feat!: add public skill references and bump plugin to v3.0.0

CLAUDE.md

@@ -1,6 +1,6 @@
 # Dev Best Practices
 
-This repo contains best-practice rules for software projects (RAG systems, AI agents, data pipelines, full-stack web apps) and a **Claude Code Plugin** with 24 skills.
+This repo contains best-practice rules for software projects (RAG systems, AI agents, data pipelines, full-stack web apps) and a **Claude Code Plugin** with 26 skills.
 
 ## Repo Structure
 
@@ -10,7 +10,7 @@ This repo contains best-practice rules for software projects (RAG systems, AI ag
 
 plugins/dev/
   .claude-plugin/
-    plugin.json             # Plugin metadata (name: "dev", version: "2.0.0")
+    plugin.json             # Plugin metadata (name: "dev", version: "3.0.0")
   commands/                 # Slash command definitions (one file per skill)
   skills/                   # Skill workflow definitions (auto-triggered)
   rules/                    # Mirror of claude/*.md (used by skills as reference)
@@ -37,8 +37,10 @@ scripts/
 
 ```text
 DESIGN:  design-app, design-secure, design-api, design-data, design-migration,
-         design-ux, design-llm, design-observability, design-cicd, design-iac
-REVIEW:  review-app, review-arch, review-secure, review-ux, review-llm
+         design-ux, design-llm, design-observability, design-cicd, design-iac,
+         design-public
+REVIEW:  review-app, review-arch, review-secure, review-ux, review-llm,
+         review-public
 TOOLS:   tool-debug, tool-test, tool-style, tool-a11y, tool-perf
 META:    meta-help, meta-install, meta-drift, meta-sync, meta-create-skill
 ```

plugins/dev/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dev",
-  "version": "2.0.0",
-  "description": "24 Skills für Design (inkl. LLM-Engineering/RAG/Agents, Observability/SRE, CI/CD, IaC/GitOps, UX/Human-AI Interaction), Security-Review (ISEC/Stanford/MIT, OWASP LLM Top 10), App-Audit (OWASP ASVS 5.0, DORA), Architektur-Review, Debug, Test, Styling, Accessibility (WCAG 2.2), Performance Engineering (MIT 6.172, USE Method) und Skill-Erstellung.",
+  "version": "3.0.0",
+  "description": "26 Skills für Design (inkl. LLM-Engineering/RAG/Agents, Observability/SRE, CI/CD, IaC/GitOps, UX/Human-AI Interaction, Repo-Publication), Security-Review (ISEC/Stanford/MIT, OWASP LLM Top 10), App-Audit (OWASP ASVS 5.0, DORA), Architektur-Review, Debug, Test, Styling, Accessibility (WCAG 2.2), Performance Engineering (MIT 6.172, USE Method) und Skill-Erstellung.",
   "author": { "name": "Gerald" }
 }

plugins/dev/skills/design-public/references/industry-sources.md

@@ -0,0 +1,68 @@
+# Industry Sources — Repo Public Scan
+
+Canonical, authoritative sources for repository publication security.
+Academic coverage of this topic is sparse; these industry standards are the
+primary knowledge base.
+
+## Tier 1 — Primary Specifications (highest authority)
+
+| Source | URL | What it covers |
+|---|---|---|
+| **OpenSSF Best Practices Badge** | https://bestpractices.coreinfrastructure.org | Full checklist for open source project health: SECURITY.md, signed commits, vulnerability reporting, CI, tests |
+| **GitHub Security Hardening Docs** | https://docs.github.com/en/code-security | Platform-specific controls: secret scanning, Dependabot, branch protection, push protection |
+| **SLSA Framework v1.0** | https://slsa.dev/spec/v1.0 | Supply chain security levels L1-L3; provenance requirements; build isolation |
+| **Sigstore Documentation** | https://docs.sigstore.dev | Keyless signing via Fulcio/Rekor; cosign usage |
+| **OpenSSF Scorecard** | https://github.com/ossf/scorecard | Automated scoring: branch protection, pinned deps, CI hardening, signed releases |
+| **OpenSSF CVD Guide** | https://github.com/ossf/oss-vulnerability-guide | Coordinated Vulnerability Disclosure for open source; SECURITY.md templates |
+
+## Tier 2 — Government & Standards Bodies
+
+| Source | URL | What it covers |
+|---|---|---|
+| **CISA Security-by-Design** | https://www.cisa.gov/resources-tools/resources/secure-by-design | Hardening principles for software publishers; supply chain recommendations |
+| **NIST SSDF SP 800-218** | https://csrc.nist.gov/publications/detail/sp/800-218/final | Secure Software Development Framework; source code management controls |
+| **OWASP DevSecOps Guideline** | https://owasp.org/www-project-devsecops-guideline | CI/CD security, SAST/DAST/SCA integration, secrets management |
+| **CIS Benchmark for GitHub** | https://www.cisecurity.org/cis-benchmarks | GitHub settings hardening checklist — search "GitHub" on this page (requires free CIS account to download) |
+| **ENISA — Open Source Software Security** | https://www.enisa.europa.eu | EU perspective on OSS supply chain risks — search "open source" in ENISA publications |
+
+## Tier 3 — Industry Reports (data-driven)
+
+| Source | What it covers | Cadence |
+|---|---|---|
+| **GitGuardian State of Secrets Sprawl** | Annual statistics on leaked credentials in public repos; detection rates | Annual |
+| **Snyk State of Open Source Security** | Vulnerability trends in OSS dependencies; SCA data | Annual |
+| **OpenSSF Alpha-Omega Project** | Investments in OSS security; most critical packages | Ongoing |
+
+## Tool Documentation
+
+| Tool | URL | Purpose |
+|---|---|---|
+| **gitleaks** | https://github.com/gitleaks/gitleaks | Secret detection in git history (150+ patterns, entropy) |
+| **truffleHog** | https://github.com/trufflesecurity/trufflehog | Secret detection with live credential verification (800+ detectors) |
+| **git-filter-repo** | https://github.com/newren/git-filter-repo | History rewriting (recommended over BFG for new projects) |
+| **BFG Repo-Cleaner** | https://rtyley.github.io/bfg-repo-cleaner | Fast history rewriting for large repos |
+| **pin-github-action** | https://github.com/mheap/pin-github-action | Automate SHA pinning of GitHub Actions |
+| **cosign** | https://github.com/sigstore/cosign | Keyless artifact signing via Sigstore |
+| **pip-audit** | https://github.com/pypa/pip-audit | Python dependency vulnerability scanning (SCA) |
+
+## Key Findings from Research (adversarially verified)
+
+1. **Secret scanning is free + automatic on public GitHub repos** — but only after the repo is already public. Pre-publication scan with gitleaks/truffleHog is essential.
+
+2. **Deleting from HEAD is not remediation** — git's immutable history preserves the leak in every clone and fork. `git-filter-repo` or BFG required.
+
+3. **SECURITY.md belongs in root, /docs, or /.github/** — only these locations populate GitHub's Security Policy tab.
+
+4. **SLSA L2 is achievable with GitHub Actions** — hosted runners + `slsa-framework/slsa-github-generator` provide signed provenance without custom infrastructure.
+
+5. **Sigstore keyless signing** — ephemeral X.509 certs (10 min TTL) via Fulcio, bound to OIDC identity. No long-lived key management required.
+
+## License Resources
+
+| Resource | URL |
+|---|---|
+| SPDX License List | https://spdx.org/licenses/ |
+| choosealicense.com | https://choosealicense.com |
+| OSI Approved Licenses | https://opensource.org/licenses |
+| EUPL (EU Public License) | https://joinup.ec.europa.eu/collection/eupl |
+| License compatibility matrix | https://choosealicense.com/appendix/ |

plugins/dev/skills/design-public/references/scan-checklist.md

@@ -0,0 +1,174 @@
+# Scan Checklist — Commands & Patterns
+
+## Secrets Detection
+
+### Tools
+
+```bash
+# gitleaks — full history scan
+gitleaks detect --source . --log-opts="--all" \
+  --report-format json --report-path gitleaks-report.json
+
+# truffleHog — live credential verification
+trufflehog git file://. --only-verified --json > trufflehog-report.json
+
+# git native — find files that should never have been committed
+git log --all --full-history -- '*.env' '*.pem' '*.key' '*.p12' '*.pfx' \
+  '*secret*' '*password*' '*credential*' '*token*' 'id_rsa' 'id_ed25519'
+```
+
+### Common Secret Patterns (manual grep fallback)
+
+```bash
+# AWS keys
+grep -rEn 'AKIA[0-9A-Z]{16}' .
+
+# Generic API key patterns
+grep -rEn '(api_key|apikey|api-key)\s*[=:]\s*["\x27][A-Za-z0-9_\-]{20,}' . --include="*.py,*.ts,*.js,*.yaml,*.yml,*.json"
+
+# Private key headers
+grep -rn 'BEGIN (RSA|EC|OPENSSH|PRIVATE) PRIVATE KEY' .
+
+# Bearer tokens
+grep -rEn 'Bearer\s+[A-Za-z0-9\-._~+/]+=*' . --include="*.py,*.ts,*.js"
+
+# Password assignments
+grep -rEn '(password|passwd|pwd)\s*=\s*["\x27][^"\x27]{6,}["\x27]' . \
+  --include="*.py,*.ts,*.js,*.env,*.yaml,*.yml"
+
+# Database connection strings with credentials
+grep -rEn '(mysql|postgres|mongodb|redis):\/\/[^:]+:[^@]+@' .
+
+# GitHub/GitLab tokens
+grep -rEn 'gh[pousr]_[A-Za-z0-9_]{36}|glpat-[A-Za-z0-9\-_]{20}' .
+```
+
+---
+
+## PII Patterns
+
+### Phone Numbers
+
+```bash
+# AT/DE/CH international
+grep -rEn '(\+43|\+49|\+41|0043|0049|0041)[0-9\s\-/()]{7,15}' \
+  tests/ fixtures/ data/ seeds/
+
+# Generic 10+ digit numbers (catches most international formats)
+grep -rEn '\b[0-9]{3,4}[\s\-.]?[0-9]{3,4}[\s\-.]?[0-9]{3,6}\b' \
+  tests/ fixtures/ --include="*.json,*.csv,*.sql"
+```
+
+### Email Addresses
+
+```bash
+# Any email that isn't a known test domain
+grep -rEn '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' \
+  tests/ fixtures/ data/ seeds/ | \
+  grep -v '@example\.\|@test\.\|@localhost\|@invalid\.'
+```
+
+### Austrian/German-Specific
+
+```bash
+# IBAN AT/DE
+grep -rEn '(AT|DE)[0-9]{2}\s?[0-9]{4}\s?[0-9]{4}\s?[0-9]{4}\s?[0-9]{4}(\s?[0-9]{4})?' \
+  tests/ fixtures/ data/
+
+# Austrian Sozialversicherungsnummer
+grep -rEn '\b[0-9]{3,4}[\s-]?[0-9]{6}\b' tests/ fixtures/
+
+# Austrian ZMR-Zahl (Zentrales Melderegister)
+grep -rEn '\b[0-9]{12}\b' tests/ fixtures/
+
+# Steueridentifikationsnummer
+grep -rEn '\b[0-9]{2}-[0-9]{3}/[0-9]{4}\b|\b[0-9]{9}\b' tests/ fixtures/
+```
+
+### IP Addresses (non-private)
+
+```bash
+# Public IPs (excludes RFC 1918 private ranges)
+grep -rEn '\b(?!10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|0\.)([0-9]{1,3}\.){3}[0-9]{1,3}\b' \
+  tests/ fixtures/ data/
+```
+
+---
+
+## Safe Test Data Replacements
+
+| Category | Safe value | Standard |
+|---|---|---|
+| Phone (AT) | `+43 800 000000` | ÖTK reserved number |
+| Phone (DE) | `+49 800 0000000` | BNetzA reserved |
+| Email | `test@example.com` | RFC 2606 |
+| Email | `noreply@example.org` | RFC 2606 |
+| Name (AT/DE) | `Max Mustermann` / `Erika Musterfrau` | Standard Testperson |
+| IBAN (AT) | `AT12 3456 7890 1234 5678` | Invalid checksum |
+| IBAN (DE) | `DE02 3705 0198 0000 0604 40` | Deutsche Bundesbank test |
+| Credit card | `4111 1111 1111 1111` | Visa test (Luhn valid) |
+| IP address | `192.0.2.1` – `192.0.2.254` | RFC 5737 TEST-NET-1 |
+| IP address | `198.51.100.x` / `203.0.113.x` | RFC 5737 TEST-NET-2/3 |
+| Domain | `example.com` / `example.org` / `example.net` | RFC 2606 |
+| URL | `https://www.example.com/path` | RFC 2606 |
+| UUID | `00000000-0000-0000-0000-000000000001` | Obvious test value |
+| Geo coords | `48.2083537, 16.3725042` | Vienna city center (public) |
+
+---
+
+## CI/CD Checks
+
+### Unpinned Actions
+
+```bash
+# Find version-tag pins (should be SHA pins)
+grep -rEn 'uses: [^@]+@v[0-9]' .github/workflows/
+grep -rEn "uses: [^@]+@v[0-9]" .gitlab-ci.yml
+
+# Example fix:
+# actions/checkout@v4  →  actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+# Use: https://github.com/mheap/pin-github-action to automate
+```
+
+### Missing Permissions
+
+```bash
+# Workflows with no explicit permissions block
+grep -rL 'permissions:' .github/workflows/
+# Each result defaults to write-all — reduce to minimum needed
+```
+
+### Secret Exposure in Logs
+
+```bash
+# Secrets echoed directly
+grep -rEn 'echo.*\$\{\{\s*secrets\.' .github/workflows/
+
+# Env var with secret that may be logged
+grep -rEn -A2 'env:' .github/workflows/ | grep 'secrets\.'
+```
+
+### Dependency Scanning Presence
+
+```bash
+# Is any SCA tool configured?
+grep -rEl 'pip-audit|safety|npm audit|yarn audit|trivy|snyk|dependabot|renovate' \
+  .github/workflows/ .github/dependabot.yml 2>/dev/null
+```
+
+---
+
+## .gitignore Coverage Check
+
+```bash
+# Files that should be ignored but aren't
+git check-ignore -v .env .env.local .env.production \
+  *.pem *.key *.p12 *.pfx id_rsa id_ed25519 \
+  node_modules/ __pycache__/ .venv/ venv/ \
+  *.log *.sqlite *.db
+
+# Or check if patterns exist in .gitignore
+for pattern in '.env' '*.pem' '*.key' 'node_modules' '__pycache__' '.venv'; do
+  grep -q "$pattern" .gitignore && echo "✅ $pattern" || echo "❌ MISSING: $pattern"
+done
+```

plugins/dev/skills/meta-help/SKILL.md

@@ -34,32 +34,36 @@ Which skill should start?
  13  review-secure     Security: crypto, injection, memory safety, GDPR/ISO/EU AI Act
  14  review-ux         UX audit: AI anti-patterns, dark patterns, trust design
  15  review-llm        LLM audit: architecture, evals, prompt injection, OWASP LLM Top 10
+ 16  review-public     Repo public scan: secrets in history, PII in tests, governance files, CI/CD hardening
+
+🏗️  DESIGN (continued)
+ 17  design-public     Publication plan: secrets audit, license, governance docs, branch protection, supply chain
 
 🛠️  TOOLS
- 16  tool-debug        Stack-aware root cause analysis with fix suggestions
- 17  tool-test         Write, improve, or plan tests
- 18  tool-style        CSS / design system + visual basics (color, typography, spacing, loading)
- 19  tool-a11y         Accessibility audit: WCAG 2.2, screen reader, EU Accessibility Act
- 20  tool-perf         Performance engineering: USE Method, flamegraph, bottleneck, Bentley Rules
+ 18  tool-debug        Stack-aware root cause analysis with fix suggestions
+ 19  tool-test         Write, improve, or plan tests
+ 20  tool-style        CSS / design system + visual basics (color, typography, spacing, loading)
+ 21  tool-a11y         Accessibility audit: WCAG 2.2, screen reader, EU Accessibility Act
+ 22  tool-perf         Performance engineering: USE Method, flamegraph, bottleneck, Bentley Rules
 
 📁  META
- 21  meta-install        Add best-practice rules to a project CLAUDE.md
- 22  meta-drift          Compare project CLAUDE.md against current rule files
- 23  meta-sync           Keep reference/*.md and claude/*.md in sync
- 24  meta-create-skill   Build a new skill: research, structure, all files
+ 23  meta-install        Add best-practice rules to a project CLAUDE.md
+ 24  meta-drift          Compare project CLAUDE.md against current rule files
+ 25  meta-sync           Keep reference/*.md and claude/*.md in sync
+ 26  meta-create-skill   Build a new skill: research, structure, all files
 
 → Enter a number, or directly describe what you need.
 ```
 
 ## Step 2 — Start Skill
 
-**With a number:** Start skill immediately.  
-**With a description:** Choose the best matching skill, mention it briefly ("→ starting review-secure …"), then start directly.  
+**With a number:** Start skill immediately.
+**With a description:** Choose the best matching skill, mention it briefly ("→ starting review-secure …"), then start directly.
 **With arguments:** Pass to the started skill.
 
 Load and follow exactly: `${CLAUDE_PLUGIN_ROOT}/skills/<chosen-skill>/SKILL.md`
 
 ## Rules
 - Show menu immediately, no intro
 - After the choice: start directly, do not explain or ask again
-- Never load all 24 skills at once — always only the chosen one
+- Never load all 26 skills at once — always only the chosen one

plugins/dev/skills/review-public/references/industry-sources.md

@@ -0,0 +1,7 @@
+# Industry Sources — review-public
+
+Same source library as design-public. Load from:
+`../../../design-public/references/industry-sources.md`
+
+This file exists as a pointer to avoid duplication.
+Both skills draw from the same authoritative sources.

plugins/dev/skills/review-public/references/scan-checklist.md

@@ -0,0 +1,7 @@
+# Scan Checklist — review-public
+
+Same command library as design-public. Load from:
+`../../../design-public/references/scan-checklist.md`
+
+This file exists as a pointer to avoid duplication.
+Both skills share the same scanning commands and PII patterns.