enchanter-ai

Seeds per-session canary tokens into WebFetch advisories and scans every subsequent tool input/output for the canary's appearance. Use when the developer wants prompt-injection detection telemetry, or asks "is my session compromised?". Auto-fires on PreToolUse(WebFetch) and PostToolUse(*). Do not use for in-prompt sanitization (see deep-research's <untrusted_source> wrapping).

Detects subagent capability escapes by comparing the tool being invoked against the skill's declared allowed-tools list. Use when the developer asks about subagent escape, sees a tool fired from an unexpected skill, or audits delegation.md compliance. Auto-fires on PreToolUse. Best-effort observability only — does not block.

OPT-IN BLOCKING capability allowlist. Pairs with hydra-capability-fence (advisory). When state/capability-policy.json sets enabled:true, this shield blocks any tool call whose name is not in the active SKILL.md frontmatter allowed-tools list. Use when the developer asks why a tool call was blocked, wants to enable or tune the capability allowlist, or reviews a stderr "capability-shield (BLOCKED)" message. Default disabled — out of the box this shield does nothing. Do not use for observability without enforcement (see capability-fence).

Logs every WebFetch / WebSearch / Bash-network destination to an append-only NDJSON and surfaces first-seen domains as advisory warnings. Use when the developer asks "what did this session reach out to?" or "show me egress", wants a per-session list of contacted hosts, asks about an egress-monitor advisory, or wants to inspect state/log.ndjson. Auto-fires on PostToolUse for network tools. Do not use for in-process state inspection (see audit-trail).

OPT-IN BLOCKING egress allowlist. Pairs with hydra-egress-monitor (advisory). When state/egress-policy.json sets enabled:true, this shield blocks any WebFetch / WebSearch / Bash-network call whose destination host is not in the operator-curated allowlist. Use when the developer asks why a network call was blocked, wants to inspect or edit the egress allowlist, or asks about audit.ndjson policy_blocked events. Default disabled — out of the box this shield does nothing. Do not use for observability without enforcement (see egress-monitor).

Scans the project's dep tree for license compatibility against an allow/deny policy. Use when the developer asks "what licenses are in here?" or before a release. Reports denied (GPL/AGPL/SSPL), warned (MPL/EPL/CDDL), and allowed (MIT/Apache/BSD/ISC) classifications. Do not use for license-text generation (see SBOM).

Helps the developer interpret package-gate advisory findings and decide whether to proceed with a package install. Use when the developer asks about a package-gate warning, supply-chain risk on a specific package, slopsquat / typosquat / maintainer-churn / download-cliff signals, or whether an `npm install` / `pip install` / `pnpm add` / `yarn add` / `uv add` target is safe. Auto-triggers on: "is X safe to install", "package-gate flagged", "typosquat", "slopsquat", "supply-chain risk", "should I install", "this package looks suspicious". Do not use for: post-install vulnerability scans (see vuln-detector), secrets in installed code (see secret-scanner), or actually blocking installs — package-gate is advisory only and the install was not blocked.

Use when the developer asks about defense-state integrity, signed state files, meta-canary scans, integrity-events.ndjson, HMAC drift, "did anyone tamper with my canaries / egress policy / capability policy / audit log", or pentest finding R-020 / F-PT-11/12/13/17. Auto-triggers on: "state integrity", "signed state", "meta canary", "integrity drift", "verify state", "tampered policy", "defense of defense".

Deep research engine (E0) that produces a verified, cited claims artifact before prompts are engineered. Decomposes the query, fans out parallel Haiku fetchers, triangulates claims across independent sources, synthesizes, and verifies every claim traces to a fetched quote. Auto-fires inside /create when the topic depends on external or time-sensitive facts. Also callable standalone. Auto-triggers on: "/deep-research", "/research", "research this topic", "look up the current state of", "what's the latest on", "fact-check this", "find sources on", "before we craft the prompt, research". Do not use for static topics (pure logic, timeless writing tasks) or when a fresh brief already exists (freshness < 30 days) — reuse it. Do not use to render an existing brief — use /research-render for that.

Runs the Wixie model-freshness aggregator over state/model-usage.ndjson and flags any models-registry.json entry whose sunset_date has elapsed. Use when the developer asks about model deprecation, registry staleness, retired models, sunset dates, F-006 closure, or wants a current freshness summary. Auto-triggers on: "model freshness", "registry stale", "deprecated models", "sunset", "F-006", "freshness report", "model usage telemetry". Do not use for emitting telemetry events (the SessionStart hook does that automatically) or for editing the registry itself (developer edits the JSON directly).

Run the Convergence Engine on any prompt file. Iterates up to 100 times, automatically fixing clarity, completeness, efficiency, model fit, and failure resilience until the prompt reaches DEPLOY quality. Auto-triggers on: "/converge", "converge this prompt", "optimize until perfect", "iterate until deploy", "run convergence".

Creates optimized, model-fitted prompts from raw task descriptions with technique selection and explained reasoning. Auto-triggers on: "I need a prompt for", "build me a prompt", "make this prompt better", "optimize this prompt", "help me prompt", "write a system prompt", "what prompting technique should I use", "how should I structure this prompt", "/create".

Tests a prompt for security vulnerabilities — injection attacks, jailbreak patterns, data leakage risks. Reports exploits found and suggests specific defenses. Use on any user-facing or API-deployed prompt. Auto-triggers on: "/harden", "harden this prompt", "test for injection", "is this prompt safe", "security check prompt", "red team this prompt".

Improves existing prompts by re-selecting techniques, adapting format to the target model, and fixing weaknesses while preserving the user's intent and domain knowledge. Auto-triggers on: "make this prompt better", "improve this prompt", "refine this prompt", "fix this prompt", "optimize this prompt", "what's wrong with this prompt", "/refine".

Runs a prompt's test suite (tests.json) by executing each test case, checking output against expected_contains assertions, and reporting pass/fail results. Use for regression testing after refinements. Auto-triggers on: "/test-prompt", "test this prompt", "run prompt tests", "check if the prompt works", "regression test".

Converts a prompt from one model's format to another. Re-selects techniques, adapts structure, preserves intent and domain content. Auto-triggers on: "/translate-prompt", "convert this prompt to GPT", "adapt for Claude", "port this prompt to Gemini", "make this work on o3", "translate prompt".

Runs L2 Budget Boundary Detection after each ledger write: increments per-scope counters, compares against ceilings in state/budgets.json, emits pech.budget.threshold.crossed on first crossing of each threshold within each scope-window. Use when: a PostToolUse hook fires and cost-tracker has already written the ledger row. Do not use for forecasting (see forecast-cost) or anomaly detection (see detect-anomaly).

Writes a single ledger row for the most recent tool-use call: reads the API response's usage field (authoritative), looks up the model rate in shared/rate-card.json, applies prompt-cache modifiers (1.25× write, 0.1× read), computes billed cost, and appends to plugins/cost-tracker/state/ledger-YYYY-MM.jsonl. Use when: a PostToolUse hook fires for any tool and attribution metadata is available via ENCHANTED_ATTRIBUTION env. Do not use for forecasting (see /pech-forecast → forecast-cost) or for anomaly detection (see budget-watcher/detect-anomaly).

Updates shared/rate-card.json with a new per-model rate table. Validates the proposed update against the existing schema, diffs prices against the current card, and produces a commit-ready diff for human review. Use when: CI nightly job detects a pricing change on Anthropic's published rate page, or when the developer runs /refresh-rate-card after verifying a price change. Do not use at runtime during a Claude Code session — this skill runs in CI or at developer invocation, never inside the observation hot path.

Token-bucket advisory rate limiter per skill+session. Surfaces runaway tool-call loops in real time before pech/budget-watcher reports them post-hoc. Auto-fires on PreToolUse. Configurable per-skill limits via state/buckets.json. Do not use for cost reporting (see budget-watcher) or for blocking installs (see package-gate).

OPT-IN BLOCKING token-bucket rate limiter. Pairs with pech-rate-limiter (advisory). When state/rate-policy.json sets enabled:true, this shield blocks (exits 2) any tool call once the active (session, skill) bucket is empty. Reads buckets from rate-limiter's state/buckets.json when present; gracefully degrades when absent. Use when the developer asks why a tool call was rate-blocked, wants to enable or tune the rate policy, or reviews a stderr "rate-shield (BLOCKED)" message. Default disabled. Do not use for advisory-only velocity signals (see rate-limiter) or for cost reporting (see budget-watcher).

Updates per-developer cost-pattern accumulator in state/learnings.json with the current session's observations. Rolls μ and σ per (skill, session_type, model) axis using a slow exponential update (α = 0.05) so one noisy session doesn't skew learned patterns. Exports a cross-plugin-readable snapshot to shared/learnings.json. Use when: PreCompact hook fires (end-of-session or compaction trigger). Do not use during an active session — runtime invocation mid-session would distort the pattern.

Runs L3 Z-Score Cost Anomaly detection against the last 30 ledger rows matching the same attribution tuple (plugin, sub_plugin, skill, agent_tier, model). Fires pech.anomaly.detected when |z| > 3, for both spikes and drops. Use when: a PostToolUse hook fires and the ledger row is in place. Do not use when the attribution tuple has fewer than 30 historical matches — emit insufficient_data instead of false-positive anomaly.

Formats Pech state into human-readable terminal output (or JSON) for /pech-cost and /pech-attribute. Reads ledger + session snapshot + budget-watcher counters; renders grouped tables with percentages; flags orphan attribution prominently. Use when: /pech-cost or /pech-attribute slash command fires. Do not use for forecasting (see forecast-cost) or PDF generation (see generate-report).

Runs M1 Cousot Interval Propagation and M2 Falleri Structural Diff on a code scope, flags runtime-failure candidates (div-zero, null deref, OOB, overflow, resource leak), and hands the flagged sites to lich-sandbox for M5 confirmation. Use when: the user runs /lich-review on a hunk / file / PR, or the PostToolUse hook fires on Write/Edit/MultiEdit. Do not use for: security-taint review (Hydra R3 owns that), change classification (Crow V1/V2 owns that), or rubric-style judgment (lich-rubric skill owns that).

Permanently suppresses a Lich rule for the current developer. Writes to plugins/lich-preference/state/overrides.json with a quarterly re-prompt date — the override auto-expires in 90 days unless the developer renews. Use when: the user runs /lich-disable <rule_id>. Do not use for: ambient preference learning (M6 Bayesian accumulation handles that automatically via accept/reject signals — don't conflate passive priors with explicit disables).

Python language adapter. When the target file is .py, maps the ruff rule catalog (~900 rules) into M-engine outputs and contributes Python-specific idiom checks (pyupgrade, typing, async-await patterns). Use when: lich-core fires on a .py file. Do not use for: non-Python files (lich- typescript covers .ts/.tsx; other languages are Phase 2), or as a replacement for ruff itself — this skill maps ruff outputs into Lich's M-engine vocabulary, it does not re-implement ruff.

Walks through why Lich flagged a specific finding — M1 flag rationale, M5 sandbox witness (if confirmed), M7 rubric scores per axis, Kappa reliability, M6 posterior state. Use when: the user runs /lich-explain <finding_id>, or wants to understand a HOLD/FAIL verdict. Do not use for: general code review (/lich-review handles that), rule disabling (/lich-disable handles that), or modifying rubric axes (rubric-v1.json edits go through a separate migration skill).

Runs M5 Bounded Subprocess Dry-Run. For each M1-flagged runtime-failure candidate, synthesizes a witness input (boundary values: 0, None, "", sys.maxsize, etc.), executes the containing function in a stdlib-only sandbox with resource.setrlimit CPU/AS/NOFILE/FSIZE caps + signal.alarm wall-clock timeout, and records confirmed / timeout / sandbox-error / input-synthesis-failed outcomes. Use when: lich-core emits flags that need confirmation, OR the user runs a skill that explicitly invokes M5. Do not use for: running untrusted code without caps, running on Windows (skip with platform-unsupported), or as a replacement for real test suites.

TypeScript / JavaScript language adapter. When target file is .ts, .tsx, .js, or .jsx, invokes biome (if installed) or tsc --noEmit (substrate fallback), maps findings into M-engine outputs, and contributes TS- specific idiom checks (React hooks deps, JSX a11y, narrow-type-guards). Use when: lich-core fires on a TypeScript/JavaScript file. Do not use for: non-TS/JS files; replacing biome; auto-fix mode (Lich is advisory).

Reconstructs session working state from the last saved checkpoint and remember.md. Use immediately after compaction when context is lost. Auto-triggers when: files being edited are unknown, project instructions are unclear, or user says "what happened" / "what were we doing".

Use when Emu fires a Drift Alert. Explains what drift means and how to break out. Auto-triggers on: "drift alert", "going in circles", "stuck", "keeps reading same file", "test won't pass".

Auto-loads when context usage feels high or compaction is approaching. Teaches token-efficient behavior. Triggers on: "context is low", "running out of space", slow responses, or after 30+ turns in a session.

Reduces output token usage by injecting terse-mode instructions. Removes filler phrases, trailing summaries, and converts prose to bullets. Configurable: off / lite / full / ultra. Auto-triggers at session start or when context is running low.

Reference when user asks why output was truncated or how to bypass compression. Also use before every bash command compression decision.

Surfaces the decision-gate to the user when a destructive git operation is detected, pausing the session for explicit confirmation before the command runs. Invoked by sylph-gate's PreToolUse hook when a Bash call is classified destructive or protected-destructive.

Explains how W2 Jaccard-Cosine Boundary Segmentation works, what events fire it, and how to interpret the cluster state in plugins/boundary-segmenter/state/boundary-clusters.json. Invoked when a developer asks "why did Sylph commit/branch here?" or "what's W2 doing?"

Explains how Sylph composes PR descriptions — the 4-section template, the fallback ladder when Crow V4 continuity or W2 cluster data is missing, and how to override the default template via PULL_REQUEST_TEMPLATE.md.

Explains how W4 Path-History Reviewer Routing ranks candidate reviewers — recency-weighted blame, path-depth specificity, CODEOWNERS boost, and optional Crow reviewer-availability filtering. Helpful when a developer asks "why did Sylph suggest these reviewers?"

Explains the W3 decision tree — how Sylph chooses between GitHub Flow, Trunk-Based, GitFlow, Release Flow, Stacked Diffs, and Unknown. Helpful when a developer asks "why did Sylph pick this branch name?" or wants to override detection via .sylph/workflow-map.yaml.

Cross-repo pattern replication. Reads a source artifact in one repository tree and generates a matched-form artifact in another, resolving paths via the sibling-repo convention (<repo-root>/<sibling>/...). Runs N1+N2+N3+N4 with N5 threshold gating; escalates to naga-orchestrator when source and target domains diverge. Use when the user runs /naga:match-across or asks to propagate a pattern from repo A to repo B. Do not use for same-repo replication (see /naga:match).

Read-only pattern report via N2 Spaerck Jones TF-IDF and N3 Levenshtein naming-convention scan. Returns the top-N stylistic terms and the naming convention distribution; performs no generation and writes no state outside the report. Use when the user runs /naga:fingerprint or asks "what pattern does this file follow?" without intending to replicate it. Do not use for fingerprint persistence (see /naga:observe) or for generation (see /naga:match).

Generates a target artifact whose N4 cosine fidelity to the source fingerprint clears the per-(pattern-class, target-domain) p10 threshold from the N5 posterior. Loop: emit chunk, score, rewrite below threshold (cap 2 attempts), drop on third. Use when the user runs /naga:match or asks to generate a new artifact in the same shape as an existing one. Do not use for fingerprint-only reports (see /naga:fingerprint) or for cross-repo work (see /naga:match-across).

Scores fidelity of a generated artifact against a source pattern via N1 Zhang-Shasha tree-edit + N4 Salton-Wong-Yang cosine. Returns (score, ci_low, ci_high, N) per the honest-numbers contract. Use when the user runs /naga:validate or asks "how close is this to the source pattern?". Do not use for fingerprinting (see /naga:observe) or for generation (see /naga:match).

Extracts the pattern fingerprint from a source artifact via N1 Zhang-Shasha AST tree-edit signature and N2 Spaerck Jones TF-IDF over identifier, comment, and structure tokens. Persists the fingerprint to plugins/naga-observe/state/ patterns/<hash>.json. Use when the user runs /naga:observe or asks to capture the structural and stylistic shape of an existing file. Do not use for generation (see /naga:match) or for cross-domain replication (see /naga:match-across).

Returns per-function McCabe cyclomatic complexity (G2) and per-module Halstead volume (G4). Lists top complexity offenders with absolute scores and percentile rank in the repo distribution. Use when the user runs /gorgon:complexity, asks "what are the most complex functions", or asks about per-function risk. Do not use for cross-file structural ranking (see /gorgon:hotspots).

Returns the 1-hop and 2-hop dependency neighbourhood of a given file in both directions (imports it depends on, importers that depend on it). Reads plugins/gorgon-gaze/state/snapshot.json. Use when the user runs /gorgon:deps <file>, asks "what depends on X", or asks "what does X import". Do not use for cross-file complexity (see /gorgon:complexity).

Returns the top-N hotspot ranking with bootstrap 95% CI per file. Reads the current snapshot at plugins/gorgon-gaze/state/snapshot.json. Use when the user runs /gorgon:hotspots, asks "which files matter most", or asks "where is the structural risk in this codebase". Do not use for per-function complexity (see /gorgon:complexity) or for dependency neighbourhoods (see /gorgon:deps).

Manual re-pin of the session intent anchor. Use when the developer explicitly runs /reorient, says the original goal no longer applies, or pivots the session to a fundamentally different task. Do not use for constraint refinements (the intent-anchor UserPromptSubmit hook handles those automatically) or for per-turn alignment (that is drift-aligner).

Ranks session utterances by their demonstrated influence on the final output via D4 PageRank over the utterance-to-artifact DAG. Use when the developer runs /rank, asks which turns actually mattered, or wants to audit a long session for filler. Do not use for per-turn drift detection (that is drift-aligner) or for re-pinning intent (that is /reorient in intent-reorient).