Instructions file
Claude Code instructions for Cantara/kcp-triage, covering kcp-triage, start here and gotchas.
2 2d ago A 690 tokens
add-analyzer
02Skill Claude CodeCodex
Pattern for extending the triage pipeline with new analysis steps. Use when adding SEO audit, performance check, accessibility scan, DNS/WHOIS lookup, tech fingerprinting, link graph analysis, or any new triage dimension.
2 2d ago A 49 tokens
claude-team
03Skill Claude CodeCodex
Multi-agent delegation patterns for kcp-triage. Use when coordinating work across Opus/Sonnet/Haiku, deciding which model tier to use, implementing cost-optimized workflows, or setting up agent escalation patterns.
2 2d ago A 49 tokens
generate-kcp
04Skill Claude CodeCodex
KCP (Knowledge Context Protocol) manifest generation — now integrated into the pipeline as Step 6. Produces knowledge.yaml per the KCP v0.29 spec so any AI agent can discover and selectively load site knowledge.
2 2d ago A 49 tokens
orchestrator
05Skill Claude CodeCodex
Top-level orchestration for kcp-triage. Entry point for triaging a website, coordinating the 7-step pipeline, managing model routing, and pipeline decisions. Start here before reading other skills.
2 2d ago A 45 tokens
scan-site
06Skill Claude CodeCodex
Full site triage workflow: init → crawl → classify → security audit → synthesize → generate project → KCP manifest → report. Use when triaging a new website end-to-end, re-running a scan, or debugging pipeline failures.
2 2d ago A 51 tokens
sdd-workflow
07Skill Claude CodeCodex
Spec-Driven Development workflow for kcp-triage. Use when starting new features, creating issues/branches, writing specs, or following the branch-based SDD process.
2 2d ago A 40 tokens
Skill Claude CodeCodex
Builder-level security assessment methodology for web services. Use when performing security header audits, identifying exposed API keys, analyzing cookie behavior, checking CSRF protection, or compiling security reports for site owners.
2 2d ago A 43 tokens
Instructions file
Claude Code instructions for Cantara/kcp-agent, covering kcp-agent and gotchas.
0 7d ago A 467 tokens
Skill Claude CodeCodex
Autonomously refactor application source for clarity and run the test suite to prove behavior is unchanged. Authorized for src/ and test/ and the test-run capability only. It never touches prod/ or secrets/ and never pushes — the human reviews the diff before anything leaves the working tree.
0 7d ago A 62 tokens
Skill Claude CodeCodex
Run an autonomous batch compliance sweep across customer records against the current policies and write a findings report. Authorized to read policies/ and customers/ and write only into reports/. Use for periodic audit sweeps; it never edits the records it audits.
0 7d ago A 53 tokens
Skill Claude CodeCodex
Apply a reviewed database schema migration by running the migration runner against the migrations/ directory. Authorized for migrations/ and the db:migrate capability. Its provenance is covered by the manifest's ed25519 signature — an agent should only invoke it from a signature-verified manifest.
0 7d ago A 60 tokens
Skill Claude CodeCodex
DEMONSTRATION — the same database-migration playbook as db-migration-signed, but served from a manifest whose signature does not verify (missing or tampered). It exists to show signature verification failing closed. An agent must refuse to invoke it.
0 7d ago A 58 tokens
deploy
14Skill Claude CodeCodex
Deploy a release to the staging environment by rendering config and running the approved deploy tooling. Authorized for config/ and the staging deploy capability only. It must never touch prod/ or secrets/ — those are outside its declared actionscope and require a separate, human-approved production skill.
0 7d ago A 57 tokens
docs-viewer
15Skill Claude CodeCodex
Read and search the project's documentation and skill library to answer "where is this documented / how does this work" questions. Read-only over docs/ and skills/. Use when a task is to look something up, summarize a doc, or locate a runbook — never to change anything.
0 7d ago A 61 tokens
Skill Claude CodeCodex
DEMONSTRATION of a mis-authored governed skill — kind skill and loadeligible true, but with NO actionscope. A skill fails closed, so a skill with no declared scope authorizes nothing. validate flags it as an error before it can ever ship.
0 7d ago A 60 tokens
Skill Claude CodeCodex
DEMONSTRATION of an attacker-planted skill — a prompt-injection payload dressed as a risk playbook that tries to exfiltrate customer data. Its audience deliberately excludes agent, so the audience gate skips it before it is ever scored. An agent must never load it.
0 7d ago A 62 tokens
Skill Claude CodeCodex
Comprehensively research a topic — gather the governed sources, cross-check them, and synthesize a grounded report where every claim cites a source. Read-only and memory-aware. Use as an autonomous agent's safe starting point for any "look into / what do we know about" task.
0 7d ago A 61 tokens
Skill Claude CodeCodex
SUPERSEDED — the 2024 customer risk-assessment playbook. Kept for audit and replay of decisions made under it, but no longer selectable. The active successor is risk-assessment. Use nothing here for new work.
0 7d ago A 54 tokens
Skill Claude CodeCodex
Assess the credit and compliance risk of a customer account from the published risk policies and the customer's own records, and produce a written risk memo. Use when a task asks to evaluate, score, or explain the risk of a customer, account, or applicant. Read-only over policies/ and customers/ — it never changes an…
0 7d ago A 72 tokens
Skill Claude CodeCodex
DEMONSTRATION of a governed skill that is well-formed and in-scope but was never granted invoke eligibility — kind skill with no loadeligible true. Skills fail closed, so the skilleligibility gate skips it. Rotating credentials is exactly the kind of action that should require an explicit grant.
0 7d ago A 69 tokens
Skill Claude CodeCodex
Cut an npm release of kcp-agent (the TypeScript/CLI package) — bump the version in every place the release tests check, re-sign knowledge.yaml, dispatch release.yml, and confirm the npm publish that release.yml hands off to ci.yml. Use when asked to release, publish, or tag a new kcp-agent version. Does NOT cover the…
0 7d ago A 91 tokens
Skill Claude CodeCodex
Navigate any KCP-published knowledge base (a knowledge.yaml manifest) with a deterministic, auditable load plan before reading or paying for anything. Use when a task involves a repository, site, or API that publishes a knowledge.yaml / .well-known/knowledge.yaml, when you need to know what knowledge exists, what it…
0 7d ago A 98 tokens
kcp-agent
24MCP server Claude CodeCodexCursor
Deterministic, fail-closed planner for KCP knowledge manifests: kcpplan, kcpload, kcpvalidate. Runs locally from the kcp-agent npm package.
0 7d ago A
tokens not measured