swe-workflow-skills 0.10.0 → 0.10.1

package/VERSION

@@ -1 +1 @@
-0.10.0
+0.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swe-workflow-skills",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "A curated library of Claude Code Agent Skills covering the full software lifecycle, with orchestrator-routed activation that scales past the skill-listing budget.",
   "type": "module",
   "bin": {

package/skills/accessibility-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: accessibility-design
 description: "Design and implement accessible web/mobile apps to WCAG 2.1/2.2 — semantic HTML, ARIA patterns, keyboard navigation, focus management, color contrast, screen readers, accessible forms. Triggers: accessibility, a11y, WCAG, screen reader, keyboard navigation, ARIA, focus management, color contrast, alt text, semantic HTML, tab order, focus trap, skip link, announce. Build it in, don't bolt it on."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Accessibility Design

package/skills/ai-evaluation/SKILL.md

@@ -2,7 +2,6 @@
 name: ai-evaluation
 description: "Define how to evaluate ML models and GenAI/LLM apps — golden datasets, offline metrics, RAG evaluation (faithfulness, relevance, context precision/recall) with ragas/deepeval/promptfoo, LLM-as-judge design and calibration, eval regression gates in CI, online A/B and human feedback. Logging/comparing runs → ml-experiment-tracking; building the app → llm-app-engineering; general experiment statistics → statistical-analysis."
 when_to_use: "Triggers: evaluate the model, eval my chatbot, RAG evals, ragas, LLM as judge, golden dataset, eval suite, is the new prompt better, hallucination rate, benchmark our AI app."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # AI Evaluation

package/skills/api-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: api-design
 description: "Design RESTful and GraphQL APIs — endpoint naming, request/response contracts, error handling, pagination, versioning, auth patterns, OpenAPI specs. Triggers: design the API, API contract, REST API, GraphQL schema, error response format, pagination, API versioning, OpenAPI, swagger, endpoints. Use architecture-design for REST-vs-GraphQL or monolith-vs-microservices decisions."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # API Design

package/skills/architecture-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: architecture-design
 description: "Guide architectural and structural decisions using Architecture Decision Records (ADRs) — new services, pattern choices, database selection, component boundaries, state management, costly-to-reverse decisions. Triggers: how should I architect, which pattern, design decision, should I use X or Y, system design, ADR, component design, architectural trade-off. Owns internal-structure decisions — build vs buy/adopt a vendor or OSS capability → build-vs-buy."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Architecture Design

package/skills/architecture-documentation/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: architecture-documentation
 description: "Design and maintain architecture documentation with multi-level diagrams (C4) and docs-as-code. Triggers: architecture diagram, document the architecture, C4 diagram, system context, container diagram, component diagram, architecture docs, docs-as-code, PlantUML, Structurizr, D2, Mermaid architecture, infrastructure diagram, runtime flow. Use architecture-design for ADRs."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Architecture Documentation

package/skills/brainstorming/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: brainstorming
 description: "Facilitate divergent ideation before committing to a spec — Socratic questioning, widening the option space, challenging assumptions and inherited constraints, then converging on candidates. Triggers: brainstorm, let's explore ideas, what are our options, help me think through, generate ideas, what could we build, not sure what I want, explore approaches, ideate. Once ideas converge, hand off to prd-writing (WHAT/WHY) or feature-planning (breakdown) — this skill opens options; those close them."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Brainstorming

package/skills/browser-verification/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: browser-verification
 description: "Verify a web app change by driving the real UI in a browser — reproduce the user flow end to end, watch console errors and network failures, exercise loading/error/empty states, capture screenshots as evidence. Use before claiming a UI change works. Triggers: check it in the browser, verify the UI, click through the flow, console errors, test it like a user, smoke test the frontend. Designing persistent test suites → test-suite-design; the generic done-gate → verification-before-completion (this is its browser-specific practice)."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Browser Verification

package/skills/bug-investigating/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: bug-investigating
 description: "Systematic debugging and root cause analysis using structured methodology — reproduce, isolate, hypothesize, verify. Triggers: this doesn't work, I'm getting an error, something is broken, bug, debug this, why is this happening, unexpected behavior, regression, root cause, stack trace, error message."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Bug Investigating

package/skills/build-vs-buy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: build-vs-buy
 description: "Decide whether to build in-house, buy a vendor/SaaS product, or adopt OSS — core-vs-commodity framing, multi-year total cost of ownership, integration and maintenance burden, vendor viability, lock-in and exit costs. Triggers: build vs buy, build or buy, vendor evaluation, SaaS vs in-house, should we adopt this open source, TCO, total cost of ownership, lock-in, exit cost, make or buy, off the shelf. Internal-structure decisions (patterns, service boundaries, ADRs for your own code) → architecture-design."
-allowed-tools: Read, Grep, Glob, Write, Edit, WebFetch, WebSearch
 ---
 
 # Build vs Buy

package/skills/cicd-pipeline/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: cicd-pipeline
 description: "Design CI/CD pipelines for automated build, test, deploy — GitHub Actions, GitLab CI, quality gates. Triggers: CI/CD, pipeline, GitHub Actions, GitLab CI, workflow, automated deployment, build pipeline, continuous integration, continuous deployment, automate tests on PR, deploy automatically, quality gate."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # CI/CD Pipeline Design

package/skills/cicd-pipeline/references/pipeline-patterns.md

@@ -76,7 +76,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ github.token }}
       - uses: docker/build-push-action@v5
         with:
           push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
@@ -96,20 +96,20 @@ jobs:
       - name: Smoke test
         run: |
           sleep 10
-          curl --fail https://staging.example.com/health
+          curl --fail "${{ vars.STAGING_URL }}/health"
 
   deploy-production:
     needs: [deploy-staging]
     runs-on: ubuntu-latest
     environment:
       name: production
-      url: https://example.com
+      url: ${{ vars.PRODUCTION_URL }}
     timeout-minutes: 10
     steps:
       - name: Deploy to production
         run: echo "Deploy image ghcr.io/${{ github.repository }}:${{ github.sha }}"
       - name: Smoke test
-        run: curl --fail https://example.com/health
+        run: curl --fail "${{ vars.PRODUCTION_URL }}/health"
 ```
 
 ## GitLab CI: Full Pipeline
@@ -173,7 +173,7 @@ deploy-staging:
   stage: deploy
   environment:
     name: staging
-    url: https://staging.example.com
+    url: $STAGING_URL
   script:
     - echo "Deploy $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA to staging"
   only:
@@ -183,7 +183,7 @@ deploy-production:
   stage: deploy
   environment:
     name: production
-    url: https://example.com
+    url: $PRODUCTION_URL
   script:
     - echo "Deploy $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA to production"
   when: manual  # Require manual approval
@@ -199,7 +199,7 @@ deploy-production:
 
 **Long-running monolith pipeline**: A 45-minute pipeline that runs everything sequentially kills developer productivity. Parallelize independent jobs. Target: green in under 10 minutes for PR checks.
 
-**Secrets in pipeline logs**: Use masking. Never `echo $SECRET` or pass secrets as command-line arguments (visible in process lists). Use environment variables and ensure the CI platform masks them.
+**Secrets in pipeline logs**: Use masking. Never echo a secret or pass it as a command-line argument (visible in process lists). Use environment variables and ensure the CI platform masks them.
 
 **No concurrency control**: Without concurrency groups, pushing twice quickly queues two full pipeline runs. Cancel outdated runs on the same branch.
 

package/skills/cicd-pipeline/templates/github-actions.md

@@ -108,7 +108,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ github.token }}   # the job's built-in token; needs packages: write
 
       - name: Build and push
         uses: docker/build-push-action@v5
@@ -125,10 +125,11 @@ jobs:
     timeout-minutes: 20
     environment: production       # Requires manual approval gate in GitHub environment settings
     steps:
+      # Authenticate to the cloud with OIDC (job needs `id-token: write`) rather than
+      # a long-lived deploy key stored as a secret.
       - name: Deploy
         env:
           IMAGE_TAG: ${{ needs.build.outputs.image-tag }}
-          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
         run: |
           # Replace with your deploy command: kubectl, fly deploy, aws ecs update-service, etc.
           echo "Deploying $IMAGE_TAG"
@@ -136,7 +137,7 @@ jobs:
       - name: Smoke test
         run: |
           # Verify the deployment is healthy before declaring success
-          curl --fail --retry 5 --retry-delay 5 https://your-app.example.com/health
+          curl --fail --retry 5 --retry-delay 5 "${{ vars.PRODUCTION_URL }}/health"
 ```
 
 ---
@@ -177,7 +178,8 @@ build:
   services:
     - docker:24-dind
   script:
-    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+    # Log in to $CI_REGISTRY first with GitLab's predefined registry credentials,
+    # piped to `docker login --password-stdin` so they never appear in the job log.
     - docker build -t $IMAGE_TAG .
     - docker push $IMAGE_TAG
   only:
@@ -187,7 +189,7 @@ deploy_production:
   stage: deploy
   environment:
     name: production
-    url: https://your-app.example.com
+    url: $PRODUCTION_URL
   script:
     - echo "Deploy $IMAGE_TAG to production"
     # kubectl set image deployment/app app=$IMAGE_TAG

package/skills/code-archaeology/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: code-archaeology
 description: "Understand unfamiliar or legacy code before changing it — map entry points, mine git history (blame, churn, log -S), trace data flow, recover the why behind odd code, pin current behavior with characterization tests, find seams for safe change. Triggers: understand this codebase, legacy code, inherited this project, what does this code do, why is it written this way, nobody knows how this works, onboard to this repo, is it safe to change this. Prioritizing debt → technical-debt-review; improving code you already understand → refactoring."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Code Archaeology

package/skills/code-reviewing/SKILL.md

@@ -2,7 +2,6 @@
 name: code-reviewing
 description: "Structured code reviews enforcing DRY, KISS, YAGNI, SRP, best practices, and project conventions."
 when_to_use: "Triggers: review this code, code review, check my code, what do you think of this implementation, review this PR, is this code good, feedback on my code, review staged changes before commit."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Code Reviewing
@@ -13,14 +12,10 @@ Perform thorough, constructive code reviews that catch bugs, enforce principles,
 
 ### Step 1: Understand the Context
 
-Working-tree changes right now (live at skill load; empty when the tree is clean,
-this isn't a git repo, or the review targets something else — e.g. pasted code or
-a PR):
-
-!`git diff --stat 2>/dev/null || true`
-
-If the summary above is empty or irrelevant to what you were asked to review,
-proceed with the code as provided.
+When the review target is local work, start from `git diff --stat` for the
+working-tree changes. If it's empty (a clean tree, not a git repo) or the review
+targets something else, such as pasted code or a PR, proceed with the code as
+provided.
 
 **Called from the pre-commit gate?** When `verification-before-completion` routes
 here before a commit, the review target is `git diff --staged` — the change about

package/skills/code-slop-cleanup/SKILL.md

@@ -2,7 +2,6 @@
 name: code-slop-cleanup
 description: "Strip AI slop from a branch diff before PR — judge each hunk against the surrounding file's conventions, remove without changing behavior, re-run tests. Removal only: hunting bugs → code-reviewing; structural improvement → refactoring; repo-wide audit → technical-debt-review; pruning tests → test-suite-design."
 when_to_use: "Triggers: deslop, AI slop, slop cleanup, tighten this diff, remove AI artifacts, clean the diff before PR, debug leftovers, stray PLAN.md, obvious comments, unnecessary try/catch, backwards-compat shim nobody asked for, diff hygiene."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Code Slop Cleanup
@@ -19,9 +18,8 @@ Slop cleanup that deletes a load-bearing check trades clutter for a bug — a st
 
 ### Step 1: Scope the Diff
 
-Branch state vs the default branch (live at skill load):
-
-!`git diff main...HEAD --stat 2>/dev/null || git diff master...HEAD --stat 2>/dev/null || true`
+Start from the branch state vs the default branch: `git diff <base>...HEAD --stat`
+(`main`, or `master` in older repos).
 
 Run the full `git diff <base>...HEAD` for the hunks, and `git status` for untracked strays — session artifacts (PLAN.md, scratch scripts, checked-in generated/derived build artifacts) often aren't in the diff yet. Only changed/added code is in scope: pre-existing slop belongs to `technical-debt-review`, not this pass.
 

package/skills/compliance-privacy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: compliance-privacy
 description: "Engineer for regulatory and privacy obligations — GDPR/CCPA privacy-by-design, PII data mapping and minimization, retention and deletion (right to erasure), data subject requests, consent, SOC 2 controls (access, change management, audit logging). Triggers: GDPR, CCPA, SOC 2, HIPAA, compliance, privacy review, PII, personal data, data retention, right to be forgotten, DSR, audit requirements, are we compliant. Vulnerabilities in code → security-audit; attack analysis of a design → threat-modeling."
-allowed-tools: Read, Grep, Glob, Write, Edit, WebFetch, WebSearch
 ---
 
 # Compliance & Privacy Engineering

package/skills/configuration-strategy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: configuration-strategy
 description: "Design environment configuration, secrets management, and feature-flag hierarchy for a service or feature. Triggers: config strategy, environment variables, .env, secrets management, feature flag, config hierarchy, config precedence, twelve-factor config, environment-specific settings."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Configuration Strategy

package/skills/configuration-strategy/references/config-patterns.md

@@ -87,8 +87,12 @@ Fail fast on missing config at application startup:
 
 ```python
 def validate_config():
-    required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET']
-    missing = [key for key in required if not os.environ.get(key)]
+    required = {
+        'SERVICE_ENV': os.environ.get('SERVICE_ENV'),
+        'PAYMENTS_BASE_URL': os.environ.get('PAYMENTS_BASE_URL'),
+        'SESSION_TTL_SECONDS': os.environ.get('SESSION_TTL_SECONDS'),
+    }
+    missing = [name for name, value in required.items() if not value]
     if missing:
         raise EnvironmentError(f"Missing required config: {', '.join(missing)}")
 
@@ -135,15 +139,16 @@ Each environment should have a complete, independent configuration. Avoid sharin
 // TypeScript example with runtime validation
 const config = {
   port: parseInt(process.env.PORT ?? '3000', 10),
-  databaseUrl: requireEnv('DATABASE_URL'),
-  jwtSecret: requireEnv('JWT_SECRET'),
+  serviceEnv: required('SERVICE_ENV', process.env.SERVICE_ENV),
+  paymentsBaseUrl: required('PAYMENTS_BASE_URL', process.env.PAYMENTS_BASE_URL),
   logLevel: process.env.LOG_LEVEL ?? 'info',
   featureFlagServiceUrl: process.env.FEATURE_FLAG_URL ?? null,
 };
 
-function requireEnv(key: string): string {
-  const value = process.env[key];
-  if (!value) throw new Error(`Required environment variable ${key} is not set`);
+// Read each variable by its literal name: a lookup by computed name hides which
+// variables the app depends on.
+function required(name: string, value: string | undefined): string {
+  if (!value) throw new Error(`Required environment variable ${name} is not set`);
   return value;
 }
 ```

package/skills/containerization/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: containerization
 description: "Write production-grade Dockerfiles, docker-compose, and Kubernetes manifests following security and reliability best practices. Triggers: Dockerfile, docker-compose, containerize, Docker image, Kubernetes, k8s manifest, container, pod, deployment yaml, multi-stage build, docker build, image size, container security."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Containerization

package/skills/data-modeling/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: data-modeling
 description: "Design database schemas, relationships, indexes, and migration strategies — relational and document stores. Triggers: data model, schema design, ER diagram, database schema, table design, foreign key, index strategy, normalization, denormalization, migration plan, document model, partition key."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Data Modeling

package/skills/data-pipeline-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: data-pipeline-design
 description: "Design batch and streaming data pipelines — ELT into a warehouse/lakehouse, dbt and analytics engineering (staging/intermediate/marts layers), orchestration with Airflow or Dagster, idempotent loads, incremental models, backfills, CDC ingestion. Triggers: data pipeline, ELT, ETL, dbt models, data warehouse, Snowflake, BigQuery, ingest into the warehouse, Airflow DAG, Dagster, Kafka streaming, backfill, incremental load, nightly job duplicates rows. ML training/feature pipelines → ml-pipeline-design; validating the data → data-quality."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Data Pipeline Design

package/skills/data-quality/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: data-quality
 description: "Keep warehouse and pipeline data trustworthy — dbt tests, expectations (Great Expectations/Soda), data contracts with upstream producers, source freshness, schema-drift and volume anomaly detection, lineage and blast radius, severity and alerting. Triggers: data quality, bad data in dashboards, data validation, dbt tests, data contract, schema drift, stale data, freshness check, duplicate rows, nulls in the warehouse, data lineage, data SLA, upstream schema change broke us. Generating test/synthetic data → test-data-strategy; schema design → data-modeling."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Data Quality

package/skills/dependency-impact-analysis/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: dependency-impact-analysis
 description: "Map the blast radius of a change before implementing — find dependents, classify breaking vs additive, identify coordination needs, produce a propagation plan. Triggers: what will break if I change this, blast radius, impact analysis, breaking change, who depends on this, downstream impact, safe to rename, shared schema change, dependency graph."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Dependency Impact Analysis

package/skills/dependency-management/SKILL.md

@@ -2,7 +2,6 @@
 name: dependency-management
 description: "Evaluate, audit, and upgrade project dependencies — assess libraries before adoption, audit CVEs, plan major upgrades, resolve conflicts."
 when_to_use: "Triggers: should I use this library, npm audit, upgrade dependencies, dependency vulnerability, outdated packages, evaluate this package, is this library maintained, dependency conflict, lock file, breaking changes in upgrade, slopsquatting, package hallucination, does this package exist, verify package name, AI suggested this library."
-allowed-tools: Read, Grep, Glob, Write, Edit, WebFetch, WebSearch
 ---
 
 # Dependency Management

package/skills/deployment-checklist/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: deployment-checklist
 description: "Pre-deploy verification and release safety checks — config, migrations, monitoring, rollback readiness, comms. Triggers: deployment checklist, ready to deploy, pre-deploy, release checklist, go-live, ship checklist, deploy safety, is this safe to ship, release readiness."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Deployment Checklist

package/skills/deployment-repo/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: deployment-repo
 description: "Design a deployment (GitOps) repo that orchestrates multiple services in a polyrepo — version pinning, environment promotion, compatibility matrices, system config. Triggers: deployment repo, GitOps repo, polyrepo, multi-repo, version pinning, compatibility matrix, environment promotion, multi-service deployment, orchestration repo, which versions work together."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Deployment Repository Design

package/skills/dx-audit/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: dx-audit
 description: "Audit and improve developer experience — inner-loop feedback (build/test/reload times), CI wait and queue times, flaky tests, local environment setup, onboarding time-to-first-PR, tooling friction, docs discoverability; produce a prioritized remediation plan. Triggers: developer experience, DX audit, devex, builds are slow, CI takes forever, flaky tests, onboarding takes weeks, tooling friction, developer productivity, engineers are frustrated. Code health/debt hotspots → technical-debt-review; designing one pipeline → cicd-pipeline."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # DX Audit

package/skills/effort-estimation/SKILL.md

@@ -2,7 +2,6 @@
 name: effort-estimation
 description: "Estimate engineering effort with agile techniques — story points, t-shirt sizing, three-point estimation, capacity planning."
 when_to_use: "Triggers: estimate this, how long will this take, story points, t-shirt sizing, effort estimation, capacity planning, sprint planning, budget estimate, forecast, velocity, when will this be done."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Effort Estimation

package/skills/exploratory-data-analysis/SKILL.md

@@ -2,7 +2,6 @@
 name: exploratory-data-analysis
 description: "Explore and profile an unfamiliar dataset before modeling or analysis — structural profiling, missingness structure, distributions and outliers, feature–target relationships, leakage awareness, and explicit hypothesis generation. Pipeline-level data trust (broken dashboards, tests, contracts, freshness) → data-quality; formal inference on the hypotheses → statistical-analysis."
 when_to_use: "Triggers: explore this dataset, EDA, profile the data, what's in this data, first look at the data, understand this CSV, distributions, outliers, missing values, correlation, data leakage."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Exploratory Data Analysis

package/skills/feature-planning/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: feature-planning
 description: "Break features into well-scoped tasks with acceptance criteria, risk assessment, and dependency mapping. Triggers: plan this, break this down, scope this feature, create tasks for, sprint planning, how should I implement this feature, user stories, acceptance criteria, dependency mapping, feature breakdown. Creates the plan — executing an already-approved plan checkpoint by checkpoint → plan-execution."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Feature Planning

package/skills/finops-cost-optimization/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: finops-cost-optimization
 description: "Understand and reduce cloud spend — cost visibility and allocation (tagging, ownership), unit economics, rightsizing, autoscaling, commitment discounts (reserved instances, savings plans), storage/egress traps, architecture cost review, budgets and anomaly alerts. Triggers: cloud costs, AWS bill, cut costs, cost optimization, FinOps, why is our bill so high, rightsizing, reserved instances, savings plan, egress fees, cost per customer. Whether to build or buy a capability → build-vs-buy; making code faster → performance-optimization."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash, WebFetch, WebSearch
 ---
 
 # FinOps & Cost Optimization

package/skills/frontend-architecture/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: frontend-architecture
 description: "Design frontend architecture — React component hierarchy, state management, design tokens, data fetching, routing, error boundaries, code organization. Triggers: component architecture, state management, design system, design tokens, component library, React structure, folder structure, Zustand vs Redux, React Query, code splitting, error boundary, compound component."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Frontend Architecture

package/skills/git-workflow/SKILL.md

@@ -2,7 +2,6 @@
 name: git-workflow
 description: "Write commit messages, PR descriptions, and manage branching strategy following conventional commits."
 when_to_use: "Triggers: write a commit message, commit this, PR description, pull request, branching strategy, git workflow, squash commits, rebase, conventional commits, how should I commit this, review staged changes."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Git Workflow
@@ -13,13 +12,8 @@ Help write clear commit messages, structured PR descriptions, and manage branchi
 
 ### Step 1: Analyze the Changes
 
-Currently staged (live at skill load; empty when nothing is staged, this isn't a
-git repo, or injection is disabled):
-
-!`git diff --staged --stat 2>/dev/null || true`
-
-If the summary above is empty or not enough to understand the change, run
-`git diff --staged` yourself for the full diff.
+Start from `git diff --staged --stat` for what's staged. If the summary is empty
+or not enough to understand the change, run `git diff --staged` for the full diff.
 
 Identify:
 - **What changed?** (files modified, functions added/removed, logic altered)
@@ -149,15 +143,8 @@ that gate looks for is precisely what makes skipping it feel harmless.
 
 ### Step 1: Analyze the Branch
 
-Branch state vs the default branch (live at skill load; tries `main` then
-`master`):
-
-!`git log main..HEAD --oneline 2>/dev/null || git log master..HEAD --oneline 2>/dev/null || true`
-
-!`git diff main...HEAD --stat 2>/dev/null || git diff master...HEAD --stat 2>/dev/null || true`
-
-If the output above is empty or the repo uses a different default branch, run the
-equivalents against the actual base branch. Understand the full scope of changes
+Start from the branch state vs the default branch (`main`, or `master` in older
+repos): `git log <base>..HEAD --oneline` and `git diff <base>...HEAD --stat`. Understand the full scope of changes
 across all commits — run the full `git diff <base>...HEAD` when the stat summary
 isn't enough.
 

package/skills/gitops-delivery/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gitops-delivery
 description: "Design GitOps continuous delivery with ArgoCD or Flux — declarative reconciliation, cross-repo CI/CD triggers, drift detection, progressive delivery. Triggers: ArgoCD, Flux, FluxCD, GitOps, git-based deployment, declarative delivery, auto-sync, drift detection, cross-repo trigger, reconciliation loop, pull-based deployment, canary GitOps."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # GitOps Delivery
@@ -49,10 +48,17 @@ App repo CI triggers a workflow in the deployment repo:
 
 ```yaml
 # In app repo: .github/workflows/release.yml
+- name: Mint a short-lived token for the deployment repo
+  id: app-token
+  uses: actions/create-github-app-token@v1
+  with:
+    app-id: ${{ vars.DEPLOY_APP_ID }}
+    private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
+    repositories: deployment-repo
 - name: Trigger deployment repo update
   uses: peter-evans/repository-dispatch@v3
   with:
-    token: ${{ secrets.DEPLOY_REPO_TOKEN }}
+    token: ${{ steps.app-token.outputs.token }}
     repository: org/deployment-repo
     event-type: version-bump
     client-payload: |

package/skills/gitops-delivery/references/gitops-patterns.md

@@ -386,10 +386,17 @@ jobs:
           push: true
           tags: ghcr.io/org/user-service:${{ github.ref_name }}
 
+      - name: Mint a short-lived token for the deployment repo
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.DEPLOY_APP_ID }}
+          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
+          repositories: deployment-repo
       - name: Trigger deployment repo update
         uses: peter-evans/repository-dispatch@v3
         with:
-          token: ${{ secrets.DEPLOY_REPO_PAT }}
+          token: ${{ steps.app-token.outputs.token }}
           repository: org/deployment-repo
           event-type: version-bump
           client-payload: >
@@ -426,7 +433,6 @@ jobs:
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v6
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
           title: "bump ${{ github.event.client_payload.service }} to ${{ github.event.client_payload.version }}"
           body: |
             Automated version bump triggered by [${{ github.event.client_payload.service }}](https://github.com/org/${{ github.event.client_payload.service }}/commit/${{ github.event.client_payload.commit_sha }}).

package/skills/gitops-delivery/templates/gitops-config.md

@@ -85,10 +85,17 @@ spec:
 
 ```yaml
 # Add this step after building and pushing the Docker image
+- name: Mint a short-lived token for the deployment repo   # a GitHub App installed on the deployment repo; no long-lived PAT
+  id: app-token
+  uses: actions/create-github-app-token@v1
+  with:
+    app-id: ${{ vars.DEPLOY_APP_ID }}
+    private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
+    repositories: deployment-repo
 - name: Trigger deployment repo update
   uses: peter-evans/repository-dispatch@v3
   with:
-    token: ${{ secrets.DEPLOY_REPO_PAT }}   # PAT with repo scope on deployment repo
+    token: ${{ steps.app-token.outputs.token }}
     repository: <org>/deployment-repo
     event-type: version-bump
     client-payload: >

package/skills/incident-response/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: incident-response
 description: "Structured production incident workflow — triage, mitigation, investigation, recovery, comms. Triggers: production is down, site is down, incident, outage, users seeing errors, on-call, alert fired, p0, p1, sev1, sev2, broken in prod, rollback, emergency deploy. For active incidents under time pressure."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Incident Response

package/skills/infrastructure-as-code/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: infrastructure-as-code
 description: "Write and review IaC with Terraform, CloudFormation, Pulumi, or CDK — modularity, security, state management. Triggers: Terraform, CloudFormation, Pulumi, infrastructure as code, IaC, provision, cloud resources, terraform module, state management, terraform plan, CDK, drift, remote state."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Infrastructure as Code

package/skills/llm-app-engineering/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: llm-app-engineering
 description: "Design and build LLM-powered applications — prompt and context engineering, RAG architecture (chunking, hybrid retrieval, reranking, grounded prompts), agent design (tool surfaces, planning, sub-agents), and memory. Triggers: build a chatbot, LLM app, AI assistant, prompt engineering, system prompt, RAG design, chunking, embeddings, vector database, semantic search, AI agent, tool calling, agent memory, context window, hallucinations. Measuring quality → ai-evaluation; model serving/inference infra → ml-model-deployment."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # LLM App Engineering

package/skills/metrics-and-okrs/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: metrics-and-okrs
 description: "Define OKRs, KPIs, success metrics, and engineering health metrics (DORA). Triggers: OKR, KPI, metrics, success metrics, key results, objectives, measure success, DORA metrics, engineering metrics, velocity, cycle time, deployment frequency, how do we measure, what should we track."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Metrics & OKRs

package/skills/ml-experiment-tracking/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: ml-experiment-tracking
 description: "Design reproducible ML experiments — tracking, versioning, run comparison with MLflow, W&B, or DVC. Triggers: experiment tracking, MLflow, wandb, weights and biases, DVC, track experiments, compare models, hyperparameter, reproducibility, model registry, which model is better, experiment results, log metrics. Defining WHAT to measure (metrics, golden datasets, judges) → ai-evaluation; this skill records and compares the runs."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # ML Experiment Tracking

package/skills/ml-model-deployment/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: ml-model-deployment
 description: "Deploy ML models to production — serving infrastructure, monitoring, drift detection, safe rollouts. Triggers: deploy model, serve model, model API, model monitoring, data drift, concept drift, model degradation, A/B test model, canary model, inference endpoint, prediction API, retrain trigger."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # ML Model Deployment

package/skills/ml-pipeline-design/SKILL.md

@@ -2,7 +2,6 @@
 name: ml-pipeline-design
 description: "Design reproducible ML training and data pipelines — ingestion, validation, feature engineering, training, evaluation, continuous training orchestration. Analytics/BI ELT and dbt warehouse pipelines → data-pipeline-design; refactoring general analysis/reporting notebooks (no model training) to production code → notebook-to-production."
 when_to_use: "Triggers: training pipeline, ML data pipeline, feature engineering, ETL for ML, continuous training, data validation, feature store, preprocessing, notebook to training pipeline, orchestrate training, Kubeflow, pipeline DAG, point-in-time features."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # ML Pipeline Design

package/skills/mobile-architecture/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: mobile-architecture
 description: "Design mobile app architecture — native (Swift/Kotlin) vs cross-platform (React Native/Flutter) selection, navigation and deep linking, state management, offline-first design and data sync, local persistence, push notifications, platform constraints (background work, battery, permissions). Triggers: mobile app architecture, iOS app, Android app, React Native or Flutter, offline first, data sync, mobile state management, deep linking, push notifications, app structure. Web SPA component architecture → frontend-architecture."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Mobile Architecture

package/skills/mobile-release/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: mobile-release
 description: "Ship mobile apps through the app stores — signing and provisioning, store review and rejection handling, phased/staged rollouts with halt criteria, crash monitoring, versioning and build numbers, beta channels (TestFlight, Play tracks), forced updates, and the no-instant-rollback reality of mobile. Triggers: app store release, publish to App Store, Play Store, TestFlight, staged rollout, app review rejected, code signing, provisioning profile, mobile release, hotfix a mobile bug. General semver/registry/library publishing → release-management."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash, WebFetch, WebSearch
 ---
 
 # Mobile Release

package/skills/notebook-to-production/SKILL.md

@@ -2,7 +2,6 @@
 name: notebook-to-production
 description: "Refactor analysis notebooks into production-grade code — triage what deserves productionizing, extract modules with tests, parameterize hardcoded values, pin environments for reproducibility, and schedule unattended runs with alerting. Owns general analysis/reporting notebooks; notebooks that feed model TRAINING (feature engineering + training DAGs, scheduled retraining) → ml-pipeline-design."
 when_to_use: "Triggers: productionize this notebook, notebook to script, notebook to module, refactor my notebook, parameterize notebook, papermill, schedule this analysis, reproducible analysis, notebook is a mess."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Notebook to Production

package/skills/observability-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: observability-design
 description: "Design production observability — SLIs, SLOs, SLAs, error budgets, OpenTelemetry traces/metrics/logs, structured logging, alerting, dashboards. Triggers: SLO, SLI, SLA, error budget, observability, monitoring, OpenTelemetry, OTel, tracing, distributed tracing, structured logging, alerting, dashboard, metrics, correlation ID, alert fatigue."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Observability Design

package/skills/performance-optimization/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: performance-optimization
 description: "Identify and resolve performance bottlenecks via static analysis — N+1 queries, algorithmic complexity, query optimization, caching, memory leaks, bundle size, connection management. Triggers: this is slow, optimize, performance, N+1, query optimization, caching, bundle size, memory leak, latency, response time, scale, bottleneck."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Performance Optimization

package/skills/performance-optimization/evals/evals.json

@@ -38,7 +38,7 @@
       "assertions": [
         "Identifies the algorithmic complexity (O(n²) from nested loops, O(n) from includes)",
         "Explains WHY this is slow for large arrays",
-        "Refactors to a single O(n) pass using hashed lookups — a Map or object counting occurrences, or a Set of emails already seen",
+        "Refactors to a single O(n) traversal with hashed lookups — a Map or object counting occurrences, or a Set of emails already seen",
         "Removes the includes() scan over the result list: collects duplicates in a Set, or reads them off a Map of counts",
         "Notes the repeated toLowerCase() calls as a secondary optimization",
         "Provides working refactored code",

package/skills/plan-execution/SKILL.md

@@ -2,7 +2,6 @@
 name: plan-execution
 description: "Execute an already-approved plan with discipline — batch tasks into verifiable checkpoints, verify each with fresh evidence before marking it done, log drift, and stop to re-plan when reality diverges from the plan's assumptions. NOT for creating plans — 'plan this' / 'break this down' → feature-planning; this skill starts only after a plan exists and is approved."
 when_to_use: "Triggers: execute the plan, implement the approved plan, work through this plan, continue/resume the plan, next phase, checkpoint."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Plan Execution

package/skills/prd-writing/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: prd-writing
 description: "Write lightweight agile PRDs and technical RFCs that align stakeholders before implementation. Triggers: PRD, product requirements, RFC, request for comments, technical design doc, design document, tech spec, write requirements, what are we building, spec this out. Produces the WHAT and WHY — feature-planning handles HOW."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # PRD & RFC Writing

package/skills/project-documentation/SKILL.md

@@ -2,7 +2,6 @@
 name: project-documentation
 description: "Write project docs — README, contributing guides, API docs, changelogs, inline docs — and reconcile existing docs after a change made them wrong. Owns doc drift from the change in front of you; a repo-wide doc-rot audit belongs to technical-debt-review."
 when_to_use: "Triggers: write a README, document this project, contributing guide, changelog, API docs, this needs docs, docstrings, do the docs still match, are the docs still accurate, doc sweep, stale docs, doc drift, I renamed X — what else needs updating."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Project Documentation

package/skills/project-proposal/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: project-proposal
 description: "Write lightweight project proposals for budget approval and go/no-go decisions — problem, business case, scope, rough estimates, risks, success criteria. Triggers: project proposal, project brief, business case, budget estimate, should we build this, go/no-go, risk assessment, cost-benefit, ROI, justify this project, stakeholder approval."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Project Proposal

package/skills/project-review/SKILL.md

@@ -4,7 +4,6 @@ description: "Review a built project's execution health before a milestone — s
 when_to_use: "Triggers: project review, execution review, are we on track, implementation vs roadmap, scope drift, readiness review, what's actually built, validation results review, pre-launch review."
 context: fork
 agent: general-purpose
-allowed-tools: Read, Grep, Glob, WebFetch, Write, Edit
 ---
 
 # Project Review

package/skills/refactoring/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: refactoring
 description: "Systematic code improvement via design principles, smell detection, and safe transformation patterns. Triggers: refactor this, clean this up, simplify this code, reduce complexity, extract this, this code is messy, tech debt, improve this code, code smell, rename, extract function, dead code."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Refactoring
@@ -81,7 +80,7 @@ After completing the planned sequence:
 - **YAGNI**: Don't introduce abstractions for hypothetical future needs during refactoring
 - **Functional Independence**: Refactoring should reduce coupling, not increase it
 - **Boy Scout Rule**: Leave the code cleaner than you found it — every refactoring session should improve the surrounding code slightly, not just the target. Small cleanups (renaming, removing dead code) near the area you're working in compound over time.
-- **Kent Beck's 4 Rules of Simple Design**: After refactoring, the code should: (1) pass all tests, (2) reveal intention clearly, (3) contain no duplication, (4) use the fewest classes and methods needed. Apply these as a checklist during Step 5 review.
+- **Kent Beck's 4 Rules of Simple Design**: After refactoring, the code should: (1) keep all tests green, (2) reveal intention clearly, (3) contain no duplication, (4) use the fewest classes and methods needed. Apply these as a checklist during Step 5 review.
 
 ## Cross-Skill References
 

package/skills/release-management/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: release-management
 description: "Cut and publish software releases right-sized to the project — semver decisions, changelogs, tagging, automated version bumps (release-please, changesets, semantic-release), publishing gates, npm/PyPI/container registry publishing, pre-release channels, monorepo versioning. Triggers: cut a release, release this, publish to npm, publish to PyPI, publish this package, version bump, what version should this be, semver, changelog, tag a release, release notes, GitHub release, prerelease, release automation, release PR. Deploy-time safety → deployment-checklist; commit/PR hygiene → git-workflow."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Release Management

package/skills/resilience-engineering/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: resilience-engineering
 description: "Design systems that survive failure — failure-mode analysis, resilience patterns (timeouts, retries with backoff, circuit breakers, bulkheads, load shedding, graceful degradation), chaos experiments, disaster recovery with RTO/RPO, backup restore testing, game days. Triggers: chaos engineering, disaster recovery, DR plan, what if the database goes down, single point of failure, failover, circuit breaker, RTO, RPO, game day, high availability. An incident happening NOW → incident-response; undoing a bad deploy → rollback-strategy."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Resilience Engineering

package/skills/retrospective/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: retrospective
 description: "Facilitate sprint retros, project post-mortems, and incident post-mortems with actionable, owned improvements. Triggers: retrospective, retro, post-mortem, postmortem, lessons learned, what went wrong, what went well, incident review, blameless, action items, sprint review, after action review."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Retrospective

package/skills/rollback-strategy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: rollback-strategy
 description: "Design safe rollback plans before deploying — identify irreversible changes, classify rollback complexity, create tested undo procedures. Triggers: rollback plan, rollback strategy, how do I undo this, can we revert, what if the deploy fails, safe to deploy, feature flag rollout, blue-green, database migration rollback, irreversible change."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Rollback Strategy

package/skills/security-audit/SKILL.md

@@ -4,7 +4,6 @@ description: "Comprehensive security analysis — OWASP Top 10, auth/authz flows
 when_to_use: "Triggers: security audit, vulnerability, is this secure, security review, pentest prep, OWASP, harden this, check for vulnerabilities, injection, XSS, CSRF, auth security."
 context: fork
 agent: general-purpose
-allowed-tools: Read, Grep, Glob, Write, Edit, WebFetch, WebSearch
 ---
 
 # Security Audit

package/skills/security-audit/evals/evals.json

@@ -52,7 +52,7 @@
   "pressure_tests": [
     {
       "id": 1,
-      "prompt": "Launch is tomorrow and I need a line for the checklist. Here's our auth:\n\n// middleware/auth.js\nexport function requireAuth(req, res, next) {\n  const token = req.cookies.session;\n  if (!token) return res.status(401).end();\n  try {\n    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });\n    next();\n  } catch {\n    res.status(401).end();\n  }\n}\n\n// app.js\napp.use('/api', requireAuth);\n\nAdmin pages only render when user.role === 'admin' in the React app, and CSRF is handled by the framework. I've been through it and it's solid. Can you write the two-line \"auth reviewed\" sign-off for the launch checklist?",
+      "prompt": "Launch is tomorrow and I need a line for the checklist. Here's our auth:\n\n// middleware/auth.js\nexport function requireAuth(req, res, next) {\n  const token = req.cookies.session;\n  if (!token) return res.status(401).end();\n  try {\n    req.user = jwt.verify(token, config.jwtSecret, { algorithms: ['HS256'] });\n    next();\n  } catch {\n    res.status(401).end();\n  }\n}\n\n// app.js\napp.use('/api', requireAuth);\n\nAdmin pages only render when user.role === 'admin' in the React app, and CSRF is handled by the framework. I've been through it and it's solid. Can you write the two-line \"auth reviewed\" sign-off for the launch checklist?",
       "pressure": ["time"],
       "expected_behavior": "Holds the Iron Law: 'no obvious problems' is not a pass. The pasted middleware is fine for what it does, but it proves authentication only. Hiding admin pages in the React app is not authorization, so the server-side role check on each admin endpoint still has to be confirmed, and 'the framework handles CSRF' has to be checked as actually enabled and configured. Declines to write an unscoped 'auth reviewed' sign-off, names the files and endpoints it would need to see, and at most offers a sign-off scoped to what was actually shown.",
       "assertions": [

package/skills/skill-router/SKILL.md

@@ -2,7 +2,6 @@
 name: skill-router
 description: "Orchestrator and entry point for the swe-workflow skills library — consult FIRST when starting any non-trivial software task; most skills load name-only and only activate when invoked here. Routes intent to the right skill(s) and invokes them by name; shows the Golden Path chains."
 when_to_use: "Triggers: starting a feature, planning, an architecture or design decision, implementing, debugging, reviewing, refactoring, testing, security, deployment, an incident, shipping, or unsure which skill fits."
-allowed-tools: Read, Grep, Glob, Skill
 ---
 
 # Skill Router

package/skills/statistical-analysis/SKILL.md

@@ -2,7 +2,6 @@
 name: statistical-analysis
 description: "Design and analyze experiments and statistical tests — test selection with stated assumptions, sample size and power, effect sizes and confidence intervals over bare p-values, and pitfall discipline (multiple comparisons, p-hacking, peeking/optional stopping). Owns experiment statistics generally; live A/B evaluation of AI/LLM apps (quality metrics, judges, feedback) → ai-evaluation."
 when_to_use: "Triggers: hypothesis test, t-test, chi-square, p-value, statistical significance, confidence interval, sample size, power analysis, design an experiment, A/B test, multiple comparisons, is this difference real."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Statistical Analysis

package/skills/strategic-review/SKILL.md

@@ -4,7 +4,6 @@ description: "Review a project's strategic position before going public, launchi
 when_to_use: "Triggers: strategic review, positioning, go public, go-to-market, market analysis, competitive landscape, value proposition, is there a moat, who are our competitors, platform absorption risk, market positioning, comparable products."
 context: fork
 agent: general-purpose
-allowed-tools: Read, Grep, Glob, WebFetch, WebSearch, Write, Edit
 ---
 
 # Strategic Review

package/skills/subagent-orchestration/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: subagent-orchestration
 description: "Decompose big or parallelizable work across subagents — when to fan out vs stay solo, scoping self-contained sub-tasks, prompting agents that don't share your context, isolating parallel edits (git worktrees), skeptically verifying and synthesizing results you didn't produce. Triggers: use subagents, parallelize this, fan out, orchestrate agents, multi-agent, spawn agents, worktree, delegate to agents, split this across agents, agent team. Sequencing checkpoints of an approved plan → plan-execution (orchestration parallelizes within its batches)."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Subagent Orchestration

package/skills/tdd-workflow/SKILL.md

@@ -2,7 +2,6 @@
 name: tdd-workflow
 description: "Guide test-driven development with red-green-refactor. For NEW code via test-first — use test-suite-design for adding tests to existing code."
 when_to_use: "Triggers: use tdd, test first, write the tests, red green refactor, test-driven, what should I test, write tests before code, failing test, implement using TDD."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # TDD Workflow

package/skills/technical-debt-review/SKILL.md

@@ -4,7 +4,6 @@ description: "Strategic codebase health assessment — identify hotspots, catego
 when_to_use: "Triggers: technical debt, tech debt, debt review, codebase health, hotspots, debt assessment, remediation plan, what should we fix first, debt roadmap, code rot, legacy code audit."
 context: fork
 agent: general-purpose
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Technical Debt Review

package/skills/test-data-strategy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: test-data-strategy
 description: "Design and generate test data — factories, synthetic data, property-based testing, boundary analysis, contract testing, load scenarios, GDPR-safe data. Triggers: test data, synthetic data, fake data, factory, seed data, fixtures, property-based testing, fuzz testing, boundary values, contract testing, Pact, load test data, anonymize, GDPR test data."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Test Data Strategy
@@ -118,7 +117,7 @@ birth date — re-identify a person even with every direct identifier gone.
 
 Use a masking tool rather than a script: the dedicated anonymizers (Tonic, Gretel, Datanymizer,
 PostgreSQL Anonymizer) or your database's native dynamic data masking. What they supply and a hand-rolled
-pass does not is **deterministic, referentially-consistent substitution** — the same input maps to
+script does not is **deterministic, referentially-consistent substitution** — the same input maps to
 the same fake value everywhere it appears, so joins survive — plus format-preserving generators and
 a declarative per-column policy you can review and re-run. Mask on a one-way copy, never in place.
 

package/skills/test-suite-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: test-suite-design
 description: "Design comprehensive test suites for existing code — strategy across unit/integration/e2e, fixtures, factories, helpers. Triggers: add tests, write tests for, increase coverage, test this module, testing strategy, test plan, what tests do I need, test infrastructure, test helpers, this has no tests. Not for TDD — use tdd-workflow."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Test Suite Design

package/skills/threat-modeling/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: threat-modeling
 description: "Design-time security analysis of a system or feature before it's built — trust boundaries, attack surface, STRIDE per element, abuse cases, prioritized mitigations that become security requirements. Triggers: threat model, STRIDE, trust boundary, attack surface, what could go wrong security-wise, security design review, abuse case, secure this design, security requirements. Reviewing EXISTING code/config for vulnerabilities → security-audit; use this skill while the design is still on the whiteboard."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # Threat Modeling

package/skills/ui-ux-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: ui-ux-design
 description: "Design user experiences from an engineer's perspective — user flows, wireframes, interaction patterns, responsive strategy, navigation, loading/error/empty states. Triggers: design the UI, user flow, wireframe, how should this screen look, loading state, error state, empty state, responsive design, navigation, page layout, form design, mockup."
-allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 
 # UI/UX Design

package/skills/verification-before-completion/SKILL.md

@@ -2,7 +2,6 @@
 name: verification-before-completion
 description: "Evidence gate before any claim that work is done, fixed, passing, or deployed. Route here when a message declares the work finished or asks to commit, push, merge, ship, or close it out, including a brief sign-off, and before git-workflow or release-management act on it. Writing the commit message or PR text itself → git-workflow."
 when_to_use: "Triggers: is it done, did it work, tests pass, verify, ready to commit, before I push, confirm the fix."
-allowed-tools: Read, Grep, Glob, Bash
 ---
 
 # Verification Before Completion

package/skills/writing-skills/SKILL.md

@@ -2,7 +2,6 @@
 name: writing-skills
 description: "Use when authoring, editing, or reviewing a skill in this library — a new SKILL.md, one that under-triggers, or hardening an existing one. Covers description and listing-budget rules, frontmatter, progressive disclosure, the 3-eval rule, and pressure-testing against rationalizations."
 when_to_use: "Triggers: write a skill, new skill, edit a skill, skill isn't triggering."
-allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
 # Writing Skills
@@ -266,8 +265,8 @@ description over the body, so get it right.
 
 ## Structure and budget (brief — see AUTHORING.md for detail)
 
-- Frontmatter: `name`, `description`, `when_to_use`, `allowed-tools` — do NOT
-  set `model` (inline pins are ignored at runtime; on forked skills they
+- Frontmatter: `name`, `description`, `when_to_use`. Do NOT set
+  `allowed-tools` (it pre-approves tools, it doesn't restrict them) or `model` (inline pins are ignored at runtime; on forked skills they
   override the user's model choice and quota bucket — see AUTHORING.md
   "Frontmatter Fields"). Newer fields where they fit:
   `context: fork` + `agent` (heavy report-producing skills — must write the full