Claude Skills by jmagly

Audit and triage general issue backlogs with read-only defaults, interactive cleanup decisions, and guidance steering; use this for "audit open issues" instead of aiwg-issue

Mark an issue as complete with comprehensive summary and verification

Add structured comments to issues using templates for progress, feedback, or blockers

Create a new ticket/issue with configurable backend (Gitea, GitHub, Jira, Linear, or local files)

Orchestrates issue-driven agent loops that post cycle status to issue threads and incorporate human feedback in each cycle.

List and filter tickets/issues from configured backend

Research-grounded SDLC issue planner — dispatches parallel research, generates the supporting doc corpus, then files prioritized cross-referenced issues for human review.

Automatically detect and update linked issues based on commits, artifacts, and task events

Update existing ticket/issue with status changes, comments, or field updates

Plan iterations, delegate to SDLC agents, and compile iteration status

Conduct comprehensive PR review from multiple perspectives (PM, Developer, QA, Security)

Analyze overall project health and metrics

Simulate project outcomes with variable modeling, risk assessment, and resource optimization scenarios.

Create a W3C PROV-compliant provenance record for an artifact

Query provenance chains to trace artifact derivation and impact

Generate provenance coverage dashboard and statistics

Validate provenance records and chains for completeness and consistency

Perform GRADE quality assessment on a research source

Compare current behavior against baseline to detect regressions

Generate properly formatted citation from research corpus

Analyze team retrospectives for insights

End-to-end SDLC ramp-up from idea to construction-ready with automated phase transitions and focused gate questions

AUTO-INVOKE when user mentions SDLC, requirements, architecture, ADR, use case, user story, test plan, phase gate, inception, elaboration, construction, transition, intake, deploy. SDLC framework quick reference — phase model, capability domains, and curated discovery phrases for aiwg discover.

Perform comprehensive security assessment

Enforce minimum security criteria before iteration close or release

One-command TDD infrastructure setup with pre-commit hooks and CI coverage gates

Generate or update the agentic environment definition for AgentSmith, SkillSmith, and CommandSmith

Generate MCP environment definition for MCPSmith with Docker and Node.js verification

Generate system definition file for ToolSmith with tested OS commands

Scaffold endurance, stress, and adversarial-input tests that reveal degradation rather than immediate crashes

Evaluate architectural decisions using Tree of Thoughts exploration

Generate troubleshooting documentation

Verify all citations in a document against the research corpus

Route structured artifact work to AIWG workflows via MCP with zero parent context cost

Decision aid for authentication factor architecture — have/know/are mapping, coercion resistance, FIDO2 PIN/UV policy, and PRF hot-path anti-patterns.

Scan source code for banned APIs/forbidden functions per project banlist; report violations with paths, line numbers, and recommended replacements

Scan tracked repository files for committed binary blobs and report reviewability/provenance exceptions

Configure Bun's install.minimumReleaseAge gate (7-day default, 10-day high-sensitivity) for JavaScript projects on Bun. Includes Corepack-equivalent version detection and lockfile-caveat warning.

Decision aid for bootstrap and verification chains — forces the 'what authenticates the authenticator' question; patterns for signed bootstrap, measured boot, recovery.

Audit CI workflow files for supply-chain risk — unpinned actions, unpinned container images, pull_request-triggered jobs with secret access, curl-pipe-shell installers, and bare :latest tags. Produces a structured markdown report with file:line refs.

Audit source-control organization settings for strong 2FA/MFA requirements across all committers

Detect bidi controls, zero-width characters, mixed-script identifiers, and homoglyph risks in source and release metadata

Decision aid for choosing AEAD, KDF, MAC, and signature primitives — flags anti-patterns (CBC-without-MAC, ad-hoc KDF, key reuse, PBKDF2-on-high-entropy).

Decision-aid skill for fail-closed vs fail-open behavior. Forces a degraded-mode matrix and rejects "type Y to override" prompts in favor of multi-step ceremonies

Compare API/ABI surfaces between refs, flag incompatible changes, and generate deprecation/changelog notes for library projects

Use when a project needs DFIR readiness from the security-engineering side: prepare incident evidence handling, chain-of-custody expectations, IOC readiness, and handoff to forensics-complete without collecting evidence.

Detect candidate fuzz targets and emit CI recipes for libFuzzer/AFL/cargo-fuzz/atheris/fast-check harnesses, plus OSS-Fuzz integration patterns

Configure and review npm min-release-age controls for JavaScript projects, including 7-day default gates, 10-day high-sensitivity profiles, npm version requirements, and safe override handling.

Audit npm projects for Shai-Hulud-class supply-chain exposure: lifecycle scripts, Git dependency prepare hooks, release-age gaps, publish-token exposure, trusted publishing, signed releases, and verifier docs.

Threat library for physical-access threats STRIDE and OWASP Top 10 miss — evil-maid, DMA, hostile peripheral, travel-host, coercion, cold-boot, side-channel.