Finalize a batch of completed FSD_Train tasks for the FSAD Training app and commit them to git. Re-bundles `dist/fsad-training.html` if any source files changed, archives shipped task files from `planning/to do/` into `planning/completed/` via `git mv` (and updates the link in `todo.md` while keeping the line), stages the relevant files (training app source, planning artifacts, todo.md), writes a scoped commit message referencing each FSD_Train task, and pushes. Use whenever the user says "/commit-cbp-changes", "commit these changes to git", "ship these FSD_Train changes", "push the training updates", "finalize this batch", or any similar phrasing that follows finishing a task. This is the natural step that runs AFTER `cbp-add-task` tasks have been implemented — so even if the user just says "we're done, commit it", trigger this skill.
Add a new FSD_Train task to the FSAD Training todo list. Creates a new entry in `planning/to do/todo.md` with the next available `FSD_Train-###` number, then prompts for task details (source, summary, plan, acceptance criteria) and generates the corresponding `task-fsd_train-NNN.md` file. Use when the user wants to add a task, track a new TODO, or capture a new idea for the training app.
Companion to `sec-review-team`. Takes the `REPORT.md` or `findings.jsonl` from a security review run and produces fix PRs (one per finding or one consolidated) with interactive approval. Each candidate finding becomes a proposed diff + a regression test that would have caught it + a commit/PR citing the finding ID. Filters by default to `severity IN (critical, high) AND confidence IN (certain, likely)`. Modes: interactive (default), `--dry-run` (produces a fix-plan document with no code changes), `--re-verify` (re-runs sec-review-team against a specific set of finding IDs and reports fixed / still-present / inconclusive). Safeguards: branch-only commits (never main), no force-push, clean-working-tree required, regression-test must pass before commit lands. Use when the user says "fix the security findings", "apply sec-review fixes", "open PRs for the security report", "re-verify the security fixes", or similar.
Run a multi-agent security review TEAM over a codebase or recent diff. Picks a specialist roster based on detected stack signals (webapp / desktop / iac / llm-agent / container / backend / etc.) from a library of 13 specialists. Each specialist writes structured JSONL + prose findings in parallel; orchestrator consolidates into a single severity-ranked REPORT.md with deduped root issues. Distinct from the built-in `/security-review` (which is a single-pass branch review). Use when the user says "multi-agent security review", "security review team", "sec-review team", "audit this branch with a team", "pre-release hardening team pass", or similar. Review-only — no fixes. Validated on Opus 4.7 (validation notes live in the upstream `fsad_playbook` repo).