swe-workflow-skills 0.4.0 → 0.5.1

package/README.md

@@ -1,5 +1,6 @@
 # SWE Workflow Skills for Claude Code
 
+[![npm](https://img.shields.io/npm/v/swe-workflow-skills)](https://www.npmjs.com/package/swe-workflow-skills)
 [![roles-check](https://github.com/SWEStash/swe-workflow-skills/actions/workflows/roles-check.yml/badge.svg)](https://github.com/SWEStash/swe-workflow-skills/actions/workflows/roles-check.yml)
 ![skills](https://img.shields.io/badge/skills-65-blue)
 [![license: MIT](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)
@@ -59,12 +60,28 @@ web, claude.ai chat, and Cowork):
 /plugin install swe-workflow-pm@swe-workflow
 ```
 
-**Want the whole library with the orchestrator** (CLI) — no clone needed:
+**Want the whole library with the orchestrator** (CLI) — no clone needed. This is a
+**two-step** setup:
 
 ```bash
-npx swe-workflow-skills install --global   # all 65 skills + router + /role + the SessionStart hook
+# 1. Install all 65 skills + router + /role + the hook script, and apply the baseline
+npx swe-workflow-skills install --global
 ```
 
+```jsonc
+// 2. Wire the hook: merge the snippet the installer prints into your settings.json
+//    (the installer never edits settings.json for you — it just prints the block).
+//    Then start a new session; /doctor should show the hook registered.
+{ "hooks": { "SessionStart": [ /* ...the printed block... */ ] } }
+```
+
+> ⚠️ **Don't skip step 2.** Step 1 alone installs the skills and prevents cropping, but
+> the hook is what nudges Claude to consult `skill-router` first — **without it, skills
+> won't auto-route** (the whole point of the library) and the baseline isn't re-asserted
+> after `/compact`. If you deliberately want no hook, pass `--no-hook`; auto-routing stays
+> off until a hook is wired. The **per-role plugin** path above needs no hook — it's
+> self-contained.
+
 Or from a clone: `node install.mjs --global`.
 
 > **Prerequisite:** Node.js ≥ 18 (already present wherever Claude Code runs).
@@ -97,7 +114,9 @@ for every method × surface, and **[ROLES.md](docs/ROLES.md)** for the activatio
 On any non-trivial task, Claude consults **`skill-router`** first; it reads the full
 catalog and invokes the matching skill(s) by name, re-routing as the work changes phase.
 The default SessionStart hook nudges Claude to do this automatically; you can also route
-explicitly ("use the security-audit skill") or switch the promoted set with `/role`.
+explicitly ("use the security-audit skill") or switch the promoted set with `/role`. Don't
+want a particular skill routed at all? `npx swe-workflow-skills disable <skill>` opts it out
+durably — see [disable a skill from routing](docs/ROLES.md#advanced-disable-a-skill-from-routing).
 
 **A routed chain, by phase** — e.g. *"add OAuth login"*:
 

package/VERSION

@@ -1 +1 @@
-0.4.0
+0.5.1

package/bin/cli.mjs

@@ -5,6 +5,9 @@
 //
 //   npx swe-workflow-skills install [--global|--dir DIR|--role R|--no-hook|...]
 //   npx swe-workflow-skills uninstall [--global|--dir DIR|--dry-run|--yes]
+//   npx swe-workflow-skills disable <skill> [--off] [--global | --dir DIR]
+//   npx swe-workflow-skills enable  <skill> [--global | --dir DIR]
+//   npx swe-workflow-skills list-disabled   [--global | --dir DIR]
 
 import { spawnSync } from "node:child_process";
 import { dirname, join } from "node:path";
@@ -17,21 +20,34 @@ const [sub, ...rest] = process.argv.slice(2);
 const HELP = `swe-workflow-skills <command> [options]
 
 Commands:
-  install      Install skills into a Claude config dir (passes flags to install.mjs)
-  uninstall    Remove the library (passes flags to uninstall.mjs)
+  install         Install skills into a Claude config dir (passes flags to install.mjs)
+  uninstall       Remove the library (passes flags to uninstall.mjs)
+  disable <skill> Opt a skill out of routing/auto-trigger (advanced; --off to fully hide)
+  enable  <skill> Re-enable a previously disabled skill
+  list-disabled   List skills currently disabled
 
 Examples:
   npx swe-workflow-skills install --global
   npx swe-workflow-skills install --role pm
   npx swe-workflow-skills uninstall --global --dry-run
+  npx swe-workflow-skills disable data-modeling --global
+  npx swe-workflow-skills enable data-modeling --global
 
 Run a command with --help to see its full option list.`;
 
+// disable/enable/list-disabled all run through disable.mjs; map the CLI verb to
+// the action positional it expects (list-disabled -> list).
+const DISABLE_ACTIONS = { disable: "disable", enable: "enable", "list-disabled": "list" };
+
 if (sub === "install" || sub === "uninstall") {
   const script = join(ROOT, sub === "install" ? "install.mjs" : "uninstall.mjs");
   // stdio inherited so install output and uninstall's confirm prompt pass through.
   const res = spawnSync(process.execPath, [script, ...rest], { stdio: "inherit" });
   process.exit(res.status ?? 1);
+} else if (sub in DISABLE_ACTIONS) {
+  const script = join(ROOT, "disable.mjs");
+  const res = spawnSync(process.execPath, [script, DISABLE_ACTIONS[sub], ...rest], { stdio: "inherit" });
+  process.exit(res.status ?? 1);
 } else if (sub === "-v" || sub === "--version" || sub === "version") {
   process.stdout.write(readFileSync(join(ROOT, "VERSION"), "utf-8"));
   process.exit(0);

package/disable.mjs

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+// Disable / enable a single skill from routing and auto-trigger, durably.
+//
+// The library installs a name-only baseline: skills don't auto-trigger, they're
+// invoked by the skill-router. Disabling goes one step further — it hides a skill
+// from the router too, for users who don't want the whole corpus routed. This is
+// an ADVANCED opt-out of the routed SWE-methodology; most people don't need it.
+//
+// Why a command (not a manual settings edit): the SessionStart hook re-writes
+// every installed skill's skillOverrides entry each session, so a hand edit is
+// reverted. This records the choice in a `.disabled-skills` marker beside the
+// skills, which the hook folds into the baseline every time — so it persists.
+//
+// Runs on Linux, macOS, and Windows using only Node.
+//
+//   node disable.mjs disable <skill>          # -> user-invocable-only (default)
+//   node disable.mjs disable <skill> --off    # -> off (fully hidden)
+//   node disable.mjs enable  <skill>          # re-enable (back to the baseline)
+//   node disable.mjs list                     # show disabled skills
+//   node disable.mjs disable <skill> --global # target the user config dir
+
+import { existsSync, statSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+import {
+  loadRoles,
+  applyBaseline,
+  installedSkills,
+  readDisabled,
+  writeDisabled,
+  DEFAULT_DISABLE_STATE,
+} from "./scripts/resolve.mjs";
+
+// Exit cleanly when stdout is closed early (e.g. piped to `head`/`grep`) instead
+// of throwing an EPIPE stack trace.
+process.stdout.on("error", (e) => {
+  if (e && e.code === "EPIPE") process.exit(0);
+  throw e;
+});
+
+const REPO_ROOT = dirname(fileURLToPath(import.meta.url));
+
+const USAGE = `Usage: disable.mjs <disable|enable|list> [skill] [options]
+
+Disable or re-enable a skill from routing/auto-trigger (advanced opt-out).
+
+Actions:
+  disable <skill>   Hide <skill> from the router. Default state: user-invocable-only
+                    (you can still run it manually as /<skill>). Add --off to hide
+                    it entirely (not even user-invocable).
+  enable  <skill>   Re-enable <skill> (return it to the name-only baseline).
+  list              List currently disabled skills.
+
+Options:
+  --off          With 'disable': set state to "off" instead of user-invocable-only
+  -g, --global   Target the user config dir: $CLAUDE_CONFIG_DIR if set, else
+                 ~/.claude/ (default without this flag: ./.claude/)
+  -d, --dir DIR  Target a custom Claude config directory DIR
+  -h, --help     Show this help`;
+
+function isDir(p) {
+  return existsSync(p) && statSync(p).isDirectory();
+}
+function fatal(msg) {
+  process.stderr.write(`Error: ${msg}\n`);
+  process.exit(1);
+}
+function log(msg) {
+  process.stdout.write(msg + "\n");
+}
+function expandTilde(p) {
+  if (p === "~" || p.startsWith("~/") || p.startsWith("~\\")) return homedir() + p.slice(1);
+  return p;
+}
+
+// ---- arg parsing -----------------------------------------------------------
+
+let global = false;
+let off = false;
+let configDir = "";
+const positional = [];
+
+const argv = process.argv.slice(2);
+for (let i = 0; i < argv.length; i++) {
+  const a = argv[i];
+  if (a === "-g" || a === "--global") global = true;
+  else if (a === "--off") off = true;
+  else if (a === "-d" || a === "--dir") {
+    configDir = argv[++i];
+    if (configDir === undefined) fatal("--dir requires a path");
+  } else if (a.startsWith("--dir=")) configDir = a.slice("--dir=".length);
+  else if (a === "-h" || a === "--help") {
+    log(USAGE);
+    process.exit(0);
+  } else if (a.startsWith("-")) {
+    process.stderr.write(`Unknown option: ${a}\n${USAGE}\n`);
+    process.exit(1);
+  } else positional.push(a);
+}
+
+const action = positional[0];
+const skill = positional[1];
+if (!action || !["disable", "enable", "list"].includes(action)) {
+  process.stderr.write(`${USAGE}\n`);
+  process.exit(1);
+}
+if ((action === "disable" || action === "enable") && !skill) {
+  fatal(`'${action}' requires a <skill> name`);
+}
+// Reject path-like / malformed names before any filesystem use.
+if (skill && !/^[a-z0-9][a-z0-9-]*$/.test(skill)) {
+  fatal(`invalid skill name '${skill}' (expected lowercase letters, digits, hyphens)`);
+}
+
+let claudeDir;
+if (configDir) {
+  if (global) fatal("--dir and --global are mutually exclusive");
+  claudeDir = resolve(expandTilde(configDir));
+} else if (global) {
+  claudeDir = process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
+} else {
+  claudeDir = join(process.cwd(), ".claude");
+}
+const dest = join(claudeDir, "skills");
+const settingsLocal = join(claudeDir, "settings.local.json");
+
+if (!isDir(dest)) fatal(`no skills found at ${dest} (is the library installed there? try --global or --dir)`);
+
+// Roles data: prefer the installed marker beside the skills, else the repo copy.
+function loadRolesData() {
+  for (const p of [join(dest, ".roles.json"), join(REPO_ROOT, "roles.json")]) {
+    if (existsSync(p)) return loadRoles(p);
+  }
+  return null;
+}
+
+// Active role, so re-applying the baseline preserves the user's promoted set.
+function activeRole(data) {
+  const f = join(dest, ".active-role");
+  if (!existsSync(f)) return null;
+  try {
+    const r = readFileSync(f, "utf-8").replace(/\s+/g, "");
+    return r && data && data.roles && r in data.roles ? r : null;
+  } catch {
+    return null;
+  }
+}
+
+// Re-assert the baseline now so the change hot-reloads in the current session
+// (like /role), instead of waiting for the next session boundary.
+function reapply() {
+  const data = loadRolesData();
+  if (!data) return; // no roles data (partial/plugin install): marker still written
+  try {
+    applyBaseline(data, settingsLocal, dest, activeRole(data));
+  } catch (e) {
+    process.stderr.write(`Warning: wrote the marker but could not re-apply the baseline (${e.message}).\n`);
+    process.stderr.write("It will take effect at the next session start.\n");
+  }
+}
+
+// ---- actions ---------------------------------------------------------------
+
+const disabled = readDisabled(dest);
+
+if (action === "list") {
+  if (disabled.size === 0) {
+    log("No skills are disabled.");
+  } else {
+    log("Disabled skills:");
+    for (const name of [...disabled.keys()].sort()) log(`  ${name}  (${disabled.get(name)})`);
+  }
+  process.exit(0);
+}
+
+const data = loadRolesData();
+const installed = new Set(installedSkills(dest));
+
+if (action === "disable") {
+  if (!installed.has(skill)) fatal(`unknown skill '${skill}' — not installed at ${dest}`);
+  const state = off ? "off" : DEFAULT_DISABLE_STATE;
+  disabled.set(skill, state);
+  writeDisabled(dest, disabled);
+  reapply();
+  log(`Disabled '${skill}' -> ${state}.`);
+  if (state === DEFAULT_DISABLE_STATE) {
+    log(`The router will no longer invoke it; you can still run it manually as /${skill}.`);
+  } else {
+    log("It is now fully hidden (not routable and not user-invocable).");
+  }
+  if (data && Array.isArray(data.pinned) && data.pinned.includes(skill)) {
+    log(`Note: '${skill}' is a pinned safety skill — disabling it opts out of that guardrail.`);
+  }
+  log("This persists across sessions (the hook re-asserts it). Re-enable with:");
+  log(`  node disable.mjs enable ${skill}${global ? " --global" : ""}`);
+} else {
+  // enable
+  if (!disabled.has(skill)) {
+    log(`'${skill}' is not disabled — nothing to do.`);
+    process.exit(0);
+  }
+  disabled.delete(skill);
+  writeDisabled(dest, disabled);
+  reapply();
+  log(`Enabled '${skill}' — back to the name-only baseline (routable again).`);
+}

package/install.mjs

@@ -369,14 +369,22 @@ if (hook) {
     hookPath = join(hookDestDir, "session-start.mjs");
     log(`Installed hook script -> ${hookPath}`);
     log("");
-    log("The name-only baseline is already applied. To have it re-asserted every");
-    log("session (and the router nudge injected), merge this into");
-    log(`${join(claudeDir, "settings.json")} (the installer does NOT edit settings for you):`);
+    log("========================================================================");
+    log("REQUIRED NEXT STEP — wire the router hook");
+    log("========================================================================");
+    log("Skills are installed and the name-only baseline is applied, so nothing");
+    log("will crop. But WITHOUT this step Claude won't be nudged to consult");
+    log("skill-router first, so skills won't auto-route — you lose the whole point");
+    log("of the library. The hook also re-asserts the baseline after /compact.");
+    log("");
+    log(`Merge this into ${join(claudeDir, "settings.json")}`);
+    log("(for your safety the installer does NOT edit settings.json for you):");
     log("");
     log(hookSnippet(hookPath));
     log("");
-    log("Start a new session and run /doctor to confirm the hook is registered.");
-    log("(Prefer no hook? Re-run with --no-hook; the baseline still applies.)");
+    log("Then start a new session and run /doctor to confirm the hook is registered.");
+    log("(Deliberately not using the hook? Re-run with --no-hook; the baseline still");
+    log(" applies, but auto-routing stays off until you wire a hook.)");
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swe-workflow-skills",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "A curated library of Claude Code Agent Skills covering the full software lifecycle, with orchestrator-routed activation that scales past the skill-listing budget.",
   "type": "module",
   "bin": {
@@ -10,6 +10,7 @@
     "bin/cli.mjs",
     "install.mjs",
     "uninstall.mjs",
+    "disable.mjs",
     "scripts/resolve.mjs",
     "hooks/session-start.mjs",
     "commands/role.md",

package/scripts/resolve.mjs

@@ -28,7 +28,7 @@
 //
 // roles.json is read from $ROLES_JSON if set, else ../roles.json relative to this file.
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync, statSync, readdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, statSync, readdirSync, rmSync } from "node:fs";
 import { dirname, join, resolve as resolvePath } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -88,6 +88,73 @@ export function installedSkills(skillsDir) {
     .sort();
 }
 
+// ---- disabled-skills marker ------------------------------------------------
+//
+// Lets a user opt a skill OUT of routing/auto-trigger and have it *survive* the
+// SessionStart hook. A plain settings.local.json edit can't: applyBaseline owns
+// every installed skill's entry and rewrites it each session. Instead the choice
+// lives in a `.disabled-skills` marker beside the skills (like `.active-role`),
+// which applyBaseline folds in on every write — so the hook re-asserts the
+// disable rather than reverting it.
+//
+// Format: one skill per line, optional state after whitespace; `#` comments and
+// blank lines ignored. Valid states are the two that hide a skill from the model:
+//   data-modeling                 -> user-invocable-only (default; human /name still works)
+//   data-modeling off             -> off (fully hidden)
+
+export const DISABLE_STATES = new Set(["user-invocable-only", "off"]);
+export const DEFAULT_DISABLE_STATE = "user-invocable-only";
+
+export function disabledMarkerPath(skillsDir) {
+  return join(skillsDir, ".disabled-skills");
+}
+
+// Parse the marker into Map<skill, state>. Best-effort: a missing or unreadable
+// file yields an empty map (never throws — the hook must not fail on it).
+export function readDisabled(skillsDir) {
+  const path = disabledMarkerPath(skillsDir);
+  const map = new Map();
+  if (!(existsSync(path) && statSync(path).isFile())) return map;
+  let text = "";
+  try {
+    text = readFileSync(path, "utf-8");
+  } catch {
+    return map;
+  }
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const [name, state] = line.split(/\s+/);
+    if (!name) continue;
+    map.set(name, DISABLE_STATES.has(state) ? state : DEFAULT_DISABLE_STATE);
+  }
+  return map;
+}
+
+// Same, but restricted to skills actually installed here (stale names dropped).
+export function loadDisabled(skillsDir) {
+  const installed = new Set(installedSkills(skillsDir));
+  const map = new Map();
+  for (const [name, state] of readDisabled(skillsDir)) {
+    if (installed.has(name)) map.set(name, state);
+  }
+  return map;
+}
+
+// Persist Map<skill, state>, sorted. Removes the marker entirely when empty so an
+// enabled-everything state leaves no file behind (mirrors pruneSettings dropping
+// an empty skillOverrides).
+export function writeDisabled(skillsDir, map) {
+  const path = disabledMarkerPath(skillsDir);
+  const names = [...map.keys()].sort();
+  if (names.length === 0) {
+    if (existsSync(path)) rmSync(path);
+    return;
+  }
+  const lines = names.map((n) => (map.get(n) === DEFAULT_DISABLE_STATE ? n : `${n} ${map.get(n)}`));
+  writeFileSync(path, lines.join("\n") + "\n");
+}
+
 // ---- settings I/O ----------------------------------------------------------
 
 // Recursively sort object keys so output is deterministic (mirrors Python's
@@ -143,11 +210,19 @@ export function applyBaseline(data, settingsPath, skillsDir, role) {
   const merged = {};
   for (const [k, v] of Object.entries(existing)) if (!installedSet.has(k)) merged[k] = v;
   Object.assign(merged, desired);
+
+  // User-disabled skills override the baseline: an explicit opt-out wins over
+  // name-only AND over a pinned/role-promoted "on" (a pinned skill the user
+  // disabled becomes user-invocable-only, not on). Read from the marker each
+  // call so the hook re-asserts the disable instead of reverting it.
+  const disabled = loadDisabled(skillsDir);
+  for (const [s, state] of disabled) merged[s] = state;
+
   settings.skillOverrides = merged;
 
   writeSettings(settingsPath, settings);
   const nameOnly = Object.keys(desired).length;
-  return { nameOnly, on: installed.length - nameOnly, role };
+  return { nameOnly, on: installed.length - nameOnly, role, disabled: disabled.size };
 }
 
 // Remove the given skills from a settings file's skillOverrides. Returns removed count.

package/skills/accessibility-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: accessibility-design
 description: "Design and implement accessible web/mobile apps to WCAG 2.1/2.2 — semantic HTML, ARIA patterns, keyboard navigation, focus management, color contrast, screen readers, accessible forms. Triggers: accessibility, a11y, WCAG, screen reader, keyboard navigation, ARIA, focus management, color contrast, alt text, semantic HTML, tab order, focus trap, skip link, announce. Build it in, don't bolt it on."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/ai-evaluation/SKILL.md

@@ -2,7 +2,6 @@
 name: ai-evaluation
 description: "Define how to evaluate ML models and GenAI/LLM apps — golden datasets, offline metrics, RAG evaluation (faithfulness, relevance, context precision/recall) with ragas/deepeval/promptfoo, LLM-as-judge design and calibration, eval regression gates in CI, online A/B and human feedback. Logging/comparing runs → ml-experiment-tracking; building the app → llm-app-engineering; general experiment statistics → statistical-analysis."
 when_to_use: "Triggers: evaluate the model, eval my chatbot, RAG evals, ragas, LLM as judge, golden dataset, eval suite, is the new prompt better, hallucination rate, benchmark our AI app."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/api-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: api-design
 description: "Design RESTful and GraphQL APIs — endpoint naming, request/response contracts, error handling, pagination, versioning, auth patterns, OpenAPI specs. Triggers: design the API, API contract, REST API, GraphQL schema, error response format, pagination, API versioning, OpenAPI, swagger, endpoints. Use architecture-design for REST-vs-GraphQL or monolith-vs-microservices decisions."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/architecture-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: architecture-design
 description: "Guide architectural and structural decisions using Architecture Decision Records (ADRs) — new services, pattern choices, database selection, component boundaries, state management, costly-to-reverse decisions. Triggers: how should I architect, which pattern, design decision, should I use X or Y, system design, ADR, component design, architectural trade-off. Owns internal-structure decisions — build vs buy/adopt a vendor or OSS capability → build-vs-buy."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/architecture-documentation/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: architecture-documentation
 description: "Design and maintain architecture documentation with multi-level diagrams (C4) and docs-as-code. Triggers: architecture diagram, document the architecture, C4 diagram, system context, container diagram, component diagram, architecture docs, docs-as-code, PlantUML, Structurizr, D2, Mermaid architecture, infrastructure diagram, runtime flow. Use architecture-design for ADRs."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/brainstorming/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: brainstorming
 description: "Facilitate divergent ideation before committing to a spec — Socratic questioning, widening the option space, challenging assumptions and inherited constraints, then converging on candidates. Triggers: brainstorm, let's explore ideas, what are our options, help me think through, generate ideas, what could we build, not sure what I want, explore approaches, ideate. Once ideas converge, hand off to prd-writing (WHAT/WHY) or feature-planning (breakdown) — this skill opens options; those close them."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/browser-verification/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: browser-verification
 description: "Verify a web app change by driving the real UI in a browser — reproduce the user flow end to end, watch console errors and network failures, exercise loading/error/empty states, capture screenshots as evidence. Use before claiming a UI change works. Triggers: check it in the browser, verify the UI, click through the flow, console errors, test it like a user, smoke test the frontend. Designing persistent test suites → test-suite-design; the generic done-gate → verification-before-completion (this is its browser-specific practice)."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/bug-investigating/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: bug-investigating
 description: "Systematic debugging and root cause analysis using structured methodology — reproduce, isolate, hypothesize, verify. Triggers: this doesn't work, I'm getting an error, something is broken, bug, debug this, why is this happening, unexpected behavior, regression, root cause, stack trace, error message."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/build-vs-buy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: build-vs-buy
 description: "Decide whether to build in-house, buy a vendor/SaaS product, or adopt OSS — core-vs-commodity framing, multi-year total cost of ownership, integration and maintenance burden, vendor viability, lock-in and exit costs. Triggers: build vs buy, build or buy, vendor evaluation, SaaS vs in-house, should we adopt this open source, TCO, total cost of ownership, lock-in, exit cost, make or buy, off the shelf. Internal-structure decisions (patterns, service boundaries, ADRs for your own code) → architecture-design."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit, WebFetch, WebSearch
 ---
 

package/skills/cicd-pipeline/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: cicd-pipeline
 description: "Design CI/CD pipelines for automated build, test, deploy — GitHub Actions, GitLab CI, quality gates. Triggers: CI/CD, pipeline, GitHub Actions, GitLab CI, workflow, automated deployment, build pipeline, continuous integration, continuous deployment, automate tests on PR, deploy automatically, quality gate."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/code-archaeology/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: code-archaeology
 description: "Understand unfamiliar or legacy code before changing it — map entry points, mine git history (blame, churn, log -S), trace data flow, recover the why behind odd code, pin current behavior with characterization tests, find seams for safe change. Triggers: understand this codebase, legacy code, inherited this project, what does this code do, why is it written this way, nobody knows how this works, onboard to this repo, is it safe to change this. Prioritizing debt → technical-debt-review; improving code you already understand → refactoring."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/code-reviewing/SKILL.md

@@ -2,7 +2,6 @@
 name: code-reviewing
 description: "Structured code reviews enforcing DRY, KISS, YAGNI, SRP, best practices, and project conventions."
 when_to_use: "Triggers: review this code, code review, check my code, what do you think of this implementation, review this PR, is this code good, feedback on my code, review staged changes before commit."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/compliance-privacy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: compliance-privacy
 description: "Engineer for regulatory and privacy obligations — GDPR/CCPA privacy-by-design, PII data mapping and minimization, retention and deletion (right to erasure), data subject requests, consent, SOC 2 controls (access, change management, audit logging). Triggers: GDPR, CCPA, SOC 2, HIPAA, compliance, privacy review, PII, personal data, data retention, right to be forgotten, DSR, audit requirements, are we compliant. Vulnerabilities in code → security-audit; attack analysis of a design → threat-modeling."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit, WebFetch, WebSearch
 ---
 

package/skills/configuration-strategy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: configuration-strategy
 description: "Design environment configuration, secrets management, and feature-flag hierarchy for a service or feature. Triggers: config strategy, environment variables, .env, secrets management, feature flag, config hierarchy, config precedence, twelve-factor config, environment-specific settings."
-model: haiku
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/containerization/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: containerization
 description: "Write production-grade Dockerfiles, docker-compose, and Kubernetes manifests following security and reliability best practices. Triggers: Dockerfile, docker-compose, containerize, Docker image, Kubernetes, k8s manifest, container, pod, deployment yaml, multi-stage build, docker build, image size, container security."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/data-modeling/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: data-modeling
 description: "Design database schemas, relationships, indexes, and migration strategies — relational and document stores. Triggers: data model, schema design, ER diagram, database schema, table design, foreign key, index strategy, normalization, denormalization, migration plan, document model, partition key."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/data-pipeline-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: data-pipeline-design
 description: "Design batch and streaming data pipelines — ELT into a warehouse/lakehouse, dbt and analytics engineering (staging/intermediate/marts layers), orchestration with Airflow or Dagster, idempotent loads, incremental models, backfills, CDC ingestion. Triggers: data pipeline, ELT, ETL, dbt models, data warehouse, Snowflake, BigQuery, ingest into the warehouse, Airflow DAG, Dagster, Kafka streaming, backfill, incremental load, nightly job duplicates rows. ML training/feature pipelines → ml-pipeline-design; validating the data → data-quality."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/data-quality/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: data-quality
 description: "Keep warehouse and pipeline data trustworthy — dbt tests, expectations (Great Expectations/Soda), data contracts with upstream producers, source freshness, schema-drift and volume anomaly detection, lineage and blast radius, severity and alerting. Triggers: data quality, bad data in dashboards, data validation, dbt tests, data contract, schema drift, stale data, freshness check, duplicate rows, nulls in the warehouse, data lineage, data SLA, upstream schema change broke us. Generating test/synthetic data → test-data-strategy; schema design → data-modeling."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/dependency-impact-analysis/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: dependency-impact-analysis
 description: "Map the blast radius of a change before implementing — find dependents, classify breaking vs additive, identify coordination needs, produce a propagation plan. Triggers: what will break if I change this, blast radius, impact analysis, breaking change, who depends on this, downstream impact, safe to rename, shared schema change, dependency graph."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/dependency-management/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: dependency-management
 description: "Evaluate, audit, and upgrade project dependencies — assess libraries before adoption, audit CVEs, plan major upgrades, resolve conflicts. Triggers: should I use this library, npm audit, upgrade dependencies, dependency vulnerability, outdated packages, evaluate this package, is this library maintained, dependency conflict, lock file, breaking changes in upgrade."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, WebFetch, WebSearch
 ---
 

package/skills/deployment-checklist/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: deployment-checklist
 description: "Pre-deploy verification and release safety checks — config, migrations, monitoring, rollback readiness, comms. Triggers: deployment checklist, ready to deploy, pre-deploy, release checklist, go-live, ship checklist, deploy safety, is this safe to ship, release readiness."
-model: haiku
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/deployment-repo/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: deployment-repo
 description: "Design a deployment (GitOps) repo that orchestrates multiple services in a polyrepo — version pinning, environment promotion, compatibility matrices, system config. Triggers: deployment repo, GitOps repo, polyrepo, multi-repo, version pinning, compatibility matrix, environment promotion, multi-service deployment, orchestration repo, which versions work together."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/dx-audit/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: dx-audit
 description: "Audit and improve developer experience — inner-loop feedback (build/test/reload times), CI wait and queue times, flaky tests, local environment setup, onboarding time-to-first-PR, tooling friction, docs discoverability; produce a prioritized remediation plan. Triggers: developer experience, DX audit, devex, builds are slow, CI takes forever, flaky tests, onboarding takes weeks, tooling friction, developer productivity, engineers are frustrated. Code health/debt hotspots → technical-debt-review; designing one pipeline → cicd-pipeline."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/effort-estimation/SKILL.md

@@ -2,7 +2,6 @@
 name: effort-estimation
 description: "Estimate engineering effort with agile techniques — story points, t-shirt sizing, three-point estimation, capacity planning."
 when_to_use: "Triggers: estimate this, how long will this take, story points, t-shirt sizing, effort estimation, capacity planning, sprint planning, budget estimate, forecast, velocity, when will this be done."
-model: haiku
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/exploratory-data-analysis/SKILL.md

@@ -2,7 +2,6 @@
 name: exploratory-data-analysis
 description: "Explore and profile an unfamiliar dataset before modeling or analysis — structural profiling, missingness structure, distributions and outliers, feature–target relationships, leakage awareness, and explicit hypothesis generation. Pipeline-level data trust (broken dashboards, tests, contracts, freshness) → data-quality; formal inference on the hypotheses → statistical-analysis."
 when_to_use: "Triggers: explore this dataset, EDA, profile the data, what's in this data, first look at the data, understand this CSV, distributions, outliers, missing values, correlation, data leakage."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/feature-planning/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: feature-planning
 description: "Break features into well-scoped tasks with acceptance criteria, risk assessment, and dependency mapping. Triggers: plan this, break this down, scope this feature, create tasks for, sprint planning, how should I implement this feature, user stories, acceptance criteria, dependency mapping, feature breakdown. Creates the plan — executing an already-approved plan checkpoint by checkpoint → plan-execution."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/finops-cost-optimization/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: finops-cost-optimization
 description: "Understand and reduce cloud spend — cost visibility and allocation (tagging, ownership), unit economics, rightsizing, autoscaling, commitment discounts (reserved instances, savings plans), storage/egress traps, architecture cost review, budgets and anomaly alerts. Triggers: cloud costs, AWS bill, cut costs, cost optimization, FinOps, why is our bill so high, rightsizing, reserved instances, savings plan, egress fees, cost per customer. Whether to build or buy a capability → build-vs-buy; making code faster → performance-optimization."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash, WebFetch, WebSearch
 ---
 

package/skills/frontend-architecture/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: frontend-architecture
 description: "Design frontend architecture — React component hierarchy, state management, design tokens, data fetching, routing, error boundaries, code organization. Triggers: component architecture, state management, design system, design tokens, component library, React structure, folder structure, Zustand vs Redux, React Query, code splitting, error boundary, compound component."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/git-workflow/SKILL.md

@@ -2,7 +2,6 @@
 name: git-workflow
 description: "Write commit messages, PR descriptions, and manage branching strategy following conventional commits."
 when_to_use: "Triggers: write a commit message, commit this, PR description, pull request, branching strategy, git workflow, squash commits, rebase, conventional commits, how should I commit this, review staged changes."
-model: haiku
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/gitops-delivery/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gitops-delivery
 description: "Design GitOps continuous delivery with ArgoCD or Flux — declarative reconciliation, cross-repo CI/CD triggers, drift detection, progressive delivery. Triggers: ArgoCD, Flux, FluxCD, GitOps, git-based deployment, declarative delivery, auto-sync, drift detection, cross-repo trigger, reconciliation loop, pull-based deployment, canary GitOps."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/incident-response/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: incident-response
 description: "Structured production incident workflow — triage, mitigation, investigation, recovery, comms. Triggers: production is down, site is down, incident, outage, users seeing errors, on-call, alert fired, p0, p1, sev1, sev2, broken in prod, rollback, emergency deploy. For active incidents under time pressure."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/infrastructure-as-code/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: infrastructure-as-code
 description: "Write and review IaC with Terraform, CloudFormation, Pulumi, or CDK — modularity, security, state management. Triggers: Terraform, CloudFormation, Pulumi, infrastructure as code, IaC, provision, cloud resources, terraform module, state management, terraform plan, CDK, drift, remote state."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/llm-app-engineering/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: llm-app-engineering
 description: "Design and build LLM-powered applications — prompt and context engineering, RAG architecture (chunking, hybrid retrieval, reranking, grounded prompts), agent design (tool surfaces, planning, sub-agents), and memory. Triggers: build a chatbot, LLM app, AI assistant, prompt engineering, system prompt, RAG design, chunking, embeddings, vector database, semantic search, AI agent, tool calling, agent memory, context window, hallucinations. Measuring quality → ai-evaluation; model serving/inference infra → ml-model-deployment."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/metrics-and-okrs/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: metrics-and-okrs
 description: "Define OKRs, KPIs, success metrics, and engineering health metrics (DORA). Triggers: OKR, KPI, metrics, success metrics, key results, objectives, measure success, DORA metrics, engineering metrics, velocity, cycle time, deployment frequency, how do we measure, what should we track."
-model: haiku
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/ml-experiment-tracking/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: ml-experiment-tracking
 description: "Design reproducible ML experiments — tracking, versioning, run comparison with MLflow, W&B, or DVC. Triggers: experiment tracking, MLflow, wandb, weights and biases, DVC, track experiments, compare models, hyperparameter, reproducibility, model registry, which model is better, experiment results, log metrics. Defining WHAT to measure (metrics, golden datasets, judges) → ai-evaluation; this skill records and compares the runs."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/ml-model-deployment/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: ml-model-deployment
 description: "Deploy ML models to production — serving infrastructure, monitoring, drift detection, safe rollouts. Triggers: deploy model, serve model, model API, model monitoring, data drift, concept drift, model degradation, A/B test model, canary model, inference endpoint, prediction API, retrain trigger."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/ml-pipeline-design/SKILL.md

@@ -2,7 +2,6 @@
 name: ml-pipeline-design
 description: "Design reproducible ML training and data pipelines — ingestion, validation, feature engineering, training, evaluation, continuous training orchestration. Analytics/BI ELT and dbt warehouse pipelines → data-pipeline-design; refactoring general analysis/reporting notebooks (no model training) to production code → notebook-to-production."
 when_to_use: "Triggers: training pipeline, ML data pipeline, feature engineering, ETL for ML, continuous training, data validation, feature store, preprocessing, notebook to training pipeline, orchestrate training, Kubeflow, pipeline DAG, point-in-time features."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/mobile-architecture/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: mobile-architecture
 description: "Design mobile app architecture — native (Swift/Kotlin) vs cross-platform (React Native/Flutter) selection, navigation and deep linking, state management, offline-first design and data sync, local persistence, push notifications, platform constraints (background work, battery, permissions). Triggers: mobile app architecture, iOS app, Android app, React Native or Flutter, offline first, data sync, mobile state management, deep linking, push notifications, app structure. Web SPA component architecture → frontend-architecture."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/mobile-release/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: mobile-release
 description: "Ship mobile apps through the app stores — signing and provisioning, store review and rejection handling, phased/staged rollouts with halt criteria, crash monitoring, versioning and build numbers, beta channels (TestFlight, Play tracks), forced updates, and the no-instant-rollback reality of mobile. Triggers: app store release, publish to App Store, Play Store, TestFlight, staged rollout, app review rejected, code signing, provisioning profile, mobile release, hotfix a mobile bug. General semver/registry/library publishing → release-management."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash, WebFetch, WebSearch
 ---
 

package/skills/notebook-to-production/SKILL.md

@@ -2,7 +2,6 @@
 name: notebook-to-production
 description: "Refactor analysis notebooks into production-grade code — triage what deserves productionizing, extract modules with tests, parameterize hardcoded values, pin environments for reproducibility, and schedule unattended runs with alerting. Owns general analysis/reporting notebooks; notebooks that feed model TRAINING (feature engineering + training DAGs, scheduled retraining) → ml-pipeline-design."
 when_to_use: "Triggers: productionize this notebook, notebook to script, notebook to module, refactor my notebook, parameterize notebook, papermill, schedule this analysis, reproducible analysis, notebook is a mess."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/observability-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: observability-design
 description: "Design production observability — SLIs, SLOs, SLAs, error budgets, OpenTelemetry traces/metrics/logs, structured logging, alerting, dashboards. Triggers: SLO, SLI, SLA, error budget, observability, monitoring, OpenTelemetry, OTel, tracing, distributed tracing, structured logging, alerting, dashboard, metrics, correlation ID, alert fatigue."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/performance-optimization/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: performance-optimization
 description: "Identify and resolve performance bottlenecks via static analysis — N+1 queries, algorithmic complexity, query optimization, caching, memory leaks, bundle size, connection management. Triggers: this is slow, optimize, performance, N+1, query optimization, caching, bundle size, memory leak, latency, response time, scale, bottleneck."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/plan-execution/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: plan-execution
 description: "Execute an already-approved plan with discipline — batch tasks into verifiable checkpoints, verify each with fresh evidence before marking it done, log drift, and stop to re-plan when reality diverges from the plan's assumptions. Triggers: execute the plan, implement the approved plan, work through this plan, continue/resume the plan, next phase, checkpoint. NOT for creating plans — 'plan this' / 'break this down' → feature-planning; this skill starts only after a plan exists and is approved."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/prd-writing/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: prd-writing
 description: "Write lightweight agile PRDs and technical RFCs that align stakeholders before implementation. Triggers: PRD, product requirements, RFC, request for comments, technical design doc, design document, tech spec, write requirements, what are we building, spec this out. Produces the WHAT and WHY — feature-planning handles HOW."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/project-documentation/SKILL.md

@@ -2,7 +2,6 @@
 name: project-documentation
 description: "Write and maintain project docs — README, contributing guides, API docs, changelogs, inline docs."
 when_to_use: "Triggers: write a README, document this project, create documentation, contributing guide, changelog, API docs, how do I document, this needs docs, onboarding docs, JSDoc, docstrings."
-model: haiku
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/project-proposal/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: project-proposal
 description: "Write lightweight project proposals for budget approval and go/no-go decisions — problem, business case, scope, rough estimates, risks, success criteria. Triggers: project proposal, project brief, business case, budget estimate, should we build this, go/no-go, risk assessment, cost-benefit, ROI, justify this project, stakeholder approval."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/project-review/SKILL.md

@@ -2,7 +2,6 @@
 name: project-review
 description: "Review a built project's execution health before a milestone — scope alignment, roadmap / execution-plan adherence, implementation maturity (what's production-ready vs stub/deferred), and the evidence it actually works (tests, coverage, validation results, changelog). Use strategic-review for vision/positioning/market; technical-debt-review for a pure code-health audit."
 when_to_use: "Triggers: project review, execution review, are we on track, implementation vs roadmap, scope drift, readiness review, what's actually built, validation results review, pre-launch review."
-model: opus
 context: fork
 agent: general-purpose
 allowed-tools: Read, Grep, Glob, WebFetch, Write, Edit

package/skills/refactoring/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: refactoring
 description: "Systematic code improvement via design principles, smell detection, and safe transformation patterns. Triggers: refactor this, clean this up, simplify this code, reduce complexity, extract this, this code is messy, tech debt, improve this code, code smell, rename, extract function, dead code."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/release-management/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: release-management
 description: "Cut and publish software releases right-sized to the project — semver decisions, changelogs, tagging, automated version bumps (release-please, changesets, semantic-release), publishing gates, npm/PyPI/container registry publishing, pre-release channels, monorepo versioning. Triggers: cut a release, release this, publish to npm, publish to PyPI, publish this package, version bump, what version should this be, semver, changelog, tag a release, release notes, GitHub release, prerelease, release automation, release PR. Deploy-time safety → deployment-checklist; commit/PR hygiene → git-workflow."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/resilience-engineering/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: resilience-engineering
 description: "Design systems that survive failure — failure-mode analysis, resilience patterns (timeouts, retries with backoff, circuit breakers, bulkheads, load shedding, graceful degradation), chaos experiments, disaster recovery with RTO/RPO, backup restore testing, game days. Triggers: chaos engineering, disaster recovery, DR plan, what if the database goes down, single point of failure, failover, circuit breaker, RTO, RPO, game day, high availability. An incident happening NOW → incident-response; undoing a bad deploy → rollback-strategy."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/retrospective/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: retrospective
 description: "Facilitate sprint retros, project post-mortems, and incident post-mortems with actionable, owned improvements. Triggers: retrospective, retro, post-mortem, postmortem, lessons learned, what went wrong, what went well, incident review, blameless, action items, sprint review, after action review."
-model: haiku
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/rollback-strategy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: rollback-strategy
 description: "Design safe rollback plans before deploying — identify irreversible changes, classify rollback complexity, create tested undo procedures. Triggers: rollback plan, rollback strategy, how do I undo this, can we revert, what if the deploy fails, safe to deploy, feature flag rollout, blue-green, database migration rollback, irreversible change."
-model: haiku
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/security-audit/SKILL.md

@@ -2,7 +2,6 @@
 name: security-audit
 description: "Comprehensive security analysis — OWASP Top 10, auth/authz flows, injection vulnerabilities, data exposure, secrets detection, dependency CVEs, hardening recommendations. Reviews EXISTING code/config — design-time analysis of a system not yet built → threat-modeling."
 when_to_use: "Triggers: security audit, vulnerability, is this secure, security review, pentest prep, OWASP, harden this, check for vulnerabilities, injection, XSS, CSRF, auth security."
-model: opus
 context: fork
 agent: general-purpose
 allowed-tools: Read, Grep, Glob, Write, Edit, WebFetch, WebSearch

package/skills/skill-router/SKILL.md

@@ -2,7 +2,6 @@
 name: skill-router
 description: "Orchestrator and entry point for the swe-workflow skills library — consult FIRST when starting any non-trivial software task; most skills load name-only and only activate when invoked here. Routes intent to the right skill(s) and invokes them by name; shows the Golden Path chains."
 when_to_use: "Triggers: starting a feature, planning, an architecture or design decision, implementing, debugging, reviewing, refactoring, testing, security, deployment, an incident, shipping, or unsure which skill fits."
-model: haiku
 allowed-tools: Read, Grep, Glob, Skill
 ---
 

package/skills/statistical-analysis/SKILL.md

@@ -2,7 +2,6 @@
 name: statistical-analysis
 description: "Design and analyze experiments and statistical tests — test selection with stated assumptions, sample size and power, effect sizes and confidence intervals over bare p-values, and pitfall discipline (multiple comparisons, p-hacking, peeking/optional stopping). Owns experiment statistics generally; live A/B evaluation of AI/LLM apps (quality metrics, judges, feedback) → ai-evaluation."
 when_to_use: "Triggers: hypothesis test, t-test, chi-square, p-value, statistical significance, confidence interval, sample size, power analysis, design an experiment, A/B test, multiple comparisons, is this difference real."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/strategic-review/SKILL.md

@@ -2,7 +2,6 @@
 name: strategic-review
 description: "Review a project's strategic position before going public, launching, or raising — vision, mission, value proposition, scope positioning, the defensible wedge, and a live competitive / market comparative analysis. Use project-review for execution/roadmap/implementation health; delegates deep market scans to deep-research."
 when_to_use: "Triggers: strategic review, positioning, go public, go-to-market, market analysis, competitive landscape, value proposition, is there a moat, who are our competitors, platform absorption risk, market positioning, comparable products."
-model: opus
 context: fork
 agent: general-purpose
 allowed-tools: Read, Grep, Glob, WebFetch, WebSearch, Write, Edit

package/skills/subagent-orchestration/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: subagent-orchestration
 description: "Decompose big or parallelizable work across subagents — when to fan out vs stay solo, scoping self-contained sub-tasks, prompting agents that don't share your context, isolating parallel edits (git worktrees), skeptically verifying and synthesizing results you didn't produce. Triggers: use subagents, parallelize this, fan out, orchestrate agents, multi-agent, spawn agents, worktree, delegate to agents, split this across agents, agent team. Sequencing checkpoints of an approved plan → plan-execution (orchestration parallelizes within its batches)."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/tdd-workflow/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: tdd-workflow
 description: "Guide test-driven development with red-green-refactor. Triggers: use tdd, test first, write the tests, red green refactor, test-driven, what should I test, write tests before code, failing test, implement using TDD. For NEW code via test-first — use test-suite-design for adding tests to existing code."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/technical-debt-review/SKILL.md

@@ -2,7 +2,6 @@
 name: technical-debt-review
 description: "Strategic codebase health assessment — identify hotspots, categorize debt, produce remediation roadmap."
 when_to_use: "Triggers: technical debt, tech debt, debt review, codebase health, hotspots, debt assessment, remediation plan, what should we fix first, debt roadmap, code rot, legacy code audit."
-model: opus
 context: fork
 agent: general-purpose
 allowed-tools: Read, Grep, Glob, Write, Edit

package/skills/test-data-strategy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: test-data-strategy
 description: "Design and generate test data — factories, synthetic data, property-based testing, boundary analysis, contract testing, load scenarios, GDPR-safe data. Triggers: test data, synthetic data, fake data, factory, seed data, fixtures, property-based testing, fuzz testing, boundary values, contract testing, Pact, load test data, anonymize, GDPR test data."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/test-suite-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: test-suite-design
 description: "Design comprehensive test suites for existing code — strategy across unit/integration/e2e, fixtures, factories, helpers. Triggers: add tests, write tests for, increase coverage, test this module, testing strategy, test plan, what tests do I need, test infrastructure, test helpers, this has no tests. Not for TDD — use tdd-workflow."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 

package/skills/threat-modeling/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: threat-modeling
 description: "Design-time security analysis of a system or feature before it's built — trust boundaries, attack surface, STRIDE per element, abuse cases, prioritized mitigations that become security requirements. Triggers: threat model, STRIDE, trust boundary, attack surface, what could go wrong security-wise, security design review, abuse case, secure this design, security requirements. Reviewing EXISTING code/config for vulnerabilities → security-audit; use this skill while the design is still on the whiteboard."
-model: opus
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/ui-ux-design/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: ui-ux-design
 description: "Design user experiences from an engineer's perspective — user flows, wireframes, interaction patterns, responsive strategy, navigation, loading/error/empty states. Triggers: design the UI, user flow, wireframe, how should this screen look, loading state, error state, empty state, responsive design, navigation, page layout, form design, mockup."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit
 ---
 

package/skills/verification-before-completion/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: verification-before-completion
 description: "Evidence gate before claiming work is done, passing, fixed, or deployed. Use before saying 'done', 'it works', or 'tests pass', or before committing, pushing, or opening a PR. Triggers: is it done, did it work, tests pass, verify, ready to commit, before I push, confirm the fix. Run the proving command fresh and read its output first."
-model: haiku
 allowed-tools: Read, Grep, Glob, Bash
 ---
 

package/skills/writing-skills/SKILL.md

@@ -2,7 +2,6 @@
 name: writing-skills
 description: "Use when authoring, editing, or reviewing a skill in this library — a new SKILL.md, one that under-triggers, or hardening an existing one. Covers description and listing-budget rules, frontmatter, progressive disclosure, the 3-eval rule, and pressure-testing against rationalizations."
 when_to_use: "Triggers: write a skill, new skill, edit a skill, skill isn't triggering."
-model: sonnet
 allowed-tools: Read, Grep, Glob, Write, Edit, Bash
 ---
 
@@ -69,8 +68,10 @@ description over the body, so get it right.
 
 ## Structure and budget (brief — see AUTHORING.md for detail)
 
-- Frontmatter: `name`, `description`, `when_to_use`, `model` (haiku/sonnet/opus
-  by reasoning need), `allowed-tools`. Newer fields where they fit:
+- Frontmatter: `name`, `description`, `when_to_use`, `allowed-tools` — do NOT
+  set `model` (inline pins are ignored at runtime; on forked skills they
+  override the user's model choice and quota bucket — see AUTHORING.md
+  "Frontmatter Fields"). Newer fields where they fit:
   `context: fork` + `agent` (heavy report-producing skills — must write the full
   report to a file and put anything needing user input in an "Open questions"
   section, since a fork returns only a summary and can't ask the user),

package/uninstall.mjs

@@ -127,6 +127,7 @@ for (const f of [
   join(dest, ".roles.json"),
   join(dest, ".catalog.json"),
   join(dest, ".active-role"),
+  join(dest, ".disabled-skills"),
   join(dest, ".swe-workflow-manifest.json"),
   join(claudeDir, "hooks", "resolve.mjs"),
   join(claudeDir, "hooks", "session-start.mjs"),