Skills¶
Nescio ships 36 skills in skills/. Each one is a directory holding a
SKILL.md whose YAML frontmatter declares a name, a description, and
whether the skill is user-invocable. Skills are loaded on demand, and the
description is what that decision is made against, so it is reproduced
verbatim below.
Skill names are identifiers, and are set in mono throughout.
At a glance¶
| Group | Skills |
|---|---|
| Security engineering | threat-model, secure-design-spec, secure-code-review, security-architecture-review, api-security-assessment, zero-trust-design, sdlc-security-gates |
| Risk and vulnerability management | risk-assessment, risk-register, vuln-assessment, fix-security-vulnerabilities, sbom |
| Detection and incident response | detection-rule, incident-response-plan, ir-playbook |
| Compliance frameworks | compliance-gap-analysis, iso27001-isms, soc2-report, pci-dss-assessment, hipaa-assessment |
| AI and prompt engineering | llm-application-architecture, rag-system-design, agent-evaluation, prompt-engineering-guide, prompt-evaluation-harness, prompt-testing-plan |
| Development workflow | code-navigation, create-adr, publish-adrs, modular-design, layered-api-design, handle-pr-comments, dependency-pr-ci-fix, gh-milestones-projects, repo-hygiene, adopt-config |
Security engineering¶
threat-model¶
Use when threat modeling a system, feature, or architecture — enumerating attack surfaces, trust boundaries, and mitigations with STRIDE/PASTA/LINDDUN/MITRE ATT&CK. Triggers on "threat model", "attack surface", "trust boundary", "abuse cases".
secure-design-spec¶
Use when writing a secure design specification for a new system or feature — defining security requirements, authentication, authorization, encryption, and trust assumptions at design time with OWASP Secure Design Principles/Microsoft SDL/NIST SSDF. Triggers on "secure design spec", "security requirements", "security by design", "least privilege", "data classification".
skills/secure-design-spec/SKILL.md
secure-code-review¶
Use when reviewing source code for security vulnerabilities — auditing authentication, authorization, cryptography, and input validation, and classifying findings by CWE. Triggers on "secure code review", "SAST findings", "CWE Top 25", "OWASP ASVS", "vulnerability review".
skills/secure-code-review/SKILL.md
security-architecture-review¶
Use when reviewing a system's security architecture — assessing control coverage, defense-in-depth layers, single points of failure, and zero-trust alignment with TOGAF/SABSA/NIST SP 800-160. Triggers on "security architecture review", "defense in depth", "control coverage", "zero trust", "north-south east-west traffic".
skills/security-architecture-review/SKILL.md
api-security-assessment¶
Use when assessing the security of an API — testing for BOLA/broken object-level authorization, broken authentication, excessive data exposure, rate limiting, and JWT flaws against the OWASP API Security Top 10 and OAuth 2.0/OIDC. Triggers on "API security assessment", "OWASP API Top 10", "BOLA", "JWT validation", "rate limiting".
skills/api-security-assessment/SKILL.md
zero-trust-design¶
Use when designing a zero trust architecture — microsegmentation, identity-aware proxies, continuous authentication, and policy decision points per NIST SP 800-207, CISA Zero Trust Maturity Model, and BeyondCorp. Triggers on "zero trust", "ZTA", "microsegmentation", "never trust always verify", "identity-aware proxy", "lateral movement".
skills/zero-trust-design/SKILL.md
sdlc-security-gates¶
Use when defining or auditing security gates across the SDLC — mandatory checkpoints at design, code, build, test, and deploy with SAST/DAST/SCA/secrets scanning in CI/CD using Microsoft SDL/OWASP SAMM/NIST SSDF. Triggers on "SDLC security gates", "DevSecOps", "CI/CD security", "gate pass rate", "shift left".
skills/sdlc-security-gates/SKILL.md
Risk and vulnerability management¶
risk-assessment¶
Use when performing a cybersecurity risk assessment — identifying threats, scoring likelihood and business impact, separating inherent from residual risk, and quantifying exposure. Triggers on "risk assessment", "threat likelihood", "inherent risk", "residual risk", "FAIR", "NIST SP 800-30", "ISO 27005", "OCTAVE".
skills/risk-assessment/SKILL.md
risk-register¶
Use when building or maintaining a risk register — logging risks with named owners, inherent and residual scores, treatment decisions (Accept/Mitigate/Transfer/Avoid), and tracking open/overdue items. Triggers on "risk register", "risk owner", "residual risk", "risk treatment", "risk score", "ISO 31000", "risk log".
vuln-assessment¶
Use when producing a vulnerability assessment report — scoring, prioritizing, and remediating findings with CVSS v4.0, EPSS, CISA KEV, CIS Controls v8.1, and NIST SP 800-40. Triggers on "vulnerability assessment", "vuln scan report", "CVE prioritization", "patch compliance", "remediation plan".
skills/vuln-assessment/SKILL.md
fix-security-vulnerabilities¶
Use when working on dependency vulnerabilities, security advisories, Dependabot or Snyk PRs, GitHub security alerts, or Azure DevOps vulnerability work items — to triage, prioritize, and prepare fixes. Triggers on "fix vulnerabilities", "dependabot", "snyk", "security alerts", "CVE remediation", "dependency update plan", "audit fix".
skills/fix-security-vulnerabilities/SKILL.md
sbom¶
Use when generating or reviewing a software bill of materials — component inventory, transitive dependencies, license compliance, and CVE cross-referencing with CycloneDX, SPDX, NTIA Minimum Elements, and SLSA. Triggers on "SBOM", "software bill of materials", "dependency inventory", "CycloneDX", "SPDX", "supply chain security".
Detection and incident response¶
detection-rule¶
Use when authoring a SIEM detection rule or use case — mapping to MITRE ATT&CK techniques, writing Sigma rules, and tuning false positives for Splunk/Elastic/Sentinel. Triggers on "detection rule", "SIEM use case", "Sigma rule", "ATT&CK detection", "alert tuning", "detection engineering".
skills/detection-rule/SKILL.md
incident-response-plan¶
Use when building an incident response plan — classification levels (P1-P4), escalation criteria, roles, and communication templates aligned to NIST SP 800-61, SANS, and ISO 27035. Triggers on "incident response plan", "IR plan", "incident classification", "escalation criteria", "MTTD", "MTTR", "CSIRT".
skills/incident-response-plan/SKILL.md
ir-playbook¶
Use when writing a scenario-specific incident response playbook — ransomware, phishing, data breach, insider threat, or DDoS — with containment steps, exact commands, and decision trees per NIST SP 800-61, SANS PICERL, MITRE ATT&CK, and D3FEND. Triggers on "IR playbook", "runbook", "ransomware response", "containment steps", "PICERL".
Compliance frameworks¶
compliance-gap-analysis¶
Use when running a compliance gap analysis against a framework — assessing current vs target control state, mapping controls across frameworks, scoring coverage, and estimating remediation effort. Triggers on "gap analysis", "compliance gap", "control coverage", "current vs target state", "NIST CSF", "CIS Controls", "remediation effort", "framework mapping".
skills/compliance-gap-analysis/SKILL.md
iso27001-isms¶
Use when building or documenting an ISO 27001 ISMS — scoping the ISMS, producing a Statement of Applicability, implementing Annex A controls, and preparing for certification. Triggers on "ISO 27001", "ISMS", "Annex A", "Statement of Applicability", "SoA", "ISO 27002", "ISO 27005", "risk treatment plan", "certification".
soc2-report¶
Use when preparing a SOC 2 report or readiness assessment — mapping controls to the Trust Services Criteria, choosing Type I vs Type II, gathering audit evidence, and tracking exceptions. Triggers on "SOC 2", "Type I", "Type II", "Trust Services Criteria", "TSC", "audit evidence", "AICPA", "control exception".
pci-dss-assessment¶
Use when assessing PCI DSS compliance for systems that store, process, or transmit cardholder data — scoping the CDE, selecting the SAQ type, validating segmentation, and tracking the 12 requirements. Triggers on "PCI DSS", "cardholder data", "CDE", "SAQ", "ROC", "ASV scan", "PCI 4.0", "tokenization".
skills/pci-dss-assessment/SKILL.md
hipaa-assessment¶
Use when assessing HIPAA compliance for systems handling ePHI — evaluating Administrative, Physical, and Technical Safeguards, Business Associate Agreements, and breach risk. Triggers on "HIPAA", "ePHI", "Security Rule", "Privacy Rule", "HITECH", "BAA", "OCR audit", "45 CFR 164".
skills/hipaa-assessment/SKILL.md
AI and prompt engineering¶
llm-application-architecture¶
Use when architecting an LLM application — agent patterns (chaining, routing, orchestrator-workers), model gateway, guardrails, retrieval, and latency/cost tradeoffs. Triggers on "LLM architecture", "agent patterns", "routing", "model gateway", "guardrails", "TTFT", "orchestrator-workers".
skills/llm-application-architecture/SKILL.md
rag-system-design¶
Use when designing a retrieval-augmented generation system — chunking, embeddings, vector store, hybrid retrieval, reranking, and evaluation. Triggers on "RAG", "retrieval-augmented", "vector database", "chunking strategy", "embeddings", "reranking", "context window".
skills/rag-system-design/SKILL.md
agent-evaluation¶
Use when evaluating an AI agent — task completion, tool-use correctness, trajectory scoring, automation rate, and human-in-the-loop review. Triggers on "agent evaluation", "agent eval", "task completion rate", "tool-use accuracy", "trajectory", "automation rate".
skills/agent-evaluation/SKILL.md
prompt-engineering-guide¶
Use when designing or documenting a prompt engineering guide — prompt patterns, system prompts, few-shot examples, versioning, and drift monitoring. Triggers on "prompt engineering", "prompt guide", "system prompt", "few-shot", "prompt versioning", "human-in-the-loop".
skills/prompt-engineering-guide/SKILL.md
prompt-evaluation-harness¶
Use when building a prompt evaluation harness — LLM-as-judge, G-Eval, faithfulness and answer-relevancy scoring, hallucination rate, and CI/CD regression suites. Triggers on "eval harness", "LLM-as-judge", "DeepEval", "RAGAS", "faithfulness", "hallucination rate", "G-Eval".
skills/prompt-evaluation-harness/SKILL.md
prompt-testing-plan¶
Use when designing a prompt testing plan — test cases, regression suites, coverage, and pass/fail criteria for prompts across versions. Triggers on "prompt testing", "test plan", "regression testing", "prompt QA", "test cases", "prompt versions".
skills/prompt-testing-plan/SKILL.md
Development workflow¶
code-navigation¶
Use when locating, reading, or editing code — finding where a symbol is defined, who calls or implements it, tracing call paths, or making symbol-level edits. Navigate semantically first (LSP/symbol tools); fall back to text search only for genuinely textual targets. Triggers on "where is X defined", "who calls X", "find references", "find implementations", "rename symbol", "trace this function".
skills/code-navigation/SKILL.md
create-adr¶
Use when recording an architecture decision, proposing an architectural change, or checking whether a proposed change conflicts with an existing decision. Writes an ADR in this brain's lightweight format and reconciles it against every existing ADR. Triggers on "create ADR", "architecture decision record", "document this decision", "does this conflict with an existing ADR".
publish-adrs¶
Publish the allowlisted, implemented ADRs from memory/repo/*/adr/ into a documentation repository as transformed copies, with a generated index. Use when an ADR graduates to accepted/as-built, when an ADR body changed, or when preparing a docs repo for outside readers. Triggers on "publish ADRs", "sync ADRs to the docs repo", "update the documentation ADRs".
modular-design¶
Use when a file has grown large, when deciding how to split a module, or when a task would add code to an already-oversized file. Applies a cohesion test rather than a line limit, and refuses splits that would separate shared state. Triggers on "this file is too big", "split this module", "god class", "refactor into modules", "where should this code live", "module boundaries".
skills/modular-design/SKILL.md
layered-api-design¶
Use when building or reviewing an HTTP service in a project that has declared a layered architecture — routing, business, and persistence layers as thin wrappers over focused submodules. Applies only on an explicit project declaration, never inferred from "this is an API". Triggers on "endpoints manager repository", "service layer", "repository pattern", "fat controller", "where does this business logic go", "layered architecture".
skills/layered-api-design/SKILL.md
handle-pr-comments¶
Use when asked to address, work through, or respond to pull request review comments — especially when the reviewer is an AI (Copilot, bot) or when suggestions need evaluation before implementing
skills/handle-pr-comments/SKILL.md
dependency-pr-ci-fix¶
Use when a dependency-bump PR's CI is failing (Dependabot, Renovate, or a manual bump) and you need to green it with the smallest safe fix. Reads the failing CI log, applies a minimal mechanical fix, and refuses to weaken/skip tests, downgrade the bump, or edit CI. Triggers on "fix the failing CI on this bump PR", "dependabot PR CI failing", "renovate PR red", "green this dependency PR".
skills/dependency-pr-ci-fix/SKILL.md
gh-milestones-projects¶
Use when creating a GitHub milestone or a GitHub Project (Projects v2 board) from the terminal, or adding issues/PRs to a project. Covers the two gh operations that have non-obvious invocations. Triggers on "create milestone", "gh milestone", "create a project board", "GitHub Projects", "add issue to project".
skills/gh-milestones-projects/SKILL.md
repo-hygiene¶
Clean git clutter in this repo — remove merged and orphaned worktrees under .claude/worktrees/, delete stale merged local branches, and report merged-PR / closed-issue housekeeping. Read-only scan by default; destructive steps require an explicit --apply/typed yes and never touch GitHub or the worktree you're standing in. Use when worktrees or branches have piled up after merges.
adopt-config¶
Discover pre-existing Claude config on this machine (files install.py won't overwrite, plus other known sources) and integrate the worthwhile parts into this repo. Two-stage flow (adopt inbox -> adopted archive) with a tracked ledger so nothing is evaluated twice. Use when setting up on a new machine, when the installer reports "exists and is not a symlink", or to learn from prior config/memory.