メニュー
Optional host SAST (Semgrep / CodeQL) feed for security review. Fail-open when tools are missing. Agent-internal + review-and-commit / council security flavor. Zero required deps.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Phase-gated bug investigation → root-cause → fix → verify cycle. Enforces root-cause-before-edit, failing-test-first, holistic callsite scan, reopen/redesign gates (SPEC-029), multi-surface done matrix, and self-calibration checklist before any "done" claim. Subcommands: /debug <desc> (full), /debug patch <desc> (fast path), /debug arch <desc> (design-first → /kickoff handoff).
Brutally honest review of staged/modified files — no sugar-coating. Thin wrapper over the council engine with preset `diff-mode`: 5 specialist investigators (logic, security, compliance, quality, simplification) run in parallel, filtered at confidence 80. Blocks commit on critical or compliance findings. Optional path argument saves the review to a file.
Fact-dense rewrite of agent memory prose (tier-0 notes, digests) without losing technical substance. Companion to /memory-distill. Zero external deps.
Adversarial council tribunal engine — reality-checks claims with material evidence. Shared engine for /council and /review-and-commit (diff-mode preset). Blind investigators, evidence-or-silence rule, dual output shapes (verdict[] and finding[]), atomic verdict index at .claude/council/index.json, feedback-memory learning loop. Judge is a dedicated agent with an empty tool allowlist. See specs/core/SPEC-013-adversarial-council-tribunal.md.
Socratic design refinement — structured questioning that forces requirement clarification before any planning or implementation. Use before /kickoff for complex features, or standalone for early-stage ideation. Optional --grill for one-question-at-a-time interviews with recommended answers.
Behavior-preserving polish on recently modified code — clarity only, no logic or API changes. Used by /orchestrate after Tech Lead approve, before QA. Zero external deps (in-plugin; not Anthropic's marketplace plugin).
| name | security-scan |
| description | Optional host SAST (Semgrep / CodeQL) feed for security review. Fail-open when tools are missing. Agent-internal + review-and-commit / council security flavor. Zero required deps. |
Optional static-analysis feed. Does not vendor Semgrep or CodeQL — runs
them only if the host already has them on PATH. Inspired by professional
SAST workflows; methodology rewritten for MIT/dev-team (no third-party skill
text).
| Caller | When |
|---|---|
/review-and-commit | Step 1c before investigators (always attempt; skip if tools missing) |
Council security flavor | Prefer running scan first; cite tool output as evidence |
| Manual | bash skills/security-scan/scan.sh [paths…] |
Never hard-require tools. Never block commit solely because tools are absent.
PDH=$( [ -f skills/plugin-dir.sh ] && pwd || find ~/.claude/plugins/cache -path '*/dev-team/*/skills/plugin-dir.sh' 2>/dev/null | sort -V | tail -1 | xargs -r dirname | xargs -r dirname )
SCAN=$(bash "$PDH/skills/plugin-dir.sh" file skills/security-scan/scan.sh)
bash "$SCAN" # optional path args; default = feature-branch changed files
Exit code is always 0 (fail-open). Stdout ends with a summary; artifacts
under OUT_DIR= (or $SECURITY_SCAN_OUT).
| Tool | Behavior |
|---|---|
semgrep | --config=auto on targets; SARIF when supported |
codeql | Only if CODEQL_DB_PATH or ./codeql-db exists — never creates DBs |
| neither | SECURITY-SCAN: SKIP line |
When scan output exists:
finding[] with tool_use_id from Read/BashWhen scan is SKIP: proceed with LLM-only security review (existing flavor).
| Variable | Effect |
|---|---|
SECURITY_SCAN=0 | Callers skip invoking scan.sh entirely |
SECURITY_SCAN_OUT | Artifact directory |
CODEQL_DB_PATH | Existing CodeQL database directory |