patronum-suggest

name	patronum-suggest
description	Suggest protection patterns based on project context. Invoke automatically when user mentions a new tech stack, cloud provider, or sensitive tooling. Also invoke when user asks what to protect.
allowed-tools	Bash(bash "${CLAUDE_PLUGIN_ROOT}/scripts/patronum-list.sh"), Bash(bash "${CLAUDE_PLUGIN_ROOT}/scripts/patronum-add.sh" *), Glob, Read, AskUserQuestion, WebSearch

Skill: patronum-suggest

Analyze the current project and suggest relevant protection patterns.

Steps

1. Detect tech stack

Check what tools and cloud services are in use. Look at:

• package.json, go.mod, requirements.txt, Gemfile, Cargo.toml
• .tf files (Terraform), docker-compose.yml, Dockerfile
• .gcloud/, .azure/, cloud config directories
• CI/CD files (.github/workflows/, .gitlab-ci.yml)

2. Research sensitive files

Use WebSearch to find known sensitive files, credential paths, and secret locations for the detected technologies. Search for patterns like:

• "[technology] sensitive files credentials path"
• "[cloud provider] local config files secrets"

This ensures suggestions cover technology-specific risks beyond the hardcoded list.

3. Check current protections

Run: bash "${CLAUDE_PLUGIN_ROOT}/scripts/patronum-list.sh" to see what is already protected.

4. Build suggestions

Based on detected stack and web research, suggest patterns that are NOT yet protected. Common suggestions include:

• Terraform: **/*.tfvars, **/*.tfstate, **/.terraform/environment
• GCP: ~/.config/gcloud/credentials.db, **/service-account*.json
• Azure: ~/.azure/accessTokens.json, ~/.azure/msal_token_cache.json
• Ruby: ~/.gem/credentials
• Gradle/Maven: ~/.gradle/gradle.properties, ~/.m2/settings.xml
• Kubernetes: **/kubeconfig, **/*.kubeconfig
• Vault: ~/.vault-token
• GPG: ~/.gnupg/*

Also suggest command patterns where the stack warrants it, using the Bash(<command>) prefix-match format (see docs/rules/bash-commands.md), e.g. Bash(aws sts), Bash(gcloud auth print-access-token), Bash(printenv).

This catalogue can go stale — verify each path against the web research from Step 2 before suggesting it (e.g. Azure's accessTokens.json only exists on older CLI versions; modern ones use the MSAL token cache).

Include any additional patterns discovered via web search.

5. Confirm with user

Use AskUserQuestion to present the suggestions as a formatted list with reasons. Let the user select which patterns to add.

6. Add confirmed patterns

For each confirmed pattern, run:

bash "${CLAUDE_PLUGIN_ROOT}/scripts/patronum-add.sh" "<pattern>" --reason "<reason>"

Present the final updated protection list as a markdown table.