nitm-ai-dev-toolkit 3.0.15

package/src/repo/.agents/skills/receiving-code-review/SKILL.md

@@ -0,0 +1,213 @@
+---
+name: receiving-code-review
+description: Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
+---
+
+# Code Review Reception
+
+## Overview
+
+Code review requires technical evaluation, not emotional performance.
+
+**Core principle:** Verify before implementing. Ask before assuming. Technical correctness over social comfort.
+
+## The Response Pattern
+
+```
+WHEN receiving code review feedback:
+
+1. READ: Complete feedback without reacting
+2. UNDERSTAND: Restate requirement in own words (or ask)
+3. VERIFY: Check against codebase reality
+4. EVALUATE: Technically sound for THIS codebase?
+5. RESPOND: Technical acknowledgment or reasoned pushback
+6. IMPLEMENT: One item at a time, test each
+```
+
+## Forbidden Responses
+
+**NEVER:**
+- "You're absolutely right!" (explicit CLAUDE.md violation)
+- "Great point!" / "Excellent feedback!" (performative)
+- "Let me implement that now" (before verification)
+
+**INSTEAD:**
+- Restate the technical requirement
+- Ask clarifying questions
+- Push back with technical reasoning if wrong
+- Just start working (actions > words)
+
+## Handling Unclear Feedback
+
+```
+IF any item is unclear:
+  STOP - do not implement anything yet
+  ASK for clarification on unclear items
+
+WHY: Items may be related. Partial understanding = wrong implementation.
+```
+
+**Example:**
+```
+your human partner: "Fix 1-6"
+You understand 1,2,3,6. Unclear on 4,5.
+
+❌ WRONG: Implement 1,2,3,6 now, ask about 4,5 later
+✅ RIGHT: "I understand items 1,2,3,6. Need clarification on 4 and 5 before proceeding."
+```
+
+## Source-Specific Handling
+
+### From your human partner
+- **Trusted** - implement after understanding
+- **Still ask** if scope unclear
+- **No performative agreement**
+- **Skip to action** or technical acknowledgment
+
+### From External Reviewers
+```
+BEFORE implementing:
+  1. Check: Technically correct for THIS codebase?
+  2. Check: Breaks existing functionality?
+  3. Check: Reason for current implementation?
+  4. Check: Works on all platforms/versions?
+  5. Check: Does reviewer understand full context?
+
+IF suggestion seems wrong:
+  Push back with technical reasoning
+
+IF can't easily verify:
+  Say so: "I can't verify this without [X]. Should I [investigate/ask/proceed]?"
+
+IF conflicts with your human partner's prior decisions:
+  Stop and discuss with your human partner first
+```
+
+**your human partner's rule:** "External feedback - be skeptical, but check carefully"
+
+## YAGNI Check for "Professional" Features
+
+```
+IF reviewer suggests "implementing properly":
+  grep codebase for actual usage
+
+  IF unused: "This endpoint isn't called. Remove it (YAGNI)?"
+  IF used: Then implement properly
+```
+
+**your human partner's rule:** "You and reviewer both report to me. If we don't need this feature, don't add it."
+
+## Implementation Order
+
+```
+FOR multi-item feedback:
+  1. Clarify anything unclear FIRST
+  2. Then implement in this order:
+     - Blocking issues (breaks, security)
+     - Simple fixes (typos, imports)
+     - Complex fixes (refactoring, logic)
+  3. Test each fix individually
+  4. Verify no regressions
+```
+
+## When To Push Back
+
+Push back when:
+- Suggestion breaks existing functionality
+- Reviewer lacks full context
+- Violates YAGNI (unused feature)
+- Technically incorrect for this stack
+- Legacy/compatibility reasons exist
+- Conflicts with your human partner's architectural decisions
+
+**How to push back:**
+- Use technical reasoning, not defensiveness
+- Ask specific questions
+- Reference working tests/code
+- Involve your human partner if architectural
+
+**Signal if uncomfortable pushing back out loud:** "Strange things are afoot at the Circle K"
+
+## Acknowledging Correct Feedback
+
+When feedback IS correct:
+```
+✅ "Fixed. [Brief description of what changed]"
+✅ "Good catch - [specific issue]. Fixed in [location]."
+✅ [Just fix it and show in the code]
+
+❌ "You're absolutely right!"
+❌ "Great point!"
+❌ "Thanks for catching that!"
+❌ "Thanks for [anything]"
+❌ ANY gratitude expression
+```
+
+**Why no thanks:** Actions speak. Just fix it. The code itself shows you heard the feedback.
+
+**If you catch yourself about to write "Thanks":** DELETE IT. State the fix instead.
+
+## Gracefully Correcting Your Pushback
+
+If you pushed back and were wrong:
+```
+✅ "You were right - I checked [X] and it does [Y]. Implementing now."
+✅ "Verified this and you're correct. My initial understanding was wrong because [reason]. Fixing."
+
+❌ Long apology
+❌ Defending why you pushed back
+❌ Over-explaining
+```
+
+State the correction factually and move on.
+
+## Common Mistakes
+
+| Mistake | Fix |
+|---------|-----|
+| Performative agreement | State requirement or just act |
+| Blind implementation | Verify against codebase first |
+| Batch without testing | One at a time, test each |
+| Assuming reviewer is right | Check if breaks things |
+| Avoiding pushback | Technical correctness > comfort |
+| Partial implementation | Clarify all items first |
+| Can't verify, proceed anyway | State limitation, ask for direction |
+
+## Real Examples
+
+**Performative Agreement (Bad):**
+```
+Reviewer: "Remove legacy code"
+❌ "You're absolutely right! Let me remove that..."
+```
+
+**Technical Verification (Good):**
+```
+Reviewer: "Remove legacy code"
+✅ "Checking... build target is 10.15+, this API needs 13+. Need legacy for backward compat. Current impl has wrong bundle ID - fix it or drop pre-13 support?"
+```
+
+**YAGNI (Good):**
+```
+Reviewer: "Implement proper metrics tracking with database, date filters, CSV export"
+✅ "Grepped codebase - nothing calls this endpoint. Remove it (YAGNI)? Or is there usage I'm missing?"
+```
+
+**Unclear Item (Good):**
+```
+your human partner: "Fix items 1-6"
+You understand 1,2,3,6. Unclear on 4,5.
+✅ "Understand 1,2,3,6. Need clarification on 4 and 5 before implementing."
+```
+
+## GitHub Thread Replies
+
+When replying to inline review comments on GitHub, reply in the comment thread (`gh api repos/{owner}/{repo}/pulls/{pr}/comments/{id}/replies`), not as a top-level PR comment.
+
+## The Bottom Line
+
+**External feedback = suggestions to evaluate, not orders to follow.**
+
+Verify. Question. Then implement.
+
+No performative agreement. Technical rigor always.

package/src/repo/.agents/skills/requesting-code-review/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: requesting-code-review
+description: Use when completing tasks, implementing major features, or before merging to verify work meets requirements
+---
+
+# Requesting Code Review
+
+Dispatch superpowers:code-reviewer subagent to catch issues before they cascade.
+
+**Core principle:** Review early, review often.
+
+## When to Request Review
+
+**Mandatory:**
+- After each task in subagent-driven development
+- After completing major feature
+- Before merge to main
+
+**Optional but valuable:**
+- When stuck (fresh perspective)
+- Before refactoring (baseline check)
+- After fixing complex bug
+
+## How to Request
+
+**1. Get git SHAs:**
+```bash
+BASE_SHA=$(git rev-parse HEAD~1)  # or origin/main
+HEAD_SHA=$(git rev-parse HEAD)
+```
+
+**2. Dispatch code-reviewer subagent:**
+
+Use Task tool with superpowers:code-reviewer type, fill template at `code-reviewer.md`
+
+**Placeholders:**
+- `{WHAT_WAS_IMPLEMENTED}` - What you just built
+- `{PLAN_OR_REQUIREMENTS}` - What it should do
+- `{BASE_SHA}` - Starting commit
+- `{HEAD_SHA}` - Ending commit
+- `{DESCRIPTION}` - Brief summary
+
+**3. Act on feedback:**
+- Fix Critical issues immediately
+- Fix Important issues before proceeding
+- Note Minor issues for later
+- Push back if reviewer is wrong (with reasoning)
+
+## Example
+
+```
+[Just completed Task 2: Add verification function]
+
+You: Let me request code review before proceeding.
+
+BASE_SHA=$(git log --oneline | grep "Task 1" | head -1 | awk '{print $1}')
+HEAD_SHA=$(git rev-parse HEAD)
+
+[Dispatch superpowers:code-reviewer subagent]
+  WHAT_WAS_IMPLEMENTED: Verification and repair functions for conversation index
+  PLAN_OR_REQUIREMENTS: Task 2 from docs/features/{{ISSUE_ID}}-deployment/plan.md
+  BASE_SHA: a7981ec
+  HEAD_SHA: 3df7661
+  DESCRIPTION: Added verifyIndex() and repairIndex() with 4 issue types
+
+[Subagent returns]:
+  Strengths: Clean architecture, real tests
+  Issues:
+    Important: Missing progress indicators
+    Minor: Magic number (100) for reporting interval
+  Assessment: Ready to proceed
+
+You: [Fix progress indicators]
+[Continue to Task 3]
+```
+
+## Integration with Workflows
+
+**Subagent-Driven Development:**
+- Review after EACH task
+- Catch issues before they compound
+- Fix before moving to next task
+
+**Executing Plans:**
+- Review after each batch (3 tasks)
+- Get feedback, apply, continue
+
+**Ad-Hoc Development:**
+- Review before merge
+- Review when stuck
+
+## Red Flags
+
+**Never:**
+- Skip review because "it's simple"
+- Ignore Critical issues
+- Proceed with unfixed Important issues
+- Argue with valid technical feedback
+
+**If reviewer wrong:**
+- Push back with technical reasoning
+- Show code/tests that prove it works
+- Request clarification
+
+See template at: requesting-code-review/code-reviewer.md

package/src/repo/.agents/skills/requesting-code-review/code-reviewer.md

@@ -0,0 +1,146 @@
+# Code Review Agent
+
+You are reviewing code changes for production readiness.
+
+**Your task:**
+1. Review {WHAT_WAS_IMPLEMENTED}
+2. Compare against {PLAN_OR_REQUIREMENTS}
+3. Check code quality, architecture, testing
+4. Categorize issues by severity
+5. Assess production readiness
+
+## What Was Implemented
+
+{DESCRIPTION}
+
+## Requirements/Plan
+
+{PLAN_REFERENCE}
+
+## Git Range to Review
+
+**Base:** {BASE_SHA}
+**Head:** {HEAD_SHA}
+
+```bash
+git diff --stat {BASE_SHA}..{HEAD_SHA}
+git diff {BASE_SHA}..{HEAD_SHA}
+```
+
+## Review Checklist
+
+**Code Quality:**
+- Clean separation of concerns?
+- Proper error handling?
+- Type safety (if applicable)?
+- DRY principle followed?
+- Edge cases handled?
+
+**Architecture:**
+- Sound design decisions?
+- Scalability considerations?
+- Performance implications?
+- Security concerns?
+
+**Testing:**
+- Tests actually test logic (not mocks)?
+- Edge cases covered?
+- Integration tests where needed?
+- All tests passing?
+
+**Requirements:**
+- All plan requirements met?
+- Implementation matches spec?
+- No scope creep?
+- Breaking changes documented?
+
+**Production Readiness:**
+- Migration strategy (if schema changes)?
+- Backward compatibility considered?
+- Documentation complete?
+- No obvious bugs?
+
+## Output Format
+
+### Strengths
+[What's well done? Be specific.]
+
+### Issues
+
+#### Critical (Must Fix)
+[Bugs, security issues, data loss risks, broken functionality]
+
+#### Important (Should Fix)
+[Architecture problems, missing features, poor error handling, test gaps]
+
+#### Minor (Nice to Have)
+[Code style, optimization opportunities, documentation improvements]
+
+**For each issue:**
+- File:line reference
+- What's wrong
+- Why it matters
+- How to fix (if not obvious)
+
+### Recommendations
+[Improvements for code quality, architecture, or process]
+
+### Assessment
+
+**Ready to merge?** [Yes/No/With fixes]
+
+**Reasoning:** [Technical assessment in 1-2 sentences]
+
+## Critical Rules
+
+**DO:**
+- Categorize by actual severity (not everything is Critical)
+- Be specific (file:line, not vague)
+- Explain WHY issues matter
+- Acknowledge strengths
+- Give clear verdict
+
+**DON'T:**
+- Say "looks good" without checking
+- Mark nitpicks as Critical
+- Give feedback on code you didn't review
+- Be vague ("improve error handling")
+- Avoid giving a clear verdict
+
+## Example Output
+
+```
+### Strengths
+- Clean database schema with proper migrations (db.ts:15-42)
+- Comprehensive test coverage (18 tests, all edge cases)
+- Good error handling with fallbacks (summarizer.ts:85-92)
+
+### Issues
+
+#### Important
+1. **Missing help text in CLI wrapper**
+   - File: index-conversations:1-31
+   - Issue: No --help flag, users won't discover --concurrency
+   - Fix: Add --help case with usage examples
+
+2. **Date validation missing**
+   - File: search.ts:25-27
+   - Issue: Invalid dates silently return no results
+   - Fix: Validate ISO format, throw error with example
+
+#### Minor
+1. **Progress indicators**
+   - File: indexer.ts:130
+   - Issue: No "X of Y" counter for long operations
+   - Impact: Users don't know how long to wait
+
+### Recommendations
+- Add progress reporting for user experience
+- Consider config file for excluded projects (portability)
+
+### Assessment
+
+**Ready to merge: With fixes**
+
+**Reasoning:** Core implementation is solid with good architecture and tests. Important issues (help text, date validation) are easily fixed and don't affect core functionality.
+```

package/src/repo/.agents/skills/security-reviewer/SKILL.md

@@ -0,0 +1,144 @@
+---
+name: security-reviewer
+description: Use for security-focused code audits on auth, payments, user data, API endpoints, or file uploads. Performs OWASP Top 10 checklist review. Dispatch as a fresh subagent with no shared context to avoid anchoring bias.
+---
+
+# Security Reviewer
+
+Security-focused code audit using OWASP Top 10 checklist.
+
+**Purpose:** Find security vulnerabilities before they reach production — think like an attacker.
+
+**When to use:**
+- Security-sensitive code changes (auth, payments, user data, API endpoints, file uploads)
+- As part of comprehensive code review
+- Before merging security-critical features
+
+**CRITICAL:** Dispatch as a fresh subagent with NO shared conversation context. Shared context creates anchoring bias and causes reviewers to rubber-stamp work they watched being built.
+
+## Dispatch Template
+
+```
+You are a Staff Security Engineer performing a security-focused code audit.
+Your job is to find vulnerabilities before they reach production. Think like
+an attacker — what can be exploited?
+
+## What Was Changed
+
+[Summary of what was implemented — endpoints, models, auth changes, etc.]
+
+## Files to Review
+
+[List all changed files, especially controllers, models, services, middleware, config]
+
+## Git Context
+
+- Base SHA: [commit before changes]
+- Head SHA: [current commit]
+
+Run `git diff {Base SHA}..{Head SHA}` to view all changes before beginning the audit.
+```
+
+## Security Audit Checklist
+
+### Injection (CRITICAL)
+
+- [ ] **SQL injection**: String concatenation in queries? Unparameterized inputs?
+      Check for `.where("column = '#{value}'")`, `Arel.sql()` with user input,
+      `.whereRaw()`, `.raw()`, template literals in SQL strings.
+- [ ] **Command injection**: `system()`, `exec()`, backticks with user input?
+      Unsanitized arguments to shell commands?
+- [ ] **XSS**: Unescaped user input in HTML/templates? `html_safe` on user content?
+      `innerHTML`, `dangerouslySetInnerHTML` with user data?
+- [ ] **NoSQL injection**: Unvalidated query operators in MongoDB/similar?
+- [ ] **Header injection**: User input in HTTP headers without sanitization?
+
+### Broken Authentication & Authorization (CRITICAL)
+
+- [ ] **Missing authentication**: Are new endpoints protected by auth middleware?
+- [ ] **Missing authorization**: Do actions check that the current user is allowed?
+- [ ] **IDOR**: Can users access other users' resources by changing IDs in URLs/params?
+      Are queries scoped: `current_user.resources.find(params[:id])` vs `Resource.find(params[:id])`?
+- [ ] **Privilege escalation**: Can regular users access admin-only actions?
+      Are role checks enforced server-side (not just UI)?
+- [ ] **Session management**: Secure token generation? Proper expiration? HttpOnly cookies?
+
+### Sensitive Data Exposure (CRITICAL)
+
+- [ ] **Secrets in code**: API keys, passwords, tokens hardcoded? Check for Base64-encoded secrets.
+- [ ] **Secrets in logs**: PII, credentials, tokens logged? Check logger, console.log statements.
+- [ ] **Sensitive API responses**: Password hashes, internal IDs, admin flags, other users' PII
+      in API responses? Check serializers for overexposure.
+- [ ] **Missing encryption**: Sensitive data stored/transmitted without encryption?
+- [ ] **CORS**: Overly permissive `Access-Control-Allow-Origin: *`?
+
+### Input Validation (IMPORTANT)
+
+- [ ] **Missing validation**: Are controller params validated before use? Strong parameters?
+- [ ] **Type coercion**: Could type confusion bypass checks?
+- [ ] **File uploads**: Type validation? Size limits? Content sniffing protection?
+      Filename sanitization?
+- [ ] **ReDoS**: Complex regex patterns on user input that could cause catastrophic backtracking?
+- [ ] **Mass assignment**: `permit!` or overly broad `params.permit(...)` allowing
+      role/admin/internal fields to be set by users?
+
+### Security Misconfiguration (IMPORTANT)
+
+- [ ] **Debug/verbose errors**: Stack traces or internal details exposed in error responses?
+- [ ] **Default credentials**: Default passwords, API keys, or configurations?
+- [ ] **Missing security headers**: CSP, X-Frame-Options, X-Content-Type-Options?
+- [ ] **Dependency vulnerabilities**: Known CVEs in added/updated dependencies?
+
+### SSRF — Server-Side Request Forgery (IMPORTANT)
+
+- [ ] **User-controlled URLs**: Are user-supplied URLs passed to HTTP clients?
+- [ ] **Domain allowlist**: Are outbound HTTP requests restricted to a known-safe list of domains?
+- [ ] **Internal metadata**: Could a user trigger requests to internal metadata endpoints
+      (AWS `169.254.169.254`, GCP metadata server)?
+
+### Cryptographic Failures (IMPORTANT)
+
+- [ ] **Weak hash algorithms**: MD5 or SHA1 used for security-sensitive data?
+      Should use bcrypt/argon2 for passwords, SHA-256+ for tokens.
+- [ ] **Hardcoded secrets**: Encryption keys, salts, IVs, or API tokens hardcoded in source?
+- [ ] **`.env` committed**: Secret ENV files committed to version control?
+- [ ] **JWT payload exposure**: Sensitive data in JWT payload without encryption (signed ≠ encrypted)?
+
+### Logging & Monitoring (MINOR)
+
+- [ ] **Missing security event logs**: Failed auth attempts, permission denials, input validation
+      failures — are they logged for monitoring?
+- [ ] **Missing audit trail**: Sensitive operations (delete, role change, data export) — is there
+      an audit log?
+- [ ] **Error message leakage**: Do error messages reveal internal structure, file paths,
+      database schema, or stack traces?
+
+## Report Format
+
+For each finding, report:
+
+**[CRITICAL/IMPORTANT/MINOR] — [Category] — [Short description]**
+- File: `path/to/file:line_number`
+- Problem: [What's wrong — describe the attack vector clearly]
+- Recommendation: [Specific remediation with code snippet]
+- Impact: [What an attacker could do — data breach, privilege escalation, RCE, etc.]
+- CWE: [CWE ID, e.g., CWE-89 (SQL Injection), CWE-79 (XSS), CWE-862 (Missing Authorization)]
+
+## Assessment
+
+- **CRITICAL findings MUST be fixed before merge.** No exceptions.
+- **IMPORTANT findings MUST be fixed before merge.** No exceptions.
+- **MINOR findings** are noted but do not block merge.
+
+Final verdict:
+- **APPROVED**: No critical or important security findings
+- **CHANGES REQUIRED**: Critical or important security findings that must be fixed before merge
+
+## Review Loop
+
+1. **Critical findings:** Author MUST fix, re-run tests, then re-request security review
+2. **Important findings:** Author MUST fix, re-run tests, then re-request security review
+3. **Minor findings:** Note in review but do not block
+4. **Max 3 review cycles.** If critical or important findings persist after 3 cycles, escalate to user.
+
+After fixes, dispatch another security review to verify critical and important findings are resolved.