ctxora 6.2.2 → 6.4.0

package/src/harness_context/skills/ecc/scientific-thinking-scholar-evaluation/SKILL.md

@@ -0,0 +1,161 @@
+---
+name: scholar-evaluation
+description: Structured scholarly-work evaluation for papers, proposals, literature reviews, methods sections, evidence quality, citation support, and research-writing feedback. Use when evaluating academic or scientific work — papers, proposals, methods sections, or evidence quality — against a repeatable rubric.
+metadata:
+  origin: community
+---
+
+# Scholar Evaluation
+
+Use this skill to evaluate academic or scientific work with a repeatable rubric.
+
+## When to Use
+
+- Reviewing a research paper, proposal, thesis chapter, or literature review.
+- Checking whether claims are supported by cited evidence.
+- Evaluating methodology, study design, analysis, or limitations.
+- Comparing two or more papers for quality or relevance.
+- Producing structured feedback for revision.
+
+## Evaluation Scope
+
+Start by identifying the artifact:
+
+- empirical research paper
+- theoretical paper
+- technical report
+- systematic or narrative literature review
+- research proposal
+- thesis or dissertation chapter
+- conference abstract or short paper
+
+Then choose scope:
+
+- **comprehensive**: all rubric dimensions
+- **targeted**: one or two dimensions, such as method or citations
+- **comparative**: rank multiple works against the same rubric
+
+## Rubric
+
+Score each applicable dimension from 1 to 5:
+
+- 5: excellent; clear, rigorous, and publication-ready
+- 4: good; minor improvements needed
+- 3: adequate; meaningful gaps but usable
+- 2: weak; substantial revision needed
+- 1: poor; major validity or clarity problems
+
+Use `N/A` for dimensions that do not apply.
+
+### 1. Problem and Research Question
+
+- Is the problem clear and specific?
+- Is the contribution meaningful?
+- Are scope and assumptions explicit?
+- Does the question match the claimed contribution?
+
+### 2. Literature and Context
+
+- Is relevant prior work covered?
+- Does the work synthesize rather than merely list sources?
+- Are gaps accurately identified?
+- Are recent and foundational sources balanced?
+
+### 3. Methodology
+
+- Does the method answer the research question?
+- Are design choices justified?
+- Are variables, datasets, participants, or materials described clearly?
+- Could another researcher reproduce the work?
+- Are ethical and practical constraints acknowledged?
+
+### 4. Data and Evidence
+
+- Are data sources credible and appropriate?
+- Is sample size or corpus coverage adequate?
+- Are inclusion, exclusion, and preprocessing decisions documented?
+- Are missing data and bias risks discussed?
+
+### 5. Analysis
+
+- Are statistical, qualitative, or computational methods appropriate?
+- Are baselines and controls fair?
+- Are uncertainty, sensitivity, or robustness checks included when needed?
+- Are alternative explanations considered?
+
+### 6. Results and Interpretation
+
+- Are results clearly presented?
+- Do claims stay within the evidence?
+- Are figures, tables, and metrics understandable?
+- Are negative or null results handled honestly?
+
+### 7. Limitations and Threats to Validity
+
+- Are limitations specific rather than generic?
+- Are internal, external, construct, and conclusion-validity risks addressed?
+- Does the paper distinguish speculation from demonstrated results?
+
+### 8. Writing and Structure
+
+- Is the argument easy to follow?
+- Are sections organized around the research question?
+- Are definitions and notation clear?
+- Is the tone precise and scholarly?
+
+### 9. Citations
+
+- Do cited papers support the claims attached to them?
+- Are primary sources used where possible?
+- Are reviews labeled as reviews?
+- Are preprints labeled as preprints?
+- Are citation metadata and links correct?
+
+## Review Process
+
+1. Read the abstract, introduction, figures, and conclusion for claimed
+   contribution.
+2. Read methods and results for evidence quality.
+3. Check the strongest claims against cited sources.
+4. Score each applicable dimension.
+5. Separate critical blockers from revision suggestions.
+6. End with concrete next edits.
+
+## Output Template
+
+```markdown
+# Scholar Evaluation: <Artifact>
+
+## Overall Assessment
+
+- Overall score: <1-5 or N/A>
+- Confidence: <high | medium | low>
+- Summary: <3-5 sentences>
+
+## Dimension Scores
+
+| Dimension | Score | Evidence | Revision priority |
+| --- | ---: | --- | --- |
+| Problem and question |  |  |  |
+| Literature and context |  |  |  |
+| Methodology |  |  |  |
+| Data and evidence |  |  |  |
+| Analysis |  |  |  |
+| Results and interpretation |  |  |  |
+| Limitations |  |  |  |
+| Writing and structure |  |  |  |
+| Citations |  |  |  |
+
+## Critical Issues
+
+## Recommended Revisions
+
+## Evidence Checks Needed
+```
+
+## Pitfalls
+
+- Do not use the score as a substitute for concrete feedback.
+- Do not penalize a paper for omitting a dimension outside its scope.
+- Do not treat citation count, venue, or author reputation as proof of quality.
+- Do not accept unsupported claims just because they appear in the abstract.

package/src/harness_context/skills/ecc/search-first/LICENSE.ecc

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Affaan Mustafa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/harness_context/skills/ecc/search-first/SKILL.md

@@ -0,0 +1,183 @@
+---
+name: search-first
+description: Research-before-coding workflow. Search for existing tools, libraries, and patterns before writing custom code. Invokes the researcher agent.
+metadata:
+  origin: ECC
+---
+
+# /search-first — Research Before You Code
+
+Systematizes the "search for existing solutions before implementing" workflow.
+
+## Trigger
+
+Use this skill when:
+- Starting a new feature that likely has existing solutions
+- Adding a dependency or integration
+- The user asks "add X functionality" and you're about to write code
+- Before creating a new utility, helper, or abstraction
+
+## Workflow
+
+```
+┌─────────────────────────────────────────────┐
+│  0. TOOL AVAILABILITY PREFLIGHT             │
+│     Check search channels before relying on │
+│     them; report skipped channels honestly   │
+├─────────────────────────────────────────────┤
+│  1. NEED ANALYSIS                           │
+│     Define what functionality is needed      │
+│     Identify language/framework constraints  │
+├─────────────────────────────────────────────┤
+│  2. PARALLEL SEARCH (researcher agent)      │
+│     ┌──────────┐ ┌──────────┐ ┌──────────┐  │
+│     │  npm /   │ │  MCP /   │ │  GitHub / │  │
+│     │  PyPI    │ │  Skills  │ │  Web      │  │
+│     └──────────┘ └──────────┘ └──────────┘  │
+├─────────────────────────────────────────────┤
+│  3. EVALUATE                                │
+│     Score candidates (functionality, maint, │
+│     community, docs, license, deps)         │
+├─────────────────────────────────────────────┤
+│  4. DECIDE                                  │
+│     ┌─────────┐  ┌──────────┐  ┌─────────┐  │
+│     │  Adopt  │  │  Extend  │  │  Build   │  │
+│     │ as-is   │  │  /Wrap   │  │  Custom  │  │
+│     └─────────┘  └──────────┘  └─────────┘  │
+├─────────────────────────────────────────────┤
+│  5. IMPLEMENT                               │
+│     Install package / Configure MCP /       │
+│     Write minimal custom code               │
+└─────────────────────────────────────────────┘
+```
+
+## Decision Matrix
+
+| Signal | Action |
+|--------|--------|
+| Exact match, well-maintained, MIT/Apache | **Adopt** — install and use directly |
+| Partial match, good foundation | **Extend** — install + write thin wrapper |
+| Multiple weak matches | **Compose** — combine 2-3 small packages |
+| Nothing suitable found | **Build** — write custom, but informed by research |
+
+## How to Use
+
+### Step 0: Tool Availability Preflight
+
+This is agent guidance, not an executable setup script. Check only the channels
+that are relevant to the task and project in front of you.
+
+| Channel | Check | If missing |
+|---------|-------|------------|
+| Repository search | `rg --files` and targeted `rg` queries | State that only visible files were inspected |
+| Package registry | `npm --version`, `python -m pip --version`, or project package manager | Use web/docs search and avoid claiming registry coverage |
+| GitHub CLI | `gh auth status` | Use public web or local git history only |
+| MCP/docs tools | Available tool list or local MCP config | Fall back to official docs/web search |
+| Skills directory | `ls ~/.claude/skills ~/.codex/skills` where applicable | Say no local skill catalog was available |
+
+### Quick Mode (inline)
+
+Before writing a utility or adding functionality, mentally run through:
+
+0. Does this already exist in the repo? → `rg` through relevant modules/tests first
+1. Is this a common problem? → Search npm/PyPI
+2. Is there an MCP for this? → Check `~/.claude/settings.json` and search
+3. Is there a skill for this? → Check `~/.claude/skills/`
+4. Is there a GitHub implementation/template? → Run GitHub code search for maintained OSS before writing net-new code
+
+### Full Mode (agent)
+
+For non-trivial functionality, launch the researcher agent:
+
+```
+Agent(subagent_type="general-purpose", prompt="
+  Research existing tools for: [DESCRIPTION]
+  Language/framework: [LANG]
+  Constraints: [ANY]
+
+  Search: npm/PyPI, MCP servers, Claude Code skills, GitHub
+  Return: Structured comparison with recommendation
+")
+```
+
+Older Claude Code docs may call this `Task(...)`; use the current agent/subagent
+tool name exposed by the active harness.
+
+## Search Shortcuts by Category
+
+### Development Tooling
+- Linting → `eslint`, `ruff`, `textlint`, `markdownlint`
+- Formatting → `prettier`, `black`, `gofmt`
+- Testing → `jest`, `pytest`, `go test`
+- Pre-commit → `husky`, `lint-staged`, `pre-commit`
+
+### AI/LLM Integration
+- Claude SDK → Context7 for latest docs
+- Prompt management → Check MCP servers
+- Document processing → `unstructured`, `pdfplumber`, `mammoth`
+
+### Data & APIs
+- HTTP clients → `httpx` (Python), `ky`/`undici` (Node)
+- Validation → `zod` (TS), `pydantic` (Python)
+- Database → Check for MCP servers first
+
+### Content & Publishing
+- Markdown processing → `remark`, `unified`, `markdown-it`
+- Image optimization → `sharp`, `imagemin`
+
+## Integration Points
+
+### With planner agent
+The planner should invoke researcher before Phase 1 (Architecture Review):
+- Researcher identifies available tools
+- Planner incorporates them into the implementation plan
+- Avoids "reinventing the wheel" in the plan
+
+### With architect agent
+The architect should consult researcher for:
+- Technology stack decisions
+- Integration pattern discovery
+- Existing reference architectures
+
+### With iterative-retrieval skill
+Combine for progressive discovery:
+- Cycle 1: Broad search (npm, PyPI, MCP)
+- Cycle 2: Evaluate top candidates in detail
+- Cycle 3: Test compatibility with project constraints
+
+## Examples
+
+### Example 1: "Add dead link checking"
+```
+Need: Check markdown files for broken links
+Search: npm "markdown dead link checker"
+Found: textlint-rule-no-dead-link (score: 9/10)
+Action: ADOPT — npm install textlint-rule-no-dead-link
+Result: Zero custom code, battle-tested solution
+```
+
+### Example 2: "Add HTTP client wrapper"
+```
+Need: Resilient HTTP client with retries and timeout handling
+Search: npm "http client retry", PyPI "httpx retry"
+Found: got (Node) with retry plugin, httpx (Python) with built-in retry
+Action: ADOPT — use got/httpx directly with retry config
+Result: Zero custom code, production-proven libraries
+```
+
+### Example 3: "Add config file linter"
+```
+Need: Validate project config files against a schema
+Search: npm "config linter schema", "json schema validator cli"
+Found: ajv-cli (score: 8/10)
+Action: ADOPT + EXTEND — install ajv-cli, write project-specific schema
+Result: 1 package + 1 schema file, no custom validation logic
+```
+
+## Anti-Patterns
+
+- **Jumping to code**: Writing a utility without checking if one exists
+- **Ignoring MCP**: Not checking if an MCP server already provides the capability
+- **Silent skipping**: Reporting "nothing found" when a search channel was unavailable
+- **Over-customizing**: Wrapping a library so heavily it loses its benefits
+- **Dependency bloat**: Installing a massive package for one small feature

package/src/harness_context/skills/ecc/security-bounty-hunter/LICENSE.ecc

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Affaan Mustafa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/harness_context/skills/ecc/security-bounty-hunter/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: security-bounty-hunter
+description: Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings. Use when hunting reportable, remotely reachable vulnerabilities in a repository.
+metadata:
+  version: "1.0.0"
+  origin: ECC direct-port adaptation
+---
+
+# Security Bounty Hunter
+
+Use this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review.
+
+## When to Use
+
+- Scanning a repository for exploitable vulnerabilities
+- Preparing a Huntr, HackerOne, or similar bounty submission
+- Triage where the question is "does this actually pay?" rather than "is this theoretically unsafe?"
+
+## How It Works
+
+Bias toward remotely reachable, user-controlled attack paths and throw away patterns that platforms routinely reject as informative or out of scope.
+
+## In-Scope Patterns
+
+These are the kinds of issues that consistently matter:
+
+| Pattern | CWE | Typical impact |
+| --- | --- | --- |
+| SSRF through user-controlled URLs | CWE-918 | internal network access, cloud metadata theft |
+| Auth bypass in middleware or API guards | CWE-287 | unauthorized account or data access |
+| Remote deserialization or upload-to-RCE paths | CWE-502 | code execution |
+| SQL injection in reachable endpoints | CWE-89 | data exfiltration, auth bypass, data destruction |
+| Command injection in request handlers | CWE-78 | code execution |
+| Path traversal in file-serving paths | CWE-22 | arbitrary file read or write |
+| Auto-triggered XSS | CWE-79 | session theft, admin compromise |
+
+## Skip These
+
+These are usually low-signal or out of bounty scope unless the program says otherwise:
+
+- Local-only `pickle.loads`, `torch.load`, or equivalent with no remote path
+- `eval()` or `exec()` in CLI-only tooling
+- `shell=True` on fully hardcoded commands
+- Missing security headers by themselves
+- Generic rate-limiting complaints without exploit impact
+- Self-XSS requiring the victim to paste code manually
+- CI/CD injection that is not part of the target program scope
+- Demo, example, or test-only code
+
+## Workflow
+
+1. Check scope first: program rules, SECURITY.md, disclosure channel, and exclusions.
+2. Find real entrypoints: HTTP handlers, uploads, background jobs, webhooks, parsers, and integration endpoints.
+3. Run static tooling where it helps, but treat it as triage input only.
+4. Read the real code path end to end.
+5. Prove user control reaches a meaningful sink.
+6. Confirm exploitability and impact with the smallest safe PoC possible.
+7. Check for duplicates before drafting a report.
+
+## Example Triage Loop
+
+```bash
+semgrep --config=auto --severity=ERROR --severity=WARNING --json
+```
+
+Then manually filter:
+
+- drop tests, demos, fixtures, vendored code
+- drop local-only or non-reachable paths
+- keep only findings with a clear network or user-controlled route
+
+## Report Structure
+
+```markdown
+## Description
+[What the vulnerability is and why it matters]
+
+## Vulnerable Code
+[File path, line range, and a small snippet]
+
+## Proof of Concept
+[Minimal working request or script]
+
+## Impact
+[What the attacker can achieve]
+
+## Affected Version
+[Version, commit, or deployment target tested]
+```
+
+## Quality Gate
+
+Before submitting:
+
+- The code path is reachable from a real user or network boundary
+- The input is genuinely user-controlled
+- The sink is meaningful and exploitable
+- The PoC works
+- The issue is not already covered by an advisory, CVE, or open ticket
+- The target is actually in scope for the bounty program

package/src/harness_context/skills/ecc/security-review/LICENSE.ecc

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Affaan Mustafa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.