0 Fork 0

Files

T

Evandro Fonseca Junior 936ceda102 docs: correct the install instructions and the repository layout

The Quick start told Hermes users to copy the workflows as loose .md files
into ~/.hermes/skills/software-development/. Hermes indexes skills by
walking for SKILL.md, so those files were never listed and never loaded.
Reproduced with the real loader (agent.skill_utils.iter_skill_index_files)
against a scratch HERMES_HOME: the documented command indexed 0 of 5
workflows, the loop now documented indexes 5 of 5.

- README.md / README.pt-BR.md: one loop for both agents, with SKILLS_DIR
  swapped for Claude Code; install verification hint (hermes skills list).
- README layout tree: five workflows (wf-readme.md was missing), the whole
  vendored skills/ tree, and the actual qa/ contents.
- The snapshot provenance claim listed base-364/v2/v3/v4 as if they lived
  in qa/snapshots/, but only baseline-final.json is committed; corrected,
  and it is now named as the file the gates read.
- Documented that api-security-review is two unrelated skills sharing one
  name (OWASP vendored vs apisec-inc external).
- docs/SKILLS.md: the Claude Code block did mkdir -p "~/.claude/..." with
  the tilde inside quotes, which creates a literal "~" directory instead of
  expanding; replaced with $HOME. Also corrected the claim that only Claude
  Code needs a per-skill directory.

Verified: installing from both documented blocks into a scratch HOME yields
15/15 skills indexed and carries the support files along.

2026-09-14 07:40:27 -03:00

6.1 KiB

Raw Blame History

Skills usadas e de onde vieram

Este é o inventário do que os workflows carregam. Cada skill é um diretório com um SKILL.md dentro, e esse diretório é obrigatório nos dois agentes (a skill é <nome>/SKILL.md, nunca um .md solto, que não é indexado): no Hermes Agent, em ~/.hermes/skills/<nome>/SKILL.md; no Claude Code, em ~/.claude/skills/<nome>/SKILL.md.

Workflows orquestradores (em `workflows/`)

Workflow	Para quê
`wf-frontend`	UI/design/PDF
`wf-backend`	API/backend seguro
`wf-architecture`	Arquitetura/ADR/C4
`wf-security-review`	Code review de segurança front+back
`wf-readme`	Criar/auditar/reescrever READMEs grounded

README (wf-readme)

Skill	Origem	O que faz
`readme-crafter`	linhai0872/readme-crafter-skill	Classifica projeto (tipo/público/temperamento) e gera README sob medida; 13 checks
`good-readme`	adewale/good-readme	Cria com exemplos reais OU audita contra 22 critérios (escala 100)
`curating-readme`	liang-senbei/curating-readme	Padroniza README + docs (CONTRIBUTING/CHANGELOG) com `audit-repo.sh`

Pilar de segurança (wf-security-review)

Vendorizadas neste repo em skills/<nome>/ — ver skills/NOTICE.md pra origem exata (commit + licença) de cada uma. Não precisa clonar nada externo pra este pilar.

Skill	Origem	O que faz
`safedeps`	Jeneidi/safedeps	Consulta OSV.dev em tempo real; CVE por `package@version` com severidade e versão de fix. Inclui o script `check_deps.py`
`sca-audit`	OWASP/secure-agent-playbook	SCA de dependências com análise de alcance (reachability), mapeamento CWE
`code-review-security`	OWASP/secure-agent-playbook	Code review de segurança sistemático mapeado a OWASP Top 10 + ASVS
`secrets-scan`	OWASP/secure-agent-playbook	Detecta credenciais/API keys no código e no git history
`api-security-review`	OWASP/secure-agent-playbook	Revisão de API contra OWASP API Security Top 10
`web-security-review`	OWASP/secure-agent-playbook	Web app contra OWASP Top 10 (2021)
`cve-triage`	UnitOneAI/SecuritySkills	Prioriza CVE por CVSS 4.0 / EPSS / CISA KEV
`patch-prioritization`	UnitOneAI/SecuritySkills	Decide a ordem de remediação
`dependency-scanning`	UnitOneAI/SecuritySkills	Varredura de dependências

Frontend / UI / design (wf-frontend)

Skill	Origem	O que faz
`frontend-design`	anthropics/skills	Direção visual, tipografia, fugir do genérico
`web-design`	KAOPU-XiaoPu/web-design	Estética web coesa
`vercel-react-best-practices`	vercel-labs/agent-skills	40+ regras de perf React/Next
`vercel-composition-patterns`	vercel-labs/agent-skills	Compound components, composição
`animate`	emilkowalski/skill	Motion com propósito
`impeccable`	pbakaus/impeccable	Vocabulário de design: 23 comandos + 59 regras determinísticas anti-slop
`anti-ai-slop`	local	Detecta padrão visual "gerado por IA"
`avoid-ai-writing`	conorbronsdon/avoid-ai-writing	Remove AI-isms de texto/microcopy

Backend / API (wf-backend)

Skill	Origem	O que faz
`secure-coding`	v6x/secure-coding-skill	Padrões de codificação segura em 15 stacks
`bola-detector`	apisec-inc/apisec-skills	Detecta object-level authorization (OWASP API1)
`auth-rbac-scaffold`	apisec-inc/apisec-skills	Auth/RBAC (OWASP API2/API5)
`injection-checker`	apisec-inc/apisec-skills	Injection SQL/ORM/shell (OWASP API8)
`openapi-hardener`	apisec-inc/apisec-skills	Saneia schemas OpenAPI/Zod (OWASP API3)
`api-security-review`	apisec-inc/apisec-skills	Review completo OWASP API Top 10
`security-test-generator`	apisec-inc/apisec-skills	Gera testes de segurança

Arquitetura (wf-architecture)

Skill	Origem	O que faz
`system-design`	Kotivskyi/architecture-governance-skills	Framework HelloInterview de system design
`c4-architecture`	Kotivskyi/architecture-governance-skills	Diagramas C4 (Mermaid/Structurizr)
`isaqb-architecture-governance`	Kotivskyi/architecture-governance-skills	arc42 + ADR
`secure-architecture-governance`	Kotivskyi/architecture-governance-skills	Threat model STRIDE+CIA, S-ADR

Caça de bugs (todas)

Skill	Origem	O que faz
`hermaguard`	Sahil-SS9/hermaguard	Review adversarial: pre-scan + 3 agentes (edge cases, ataque, blast radius)

Como instalar as skills de origem

Pilar de segurança: já vem vendorizado em skills/ neste repo — sem clone externo. Copie direto:

# Hermes Agent:
cp -r skills/* ~/.hermes/skills/

# Claude Code (cada skill no seu próprio diretório):
mkdir -p "$HOME/.claude/skills"
for d in skills/*/; do
  cp -r "$d" "$HOME/.claude/skills/"
done

Os arquivos de apoio que cada skill referencia (plays/, templates/, schemas/, docs/) ficam dentro do diretório da própria skill, então o cp -r os leva junto. Origem e licença de cada um: skills/NOTICE.md.

Frontend/backend/arquitetura (ainda não vendorizadas, instalam de fora): a maioria via npx skills (formato agentskills.io):

npx skills add anthropics/skills --skill frontend-design
npx skills add vercel-labs/agent-skills --skill vercel-react-best-practices
npx skills add conorbronsdon/avoid-ai-writing
npx skills add https://github.com/pbakaus/impeccable --skill impeccable

6.1 KiB Raw Blame History