Conversation
…olution of claude.md and more Signed-off-by: Anderson Leite <anderson.leite@movingimage.com>
…outing - Migrate 5 skills from flat .md to Anthropic official folder-based format (researching-code, planning-solutions, implementing-code, reviewing-code, review-fix) - Implement cost-optimized model routing via `model:` frontmatter field (Opus for research/design/plan/implement, Sonnet for discover/review/security/deploy/observe/retro) - Add two-tier memory system (CLAUDE.md Learnings + auto-memory) - Update /retro to write learnings to both tiers - Archive STATE_MANAGEMENT.md (superseded by lean 5-artifact model) - Add model routing docs to orchestrator, ARCHITECTURE.md, README.md - Update cross-references in COMMAND_USAGE.md and integration-plan.md - Full 10-phase SDLC workflow artifacts in .claude/planning/add-memory-improve-skills/ Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anderson Leite <anderson.leite@secra.de>
- Integrate visual-explainer skill with 8 /visual/* commands (generate-web-diagram, diff-review, plan-review, project-recap, fact-check, generate-slides, generate-visual-plan, share) - Add skill references (CSS patterns, libraries, slide patterns) and HTML templates (architecture, data-table, mermaid, slides) - Create interactive slide deck overview of the SDLC workflow (13 slides: pipeline diagram, security layer, tools, quick start) - Enable GitHub Pages on docs/ with custom domain ai-sdlc.andersonleite.me - Update ARCHITECTURE.md with Visualization Layer section - Update CLAUDE.md with visual commands reference - Update README.md with integrated tools table, slide deck link, visualization commands section, and credits Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anderson Leite <anderson.leite@secra.de>
Signed-off-by: Anderson Leite <anderson.leite@secra.de>
Signed-off-by: Anderson Leite <anderson.leite@secra.de>
…ction - Number all Convention A artifact files by phase (01_DISCOVERY.md through 11_RETROSPECTIVE.md) for clear visual ordering in file browsers - Add /sdlc/continue slash command that auto-detects incomplete workflows in .claude/planning/ and resumes the next phase - Add session start auto-detection instructions to CLAUDE.md so Claude proactively notifies users of incomplete workflows - Update all 14 phase commands, security-analyst agent, templates, schema, and documentation to use the new numbered naming convention - Backward compatible: /sdlc/continue recognizes both STATUS.md and 00_STATUS.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Integrates n8n-MCP (github.com/czlonkowski/n8n-mcp) as a new MCP server option. Users run /n8n/setup on first use to choose hosting (cloud, npx, Docker, local dev) and capabilities (basic docs-only or full instance management), then /n8n to search nodes, browse templates, and manage workflows. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…lide - Add /firecrawl and /firecrawl/setup commands for self-hosted web scraping - Add "Understand First, Code Second" slide explaining discovery/research intelligence - Add dedicated slides for n8n-MCP and Firecrawl integrations - Fix tools table ordering (visual-explainer sub-rows grouped correctly) - Update KPIs: 5→7 integrated tools - Update CLAUDE.md and README.md with Firecrawl documentation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Introduces hybrid BM25 + vector search over AST-indexed codebases: - /retrieval/setup — interactive wizard (Ollama+Milvus local, Zilliz Cloud) - /retrieval — search, index, status, clear commands - researching-code skill: Step 0 queries index before Glob/Grep - implementing-code skill: optional pattern discovery via search_code - Session-start suggestion if claude-context not in settings.json - Off by default — active only when claude-context is in settings.json Security: Milvus bound to 127.0.0.1 (not 0.0.0.0) per audit finding F-02. Includes full SDLC artifacts in .claude/planning/add-semantic-retrieval/. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add claude-context slide (slide 13) to deck — hybrid search, AST chunking, token savings - Add claude-context to tools table (slide 9) and bump tool count to 8 - Add benefits table to README — token savings, cross-file awareness, O(1) search - Add "No semantic code understanding" row to Why This Exists table - Update slide count reference from 13 to 17 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…er integration - New /repo-map command: generates compact structural overview (file tree + top-level symbols) in ≤2K tokens, supports 6 language patterns (TS/JS, Python, Go, PHP, Rust, generic), progressive truncation for large repos - /discover now auto-generates repo map as Step 3, embedded in 01_DISCOVERY.md so users never forget to generate it - researching-code skill upgraded to Level 1→Level 2 hierarchical context loading: reads repo map first, then does targeted search on candidate files - ARCHITECTURE.md updated with Context Engine (Hierarchical) section - README updated with new Hierarchical Repo Context Engine section - Slide deck updated to 18 slides with new context engine slide - CLAUDE.md Quick Reference updated with /repo-map command - Full SDLC planning artifacts included (discovery through retrospective) Inspired by Aider's repo map. Uses Glob + Grep (no MCP required). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…83% savings) Move learnings to .claude/LEARNINGS.md and tool cheat sheets to .claude/QUICK_REFERENCE.md (loaded on demand, not every conversation). Project CLAUDE.md now contains only essential SDLC workflow rules + 2 most recent retro blocks. Update /retro to write full learnings to LEARNINGS.md and abbreviated summaries to CLAUDE.md. Update README with token optimization docs and new file structure. Estimated savings: ~17K tokens per conversation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add retrospective for the CLAUDE.md token optimization work. Update LEARNINGS.md with full learnings, rotate CLAUDE.md to show the 2 most recent retro blocks (add-semantic-retrieval + optimize-token-usage), fix imprecise behavioral guideline wording. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…eranking, context pack Upgrade the hierarchical context engine into a full Code Intelligence Layer with 5 new components, all implemented as prompt instructions (zero deps): - Symbol Index: compact type:name:file:line format (≤1K tokens) generated by /repo-map Step 7 and embedded in 01_DISCOVERY.md by /discover - Dependency Graph: Grep-based import/export tracing for 6 language families, built in-context during /research Step 0b (repos ≥50 files) - Reranking: 3-factor heuristic scoring (keyword 40%, dep proximity 35%, file-type 25%) applied when >5 candidates returned - Context Pack Builder: assembles ≤8 files (seeds + 1-hop imports + tests) with progressive read depth (full/partial/sections) - Session Persistence: cross-session via 01_DISCOVERY.md, intra-session via Claude Code context window (no file cache needed) Key design decisions (ADR-001, ADR-002): - All prompt-based — no new MCP servers or runtime code - Context window as session cache — no .claude/cache/ directory - Smart activation gates — skip graph+reranking for repos <50 files Files modified: researching-code/SKILL.md (v2.0, 190 lines), repo-map.md, discover.md, implementing-code/SKILL.md, ARCHITECTURE.md, CLAUDE.md, LEARNINGS.md, README.md, slide deck. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a new section explaining the Code Intelligence Layer for non-engineers and engineers new to AI/LLM tooling. Includes: - Why it matters: the "new developer on their first day" framing - Step-by-step walkthrough of how senior developers navigate code - Before/after impact comparison table - GPS navigation analogy for the 5-level pipeline - Existing technical details preserved below the new section Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
… repo These SDLC planning artifacts are local workflow state, not deliverables. The files remain on disk but are no longer tracked in git. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Anderson Leite <anderson.leite@secra.de>
Ships a generic defensive security-testing capability integrated with Phase 7a of the SDLC workflow. The /security command now delegates to @security-orchestrator for large/high-risk scopes (composing 39 specialist hunter skills) and falls back to the OWASP/STRIDE checklist for M-sized features. Skill library organized by tier: - Recon (T4): web-recon-passive/active, api-recon, auth-flow-mapper, attack-surface-mapper — produce inventory artifacts every hunter consumes (PASSIVE_RECON.md, ATTACK_SURFACE.md, API_INVENTORY.md, AUTH_FLOWS.md, CONSOLIDATED_ATTACK_SURFACE.md) - Authentication (T1): auth-flaw, session-flaw, jwt, oauth-oidc - Access control (T1): idor, bola-bfla - Injection (T1-T2): sqli, xxe, ssti, command-injection, path-traversal, deserialization — with post-RCE halt contract - Client-side (T1-T2): xss, dom-xss, clickjacking, csrf, open-redirect, cors-misconfig - API-class (T1-T2): graphql, mass-assignment, excessive-data-exposure, rate-limit, owasp-api-top10-tester - Server-side (T1-T2): ssrf, ssrf-cloud-metadata, cache-smuggling (dual-gated staging-only) - Logic + crypto: business-logic, crypto-flaw - Cloud / CI-CD / Secrets (T3): aws-iam (read-only), s3-misconfig, container, gitlab-cicd, secrets-in-code (trufflehog + gitleaks) - Recon-adjacent (T2): subdomain-takeover (detection-only) Every skill: - Reads .claude/security-scope.yaml before any outbound activity and halts on missing/placeholder scope - Tool-profile-scoped (passive / active / cloud-readonly / cicd-readonly / repo-readonly); forbidden tools (sqlmap, metasploit, hydra, nikto, etc.) enforced by validator - Defensive framing throughout — attacker-voice rewritten, every finding has a remediation block - Real payloads/remediation/signatures extracted from methodology notes (references/*.md), not invented - Appends findings to one canonical SECURITY_AUDIT.md using the schema in _shared/finding-schema.md Infrastructure: - .claude/agents/security-orchestrator.md — composes the 39 skills via phase selection - .claude/security-scope.yaml — authorization template (must be populated with real assets before live use) - .claude/skills/SECURITY_SKILLS_README.md — library entry point with tier-grouped inventory + cross-skill dispatch map - .claude/skills/_shared/ — finding-schema, tool-profiles, name-mapping, batch-conversion-prompt, validation spec, security-md-patch - scripts/validate-skills.sh — 0 errors, 0 warnings across 39 skills - pentest-agent-development/notebooklm-notes/ — 41 source methodology notes (kept for regeneration reference) Docs: - README.md: new "Defensive Security Skills Library" section with coverage-by-class table + authorization summary; /security row added to Security Commands table - docs/sdlc-overview-deck.html: Skills KPI bumped 7→46; Phase 7a bullet updated to mention the 39-skill orchestrated deep-dive - CLAUDE.md: "Security Testing Scope and Authorization" rules of engagement section appended Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…tterns Merges upstream hardening (vakaobr commit 65fbd3e) with the sdlc- prefix stripped. Phase 6 (/review) now dispatches five specialists in parallel — architect, qa-reviewer, sre-reviewer, security-analyst, tech-writer — and runs a scoped fix loop (max 3 iterations; only failing specialists re-review). - `.claude/agents/sdlc-orchestrator.md` — hardened autonomous driver with JSON state machine (schema v2.0.0), parallel dispatch contract, risk-level extraction, plan confirmation gate - `.claude/agents/architect.md` — architecture fit, design patterns - `.claude/agents/qa-reviewer.md` — test coverage, regression risk - `.claude/agents/sre-reviewer.md` — reliability, observability, operational readiness - `.claude/agents/tech-writer.md` — docs, changelog, breaking-change detection, API surface - `.claude/sdlc/AGENTIC_WORKFLOW_BEST_PRACTICES.md` — 717-line reference for parallel-review contract, state schema, scoped-fix-loop semantics - `.claude/settings.json` — 14 new allow-list entries for test/audit tooling (pytest, go test, cargo test, bundle exec rspec, govulncheck, pip-audit, bundle audit, cargo audit) + Agent/Glob/Grep/Write - `README.md` — new "Agent Library" section documenting orchestrators vs. specialists, File Organization updated with `.claude/sdlc/` and the 4 new agents, Phase 6 row annotated with specialist agents Security reviewer dispatches map to existing `security-analyst` agent (no duplicate import). Only remaining `sdlc-` reference is the orchestrator's own name field, kept to match the existing global agent. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Anderson Leite <anderson.leite@secra.de>
…-cli
New /cloud/* slash commands for cost estimation, waste detection, and
cross-tool comparison across AWS, Azure, and GCP. Issue-tied by default
(outputs land in .claude/planning/{issue}/) with --adhoc fallback.
- /cloud/aws-doctor-setup, /cloud/aws-cost-estimate, /cloud/aws-waste-scan,
/cloud/aws-trend (aws-doctor wrapper)
- /cloud/cost-cli-setup, /cloud/cost-scan (cloud-cost-cli wrapper,
multi-cloud)
- /cloud/aws-cost-compare (runs both tools, diffs consensus / unique /
conflicting findings)
Hooks:
- /discover suggests setup + scan per detected cloud (AWS/Azure/GCP)
- /deploy-plan gates cloud-provisioning deploys on a cost baseline
artifact and flags Cost-Material deploys
Docs/config:
- README: new Cloud Cost Commands section + file-org tree entries
- Slide deck: 2 new rows in integrations table + dedicated Cloud Cost
Optimization slide; KPI counts refreshed (50+ -> 60+ commands, 8 -> 10
integrated tools)
- settings.json: allowlist entries for aws-doctor, cloud-cost-cli, and
the per-provider auth-check commands
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Anderson Leite <anderson.leite@secra.de>
Integrate Microsoft MarkItDown so the workflow consumes documents as clean Markdown instead of binary/image-rendered content (PDFs are otherwise rendered as images at high token cost). Three entry points: - /markitdown skill + /markitdown/setup wizard — local STDIO MCP server (markitdown-mcp, direct install not Docker so local file: URIs work) - Phase hooks in /discover and the researching-code skill — convert non-plaintext docs before reading; gated by a canonical plaintext deny-list - Harness-level PreToolUse(Read) interceptor (~/.claude/hooks/markitdown-read.sh) — auto-converts documents on any model-initiated Read, in every project; cached, size-guarded (50MB), best-effort fallback to native Read Reproducible install: install-markitdown-interceptor.sh sets up the user-level hook + venv + registration; /markitdown/setup asks before running it. Security (07a hardening): tool not pre-authorized (human-in-the-loop on convert_to_markdown), sensitive-path guard, untrusted-content marker, markitdown-mcp pinned (0.0.1a4), *.converted.md + .venvs gitignored. Known limit: drag-dropped/bare-path files are attached by Claude Code before any hook runs, so they bypass the interceptor — use /markitdown convert <path>. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- New row in the Integrated External Tools table - Dedicated 'MarkItDown Integration' split slide (matches n8n/Firecrawl) - Integrated-tools count 10 → 11 (KPI + subtitle + trend list) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The previous docs commit inadvertently staged a local settings.json; this restores it to match main so the PR does not touch it. MCP server config is written per-machine by /markitdown/setup. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat: layered delivery structure (Spec/Verifier/Loop/Environment)
Reflects the layered-delivery-structure feature on the public overview deck: new 'Four Delivery Layers' slide after the 11-phase workflow, naming the Quality Contract, /roadmap, and /roadmap-run within the layers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Clarify that the 11-phase diagram is grouped by lifecycle flow (Define/Build/ Secure/Ship), while the next slide groups the same phases by purpose (the four Delivery Layers) — so the two 4-way groupings don't read as contradictory. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs(deck): add Delivery Layers slide to the overview deck
…eder) Wraps the open-source lissy93/web-check (MIT) OSINT aggregator as a scope-gated, self-hosted Tier-4 recon skill. It runs ~30 structured checks (TLS/DNS/headers/cookies/tech-stack/subdomains/mail/reputation, plus an active-tier set: ports/traceroute/firewall/crawl/screenshot), normalizes the JSON into the existing recon dossier, and proposes hygiene findings for analyst triage — it enumerates, it does not exploit. Skill brings the container up on demand and tears it down via a managed docker compose; a single driver (scripts/recon.sh) runs the whole pipeline pull -> up -> run -> normalize -> down so steps can't be missed. Authorization discipline matches the rest of the library: - reads .claude/security-scope.yaml first; tier derived from testing_level - PASSIVE checks only unless the asset is testing_level: active - container bound to 127.0.0.1 only; GUI disabled; rate-limit honored - public web-check.xyz forbidden for client targets; tls-labs opt-in only - only self-standing recon facts (expired/weak TLS, leaked creds) promoted to SECURITY_AUDIT.md; everything else stays Suspected and routes to the owning hunter Wiring + docs: - security-orchestrator Phase 1: runs web-check-recon first (always) - web-recon-passive: consumes WEBCHECK.md, focuses on the OSINT depth web-check skips - new recon-webcheck tool profile in _shared/tool-profiles.md - SECURITY_SKILLS_README.md + README.md: skill counts 39 -> 40, recon tables, dispatch pattern Validated end-to-end against a company-owned asset (passive tier): full pull/up/run/normalize/teardown lifecycle, correct subdomain + fingerprint extraction, and accurate hygiene candidates. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat(security): web-check-recon skill (self-hosted OSINT recon feeder)
…sion Extends the defensive security library with 5 skills covering categories the web/API/cloud hunters do not, on a separate manually-driven track (the security-orchestrator does not auto-dispatch them). New skills: - redteam-ad-ops (reference): network-service matrix, AD attack lifecycle, credential-access/OPSEC maps, C2/EDR-evasion, output parsing. Sourced from RedefiningReality/Cheatsheets (MIT per author). - ad-recon-hunter, ad-kerberos-hunter (executable, internal-ad profile): BloodHound/LDAP enumeration -> Kerberoast / AS-REP / delegation. - llm-redteam-hunter (ai-redteam profile): automated garak + PyRIT against first-party LLM endpoints; complements manual /redteam-ai. - mobile-android-hunter (mobile-sast profile): static APK assessment (MobSF + apkleaks). llm/mobile patterns cannibalized from guardian-cli (MIT). Supporting changes: - 3 new tool profiles (internal-ad, ai-redteam, mobile-sast). internal-ad deliberately permits credential attacks/cracking for authorized internal pentests; extra-gated. - security-scope.yaml: new red_team_extension block (all gates default denied: internal_pentest, offline_cracking, impersonation_proof, credential_dumping, domain_dominance, llm_redteam, mobile_testing, ...). - security-orchestrator: out-of-band skills note. - README + SECURITY_SKILLS_README: extension inventory, profiles, track. - validate-skills.sh: exclude reference skill redteam-ad-ops, exempt internal-ad skills from the hashcat ban (sqlmap/metasploit/hydra/nikto stay banned everywhere), and make array-fill bash 3.2-compatible. Validation: 0 errors, 0 warnings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…obile-llm-redteam # Conflicts: # .claude/skills/SECURITY_SKILLS_README.md # .claude/skills/_shared/tool-profiles.md
…team feat(security): add internal-AD, mobile, and LLM red-team skill extension
Adds the stack's first DEFENSIVE/reactive track: digital forensics and incident response, analyzing acquired evidence copies read-only. Skills never acquire, mount read-write, contain, or eradicate. Authored from NIST SP 800-61/800-86, SANS PICERL, and MITRE ATT&CK/D3FEND (not from any awesome-list). New skills: - incident-response (reference): NIST/PICERL lifecycle, evidence handling + chain of custody, triage decision tree, IOC/ATT&CK model, artifact map. - memory-forensics-hunter (dfir-readonly): Volatility 3 over a RAM image (malfind/pslist/psscan/netscan/credential-access). - disk-triage-hunter (dfir-readonly): Sleuth Kit + plaso over a disk image (MFT/registry/Prefetch/persistence, deleted-file recovery, super-timeline). - log-timeline-hunter (dfir-readonly): Chainsaw/Hayabusa Sigma over EVTX + Linux/network logs/PCAP (logon anomalies, lateral movement, C2, timeline). Supporting changes: - New dfir-readonly tool profile (read-only forensic tools; hash-verify before analysis; no acquisition/mount-rw/containment). - New _shared/incident-schema.md output contract (INCIDENT_REPORT.md, IR-FINDING-NNN, evidence register, ATT&CK timeline, IOC table) — DFIR writes here, NOT to SECURITY_AUDIT.md. - security-scope.yaml: new dfir_scope block (incident_response, case_id, evidence_store_path, chain_of_custody_log, allow_live_response, external_sandbox — all default denied). - validate-skills.sh: exclude reference skill incident-response. - README + SECURITY_SKILLS_README: DFIR inventory, profile, track, counts (49 skills / 10 profiles). Validation: 0 errors, 0 warnings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat(security): add DFIR / incident-response extension (4 skills)
…c, cracking First batch of the full-scope red-team-ops layer (for proving impact to clients, not just flagging findings). Authored from PTES / NIST SP 800-115 / HackTricks / GTFOBins / LOLBAS (tool names cross-checked against awesome-pentest, CC-BY-4.0). AV/EDR evasion intentionally excluded; RE / exploit-dev / social-engineering / wireless follow in later batches. New skills: - redteam-ops (reference): PTES engagement phases, ROE + proof-for-clients discipline, external→internal kill-chain, technique/tool map. Grounds the red-team-ops hunters. - network-pentest-hunter (network-pentest): non-web infra — full nmap/rustscan/masscan, SMB/SNMP/NFS/DB/mail enum, default-cred checks, version→CVE + least-damage validation. No online brute force. - host-privesc-hunter (host-privesc): local Linux/Windows privesc on an authorized foothold — PEAS enumeration → GTFOBins/LOLBAS/service/cron/ kernel paths, least-damage proof, no persistence. - cracking-hunter (cracking): offline hashcat/John against captured hashes (AD/JWT/SAM/NTDS); the shared cracking utility for ad-kerberos, jwt, and host-privesc. Supporting changes: - 3 new tool profiles (network-pentest, host-privesc, cracking). - security-scope.yaml: red_team_ops block (network_pentest, network_targets, exploit_validation, scan_rate, host_privesc, offline_cracking, crack_time_budget — all default denied). - validate-skills.sh: exclude redteam-ops reference; exempt cracking profile from the hashcat ban (offline cracking) — hydra/sqlmap/metasploit/ nikto stay banned everywhere. - README + SECURITY_SKILLS_README: red-team-ops inventory, profiles, track; counts now 53 skills / 13 profiles. Validation: 0 errors, 0 warnings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat(security): red-team-ops batch 1 — infra pentest, host privesc, cracking
…-eng, wireless Completes the red-team-ops layer (per the agreed plan; AV/EDR evasion intentionally excluded). Authored from PTES / Ghidra / pwntools / Gophish / aircrack-ng docs (tool names cross-checked vs awesome-pentest CC-BY-4.0). New skills: - reverse-engineering-hunter (reverse-eng): static-first RE of binaries/ firmware (Ghidra/radare2/gdb/binwalk/capa/floss); dynamic only in an isolated sandbox. Feeds exploit-validation-hunter. - exploit-validation-hunter (exploit-validation, service_affecting): confirm exploitability with vetted PoCs / pwntools, replica-first, benign proof, stop at proof. No metasploit/msfvenom, no weaponization. - social-engineering-hunter (social-eng): authorized phishing/awareness (Gophish; evilginx MFA-demo gated). Targets people — separate written consent + approved recipient list; never stores real credentials. - wireless-hunter (wireless, service_affecting, requires_hardware): 802.11 survey, WPA handshake/PMKID capture (→ cracking-hunter), rogue-AP / awareness demos. Runs from a Linux capture host — VM with USB passthrough (primary) or Raspberry Pi 4/5 (documented); never macOS. Built around the honest workshop demo (plaintext DNS / TLS SNI / probe requests / cleartext HTTP), adapter e.g. Alfa AWUS036ACH (RTL8812AU). Supporting changes: - 4 new tool profiles (reverse-eng, exploit-validation, social-eng, wireless). - security-scope.yaml: red_team_ops gates extended (reverse_engineering, re_artifacts, lab_replica, social_engineering + se_consent_ref + se_recipient_list + se_evilginx, wireless + wireless_targets + wireless_workshop_consent + wireless_capture_host). All default denied. - README + SECURITY_SKILLS_README: inventory, profiles, track; counts now 57 skills / 17 profiles. (No validator change — no new reference skills, no banned tools.) Validation: 0 errors, 0 warnings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat(security): red-team-ops batch 2 — RE, exploit validation, social-eng, wireless
- wireless-hunter/references/capture-host-setup.md: runnable checklist for the Linux capture host — Kali VM + USB passthrough (primary; Intel-host vs Apple-Silicon caveats), Raspberry Pi 4/5 (portable alternative), RTL8812AU DKMS driver install, monitor-mode + injection verification, workshop rogue-AP bring-up (honest DNS/SNI/HTTP/probe capture) and teardown, plus a troubleshooting table. Linked from the skill. - security-scope.example.yaml: a fully worked, filled-in scope using reserved example.com/contoso.com domains + RFC-1918 ranges, covering the web/AD/mobile/LLM/red-team-ops/DFIR blocks. NOT live — skills read security-scope.yaml, never this; documented as copy-from-only. README Quickstart points to it. Validation: 0 errors, 0 warnings. Both YAML files parse. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…-scope-example docs(security): wireless capture-host checklist + worked scope example
wireless-hunter/references/workshop-runbook.md — turnkey companion to the capture-host checklist: attendee-facing talk track (~15-20 min), the slide-worthy "what leaked vs what didn't" table (DNS/SNI/probe-requests/ cleartext-HTTP visible; HTTPS bodies not), attendee takeaways (VPN, encrypted DNS, disable auto-join, captive-portal warning), an operator tshark quick-reference, and an ethics/cleanup checklist. Linked from the skill. Honest framing throughout (HTTPS hides contents, not who/what). Validation: 0 errors, 0 warnings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs(security): wireless awareness-workshop runbook
…-portal vs evilginx - capture-host-setup.md: correct the Apple-Silicon nuance — USB passthrough WORKS; the real blocker is the out-of-tree Wi-Fi driver vs guest kernel. Documents the verified finding (Kali arm64 6.19 + realtek-rtl88xxau-dkms is BUILD_EXCLUSIVE -> won't build). Adds an "Adapter selection" table recommending mainline-driver chipsets (MT7612U / AR9271) over the RTL8812AU (AWUS036ACH); makes the driver step chipset-aware. - redteam-ops/references/kali-vm-setup.md (new): reproducible operator-VM build (vmcli + vmx, ISO + checksum, ssh/sudo, full user-level toolset install for every red-team-ops + DFIR hunter). Linked from redteam-ops. - workshop-runbook.md: clarify captive portal (your own HTML, fully customizable) vs evilginx (reverse-proxy that mirrors a real site via phishlets; for MFA-phish proof, not the splash page). Validation: 0 errors, 0 warnings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs(security): adapter guidance + reproducible Kali VM setup + captive-portal/evilginx clarification
Adds wireless-hunter/references/captive-portal/ — a brandable "free wifi" captive portal for awareness workshops with Continue-with-Google/Microsoft/ GitHub buttons. - Safe by default: buttons -> an awareness "gotcha" page (aware.html) explaining AiTM, why OTP/push MFA fails, and that passkeys/FIDO2 are the fix. The portal NEVER stores credentials; it logs only the FACT of a click (timestamp, IP, provider) for click-rates. - portal.py: stdlib-only server (handles OS captive probes, /go redirect, logging, safe-vs-live mode). hostapd.conf + dnsmasq.conf templates. - Opt-in LIVE evilginx (AiTM) wiring documented in README under the social-engineering-hunter gates (se_consent_ref/se_evilginx), test account only, token destruction after proof. README is explicit that evilginx mirrors the REAL provider (phishlets), not a custom-look page, that providers fight AiTM, and that passkeys defeat it. - Tested on the Kali VM: splash renders, /go?provider=google -> 302 /aware (safe mode), captive probes pop the portal, click logged, no creds. - Linked from workshop-runbook.md. Validation: 0 errors, 0 warnings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat(security): workshop captive portal (social-login awareness demo)
… IP geo Reworks the awareness captive portal per workshop feedback: - Linkyfi-style UI; renamed to "Free WiFi Gateway"; real inline-SVG brand logos (Google/Microsoft/GitHub/WhatsApp); added WhatsApp option. - New flow: each button opens a SIMULATED, logo-branded provider login page; on submit the awareness page reveals only the first 4 chars of the password and discards the rest (never logged/stored). - New login.html template + fingerprint.js (client-side). - Device profiling table (client-side): OS+version+arch (arm64), real browser brand (Google Chrome, not Chromium), device, physical screen resolution, timezone, language, GPU, CPU cores, automation flag. - Server-side IP geolocation (ip-api): approx location, ISP, VPN/proxy flag, public IP - resolves the AP uplink on the live rogue AP; degrades gracefully offline. - Side-by-side layout (login card + device box); stacks on mobile with the table below. Button label padding; cleaner inputs. - Removed all em/en dashes. Deployed + verified on the Kali VM. Privacy contract intact: full password truncated to 4 chars, device data display-only, log holds metadata only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat(security): portal redesign - simulated logins, device profiling, IP geo
…blet)' Clearer than 'Desktop'/'Touch', and uses the reliable userAgentData.mobile flag (falls back to UA + touch+small-screen heuristic) so touch laptops aren't misclassified as mobile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(security): portal device label (Computer / Mobile)
Repo-wide sweep replacing em (U+2014) and en (U+2013) dashes with a spaced hyphen across all security skills (hunters, recon, references, _shared, extensions, DFIR, red-team-ops), the security agents, and the scope files, to honor the no-em-dash preference. Mechanical text-only change; arrows (→) and the multiplication sign (×) are untouched. Validation: 0 errors, 0 warnings; both scope YAMLs still parse. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
style(security): remove em/en dashes across the security skill stack
Distilled from the O'Reilly software-architecture catalog (Building Microservices, Software Architecture: The Hard Parts, Learning DDD, Building Evolutionary Architectures, The Software Architect Elevator, and more) into 12 Claude Code skills under .claude/skills/: ddd-context-mapping, semantic-domain-deconstruction, distributed-sagas-and-workflows, contract-first-api-evolution, architectural-fitness-functions, python-architecture-patterns, saas-multi-tenant-isolation, medallion-lakehouse-pipelines, green-ops-sustainability, facilitative-adr-and-governance, sociotechnical-iceberg-analysis, executive-elevator-translation They complement the /design-system, /plan and /implement phases with grounded methodologies. These skills use a different template from the defensive-security library, so validate-skills.sh excludes them (as it already does for the framework skills); README documents the new set. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR extends the original claude-code-ai-development-workflow repository by transforming it from a structured research → plan → implement sequence into a comprehensive 10-phase AI-assisted Software Delivery Lifecycle (SDLC). The enhancements include:
What’s New
10-Phase Workflow covering:
Integration with LLM best practices (from LLM knowledge hub patterns) for:
Value Added
Testing & Validation