cosmian/kms

kms-sync-rules

Auto-detect changed files via git diff and emit only the applicable AGENTS.md synchronization sub-rules as a checklist. Use after every code change.

ci-efficiency

Audit GitHub Actions workflows for efficiency and recommend fixes to reduce CI minutes and costs. Use when asked to improve CI performance.

ckms-subcommand-test

Generate and run integration tests for a new or modified ckms subcommand: test file, helpers, happy-path + error-case + CO-gating coverage, module registration, cargo test -p ckms. Use after adding a ckms subcommand or flag, or when CI/review flags missing…

code-quality

Scoped code-quality audit orchestrator: runs 8 phases per .github/skills/shared/orchestrator-contract.md (KMS Caveman first, then MISE, Clippy, error-prop, refactor + simplify, patterns, async, CI efficiency). Each phase is a sub-agent (contract §6). One…

cryptography-review

Comprehensive cryptographic audit: FIPS 140-3, BSI TR-02102, ANSSI, NIST SP 800-series compliance, algorithm allow-list, key sizes, feature-flag gating, OpenSSL provider init, key lifecycle, multi-standard matrix, and academic cryptanalysis cross-check. Use…

issue-workflow

Deterministic end-to-end procedure for resolving a GitHub issue: scope, reproduce (bugs), plan, branch (stacked when required), test-first implementation, variant/backend/UI testing, documentation, the mandatory AGENTS.md §5 execution workflow (including…

kms-adversarial-test

Acts as the final quality gate for Eviden KMS PRs. Assumes all automated tests pass upstream. Builds an ACC risk map from git diff, runs adversarial tours against a live KMS instance, and produces a finding report. Use when reviewing a PR, testing a new…

kms-pr-review

Two-pass PR/diff review per .github/skills/shared/orchestrator-contract.md: structural scan (with conditional domain-skill escalation for crypto, security, KMIP), then semantic verification that disposes of every structural finding. Self-review mode (local…

meta-security

Full security-audit orchestrator running /security-review, /cryptography-review, /threat-model, and /standards-review in canonical order per .github/skills/shared/orchestrator-contract.md. Each phase is a sub-agent (contract §6). Use before release or major…

pkcs11-check

Run the external PKCS#11 battle-test suite (mise run test:pkcs11:tool) and interpret its report. Use when changing crate/clients/pkcs11/ (loader, module, provider), PKCS#11 MISE scripts, or provider configuration.

pre-release

Release readiness orchestrator: 9-phase gate per .github/skills/shared/orchestrator-contract.md. Each phase is a sub-agent (contract §6). Runs security, crypto, KMIP, threat-model, sync rules, changelog, release notes audits. Use before triggering release.yml.

rust-review-all

Hardcore Rust code review gate per .github/skills/shared/orchestrator-contract.md: runs 10 review phases as sub-agents (contract §6). Each phase writes to ./review/. Use before significant Rust PRs or large code generation.

simplify-code

Simplify recently changed code for clarity, reuse, quality, and efficiency while preserving behavior. Use for tidy/refactor passes; not for bug fixing.

ci-dedupe

Audit GitHub Actions workflows for duplicated step sequences across jobs/files and recommend extracting local composite actions under .github/actions/ to simplify and factorize the YAML. Use when workflows grow repetitive, before adding a new job that copies…

rust-clone-audit

Detect and eliminate abusive cloning in Rust: treat every `.clone()`, `.to_owned()`, `.to_vec()`, `Cow::into_owned()`, and equivalent owned-duplication call as a potential ownership-design defect, not a free fix for a borrow-checker error. Use when writing,…

rust-signature-design

Classify Rust function parameters and the structs behind them to catch omitted, swapped, or drifting arguments while designing a signature. Use when defining a new function signature, adding or removing a parameter, a parameter list grows past ~4 entries,…

adr

Create an Architectural Decision Record (ADR) under documentation/adr/. Use when making or documenting an architectural decision.

ci-fix

Fix failures from a supplied GitHub run or the current commit, batch repairs, and verify the resulting runs. Use when CI is failing and needs repair.

mise

Create, modify, and refactor MISE task and library Bash scripts. Covers the full MISE conventions: task headers, USAGE framework, library sourcing, aggregator patterns, KMS server lifecycle, naming, and safety rules. Use when working on .mise/tasks/,…

react-ant-patterns

React 19 + Ant Design 5 + Tailwind 4 + Vite 7 patterns for the KMS Web UI: WASM integration, FIPS guards, data-testid placement, Playwright companion. Use as a reference for UI development patterns.

rust-panic-audit

Standalone Rust audit for panic and brutal-exit hazards, including panic macros, production `.unwrap()` / `.expect()`, process exits, overflow, and indexing. Use for a dedicated panic check; `/rust-review-all` uses KMS Caveman and does not invoke this skill…

rust-patterns

KMS-specific Rust design patterns: newtype wrappers, builder config, command pattern for KMIP ops, trait-based HSM/DB abstraction, key lifecycle state machine. Authoritative patterns in `.github/instructions/rust-server.instructions.md` and this reference.

standards-review

Verify code and protocol implementations against the exact text of applicable standards (FIPS, NIST SP, RFC, KMIP, PKCS, BSI, ANSSI, OWASP). Every citation is URL-verified — no hallucinated section numbers. Use when checking standards compliance or before a…

kms-caveman

Performs concise, read-only mechanical Rust triage for panic/exit patterns, new lint suppressions, and structural candidates. Use before deeper Rust audits or for a quick scoped scan; it does not replace semantic, security, crypto, or protocol review.

security-review

AI-powered security scanner — OWASP Top 10, CWE Top 25, KMIP authorization, FIPS gating, memory safety, side-channel, supply chain, and 20 vulnerability families. Use when asked to review code security, audit KMIP access control, or scan for vulnerabilities.

docs-writer

Diátaxis documentation expert for the KMS docs site. Creates tutorials, how-to guides, reference pages, and explanations. Use when writing or updating documentation.

kms-release-notes

Write the next version entry at the top of CHANGELOG.md by summarizing all changes since the last tagged release. Use when preparing release notes.

kms-test-vector

Walk through the full KMS test vector creation workflow: directory, manifest.toml, TTLV steps, vector_runner.rs registration, README count. Use when creating test vectors.

threat-model

STRIDE-A threat model analysis for the Eviden KMS. Two modes: full analysis or incremental update. Use when asked to perform a threat model, generate a DFD, or update threat analysis.

actix-web-middleware-audit

Audit actix-web middleware ordering, LIFO `.wrap()` evaluation, Condition guard correctness, and request-extension injection. Use when adding or reordering middleware in start_kms_server.rs.

rust-async-refactor

Detect sequential .await chains that could be parallelized with tokio::join!/try_join!, unnecessary Arc/Box::pin in async contexts, and blocking calls on async paths. Use when performance-tuning transit/PKI or KMIP operation handlers.

rust-error-propagation

Analyze Result propagation chains: find missed ? opportunities, .map_err(|e| e.to_string()) anti-patterns, lost error context, and suggest KmsError enrichment. Use before PR for error-handling hygiene.

kms-changelog

Create or update the branch CHANGELOG entry. Use when writing a changelog entry for this branch.

rust-simplify

Scan Rust code for simplification opportunities — nested control flow, long functions, dead code, boolean param traps, redundant iterator chains, and Clippy-flagged complexity. Use when asked to simplify code, reduce cognitive complexity, clean up code, or…

kmip-compliance

Validate a KMIP operation against the KMIP 2.1 spec, dispatch table, and type definitions. Use when adding or modifying a KMIP operation.

openapi-endpoint

Implement a new REST endpoint following sync rule 4.2: handler, routes/mod.rs, start_kms_server.rs with LIFO middleware, openapi.yaml, validation tests. Use when adding a new REST endpoint.

playwright-kms

Create Playwright E2E tests for the KMS Web UI following project conventions: data-testid, Ant Design Select helpers, regex assertions, FIPS skips. Use when adding E2E tests.

refactor-plan

Plan a multi-file Rust refactor safely: investigate, plan, confirm, implement. Use before any multi-file refactor.

rust-refactor

Find duplication in Rust code and consolidate it using Traits, Generics, shared functions, and macros. Use when asked to reduce Rust code duplication.