noctua84
UserAn agent crew for Claude Code that says 'I don't know' — principled refusal + a built-in devil's advocate, a growing memory, and a learning loop.
Categories
Indexed Skills (27)
adopt-config
Discover pre-existing Claude config on this machine (files install.sh/install.py won't overwrite, plus other known sources) and integrate the worthwhile parts into this repo. Two-stage flow (adopt inbox -> adopted archive) with a tracked ledger so nothing is evaluated twice. Use when setting up on a new machine, when the installer reports "exists and is not a symlink", or to learn from prior config/memory.
agent-evaluation
Use when evaluating an AI agent — task completion, tool-use correctness, trajectory scoring, automation rate, and human-in-the-loop review. Triggers on "agent evaluation", "agent eval", "task completion rate", "tool-use accuracy", "trajectory", "automation rate".
api-security-assessment
Use when assessing the security of an API — testing for BOLA/broken object-level authorization, broken authentication, excessive data exposure, rate limiting, and JWT flaws against the OWASP API Security Top 10 and OAuth 2.0/OIDC. Triggers on "API security assessment", "OWASP API Top 10", "BOLA", "JWT validation", "rate limiting".
create-adr
Use when recording an architecture decision, proposing an architectural change, or checking whether a proposed change conflicts with an existing decision. Writes an ADR in this brain's lightweight format and reconciles it against every existing ADR. Triggers on "create ADR", "architecture decision record", "document this decision", "does this conflict with an existing ADR".
detection-rule
Use when authoring a SIEM detection rule or use case — mapping to MITRE ATT&CK techniques, writing Sigma rules, and tuning false positives for Splunk/Elastic/Sentinel. Triggers on "detection rule", "SIEM use case", "Sigma rule", "ATT&CK detection", "alert tuning", "detection engineering".
fix-security-vulnerabilities
Use when working on dependency vulnerabilities, security advisories, Dependabot or Snyk PRs, GitHub security alerts, or Azure DevOps vulnerability work items — to triage, prioritize, and prepare fixes. Triggers on "fix vulnerabilities", "dependabot", "snyk", "security alerts", "CVE remediation", "dependency update plan", "audit fix".
gh-milestones-projects
Use when creating a GitHub milestone or a GitHub Project (Projects v2 board) from the terminal, or adding issues/PRs to a project. Covers the two gh operations that have non-obvious invocations. Triggers on "create milestone", "gh milestone", "create a project board", "GitHub Projects", "add issue to project".
handle-pr-comments
Use when asked to address, work through, or respond to pull request review comments — especially when the reviewer is an AI (Copilot, bot) or when suggestions need evaluation before implementing
hipaa-assessment
Use when assessing HIPAA compliance for systems handling ePHI — evaluating Administrative, Physical, and Technical Safeguards, Business Associate Agreements, and breach risk. Triggers on "HIPAA", "ePHI", "Security Rule", "Privacy Rule", "HITECH", "BAA", "OCR audit", "45 CFR 164".
ir-playbook
Use when writing a scenario-specific incident response playbook — ransomware, phishing, data breach, insider threat, or DDoS — with containment steps, exact commands, and decision trees per NIST SP 800-61, SANS PICERL, MITRE ATT&CK, and D3FEND. Triggers on "IR playbook", "runbook", "ransomware response", "containment steps", "PICERL".
iso27001-isms
Use when building or documenting an ISO 27001 ISMS — scoping the ISMS, producing a Statement of Applicability, implementing Annex A controls, and preparing for certification. Triggers on "ISO 27001", "ISMS", "Annex A", "Statement of Applicability", "SoA", "ISO 27002", "ISO 27005", "risk treatment plan", "certification".
llm-application-architecture
Use when architecting an LLM application — agent patterns (chaining, routing, orchestrator-workers), model gateway, guardrails, retrieval, and latency/cost tradeoffs. Triggers on "LLM architecture", "agent patterns", "routing", "model gateway", "guardrails", "TTFT", "orchestrator-workers".
pci-dss-assessment
Use when assessing PCI DSS compliance for systems that store, process, or transmit cardholder data — scoping the CDE, selecting the SAQ type, validating segmentation, and tracking the 12 requirements. Triggers on "PCI DSS", "cardholder data", "CDE", "SAQ", "ROC", "ASV scan", "PCI 4.0", "tokenization".
prompt-engineering-guide
Use when designing or documenting a prompt engineering guide — prompt patterns, system prompts, few-shot examples, versioning, and drift monitoring. Triggers on "prompt engineering", "prompt guide", "system prompt", "few-shot", "prompt versioning", "human-in-the-loop".
prompt-evaluation-harness
Use when building a prompt evaluation harness — LLM-as-judge, G-Eval, faithfulness and answer-relevancy scoring, hallucination rate, and CI/CD regression suites. Triggers on "eval harness", "LLM-as-judge", "DeepEval", "RAGAS", "faithfulness", "hallucination rate", "G-Eval".
prompt-testing-plan
Use when designing a prompt testing plan — test cases, regression suites, coverage, and pass/fail criteria for prompts across versions. Triggers on "prompt testing", "test plan", "regression testing", "prompt QA", "test cases", "prompt versions".
rag-system-design
Use when designing a retrieval-augmented generation system — chunking, embeddings, vector store, hybrid retrieval, reranking, and evaluation. Triggers on "RAG", "retrieval-augmented", "vector database", "chunking strategy", "embeddings", "reranking", "context window".
repo-hygiene
Clean git clutter in this repo — remove merged and orphaned worktrees under .claude/worktrees/, delete stale merged local branches, and report merged-PR / closed-issue housekeeping. Read-only scan by default; destructive steps require an explicit --apply/typed yes and never touch GitHub or the worktree you're standing in. Use when worktrees or branches have piled up after merges.
sbom
Use when generating or reviewing a software bill of materials — component inventory, transitive dependencies, license compliance, and CVE cross-referencing with CycloneDX, SPDX, NTIA Minimum Elements, and SLSA. Triggers on "SBOM", "software bill of materials", "dependency inventory", "CycloneDX", "SPDX", "supply chain security".
sdlc-security-gates
Use when defining or auditing security gates across the SDLC — mandatory checkpoints at design, code, build, test, and deploy with SAST/DAST/SCA/secrets scanning in CI/CD using Microsoft SDL/OWASP SAMM/NIST SSDF. Triggers on "SDLC security gates", "DevSecOps", "CI/CD security", "gate pass rate", "shift left".
secure-code-review
Use when reviewing source code for security vulnerabilities — auditing authentication, authorization, cryptography, and input validation, and classifying findings by CWE. Triggers on "secure code review", "SAST findings", "CWE Top 25", "OWASP ASVS", "vulnerability review".
secure-design-spec
Use when writing a secure design specification for a new system or feature — defining security requirements, authentication, authorization, encryption, and trust assumptions at design time with OWASP Secure Design Principles/Microsoft SDL/NIST SSDF. Triggers on "secure design spec", "security requirements", "security by design", "least privilege", "data classification".
security-architecture-review
Use when reviewing a system's security architecture — assessing control coverage, defense-in-depth layers, single points of failure, and zero-trust alignment with TOGAF/SABSA/NIST SP 800-160. Triggers on "security architecture review", "defense in depth", "control coverage", "zero trust", "north-south east-west traffic".
soc2-report
Use when preparing a SOC 2 report or readiness assessment — mapping controls to the Trust Services Criteria, choosing Type I vs Type II, gathering audit evidence, and tracking exceptions. Triggers on "SOC 2", "Type I", "Type II", "Trust Services Criteria", "TSC", "audit evidence", "AICPA", "control exception".
threat-model
Use when threat modeling a system, feature, or architecture — enumerating attack surfaces, trust boundaries, and mitigations with STRIDE/PASTA/LINDDUN/MITRE ATT&CK. Triggers on "threat model", "attack surface", "trust boundary", "abuse cases".
vuln-assessment
Use when producing a vulnerability assessment report — scoring, prioritizing, and remediating findings with CVSS v4.0, EPSS, CISA KEV, CIS Controls v8.1, and NIST SP 800-40. Triggers on "vulnerability assessment", "vuln scan report", "CVE prioritization", "patch compliance", "remediation plan".
zero-trust-design
Use when designing a zero trust architecture — microsegmentation, identity-aware proxies, continuous authentication, and policy decision points per NIST SP 800-207, CISA Zero Trust Maturity Model, and BeyondCorp. Triggers on "zero trust", "ZTA", "microsegmentation", "never trust always verify", "identity-aware proxy", "lateral movement".
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.