opencode reads the same SKILL.md files but needs its own subagent format and a
TypeScript plugin for the guard, formatter and gate, so install.py converts the
agents and points the copies at this checkout.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Each workflow was ~300 lines of grep-count "VERIFICAR" steps and ran every
phase for every request. Phases now state their minimum tier, checks are the
quality gate plus real tools, detail moved to references/, and machine-specific
paths and non-public skills are gone. Security references move to OWASP Top
10:2025, ASVS 5.0 and the OWASP LLM Top 10.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every workflow used to run all of its phases for any request, so a one-line
fix paid the cost of a feature. dev-router classifies the request into tiers
0-3 with security triggers that raise the tier, and picks the workflow,
agents and gate tier. Agents get only the tools their role needs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Workflows move to skills/<name>/SKILL.md so the repo installs as a plugin.
scripts/quality-gate runs only the checks of the requested tier on the diff
and reports missing tools as unverified instead of passing them. Hooks block
stopping on a failed or stale gate, guard destructive shell commands and
format edited files with the project's own formatter.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wf-frontend had no skill that generates new UI with taste, only ones that
audit it. design-taste-frontend covers new screens and
redesign-existing-projects covers upgrading existing ones.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Quick start told Hermes users to copy the workflows as loose .md files
into ~/.hermes/skills/software-development/. Hermes indexes skills by
walking for SKILL.md, so those files were never listed and never loaded.
Reproduced with the real loader (agent.skill_utils.iter_skill_index_files)
against a scratch HERMES_HOME: the documented command indexed 0 of 5
workflows, the loop now documented indexes 5 of 5.
- README.md / README.pt-BR.md: one loop for both agents, with SKILLS_DIR
swapped for Claude Code; install verification hint (hermes skills list).
- README layout tree: five workflows (wf-readme.md was missing), the whole
vendored skills/ tree, and the actual qa/ contents.
- The snapshot provenance claim listed base-364/v2/v3/v4 as if they lived
in qa/snapshots/, but only baseline-final.json is committed; corrected,
and it is now named as the file the gates read.
- Documented that api-security-review is two unrelated skills sharing one
name (OWASP vendored vs apisec-inc external).
- docs/SKILLS.md: the Claude Code block did mkdir -p "~/.claude/..." with
the tilde inside quotes, which creates a literal "~" directory instead of
expanding; replaced with $HOME. Also corrected the claim that only Claude
Code needs a per-skill directory.
Verified: installing from both documented blocks into a scratch HOME yields
15/15 skills indexed and carries the support files along.
The vendored SKILL.md files were byte-identical to upstream, but the
playbooks, templates and schemas they reference were left behind in the
original repos, so a loading skill pointed at a file that does not exist
anywhere in this repository.
Vendored 1:1 into each skill directory (so they survive
`cp -r skills/* ~/.hermes/skills/`):
- plays/ for api-security-review, code-review-security, sca-audit,
secrets-scan, web-security-review (OWASP/secure-agent-playbook)
- templates/finding.md for the four OWASP skills that cite it
- schemas/finding.schema.json for cve-triage, patch-prioritization,
dependency-scanning (UnitOneAI/SecuritySkills)
- docs/sarif-output.md, docs/fixer-policy.md and
docs/normalized-json-output.md for dependency-scanning
Path fixes, the only edit to vendored text:
- the three UnitOneAI skills referenced ../../../schemas/ and ../../../docs/
which assumed upstream's skills/<category>/<skill>/ depth; this repo is
flat, so the links now resolve inside the skill directory
- safedeps told the agent to run <skill_dir>/../../check_deps.py while the
script is vendored next to SKILL.md; corrected to <skill_dir>/check_deps.py
and documented the script's exit codes (1 = finding, not a crash)
- NOTICE.md records the new files, the path edits, and the remaining known
gaps (hermaguard's kensei-pipeline references, the ASVS dataset citations,
and hermaguard being behind upstream)
Verified: every backticked path in every SKILL.md now resolves;
check_deps.py runs from the installed location and returns live OSV.dev
data ([email protected] -> 2 advisories); hermaguard's 46 tests still pass.
The harness resolved workflows and referenced skills only under
~/.hermes/skills/, so the commands documented in the README ("Quick
start") and in CONTRIBUTING ("Local checks before a PR") produced a
meaningless result on a fresh clone: every workflow scored 0, the gates
reported REPROVADO and the meta-tests failed.
- wf_quality_harness.py: resolve each workflow from the repo
(workflows/<name>.md) first, then from the installed skills dir; resolve
referenced skills from the vendored skills/ tree as well. Report the real
per-workflow cap instead of a fixed 100 (scores were shown as >100%).
- test_quality.py: G3 compared the current score against 2x its own final
value, so it could never pass and made the documented command exit 1.
Moved G3 into the --strict family alongside G2, and updated the stale
docstring (364.1 / 3 workflows -> 1613.2 / 4).
- test_tests.py: meta-test 3 pointed at a path that does not exist in the
repo, so it was skipped in silence (false green). It now resolves the
same path the harness uses and FAILS when the workflow is missing; also
guards the None harness result that previously crashed test 2.
Verified from the clone: harness exit 0, score 1613.2 (matches the
committed snapshot exactly on CPython 3.10 and 3.11); test_quality exit 0
(APROVADO G1,G4,G5); test_tests exit 0 with both mutations detected.
Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.
Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.
New wf-readme workflow (grounded README creation/audit/rewrite) built on
readme-crafter, good-readme and curating-readme skills. Validated with the
QA harness: 302.3 -> 379.0 on the same ruler, all phases verified, no
false-positive skill refs.
Applied it to this repo: audit-repo.sh scan, link/TOC/em-dash validation,
added CONTRIBUTING.md (gap the workflow flagged) and wired the docs.
Add pbakaus/impeccable (v4.1.1, 23 design commands, 59 deterministic
anti-slop rules) to the frontend workflow and READMEs.
Document the QA harness measurements in both READMEs: before/after
workflow scores on the same ruler (total +98.6%), the four green gates,
the meta-tests, and what the refinement added. Full snapshot history
is in qa/snapshots/.
Two versions (EN primary, PT-BR). Hero with badges, TOC, per-skill
explanations with links to each skill's owner, security rationale,
quick start, QA harness section and repo layout.
Removed AI-isms and em-dashes flagged by avoid-ai-writing checks.
Four SKILL.md-based workflows for agent-driven development: frontend/UI,
backend/API, architecture, and security code review.
Each workflow defines phases with verification steps, acceptance criteria
and hard rules so agents deliver work that can be checked instead of
asserted. The security review consults live sources (OSV.dev, GitHub
Advisory, NVD) because model CVE knowledge is frozen at training cutoff.
Includes a QA harness (qa/) that scores workflows on 30+ criteria, a
non-regression gate, and meta-tests that corrupt the harness to prove it
detects regressions.
