cliff-security

Drive Cliff from inside Claude Code. Trigger when the user asks to (a) install Cliff, (b) onboard credentials (GitHub PAT or an AI provider key), (c) secure a repo end-to-end (scan → plan → approve → PR → merge → close), or (d) troubleshoot a broken install. The skill is action-dispatched: this file routes to one of four versioned playbooks under `knowledge/`. Uses the `cliffsec` CLI (bundled with the Cliff installer) and `gh` for PR review/merge and issue-filing. Hard rule: never auto-approve plans, auto-merge PRs, auto-submit issues, or run any write action without explicit user approval — those are user gates.