القائمة
Use when the user runs "/cap" or asks to "commit and push", "cap it", "ship it", "save progress". Scans for secrets, generates a commit message, stages appropriate files, commits, and pushes.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when the user runs "/insights-audit", asks to "validate the insights report", "audit the report against my projects", "check what the report got wrong", or wants to cross-check an /insights-generated HTML report against actual GitHub repos and local project directories.
This skill should be used when the user asks to "end session", "capture state", "session summary", "what changed this session", "summarize repos", "write session notes", or wants to capture multi-repo state at the end of a work session.
Fill in the Patterns & Surprises section of the latest session reflect file and write the completed review to .ctx/logs/self-review/. Use when the user runs "/self-review", asks to "fill in the reflect", "write the session review", or "what patterns did we hit".
Use when working on the rslm project — Recursive Language Model inference engine in Rust. Triggers on "rslm", "RLM", "recursive language model", "rhai built-ins", "ctx_grep", "ctx_slice", "rlm_call", "rslm-core", "rslm-providers", "rslm-store", or any question about running queries, ingesting documents, or writing Rhai scripts for the RLM loop.
This skill should be used when the user asks to "review this diff", "ai review", "security review my changes", "review before push", "check my code for issues", or wants an LLM-based security and correctness review of uncommitted or unpushed changes.
This skill should be used when the user asks to "generate commit message", "write a commit msg", "ai commit", "generate a conventional commit", "write my commit", or wants an LLM to draft a commit message from the staged diff.
| name | cap |
| description | Use when the user runs "/cap" or asks to "commit and push", "cap it", "ship it", "save progress". Scans for secrets, generates a commit message, stages appropriate files, commits, and pushes. |
| argument-hint | [optional commit message hint] |
| allowed-tools | Read, Write, Edit, Bash, Glob, Grep |
Fast commit workflow: devsec scan → message generation → selective staging → commit → push.
git status --short
git diff --stat HEAD
Identify: new files, modified files, deleted files, untracked files.
Run gitleaks on staged + unstaged changes:
gitleaks detect --source . --no-git 2>/dev/null \
|| gitleaks detect --source . 2>/dev/null \
|| echo "gitleaks not found — skipping"
If gitleaks is unavailable, fall back to a quick pattern grep on changed files:
git diff HEAD -- . | grep -iE \
'(api[_-]?key|secret|password|token|bearer|private[_-]?key)\s*[:=]\s*["\x27]?[A-Za-z0-9+/]{16,}'
If any real secrets are found: STOP. Report findings. Do not commit.
False positives (test fixtures, variable names, localhost IPs) — note them and continue.
Stage:
Do NOT stage:
.env, .env.*, *.key, *.pem, *.p12, *.pfx*secret*, *credential*, *token* (unless clearly non-sensitive, e.g. a test fixture file)target/, dist/, *.wasm) unless explicitly requested.ctx/HANDOFF.*.state.yamlStage appropriate files:
git add <files> # specific files only — never `git add -A` blindly
Read the diff and produce a conventional commit message:
<type>(<scope>): <what changed and why>
Types: feat, fix, docs, chore, refactor, test, style, ci
Rules:
git commit -m "<message>"
Never use --no-verify. Let hooks run. If a hook fails, report it — do not retry blindly.
git push
If the branch has no upstream, set it:
git push -u origin $(git branch --show-current)
One-line summary:
capped: <N> files | <commit hash> | <branch> -> origin
If anything was skipped (secrets found, files excluded), note it on the next line.