Each workflow was ~300 lines of grep-count "VERIFICAR" steps and ran every
phase for every request. Phases now state their minimum tier, checks are the
quality gate plus real tools, detail moved to references/, and machine-specific
paths and non-public skills are gone. Security references move to OWASP Top
10:2025, ASVS 5.0 and the OWASP LLM Top 10.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every workflow used to run all of its phases for any request, so a one-line
fix paid the cost of a feature. dev-router classifies the request into tiers
0-3 with security triggers that raise the tier, and picks the workflow,
agents and gate tier. Agents get only the tools their role needs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Workflows move to skills/<name>/SKILL.md so the repo installs as a plugin.
scripts/quality-gate runs only the checks of the requested tier on the diff
and reports missing tools as unverified instead of passing them. Hooks block
stopping on a failed or stale gate, guard destructive shell commands and
format edited files with the project's own formatter.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wf-frontend had no skill that generates new UI with taste, only ones that
audit it. design-taste-frontend covers new screens and
redesign-existing-projects covers upgrading existing ones.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The vendored SKILL.md files were byte-identical to upstream, but the
playbooks, templates and schemas they reference were left behind in the
original repos, so a loading skill pointed at a file that does not exist
anywhere in this repository.
Vendored 1:1 into each skill directory (so they survive
`cp -r skills/* ~/.hermes/skills/`):
- plays/ for api-security-review, code-review-security, sca-audit,
secrets-scan, web-security-review (OWASP/secure-agent-playbook)
- templates/finding.md for the four OWASP skills that cite it
- schemas/finding.schema.json for cve-triage, patch-prioritization,
dependency-scanning (UnitOneAI/SecuritySkills)
- docs/sarif-output.md, docs/fixer-policy.md and
docs/normalized-json-output.md for dependency-scanning
Path fixes, the only edit to vendored text:
- the three UnitOneAI skills referenced ../../../schemas/ and ../../../docs/
which assumed upstream's skills/<category>/<skill>/ depth; this repo is
flat, so the links now resolve inside the skill directory
- safedeps told the agent to run <skill_dir>/../../check_deps.py while the
script is vendored next to SKILL.md; corrected to <skill_dir>/check_deps.py
and documented the script's exit codes (1 = finding, not a crash)
- NOTICE.md records the new files, the path edits, and the remaining known
gaps (hermaguard's kensei-pipeline references, the ASVS dataset citations,
and hermaguard being behind upstream)
Verified: every backticked path in every SKILL.md now resolves;
check_deps.py runs from the installed location and returns live OSV.dev
data ([email protected] -> 2 advisories); hermaguard's 46 tests still pass.
Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.
Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.
