Even-handed investigation of loaded, contested topics. Research & investigation skills for thinking-with-AI - investigation protocols (deep-investigation, cui-bono / "follow the money", screening a dev job or employer for hidden military/defense ties), text & source deconstruction, frame rotation, and iterative verification that escalates to a recursive adversarial dialectic (generate a claim's exact opposite and test it). The skepticism is symmetric - turned on the consensus, the contrarian take, the model's own bias, and its own conclusions; it assumes no villain in advance (POSIWID: judge a method by what it does, not what it claims). Ships two deliberately basic MCP servers - thin data-access layers, not analysis engines; the skills do the analysis: financial-mcp (stock price, history, company info and standard technical indicators via yfinance, with a local ticker cache) and transparency-mcp (keyless public data - US Congress bills/members/votes via GovTrack, World Bank development indicators, and US nonprofit Form 990 filings via ProPublica).
22 skills · 2 commands · 4 agents · 2 MCP servers · hooks
A working proof of concept for catching the same structure in places that have nothing to do with each other - and in your own working process: notice such a regularity, capture it, and test each for a real shared mechanism, not surface resemblance. Today it's a growing, hand-kept list of specific observations that resurface when the shape shows up again, each accumulating a count of the times it has recurred. The self-organizing learner the system is built toward is the genuine direction, not yet the state - an early, already-useful step toward it. Memory for forms, not just facts; two local MCP servers (relational-memory + a usage-weighted knowledge graph, experimental). The term "vasana" is grounded in the plugin's axioms.
10 skills · 1 command · 1 agent · 2 MCP servers · hooks
Useful friction against obvious mistakes - a basic draft, not a security product (no sandbox; whatever doesn't match a pattern passes through). Threat-detection and dangerous-action-blocking hooks for Claude Code: prompt-injection detection (tiered, with allowlist; covers MCP tool outputs via the * matcher), block dangerous git operations (push to main, force push, reset --hard, --no-verify, etc.), and Desktop Commander input safeguards (block start_process and set_config_value). Also ships an optional, per-user PR-merge guard - block Claude from running `gh pr merge` so a human always merges - that is OFF by default and toggled with the `/pr-merge-guard` command (on/off/status); the `pr-merge-guard` skill explains it and flips it on request. New: the `windows-wsl-security-verification` skill - a guided "am I compromised?" IOC triage + attack-surface reduction for Windows + WSL2 dev boxes after a supply-chain scare (poisoned npm/PyPI package, trojaned extension), with the detection-reading discriminators that prevent false alarms. Windows/WSL-specific; verifies, does not harden; a clean result raises confidence, never proves. Also ships the `pii-gate` skill and installer - a drop-in PII/secret gate for a git repo (pre-commit + pre-push hooks + a CI workflow) that blocks personal names from reaching a remote and chains gitleaks for secrets. It fires on `git init`, adding a remote, or a first push, because pushed history is permanent and the gate only works if it exists before that first push. Everything fails closed, matching is case-insensitive and whole-word in every layer, the CI denylist secret lives in a GitHub Environment limited to the default branch so no branch run can read it, gitleaks in CI ignores inline allow comments and repo-root config, a matched term is never echoed, and the shipped denylist template is EMPTY by design - you fill in a gitignored copy, nothing personal ever lives in the repo.
3 skills · 1 command · hooks