0 Fork 0

Files

T

Evandro Fonseca Junior ee44fa0f7a feat: add wf-readme workflow + skills, validated, applied to this repo

New wf-readme workflow (grounded README creation/audit/rewrite) built on
readme-crafter, good-readme and curating-readme skills. Validated with the
QA harness: 302.3 -> 379.0 on the same ruler, all phases verified, no
false-positive skill refs.

Applied it to this repo: audit-repo.sh scan, link/TOC/em-dash validation,
added CONTRIBUTING.md (gap the workflow flagged) and wired the docs.

2026-08-19 17:37:45 -03:00

5.8 KiB

Raw Blame History

Skills usadas e de onde vieram

Este é o inventário do que os workflows carregam. Cada skill é um diretório com um SKILL.md; para o Hermes Agent, vão em ~/.hermes/skills/.

Workflows orquestradores (em `workflows/`)

Workflow	Para quê
`wf-frontend`	UI/design/PDF
`wf-backend`	API/backend seguro
`wf-architecture`	Arquitetura/ADR/C4
`wf-security-review`	Code review de segurança front+back
`wf-readme`	Criar/auditar/reescrever READMEs grounded

README (wf-readme)

Skill	Origem	O que faz
`readme-crafter`	linhai0872/readme-crafter-skill	Classifica projeto (tipo/público/temperamento) e gera README sob medida; 13 checks
`good-readme`	adewale/good-readme	Cria com exemplos reais OU audita contra 22 critérios (escala 100)
`curating-readme`	liang-senbei/curating-readme	Padroniza README + docs (CONTRIBUTING/CHANGELOG) com `audit-repo.sh`

Pilar de segurança (wf-security-review)

Skill	Origem	O que faz
`safedeps`	Jeneidi/safedeps	Consulta OSV.dev em tempo real; CVE por `package@version` com severidade e versão de fix. Inclui o script `check_deps.py`
`sca-audit`	OWASP/secure-agent-playbook	SCA de dependências com análise de alcance (reachability), mapeamento CWE
`code-review-security`	OWASP/secure-agent-playbook	Code review de segurança sistemático mapeado a OWASP Top 10 + ASVS
`secrets-scan`	OWASP/secure-agent-playbook	Detecta credenciais/API keys no código e no git history
`api-security-review`	OWASP/secure-agent-playbook	Revisão de API contra OWASP API Security Top 10
`web-security-review`	OWASP/secure-agent-playbook	Web app contra OWASP Top 10 (2021)
`cve-triage`	UnitOneAI/SecuritySkills	Prioriza CVE por CVSS 4.0 / EPSS / CISA KEV
`patch-prioritization`	UnitOneAI/SecuritySkills	Decide a ordem de remediação
`dependency-scanning`	UnitOneAI/SecuritySkills	Varredura de dependências

Frontend / UI / design (wf-frontend)

Skill	Origem	O que faz
`frontend-design`	anthropics/skills	Direção visual, tipografia, fugir do genérico
`web-design`	KAOPU-XiaoPu/web-design	Estética web coesa
`vercel-react-best-practices`	vercel-labs/agent-skills	40+ regras de perf React/Next
`vercel-composition-patterns`	vercel-labs/agent-skills	Compound components, composição
`animate`	emilkowalski/skill	Motion com propósito
`impeccable`	pbakaus/impeccable	Vocabulário de design: 23 comandos + 59 regras determinísticas anti-slop
`anti-ai-slop`	local	Detecta padrão visual "gerado por IA"
`avoid-ai-writing`	conorbronsdon/avoid-ai-writing	Remove AI-isms de texto/microcopy

Backend / API (wf-backend)

Skill	Origem	O que faz
`secure-coding`	v6x/secure-coding-skill	Padrões de codificação segura em 15 stacks
`bola-detector`	apisec-inc/apisec-skills	Detecta object-level authorization (OWASP API1)
`auth-rbac-scaffold`	apisec-inc/apisec-skills	Auth/RBAC (OWASP API2/API5)
`injection-checker`	apisec-inc/apisec-skills	Injection SQL/ORM/shell (OWASP API8)
`openapi-hardener`	apisec-inc/apisec-skills	Saneia schemas OpenAPI/Zod (OWASP API3)
`api-security-review`	apisec-inc/apisec-skills	Review completo OWASP API Top 10
`security-test-generator`	apisec-inc/apisec-skills	Gera testes de segurança

Arquitetura (wf-architecture)

Skill	Origem	O que faz
`system-design`	Kotivskyi/architecture-governance-skills	Framework HelloInterview de system design
`c4-architecture`	Kotivskyi/architecture-governance-skills	Diagramas C4 (Mermaid/Structurizr)
`isaqb-architecture-governance`	Kotivskyi/architecture-governance-skills	arc42 + ADR
`secure-architecture-governance`	Kotivskyi/architecture-governance-skills	Threat model STRIDE+CIA, S-ADR

Caça de bugs (todas)

Skill	Origem	O que faz
`hermaguard`	Sahil-SS9/hermaguard	Review adversarial: pre-scan + 3 agentes (edge cases, ataque, blast radius)

Como instalar as skills de origem

A maioria instala via npx skills (formato agentskills.io):

npx skills add anthropics/skills --skill frontend-design
npx skills add vercel-labs/agent-skills --skill vercel-react-best-practices
npx skills add conorbronsdon/avoid-ai-writing
npx skills add https://github.com/pbakaus/impeccable --skill impeccable

As de segurança do OWASP e UnitOne instalam clonando e copiando o diretório da skill:

git clone --depth 1 https://github.com/OWASP/secure-agent-playbook.git
cp -r secure-agent-playbook/plugins/code-security-skills/skills/{sca-audit,secrets-scan} ~/.hermes/skills/

git clone --depth 1 https://github.com/UnitOneAI/SecuritySkills.git
cp -r SecuritySkills/skills/vuln-management/{cve-triage,patch-prioritization} ~/.hermes/skills/

O safedeps precisa do script junto da skill:

git clone --depth 1 https://github.com/Jeneidi/safedeps.git
cp -r safedeps/skills/safedeps ~/.hermes/skills/safedeps
cp safedeps/check_deps.py ~/.hermes/skills/safedeps/

5.8 KiB Raw Blame History