Evidence-backed, deterministic breaking-change review of a git branch's changes in whatever repository the skill is invoked from. Whether a change "breaks callers" is a judgement; this skill makes the EVIDENCE deterministic: a bundled Rust tool (ctk), built on tree-sitter, extracts the public contract surface (every public function, method, type, field, variant, constant, and alias, with normalized, formatter-proof signatures and visibility) across Rust, TypeScript/JavaScript, Python, and Go at the base and at the branch head, diffs them, and emits reason-coded candidates — REMOVED, REMOVED_DEPRECATED, SIGNATURE_CHANGED, VISIBILITY_REDUCED, ADDED — each with a semver impact and the before/after signature as proof, plus an optional CI gate. Every finding cites a signature change at file:line. No measurement, no finding. Use whenever the user asks whether a branch/PR breaks the public API or ABI, is backward-compatible, needs a major/minor semver bump, changed an exported contract, removed or renamed public fun
Evidence-backed, deterministic code-quality review of a git branch's changes in whatever repository the skill is invoked from — language and framework agnostic. Quality judgement is subjective, so this skill makes the EVIDENCE deterministic: a bundled Rust tool (cqt) measures per-function complexity deltas (cognitive/cyclomatic), repo-relative percentiles, churn-x-complexity hotspots, branch-introduced duplication, and missing co-change coupling, and joins them with `cqt assess` into ranked, reason-coded candidate findings. Every finding must cite a measurement at file:line. No measurement, no finding. Use whenever the user asks to review code quality, maintainability, complexity, or duplication of a branch/PR/diff, asks "did this branch make the code worse", "what got more complex", "where's the risky code", or wants a reproducible, metric-grounded quality assessment rather than vibes. Produces a ranked, measurement-cited findings report with remediation pointers — it assesses, it does not fix.
Offensive adversarial security assessment of a git branch's changes in whatever repository the skill is invoked from — language, framework, and domain agnostic. You are the attacker. Assume the diff is hostile, assume breach, and try to own it: model the attacker's view first (black box), confirm exploitability against the source (white box), chain findings into a kill chain to the crown jewels, then prove the worst against a local instance you control (dynamic). Use whenever the user asks to red-team, attack, pen-test, threat-model, exploit, or do a security/adversarial review of a branch, PR, or set of changes, or asks "is this branch secure", "find the security holes", "what could an attacker do with this". Produces a severity-ranked, exploit-first findings report with kill chains, recommendations, and education — not code fixes.