Omar SobhandClaude Opus 4.7
7b23f61632
Hand-authored skill catalog anchored to real 2026-07 versions:
- Rust 1.97.1 (stable), edition 2024
- React 19.2.7, Server Components + Actions
- TailwindCSS 4.3.3 (CSS-first config, Oxide engine)
- three.js r185 (WebGPURenderer stable, BatchedMesh matured)
- React Native 0.86 / Expo SDK 54+ (New Architecture default)
- cargo-nextest 0.9.140, gitleaks 8.20+, cargo-audit 0.21+
- Postgres 17 (18 in beta, don't rely on)
- CUDA Blackwell, Metal Apple7+, ROCm CDNA3
Ships 15 skills across the categories:
foundation/ workspace-repo-commit-protocol
small-focused-commits
tdd-red-green-refactor
code-review-checklist
int-xx-marker-protocol
decompose-int-items
rust/ write-rust-current-edition
rust-error-handling
cargo-test-driven-development
rust-async-tokio-idioms
backend/ postgres-migrations-forward-only
postgres-index-selection
api-pagination-day-1
frontend/ react-19-server-components
tailwind-v4-idioms
component-4-state-model
mobile/ expo-managed-vs-bare
rn-flashlist-perf
gpu/ gpu-coalescing-and-occupancy
roofline-model
threejs/ threejs-perf-and-teardown
security/ cargo-audit-workflow
secret-scanning-gitleaks
skills_loader.rs walks skills/**/*.md, parses YAML frontmatter
(name, description, when_to_use, tags), upserts via
skills_catalog::upsert_builtin. Idempotent per boot — bumps version
+ appends skill_versions row ONLY when body changes. Deterministic
sha256-derived ids so builtins are stable across boots.
Dockerfile copies skills/ to /etc/clawmates/skills. Server boot
task spawns loader alongside team_template_loader.
Follow-ups (Slice 3.5c continuation, future PRs):
- 20-30 more skills (duckdb, shadcn composition, a11y, WebGPU
migration, metal frame capture, rocprof, deep gitea forge
integration, semgrep rulepacks)
- Bind skills to team template roles (add [role.skills] refs to
templates/teams/*.toml + wire template_role_skills population
in team_template_loader)
Co-Authored-By: Claude Opus 4.7 <[email protected]>
3.3 KiB
3.3 KiB
name, description, when_to_use, tags
| name | description | when_to_use | tags | ||
|---|---|---|---|---|---|
| secret-scanning-gitleaks | Detecting + removing leaked credentials with gitleaks 8+. Pre-commit + CI + full history sweep policies. | You're on a security mission, or setting up a new repo, or triaging a "did we push a key?" incident. |
|
Gitleaks workflow
Anchored to gitleaks 8.20+ (2026 line). Detects secrets in the working tree, staged changes, and git history.
Modes
gitleaks protect --staged— pre-commit hook. Blocks commits containing secrets.gitleaks detect— scans working tree + full history. Use in CI.gitleaks detect --log-opts="--since=2026-01-01"— bounded historical sweep for large repos.
Pre-commit integration
# .pre-commit-config.yaml
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.20.0
hooks:
- id: gitleaks
Config: .gitleaks.toml
title = "clawmates gitleaks config"
[extend]
useDefault = true # start from bundled rules
[[rules]]
id = "clawmates-internal-token"
description = "Our internal service session token pattern"
regex = '''cm_svc_[a-f0-9]{64}'''
tags = ["clawmates", "token"]
[allowlist]
description = "Test fixtures that intentionally contain fake secrets"
paths = ['''crates/cm-auth/tests/fixtures/.*''']
regexes = ['''sk-ant-api03-TEST[a-zA-Z0-9]+''']
Rules to add per-repo, not global — every codebase has domain-specific token shapes.
What to do when it fires
On a commit-in-progress:
- Don't commit.
- Rotate the credential immediately (whether you'd have pushed it or not — assume compromised the moment it existed on disk).
- Remove from the file. Re-attempt.
On a historical hit (already pushed):
- Rotate first, panic second.
- Force-remove from history with
git filter-repo --replace-textorbfg-repo-cleaner. git push --forceafter coordination with everyone with a clone (they'll need togit reset --hard origin/mainto avoid re-introducing).- Notify anyone who might have cached the value (CI logs, artifact registries, error monitoring backends often store request bodies).
What gitleaks misses
- Base64-encoded secrets. Add a rule if you use them.
- Split-across-lines secrets — most rules are single-line regex.
- Secrets in binary files. Gitleaks skips binaries by default; scan artifacts separately.
- Encrypted-at-rest formats (age, sops) — encrypted content is opaque to gitleaks; make sure the ENCRYPTED file being in the repo is the intent.
Integration with the security mission template
Runs gitleaks detect --report-format=json in the security_scan phase. Each finding becomes a mission_task:
external_id = <fingerprint>title = "<RuleID> at <file>:<line>"status = "created"
The coding phase remediates: rotate + purge + add allowlist entry if a false positive. Emit COMPLETED: <fingerprint> when the rotation is confirmed AND the historical removal is deployed.
Anti-patterns
- Adding a blanket
.gitleaks.tomlallowlist covering entire directories. Neuters detection. Allowlist specific patterns with justification comments. - Fixing the secret leak by squashing history without rotating. The secret was on disk on multiple machines; it's compromised. Rotate first.
.gitignoreas your secret defense. Files can be added by name from the CLI; gitignore only helpsgit add .sweeps.