codymaster 4.4.3 โ†’ 4.4.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/CHANGELOG.md +17 -0
  2. package/README.md +45 -23
  3. package/package.json +5 -2
  4. package/skills/cm-quality-gate/SKILL.md +11 -1
  5. package/skills/cm-safe-deploy/SKILL.md +38 -2
  6. package/skills/cm-security-gate/SKILL.md +158 -34
  7. package/skills/cm-test-gate/SKILL.md +3 -0
package/CHANGELOG.md CHANGED
@@ -4,6 +4,23 @@ All notable changes to this project will be documented in this file.
4
4
 
5
5
  Categories: ๐Ÿš€ **Improvements** | ๐Ÿ› **Bug Fixes** | ๐Ÿ”’ **Security**
6
6
 
7
+ ## [4.4.3] - 2026-03-29
8
+
9
+ ### ๐Ÿš€ Improvements โ€” The Self-Healing Update
10
+
11
+ - **68+ Skill Milestone** โ€” CodyMaster arsenal grows from 60+ to 68+ battle-tested skills with 8 new capabilities.
12
+ - **๐Ÿงฌ Self-Healing AI Pipeline** โ€” Skills now monitor, score, and auto-repair themselves:
13
+ - `cm-skill-health` โ€” Real-time quality monitoring with SQLite-backed metrics dashboard (invocations, success rate, token usage, health scores).
14
+ - `cm-skill-evolution` โ€” 3-mode evolution engine (FIX/DERIVED/CAPTURED) with version DAG and lineage tracking. Auto-patches degraded skills.
15
+ - `cm-skill-search` โ€” BM25 + health-score ranking for intelligent skill discovery.
16
+ - `cm-skill-share` โ€” Export/import skills across teams and machines with version integrity.
17
+ - **๐Ÿข cm-frappe-agent** โ€” Full-stack Frappe/ERPNext development agent with 7-layer architecture: doctypes, workflows, REST APIs, permissions, fixtures, performance optimization, and production deploys.
18
+ - **๐Ÿš€ Growth Hacking Engine** โ€” `cm-growth-hacking` generates complete conversion systems (Bottom Sheet + Calendar CTA + Tracking) with industry auto-detection.
19
+ - **cm-auto-publisher** โ€” Publishing automation bridge: AI agents โ†’ Content Factory Router โ†’ any Astro site.
20
+ - **cm-clean-code** โ€” TRIZ-powered code hygiene gate: dead code detection, duplicate elimination, naming analysis.
21
+ - **cm-reactor** โ€” Strategic codebase re-direction when requirements change or tech debt blocks progress.
22
+ - **Documentation Overhaul** โ€” README (all 6 languages), CHANGELOG, and new Self-Healing AI deep-dive doc updated.
23
+
7
24
  ## [4.4.2] - 2026-03-29
8
25
 
9
26
  ### ๐Ÿš€ Improvements
package/README.md CHANGED
@@ -6,11 +6,11 @@
6
6
 
7
7
  ### Your AI Agent is smart. CodyMaster makes it *wise*.
8
8
 
9
- **60+ Skills ยท 11 Commands ยท 1 Plugin ยท 7+ Platforms ยท 6 Languages**
9
+ **68+ Skills ยท 11 Commands ยท 1 Plugin ยท 7+ Platforms ยท 6 Languages**
10
10
 
11
11
  <p align="center">
12
- <img alt="Version" src="https://img.shields.io/badge/version-4.3.0-blue.svg?cacheSeconds=2592000" />
13
- <img alt="Skills" src="https://img.shields.io/badge/skills-60+-success.svg" />
12
+ <img alt="Version" src="https://img.shields.io/badge/version-4.4.3-blue.svg?cacheSeconds=2592000" />
13
+ <img alt="Skills" src="https://img.shields.io/badge/skills-68+-success.svg" />
14
14
  <img alt="Platforms" src="https://img.shields.io/badge/platforms-7+-orange.svg" />
15
15
  <img alt="Open Source" src="https://img.shields.io/badge/license-MIT-purple.svg" />
16
16
  <a href="https://github.com/tody-agent/codymaster#readme" target="_blank">
@@ -58,29 +58,30 @@ But then reality hits:
58
58
 
59
59
  ## ๐ŸŸข The Solution: An Entire Senior Team in One Kit
60
60
 
61
- CodyMaster isn't just "another AI skills pack." It's **10+ years of product management experience + 6 months of battle-tested vibe coding**, distilled into 60+ interconnected skills that work as a **single integrated system**.
61
+ CodyMaster isn't just "another AI skills pack." It's **10+ years of product management experience + 6 months of battle-tested vibe coding**, distilled into 68+ interconnected skills that work as a **single integrated system**.
62
62
 
63
63
  When you install CodyMaster, you're not adding skills.
64
64
  **You're hiring an entire senior team:**
65
65
 
66
66
  ```mermaid
67
67
  graph TD
68
- A["๐Ÿง  CodyMaster Kit"] --> B["๐Ÿ‘จโ€๐Ÿ’ป Senior Developer<br/><i>cm-tdd ยท cm-debugging ยท cm-code-review</i>"]
68
+ A["๐Ÿง  CodyMaster Kit"] --> B["๐Ÿ‘จโ€๐Ÿ’ป Senior Developer<br/><i>cm-tdd ยท cm-debugging ยท cm-code-review ยท cm-clean-code</i>"]
69
69
  A --> C["๐ŸŽจ UX Lead<br/><i>cm-design-system ยท cm-ux-master ยท cm-ui-preview</i>"]
70
70
  A --> D["๐Ÿ“‹ Product Manager<br/><i>cm-planning ยท cm-brainstorm-idea ยท cm-jtbd</i>"]
71
71
  A --> E["๐Ÿ”’ DevOps Engineer<br/><i>cm-safe-deploy ยท cm-secret-shield ยท cm-security-gate ยท cm-identity-guard</i>"]
72
- A --> F["๐Ÿ“ Technical Writer<br/><i>cm-dockit ยท cm-content-factory</i>"]
73
- A --> G["๐Ÿ“ˆ Growth Marketer<br/><i>cm-ads-tracker ยท cro-methodology</i>"]
72
+ A --> F["๐Ÿ“ Technical Writer<br/><i>cm-dockit ยท cm-content-factory ยท cm-auto-publisher</i>"]
73
+ A --> G["๐Ÿ“ˆ Growth Marketer<br/><i>cm-ads-tracker ยท cm-cro-methodology ยท cm-growth-hacking</i>"]
74
+ A --> H["๐Ÿญ Enterprise Dev<br/><i>cm-frappe-agent ยท cm-booking-calendar ยท cm-google-form</i>"]
74
75
  style A fill:#fbc531,stroke:#e1b12c,color:#2f3640,stroke-width:3px
75
76
  classDef team fill:#2f3640,stroke:#dcdde1,stroke-width:1px,color:#fff;
76
- class B,C,D,E,F,G team;
77
+ class B,C,D,E,F,G,H team;
77
78
  ```
78
79
 
79
80
  ---
80
81
 
81
82
  ## โšก What Makes CodyMaster Different
82
83
 
83
- Other skill packs give you loose tools. CodyMaster gives you an **interconnected operating system** for your AI. CodyMaster provides 60+ skills that chain, share memory, and communicate.
84
+ Other skill packs give you loose tools. CodyMaster gives you an **interconnected operating system** for your AI โ€” 68+ skills that chain, share memory, and communicate like a real team.
84
85
 
85
86
  ### ๐Ÿ”„ Full Lifecycle Coverage (Idea โ†’ Production)
86
87
 
@@ -174,20 +175,39 @@ Need to scale content? **`cm-content-factory`** is a self-learning, multi-agent
174
175
 
175
176
  Track it all on the **Visual Dashboard** (`cm-dashboard`): No more guessing. Track every task, every agent, every deployment on a real-time Kanban board. Pipeline progress, token tracker, event log โ€” all on one screen.
176
177
 
178
+ ### ๐Ÿงฌ Self-Healing AI (Skills That Fix Themselves)
179
+
180
+ CodyMaster doesn't just run skills โ€” it **watches them, scores them, and heals them automatically.**
181
+
182
+ - **`cm-skill-health`** monitors every invocation: success rate, token usage, error patterns.
183
+ - **`cm-skill-evolution`** auto-patches degraded skills (Mode: FIX) when health scores drop below threshold.
184
+ - **`cm-skill-search`** uses BM25 ranking to find the right skill for any task.
185
+ - **`cm-skill-share`** exports & imports skills across teams and machines.
186
+
187
+ > **Think of it like an immune system for your AI toolkit.** Skills that break get healed. Skills that work well get reinforced. Dead skills get archived.
188
+
189
+ ### ๐Ÿข Enterprise-Ready: Frappe/ERPNext Full-Stack
190
+
191
+ Building on Frappe Framework? **`cm-frappe-agent`** is a 7-layer architecture agent covering the entire Frappe lifecycle โ€” from `bench new-app` to production deploys. Custom doctypes, workflows, REST APIs, permissions, fixtures, and performance optimization โ€” all battle-tested.
192
+
193
+ ### ๐Ÿš€ Growth Hacking Engine
194
+
195
+ Need popups, booking flows, or lead capture? **`cm-growth-hacking`** generates complete conversion systems: Bottom Sheet + Calendar CTA + Tracking. Auto-detects industry, selects the right pattern, wires up **`cm-booking-calendar`** for appointments and **`cm-ads-tracker`** for pixel tracking. Zero dependencies.
196
+
177
197
  ---
178
198
 
179
199
  ## ๐Ÿ†š Scattered Skills vs CodyMaster
180
200
 
181
201
  | | ๐Ÿ˜ต 15 Random Skills | ๐Ÿง  CodyMaster |
182
202
  | -------------------------- | ------------------------------------------- | --------------------------------------------------------------------- |
183
- | **Integration** | Each skill is standalone, no shared context | 60+ skills that chain, share memory, and communicate |
203
+ | **Integration** | Each skill is standalone, no shared context | 68+ skills that chain, share memory, and communicate |
184
204
  | **Lifecycle** | Covers coding only | Covers Idea โ†’ Design โ†’ Code โ†’ Test โ†’ Deploy โ†’ Docs โ†’ Learn |
185
205
  | **Memory** | Forgets everything between sessions | 5-tier Unified Brain: Sensory โ†’ Working โ†’ Long-term โ†’ Semantic โ†’ Structural + Cloud Brain |
186
206
  | **Safety** | YOLO deploys | 4-layer protection: TDD โ†’ Security โ†’ Isolation โ†’ Multi-gate deploy |
187
207
  | **Design** | Random UI every time | Extracts & enforces design system + visual preview |
188
208
  | **Documentation** | "Maybe write a README later" | Auto-generates complete docs, SOPs, API refs from code |
189
- | **Self-improvement** | Static โ€” what you install is what you get | Learns from mistakes, auto-discovers new skills, gets smarter daily |
190
- | **Maintenance** | Update 15 repos separately | One `git pull` updates everything |
209
+ | **Self-improvement** | Static โ€” what you install is what you get | Self-healing: monitors health โ†’ auto-patches โ†’ reinforces winners |
210
+ | **Maintenance** | Update 15 repos separately | One `npm i -g codymaster` updates everything |
191
211
 
192
212
  ---
193
213
 
@@ -218,7 +238,7 @@ If you prefer:
218
238
 
219
239
  ### 1. Install AI Skills (All Platforms)
220
240
 
221
- One command installs all 60+ skills to your environment. Supports Claude Code, Gemini CLI, Cursor, Aider, Windsurf, Cline, OpenCode, and more:
241
+ One command installs all 68+ skills to your environment. Supports Claude Code, Gemini CLI, Cursor, Aider, Windsurf, Cline, OpenCode, and more:
222
242
 
223
243
  ```bash
224
244
  bash <(curl -fsSL https://raw.githubusercontent.com/tody-agent/codymaster/main/install.sh) --all
@@ -256,16 +276,18 @@ The CLI will greet you and keep you organized on your long coding sessions!
256
276
 
257
277
  ---
258
278
 
259
- ## ๐Ÿงฐ The 60+ Skill Arsenal
279
+ ## ๐Ÿงฐ The 68+ Skill Arsenal
260
280
 
261
281
  | Domain | Skills |
262
282
  | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
263
- | ๐Ÿ”ง**Engineering** | `cm-tdd` `cm-debugging` `cm-quality-gate` `cm-test-gate` `cm-code-review` |
264
- | โš™๏ธ**Operations** | `cm-safe-deploy` `cm-identity-guard` `cm-secret-shield` `cm-security-gate` `cm-git-worktrees` `cm-terminal` `cm-safe-i18n` |
265
- | ๐ŸŽจ**Product & UX** | `cm-planning` `cm-design-system` `cm-ux-master` `cm-ui-preview` `cm-project-bootstrap` `cm-jtbd` `cm-brainstorm-idea` `cm-dockit` `cm-readit` |
266
- | ๐Ÿ“ˆ**Growth/CRO** | `cm-content-factory` `cm-ads-tracker` `cro-methodology` |
267
- | ๐ŸŽฏ**Orchestration** | `cm-execution` `cm-continuity` `cm-skill-chain` `cm-skill-mastery` `cm-skill-index` `cm-deep-search` `cm-how-it-work` `cm-notebooklm` |
268
- | ๐Ÿ–ฅ๏ธ**Workflow** | `cm-start` `cm-dashboard` `cm-status` |
283
+ | ๐Ÿ”ง **Engineering** | `cm-tdd` `cm-debugging` `cm-quality-gate` `cm-test-gate` `cm-code-review` `cm-clean-code` |
284
+ | โš™๏ธ **Operations** | `cm-safe-deploy` `cm-identity-guard` `cm-secret-shield` `cm-security-gate` `cm-git-worktrees` `cm-terminal` `cm-safe-i18n` |
285
+ | ๐ŸŽจ **Product & UX** | `cm-planning` `cm-design-system` `cm-ux-master` `cm-ui-preview` `cm-project-bootstrap` `cm-jtbd` `cm-brainstorm-idea` `cm-dockit` `cm-readit` |
286
+ | ๐Ÿ“ˆ **Growth & CRO** | `cm-content-factory` `cm-auto-publisher` `cm-ads-tracker` `cm-cro-methodology` `cm-growth-hacking` `cm-booking-calendar` `cm-google-form` |
287
+ | ๐Ÿข **Enterprise** | `cm-frappe-agent` `cm-reactor` `cm-notebooklm` |
288
+ | ๐Ÿงฌ **Self-Healing** | `cm-skill-health` `cm-skill-evolution` `cm-skill-search` `cm-skill-share` `cm-skill-chain` `cm-skill-mastery` `cm-skill-index` |
289
+ | ๐ŸŽฏ **Orchestration** | `cm-execution` `cm-continuity` `cm-deep-search` `cm-codeintell` `cm-how-it-work` |
290
+ | ๐Ÿ–ฅ๏ธ **Workflow** | `cm-start` `cm-dashboard` `cm-status` |
269
291
 
270
292
  ---
271
293
 
@@ -277,7 +299,7 @@ cm task add "..." โ†’ Add a task
277
299
  cm task list โ†’ View tasks
278
300
  cm status โ†’ Project health
279
301
  cm dashboard โ†’ Open Mission Control
280
- cm list โ†’ Browse 60+ skills
302
+ cm list โ†’ Browse 68+ skills
281
303
  cm profile โ†’ Your stats & achievements
282
304
  cm deploy <env> โ†’ Record deployment
283
305
  ```
@@ -298,7 +320,7 @@ cm deploy <env> โ†’ Record deployment
298
320
 
299
321
  **Tody Le** โ€” Head of Product with 10+ years of experience. Can't write code. Used AI to build real products for 6 months straight. Every skill in this kit was born from a real failure that cost real time and real tears.
300
322
 
301
- > *"60+ skills. Each skill is a lesson. Each lesson is a sleepless night. And now, you don't have to go through those nights."*
323
+ > *"68+ skills. Each skill is a lesson. Each lesson is a sleepless night. And now, you don't have to go through those nights."*
302
324
 
303
325
  ๐Ÿ“– [Read the full story โ†’](https://cody.todyle.com/story)
304
326
 
@@ -308,7 +330,7 @@ cm deploy <env> โ†’ Record deployment
308
330
 
309
331
  - ๐ŸŒ [Website](https://cody.todyle.com) โ€” Overview & demos
310
332
  - ๐Ÿ“– [Documentation](https://cody.todyle.com/docs) โ€” Full deep-dive
311
- - ๐Ÿ› ๏ธ [Skills Reference](skills/) โ€” Browse all 60+ SKILL.md files
333
+ - ๐Ÿ› ๏ธ [Skills Reference](skills/) โ€” Browse all 68+ SKILL.md files
312
334
  - ๐Ÿ“– [Our Story](https://cody.todyle.com/story) โ€” Why this exists
313
335
 
314
336
  ---
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "codymaster",
3
- "version": "4.4.3",
4
- "description": "65 Skills. Ship 10x faster. AI-powered coding skill kit for Claude, Cursor, Gemini & more.",
3
+ "version": "4.4.5",
4
+ "description": "68+ Skills. Ship 10x faster. AI-powered coding skill kit for Claude, Cursor, Gemini & more.",
5
5
  "main": "dist/index.js",
6
6
  "repository": {
7
7
  "type": "git",
@@ -73,5 +73,8 @@
73
73
  "ts-node": "^10.9.2",
74
74
  "typescript": "^5.9.3",
75
75
  "vitest": "^4.1.0"
76
+ },
77
+ "overrides": {
78
+ "path-to-regexp": "^8.4.0"
76
79
  }
77
80
  }
package/skills/cm-quality-gate/SKILL.md CHANGED
@@ -186,7 +186,17 @@ After ANY gate fails, **FIRST run Memory Integrity Check:**
186
186
  | `cm-identity-guard` | Verify identity before using quality gate to ship |
187
187
  | `cm-tdd` | TDD creates the logic for Layer 3 |
188
188
  | `cm-safe-i18n` | Leverages Layer 4 for parity checks |
189
+ | `cm-security-gate` | **PRE-REQUISITE for production:** Security scan (Snyk + Aikido) PASS must be in deployment evidence. No production deploy without security clearance. |
190
+
191
+ ## Evidence Requirements for Production Deploy
192
+
193
+ | Evidence | Command | Required |
194
+ |----------|---------|----------|
195
+ | Test suite passes | `npm run test:gate` | โœ… Always |
196
+ | Build succeeds | `npm run build` | โœ… Always |
197
+ | Security scan passes | `snyk test && aikido-api-client scan-release ...` | โœ… For production / public releases |
198
+ | i18n parity | Included in test:gate | โœ… If multilingual |
189
199
 
190
200
  ## The Bottom Line
191
201
 
192
- **Test before deploy. Evidence before claims. Safety before shipping. Non-negotiable.**
202
+ **Test before deploy. Scan before release. Evidence before claims. Safety before shipping. Non-negotiable.**
package/skills/cm-safe-deploy/SKILL.md CHANGED
@@ -31,12 +31,13 @@ SYNTAX CHECK IS GATE 1. IF IT FAILS, NOTHING ELSE RUNS.
31
31
  - After a production incident caused by untested code
32
32
  - Adding CI/CD to an existing project
33
33
 
34
- ## The 7-Gate Pipeline
34
+ ## The 8-Gate Pipeline
35
35
 
36
36
  ```dot
37
37
  digraph pipeline {
38
38
  rankdir=LR;
39
39
  gate0 [label="Gate 0\nSecret\nHygiene", shape=box, style=filled, fillcolor="#ffc0cb"];
40
+ gate05 [label="Gate 0.5\nSecurity\nScan", shape=box, style=filled, fillcolor="#f0b3ff"];
40
41
  gate1 [label="Gate 1\nSyntax", shape=box, style=filled, fillcolor="#ffcccc"];
41
42
  gate2 [label="Gate 2\nTest\nSuite", shape=box, style=filled, fillcolor="#ffe0cc"];
42
43
  gate3 [label="Gate 3\ni18n\nParity", shape=box, style=filled, fillcolor="#e0ccff"];
@@ -45,8 +46,10 @@ digraph pipeline {
45
46
  gate6 [label="Gate 6\nDeploy +\nSmoke", shape=box, style=filled, fillcolor="#cce5ff"];
46
47
  fail [label="STOP\nFix first", shape=box, style=filled, fillcolor="#ff9999"];
47
48
 
48
- gate0 -> gate1 [label="pass"];
49
+ gate0 -> gate05 [label="pass"];
49
50
  gate0 -> fail [label="fail"];
51
+ gate05 -> gate1 [label="pass"];
52
+ gate05 -> fail [label="fail"];
50
53
  gate1 -> gate2 [label="pass"];
51
54
  gate1 -> fail [label="fail"];
52
55
  gate2 -> gate3 [label="pass"];
@@ -165,6 +168,39 @@ wrangler secret put SUPABASE_SERVICE_KEY
165
168
 
166
169
  ---
167
170
 
171
+ ### Gate 0.5: Security Scan (Snyk + Aikido โ€” Parallel)
172
+
173
+ > [!IMPORTANT]
174
+ > **CodyMaster internal:** This gate is MANDATORY. Both Snyk and Aikido must pass.
175
+ > **User projects:** This gate is SUGGESTED by default. Becomes MANDATORY if CVEs or risk flags were detected during development.
176
+
177
+ **Run both scanners in parallel:**
178
+
179
+ ```bash
180
+ # Snyk โ€” dependency vulnerabilities
181
+ snyk test
182
+
183
+ # Aikido โ€” SAST + dependencies + secrets + IaC
184
+ aikido-api-client scan-release <repo> $(git rev-parse HEAD) \
185
+ --minimum-severity-level="HIGH"
186
+ ```
187
+
188
+ **For CodyMaster (maximum strictness):**
189
+ ```bash
190
+ aikido-api-client scan-release <repo> $(git rev-parse HEAD) \
191
+ --minimum-severity-level="HIGH" \
192
+ --fail-on-sast-scan \
193
+ --fail-on-secrets-scan
194
+ ```
195
+
196
+ **Gate decision:**
197
+ - Both pass โ†’ proceed to Gate 1
198
+ - Either fails โ†’ **STOP. Fix before continuing.** Invoke `cm-security-gate` for remediation.
199
+
200
+ > See `cm-security-gate` for full setup, flag reference, and remediation workflow.
201
+
202
+ ---
203
+
168
204
  ### Gate 1: Syntax Validation (FAST FAIL)
169
205
 
170
206
  > [!IMPORTANT]
package/skills/cm-security-gate/SKILL.md CHANGED
@@ -1,10 +1,23 @@
1
1
  ---
2
- description: Pre-production security audit. Run vulnerability scans using Snyk and set up automated GitHub security checks with Jules.
2
+ description: Pre-production security audit and vulnerability scanning. Run Snyk + Aikido dependency scans, OWASP analysis, and set up automated GitHub security checks with Jules. Use when asked to 'run security check', 'security audit', 'kiแปƒm tra bแบฃo mแบญt', 'vulnerability scan', 'Snyk', 'OWASP', or before open-sourcing / commercializing a project.
3
3
  ---
4
- # cm-security-gate โ€” Pre-production Vulnerability Audit
4
+ # cm-security-gate โ€” Mandatory Security Audit & Vulnerability Gate
5
5
 
6
6
  > **No code goes public without a security pass.**
7
- > This skill is the **SUPPLEMENTARY FINAL GATE** before making a project public, commercializing, or open-sourcing.
7
+ > **No CodyMaster release ships without Snyk + Aikido green.**
8
+
9
+ ## Enforcement Policy
10
+
11
+ | Context | Level | What Happens |
12
+ |---------|-------|-------------|
13
+ | **CodyMaster internal** | ๐Ÿ”ด MANDATORY | Both Snyk + Aikido MUST pass. No deploy, no PR merge without green. |
14
+ | **User projects (normal)** | ๐ŸŸก SUGGESTED | Recommend scanning, provide easy commands. User may skip. |
15
+ | **User projects (risk detected)** | ๐Ÿ”ด ESCALATED MANDATORY | If CVEs found, errors hit, or risk flags raised โ†’ block until resolved. |
16
+
17
+ > [!CAUTION]
18
+ > **The Escalation Rule:** When a user encounters security errors, CVE warnings, or suspicious dependency behavior during development, the agent MUST escalate from "suggested" to "mandatory" โ€” triggering the full Snyk + Aikido scan before any further deploy or push.
19
+
20
+ ---
8
21
 
9
22
  ## When to Use
10
23
 
@@ -13,23 +26,56 @@ description: Pre-production security audit. Run vulnerability scans using Snyk a
13
26
  - Preparing to open-source a repository or launch a commercial product
14
27
  - Adding major third-party dependencies
15
28
  - The project is graduating from alpha/beta to a wider release
29
+ - A user encounters CVE warnings, npm audit alerts, or suspicious dependency behavior
30
+ - Before any CodyMaster release or PR merge
16
31
 
17
32
  **Skip when:**
18
- - Doing quick local prototyping
19
- - Exploring ideas without real user data or production intent
33
+ - Doing quick local prototyping with no real user data
34
+ - Exploring ideas without production intent
20
35
 
21
36
  ---
22
37
 
23
38
  ## Core Capabilities
24
39
 
25
- 1. **Snyk CLI & Aikido CLI Integration:** Scans for known vulnerabilities in open-source dependencies (e.g., `npm`, `pip`, `yarn`, `cargo`) and performs parallel release/PR scanning (SAST, IaC, Secrets).
26
- 2. **Jules CI/CD Recommendation:** Recommends integrating continuous automated security analysis via GitHub.
40
+ 1. **Aikido MCP Server:** Real-time scanning of AI-generated code inside the IDE (vulnerabilities + secrets)
41
+ 2. **Snyk CLI:** Dependency vulnerability scanning (`npm`, `pip`, `yarn`, `cargo`)
42
+ 3. **Aikido CLI:** SAST, IaC, Secrets, and Dependency scanning with release/PR gating
43
+ 4. **Continuous Monitoring:** Snyk dashboard + Aikido dashboard for ongoing protection
44
+ 5. **Jules CI/CD:** Automated security analysis via GitHub on every commit
27
45
 
28
46
  ---
29
47
 
30
48
  ## The Process
31
49
 
32
- ### Phase 1: Preparation (Tooling Check)
50
+ ### Phase 0: Aikido MCP Setup (IDE-Level Real-Time Scanning)
51
+
52
+ > [!IMPORTANT]
53
+ > **One-time setup.** Once configured, every AI coding session automatically scans generated code for vulnerabilities and hardcoded secrets โ€” BEFORE the code is even committed.
54
+
55
+ **Step 1:** Create a Personal Access Token at [Aikido Settings โ†’ IDE โ†’ MCP](https://app.aikido.dev/settings/integrations/ide/mcp)
56
+
57
+ **Step 2:** Install Aikido MCP server:
58
+ ```bash
59
+ # For Antigravity / Gemini CLI
60
+ gemini mcp add aikido \
61
+ --env AIKIDO_API_KEY=YOUR_TOKEN \
62
+ npx -y @aikidosec/mcp
63
+ ```
64
+
65
+ **Step 3:** Download the Aikido agent rule:
66
+ ```bash
67
+ mkdir -p ~/.gemini/skills/
68
+ curl -fsSL "https://gist.githubusercontent.com/kidk/aa48cad6db80ba4a38493016aae67712/raw/3644397b7df43423e3da06434491b40bbb79dd47/aikido-rule.txt" \
69
+ -o ~/.gemini/skills/aikido-rule.txt
70
+ ```
71
+
72
+ **Step 4:** Restart Antigravity IDE. Aikido MCP is now active.
73
+
74
+ > **What this gives you:** Deterministic, independent security checks on EVERY AI-generated snippet. Not a replacement for CLI scanning โ€” this is the first line of defense, catching issues at write-time.
75
+
76
+ ---
77
+
78
+ ### Phase 1: Preparation (CLI Tooling Check)
33
79
 
34
80
  Verify if the Snyk CLI and Aikido CLI are available:
35
81
  ```bash
@@ -37,19 +83,24 @@ which snyk
37
83
  which aikido-api-client
38
84
  ```
39
85
 
40
- **If Snyk is NOT installed**, provide installation instructions before proceeding:
86
+ **If Snyk is NOT installed:**
41
87
  - **macOS (Homebrew):** `brew tap snyk/tap && brew install snyk`
42
88
  - **npm:** `npm install -g snyk`
43
- - Ensure the user authenticates via `snyk auth` after installation.
89
+ - Authenticate: `snyk auth`
44
90
 
45
- **If Aikido CLI is NOT installed**, provide installation instructions:
91
+ **If Aikido CLI is NOT installed:**
46
92
  - **npm:** `npm install -g @aikidosec/ci-api-client`
47
- - Tell the user to authenticate globally: `aikido-api-client apikey <API-KEY>`
48
- - *Note: API keys are found at [Aikido Integration Settings](https://app.aikido.dev/settings/integrations/continuous-integration).*
93
+ - Set API key: `aikido-api-client apikey <API-KEY>`
94
+ - *API keys: [Aikido CI Integration Settings](https://app.aikido.dev/settings/integrations/continuous-integration)*
95
+
96
+ > [!WARNING]
97
+ > **Two different API keys!** Aikido MCP (real-time IDE scanning) uses a *Personal Access Token*. Aikido CLI (release/PR gating) uses a *CI API key*. Don't mix them.
98
+
99
+ ---
49
100
 
50
101
  ### Phase 2: Execution (Parallel Vulnerability Scan)
51
102
 
52
- Execute security scanning using both tools. They should be run in parallel to save time.
103
+ Execute both tools **in parallel** to save time:
53
104
 
54
105
  **1. Snyk Dependency Scan:**
55
106
  ```bash
@@ -58,20 +109,66 @@ snyk test
58
109
 
59
110
  **2. Aikido Release Scan:**
60
111
  ```bash
61
- aikido-api-client scan-release <repository_id or repository_name> <commit_id> --minimum-severity-level="HIGH"
112
+ aikido-api-client scan-release <repository_id_or_name> <commit_id> \
113
+ --minimum-severity-level="HIGH"
62
114
  ```
63
- *(Tip: You can add `--fail-on-secrets-scan` or `--fail-on-sast-scan` depending on the project type).*
64
115
 
65
- Analyze the output from both tools:
116
+ #### Aikido Scan Flags Reference
117
+
118
+ | Flag | Purpose |
119
+ |------|---------|
120
+ | `--minimum-severity-level` | `LOW`, `MEDIUM`, `HIGH`, `CRITICAL` โ€” set the minimum severity that triggers a failure |
121
+ | `--fail-on-sast-scan` | Fail if SAST (Static Analysis) issues are found |
122
+ | `--fail-on-iac-scan` | Fail if Infrastructure as Code misconfigurations are found |
123
+ | `--fail-on-secrets-scan` | Fail if hardcoded secrets are detected |
124
+
125
+ #### CodyMaster Internal (Maximum Strictness)
126
+ ```bash
127
+ aikido-api-client scan-release <repo> <commit> \
128
+ --minimum-severity-level="HIGH" \
129
+ --fail-on-sast-scan \
130
+ --fail-on-secrets-scan
131
+ ```
132
+
133
+ #### User Projects (Standard)
134
+ ```bash
135
+ aikido-api-client scan-release <repo> <commit> \
136
+ --minimum-severity-level="HIGH"
137
+ ```
138
+
139
+ #### Analyzing Results
66
140
  - **Critical/High:** Must be resolved before making the project public.
67
141
  - **Medium/Low:** Document as technical debt or evaluate for false positives.
68
142
  - Run `snyk monitor` if the user wants continuous monitoring on the Snyk dashboard.
69
143
 
70
- ### Phase 2.5: Vulnerability Remediation (Skill Discovery)
144
+ ---
145
+
146
+ ### Phase 2.5: PR Gating (GitHub Integration)
147
+
148
+ For projects with CI/CD pipelines, add Aikido PR gating to block merging PRs with security issues:
149
+
150
+ ```bash
151
+ # In GitHub Actions or CI script
152
+ aikido-api-client scan-pr <repository_id_or_name> <base_commit_id> <head_commit_id> \
153
+ --minimum-severity-level="HIGH"
154
+ ```
155
+
156
+ **package.json integration:**
157
+ ```json
158
+ {
159
+ "scripts": {
160
+ "test:security": "snyk test && aikido-api-client scan-release $npm_package_name $(git rev-parse HEAD) --minimum-severity-level=HIGH",
161
+ "test:security:strict": "snyk test && aikido-api-client scan-release $npm_package_name $(git rev-parse HEAD) --minimum-severity-level=HIGH --fail-on-dependency-scan --fail-on-sast-scan --fail-on-secrets-scan"
162
+ }
163
+ }
164
+ ```
165
+
166
+ ---
167
+
168
+ ### Phase 3: Vulnerability Remediation (Skill Discovery)
71
169
 
72
- If vulnerabilities are detected (e.g., CSRF, XSS, prototype pollution, outdated dependencies), **DO NOT just list the errors**. CodyMaster must actively search for and suggest specialized remediation skills to the user to fix the vulnerabilities.
170
+ If vulnerabilities are detected, **DO NOT just list errors**. CodyMaster must actively search for remediation skills:
73
171
 
74
- **Message to user:**
75
172
  > ๐Ÿšจ **Vulnerabilities Detected: Initiating Remediation**
76
173
  >
77
174
  > Security issues were found. To systematically patch these risks, we need specialized weapons. I suggest finding and installing a dedicated remediation skill for your stack:
@@ -80,26 +177,48 @@ If vulnerabilities are detected (e.g., CSRF, XSS, prototype pollution, outdated
80
177
  > ```
81
178
  > *(Once you discover and install the appropriate security patch skills, we will use them to eradicate the vulnerabilities and eliminate all security risks).*
82
179
 
83
- ### Phase 2.6: Knowledge Retention (Memory Sync)
180
+ ---
181
+
182
+ ### Phase 4: Knowledge Retention (Memory Sync)
84
183
 
85
- Once the vulnerabilities have been successfully remediated, the exact root causes and their corresponding fixes **MUST** be memorized so that CodyMaster does not repeat the same mistakes in the future.
184
+ Once vulnerabilities are remediated, the root causes and fixes **MUST** be memorized:
86
185
 
87
186
  **Action Required:**
88
- - Trigger the `cm-continuity` skill to log the security flaw and the applied fix into `CONTINUITY.md` under a "Security Lessons" or "Hard Lessons" section.
89
- - If the project uses cloud memory, suggest tracking this in `cm-notebooklm` to sync this critical security knowledge to the permanent AI brain.
187
+ - Trigger `cm-continuity` to log flaw + fix into `CONTINUITY.md` โ†’ "Security Lessons" section.
188
+ - If cloud memory is available, sync to `cm-notebooklm` for permanent retention.
90
189
 
91
- ### Phase 3: Automation Handoff (Jules Integration)
190
+ ---
92
191
 
93
- After the manual Snyk scan is complete and the results are presented to the user, **ALWAYS** provide the following suggestion to automate future security checks:
192
+ ### Phase 5: Automation Handoff (Jules + Continuous Monitoring)
94
193
 
95
- > ๐Ÿ›ก๏ธ **Next Step: Automated Security Checks via Jules**
194
+ > ๐Ÿ›ก๏ธ **Next Step: Automated Security Checks**
96
195
  >
97
- > Once your project is ready for commercial or public release, manual checks aren't enough. It's highly recommended to automate security scanning on every commit and Pull Request.
196
+ > Manual checks aren't enough for production. Automate on every commit and PR:
98
197
  >
99
- > Please use **Google Jules** for automated GitHub security analysis:
198
+ > **Option A โ€” Google Jules** (GitHub automated analysis):
100
199
  > ๐Ÿ‘‰ [http://jules.google.com/](http://jules.google.com/)
101
200
  >
102
- > Integrating Jules will automatically catch vulnerabilities in your codebase, ensuring your commercial product remains secure as it scales.
201
+ > **Option B โ€” Snyk Continuous Monitoring:**
202
+ > ```bash
203
+ > snyk monitor
204
+ > ```
205
+ >
206
+ > **Option C โ€” Aikido Dashboard** (full visibility):
207
+ > ๐Ÿ‘‰ [https://app.aikido.dev/](https://app.aikido.dev/)
208
+
209
+ ---
210
+
211
+ ## Escalation Protocol
212
+
213
+ When the agent detects ANY of these signals, enforcement escalates from SUGGESTED โ†’ MANDATORY:
214
+
215
+ | Signal | Action |
216
+ |--------|--------|
217
+ | `npm audit` reports HIGH/CRITICAL | Trigger full Snyk + Aikido scan |
218
+ | User mentions "security error" or "hack" | Trigger full scan before proceeding |
219
+ | New major dependency added (e.g., new ORM, auth lib) | Suggest scan, escalate if dep has known CVEs |
220
+ | Pre-deploy / pre-PR-merge | Check if scan was run in this session, block if not (CodyMaster only) |
221
+ | `.snyk` policy file has expired ignores | Re-scan and update policy |
103
222
 
104
223
  ---
105
224
 
@@ -107,8 +226,13 @@ After the manual Snyk scan is complete and the results are presented to the user
107
226
 
108
227
  | Skill | Relationship |
109
228
  |-------|-------------|
110
- | `cm-quality-gate` | PRE-REQUISITE: Code should pass functional tests before security audits. |
111
- | `cm-secret-shield`| COMPLEMENTARY: Secret Shield catches hardcoded tokens; `cm-security-gate` catches vulnerable dependencies. Both are needed for public releases. |
112
- | `cm-safe-deploy` | POST-REQUISITE: Security gates should ideally be part of the automated deployment pipeline. |
113
- | `cm-continuity` | MEMORY LOGGING: Records discovered vulnerabilities and their fixes into the local working memory to prevent future recurrences. |
229
+ | `cm-quality-gate` | PRE-REQUISITE: Code should pass functional tests before security audits. Security scan PASS is required evidence for production deploy. |
230
+ | `cm-secret-shield`| COMPLEMENTARY: Secret Shield catches hardcoded tokens at write/commit time; `cm-security-gate` catches vulnerable dependencies and SAST issues. Both are needed. |
231
+ | `cm-safe-deploy` | INTEGRATED: Security scan is Gate 0.5 in the deploy pipeline (between Secret Hygiene and Syntax). |
232
+ | `cm-test-gate` | INTEGRATED: `test:security` script pattern uses Snyk + Aikido CLI for automated scanning in the test suite. |
233
+ | `cm-continuity` | MEMORY: Records discovered vulnerabilities and fixes into working memory. |
114
234
  | `cm-notebooklm` | LONG-TERM MEMORY: Syncs critical security lessons to the permanent cloud AI brain. |
235
+
236
+ ## The Bottom Line
237
+
238
+ **Scan before deploy. Remediate before release. Memorize before repeating. Non-negotiable.**
package/skills/cm-test-gate/SKILL.md CHANGED
@@ -199,11 +199,14 @@ Wire these tests into `package.json` to make them easily executable by CI or oth
199
199
  "scripts": {
200
200
  "test": "vitest",
201
201
  "test:gate": "vitest run --reporter=verbose",
202
+ "test:security": "snyk test && aikido-api-client scan-release $npm_package_name $(git rev-parse HEAD) --minimum-severity-level=HIGH",
202
203
  "test:watch": "vitest watch"
203
204
  }
204
205
  }
205
206
  ```
206
207
 
208
+ > **Security Gate Check:** The `test:security` script runs the Snyk dependency check and the Aikido release scan in parallel. See `cm-security-gate` for advanced SAST/IaC flags.
209
+
207
210
  ### Phase 4: Secret Hygiene and Ignore Configuration
208
211
 
209
212
  **NEVER commit `.env` or `.dev.vars`.** Ensure tests do not expose actual production secrets.