minimal-vibe-coding-kit 0.4.1 → 0.4.2

package/.agents/skills/agentshield-security-review/scripts/agentshield_repo_probe.py

@@ -15,10 +15,11 @@ PATTERNS = {
     "repo_instructions": ["CLAUDE.md", "AGENTS.md", ".github/copilot-instructions.md"],
     "claude": [".claude", ".claude-plugin", "agents"],
     "codex": [".codex", ".codex-plugin"],
-    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", "skills"],
+    "grok": [".grok"],
+    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", ".grok/skills", "skills"],
     "shared_commands": [".vibekit/commands"],
     "kit_scripts": [".vibekit/scripts"],
-    "hooks": ["hooks", ".claude/hooks", ".agents/hooks"],
+    "hooks": ["hooks", ".claude/hooks", ".agents/hooks", ".grok/hooks"],
     "mcp": [".mcp.json", "mcp.json", "mcp-configs"],
     "ci": [".github/workflows"],
 }
@@ -55,6 +56,27 @@ def safe_read(path: Path, limit: int = 200_000) -> str:
         return ""
 
 
+def deny_block_lines(text: str) -> set[int]:
+    """Line indexes inside a permissions deny array (JSON `"deny": [` or TOML `deny = [`).
+
+    Deny rules quote dangerous patterns in order to block them, so a marker on
+    those lines is defensive, not suspicious. Allow/ask blocks are still scanned.
+    """
+    covered: set[int] = set()
+    inside = False
+    for idx, line in enumerate(text.splitlines()):
+        stripped = line.strip()
+        if not inside and "[" in stripped and ('"deny"' in stripped or stripped.startswith("deny =") or stripped.startswith("deny=")):
+            covered.add(idx)
+            inside = "]" not in stripped.split("[", 1)[1]
+            continue
+        if inside:
+            covered.add(idx)
+            if "]" in stripped:
+                inside = False
+    return covered
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description="Inventory Claude/Codex AgentShield surfaces")
     parser.add_argument("path", nargs="?", default=".", help="Repository root")
@@ -77,8 +99,11 @@ def main() -> int:
                     if file_path.suffix.lower() not in {".md", ".json", ".toml", ".yaml", ".yml", ".sh", ".js", ".ts"}:
                         continue
                     text = safe_read(file_path)
+                    skip_lines = deny_block_lines(text)
+                    lines = text.splitlines()
                     for marker in SUSPICIOUS_TEXT:
-                        if marker in text:
+                        hits = [idx for idx, line in enumerate(lines) if marker in line]
+                        if any(idx not in skip_lines for idx in hits):
                             suspicious.append({
                                 "path": str(file_path.relative_to(root)),
                                 "marker": marker,

package/.agents/skills/prompt-sharpener/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: prompt-sharpener
+description: Sharpen a rough prompt into a precise one — same intent, sharper not longer — then execute the sharpened version immediately in the same turn.
+argument-hint: "the rough prompt to sharpen and execute"
+disable-model-invocation: true
+---
+
+# Prompt Sharpener
+
+The text the user types after the invocation is the **raw prompt**. Upgrade it into a prompt that is **sharper, not longer** — keep the original intent, constraints, and language — then execute the upgraded version immediately in the same turn. No text after the invocation → ask the user what they want and stop.
+
+## Step 1 — Diagnose the raw prompt
+
+Scan for every ailment below; each ailment found gets its cure applied directly in the upgraded prompt. Cure silently; call out a cure only when it could shift the user's intent.
+
+- Vague verbs or adjectives ("help me", "make it nicer") → concrete, measurable operations and parameters.
+- Two tasks in one prompt → split into an explicit execution order.
+- No success criteria → add a binary pass/fail `Done when`.
+- Emotional description ("everything is broken") → extract the specific technical symptom.
+- "The whole app" scope → pin exact files/functions/directories; coding tasks always get a **scope lock** (edit only inside X, leave the rest untouched).
+- Relies on memory of an old session → copy the decisions already settled in this conversation (stack, architecture, what was tried and failed) into the `Context` block.
+- Invitation to fabricate ("what do experts say about X?") → anchor grounding: state only what can be verified; when unsure, say so explicitly.
+- No output format → fix the structure and length; when the format is hard to describe in words, include 2-3 sample examples (including an edge case) in the `Output Contract`.
+
+Done when: the raw prompt has been checked against the full list and no ailment is left without its cure in the upgraded prompt.
+
+## Step 2 — Build the upgraded prompt
+
+Classify the task (coding / research / writing / analysis / planning / review), then assemble blocks in this order — add a block only when it raises precision; small tasks need just 2-3 blocks:
+
+`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`
+
+Focus per task type:
+
+- Coding: scope lock, smallest correct change, validation after the edit — default to the `validate` command in `backbone.yml` when the repo has one.
+- Research: source quality, citations, explicit uncertainty.
+- Writing: audience, voice, length.
+- Review: group findings by severity, name the failure mode.
+
+Construction rules:
+
+- Write constraints with the strongest signal words: MUST instead of "should", NEVER instead of "avoid".
+- Missing information → state the assumption in `Context` and keep going; stop to ask only when the task is destructive or irreversible.
+- Say _what_ to verify; let the model regulate its own depth of thought.
+- Repo work MUST respect `backbone.yml` conventions and protected paths; when the upgraded task is a large decomposition or a risky decision, its `Work Style` block may direct Step 3 to open with the `sequential-thinking` or `clearthought` skill.
+- Closing audit: reread every sentence; if cutting it would not change the output, cut it — every remaining word is **load-bearing**.
+
+Done when the upgraded prompt scores on all 6 points: intent preserved — ambiguity reduced — right depth — clear output — has verification — has a stopping point.
+
+## Step 3 — Present and execute
+
+Print the upgraded prompt in a single code block, with at most 2 sentences on the key changes. Then treat it as the user's official request: start executing immediately in the same turn, researching and editing according to its own `Tool Rules`.
+
+Done when the upgraded prompt's `Done Criteria` are satisfied.

package/.agents/skills/vibekit-init/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: vibekit-init
-description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, or Codex skill setup. Always show requirements and a diff before writing.
+description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, Codex skill setup, or Grok setup. Always show requirements and a diff before writing.
 disable-model-invocation: true
-argument-hint: target path; profiles claude,cursor,codex; write yes/no
+argument-hint: target path; profiles claude,cursor,codex,grok; write yes/no
 ---
 
 # Vibe Kit Init

package/.claude/settings.json

@@ -6,10 +6,17 @@
       "Bash(git push:*)",
       "Bash(git push --force:*)",
       "Bash(git reset --hard:*)",
-      "Bash(curl *|*sh:*)",
-      "Bash(wget *|*sh:*)",
+      "Bash(sh)",
+      "Bash(sh -)",
+      "Bash(bash)",
+      "Bash(bash -)",
+      "Bash(zsh)",
+      "Bash(zsh -)",
+      "Bash(npx --yes *)",
+      "Bash(npx -y *)",
+      "Bash(npx * --yes *)",
+      "Bash(npx * -y *)",
       "Bash(npm publish:*)",
-      "Bash(npx * --yes:*)",
       "Bash(migrate *)",
       "Bash(docker compose up*)",
       "Bash(docker-compose up*)"

package/.claude/skills/agentshield-security-review/scripts/agentshield_repo_probe.py

@@ -15,10 +15,11 @@ PATTERNS = {
     "repo_instructions": ["CLAUDE.md", "AGENTS.md", ".github/copilot-instructions.md"],
     "claude": [".claude", ".claude-plugin", "agents"],
     "codex": [".codex", ".codex-plugin"],
-    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", "skills"],
+    "grok": [".grok"],
+    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", ".grok/skills", "skills"],
     "shared_commands": [".vibekit/commands"],
     "kit_scripts": [".vibekit/scripts"],
-    "hooks": ["hooks", ".claude/hooks", ".agents/hooks"],
+    "hooks": ["hooks", ".claude/hooks", ".agents/hooks", ".grok/hooks"],
     "mcp": [".mcp.json", "mcp.json", "mcp-configs"],
     "ci": [".github/workflows"],
 }
@@ -55,6 +56,27 @@ def safe_read(path: Path, limit: int = 200_000) -> str:
         return ""
 
 
+def deny_block_lines(text: str) -> set[int]:
+    """Line indexes inside a permissions deny array (JSON `"deny": [` or TOML `deny = [`).
+
+    Deny rules quote dangerous patterns in order to block them, so a marker on
+    those lines is defensive, not suspicious. Allow/ask blocks are still scanned.
+    """
+    covered: set[int] = set()
+    inside = False
+    for idx, line in enumerate(text.splitlines()):
+        stripped = line.strip()
+        if not inside and "[" in stripped and ('"deny"' in stripped or stripped.startswith("deny =") or stripped.startswith("deny=")):
+            covered.add(idx)
+            inside = "]" not in stripped.split("[", 1)[1]
+            continue
+        if inside:
+            covered.add(idx)
+            if "]" in stripped:
+                inside = False
+    return covered
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description="Inventory Claude/Codex AgentShield surfaces")
     parser.add_argument("path", nargs="?", default=".", help="Repository root")
@@ -77,8 +99,11 @@ def main() -> int:
                     if file_path.suffix.lower() not in {".md", ".json", ".toml", ".yaml", ".yml", ".sh", ".js", ".ts"}:
                         continue
                     text = safe_read(file_path)
+                    skip_lines = deny_block_lines(text)
+                    lines = text.splitlines()
                     for marker in SUSPICIOUS_TEXT:
-                        if marker in text:
+                        hits = [idx for idx, line in enumerate(lines) if marker in line]
+                        if any(idx not in skip_lines for idx in hits):
                             suspicious.append({
                                 "path": str(file_path.relative_to(root)),
                                 "marker": marker,

package/.claude/skills/prompt-sharpener/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: prompt-sharpener
+description: Sharpen a rough prompt into a precise one — same intent, sharper not longer — then execute the sharpened version immediately in the same turn.
+argument-hint: "the rough prompt to sharpen and execute"
+disable-model-invocation: true
+---
+
+# Prompt Sharpener
+
+The text the user types after the invocation is the **raw prompt**. Upgrade it into a prompt that is **sharper, not longer** — keep the original intent, constraints, and language — then execute the upgraded version immediately in the same turn. No text after the invocation → ask the user what they want and stop.
+
+## Step 1 — Diagnose the raw prompt
+
+Scan for every ailment below; each ailment found gets its cure applied directly in the upgraded prompt. Cure silently; call out a cure only when it could shift the user's intent.
+
+- Vague verbs or adjectives ("help me", "make it nicer") → concrete, measurable operations and parameters.
+- Two tasks in one prompt → split into an explicit execution order.
+- No success criteria → add a binary pass/fail `Done when`.
+- Emotional description ("everything is broken") → extract the specific technical symptom.
+- "The whole app" scope → pin exact files/functions/directories; coding tasks always get a **scope lock** (edit only inside X, leave the rest untouched).
+- Relies on memory of an old session → copy the decisions already settled in this conversation (stack, architecture, what was tried and failed) into the `Context` block.
+- Invitation to fabricate ("what do experts say about X?") → anchor grounding: state only what can be verified; when unsure, say so explicitly.
+- No output format → fix the structure and length; when the format is hard to describe in words, include 2-3 sample examples (including an edge case) in the `Output Contract`.
+
+Done when: the raw prompt has been checked against the full list and no ailment is left without its cure in the upgraded prompt.
+
+## Step 2 — Build the upgraded prompt
+
+Classify the task (coding / research / writing / analysis / planning / review), then assemble blocks in this order — add a block only when it raises precision; small tasks need just 2-3 blocks:
+
+`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`
+
+Focus per task type:
+
+- Coding: scope lock, smallest correct change, validation after the edit — default to the `validate` command in `backbone.yml` when the repo has one.
+- Research: source quality, citations, explicit uncertainty.
+- Writing: audience, voice, length.
+- Review: group findings by severity, name the failure mode.
+
+Construction rules:
+
+- Write constraints with the strongest signal words: MUST instead of "should", NEVER instead of "avoid".
+- Missing information → state the assumption in `Context` and keep going; stop to ask only when the task is destructive or irreversible.
+- Say _what_ to verify; let the model regulate its own depth of thought.
+- Repo work MUST respect `backbone.yml` conventions and protected paths; when the upgraded task is a large decomposition or a risky decision, its `Work Style` block may direct Step 3 to open with the `sequential-thinking` or `clearthought` skill.
+- Closing audit: reread every sentence; if cutting it would not change the output, cut it — every remaining word is **load-bearing**.
+
+Done when the upgraded prompt scores on all 6 points: intent preserved — ambiguity reduced — right depth — clear output — has verification — has a stopping point.
+
+## Step 3 — Present and execute
+
+Print the upgraded prompt in a single code block, with at most 2 sentences on the key changes. Then treat it as the user's official request: start executing immediately in the same turn, researching and editing according to its own `Tool Rules`.
+
+Done when the upgraded prompt's `Done Criteria` are satisfied.

package/.claude/skills/vibekit-init/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: vibekit-init
-description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, or Codex skill setup. Always show requirements and a diff before writing.
+description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, Codex skill setup, or Grok setup. Always show requirements and a diff before writing.
 disable-model-invocation: true
-argument-hint: target path; profiles claude,cursor,codex; write yes/no
+argument-hint: target path; profiles claude,cursor,codex,grok; write yes/no
 ---
 
 # Vibe Kit Init

package/.codex/rules/vibekit.rules

@@ -0,0 +1,77 @@
+# Minimal Vibe Coding Kit guardrails for Codex.
+# Codex rules are experimental. Project-local rules load only when the
+# project .codex/ layer is trusted, and they govern commands that request
+# execution outside the sandbox. Verify a rule with:
+#   codex execpolicy check --pretty --rules .codex/rules/vibekit.rules -- git push origin main
+
+prefix_rule(
+    pattern = ["rm"],
+    decision = "forbidden",
+    justification = "Use `trash` instead of `rm` so deletions stay recoverable.",
+    match = ["rm -rf build", "rm notes.txt"],
+    not_match = ["trash notes.txt"],
+)
+
+prefix_rule(
+    pattern = ["git", "push"],
+    decision = "forbidden",
+    justification = "Pushing needs explicit user approval.",
+    match = ["git push", "git push --force origin main"],
+    not_match = ["git status"],
+)
+
+prefix_rule(
+    pattern = ["git", "reset", "--hard"],
+    decision = "forbidden",
+    justification = "Hard resets discard work; ask the user first.",
+    match = ["git reset --hard origin/main"],
+    not_match = ["git reset --soft HEAD~1"],
+)
+
+prefix_rule(
+    pattern = [["sh", "bash", "zsh"]],
+    decision = "forbidden",
+    justification = "Blocks `curl ... | sh` style remote installers; run vetted scripts by path instead.",
+    match = ["sh -c ls", "bash install.sh"],
+    not_match = ["shellcheck install.sh"],
+)
+
+prefix_rule(
+    pattern = ["npx", ["--yes", "-y"]],
+    decision = "forbidden",
+    justification = "Auto-confirmed npx executes arbitrary packages; drop the --yes/-y flag so the run is reviewed.",
+    match = ["npx --yes some-package", "npx -y some-package"],
+    not_match = ["npx vitest run"],
+)
+
+prefix_rule(
+    pattern = ["npm", "publish"],
+    decision = "forbidden",
+    justification = "Publishing needs explicit user approval.",
+    match = ["npm publish", "npm publish --access public"],
+    not_match = ["npm pack"],
+)
+
+prefix_rule(
+    pattern = ["migrate"],
+    decision = "forbidden",
+    justification = "Database migrations need explicit user approval.",
+    match = ["migrate up"],
+    not_match = ["npm run migrate"],
+)
+
+prefix_rule(
+    pattern = ["docker", "compose", "up"],
+    decision = "forbidden",
+    justification = "Starting service stacks needs explicit user approval.",
+    match = ["docker compose up -d"],
+    not_match = ["docker compose ps"],
+)
+
+prefix_rule(
+    pattern = ["docker-compose", "up"],
+    decision = "forbidden",
+    justification = "Starting service stacks needs explicit user approval.",
+    match = ["docker-compose up -d"],
+    not_match = ["docker-compose ps"],
+)

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "minimal-vibe-coding-kit",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Reusable vibe coding skills and workflows for Codex-compatible repositories.",
   "author": {
     "name": "Minimal Vibe Coding Kit"

package/.cursor/cli.json

@@ -0,0 +1,18 @@
+{
+  "permissions": {
+    "deny": [
+      "Shell(rm)",
+      "Shell(sh)",
+      "Shell(bash)",
+      "Shell(zsh)",
+      "Shell(git:push*)",
+      "Shell(git:reset --hard*)",
+      "Shell(npx:--yes*)",
+      "Shell(npx:-y*)",
+      "Shell(npm:publish*)",
+      "Shell(migrate)",
+      "Shell(docker:compose up*)",
+      "Shell(docker-compose:up*)"
+    ]
+  }
+}

package/.cursor/settings.json

@@ -2,15 +2,22 @@
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "permissions": {
     "deny": [
-      "Bash(rm -rf *)",
+      "Bash(rm -rf:*)",
       "Bash(rm:*)",
-      "Bash(git push *)",
-      "Bash(git push --force*)",
-      "Bash(git reset --hard*)",
-      "Bash(curl *|*sh*)",
-      "Bash(wget *|*sh*)",
-      "Bash(npm publish*)",
-      "Bash(npx * --yes*)",
+      "Bash(git push:*)",
+      "Bash(git push --force:*)",
+      "Bash(git reset --hard:*)",
+      "Bash(sh)",
+      "Bash(sh -)",
+      "Bash(bash)",
+      "Bash(bash -)",
+      "Bash(zsh)",
+      "Bash(zsh -)",
+      "Bash(npx --yes *)",
+      "Bash(npx -y *)",
+      "Bash(npx * --yes *)",
+      "Bash(npx * -y *)",
+      "Bash(npm publish:*)",
       "Bash(migrate *)",
       "Bash(docker compose up*)",
       "Bash(docker-compose up*)"

package/.cursor/skills/prompt-sharpener/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: prompt-sharpener
+description: Sharpen a rough prompt into a precise one — same intent, sharper not longer — then execute the sharpened version immediately in the same turn.
+argument-hint: "the rough prompt to sharpen and execute"
+disable-model-invocation: true
+---
+
+# Prompt Sharpener
+
+The text the user types after the invocation is the **raw prompt**. Upgrade it into a prompt that is **sharper, not longer** — keep the original intent, constraints, and language — then execute the upgraded version immediately in the same turn. No text after the invocation → ask the user what they want and stop.
+
+## Step 1 — Diagnose the raw prompt
+
+Scan for every ailment below; each ailment found gets its cure applied directly in the upgraded prompt. Cure silently; call out a cure only when it could shift the user's intent.
+
+- Vague verbs or adjectives ("help me", "make it nicer") → concrete, measurable operations and parameters.
+- Two tasks in one prompt → split into an explicit execution order.
+- No success criteria → add a binary pass/fail `Done when`.
+- Emotional description ("everything is broken") → extract the specific technical symptom.
+- "The whole app" scope → pin exact files/functions/directories; coding tasks always get a **scope lock** (edit only inside X, leave the rest untouched).
+- Relies on memory of an old session → copy the decisions already settled in this conversation (stack, architecture, what was tried and failed) into the `Context` block.
+- Invitation to fabricate ("what do experts say about X?") → anchor grounding: state only what can be verified; when unsure, say so explicitly.
+- No output format → fix the structure and length; when the format is hard to describe in words, include 2-3 sample examples (including an edge case) in the `Output Contract`.
+
+Done when: the raw prompt has been checked against the full list and no ailment is left without its cure in the upgraded prompt.
+
+## Step 2 — Build the upgraded prompt
+
+Classify the task (coding / research / writing / analysis / planning / review), then assemble blocks in this order — add a block only when it raises precision; small tasks need just 2-3 blocks:
+
+`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`
+
+Focus per task type:
+
+- Coding: scope lock, smallest correct change, validation after the edit — default to the `validate` command in `backbone.yml` when the repo has one.
+- Research: source quality, citations, explicit uncertainty.
+- Writing: audience, voice, length.
+- Review: group findings by severity, name the failure mode.
+
+Construction rules:
+
+- Write constraints with the strongest signal words: MUST instead of "should", NEVER instead of "avoid".
+- Missing information → state the assumption in `Context` and keep going; stop to ask only when the task is destructive or irreversible.
+- Say _what_ to verify; let the model regulate its own depth of thought.
+- Repo work MUST respect `backbone.yml` conventions and protected paths; when the upgraded task is a large decomposition or a risky decision, its `Work Style` block may direct Step 3 to open with the `sequential-thinking` or `clearthought` skill.
+- Closing audit: reread every sentence; if cutting it would not change the output, cut it — every remaining word is **load-bearing**.
+
+Done when the upgraded prompt scores on all 6 points: intent preserved — ambiguity reduced — right depth — clear output — has verification — has a stopping point.
+
+## Step 3 — Present and execute
+
+Print the upgraded prompt in a single code block, with at most 2 sentences on the key changes. Then treat it as the user's official request: start executing immediately in the same turn, researching and editing according to its own `Tool Rules`.
+
+Done when the upgraded prompt's `Done Criteria` are satisfied.

package/.grok/README.md

@@ -0,0 +1,13 @@
+# Grok notes
+
+Grok Build (the `grok` CLI) reads `AGENTS.md` from the repo root down to the working directory (Codex-style), plus every `*.md` rule in `.grok/rules/`, and repository skills from `.grok/skills/`. User-invocable skills also appear as slash commands, for example `/memento` or `/prompt-sharpener`.
+
+Useful built-ins include `/plan`, `/skills`, `/plugins`, `/hooks`, `/mcps`, and `/model`; `grok inspect` lists the config sources, instructions, skills, plugins, hooks, and MCP servers discovered for the current directory, and `grok -p "<prompt>"` runs headless.
+
+Guardrails ship in two layers. This repo's `.grok/config.toml` carries project-scoped `[permission]` deny rules for dangerous commands — project configs support MCP servers, plugins, and permission rules. User preferences such as `[ui] permission_mode` are user-scoped only and belong in `~/.grok/config.toml`; see `config.example.toml`. Project `.grok/hooks/` require `/hooks-trust` before they run.
+
+Native custom reasoning skills:
+
+- `clearthought`: structured reasoning for broad or ambiguous coding tasks.
+- `sequential-thinking`: step-by-step task splitting with revisions and branches.
+- `reviewing-4p-priorities`: P0-P4 review triage and fix ordering.

package/.grok/config.example.toml

@@ -0,0 +1,13 @@
+# Example user-level settings. Copy the relevant parts into ~/.grok/config.toml.
+# Project-scoped guardrails already ship in this repo's .grok/config.toml
+# ([permission] deny rules for dangerous commands); Grok merges both layers.
+
+# Keep the default ask-before-run permission mode; do not enable always-approve.
+# permission_mode is user-scoped and is ignored in project configs.
+[ui]
+permission_mode = "ask"
+
+# One-off deny on the CLI: grok --deny 'Bash(rm -rf *)'
+# Enterprise-managed policy belongs in /etc/grok/requirements.toml (fail-closed;
+# it cannot be overridden by user or project config).
+# References: https://docs.x.ai/build/settings and https://docs.x.ai/build/enterprise

package/.grok/config.toml

@@ -0,0 +1,29 @@
+# Managed by Minimal Vibe Coding Kit. Project-scoped Grok Build settings.
+# Project configs support MCP servers, plugins, and permission rules; other
+# settings (such as [ui] permission_mode) are user-scoped and belong in
+# ~/.grok/config.toml. Reference: https://docs.x.ai/build/settings
+
+[permission]
+deny = [
+  "Bash(rm -rf *)",
+  "Bash(rm *)",
+  "Bash(git push)",
+  "Bash(git push *)",
+  "Bash(git reset --hard)",
+  "Bash(git reset --hard *)",
+  "Bash(sh)",
+  "Bash(sh -)",
+  "Bash(bash)",
+  "Bash(bash -)",
+  "Bash(zsh)",
+  "Bash(zsh -)",
+  "Bash(npx --yes *)",
+  "Bash(npx -y *)",
+  "Bash(npx * --yes *)",
+  "Bash(npx * -y *)",
+  "Bash(npm publish)",
+  "Bash(npm publish *)",
+  "Bash(migrate *)",
+  "Bash(docker compose up*)",
+  "Bash(docker-compose up*)"
+]

package/.grok/rules/safe-delete.md

@@ -0,0 +1,11 @@
+# Safe delete rules
+
+- Never delete permanently by default. Prefer `trash` over `rm`, `rm -rf`, `rmdir`, and `find -delete` so deletions stay recoverable.
+- Before deleting, check availability with `command -v trash`. If available, use `trash <path>`.
+- If `trash` is missing, recommend installing it instead of falling back to `rm`:
+  - macOS 14 or newer: built in at `/usr/bin/trash`, nothing to install.
+  - Older macOS: `brew install trash` (https://formulae.brew.sh/formula/trash).
+  - Linux: `sudo apt install trash-cli` or `pip install trash-cli` (https://github.com/andreafrancia/trash-cli).
+  - Any OS with Node.js: `npm install --global trash-cli` (https://github.com/sindresorhus/trash-cli).
+- Permanent deletion requires the user's explicit approval of the exact paths, and the `path-sensitive-shell-safety` skill first when paths come from variables.
+- Honor the deletion preference recorded in `backbone.yml` `conventions.custom_rules` during first-time init.

package/.grok/rules/security.md

@@ -0,0 +1,5 @@
+# Security rules
+
+Use the `agentshield-security-review` skill (invocable as `/agentshield-security-review`) for changes to agent surfaces, commands, hooks, MCP, skills, or installer scripts. Do not run untrusted hooks, MCP servers, deploys, migrations, or remote installers during review.
+
+Use the `path-sensitive-shell-safety` skill before changing shell/deploy/installer/repair logic that builds paths from variables or can delete, move, copy, replace, clean, or reset files.

package/.grok/rules/vibe-core.md

@@ -0,0 +1,8 @@
+# Vibe core rules
+
+- Read `backbone.yml` first.
+- Follow `backbone.yml` `conventions` after init.
+- Keep plans short and diffs small.
+- Use skills for repeatable procedures.
+- Validate with the command in `backbone.yml` after relevant edits.
+- Do not overwrite user instructions; use managed blocks.

package/.grok/skills/agentshield-security-review/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: agentshield-security-review
+description: repository-native security review workflow for Claude Code and Codex projects using the AgentShield concept. Use when auditing or hardening agent configuration, skills, prompts, hooks, MCP servers, permissions, slash commands, Codex plugin files, Claude plugin files, AGENTS.md, CLAUDE.md, or repository-level AI coding-agent surfaces. Prefer this skill before merging changes to .claude, .codex, .codex-plugin, .claude-plugin, .agents, .vibekit/skills, .vibekit/commands, .vibekit/scripts, hooks, mcp configs, or generated code that touches agent execution.
+---
+
+# AgentShield Security Review
+
+Use this skill to run an AgentShield-style review that is native to both Claude Code and Codex repositories. Treat the repo root as the source of truth, then inspect agent surfaces before normal code review.
+
+## Core rule
+
+Do not invent findings. Prefer deterministic scanner output when available, then add reviewer judgment separately. Clearly label each finding as `scanner-backed`, `manual-confirmed`, or `manual-suspected`.
+
+## Standard workflow
+
+1. Identify the repo root and active harness surfaces.
+2. Run `node .vibekit/scripts/agentshield-probe.mjs .` to inventory Claude, Codex, shared skills, hooks, MCP, commands, and repo instruction files.
+3. If Node/npm is available, run AgentShield from the repo root:
+   ```bash
+   npx ecc-agentshield scan --path . --format text
+   ```
+4. If JSON is needed for CI or automation, run:
+   ```bash
+   npx ecc-agentshield scan --path . --format json
+   ```
+5. If safe auto-fixes are requested, first summarize the proposed edits, then run:
+   ```bash
+   npx ecc-agentshield scan --path . --fix
+   ```
+6. Re-run the scan after fixes and report before/after score, severity counts, and changed files.
+7. If AgentShield is unavailable, perform the fallback manual review in `references/review-checklist.md`.
+
+## Harness-native layout
+
+Use a shared root skill where possible:
+
+- `.vibekit/skills/agentshield-security-review/SKILL.md` is the canonical workflow.
+- Claude Code may add a slash-command shim in `.vibekit/commands/security-scan.md` or `.claude/commands/security-scan.md`.
+- Codex should consume the same root `.vibekit/skills/` directory through `.codex-plugin/plugin.json` or the repo's native skill/plugin mechanism.
+- Do not duplicate divergent Claude and Codex skill bodies. Duplication causes drift.
+
+See `references/native-install.md` for copy-ready Claude and Codex snippets.
+
+## What to inspect
+
+Prioritize runtime-active files over examples and docs:
+
+1. `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`
+2. `.claude/settings.json`, `.claude/settings.local.json`, `.claude/agents/*.md`, `.claude/commands/*.md`
+3. `.codex/config.toml`, `.codex/`, `.codex-plugin/plugin.json`
+4. `.agents/`, `agents/`, `.vibekit/skills/`, `.vibekit/commands/`, `.vibekit/scripts/`, `hooks/`
+5. `.mcp.json`, `mcp.json`, `mcp-configs/*.json`
+6. installer scripts, CI workflows, package scripts, and generated plugin manifests
+
+## Output contract
+
+Return a concise report with:
+
+- Security grade/score if AgentShield provides one.
+- Commands run and whether the scan was `npx`, local, CI, or fallback-manual.
+- Active harness surfaces found.
+- Critical/high findings with exact paths, severity, confidence, exploit impact, and fix.
+- Medium/low findings grouped separately.
+- Safe auto-fix candidates versus manual-only changes.
+- Claude-native and Codex-native installation notes when the repo lacks one of them.
+- Final remediation order.
+
+Use `references/report-template.md` for the preferred report format.
+
+## Safety constraints
+
+- Never print full secrets. Show only the file path and key name or a redacted prefix/suffix.
+- Do not run untrusted hook scripts, MCP server commands, package scripts, or installer scripts just to inspect them.
+- Do not apply `--fix` without first stating the planned edit types.
+- Treat wildcard shell permissions, unpinned `npx`, shell-running MCP servers, prompt-injection instructions, and silent hook failures as high-risk until proven otherwise.

package/.grok/skills/agentshield-security-review/agents/openai.yaml

@@ -0,0 +1,5 @@
+interface:
+  display_name: AgentShield Security Review
+  short_description: Audit Claude, Codex, skills, hooks, MCP, and agent config surfaces.
+  icon: shield
+  brand_color: "#334155"