diff --git a/.gemini/skills-index.json b/.gemini/skills-index.json index f214665..ea3ea03 100644 --- a/.gemini/skills-index.json +++ b/.gemini/skills-index.json @@ -1,7 +1,7 @@ { "version": "1.0.0", "name": "gemini-cli-skills", - "total_skills": 264, + "total_skills": 270, "skills": [ { "name": "README", @@ -443,6 +443,11 @@ "category": "engineering", "description": "Adversarial code review that breaks the self-review monoculture. Use when you want a genuinely critical review of recent changes, before merging a PR, or when you suspect Claude is being too agreeable about code quality. Forces perspective shifts through hostile reviewer personas that catch blind spots the author's mental model shares with the reviewer." }, + { + "name": "ai-security", + "category": "engineering", + "description": "Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring." + }, { "name": "aws-solution-architect", "category": "engineering", @@ -458,6 +463,11 @@ "category": "engineering", "description": ">-" }, + { + "name": "cloud-security", + "category": "engineering", + "description": "Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture assessment with MITRE ATT&CK mapping." + }, { "name": "code-reviewer", "category": "engineering", @@ -513,6 +523,11 @@ "category": "engineering", "description": "Incident Commander Skill" }, + { + "name": "incident-response", + "category": "engineering", + "description": "Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle." + }, { "name": "migrate", "category": "engineering", @@ -533,6 +548,11 @@ "category": "engineering", "description": "Graduate a proven pattern from auto-memory (MEMORY.md) to CLAUDE.md or .claude/rules/ for permanent enforcement." }, + { + "name": "red-team", + "category": "engineering", + "description": "Use when planning or executing authorized red team engagements, attack path analysis, or offensive security simulations. Covers MITRE ATT&CK kill-chain planning, technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting." + }, { "name": "remember", "category": "engineering", @@ -663,6 +683,11 @@ "category": "engineering", "description": ">-" }, + { + "name": "threat-detection", + "category": "engineering", + "description": "Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization." + }, { "name": "agent-designer", "category": "engineering-advanced", @@ -853,6 +878,11 @@ "category": "engineering-advanced", "description": "Use when the user asks to set up secret management infrastructure, integrate HashiCorp Vault, configure cloud secret stores (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), implement secret rotation, or audit secret access patterns." }, + { + "name": "self-eval", + "category": "engineering-advanced", + "description": "Honestly evaluate AI work quality using a two-axis scoring system. Use after completing a task, code review, or work session to get an unbiased assessment. Detects score inflation, forces devil's advocate reasoning, and persists scores across sessions." + }, { "name": "setup", "category": "engineering-advanced", @@ -1342,11 +1372,11 @@ "description": "Command resources" }, "engineering": { - "count": 46, + "count": 51, "description": "Engineering resources" }, "engineering-advanced": { - "count": 49, + "count": 50, "description": "Engineering-advanced resources" }, "finance": { diff --git a/.gemini/skills/ai-security/SKILL.md b/.gemini/skills/ai-security/SKILL.md new file mode 120000 index 0000000..61c5d85 --- /dev/null +++ b/.gemini/skills/ai-security/SKILL.md @@ -0,0 +1 @@ +../../../engineering-team/ai-security/SKILL.md \ No newline at end of file diff --git a/.gemini/skills/cloud-security/SKILL.md b/.gemini/skills/cloud-security/SKILL.md new file mode 120000 index 0000000..b3724fb --- /dev/null +++ b/.gemini/skills/cloud-security/SKILL.md @@ -0,0 +1 @@ +../../../engineering-team/cloud-security/SKILL.md \ No newline at end of file diff --git a/.gemini/skills/incident-response/SKILL.md b/.gemini/skills/incident-response/SKILL.md new file mode 120000 index 0000000..2a6ee2c --- /dev/null +++ b/.gemini/skills/incident-response/SKILL.md @@ -0,0 +1 @@ +../../../engineering-team/incident-response/SKILL.md \ No newline at end of file diff --git a/.gemini/skills/red-team/SKILL.md b/.gemini/skills/red-team/SKILL.md new file mode 120000 index 0000000..a16db25 --- /dev/null +++ b/.gemini/skills/red-team/SKILL.md @@ -0,0 +1 @@ +../../../engineering-team/red-team/SKILL.md \ No newline at end of file diff --git a/.gemini/skills/self-eval/SKILL.md b/.gemini/skills/self-eval/SKILL.md new file mode 120000 index 0000000..5eea1d9 --- /dev/null +++ b/.gemini/skills/self-eval/SKILL.md @@ -0,0 +1 @@ +../../../engineering/self-eval/SKILL.md \ No newline at end of file diff --git a/.gemini/skills/threat-detection/SKILL.md b/.gemini/skills/threat-detection/SKILL.md new file mode 120000 index 0000000..f4c08dc --- /dev/null +++ b/.gemini/skills/threat-detection/SKILL.md @@ -0,0 +1 @@ +../../../engineering-team/threat-detection/SKILL.md \ No newline at end of file diff --git a/docs/skills/engineering-team/a11y-audit.md b/docs/skills/engineering-team/a11y-audit.md index 702a741..5de9f31 100644 --- a/docs/skills/engineering-team/a11y-audit.md +++ b/docs/skills/engineering-team/a11y-audit.md @@ -15,26 +15,14 @@ description: "Accessibility audit skill for scanning, fixing, and verifying WCAG Install: claude /plugin install engineering-skills -**Name**: a11y-audit -**Tier**: STANDARD -**Category**: Engineering - Frontend Quality -**Dependencies**: Python 3.8+ (Standard Library Only) -**Author**: Alireza Rezvani -**Version**: 2.1.2 -**Last Updated**: 2026-03-18 -**License**: MIT ---- - -## Name - -a11y-audit -- WCAG 2.2 Accessibility Audit and Remediation Skill +WCAG 2.2 Accessibility Audit and Remediation Skill ## Description The a11y-audit skill provides a complete accessibility audit pipeline for modern web applications. It implements a three-phase workflow -- Scan, Fix, Verify -- that identifies WCAG 2.2 Level A and AA violations, generates exact fix code per framework, and produces stakeholder-ready compliance reports. -This skill goes beyond detection. For every violation it finds, it provides the precise before/after code fix tailored to your framework (React, Next.js, Vue, Angular, Svelte, or plain HTML). It understands that a missing `alt` attribute on an `` in React JSX requires a different fix pattern than the same issue in a Vue SFC or an Angular template. +For every violation it finds, it provides the precise before/after code fix tailored to your framework (React, Next.js, Vue, Angular, Svelte, or plain HTML). **What this skill does:** @@ -44,18 +32,8 @@ This skill goes beyond detection. For every violation it finds, it provides the 4. **Reports** findings in a structured format suitable for developers, PMs, and compliance stakeholders 5. **Integrates** into CI/CD pipelines to prevent accessibility regressions -**Key differentiators:** - -- Framework-aware fix patterns (not generic HTML advice) -- Color contrast analysis with accessible alternative suggestions -- WCAG 2.2 coverage including the newest success criteria (Focus Appearance, Dragging Movements, Target Size) -- CI/CD pipeline integration with GitHub Actions, GitLab CI, and Azure DevOps -- Slash command support via `/a11y-audit` - ## Features -### Core Capabilities - | Feature | Description | |---------|-------------| | **Full WCAG 2.2 Scan** | Checks all Level A and AA success criteria across your codebase | @@ -63,37 +41,23 @@ This skill goes beyond detection. For every violation it finds, it provides the | **Severity Classification** | Categorizes each violation as Critical, Major, or Minor | | **Fix Code Generation** | Produces before/after code diffs for every issue | | **Color Contrast Checker** | Validates foreground/background pairs against AA and AAA ratios | -| **Accessible Alternatives** | Suggests replacement colors that meet contrast requirements | | **Compliance Reporting** | Generates stakeholder reports with pass/fail summaries | | **CI/CD Integration** | GitHub Actions, GitLab CI, Azure DevOps pipeline configs | | **Keyboard Navigation Audit** | Detects missing focus management and tab order issues | | **ARIA Validation** | Checks for incorrect, redundant, or missing ARIA attributes | -| **Live Region Detection** | Identifies dynamic content lacking `aria-live` announcements | -| **Form Accessibility** | Validates label associations, error messaging, and input types | - -### WCAG 2.2 Coverage Matrix - -| Principle | Level A Criteria | Level AA Criteria | -|-----------|-----------------|-------------------| -| **Perceivable** | 1.1.1 Non-text Content, 1.2.1-1.2.3 Time-based Media, 1.3.1-1.3.3 Adaptable, 1.4.1-1.4.2 Distinguishable | 1.3.4-1.3.5 Adaptable, 1.4.3-1.4.5 Contrast & Images of Text, 1.4.10-1.4.13 Reflow & Content | -| **Operable** | 2.1.1-2.1.2 Keyboard, 2.2.1-2.2.2 Timing, 2.3.1 Seizures, 2.4.1-2.4.4 Navigable, 2.5.1-2.5.4 Input | 2.4.5-2.4.7 Navigable, 2.4.11 Focus Appearance (NEW 2.2), 2.5.7 Dragging (NEW 2.2), 2.5.8 Target Size (NEW 2.2) | -| **Understandable** | 3.1.1 Language, 3.2.1-3.2.2 Predictable, 3.3.1-3.3.2 Input Assistance | 3.1.2 Language of Parts, 3.2.3-3.2.4 Predictable, 3.3.3-3.3.4 Error Handling, 3.3.7 Redundant Entry (NEW 2.2), 3.3.8 Accessible Auth (NEW 2.2) | -| **Robust** | 4.1.2 Name/Role/Value | 4.1.3 Status Messages | ### Severity Definitions | Severity | Definition | Example | SLA | |----------|-----------|---------|-----| -| **Critical** | Blocks access for entire user groups | Missing alt text on informational images, no keyboard access to primary navigation | Fix before release | -| **Major** | Significant barrier that degrades experience | Insufficient color contrast on body text, missing form labels | Fix within current sprint | +| **Critical** | Blocks access for entire user groups | Missing alt text, no keyboard access to navigation | Fix before release | +| **Major** | Significant barrier that degrades experience | Insufficient color contrast, missing form labels | Fix within current sprint | | **Minor** | Usability issue that causes friction | Redundant ARIA roles, suboptimal heading hierarchy | Fix within next 2 sprints | ## Usage ### Quick Start -Activate the skill and run an audit on your project: - ```bash # Scan entire project python scripts/a11y_scanner.py /path/to/project @@ -110,8 +74,6 @@ python scripts/contrast_checker.py --file /path/to/styles.css ### Slash Command -Use the `/a11y-audit` slash command for an interactive audit session: - ``` /a11y-audit # Audit current project /a11y-audit --scope src/ # Audit specific directory @@ -122,84 +84,23 @@ Use the `/a11y-audit` slash command for an interactive audit session: ### Three-Phase Workflow -#### Phase 1: Scan - -The scanner walks your source tree, detects the framework in use, and applies the appropriate rule set. +**Phase 1: Scan** -- Walk the source tree, detect framework, apply rule set. ```bash python scripts/a11y_scanner.py /path/to/project --format table ``` -**Sample output:** +**Phase 2: Fix** -- Apply framework-specific fixes for each violation. -``` -A11Y AUDIT REPORT - /path/to/project -Framework Detected: React (Next.js) -Files Scanned: 127 -━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ +> See [references/framework-a11y-patterns.md](https://github.com/alirezarezvani/claude-skills/tree/main/engineering-team/a11y-audit/references/framework-a11y-patterns.md) for the complete fix patterns catalog. -CRITICAL (3 issues) - [1.1.1] src/components/Hero.tsx:14 - Missing alt text on element - [2.1.1] src/components/Modal.tsx:8 - Focus not trapped inside modal dialog - [1.4.3] src/styles/globals.css:42 - Contrast ratio 2.8:1 on .subtitle (requires 4.5:1) - -MAJOR (7 issues) - [2.4.11] src/components/Button.tsx:22 - Focus indicator not visible (2px outline required) - [1.3.1] src/components/Form.tsx:31 - Input missing associated