Skip to content
Back to skills

sdlc-kit

ASecurity

Gated SDLC loop with human approvals, for building features and fixing bugs. Triggers: any request to implement, change, or fix something in a project that has .sdlc/ — plain wording counts (\"add X\", \"fix this bug\", \"make Y work\") — plus \"start SDLC\", \"sdlc status\", \"continue the loop\", and incident reports. Does NOT trigger on read-only work: explaining code, answering questions, reviews and audits that change nothing.

  • 4 stars
  • 0 votes
  • 0 copies
  • 3 views
  • Added September 4, 2026
ai-agentsgit

Works with

  • terminal

Security analysis

A100/100

Pro scans all 20 files and shows the line behind each finding

Scanned October 4, 2026

npx -y skills add cskwork/sdlc-kit --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of sdlc-kit?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for sdlc-kit
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/cskwork-sdlc-kit/badge)](https://www.skillsdirectory.com/skills/cskwork-sdlc-kit)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: sdlc-kit
description: "Gated SDLC loop with human approvals, for building features and fixing bugs. Triggers: any request to implement, change, or fix something in a project that has .sdlc/ — plain wording counts (\"add X\", \"fix this bug\", \"make Y work\") — plus \"start SDLC\", \"sdlc status\", \"continue the loop\", and incident reports. Does NOT trigger on read-only work: explaining code, answering questions, reviews and audits that change nothing."
---

# sdlc-kit router

One loop, six stages, one artifact per stage, and a gate between stages:
human at intent, spec, and ship; tiered at plan; `lazymode:` in
`.sdlc/config.md` can waive human gates (AGENTS.md rule 3).
This file routes requests. `AGENTS.md` in this directory is the full contract
— gates, authority, memory, fresh-context review, proof. Read it completely
before the first stage of a session, then return here.

## When this skill runs

In a project with `.sdlc/`, any request that CHANGES the product runs through
this loop — "add a filter to the report", "fix the login redirect", "make the
export faster". No SDLC vocabulary is required; the words the human used are
not the trigger, the change is.

Read-only requests do NOT start the loop: explaining how something works,
answering a question, reading logs, reviewing or auditing code without
changing it. Answer those directly. If the answer turns into "…and here is
what I would change", that is where stage 1 starts — say so, then start it.

Specialist agents and project-local skills still do the implementation work;
they do it under this contract (gates, artifacts, memory), not beside it.

## Route by request

| Request looks like | Do |
|---|---|
| any feature or change request, however worded — a fix whose cause is already known included | New slug. Read `skills/1-intent/SKILL.md`. Small and well understood → compact route (one work artifact: intent → build → ship); anything ambiguous, broad, or risky → full route; oversized → map first. |
| "explain X" / "why does Y happen" / read-only audit | Answer it. No slug, no artifacts, no gates. Propose stage 1 only if the human wants the change made. |
| ticket too big or foggy for one intent pass | `map.md` in the same slug dir first (skills/1-intent "Chart a map first"); one Unknown per session, six sessions max. |
| "continue <slug>" / "what's next" | Run `gates/status.sh <slug>` from the project root. Its `next →` line names the stage skill or gate command. |
| "where are we" / "sdlc status" | `gates/status.sh` (open features; `--all` adds the newest 20 archived) + `gates/stats.sh` (open + recent closed). Full-archive sweeps: `ls`/`grep .sdlc/archive/`, never the whole listing into context. |
| "use jev for QA" / "jev로 QA" / "switch QA back to agent" / "which QA mode" | `tools/qa-mode.sh set jev` (or `set agent`; `--project` for this project only; default is agent, the choice is remembered) or `tools/qa-mode.sh` to show it. Jev mode changes how the verifier drives screens: `docs/jev-qa.md`. |
| "has this been done before" / "why is X like this" / "what are the rules for <menu>" | `tools/kb.sh search "<text>"`, then `tools/kb.sh show <slug>` or `show <product area>`; `tools/kb.sh index` lists the areas (AGENTS.md rule 7). |
| "what did we learn that is not in memory yet" / many open features, few closes | `tools/kb.sh harvest [--stale <days>]`; a stale one may be merged without closing (AGENTS.md rule 4). Contents page: `tools/kb.sh index` (`index_style: obsidian` in config.md for a vault). |
| a host/scheduler drives the loop, or you need machine state | `gates/status.sh --json`, `tools/auto.sh next <slug>`; contract: `docs/automation.md`. |
| gate request answered "approve" in chat | `gates/approve.sh <stage> <artifact> --delegated` per AGENTS.md rule 3. |
| something is broken and the cause is not known — bug report, incident, alert | Read `skills/6-maintain/SKILL.md` first: it diagnoses, then writes the intent. Takes precedence over the first row. |
| "we're done / drop this / dead end" for a feature | `gates/close.sh <slug> <shipped\|abandoned\|dead-end\|handed-off> "reason"` — what each needs: AGENTS.md "Every feature ends in a terminal state". |
| project has no `.sdlc/` yet | Run `<kit>/init.sh` from the project root (records are gitignored; `--area <folder>` keeps them in a folder the human names instead); ask the human which lazymode level they want (0–4, default 1; AGENTS.md rule 3) and set it in `.sdlc/config.md`; fill the config commands from the repo (package scripts, Makefile, CI) and run each once — ask only for what the repo cannot show; then stage 1. |

Files in this skill

  • AGENTS.md14.8 KB
  • README.ko.md20.2 KB
  • SKILL.md3 KB
  • VERSION7 B
  • docs/index.html42.4 KB
  • gates/approve.sh4.4 KB
  • gates/check-gate.sh898 B
  • gates/close.sh8 KB
  • gates/selftest.sh22.1 KB
  • gates/stats.sh3.3 KB
  • gates/status.sh8.9 KB
  • init.sh7.6 KB
  • roles/adversary.md2.6 KB
  • roles/researcher.md2.8 KB
  • roles/verifier.md1.6 KB
  • templates/deviations.md681 B
  • templates/evidence.md907 B
  • templates/harvest.md788 B
  • templates/intent.md1.8 KB
  • templates/lesson.md395 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.