Security-first specification pipeline. prd-generator writes a full PRD with a threat model from a plain-language feature description. The 12 phoenix-* roles run the same pipeline stage by stage: context curation, scope, constraints, RFC 2119 requirements, ambiguity hunting, threat model, API contracts, verification matrix, delivery batches and a final ship gate.
Plugin phoenix-prd-pipeline from marketplace phoenix-security in Security-Phoenix-demo/security-skills-claude-code. Commands read from the repo's manifest — 1 month ago.
phoenix-ambiguity-hunterRole 05 of the Phoenix Security spec pipeline. Red-teams normative requirements for Phoenix-specific failure modes: multi-tenant isolation gaps, vague integration surface definitions, AI agent safety holes (PSC-08), missing auth controls (PSC-06), reachability vs CVSS conflicts, RFC 2119 drift, comp
phoenix-batch-plannerRole 09 of the Phoenix Security spec pipeline. Slices a Phoenix Security feature into safe, incremental batches sized for a 12-person team (1–3 engineer-days each), with P0 security requirements always in Batch 1, API contracts before consumers, integrations last, explicit rollback strategies for ir
phoenix-constraint-distillerRole 03 of the Phoenix Security spec pipeline. Distils SCOPE_DEFINITION into an ACTIVE_SET of 8–15 compact, testable constraints that govern all downstream requirements — drawing from Phoenix's 12 Standing Constraints (PSC-01 through PSC-12) covering AWS/GCP infra split, 12-person team capacity, mul
phoenix-context-curatorRole 01 of the Phoenix Security spec pipeline. Cleans raw input — notes, tickets, Slack threads, customer call transcripts — into a structured CLEAN_CONTEXT block of FACTS, DECISIONS, and OPEN_QUESTIONS, tagged with Phoenix domain vocabulary, customer account labels (Mimecast, Johnson Matthey, Anapl
phoenix-contract-architectRole 07 of the Phoenix Security spec pipeline. Turns Phoenix Security requirements into precise implementable contracts: REST API endpoints with Phoenix auth patterns, tenant isolation invariants, cursor-based pagination (for 100K+ vuln record volumes), standard response envelopes, event schemas wit
phoenix-final-gateRole 10 of the Phoenix Security spec pipeline. Makes the final SHIP / NO_SHIP decision for a Phoenix Security feature spec by checking 8 hard blockers: critical ambiguities remaining, unverified MUSTs, multi-tenant isolation gaps (PSC-03), auth layer coverage (PSC-06), AI agent safety violations (PS
phoenix-orchestratorRun the full Phoenix Security spec pipeline (roles 01–10) from raw context to a ship-ready PRD — automatically chaining context curation, scope cutting, constraint distillation, requirements engineering, ambiguity hunting, security threat modelling, contract design, verification mapping, batch plann
phoenix-pipeline-navigatorInteractive guide and launcher for the Phoenix Security spec pipeline. Asks where you are in the process, what you want to do next, and routes you to the right skill with the correct inputs. Use this skill whenever someone says "where do I start", "what should I do next", "help me with the pipeline"
phoenix-requirements-engineerRole 04 of the Phoenix Security spec pipeline. Converts Phoenix Security feature intent into testable RFC 2119 requirements with structured IDs (R-FUNC, R-SEC, R-REL, R-INT, R-PERF, R-UX, R-DX, R-COMP), P0/P1/P2 priorities, and full traceability to active constraints. Covers functional, integration
phoenix-scope-cutterRole 02 of the Phoenix Security spec pipeline. Converts CLEAN_CONTEXT into an explicit, minimal SCOPE_DEFINITION — goals, non-goals, in/out boundaries, assumptions, success metrics, and gating questions — anchored to Phoenix's product pillars and 12-person team constraints. Use this skill when you h
phoenix-security-engineerRole 06 of the Phoenix Security spec pipeline. Produces a threat model and security requirements grounded in Phoenix Security's actual architecture: 6 trust boundaries (tenant↔platform, platform↔integrations, platform↔AI/LLM, platform↔CI/CD, platform↔AWS, CTI↔GCP), high-value asset inventory (vuln d
phoenix-verification-matrixRole 08 of the Phoenix Security spec pipeline. Maps every MUST/MUST NOT to a concrete proof method using Phoenix's proof type hierarchy: unit-test, integration-test, contract-test, static-analysis, infra-check, load-test, manual-review. Enforces that security requirements use static-analysis + unit-
prd-generatorGenerate a full security-focused PRD (Product Requirements Document) from a plain-language feature description. Use this skill whenever someone wants to create a PRD, product spec, feature spec, requirements document, or says things like "write a PRD for", "create a spec for", "plan this feature", "
AppSec review suite: multi-language security-reviewer (8-point check, 7 language packs, OWASP/ASVS + endpoint checklists), whole-repo security-assessment, diff-scoped 0day-scanner, STRIDE/DREAD threat-modeling, and two threat-model-driven tiers (tm-quick-security-assessment, tm-security-review). Ships 4 slash commands, a security-reviewer subagent, and 3 opt-in hooks.
6 skills · 4 commands · 1 agent
Documentation and research tooling. project-documenter generates and self-heals a full documentation pack across 6 modes. notebooklm queries Google NotebookLM for citation-backed, source-grounded answers. phoenix-research-pipeline runs web and YouTube research and pushes sources into NotebookLM.
3 skills
Cyber threat intelligence search across 595 curated security domains in 4 authority tiers, for CVEs, threat actors, malware families, exploits and breach reports. Ships a skill that needs no API key, a Node CLI, an MCP server, and a /cti-search command. Optional push to NotebookLM.
1 skill · 1 command
Two adversarial review gates. plan-readiness-review asks whether a PRD, spec or RFC is implementable without inventing anything. production-readiness-review asks whether the code is actually built, wired, tested and safe to deploy, backed by a deterministic repo scanner.
2 skills
Generate opengrep/semgrep SAST rules for 30+ languages, including pattern and taint-mode rules. The research variant first researches a CVE or CWE with web search, then writes targeted detection rules from the findings.
2 skills
Talk like caveman. Cut filler. Keep technical details explicit.
22 skills · 1 command · 3 agents · hooks
Persistent memory for Claude Code: the next session starts where the last one left off.
29 skills · 1 MCP server · hooks
tasteskill 2.5.1: professional company websites at the figma.com and x.ai level, with one section per screen, real photographs, real product UI, effects kept for tech and gaming pages, and a real-browser checker and finish gate.
1 skill
Open-source AI job search that runs locally in your AI coding CLI: scan job portals, evaluate listings into a structured A-H report with a 1-5 score, tailor your CV, track applications
5 skills · hooks
Cross-session memory and token savings for coding agents.
6 skills · 1 agent · 1 MCP server · hooks
Package any website or local web build into a lightweight desktop app with Pake CLI.
1 skill
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.