themarmack
UserClaude Code skill toolkit for SDLC modernization in regulated environments — research digests, Copilot/GHAS governance, and an Obsidian-backed knowledge vault.
Categories
Indexed Skills (35)
actions-workflow-hardener
Review a GitHub Actions workflow YAML file for security hardening issues — unpinned action SHAs, overpermissive GITHUB_TOKEN, missing OIDC for cloud auth, pull_request_target misuse, secret-handling problems, self-hosted-runner risks. Produces a structured finding list with severity, line reference, remediation, and a citation to the underlying GitHub recommendation. Baseline derived from `vault/research/github/2026-06-20-actions-hardening-post-shai-hulud.md` (7 hardening practices from GitHub Docs). Use whenever the user is reviewing a workflow file before merge or auditing inherited workflows.
ai-coding-tools-compare
Produce a side-by-side comparison of AI coding tools — GitHub Copilot vs Cursor vs Windsurf vs Cody vs Tabnine vs JetBrains AI vs Amazon Q Developer vs emerging entrants — against the org's enterprise rubric. Rubric axes — auth (SSO/SAML/SCIM), data flow (residency, content exclusion, training-data policy), IP indemnity, on-prem / single-tenant options, admin telemetry, FedRAMP/SOC2/ISO certifications, model routing transparency, audit log access. Use when the user asks to compare AI coding tools (Copilot vs Cursor vs Windsurf vs Cody vs others) against the org's enterprise rubric, or asks "should we switch to X?" — during periodic re-evaluation, vendor selection for a specific use case, or before responding to leadership. For an in-depth single-tool study (not a comparison) use copilot-deep-dive.
ai-governance-research
On-demand Category 1 researcher targeting AI governance frameworks and regulations applicable to internal AI dev tooling — NIST AI RMF, EU AI Act, US executive orders, state AI laws (California, Colorado, etc.), ISO 42001, model cards, and the org-specific application of each. Enforces Obsidian-first contract. Outputs at vault/research/ai-governance/YYYY-MM-DD-{slug}.md; verified facts get staged for memory-curator promotion to vault/facts/{framework-entity}/. Use when the user asks to research whether or how an AI governance framework or AI-specific law applies to internal AI dev tooling — producing a fresh, cited research note — as opposed to financial-services regulator guidance (financial-regulator-watch) or a cross-framework control-ID mapping for a single control question (compliance-framework-lookup).
ai-tooling-data-flow-reviewer
Given a proposed AI tool integration (Copilot Chat knowledge base, Cursor on a regulated repo, an internal LLM gateway routing to an external provider, a Copilot agentic action that touches a system of record), map the complete data flow and flag every place regulated data could leave the org's boundary. Cross-references vault facts (data residency, content exclusion, audit log paths) to validate the org's posture matches the integration's actual flows. Produces a data-flow diagram (ASCII), a per-hop classification table, and a findings list. Use before greenlighting any new AI tool integration touching production systems or regulated data.
biweekly-codeql-community-pulse
Biweekly scheduled agent. Surveys the github/codeql repo + community packs for new queries, modified queries, and new packs published in the past 14 days. Relevance-scores each against the org's stack (using daily-cve-digest's stack.yml as the source of in-scope ecosystems) — surface only ecosystem-matching results. Output at vault/digests/biweekly/YYYY-MM-DD-codeql-community-pulse.md. Feeds the codeql-pattern-finder skill — every relevant new community query is a candidate for the org's adoption queue. Use when the user asks to run the CodeQL community pulse or see what new community queries or packs shipped upstream — and on its biweekly schedule.
claim-extractor
Extract falsifiable claims from a fetched source document, returning a standard `{claim, quoted_anchor, source_url, source_tier, claim_type}` schema per claim. Filters out opinions, marketing fluff, vague generalizations, and unverifiable forward-looking statements. Used by every Category 1 research skill (Obsidian-first contract) before passing claims to verify-claim, and by memory-curator when staging multi-claim documents into _inbox/. Composes on source-fetcher (the input is its content_md) and prompt-injection-guard (already applied upstream). Use after source-fetcher returns content during any Category 1 research or scheduled digest run, before claims go to verify-claim or get staged for memory-curator.
codeql-onboarding-helper
Given a target repo's stack + risk profile, decide default vs advanced CodeQL setup, recommend a query suite (code-scanning / security-extended / security-and-quality), select custom packs (community + org's internal), document the alert triage workflow, and define the exception process. Produces an onboarding plan ready to hand to the repo owner. Use during repo GHAS onboarding or when refactoring a repo's existing CodeQL setup that's drowning in low-signal alerts or missing real ones.
codeql-pattern-finder
Given a vulnerability class or business rule (e.g. "find SQL injection via string concat in Java", "find calls to deprecated crypto APIs", "find unchecked PII handling at API boundaries"), search the standard github/codeql packs and community packs for an existing query that matches. If no off-the-shelf query exists, sketch a custom query in CodeQL with annotated reasoning. Output is a research note with the chosen query (or sketch) + how to deploy it via codeql-onboarding-helper. Use when planning a custom pack rollout, when an internal pattern keeps appearing in incidents, or when a regulator-specific control needs a code-level enforcement.
copilot-exception-handler
Walk through a non-standard Copilot config request — public-code-filter-off, alternate model pin, content-exclusion-override, license-assignment outside the standard process — decide justified / partially justified / not justified, and produce the formal exception document with risk statement, compensating controls, expiry, owner, and renewal trigger. Pulls org constants from vault/facts/copilot/ and canonical answers from copilot-faq-answerer; pre-empts objector arguments via objection-response-library. Use whenever a team lead or developer submits a request that breaks the standard Copilot configuration.
copilot-faq-answerer
Answer the recurring GitHub Copilot questions a regulated-environment GitHub admin fields daily (data handling, IP indemnity, content exclusions, audit logs, model selection, public code filter, knowledge bases, AGENTS.md governance). Reads canonical answers from `./canonical-answers.md` in this skill folder, applies them with the compliance-relevant lens, and cites GitHub's authoritative source. Also checks the Obsidian vault (`facts/copilot/*`) for any more recent fact that should override the canonical answer. Use whenever the user (or a stakeholder via the user) asks a Copilot policy / controls question.
copilot-metrics-analyzer
Take raw Copilot Usage Metrics API output (per-user, daily granularity, including the new `ai_credits_used` field) and produce structured findings — top cost/usage anomalies, per-dev chargeback math with the 10% data-residency surcharge applied, and actionable recommendations. Uses facts from `vault/facts/copilot/` (usage-metrics-ai-credits-per-user, data-residency-surcharge) so cost math reflects the org's actual configuration, not generic per-seat assumptions. Use when the user has raw Copilot usage-metrics output to analyze — during weekly cost monitoring, before a cost-attribution conversation with finance, or when hunting dormant licenses.
copilot-rollout-playbook
Generate a tailored Copilot expansion plan for a target team or BU. Takes a team description (size, language stack, current Copilot adoption state, business priorities, regulatory exposure) and produces a 5-phase rollout — prerequisites, training, pilot, expansion, steady-state. Pulls org-specific constants (data residency, content exclusion, public code filter, IP indemnity terms) from `vault/facts/copilot/` so the plan reflects the current configuration, not generic GitHub guidance. Use when a team lead asks "how do we roll Copilot out to my team?" or when planning an org-wide expansion wave.
demo-script-builder
Build a tailored demo script for an AI-coding / SDLC-modernization audience. Inputs — audience type (skeptical dev / curious leader / risk-focused auditor / vendor evaluator), demo goal (familiarization / objection-handling / specific-feature showcase / posture demonstration), time budget (10 / 20 / 45 minutes). Output is a moment-by-moment script with prep checklist, the specific Copilot prompts / commands the demoer will type, expected output narration, and the fallback plan if a step fails live. Use when prepping for a stakeholder demo, audit conversation, vendor-account-team meeting, or all-hands familiarization.
dependabot-config-helper
Generate or review a `.github/dependabot.yml` for a target repo or service, calibrated to org policy (regulated-environment defaults from `dependabot-strategy` research) and the repo's actual stack. Handles grouped updates (security + version separately), schedule cadence per ecosystem, private-registry integration, auto-merge gating, reviewer routing, and the open-pull-requests-limit per ecosystem. Use whenever onboarding a repo to Dependabot, refactoring an existing config that's drowning the team in PRs, or auditing a sample of org repos for config consistency.
dependabot-strategy
On-demand Category 1 researcher focused on Dependabot best practices for a regulated organization — triage workflows, grouped-update strategies, auto-merge gates, ecosystem coverage, private-registry integration, cooldown periods for zero-day waiting, and the auto-triage rules that turn alert volume into actionable signal. Enforces Obsidian-first contract. Findings land at vault/research/dependabot/YYYY-MM-DD-{slug}.md; verified facts get staged for memory-curator promotion to vault/facts/ghas-dependabot/. Used by dependabot-config-helper as the source of defaults. Use when the user asks a strategic, policy, triage, or tooling question about Dependabot that needs a research-grade answer with citations — not when generating or reviewing a concrete dependabot.yml (dependabot-config-helper) or researching a non-Dependabot GHAS feature (ghas-feature-research).
digest-writer
Canonical formatter for digests and research reports. Enforces a 5-section structure (TL;DR → What Changed → Why You Care → Detailed Findings → Sources) with the regulated-org lens applied to "Why You Care" and credibility-tier badges on every source. Delegates the actual file write to vault-writer, landing the digest at `vault/digests/{cadence}/YYYY-MM-DD-{skill}.md` (for scheduled agents) or `vault/research/{topic}/YYYY-MM-DD-{slug}.md` (for on-demand research). Every Category 2 scheduled agent and every Category 1 research skill writes through this skill. Use whenever a scheduled agent or research skill is formatting its final output — after claims are extracted and verified, immediately before the vault-writer write.
email-sender
Send, or preview and show, email delivery of a vault note (digest or research) to your distribution list. Delivery is deterministic — Markdown rendered to styled HTML with the raw `.md` attached, via a committed `render_and_send.py` (no AI call). Scheduled digests auto-send to everyone on the list; research notes prompt `[y/n]` first. A `show_list` action loads and prints the distribution list — who would receive the next send — without sending anything. Recipients come from a plain-Markdown list at `vault/_config/email-distribution.md`. Use when the user asks to email, send, forward, or distribute a digest or research note to their list, OR to show, list, view, preview, check, or validate their email distribution list (who's on it, who would get the next digest) — and immediately after `vault-writer.write_digest` or `vault-writer.write_research` succeeds. Not for composing an ad-hoc personal email or answering a generic SMTP question.
enablement-content-creator
Generate training / enablement content for the SDLC modernization program — Copilot prompting, secure coding with AI, CodeQL triage, GHAS workflows, AGENTS.md authoring. Produces tiered content (dev / lead / exec) with the same factual backbone but different framing, depth, and call-to-action per audience. Pulls from copilot-faq-answerer canonical answers (recently extended via memory-curator's promoted facts) and objection-response-library steel-manned concerns. Output lands at vault/insights/YYYY-MM-DD-enablement-{topic-slug}.md. Use when the user needs to create or refresh training / enablement material — before a rollout training phase, after cited vault facts change past a module's `last_verified`, or when a recurring question merits standalone content.
enterprise-audit-log-investigator
Run common saved searches against the GitHub enterprise audit log — Copilot policy changes, secret-scanning push-protection bypasses, SSO events, allowed-Actions list edits, content-exclusion changes. Each canonical search has a structured query (the `gh api`-equivalent of the audit log search syntax), the matching `action` types, expected normal volume, alert threshold, and what to do if results spike. Use during incident response (something changed and we need to know who/when), during quarterly audit prep, or proactively as part of a security-monitoring rhythm.
executive-summary-writer
Turn an existing research note into a 1-page executive summary personalized to a named audience (e.g. `ciso`, `vp-eng`, `ceo`, or `default`). **Invoke ONLY when the user explicitly asks for an exec summary** — never as a post-write step in a Category 1 researcher flow. Loads audience preferences — length, voice, format, emphasize/avoid lists, special interests, section toggles — from `~/Obsidian/Research-Brain/_config/exec-preferences.md`. Writes the summary to `vault/insights/YYYY-MM-DD-exec-summary-{audience}-{slug}.md` via `vault-writer.write_insight`, then composes with `email-sender.prompt_then_send` to optionally deliver via Gmail. The 8-section structure (BLUF, Why This Matters Now, Key Findings, Implications, Recommended Action, Risks, Next Decision Point, Sources) is the spine — three sections are mandatory; the other five are toggleable per audience. Stop-and-reports on missing source note, missing prefs file, missing `## Default` section, or unknown audience. Use when the user asks to summarize a r
feed-watcher
Poll RSS / Atom / JSON-Feed / GitHub-releases sources from the source-registry and return items new since last poll. Dedup state is persisted via seen-tracker under `<repo>/.state/<agent_name>/seen.jsonl`, keyed by the calling agent — feed-watcher holds no state of its own. Composes on source-registry (which sources to poll) and source-fetcher (one-off URL fetch for HTML sources without native feeds). Use when a Category 2 scheduled agent starts its run (its first action, to learn what changed since the last run) and when the user wants a one-shot "what's new in the last N days from sources tagged X" lookup.
ghas-config-reviewer
Audit a GitHub repo or org's GitHub Advanced Security configuration against the org's baseline. Checks code scanning enablement, secret scanning + push protection, Dependabot alerts + version updates, dependency review, branch protection requiring GHAS checks, and CODEOWNERS hygiene. Uses `gh api` for live inspection of a target repo or org; falls back to documented baseline check items the user can run manually. Produces a structured finding list with severity, current vs expected state, and remediation steps. Use when the user asks to audit or review a repo's or org's GitHub Advanced Security (GHAS) configuration — code scanning, secret scanning + push protection, Dependabot, dependency review, branch protection — during repo onboarding, periodic GHAS audits, or before a stakeholder review of GHAS posture. This owns "is code scanning / secret scanning / push protection / Dependabot enabled?" questions at **repo or org** level. For researching how a single GHAS feature works use ghas-feature-research; for no
github-org-audit-runner
Audit a GitHub organization's admin-surface settings — SAML / SCIM, EMU posture, base permissions, secret scanning + push-protection org defaults, allowed Actions list, runner groups, repository creation policies, IP allow-list — against the org's baseline. Uses `gh api` for live inspection where authenticated; falls back to a structured manual-checklist a human admin can walk through in the UI. Produces a posture report with `current_state` vs `expected_state` per item, severity, and remediation. Use during quarterly admin reviews, before audit conversations, or when troubleshooting a "why can't users do X" complaint that might be an org-wide policy.
meeting-prep-brief
Generate a one-page prep brief for a meeting from the user's notes + recent vault activity. Sections — meeting context, the participants (with their likely concerns, sourced from objection-response-library and people notes), the asks (what user needs to walk in prepared for), the prior context (relevant vault notes + decisions + facts), and the "if X comes up, here's the response" pre-empts. Use before any stakeholder meeting where the user wants to be ahead of the conversation rather than reacting to it.
memory-curator
Decide whether an inbox item or candidate finding should be promoted to a durable vault folder, patched onto an existing note, or dropped. Applies the rules from vault/_meta/inbox-rules.md (novelty, falsifiability, future utility, surprise, sourcing). Runs on _inbox/{agent-id}/ items to sweep them or can be called ad-hoc by a skill before a direct vault-writer call. Composes with vault-querier for novelty checks and vault-writer for the actual promote/patch writes. Default-drops unsourced agent claims; never silently drops content with substance — uncertain items get tagged
peer-bank-tech-intel
Collect what other major banks publicly share about their developer platforms, AI coding adoption, platform engineering, and SDLC modernization — engineering blogs (JPMorgan, Goldman Sachs, Morgan Stanley, Capital One, BofA, Wells Fargo, Citi, HSBC, Deutsche Bank, Barclays), conference talks (FS-ISAC, QCon Financial Services tracks), public RFCs / open-source projects, and named-analyst commentary. Output at vault/research/peer-bank/YYYY-MM-DD-{slug}.md. Composes with stakeholder-update-writer (exec asks "what are peers doing?") and decision-memo-writer. Use when the user asks what peer banks are publicly doing or saying about developer platforms, AI coding, or SDLC modernization — producing a fresh, cited research note from public sources only — not for evaluating a specific vendor's security posture (vendor-security-eval) or comparing AI coding tools (ai-coding-tools-compare).
prompt-injection-guard
Scan fetched web content for prompt injection patterns before it is passed to a downstream LLM call. Returns the content with suspicious blocks quarantined plus a verdict (clean / quarantined / suspicious). Mandatory for any skill that ingests arbitrary web text — including source-fetcher, voices-watcher, weekly-intelligence-digest, every on-demand researcher, and any skill that promotes content from _inbox/. Do not use for trusted user input or for already-curated vault content.
regulated-finance-framer
Reusable prompt-fragment skill consolidating the regulated-org framing rules that every Category 1 research skill and Category 5 comms skill currently bakes into its own SKILL.md. Any topic skill that needs the compliance-relevant lens can include this fragment via a single reference rather than re-implementing the framing. When the org's posture, regulatory environment, or control catalog evolves, edit this skill once and every downstream skill inherits. Use as an `import` from any skill that wants the standard compliance framing applied to its output — when authoring or updating a Category 1 research or Category 5 comms skill, or before framing any research, synthesis, or communication output with the regulated-org lens.
frontier-model-watch
On-demand Category 1 researcher for frontier-model news (Anthropic, OpenAI, Google, Meta, Mistral, emerging) with the "what changes for enterprise dev tooling" angle. Specifically — which models route through Copilot per-feature? What deprecations are imminent? What new capabilities affect AI-tool TPRM posture or model-risk reviews? Output at vault/research/frontier-model/YYYY-MM-DD-{slug}.md. Composes with ai-coding-tools-compare (model side of the tool comparison) and the weekly-intelligence-digest (the recurring intelligence pipe). Use when the user asks to research a specific frontier-model release, deprecation, availability shift, or benchmark on demand — producing a fresh, cited research note — not the scheduled quarterly landscape survey (quarterly-ai-coding-landscape), a tool-level comparison (ai-coding-tools-compare), or a recurring news sweep (weekly-intelligence-digest).
ghas-feature-research
On-demand Category 1 researcher for a specific GitHub Advanced Security feature — secret scanning push protection, code scanning autofix, security campaigns, dependency review action, security advisories database, custom auto-triage rules. For a chosen feature, produces a research note with current state, rollout caveats, regulated-org applicability, and recommendations. Output at vault/research/ghas/YYYY-MM-DD-{feature-slug}.md. Composes with ghas-config-reviewer (baseline-checking side) and the various GHAS-touching ops skills. Use when the user asks to research a single GHAS feature in depth — adoption, rollout, tuning, regulated-org caveats — producing a fresh, cited research note; not for checking a repo or org config against the baseline (ghas-config-reviewer), Dependabot strategy questions (dependabot-strategy), or platform-wide GitHub questions (github-platform-watch).
adr-writer
Draft an Architecture Decision Record using the org's ADR template. ADRs document **technical decisions** with their context, the decision itself, and the consequences — focused on the "what" and "why" rather than implementation steps. Distinct from RFCs (which propose for discussion) and decision memos (which inform leadership). Output lands as a `decisions/` note in the vault. Use when capturing a technical architecture choice that's been made (or is about to be made) and needs to be discoverable + reviewable by future readers.
daily-cve-digest
Daily scheduled agent. Polls CVE / advisory feeds (GHSA, OSV.dev, NVD) for the past 24 hours, matches against the org's declared stack in `./stack.yml`, and produces a severity-prioritized digest. Each item carries first-response SLA, remediation SLA, and a "what Dependabot will/won't catch" line — Dependabot covers direct dependency CVEs but misses ecosystem-level signals (base-image advisories, transitive depths Dependabot doesn't reach, supply-chain attack disclosures). Runs weekday mornings; outputs to vault/digests/daily/YYYY-MM-DD-daily-cve-digest.md. Use when the user asks to run the CVE or vulnerability digest, or to see what new CVEs or advisories hit the org's stack in the last day — and on its weekday-morning schedule.
conference-talk-distiller
Turn a conference talk's slides / transcript / recording into the 3 things that matter for the user's program. Most talks have 1-3 substantive ideas wrapped in 30-45 minutes; this skill extracts the substance. Output at vault/insights/YYYY-MM-DD-talk-{slug}.md with the 3 key ideas + compliance-relevant takeaways + speaker recommendations to track. Use after attending or watching a recorded talk that the user wants to retain value from.
learning-capture
Save a structured insight note from an article, conversation, or experience. Routes through vault-writer to vault/insights/ (or vault/facts/{entity}/{predicate}.md if the captured content is atomic and falsifiable). Uses the controlled tag vocabulary. Distinct from quick-capture (which uses the qc-* sentence-starter formats and is faster). Use whenever encountering content worth retaining beyond the current conversation — a blog post that changes your mental model, a learning from a meeting that should outlast the meeting, a synthesis across multiple sources.
reading-queue-summarizer
Triage and summarize a backlog of saved articles / papers. For each item — 1-paragraph summary, salient quotes, vault connections, and a verdict (promote to a research note / capture as an insight / dismiss / defer). Especially useful after a busy intelligence-digest week when the user has marked items for follow-up reading. Output at vault/insights/YYYY-MM-DD-reading-triage-{slug}.md plus per-item promotion notes where applicable. Use when the user asks to triage, clear, or summarize their reading queue, saved articles, or marked follow-up items.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.