ai-transformation-delivery-systems

Classify each failing CI test into one of four verdicts — APPLICATION_BUG, TEST_BUG, FLAKY_FAILURE, or ENVIRONMENT_ISSUE — so teams never auto-generate no-op tests for genuinely broken code, never "fix" the application when the test itself is stale, and never burn a code/test patch on an intermittent or infrastructure failure. Built on Joe's framing (is the test wrong or the code wrong?) and aligned to the industry-standard four-way failure taxonomy used by tools like ContextQA and FixSense. For each failing test the skill emits a verdict plus a short rationale and a failure category (visual drift, behavioral drift, E2E form-flow drift). Produces a human-readable terminal report and a machine-readable JSON block that the dispatcher uses to post a single PR comment requesting a mandatory 👍/👎 reaction. Use this skill whenever a CI test run fails and you want to know whether the test, the code, the test's stability, or the environment is at fault.

Perform a comprehensive pre-commit security review on uncommitted changes. Covers all areas of the built-in /security-review, OWASP Top 10 (where applicable), and mandatorily detects secrets, PII, and PHI in staged changes. Use whenever a security review is requested, when running as a pre-commit hook, or any time uncommitted code changes need security validation before they enter the repository. Only report findings of low severity or above. Critical, high, and medium findings block the commit; low findings warn without blocking.

Perform a comprehensive pre-commit IaC compliance review on uncommitted infrastructure-as-code changes (Terraform, CloudFormation, Bicep, Pulumi, Ansible, Kubernetes manifests, Helm charts, CDK, and similar). Checks staged changes against CMS ARS 5.1 and NIST SP 800-53 Rev 5 controls that are directly enforceable through IaC. Blocks on critical, high, and medium findings; warns on low. Use whenever an IaC compliance review is requested, when running as a pre-commit hook, or any time uncommitted infrastructure changes need compliance validation before they enter the repository. Only report findings of low severity or above.

Perform a comprehensive security and IaC-compliance audit of an entire existing codebase, directory-by-directory. Unlike the pre-commit and PR review skills which review diffs, this skill reviews the full content of files at rest. Designed for one-time baseline audits, periodic full reviews (e.g., quarterly), audits before a compliance assessment, and audits of repositories being onboarded into a regulated environment. Produces one markdown report per directory batch in audit-reports/, optionally with SARIF output for ingestion into security dashboards. Supports min-severity filtering and resume mode for long-running audits.

Independent second-opinion adjudication of an automated first-pass security or compliance review. Given a first-pass findings report, re-inspect the cited code with fresh eyes and classify each finding as confirmed, false positive, or overstated (downgraded), with a one-line rationale each. Removes false positives before they reach the developer or report, without any manual suppression list. Invoked automatically by the dispatcher when a first pass reports findings; the gate is then decided by the adjudicated result.