[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6K7TP7VTTPW9H79AEHEVPGK":3,"skill-same:01M6K7TP7VTTPW9H79AEHEVPGK":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":32,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":57,"install":58,"resources":71},"01M6K7TP7VTTPW9H79AEHEVPGK","sec-review-fixes",null,"Companion to `sec-review-team`. Takes the `REPORT.md` or `findings.jsonl` from a security review run and produces fix PRs (one per finding or one consolidated) with interactive approval. Each candidate finding becomes a proposed diff + a regression test that would have caught it + a commit\u002FPR citing the finding ID. Filters by default to `severity IN (critical, high) AND confidence IN (certain, likely)`. Modes: interactive (default), `--dry-run` (produces a fix-plan document with no code changes), `--re-verify` (re-runs sec-review-team against a specific set of finding IDs and reports fixed \u002F still-present \u002F inconclusive). Safeguards: branch-only commits (never main), no force-push, clean-working-tree required, regression-test must pass before commit lands. Use when the user says \"fix the security findings\", \"apply sec-review fixes\", \"open PRs for the security report\", \"re-verify the security fixes\", or similar.","tbeack\u002Ffsad_playbook","tbeack","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206807984?v=4","01M6K7Q3C3VRTCVC55T71A1SY9","Theo Beack","01M6K7Q3GDY8TXRQEH984SEE5W",8,"MIT","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_playbook\u002Fblob\u002Fmain\u002Fskills\u002Fsec-review-fixes\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"sec review fixes","review fixes","fixes","review","security report","when","re","critical","main","clean","default","filters","only","never","fix","branch","regression","open","ids","SET","code","2026-11-10 10:12:30",false,"---\nname: sec-review-fixes\ndescription: 'Companion to `sec-review-team`. Takes the `REPORT.md` or `findings.jsonl` from a security review run and produces fix PRs (one per finding or one consolidated) with interactive approval. Each candidate finding becomes a proposed diff + a regression test that would have caught it + a commit\u002FPR citing the finding ID. Filters by default to `severity IN (critical, high) AND confidence IN (certain, likely)`. Modes: interactive (default), `--dry-run` (produces a fix-plan document with no code changes), `--re-verify` (re-runs sec-review-team against a specific set of finding IDs and reports fixed \u002F still-present \u002F inconclusive). Safeguards: branch-only commits (never main), no force-push, clean-working-tree required, regression-test must pass before commit lands. Use when the user says \"fix the security findings\", \"apply sec-review fixes\", \"open PRs for the security report\", \"re-verify the security fixes\", or similar.'\nargument-hint: '`[path to REPORT.md or findings.jsonl] [--dry-run | --re-verify \u003Cid>...] [--one-pr | --pr-per-finding]`'\n---\n\n# sec-review-fixes — Fix-Workflow Orchestration\n\nCompanion to `sec-review-team`. Never applies a code change without explicit user approval.\n\n## Step 0: Locate findings source\n\nParse `$ARGUMENTS`:\n- **Source path** — either a `REPORT.md` or a `\u003Cagent>.findings.jsonl` file (or a directory containing them, e.g. `\u003Ctarget>\u002F.planning\u002Fsecurity-review\u002F`).\n  - If source is a directory, aggregate every `*.findings.jsonl` in it.\n  - If source is `REPORT.md`, prefer the sibling `*.findings.jsonl` files if they exist (structured parse). Fall back to parsing the markdown if only the prose report is available.\n- **Mode:**\n  - default = interactive\n  - `--dry-run` = write a fix-plan markdown, no code changes\n  - `--re-verify \u003Cid>...` = re-run sec-review-team on the specified finding IDs and report status (skip Steps 2–5)\n- **PR granularity:** `--one-pr` (all fixes in one PR) or `--pr-per-finding` (default for ≤ 3 fixes; for ≥ 4, default switches to one-PR to avoid PR storm).\n\nDo **not** operate on the source target repo yet. Just read metadata.\n\n## Step 1: Filter candidate findings\n\nApply default filter:\n- `severity IN (critical, high)` — medium\u002Flow need manual review first, they are not eligible for auto-fix.\n- `confidence IN (certain, likely)` — `possible`\u002F`unverified` require human triage first; they are not eligible for auto-fix.\n- User may relax the filter explicitly (prompt: \"N findings matched default filter. X additional findings available at lower severity\u002Fconfidence — include them?\").\n\nFor `--re-verify`, skip filtering; use the specified IDs literally.\n\n## Step 2: Safety preflight\n\nBefore touching any file, verify:\n\n1. **Target git state:** Working tree clean (`git status --porcelain` empty). If dirty, abort with explanation. The user must stash\u002Fcommit first.\n2. **Current branch is NOT `main` \u002F `master` \u002F `trunk` \u002F default-branch.** If it is, offer to create `sec-review-fix\u002F\u003Ctimestamp>` and switch. Never operate directly on default.\n3. **No in-progress rebase \u002F merge \u002F cherry-pick** (`git status` shows no in-progress operation).\n4. **Remote reachable** (if PR mode, not dry-run): `git ls-remote --exit-code origin` succeeds.\n5. **`gh` CLI available and authenticated** (if PR mode).\n\nIf any check fails, abort with a specific message. Never proceed past a failed safety check.\n\n## Step 3: Per-finding fix authoring (spawn subagents in parallel)\n\nFor each candidate finding, spawn a `fix-author` `Agent` with:\n\n- **Subagent type:** `general-purpose` (or a typed `code-writer` if available).\n- **Brief:** \"Here is one security finding from sec-review-team: `\u003Cfinding>`. The current state of the code at `\u003Cfile>:\u003Cline_range>` is `\u003Csnippet>`. Produce (1) a diff that implements the `fix` field, (2) a regression test that would fail before the fix and pass after. Write to `\u003CTARGET>\u002F.planning\u002Fsec-review-fixes\u002F\u003Cid>.diff` and `\u003Cid>.test.\u003Cext>` respectively. Also write a one-paragraph commit message at `\u003Cid>.commit-msg.txt`.\"\n- **Allowed tools:** `Read`, `Grep`, `Glob`, read-only `Bash` allowlist. `Write` scoped to the three output paths only. **No `Edit` on target files** — the orchestrator applies diffs later, not the subagent.\n\nSubagents don't mutate target code. They produce candidate artifacts.\n\n## Step 4: Interactive approval (one finding at a time)\n\nFor each candidate:\n\n```\n━━ Finding \u003Cid>: \u003Ctitle> ━━\n  Severity:    \u003Csev>\n  Confidence:  \u003Cconf>\n  File:        \u003Cfile>:\u003Cline_range>\n  Root issue:  \u003Croot_issue>\n\nExploit:\n  \u003Cexploit>\n\nProposed fix:\n  \u003Cfix>\n\nProposed diff:\n  \u003Cdiff contents>\n\nProposed regression test:\n  \u003Ctest contents>\n\nApprove \u002F edit-fix \u002F skip \u002F abort? [a\u002Fe\u002Fs\u002Fx]\n```\n\n- **a** (approve) — move to Step 5 for this finding.\n- **e** (edit-fix) — let the user type revised instructions; respawn the fix-author with the revised brief.\n- **s** (skip) — finding stays un-fixed; continue to next.\n- **x** (abort) — stop all further processing; do not apply any pending approved fixes that haven't been committed yet.\n\nDefault if no response: treat as skip (never auto-approve).\n\nException: `--dry-run` skips this step entirely. The fix-plan is just the collected proposals.\n\n## Step 5: Apply + test + commit + push + PR (per approved finding)\n\n**Still safeguarded.** Even after approval:\n\n1. **Create or checkout the fix branch:** `sec-review-fix\u002F\u003Cfinding-id>` (for per-PR mode) or `sec-review-fix\u002F\u003Ctimestamp>` (for one-PR mode). Never operate on main.\n2. **Apply the diff** via `git apply \u003Cid>.diff`. On failure: mark finding as `apply-failed`, do not commit, continue to next.\n3. **Run the regression test.** How: detect target's test runner (`package.json scripts.test`, `cargo test`, `pytest`, `go test`, etc.) and invoke. The test must pass before proceeding. If it fails, revert (`git checkout -- \u003Caffected>`), mark as `regression-test-failed`, continue to next.\n4. **Commit with message:** the contents of `\u003Cid>.commit-msg.txt`, plus a trailer `Fixes-finding: \u003Cid>` + `Ref: \u003Csource path of findings>`. Default commit message ends with `Co-Authored-By: Claude (sec-review-fixes) \u003Cnoreply@anthropic.com>`.\n5. **Push to origin** (for PR mode only). `git push -u origin \u003Cbranch>`.\n6. **Open PR** via `gh pr create`:\n   - Title: `fix(security): \u003Cfinding title>`\n   - Body: full finding (exploit + fix + evidence), the regression test description, a checklist for the reviewer (manual verification + security implications + adjacent review).\n   - Label: `security`, `sec-review-team`.\n\nSafeguards that stay on throughout:\n- **Never force-push.**\n- **Never push to main.**\n- **Never amend an existing commit.**\n- **Never modify `.git\u002F` directly.**\n- If any safeguard tripping is requested, abort and surface it to the user.\n\n## Step 6: Report\n\nEmit a summary table:\n\n| Finding | Status | PR | Branch |\n|---|---|---|---|\n| auth-001 | fixed + PR opened | #1234 | sec-review-fix\u002Fauth-001 |\n| iv-003 | skipped | — | — |\n| sc-001 | regression-test-failed | — | — |\n| de-002 | apply-failed | — | — |\n\nPrint absolute paths to `.planning\u002Fsec-review-fixes\u002F` artifacts for every candidate (even skipped ones, so the user can come back later).\n\n## `--re-verify` mode\n\nAlternate flow triggered by `--re-verify \u003Cid>...`:\n\n1. Parse the finding IDs from args.\n2. For each ID, look up the original finding metadata (severity, file, root_issue, evidence) from the source `findings.jsonl`.\n3. Invoke `sec-review-team` against the same target and same scope. Wait for new `findings.jsonl`.\n4. For each requested ID:\n   - If no finding with the same `root_issue` + `file` appears in the new run → **fixed**.\n   - If a finding with the same `root_issue` appears → **still-present**. Show the diff between old and new evidence.\n   - If the specialist that would cover this category is not in the new roster (stack changed), or the category was `not-checked` → **inconclusive** (explain why).\n5. Emit a re-verify report at `.planning\u002Fsec-review-fixes\u002Fre-verify-\u003Ctimestamp>.md`.\n\nNever apply fixes in re-verify mode. Pure audit.\n\n## `--dry-run` mode\n\nTriggered by `--dry-run`. Steps 2, 4 (modified), 5 are skipped:\n\n- Step 2 safety preflight still runs (we still inspect repo state) but doesn't require branch-switching.\n- Step 3 still spawns fix-authors (artifact-only).\n- Step 4 shows proposals but doesn't prompt for apply — just collects them.\n- Step 5 is skipped entirely.\n- Instead: write `.planning\u002Fsec-review-fixes\u002Ffix-plan.md` — a human-readable document with every proposed fix + test + commit message, organized by severity. User can hand off to a team for manual implementation.\n\n## Related\n\n- **Companion skill:** [`sec-review-team`](..\u002Fsec-review-team\u002FSKILL.md) produces the input to this skill.\n- **Schema:** [`sec-review-team\u002Fschema\u002Ffinding.schema.json`](..\u002Fsec-review-team\u002Fschema\u002Ffinding.schema.json) — what `findings.jsonl` lines conform to.\n- **Safeguard details:** [`docs\u002Fsafeguards.md`](docs\u002Fsafeguards.md)\n- **Design tradeoffs:** [`sec-review-team\u002Fdocs\u002Ftradeoffs.md`](..\u002Fsec-review-team\u002Fdocs\u002Ftradeoffs.md) — item #5 (no-auto-fix) explains why this skill exists separately.\n","# sec-review-fixes — Fix-Workflow Orchestration\n\nCompanion to `sec-review-team`. Never applies a code change without explicit user approval.\n\n## Step 0: Locate findings source\n\nParse `$ARGUMENTS`:\n- **Source path** — either a `REPORT.md` or a `\u003Cagent>.findings.jsonl` file (or a directory containing them, e.g. `\u003Ctarget>\u002F.planning\u002Fsecurity-review\u002F`).\n  - If source is a directory, aggregate every `*.findings.jsonl` in it.\n  - If source is `REPORT.md`, prefer the sibling `*.findings.jsonl` files if they exist (structured parse). Fall back to parsing the markdown if only the prose report is available.\n- **Mode:**\n  - default = interactive\n  - `--dry-run` = write a fix-plan markdown, no code changes\n  - `--re-verify \u003Cid>...` = re-run sec-review-team on the specified finding IDs and report status (skip Steps 2–5)\n- **PR granularity:** `--one-pr` (all fixes in one PR) or `--pr-per-finding` (default for ≤ 3 fixes; for ≥ 4, default switches to one-PR to avoid PR storm).\n\nDo **not** operate on the source target repo yet. Just read metadata.\n\n## Step 1: Filter candidate findings\n\nApply default filter:\n- `severity IN (critical, high)` — medium\u002Flow need manual review first, they are not eligible for auto-fix.\n- `confidence IN (certain, likely)` — `possible`\u002F`unverified` require human triage first; they are not eligible for auto-fix.\n- User may relax the filter explicitly (prompt: \"N findings matched default filter. X additional findings available at lower severity\u002Fconfidence — include them?\").\n\nFor `--re-verify`, skip filtering; use the specified IDs literally.\n\n## Step 2: Safety preflight\n\nBefore touching any file, verify:\n\n1. **Target git state:** Working tree clean (`git status --porcelain` empty). If dirty, abort with explanation. The user must stash\u002Fcommit first.\n2. **Current branch is NOT `main` \u002F `master` \u002F `trunk` \u002F default-branch.** If it is, offer to create `sec-review-fix\u002F\u003Ctimestamp>` and switch. Never operate directly on default.\n3. **No in-progress rebase \u002F merge \u002F cherry-pick** (`git status` shows no in-progress operation).\n4. **Remote reachable** (if PR mode, not dry-run): `git ls-remote --exit-code origin` succeeds.\n5. **`gh` CLI available and authenticated** (if PR mode).\n\nIf any check fails, abort with a specific message. Never proceed past a failed safety check.\n\n## Step 3: Per-finding fix authoring (spawn subagents in parallel)\n\nFor each candidate finding, spawn a `fix-author` `Agent` with:\n\n- **Subagent type:** `general-purpose` (or a typed `code-writer` if available).\n- **Brief:** \"Here is one security finding from sec-review-team: `\u003Cfinding>`. The current state of the code at `\u003Cfile>:\u003Cline_range>` is `\u003Csnippet>`. Produce (1) a diff that implements the `fix` field, (2) a regression test that would fail before the fix and pass after. Write to `\u003CTARGET>\u002F.planning\u002Fsec-review-fixes\u002F\u003Cid>.diff` and `\u003Cid>.test.\u003Cext>` respectively. Also write a one-paragraph commit message at `\u003Cid>.commit-msg.txt`.\"\n- **Allowed tools:** `Read`, `Grep`, `Glob`, read-only `Bash` allowlist. `Write` scoped to the three output paths only. **No `Edit` on target files** — the orchestrator applies diffs later, not the subagent.\n\nSubagents don't mutate target code. They produce candidate artifacts.\n\n## Step 4: Interactive approval (one finding at a time)\n\nFor each candidate:\n\n```\n━━ Finding \u003Cid>: \u003Ctitle> ━━\n  Severity:    \u003Csev>\n  Confidence:  \u003Cconf>\n  File:        \u003Cfile>:\u003Cline_range>\n  Root issue:  \u003Croot_issue>\n\nExploit:\n  \u003Cexploit>\n\nProposed fix:\n  \u003Cfix>\n\nProposed diff:\n  \u003Cdiff contents>\n\nProposed regression test:\n  \u003Ctest contents>\n\nApprove \u002F edit-fix \u002F skip \u002F abort? [a\u002Fe\u002Fs\u002Fx]\n```\n\n- **a** (approve) — move to Step 5 for this finding.\n- **e** (edit-fix) — let the user type revised instructions; respawn the fix-author with the revised brief.\n- **s** (skip) — finding stays un-fixed; continue to next.\n- **x** (abort) — stop all further processing; do not apply any pending approved fixes that haven't been committed yet.\n\nDefault if no response: treat as skip (never auto-approve).\n\nException: `--dry-run` skips this step entirely. The fix-plan is just the collected proposals.\n\n## Step 5: Apply + test + commit + push + PR (per approved finding)\n\n**Still safeguarded.** Even after approval:\n\n1. **Create or checkout the fix branch:** `sec-review-fix\u002F\u003Cfinding-id>` (for per-PR mode) or `sec-review-fix\u002F\u003Ctimestamp>` (for one-PR mode). Never operate on main.\n2. **Apply the diff** via `git apply \u003Cid>.diff`. On failure: mark finding as `apply-failed`, do not commit, continue to next.\n3. **Run the regression test.** How: detect target's test runner (`package.json scripts.test`, `cargo test`, `pytest`, `go test`, etc.) and invoke. The test must pass before proceeding. If it fails, revert (`git checkout -- \u003Caffected>`), mark as `regression-test-failed`, continue to next.\n4. **Commit with message:** the contents of `\u003Cid>.commit-msg.txt`, plus a trailer `Fixes-finding: \u003Cid>` + `Ref: \u003Csource path of findings>`. Default commit message ends with `Co-Authored-By: Claude (sec-review-fixes) \u003Cnoreply@anthropic.com>`.\n5. **Push to origin** (for PR mode only). `git push -u origin \u003Cbranch>`.\n6. **Open PR** via `gh pr create`:\n   - Title: `fix(security): \u003Cfinding title>`\n   - Body: full finding (exploit + fix + evidence), the regression test description, a checklist for the reviewer (manual verification + security implications + adjacent review).\n   - Label: `security`, `sec-review-team`.\n\nSafeguards that stay on throughout:\n- **Never force-push.**\n- **Never push to main.**\n- **Never amend an existing commit.**\n- **Never modify `.git\u002F` directly.**\n- If any safeguard tripping is requested, abort and surface it to the user.\n\n## Step 6: Report\n\nEmit a summary table:\n\n| Finding | Status | PR | Branch |\n|---|---|---|---|\n| auth-001 | fixed + PR opened | #1234 | sec-review-fix\u002Fauth-001 |\n| iv-003 | skipped | — | — |\n| sc-001 | regression-test-failed | — | — |\n| de-002 | apply-failed | — | — |\n\nPrint absolute paths to `.planning\u002Fsec-review-fixes\u002F` artifacts for every candidate (even skipped ones, so the user can come back later).\n\n## `--re-verify` mode\n\nAlternate flow triggered by `--re-verify \u003Cid>...`:\n\n1. Parse the finding IDs from args.\n2. For each ID, look up the original finding metadata (severity, file, root_issue, evidence) from the source `findings.jsonl`.\n3. Invoke `sec-review-team` against the same target and same scope. Wait for new `findings.jsonl`.\n4. For each requested ID:\n   - If no finding with the same `root_issue` + `file` appears in the new run → **fixed**.\n   - If a finding with the same `root_issue` appears → **still-present**. Show the diff between old and new evidence.\n   - If the specialist that would cover this category is not in the new roster (stack changed), or the category was `not-checked` → **inconclusive** (explain why).\n5. Emit a re-verify report at `.planning\u002Fsec-review-fixes\u002Fre-verify-\u003Ctimestamp>.md`.\n\nNever apply fixes in re-verify mode. Pure audit.\n\n## `--dry-run` mode\n\nTriggered by `--dry-run`. Steps 2, 4 (modified), 5 are skipped:\n\n- Step 2 safety preflight still runs (we still inspect repo state) but doesn't require branch-switching.\n- Step 3 still spawns fix-authors (artifact-only).\n- Step 4 shows proposals but doesn't prompt for apply — just collects them.\n- Step 5 is skipped entirely.\n- Instead: write `.planning\u002Fsec-review-fixes\u002Ffix-plan.md` — a human-readable document with every proposed fix + test + commit message, organized by severity. User can hand off to a team for manual implementation.\n\n## Related\n\n- **Companion skill:** [`sec-review-team`](..\u002Fsec-review-team\u002FSKILL.md) produces the input to this skill.\n- **Schema:** [`sec-review-team\u002Fschema\u002Ffinding.schema.json`](..\u002Fsec-review-team\u002Fschema\u002Ffinding.schema.json) — what `findings.jsonl` lines conform to.\n- **Safeguard details:** [`docs\u002Fsafeguards.md`](docs\u002Fsafeguards.md)\n- **Design tradeoffs:** [`sec-review-team\u002Fdocs\u002Ftradeoffs.md`](..\u002Fsec-review-team\u002Fdocs\u002Ftradeoffs.md) — item #5 (no-auto-fix) explains why this skill exists separately.\n",{"name":5,"description":7,"argument-hint":50},"`[path to REPORT.md or findings.jsonl] [--dry-run | --re-verify \u003Cid>...] [--one-pr | --pr-per-finding]`","bf3a412c985273327682c956ca35341c64ce9f8c","skills\u002Fsec-review-fixes",4,"https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_playbook","https:\u002F\u002Ffsad-playbook.vercel.app","https:\u002F\u002Fgithub.com\u002Ftbeack","2026-11-14 21:03:06",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add tbeack\u002Ffsad_playbook --skill sec-review-fixes",{"tool":64,"command":65},"bunx","bunx skills add tbeack\u002Ffsad_playbook --skill sec-review-fixes",{"tool":67,"command":68},"pnpm","pnpm dlx skills add tbeack\u002Ffsad_playbook --skill sec-review-fixes","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_playbook\u002Fblob\u002Fmain\u002Fskills\u002Fsec-review-fixes\u002FSKILL.md",true,[],[73,95,122,140,160,188],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":45},"01M6K7W5RTRMRQMWAGXNSX8DM6","sync","Pre-flight sync check for registered projects. Fetches from remote, reports uncommitted changes, and handles four states — up-to-date, ahead, behind (warns + pulls), or diverged (warns, no pull). Supports single-project (cwd detection), named-project (fsad-harness:sync key1 key2), and full-sync (fsad-harness:sync ALL) modes.","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_playbook\u002Fblob\u002Fmain\u002Fskills\u002Fsync\u002FSKILL.md",[],[75,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94],"pull","harness","detection","projects","check","up","reports","project","full","remote","states","for","changes","modes","single",{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":106,"publishedAt":45},"01M6K7VY55SWBDD379T9JZVF16","spec-review","Run a detailed, adversarial multi-agent review of a written proposal or specification (spec.md, PRD, RFC, design doc, architecture proposal, business case) — reviews the document, not code. Runs a steelman\u002Finventory pass, then up to 10 specialist lenses (logic, assumptions, evidence, completeness, feasibility, alternatives, consistency, stakeholders, testability, risk), then adversarial validation that defaults to refuting each finding unless it survives, then a loop-until-dry completeness pass. Writes a single severity-ranked SPEC-REVIEW.md next to the document. Use when the user says \"review this spec\", \"adversarial review\", \"poke holes in this proposal\", \"red team this PRD\", \"critique this design doc\", \"what's wrong with this RFC\", \"stress test this plan\", or similar. Review-only — never edits the document.","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_playbook\u002Fblob\u002Fmain\u002Fskills\u002Fspec-review\u002FSKILL.md",[101],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[27,107,108,109,110,44,111,112,113,37,36,85,114,115,116,117,118,119,120,121,29],"spec","spec review","design","architecture","inventory","team","loop","specification","poke","deep","dry","proposal","lens","quick","reviews",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":45},"01M6K7VVD3B0SM3VKJ5W26QPPV","ship","Short alias for \u002Ffsad-harness:ship-it. Wrap up finished work, cut a version, commit, push, and open a PR.","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_playbook\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002FSKILL.md",[],[124,129,130,81,131,41,132,133,134,135,85,136,137,138,139,91],"commit","pr","push","wrap up","work","short","version","wrap","alias","cut","it",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":45},"01M6K7VP2QDRNX57KP2RH10FAW","ship-it","Wrap up a finished round of work — verify README and CHANGELOG are current, cut a version if warranted, move completed task files into the completed\u002F folder, then create a feature branch if needed, commit, push, and open a PR. Run after `\u002Ffsad-harness:do-task` has marked one or more tasks done. Takes no arguments.","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_playbook\u002Fblob\u002Fmain\u002Fskills\u002Fship-it\u002FSKILL.md",[],[124,147,139,129,148,149,41,150,151,133,39,152,85,153,154,155,156,157,89,158,159],"ship it","tasks","create","Bash","gh pr","fetch","log","files","done","checkout","move","ls","parse",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":45},"01M6K7VEK1C0MK5BNDHV8S6HCA","set-context","Gather codebase and initiative context before planning starts — runs a graphify build or query when graphify is available locally, falls back to a manual repo sweep otherwise, then asks targeted questions and writes a single context.md. Invocable standalone or as fsad-harness:plan's mandatory Phase 0. Use when the user says \"set context\", \"gather context\", or as the first step of fsad-harness:plan.","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_playbook\u002Fblob\u002Fmain\u002Fskills\u002Fset-context\u002FSKILL.md",[],[43,167,168,169,81,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,94,186,187,29],"context","set context","planning","first","graphify","plan","sweep","repo","user","use","build","back","query","as","questions","manual","standalone","path","codebase","phase","gather",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":198,"publishedAt":45},"01M6K7V17M3MQ92QZ99G294RYM","sec-review-team","Run a multi-agent security review TEAM over a codebase or recent diff. Picks a specialist roster based on detected stack signals (webapp \u002F desktop \u002F iac \u002F llm-agent \u002F container \u002F backend \u002F mobile \u002F etc.) from a library of 13 specialists. Each specialist writes structured JSONL + prose findings in parallel; input-validation-auditor and auth-authz-auditor run a loop-until-dry consensus fan-out (2-8 passes); every deduped finding is adversarially verified by a dedicated validator agent before it can appear in the report. Orchestrator consolidates into a single severity-ranked REPORT.md with deduped root issues, archived per-run under a known-findings.jsonl ledger that drives auto re-review. Distinct from the built-in `\u002Fsecurity-review` (which is a single-pass branch review). Use when the user says \"multi-agent security review\", \"security review team\", \"sec-review team\", \"audit this branch with a team\", \"pre-release hardening team pass\", or similar. Review-only — no fixes.","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_playbook\u002Fblob\u002Fmain\u002Fskills\u002Fsec-review-team\u002FSKILL.md",[194,197],{"categoryNo":195,"categoryName":196,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[27,112,199,200,201,202,203,204,205,113,206,39,207,208,209,117,210,30,211,212,213],"sec review team","review team","agent security","security review","run","release","security-review","stack","consensus","auto","mobile","input","jsonl","which","verified"]