OWASP vulnerability patterns, secret detection, and authentication/authorization analysis. Trigger: "security scan", "OWASP check", "secret detection", "auth analysis".

Threat modeling, zero trust design, identity architecture, encryption strategy, and compliance mapping for software systems. Trigger: "security architecture", "threat model", "zero trust", "identity", "encryption", "compliance", "OWASP".

Provides industry context, regulatory landscape analysis, competitive benchmarks, and sector-specific technology trends. Trigger: "industry context", "sector analysis", "regulatory landscape", "benchmarks".

Logging architecture, distributed tracing, metrics design, alerting strategy, SLO/SLI definition, and incident response procedures. Trigger: "observability", "logging", "tracing", "metrics", "alerting", "SLO", "SLI", "incident response".

Engineers quality formatting with ghost menus, progressive disclosure, and excellence standards for technical artifacts. Trigger: "format output", "ghost menu", "progressive disclosure", "output quality", "excellence standards".

Logging, metrics, and tracing completeness analysis across the system. Trigger: "observability gaps", "logging analysis", "metrics coverage", "tracing completeness".

Designs logging, metrics, and distributed tracing architectures using OpenTelemetry and observability platforms. Trigger: "observability design", "logging architecture", "metrics strategy", "distributed tracing", "OpenTelemetry".

This skill should be used when the user asks to "generate QA plan", "refresh QA plan", "check definition of done", "review acceptance criteria", "audit gate status", or "validate quality gates". It generates QA-PLAN.md and qa-plan.json with Definition of Done, acceptance criteria per feature, and G1/G2/G3 gate status. Use this skill whenever the user mentions QA plan, quality gates, DoD, or acceptance criteria.

This skill should be used when the user asks to "create a feature", "select a feature", "list features", "switch feature", "add new feature to project", or "manage features". It creates, selects, and lists features in the specs/ directory with proper numbering and directory structure. Use this skill whenever the user mentions feature creation, feature selection, or feature management.

This skill should be used when the user asks to "show menu", "list all commands", "what commands are available", "show command palette", "help with SDD commands", or "what can SDD do". It displays the interactive command palette organized by category (pipeline, intelligence, utility, experience) with descriptions and aliases. Use this skill whenever the user mentions menu, command list, help, or available commands.

This skill should be used when the user asks to "run sentinel", "check project health", "scan for drift", "detect stale artifacts", "run perceive-decide-act cycle", or "audit pipeline state". It executes a full sentinel cycle (perceive-decide-act) with zero LLM cost to detect stale artifacts, missing files, health regression, and drift from constitution principles. Use this skill whenever the user mentions sentinel, health check, drift detection, or pipeline audit.

SDD Utility — Resolve ambiguities in any artifact at any phase. Enhanced: auto-detect artifact, structured questions per ambiguity taxonomy, RAG capture.

This skill should be used when the user asks to "seed demo data", "generate sample data", "populate project with examples", "create test fixtures", "seed without dashboard", or "just create the demo files". It seeds demo data (3 features with pipeline artifacts) without opening the dashboard. Use this skill when the user wants demo data only, not the full demo experience with dashboard.

SDD Bug report + fix tasks. Enhanced: Quick Flow triage, GitHub issue inbound (#number), scope guard against AP-06 (consecutive quick flows).

SDD Phase 8 — Export tasks to GitHub Issues with labels and dependencies. [GATE G3] Enhanced: mandatory gate, issue-map tracking, cross-check verification.

SDD Phase 7 — Iterative TDD implementation with BDD verification chain. [GATE G2] Enhanced: mandatory gate, step coverage verification, assertion integrity, feature immutability.

SDD Phase 6 — Cross-artifact consistency validation, traceability FR→TS→Tasks. Enhanced: knowledge graph rebuild, orphan detection, health scoring.

This skill should be used when the user asks to "capture input", "save to RAG memory", "index a file", "store reference material", "capture document for context", or "add to knowledge base". It captures session inputs as RAG memory files with frontmatter, abstract, key takeaways, and full content. Workspace-aware routing sends captures to the active workspace's rag/ folder. Use this skill whenever the user mentions capture, RAG, memory indexing, or knowledge base storage.

This skill should be used when the user asks to "create workspace", "list workspaces", "select workspace", "archive workspace", "manage workspace sessions", or "switch task context". It manages per-task workspace sessions with isolated inputs, RAG files, logs, and tasklog per interaction. Use this skill whenever the user mentions workspace, session management, task isolation, or context switching.

This skill should be used when the user asks to "run a demo", "show me how SDD works", "generate a demo project", "create a sample project", "demonstrate the pipeline", or "try SDD with example data". It generates a complete demo project with realistic features, specs, tests, tasks, and opens the dashboard for exploration. Use this skill whenever the user mentions demo, demonstration, sample project, or try SDD.