project-kit-cli 0.6.0__tar.gz → 1.0.1__tar.gz

{project_kit_cli-0.6.0 → project_kit_cli-1.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: project-kit-cli
-Version: 0.6.0
+Version: 1.0.1
 Summary: Project definition and dev-workflow kit that hands off to Spec Kit
 Keywords: project-management,spec-kit,claude-code,workflow,github
 Author: Miguel Tomás

{project_kit_cli-0.6.0 → project_kit_cli-1.0.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "project-kit-cli"
-version = "0.6.0"
+version = "1.0.1"
 description = "Project definition and dev-workflow kit that hands off to Spec Kit"
 readme = "README.md"
 requires-python = ">=3.12"

{project_kit_cli-0.6.0 → project_kit_cli-1.0.1}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "project-kit-cli"
-version = "0.6.0"
+version = "1.0.1"
 description = "Project definition and dev-workflow kit that hands off to Spec Kit"
 readme = "README.md"
 requires-python = ">=3.12"

{project_kit_cli-0.6.0 → project_kit_cli-1.0.1}/src/project_kit/assets/docs/skills.md

@@ -45,6 +45,13 @@ cubren lo que depende del proyecto: sus reglas, la entrevista crítica y la reco
 | testing | tdd | kayaman/skills | CC0-1.0 | leída |
 | seo | Claude SEO | AgriciDaniel/claude-seo | MIT | leída |
 | security | insecure-defaults, supply-chain-risk-auditor, differential-review, open-sourcing | trailofbits/skills | CC BY-SA 4.0 | leída |
+| security | security-audit | cloudflare/security-audit-skill | MIT | leída; ver abajo por qué es `any` |
+
+**security-audit (Cloudflare)** es `any` y no un rasgo concreto porque sus clases de ataque
+cubren todo tipo de objetivo (memoria y binarios, web y autenticación, cliente, nube, cadena de
+suministro, IA, escritorio y móvil) y el catálogo no tiene un rasgo «tiene código». Se ofrece
+cuando ya hay código, no durante la definición. Va aparte de Trail of Bits: esa revisa
+decisiones y dependencias; esta audita el código y verifica cada hallazgo con otro agente.
 
 Quedan **sin candidata verificada**: marketing, privacidad y cumplimiento, datos y migraciones,
 diseño de API, observabilidad y rendimiento. `accessibility` tiene solo las reglas de Vercel;

{project_kit_cli-0.6.0 → project_kit_cli-1.0.1}/src/project_kit/assets/project/skills-catalog.yml

@@ -182,3 +182,23 @@ skills:
     when: [any]
     checked: 2026-10-18
     notes: ShareAlike licence, so do not copy its text into your repository; install it instead. Pick plugins with /plugin menu.
+
+  - id: cloudflare-security-audit
+    name: security-audit (Cloudflare)
+    area: security
+    source: https://github.com/cloudflare/security-audit-skill
+    install: "npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit"
+    license: MIT
+    summary: Multi-phase security audit of the code with isolated agents, independently verified findings and a machine-readable findings.json.
+    when: [any]
+    provides: [security-audit]
+    checked: 2026-10-20
+    notes: >-
+      Audits code, so offer it once the project has some, not while it is being defined. Needs
+      npx (Node), which also runs its validators. A full audit launches many isolated agents and
+      spends a lot of tokens. By default it writes architecture.md, coverage-ledger.json,
+      findings.json and REPORT.md outside the repository (~/security-audit-skill/<repo>/run-N);
+      inside it only if you pick a directory that version control ignores. Do not commit them
+      without reading them: they can describe vulnerabilities that are not fixed yet. It wants an
+      OS sandbox (no network, scratch-only writes) to run the target's code; without one it keeps
+      leads as needs_validation. Its output is long: read REPORT.md with pjkit peek.

{project_kit_cli-0.6.0 → project_kit_cli-1.0.1}/src/project_kit/assets/skills/pk-skills/SKILL.md

@@ -44,6 +44,10 @@ boundary - check `pjkit skills list --status installed`. If the matching skill i
 installed and not rejected, say in one sentence which one would help and offer to run this
 skill. Do it once per kind of task; do not interrupt twice.
 
+Skills that audit code (`cloudflare-security-audit`) are for once there is code: offer them in
+the specification phase or when the user asks for a security review, never while the project is
+still being defined. Say that a full audit costs many tokens and where it writes its results.
+
 ## Rules
 
 - Never run an install command, `npx`, `npm install -g` or a plugin install for the user.