swe-workflow-skills 0.1.0 → 0.3.0

package/README.md

@@ -1,10 +1,10 @@
 # SWE Workflow Skills for Claude Code
 
 [![roles-check](https://github.com/SWEStash/swe-workflow-skills/actions/workflows/roles-check.yml/badge.svg)](https://github.com/SWEStash/swe-workflow-skills/actions/workflows/roles-check.yml)
-![skills](https://img.shields.io/badge/skills-44-blue)
-[![license](https://img.shields.io/github/license/SWEStash/swe-workflow-skills)](LICENSE)
+![skills](https://img.shields.io/badge/skills-65-blue)
+[![license: MIT](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)
 
-A curated library of **44 Claude Code Agent Skills** that walk Claude through the
+A curated library of **65 Claude Code Agent Skills** that walk Claude through the
 software lifecycle the way a disciplined senior engineer would — planning, design,
 TDD, review, security, deployment, incidents, and the project-management work around
 them.
@@ -17,21 +17,37 @@ LLM-as-judge eval harness.
 
 ## Why this library
 
-- **An orchestrator, not a pile of skills.** A `skill-router` skill maps your intent to
-  the right skill(s) and chains them across phases. Activation is *routed and
-  deterministic*, not left to fuzzy auto-triggering.
+Not just a pile of skills — an activation architecture, an eval discipline, and
+full-SDLC breadth that popular collections don't cover:
+
+- **An orchestrator, not auto-trigger roulette.** A `skill-router` skill maps your
+  intent to the right skill(s) and chains them across phases. Activation is *routed and
+  deterministic*, not left to fuzzy auto-triggering — the routing eval harness measures
+  it (top-1 accuracy 1.00, zero misroutes on the current baseline, regression-gated in
+  CI).
 - **Scales past Claude's skill-listing budget.** Claude Code only injects skill
   descriptions up to ~1% of context, so large libraries silently stop triggering past
   ~20–40 skills. This library keeps only the router + safety skills "loud" and lists the
-  rest **name-only** — so the router can invoke all 44 by name, with no cropping and
-  without making you pre-pick a subset ([how it works](docs/ROLES.md)).
-- **Role-scoped.** `/role backend` (or `frontend`, `devops`, `ml`, `security`,
-  `architect`, `em`, `pm`, `qa`, `designer`) promotes a working set to auto-trigger; the
-  rest stay one route away.
+  rest **name-only** — the mechanism Claude Code's own docs now recommend for large
+  installs — so the router can invoke every skill by name, with no cropping and without
+  making you pre-pick a subset ([how it works](docs/ROLES.md)).
+- **Tested like code, not prose.** Every skill ships 3 evals; two LLM-as-judge
+  harnesses (content quality and routing accuracy) replay them with skill loaded vs
+  absent and gate regressions in CI. Safety-critical skills (deploys, releases, tests,
+  incidents, security) are **hardened**: an Iron Law, a rationalization table distilled
+  from real baseline failures, and pressure tests that try to talk the agent out of it.
+- **Full-SDLC breadth.** Planning, architecture/ADRs, API and data design, TDD, review,
+  security, releases, deploys, GitOps, observability, incidents, MLOps, LLM apps
+  and AI evaluation, data pipelines and data quality, and the PM/strategy work
+  around them — a wider slice of the lifecycle than the community collections we
+  know of aim for (they tend to go deep on the coding inner loop; see
+  [Acknowledgements](#acknowledgements)).
+- **Role-scoped.** `/role backend` (or `frontend`, `devops`, `ml`, `ai`, `data`,
+  `data-scientist`, `security`, `architect`, `em`, `pm`, `strategy`, `qa`, `mobile`,
+  `designer`) promotes a working set to auto-trigger; the rest stay one route away.
 - **Cross-platform install.** The installer and SessionStart hook are **pure Node** — the
   one runtime Claude Code already requires — so they run identically on Linux, macOS, and
   Windows (no bash, Python, or `sed`).
-- **Tested.** Every skill ships 3 evals; safety/discipline skills add pressure tests.
 
 ## Quick Start
 
@@ -46,7 +62,7 @@ web, claude.ai chat, and Cowork):
 **Want the whole library with the orchestrator** (CLI) — no clone needed:
 
 ```bash
-npx swe-workflow-skills install --global   # all 44 skills + router + /role + the SessionStart hook
+npx swe-workflow-skills install --global   # all 65 skills + router + /role + the SessionStart hook
 ```
 
 Or from a clone: `node install.mjs --global`.
@@ -104,15 +120,19 @@ review) live in the `skill-router` skill and **[ROLES.md](docs/ROLES.md)**.
 
 ## What's included
 
-44 skills — **[full catalog → SKILLS.md](docs/SKILLS.md)**:
+65 skills — **[full catalog → SKILLS.md](docs/SKILLS.md)**:
 
 | Area | Count | Examples |
 |------|-------|----------|
-| Software Engineering | 23 | feature-planning, architecture-design, tdd-workflow, code-reviewing, security-audit, refactoring, incident-response |
-| Project Management | 6 | prd-writing, effort-estimation, metrics-and-okrs, retrospective, strategic-review |
-| DevOps | 5 | containerization, cicd-pipeline, infrastructure-as-code, gitops-delivery |
+| Software Engineering | 30 | feature-planning, plan-execution, architecture-design, threat-modeling, compliance-privacy, code-archaeology, tdd-workflow, security-audit, browser-verification, subagent-orchestration |
+| Project Management | 8 | brainstorming, prd-writing, effort-estimation, build-vs-buy, metrics-and-okrs, retrospective, strategic-review |
+| DevOps | 8 | containerization, cicd-pipeline, release-management, gitops-delivery, resilience-engineering, finops-cost-optimization |
 | Design | 3 | ui-ux-design, frontend-architecture, accessibility-design |
 | MLOps | 3 | ml-pipeline-design, ml-experiment-tracking, ml-model-deployment |
+| AI Engineering | 2 | llm-app-engineering, ai-evaluation |
+| Data Science | 3 | exploratory-data-analysis, statistical-analysis, notebook-to-production |
+| Data Engineering | 2 | data-pipeline-design, data-quality |
+| Mobile | 2 | mobile-architecture, mobile-release |
 | Evaluation & Monitoring | 2 | observability-design, test-data-strategy |
 | Meta | 2 | skill-router, writing-skills |
 
@@ -139,6 +159,27 @@ New or improved skills are welcome — start with **[AUTHORING.md](docs/AUTHORIN
 install the `writing-skills` skill). The short version: descriptions are everything, keep
 SKILL.md concise with detail in `references/`, and ship exactly 3 evals.
 
+## Acknowledgements
+
+This library stands on ideas from projects we found genuinely useful:
+
+- **[obra/superpowers](https://github.com/obra/superpowers)** — the guardrail pattern
+  our hardened safety skills adopt (an Iron Law, a rationalization table distilled from
+  real failures, and pressure tests that try to talk the agent out of it) comes from
+  Jesse Vincent's work here, as does the idea of a Socratic brainstorming skill as the
+  entry point to a feature. Superpowers goes deeper on the coding inner loop than we do;
+  if that's what you want, use it.
+- **[anthropics/skills](https://github.com/anthropics/skills)** — Anthropic's official
+  skills (and `skill-creator` in particular) are the authoring practice we benchmark
+  ours against; the eval-first loop in [AUTHORING.md](docs/AUTHORING.md) follows the
+  same instinct.
+- **The [Agent Skills docs](https://code.claude.com/docs/en/skills) and Anthropic's
+  engineering posts** — progressive disclosure, the listing budget, and the
+  `name-only` + `skillOverrides` activation surface this library's routing model is
+  built on.
+- **The awesome-claude-skills community lists** — the ecosystem survey that shaped our
+  gap analysis of what a full-SDLC library should cover.
+
 ## License
 
 MIT — see [LICENSE](LICENSE).

package/VERSION

@@ -1 +1 @@
-0.1.0
+0.3.0

package/catalog.json

@@ -6,6 +6,11 @@
       "description": "Design and implement accessible web/mobile apps to WCAG 2.1/2.2 — semantic HTML, ARIA patterns, keyboard navigation, focus management, color contrast, screen readers, accessible forms. Triggers: accessibility, a11y, WCAG, screen reader, keyboard navigation, ARIA, focus management, color contrast, alt text, semantic HTML, tab order, focus trap, skip link, announce. Build it in, don't bolt it on.",
       "path": "accessibility-design/SKILL.md"
     },
+    {
+      "name": "ai-evaluation",
+      "description": "Define how to evaluate ML models and GenAI/LLM apps — golden datasets, offline metrics, RAG evaluation (faithfulness, relevance, context precision/recall) with ragas/deepeval/promptfoo, LLM-as-judge design and calibration, eval regression gates in CI, online A/B and human feedback. Logging/comparing runs → ml-experiment-tracking; building the app → llm-app-engineering; general experiment statistics → statistical-analysis. Triggers: evaluate the model, eval my chatbot, RAG evals, ragas, LLM as judge, golden dataset, eval suite, is the new prompt better, hallucination rate, benchmark our AI app.",
+      "path": "ai-evaluation/SKILL.md"
+    },
     {
       "name": "api-design",
       "description": "Design RESTful and GraphQL APIs — endpoint naming, request/response contracts, error handling, pagination, versioning, auth patterns, OpenAPI specs. Triggers: design the API, API contract, REST API, GraphQL schema, error response format, pagination, API versioning, OpenAPI, swagger, endpoints. Use architecture-design for REST-vs-GraphQL or monolith-vs-microservices decisions.",
@@ -13,7 +18,7 @@
     },
     {
       "name": "architecture-design",
-      "description": "Guide architectural and structural decisions using Architecture Decision Records (ADRs) — new services, pattern choices, database selection, component boundaries, state management, costly-to-reverse decisions. Triggers: how should I architect, which pattern, design decision, should I use X or Y, system design, ADR, component design, architectural trade-off.",
+      "description": "Guide architectural and structural decisions using Architecture Decision Records (ADRs) — new services, pattern choices, database selection, component boundaries, state management, costly-to-reverse decisions. Triggers: how should I architect, which pattern, design decision, should I use X or Y, system design, ADR, component design, architectural trade-off. Owns internal-structure decisions — build vs buy/adopt a vendor or OSS capability → build-vs-buy.",
       "path": "architecture-design/SKILL.md"
     },
     {
@@ -21,21 +26,46 @@
       "description": "Design and maintain architecture documentation with multi-level diagrams (C4) and docs-as-code. Triggers: architecture diagram, document the architecture, C4 diagram, system context, container diagram, component diagram, architecture docs, docs-as-code, PlantUML, Structurizr, D2, Mermaid architecture, infrastructure diagram, runtime flow. Use architecture-design for ADRs.",
       "path": "architecture-documentation/SKILL.md"
     },
+    {
+      "name": "brainstorming",
+      "description": "Facilitate divergent ideation before committing to a spec — Socratic questioning, widening the option space, challenging assumptions and inherited constraints, then converging on candidates. Triggers: brainstorm, let's explore ideas, what are our options, help me think through, generate ideas, what could we build, not sure what I want, explore approaches, ideate. Once ideas converge, hand off to prd-writing (WHAT/WHY) or feature-planning (breakdown) — this skill opens options; those close them.",
+      "path": "brainstorming/SKILL.md"
+    },
+    {
+      "name": "browser-verification",
+      "description": "Verify a web app change by driving the real UI in a browser — reproduce the user flow end to end, watch console errors and network failures, exercise loading/error/empty states, capture screenshots as evidence. Use before claiming a UI change works. Triggers: check it in the browser, verify the UI, click through the flow, console errors, test it like a user, smoke test the frontend. Designing persistent test suites → test-suite-design; the generic done-gate → verification-before-completion (this is its browser-specific practice).",
+      "path": "browser-verification/SKILL.md"
+    },
     {
       "name": "bug-investigating",
       "description": "Systematic debugging and root cause analysis using structured methodology — reproduce, isolate, hypothesize, verify. Triggers: this doesn't work, I'm getting an error, something is broken, bug, debug this, why is this happening, unexpected behavior, regression, root cause, stack trace, error message.",
       "path": "bug-investigating/SKILL.md"
     },
+    {
+      "name": "build-vs-buy",
+      "description": "Decide whether to build in-house, buy a vendor/SaaS product, or adopt OSS — core-vs-commodity framing, multi-year total cost of ownership, integration and maintenance burden, vendor viability, lock-in and exit costs. Triggers: build vs buy, build or buy, vendor evaluation, SaaS vs in-house, should we adopt this open source, TCO, total cost of ownership, lock-in, exit cost, make or buy, off the shelf. Internal-structure decisions (patterns, service boundaries, ADRs for your own code) → architecture-design.",
+      "path": "build-vs-buy/SKILL.md"
+    },
     {
       "name": "cicd-pipeline",
       "description": "Design CI/CD pipelines for automated build, test, deploy — GitHub Actions, GitLab CI, quality gates. Triggers: CI/CD, pipeline, GitHub Actions, GitLab CI, workflow, automated deployment, build pipeline, continuous integration, continuous deployment, automate tests on PR, deploy automatically, quality gate.",
       "path": "cicd-pipeline/SKILL.md"
     },
+    {
+      "name": "code-archaeology",
+      "description": "Understand unfamiliar or legacy code before changing it — map entry points, mine git history (blame, churn, log -S), trace data flow, recover the why behind odd code, pin current behavior with characterization tests, find seams for safe change. Triggers: understand this codebase, legacy code, inherited this project, what does this code do, why is it written this way, nobody knows how this works, onboard to this repo, is it safe to change this. Prioritizing debt → technical-debt-review; improving code you already understand → refactoring.",
+      "path": "code-archaeology/SKILL.md"
+    },
     {
       "name": "code-reviewing",
       "description": "Structured code reviews enforcing DRY, KISS, YAGNI, SRP, best practices, and project conventions. Triggers: review this code, code review, check my code, what do you think of this implementation, review this PR, is this code good, feedback on my code, review staged changes before commit.",
       "path": "code-reviewing/SKILL.md"
     },
+    {
+      "name": "compliance-privacy",
+      "description": "Engineer for regulatory and privacy obligations — GDPR/CCPA privacy-by-design, PII data mapping and minimization, retention and deletion (right to erasure), data subject requests, consent, SOC 2 controls (access, change management, audit logging). Triggers: GDPR, CCPA, SOC 2, HIPAA, compliance, privacy review, PII, personal data, data retention, right to be forgotten, DSR, audit requirements, are we compliant. Vulnerabilities in code → security-audit; attack analysis of a design → threat-modeling.",
+      "path": "compliance-privacy/SKILL.md"
+    },
     {
       "name": "configuration-strategy",
       "description": "Design environment configuration, secrets management, and feature-flag hierarchy for a service or feature. Triggers: config strategy, environment variables, .env, secrets management, feature flag, config hierarchy, config precedence, twelve-factor config, environment-specific settings.",
@@ -51,6 +81,16 @@
       "description": "Design database schemas, relationships, indexes, and migration strategies — relational and document stores. Triggers: data model, schema design, ER diagram, database schema, table design, foreign key, index strategy, normalization, denormalization, migration plan, document model, partition key.",
       "path": "data-modeling/SKILL.md"
     },
+    {
+      "name": "data-pipeline-design",
+      "description": "Design batch and streaming data pipelines — ELT into a warehouse/lakehouse, dbt and analytics engineering (staging/intermediate/marts layers), orchestration with Airflow or Dagster, idempotent loads, incremental models, backfills, CDC ingestion. Triggers: data pipeline, ELT, ETL, dbt models, data warehouse, Snowflake, BigQuery, ingest into the warehouse, Airflow DAG, Dagster, Kafka streaming, backfill, incremental load, nightly job duplicates rows. ML training/feature pipelines → ml-pipeline-design; validating the data → data-quality.",
+      "path": "data-pipeline-design/SKILL.md"
+    },
+    {
+      "name": "data-quality",
+      "description": "Keep warehouse and pipeline data trustworthy — dbt tests, expectations (Great Expectations/Soda), data contracts with upstream producers, source freshness, schema-drift and volume anomaly detection, lineage and blast radius, severity and alerting. Triggers: data quality, bad data in dashboards, data validation, dbt tests, data contract, schema drift, stale data, freshness check, duplicate rows, nulls in the warehouse, data lineage, data SLA, upstream schema change broke us. Generating test/synthetic data → test-data-strategy; schema design → data-modeling.",
+      "path": "data-quality/SKILL.md"
+    },
     {
       "name": "dependency-impact-analysis",
       "description": "Map the blast radius of a change before implementing — find dependents, classify breaking vs additive, identify coordination needs, produce a propagation plan. Triggers: what will break if I change this, blast radius, impact analysis, breaking change, who depends on this, downstream impact, safe to rename, shared schema change, dependency graph.",
@@ -71,16 +111,31 @@
       "description": "Design a deployment (GitOps) repo that orchestrates multiple services in a polyrepo — version pinning, environment promotion, compatibility matrices, system config. Triggers: deployment repo, GitOps repo, polyrepo, multi-repo, version pinning, compatibility matrix, environment promotion, multi-service deployment, orchestration repo, which versions work together.",
       "path": "deployment-repo/SKILL.md"
     },
+    {
+      "name": "dx-audit",
+      "description": "Audit and improve developer experience — inner-loop feedback (build/test/reload times), CI wait and queue times, flaky tests, local environment setup, onboarding time-to-first-PR, tooling friction, docs discoverability; produce a prioritized remediation plan. Triggers: developer experience, DX audit, devex, builds are slow, CI takes forever, flaky tests, onboarding takes weeks, tooling friction, developer productivity, engineers are frustrated. Code health/debt hotspots → technical-debt-review; designing one pipeline → cicd-pipeline.",
+      "path": "dx-audit/SKILL.md"
+    },
     {
       "name": "effort-estimation",
       "description": "Estimate engineering effort with agile techniques — story points, t-shirt sizing, three-point estimation, capacity planning. Triggers: estimate this, how long will this take, story points, t-shirt sizing, effort estimation, capacity planning, sprint planning, budget estimate, forecast, velocity, when will this be done.",
       "path": "effort-estimation/SKILL.md"
     },
+    {
+      "name": "exploratory-data-analysis",
+      "description": "Explore and profile an unfamiliar dataset before modeling or analysis — structural profiling, missingness structure, distributions and outliers, feature–target relationships, leakage awareness, and explicit hypothesis generation. Pipeline-level data trust (broken dashboards, tests, contracts, freshness) → data-quality; formal inference on the hypotheses → statistical-analysis. Triggers: explore this dataset, EDA, profile the data, what's in this data, first look at the data, understand this CSV, distributions, outliers, missing values, correlation, data leakage.",
+      "path": "exploratory-data-analysis/SKILL.md"
+    },
     {
       "name": "feature-planning",
-      "description": "Break features into well-scoped tasks with acceptance criteria, risk assessment, and dependency mapping. Triggers: plan this, break this down, scope this feature, create tasks for, sprint planning, how should I implement this feature, user stories, acceptance criteria, dependency mapping, feature breakdown.",
+      "description": "Break features into well-scoped tasks with acceptance criteria, risk assessment, and dependency mapping. Triggers: plan this, break this down, scope this feature, create tasks for, sprint planning, how should I implement this feature, user stories, acceptance criteria, dependency mapping, feature breakdown. Creates the plan — executing an already-approved plan checkpoint by checkpoint → plan-execution.",
       "path": "feature-planning/SKILL.md"
     },
+    {
+      "name": "finops-cost-optimization",
+      "description": "Understand and reduce cloud spend — cost visibility and allocation (tagging, ownership), unit economics, rightsizing, autoscaling, commitment discounts (reserved instances, savings plans), storage/egress traps, architecture cost review, budgets and anomaly alerts. Triggers: cloud costs, AWS bill, cut costs, cost optimization, FinOps, why is our bill so high, rightsizing, reserved instances, savings plan, egress fees, cost per customer. Whether to build or buy a capability → build-vs-buy; making code faster → performance-optimization.",
+      "path": "finops-cost-optimization/SKILL.md"
+    },
     {
       "name": "frontend-architecture",
       "description": "Design frontend architecture — React component hierarchy, state management, design tokens, data fetching, routing, error boundaries, code organization. Triggers: component architecture, state management, design system, design tokens, component library, React structure, folder structure, Zustand vs Redux, React Query, code splitting, error boundary, compound component.",
@@ -106,6 +161,11 @@
       "description": "Write and review IaC with Terraform, CloudFormation, Pulumi, or CDK — modularity, security, state management. Triggers: Terraform, CloudFormation, Pulumi, infrastructure as code, IaC, provision, cloud resources, terraform module, state management, terraform plan, CDK, drift, remote state.",
       "path": "infrastructure-as-code/SKILL.md"
     },
+    {
+      "name": "llm-app-engineering",
+      "description": "Design and build LLM-powered applications — prompt and context engineering, RAG architecture (chunking, hybrid retrieval, reranking, grounded prompts), agent design (tool surfaces, planning, sub-agents), and memory. Triggers: build a chatbot, LLM app, AI assistant, prompt engineering, system prompt, RAG design, chunking, embeddings, vector database, semantic search, AI agent, tool calling, agent memory, context window, hallucinations. Measuring quality → ai-evaluation; model serving/inference infra → ml-model-deployment.",
+      "path": "llm-app-engineering/SKILL.md"
+    },
     {
       "name": "metrics-and-okrs",
       "description": "Define OKRs, KPIs, success metrics, and engineering health metrics (DORA). Triggers: OKR, KPI, metrics, success metrics, key results, objectives, measure success, DORA metrics, engineering metrics, velocity, cycle time, deployment frequency, how do we measure, what should we track.",
@@ -113,7 +173,7 @@
     },
     {
       "name": "ml-experiment-tracking",
-      "description": "Design reproducible ML experiments — tracking, versioning, run comparison with MLflow, W&B, or DVC. Triggers: experiment tracking, MLflow, wandb, weights and biases, DVC, track experiments, compare models, hyperparameter, reproducibility, model registry, which model is better, experiment results, log metrics.",
+      "description": "Design reproducible ML experiments — tracking, versioning, run comparison with MLflow, W&B, or DVC. Triggers: experiment tracking, MLflow, wandb, weights and biases, DVC, track experiments, compare models, hyperparameter, reproducibility, model registry, which model is better, experiment results, log metrics. Defining WHAT to measure (metrics, golden datasets, judges) → ai-evaluation; this skill records and compares the runs.",
       "path": "ml-experiment-tracking/SKILL.md"
     },
     {
@@ -123,9 +183,24 @@
     },
     {
       "name": "ml-pipeline-design",
-      "description": "Design reproducible ML training and data pipelines — ingestion, validation, feature engineering, training, evaluation, continuous training orchestration. Triggers: training pipeline, data pipeline, feature engineering, ETL for ML, continuous training, data validation, feature store, preprocessing, notebook to pipeline, orchestrate training, Airflow, Kubeflow, pipeline DAG.",
+      "description": "Design reproducible ML training and data pipelines — ingestion, validation, feature engineering, training, evaluation, continuous training orchestration. Analytics/BI ELT and dbt warehouse pipelines → data-pipeline-design; refactoring general analysis/reporting notebooks (no model training) to production code → notebook-to-production. Triggers: training pipeline, ML data pipeline, feature engineering, ETL for ML, continuous training, data validation, feature store, preprocessing, notebook to training pipeline, orchestrate training, Kubeflow, pipeline DAG, point-in-time features.",
       "path": "ml-pipeline-design/SKILL.md"
     },
+    {
+      "name": "mobile-architecture",
+      "description": "Design mobile app architecture — native (Swift/Kotlin) vs cross-platform (React Native/Flutter) selection, navigation and deep linking, state management, offline-first design and data sync, local persistence, push notifications, platform constraints (background work, battery, permissions). Triggers: mobile app architecture, iOS app, Android app, React Native or Flutter, offline first, data sync, mobile state management, deep linking, push notifications, app structure. Web SPA component architecture → frontend-architecture.",
+      "path": "mobile-architecture/SKILL.md"
+    },
+    {
+      "name": "mobile-release",
+      "description": "Ship mobile apps through the app stores — signing and provisioning, store review and rejection handling, phased/staged rollouts with halt criteria, crash monitoring, versioning and build numbers, beta channels (TestFlight, Play tracks), forced updates, and the no-instant-rollback reality of mobile. Triggers: app store release, publish to App Store, Play Store, TestFlight, staged rollout, app review rejected, code signing, provisioning profile, mobile release, hotfix a mobile bug. General semver/registry/library publishing → release-management.",
+      "path": "mobile-release/SKILL.md"
+    },
+    {
+      "name": "notebook-to-production",
+      "description": "Refactor analysis notebooks into production-grade code — triage what deserves productionizing, extract modules with tests, parameterize hardcoded values, pin environments for reproducibility, and schedule unattended runs with alerting. Owns general analysis/reporting notebooks; notebooks that feed model TRAINING (feature engineering + training DAGs, scheduled retraining) → ml-pipeline-design. Triggers: productionize this notebook, notebook to script, notebook to module, refactor my notebook, parameterize notebook, papermill, schedule this analysis, reproducible analysis, notebook is a mess.",
+      "path": "notebook-to-production/SKILL.md"
+    },
     {
       "name": "observability-design",
       "description": "Design production observability — SLIs, SLOs, SLAs, error budgets, OpenTelemetry traces/metrics/logs, structured logging, alerting, dashboards. Triggers: SLO, SLI, SLA, error budget, observability, monitoring, OpenTelemetry, OTel, tracing, distributed tracing, structured logging, alerting, dashboard, metrics, correlation ID, alert fatigue.",
@@ -136,6 +211,11 @@
       "description": "Identify and resolve performance bottlenecks via static analysis — N+1 queries, algorithmic complexity, query optimization, caching, memory leaks, bundle size, connection management. Triggers: this is slow, optimize, performance, N+1, query optimization, caching, bundle size, memory leak, latency, response time, scale, bottleneck.",
       "path": "performance-optimization/SKILL.md"
     },
+    {
+      "name": "plan-execution",
+      "description": "Execute an already-approved plan with discipline — batch tasks into verifiable checkpoints, verify each with fresh evidence before marking it done, log drift, and stop to re-plan when reality diverges from the plan's assumptions. Triggers: execute the plan, implement the approved plan, work through this plan, continue/resume the plan, next phase, checkpoint. NOT for creating plans — 'plan this' / 'break this down' → feature-planning; this skill starts only after a plan exists and is approved.",
+      "path": "plan-execution/SKILL.md"
+    },
     {
       "name": "prd-writing",
       "description": "Write lightweight agile PRDs and technical RFCs that align stakeholders before implementation. Triggers: PRD, product requirements, RFC, request for comments, technical design doc, design document, tech spec, write requirements, what are we building, spec this out. Produces the WHAT and WHY — feature-planning handles HOW.",
@@ -153,7 +233,7 @@
     },
     {
       "name": "project-review",
-      "description": "Review a built project's execution health before a milestone — scope alignment, roadmap / execution-plan adherence, implementation maturity (what's production-ready vs stub/deferred), and the evidence it actually works (tests, coverage, validation results, changelog). Triggers: project review, execution review, are we on track, implementation vs roadmap, scope drift, readiness review, what's actually built, validation results review, pre-launch review. Use strategic-review for vision/positioning/market; technical-debt-review for a pure code-health audit.",
+      "description": "Review a built project's execution health before a milestone — scope alignment, roadmap / execution-plan adherence, implementation maturity (what's production-ready vs stub/deferred), and the evidence it actually works (tests, coverage, validation results, changelog). Use strategic-review for vision/positioning/market; technical-debt-review for a pure code-health audit. Triggers: project review, execution review, are we on track, implementation vs roadmap, scope drift, readiness review, what's actually built, validation results review, pre-launch review.",
       "path": "project-review/SKILL.md"
     },
     {
@@ -161,6 +241,16 @@
       "description": "Systematic code improvement via design principles, smell detection, and safe transformation patterns. Triggers: refactor this, clean this up, simplify this code, reduce complexity, extract this, this code is messy, tech debt, improve this code, code smell, rename, extract function, dead code.",
       "path": "refactoring/SKILL.md"
     },
+    {
+      "name": "release-management",
+      "description": "Cut and publish software releases right-sized to the project — semver decisions, changelogs, tagging, automated version bumps (release-please, changesets, semantic-release), publishing gates, npm/PyPI/container registry publishing, pre-release channels, monorepo versioning. Triggers: cut a release, release this, publish to npm, publish to PyPI, publish this package, version bump, what version should this be, semver, changelog, tag a release, release notes, GitHub release, prerelease, release automation, release PR. Deploy-time safety → deployment-checklist; commit/PR hygiene → git-workflow.",
+      "path": "release-management/SKILL.md"
+    },
+    {
+      "name": "resilience-engineering",
+      "description": "Design systems that survive failure — failure-mode analysis, resilience patterns (timeouts, retries with backoff, circuit breakers, bulkheads, load shedding, graceful degradation), chaos experiments, disaster recovery with RTO/RPO, backup restore testing, game days. Triggers: chaos engineering, disaster recovery, DR plan, what if the database goes down, single point of failure, failover, circuit breaker, RTO, RPO, game day, high availability. An incident happening NOW → incident-response; undoing a bad deploy → rollback-strategy.",
+      "path": "resilience-engineering/SKILL.md"
+    },
     {
       "name": "retrospective",
       "description": "Facilitate sprint retros, project post-mortems, and incident post-mortems with actionable, owned improvements. Triggers: retrospective, retro, post-mortem, postmortem, lessons learned, what went wrong, what went well, incident review, blameless, action items, sprint review, after action review.",
@@ -173,19 +263,29 @@
     },
     {
       "name": "security-audit",
-      "description": "Comprehensive security analysis — OWASP Top 10, auth/authz flows, injection vulnerabilities, data exposure, secrets detection, dependency CVEs, hardening recommendations. Triggers: security audit, vulnerability, is this secure, security review, pentest prep, OWASP, harden this, check for vulnerabilities, injection, XSS, CSRF, auth security.",
+      "description": "Comprehensive security analysis — OWASP Top 10, auth/authz flows, injection vulnerabilities, data exposure, secrets detection, dependency CVEs, hardening recommendations. Reviews EXISTING code/config — design-time analysis of a system not yet built → threat-modeling. Triggers: security audit, vulnerability, is this secure, security review, pentest prep, OWASP, harden this, check for vulnerabilities, injection, XSS, CSRF, auth security.",
       "path": "security-audit/SKILL.md"
     },
     {
       "name": "skill-router",
-      "description": "Orchestrator and entry point for the swe-workflow skills library — consult FIRST when starting any non-trivial software task; most skills load name-only and only activate when invoked here. Triggers: starting a feature, planning, an architecture or design decision, implementing, debugging, reviewing, refactoring, testing, security, deployment, an incident, shipping, or unsure which skill fits. Routes intent to the right skill(s) and invokes them by name; shows the Golden Path chains.",
+      "description": "Orchestrator and entry point for the swe-workflow skills library — consult FIRST when starting any non-trivial software task; most skills load name-only and only activate when invoked here. Routes intent to the right skill(s) and invokes them by name; shows the Golden Path chains. Triggers: starting a feature, planning, an architecture or design decision, implementing, debugging, reviewing, refactoring, testing, security, deployment, an incident, shipping, or unsure which skill fits.",
       "path": "skill-router/SKILL.md"
     },
+    {
+      "name": "statistical-analysis",
+      "description": "Design and analyze experiments and statistical tests — test selection with stated assumptions, sample size and power, effect sizes and confidence intervals over bare p-values, and pitfall discipline (multiple comparisons, p-hacking, peeking/optional stopping). Owns experiment statistics generally; live A/B evaluation of AI/LLM apps (quality metrics, judges, feedback) → ai-evaluation. Triggers: hypothesis test, t-test, chi-square, p-value, statistical significance, confidence interval, sample size, power analysis, design an experiment, A/B test, multiple comparisons, is this difference real.",
+      "path": "statistical-analysis/SKILL.md"
+    },
     {
       "name": "strategic-review",
-      "description": "Review a project's strategic position before going public, launching, or raising — vision, mission, value proposition, scope positioning, the defensible wedge, and a live competitive / market comparative analysis. Triggers: strategic review, positioning, go public, go-to-market, market analysis, competitive landscape, value proposition, is there a moat, who are our competitors, platform absorption risk, market positioning, comparable products. Use project-review for execution/roadmap/implementation health; delegates deep market scans to deep-research.",
+      "description": "Review a project's strategic position before going public, launching, or raising — vision, mission, value proposition, scope positioning, the defensible wedge, and a live competitive / market comparative analysis. Use project-review for execution/roadmap/implementation health; delegates deep market scans to deep-research. Triggers: strategic review, positioning, go public, go-to-market, market analysis, competitive landscape, value proposition, is there a moat, who are our competitors, platform absorption risk, market positioning, comparable products.",
       "path": "strategic-review/SKILL.md"
     },
+    {
+      "name": "subagent-orchestration",
+      "description": "Decompose big or parallelizable work across subagents — when to fan out vs stay solo, scoping self-contained sub-tasks, prompting agents that don't share your context, isolating parallel edits (git worktrees), skeptically verifying and synthesizing results you didn't produce. Triggers: use subagents, parallelize this, fan out, orchestrate agents, multi-agent, spawn agents, worktree, delegate to agents, split this across agents, agent team. Sequencing checkpoints of an approved plan → plan-execution (orchestration parallelizes within its batches).",
+      "path": "subagent-orchestration/SKILL.md"
+    },
     {
       "name": "tdd-workflow",
       "description": "Guide test-driven development with red-green-refactor. Triggers: use tdd, test first, write the tests, red green refactor, test-driven, what should I test, write tests before code, failing test, implement using TDD. For NEW code via test-first — use test-suite-design for adding tests to existing code.",
@@ -206,6 +306,11 @@
       "description": "Design comprehensive test suites for existing code — strategy across unit/integration/e2e, fixtures, factories, helpers. Triggers: add tests, write tests for, increase coverage, test this module, testing strategy, test plan, what tests do I need, test infrastructure, test helpers, this has no tests. Not for TDD — use tdd-workflow.",
       "path": "test-suite-design/SKILL.md"
     },
+    {
+      "name": "threat-modeling",
+      "description": "Design-time security analysis of a system or feature before it's built — trust boundaries, attack surface, STRIDE per element, abuse cases, prioritized mitigations that become security requirements. Triggers: threat model, STRIDE, trust boundary, attack surface, what could go wrong security-wise, security design review, abuse case, secure this design, security requirements. Reviewing EXISTING code/config for vulnerabilities → security-audit; use this skill while the design is still on the whiteboard.",
+      "path": "threat-modeling/SKILL.md"
+    },
     {
       "name": "ui-ux-design",
       "description": "Design user experiences from an engineer's perspective — user flows, wireframes, interaction patterns, responsive strategy, navigation, loading/error/empty states. Triggers: design the UI, user flow, wireframe, how should this screen look, loading state, error state, empty state, responsive design, navigation, page layout, form design, mockup.",

package/commands/role.md

@@ -8,10 +8,21 @@ disable-model-invocation: true
 
 The user is managing the active swe-workflow skill role. The requested role argument is: `$ARGUMENTS`
 
-Run this script exactly once via Bash, then report the result to the user concisely (the new active role, and that the change hot-reloads so it applies to the next prompt):
+**Validate the argument before running anything.** It must be empty or match
+`^[a-z0-9_-]{1,32}$` (role keys are short kebab-case names). If it does not match —
+any spaces, quotes, `$`, backticks, slashes, or other characters — do NOT run the
+script below with it: reply that the role name is invalid and show the available
+roles by running only `node "@@RESOLVE@@" roles` (with `ROLES_JSON="@@ROLES@@"`
+exported).
+
+If the argument is valid, run this script exactly once via Bash, replacing
+`__ROLE__` with the validated argument (or with nothing when no argument was
+given), then report the result to the user concisely (the new active role, and
+that the change hot-reloads so it applies to the next prompt):
 
 ```bash
-ROLE="$ARGUMENTS"
+ROLE="__ROLE__"
+case "$ROLE" in *[!a-zA-Z0-9_-]*) echo "invalid role name" >&2; exit 1;; esac
 RESOLVE="@@RESOLVE@@"; SKILLS="@@SKILLS@@"; SETTINGS="@@SETTINGS@@"
 ROLES="@@ROLES@@"; ACTIVE="@@ACTIVE_ROLE@@"
 export ROLES_JSON="$ROLES"
@@ -32,3 +43,4 @@ fi
 Notes:
 - `skillOverrides` and the skill listing hot-reload when `settings.local.json` changes, so the new auto-trigger set takes effect on the next prompt without a restart.
 - This command is for the full (all-skills) CLI install. Hard-subset (`--role`) installs and the per-role marketplace plugins don't need it.
+- Security: the script deliberately never embeds `$ARGUMENTS` directly (slash-command templates interpolate it as text, so a crafted argument would execute in the shell). The value reaches the script only via the validated `__ROLE__` transfer above; the in-script `case` guard is defense-in-depth.

package/install.mjs

@@ -161,6 +161,17 @@ if (role) {
   }
 }
 
+// Positional args must be exact skill names, never paths: a traversal like
+// `install.mjs ../..` would pass the isDir guard below and the clean-copy rmSync
+// would then delete outside the destination. Reject before touching anything.
+if (selected.length > 0) {
+  const known = new Set(listSkillDirs());
+  const bad = selected.filter((s) => !known.has(s));
+  if (bad.length > 0) {
+    fatal(`unknown skill(s): ${bad.join(", ")}. Run 'install.mjs --list' to see skills.`);
+  }
+}
+
 // ---- resolve destination ---------------------------------------------------
 
 let claudeDir;
@@ -298,15 +309,24 @@ function copyIfExists(src, destPath) {
   if (existsSync(src)) cpSync(src, destPath);
 }
 
-// The SessionStart block to merge into settings.json. JSON.stringify keeps the path
-// correctly escaped on every OS (Windows backslashes included).
+// Double-quote a path for the POSIX shell that runs the hook command, escaping the
+// chars that stay active inside double quotes (\ $ ` "). Without the $/` escapes, a
+// config path containing e.g. `$(cmd)` would run that command substitution at every
+// session start. For \ and " this produces exactly what JSON.stringify used to (so
+// Windows paths render unchanged); cmd.exe keeps the backslash before $/`, but paths
+// with those chars are effectively POSIX-only.
+function shellQuote(p) {
+  return '"' + p.replace(/[\\$`"]/g, (c) => "\\" + c) + '"';
+}
+
+// The SessionStart block to merge into settings.json.
 function hookSnippet(path) {
   const block = {
     hooks: {
       SessionStart: [
         {
           matcher: "startup|resume|clear|compact",
-          hooks: [{ type: "command", command: `node ${JSON.stringify(path)}` }],
+          hooks: [{ type: "command", command: `node ${shellQuote(path)}` }],
         },
       ],
     },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "swe-workflow-skills",
-  "version": "0.1.0",
-  "description": "A curated library of 44 Claude Code Agent Skills for the software lifecycle, with orchestrator-routed activation that scales past the skill-listing budget.",
+  "version": "0.3.0",
+  "description": "A curated library of Claude Code Agent Skills covering the full software lifecycle, with orchestrator-routed activation that scales past the skill-listing budget.",
   "type": "module",
   "bin": {
     "swe-workflow-skills": "bin/cli.mjs"