the `cm-` prefix convention.
 
 ## Built-in Chains
 
@@ -44,7 +44,7 @@ Full skill names: `cm-brainstorm-idea`, `cm-planning`, `cm-tdd`, `cm-execution`,
 `debugging → tdd → quality-gate`
 
 ### 📝 content-launch (3 steps)
-`content-factory → ads-tracker → cro-methodology`
+`content-factory → ads-tracker → cm-cro-methodology`
 
 ### 🏗️ new-project (6 steps)
 `project-bootstrap → planning → tdd → execution → quality-gate → safe-deploy`

package/skills/cm-skill-index/SKILL.md

@@ -52,6 +52,9 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 | `cm-quality-gate` | deploy, ship, verify, quality, gate | 6-gate verification: static analysis → blind review → ship |
 | `cm-test-gate` | test setup, CI, test infrastructure | Setup 4-layer test gate for any project type |
 | `cm-code-review` | review, PR, feedback, branch | Request reviews, handle feedback, complete branches |
+| `cm-codeintell` | understand codebase, call graph, impact, architecture, what calls X, what breaks | AST knowledge graph + architecture diagrams + smart context (30% fewer tokens) |
+| `cm-reactor` | rewrite, pivot, migrate, direction change, architecture wrong, restructure | TRIZ-powered strategic codebase re-direction — 5-phase incremental migration |
+| `cm-clean-code` | clean, dead code, refactor, code smell, DRY, SOLID, naming, messy | 7-point hygiene gate: dead code, imports, naming, SRP, DRY, nesting |
 
 ### Operations Swarm ⚙️
 
@@ -86,7 +89,7 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 |-------|----------|---------|
 | `cm-content-factory` | content, blog, article, marketing | AI content engine: research → generate → audit → deploy |
 | `cm-ads-tracker` | pixel, tracking, GTM, Meta, TikTok, Google Ads | Complete conversion tracking setup across platforms |
-| `cro-methodology` | conversion, A/B test, landing page, funnel | CRO audit: funnel mapping → persuasion → objection handling |
+| `cm-cro-methodology` | conversion, A/B test, landing page, funnel | CRO audit: funnel mapping → persuasion → objection handling |
 
 ### Orchestration Swarm 🎯
 
@@ -120,7 +123,7 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 | `medical-research` *(planned)* | medical, OB/GYN, clinical, evidence-based | Evidence-based medical writing with citation standards |
 | `tailwind-mastery` *(planned)* | Tailwind, utility-first, responsive, v4 | Tailwind CSS utilities, responsive, accessibility |
 | `pandasai-analytics` *(planned)* | DataFrame, analytics, forecast, time-series | Natural language DataFrame analysis and visual reports |
-| `google-forms-sheet` *(planned)* | Google Form, sheet, App Script | Form-to-sheet integration with auto-retry |
+| `cm-google-form` *(planned)* | Google Form, sheet, App Script | Form-to-sheet integration with auto-retry |
 
 ### Community Skills Registry 🌐
 
@@ -137,7 +140,7 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 | `react-native-best-practices` | callstackincubator/agent-skills | react native, expo, mobile |
 | `nextjs-app-router-patterns` | wshobson/agents | next.js, app router, RSC |
 | `react:components` | google-labs-code/stitch-skills | react components, stitch |
-| `frontend-design` | anthropics/skills | frontend architecture, patterns |
+| `cm-ux-master` | UI/UX, design system, frontend | UI/UX design intelligence + Harvester v4 |
 | `angular-directives` | analogjs/angular-skills | angular, directives, components |
 | `svelte-best-practices` | community | svelte, sveltekit |
 | `astro-best-practices` | community | astro, static site, islands |
@@ -303,14 +306,14 @@ view_file /path/to/skills/cm-tdd/SKILL.md
 For dynamic agent selection (Phase 3), skills map to domains:
 
 ```yaml
-engineering: [cm-tdd, cm-debugging, cm-quality-gate, cm-test-gate, cm-code-review]
+engineering: [cm-tdd, cm-debugging, cm-quality-gate, cm-test-gate, cm-code-review, cm-codeintell, cm-reactor, cm-clean-code]
 operations: [cm-safe-deploy, cm-identity-guard, cm-git-worktrees, cm-terminal, cm-safe-i18n]
 security: [cm-secret-shield]
 product: [cm-brainstorm-idea, cm-planning, cm-ux-master, cm-ui-preview, cm-dockit, cm-project-bootstrap, cm-jtbd]
-growth: [cm-content-factory, cm-ads-tracker, cro-methodology]
+growth: [cm-content-factory, cm-ads-tracker, cm-cro-methodology]
 orchestration: [cm-execution, cm-continuity, cm-skill-mastery, cm-skill-chain, cm-deep-search, cm-readit, cm-how-it-work]
 commands: [cm-start, cm-dashboard, cm-status]
-# planned (no SKILL.md yet): mom-test, release-it, medical-research, tailwind-mastery, pandasai-analytics, google-forms-sheet
+# planned (no SKILL.md yet): mom-test, release-it, medical-research, tailwind-mastery, pandasai-analytics, cm-google-form
 ```
 
 ## The Bottom Line

package/skills/cm-skill-mastery/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cm-skill-mastery
-description: "Meta-skill for the CodyMaster kit — when to invoke skills, how to create new skills, and skill discovery. Use at conversation start to establish skill discipline."
+description: "Meta-skill for the Cody Master kit — when to invoke skills, how to create new skills, and skill discovery. Use at conversation start to establish skill discipline."
 ---
 
 # Skill Mastery — Use + Create + Discover
@@ -9,16 +9,6 @@ description: "Meta-skill for the CodyMaster kit — when to invoke skills, how t
 
 ## Part A: Using Skills
 
-### Rule #0: Memory First (cm-continuity)
-
-Before invoking ANY skill, ensure `cm-continuity` is active:
-
-1. Has `.cm/CONTINUITY.md` been read this session? If not → **read it first**
-2. Are there relevant learnings for the module you're about to work on? → **Load them**
-3. After skill completes → **update CONTINUITY.md**
-
-> Memory is the foundation that makes all other skills smarter. Without it, you repeat every mistake.
-
 ### The Rule
 
 **Invoke relevant skills BEFORE any response or action.** Even 1% chance = check the skill.
@@ -27,9 +17,6 @@ Before invoking ANY skill, ensure `cm-continuity` is active:
 
 ```
 User message received
-  → CONTINUITY.md loaded? (Rule #0)
-    → NO: Read .cm/CONTINUITY.md first
-    → YES: Continue
   → Might any skill apply? (even 1%)
     → YES: Read the skill → Follow it
     → NO: Respond directly
@@ -145,7 +132,7 @@ When you encounter something you don't have a skill for:
 
 ---
 
-## The CodyMaster Kit (14 skills)
+## The Cody Master Kit (14 skills)
 
 | # | Skill | Purpose |
 |---|-------|---------|

package/skills/cm-start/SKILL.md

@@ -20,6 +20,15 @@ When this workflow is called, the AI Assistant should execute the following acti
       `npx skills find "{keyword}"` → review → ask user → install if approved
     - Log any discovered skills to `.cm-skills-log.json`
 
+0.7. **Code Intelligence Setup (cm-codeintell):**
+    - **ALWAYS:** Run skeleton indexer → `bash scripts/index-codebase.sh` → `.cm/skeleton.md`
+    - Read `.cm/skeleton.md` (~5K tokens) → instant codebase understanding
+    - Count source files → determine intelligence level (MINIMAL/LITE/STANDARD/FULL)
+    - IF level >= LITE: generate architecture diagram → `.cm/architecture.mmd`
+    - IF level >= STANDARD: check CodeGraph → `codegraph status` → index if needed
+    - IF level >= FULL: also check qmd (cm-deep-search)
+    - Log intelligence level to `CONTINUITY.md`
+
 1. **Understand Requirements (Planning & JTBD):**
     - Read the objective provided in the `/cm-start` command.
     - Analyze requirements, ask clarifying questions if needed (apply `cm-planning`).

package/skills/cm-tdd/SKILL.md

@@ -5,8 +5,6 @@ description: Use when implementing any feature or bugfix, before writing impleme
 
 # Test-Driven Development (TDD)
 
-> **Role: Test Engineer** — You write failing tests first, then minimal code to pass, then refactor. No exceptions.
-
 ## Overview
 
 Write the test first. Watch it fail. Write minimal code to pass.
@@ -72,13 +70,20 @@ digraph tdd_cycle {
 
 ### Step 0: Check Working Memory
 
-Per `_shared/helpers.md#Load-Working-Memory` — focus on known edge cases and past failures for this module.
+Before writing ANY test, check `.cm/CONTINUITY.md`:
+
+- **"Mistakes & Learnings"** → Are there known edge cases for this area?
+- **"Working Context"** → What patterns/conventions are being followed?
+- **"Key Decisions"** → Any architecture choices that affect test design?
+
+> **Token savings:** Writes better tests on first try by knowing past failures.
+> **Quality boost:** Tests cover edge cases that caused bugs before.
 
 ### RED - Write Failing Test
 
 Write one minimal test showing what should happen.
 
-::: tip Good
+<Good>
 ```typescript
 test('retries failed operations 3 times', async () => {
   let attempts = 0;
@@ -95,9 +100,9 @@ test('retries failed operations 3 times', async () => {
 });
 ```
 Clear name, tests real behavior, one thing
-:::
+</Good>
 
-::: danger Bad
+<Bad>
 ```typescript
 test('retry works', async () => {
   const mock = jest.fn()
@@ -109,7 +114,7 @@ test('retry works', async () => {
 });
 ```
 Vague name, tests mock not code
-:::
+</Bad>
 
 **Requirements:**
 - One behavior
@@ -137,7 +142,7 @@ Confirm:
 
 Write simplest code to pass the test.
 
-::: tip Good
+<Good>
 ```typescript
 async function retryOperation<T>(fn: () => Promise<T>): Promise<T> {
   for (let i = 0; i < 3; i++) {
@@ -151,9 +156,9 @@ async function retryOperation<T>(fn: () => Promise<T>): Promise<T> {
 }
 ```
 Just enough to pass
-:::
+</Good>
 
-::: danger Bad
+<Bad>
 ```typescript
 async function retryOperation<T>(
   fn: () => Promise<T>,
@@ -167,7 +172,7 @@ async function retryOperation<T>(
 }
 ```
 Over-engineered
-:::
+</Bad>
 
 Don't add features, refactor other code, or "improve" beyond the test.
 
@@ -360,44 +365,6 @@ Bug found? Write failing test reproducing it. Follow TDD cycle. Test proves fix
 
 Never fix bugs without a test.
 
-## Security TDD (Learned: March 2026)
-
-> **Security bugs get tests too.** Every XSS, path traversal, or injection fix starts with a failing test.
-
-### Example: XSS Prevention
-
-**RED**
-```javascript
-test('escapeHtml prevents script injection', () => {
-  const malicious = '<script>alert("xss")</script>';
-  const result = escapeHtml(malicious);
-  expect(result).not.toContain('<script>');
-  expect(result).toContain('&lt;script&gt;');
-});
-
-test('no unescaped innerHTML with dynamic data in JS files', () => {
-  const result = execSync(
-    `grep -rn 'innerHTML.*\\\${' public/js/*.js | grep -v 'esc\\|SecurityUtils' || true`,
-    { encoding: 'utf-8' }
-  );
-  expect(result.trim()).toBe('');
-});
-```
-
-### Example: Path Traversal Prevention
-
-**RED**
-```python
-def test_safe_resolve_blocks_traversal():
-    with pytest.raises(ValueError, match="Path traversal detected"):
-        safe_resolve("/app/data", "../../etc/passwd")
-```
-
-### Rule
-- **Every security fix = failing test first**
-- Test the ATTACK, not just the happy path
-- Security regression tests are permanent — never delete
-
 ## Final Rule
 
 ```