skills

A collection of skills for coding assistants: reusable workflows that define how to approach a specific technical task, with its rules, anti-patterns, and output contract.

Each skill lives in its own directory, with a SKILL.md holding the main workflow and a references/ directory with the type-specific detail that is read on demand.

Index

Skill	What it solves
dev-secure-coding	Writing application code that does not become a security finding later — untrusted input and its sinks, secrets from the environment, failing closed on authorization, and vetting a dependency before adding it. Ships stack references for Python, Go, React, and Angular.
gitlab-vuln-remediation	Remediation of GitLab security findings — SAST, SCA / dependency scanning, and secret detection. Covers the full lifecycle: triage and prioritization, scoped fix, post-fix validation, merge request creation, and finding resolution.

Structure

<skill-name>/
├── SKILL.md              # workflow, principles, and routing
└── references/           # per-type detail, loaded when it applies
    └── *.md

SKILL.md opens with frontmatter declaring name and description. The description is what determines when the skill triggers, so it lists concrete triggers — finding types, identifiers such as CVE or CWE, and the phrasings the task is usually requested with — rather than describing the skill in the abstract.