themarmack

@themarmack source repo

76 skills
0 followers
11 hours ago last updated

▌
Verify Claim · themarmack bundle
Adversarially verify a single load-bearing claim by spawning N independent refuters (default 3) and killing the claim at ≥2/3 refute. Returns `{verdict, vote_breakdown, evidence}`. Reusable everywhere a claim needs scrutiny — Category 1 research synthesis, memory-curator before promoting to facts/, weekly-intelligence-digest before publishing a "what changed" item. Lifted from the built-in deep-research skill's verification pattern. Composes on claim-extractor (its input shape). Use after claim-extractor during any Category 1 research or scheduled digest run, before a load-bearing claim is published in a digest or promoted to vault/facts/.

0
installs
▌
Digest Writer · themarmack
Canonical formatter for digests and research reports. Enforces a 5-section structure (TL;DR → What Changed → Why You Care → Detailed Findings → Sources) with the regulated-org lens applied to "Why You Care" and credibility-tier badges on every source. Delegates the actual file write to vault-writer, landing the digest at `vault/digests/{cadence}/YYYY-MM-DD-{skill}.md` (for scheduled agents) or `vault/research/{topic}/YYYY-MM-DD-{slug}.md` (for on-demand research). Every Category 2 scheduled agent and every Category 1 research skill writes through this skill. Use whenever a scheduled agent or research skill is formatting its final output — after claims are extracted and verified, immediately before the vault-writer write.

0
installs
▌
Quick Capture · themarmack
quick-capture

0
installs
▌
Sbom Reviewer · themarmack
Parse a CycloneDX or SPDX SBOM and flag supply-chain concerns BEYOND what CVE matching catches — unsigned releases, abandoned packages (no commits in 12+ months), single-maintainer critical dependencies, known-malicious authors / typo-squat patterns, license conflicts, SBOM completeness (declared vs actual depth). Produces a structured finding list with severity and remediation. Composes with daily-cve-digest (which handles the CVE side) and license-compliance-checker (which handles the licensing side); this skill covers the structural risk surface. Use whenever the user is reviewing an SBOM — a newly published one, a vendor-provided one, or a portfolio sample — before adopting the artifact or after a supply-chain incident.

0
installs
▌
Vault Querier · themarmack
Read-side query interface for the Obsidian vault (`vault/`). Supports lookups by tag, by frontmatter field, by [[wikilink]] (forward + backlinks), and full-text. Returns `{path, frontmatter, excerpt, links}` per match. Uses filesystem Glob + Grep + Read — no MCP, no daemon. Call this **first** for every on-demand research task (Obsidian-first contract) and any time a vault-writing skill needs to find related notes to link to. Use before any web research in a Category 1 task, and whenever vault-writer or memory-curator needs to find existing or related notes.

0
installs
▌
Weekly Review · themarmack
OB1-borrowed weekly review skill. Scans the vault's writes from the past 7 days (across digests/, research/, events/, decisions/, facts/, insights/, _inbox/, people/, projects/) and produces an end-of-week synthesis at vault/digests/weekly/YYYY-MM-DD-weekly-review.md with the OB1 structure (Week at a Glance / Themes / Open Loops / Connections / Gaps / Focus). Unlike weekly-intelligence-digest, the source is the vault itself, not external feeds. Runs on Sunday PM by default (configurable). Use when the user asks to run the weekly review or synthesize what the vault accumulated this week — and on its Sunday-evening schedule.

0
installs
▌
Memory Curator · themarmack
Decide whether an inbox item or candidate finding should be promoted to a durable vault folder, patched onto an existing note, or dropped. Applies the rules from vault/_meta/inbox-rules.md (novelty, falsifiability, future utility, surprise, sourcing). Runs on _inbox/{agent-id}/ items to sweep them or can be called ad-hoc by a skill before a direct vault-writer call. Composes with vault-querier for novelty checks and vault-writer for the actual promote/patch writes. Default-drops unsourced agent claims; never silently drops content with substance — uncertain items get tagged

0
installs
▌
Source Fetcher · themarmack
Fetch a single URL's content for research and return a structured object (url, fetched_at, status, content_md, content_hash, source_tier, injection_verdict). Every fetch is run through prompt-injection-guard before returning. Use whenever a research skill, scheduled agent, or curator needs to ingest one web source — prefer this over calling WebFetch directly so all fetches share timeout, redirect, tier-tagging, and injection-scanning behavior. Do not use for bulk crawls, authenticated pages, or known-paywalled URLs.

0
installs
▌
Voices Watcher · themarmack bundle
Daily scheduled agent that reports what the people and channels on the curated roster at `voices.csv` just published — new Substack posts, blog articles, podcast episodes, and YouTube videos. Use when the user asks to run the voices digest, what their AI/security voices published today, what's new on the YouTube channels or creators they follow or subscribe to, or which of their tracked voices posted recently — and on its daily 07:30 schedule. Writes vault/digests/daily/YYYY-MM-DD-voices-watcher.md. YouTube is polled via per-channel Atom feeds — no API key, no transcripts; video items surface as title + link only. Also keeps vault/people/{handle}.md in sync for non-org rows. Does NOT poll X/Twitter (per decisions/2026-06-20-adopt-obsidian-and-ob1-patterns).

0
installs
▌
Claim Extractor · themarmack bundle
Extract falsifiable claims from a fetched source document, returning a standard `{claim, quoted_anchor, source_url, source_tier, claim_type}` schema per claim. Filters out opinions, marketing fluff, vague generalizations, and unverifiable forward-looking statements. Used by every Category 1 research skill (Obsidian-first contract) before passing claims to verify-claim, and by memory-curator when staging multi-claim documents into _inbox/. Composes on source-fetcher (the input is its content_md) and prompt-injection-guard (already applied upstream). Use after source-fetcher returns content during any Category 1 research or scheduled digest run, before claims go to verify-claim or get staged for memory-curator.

0
installs
▌
Source Registry · themarmack bundle
Curated YAML registry of high-signal sources (vendor changelogs, regulator feeds, security advisories, peer-bank blogs) that any research or scheduled-agent skill should load WHERE to look from. Loads `./registry.yml` from this skill's folder and supports filters by topic tag, credibility tier, source type, or host lookup. Used by feed-watcher (which sources to poll), source-fetcher (host → credibility-tier lookup), and every Category 1 + Category 2 skill (curated source list per topic). Use whenever feed-watcher assembles its polling list, source-fetcher needs a host→tier lookup for a fetched URL, or a research skill needs the curated seed sources for its topic.

0
installs
▌
Daily Cve Digest · themarmack bundle
Daily scheduled agent. Polls CVE / advisory feeds (GHSA, OSV.dev, NVD) for the past 24 hours, matches against the org's declared stack in `./stack.yml`, and produces a severity-prioritized digest. Each item carries first-response SLA, remediation SLA, and a "what Dependabot will/won't catch" line — Dependabot covers direct dependency CVEs but misses ecosystem-level signals (base-image advisories, transitive depths Dependabot doesn't reach, supply-chain attack disclosures). Runs weekday mornings; outputs to vault/digests/daily/YYYY-MM-DD-daily-cve-digest.md. Use when the user asks to run the CVE or vulnerability digest, or to see what new CVEs or advisories hit the org's stack in the last day — and on its weekday-morning schedule.

0
installs
▌
Learning Capture · themarmack
Save a structured insight note from an article, conversation, or experience. Routes through vault-writer to vault/insights/ (or vault/facts/{entity}/{predicate}.md if the captured content is atomic and falsifiable). Uses the controlled tag vocabulary. Distinct from quick-capture (which uses the qc-* sentence-starter formats and is faster). Use whenever encountering content worth retaining beyond the current conversation — a blog post that changes your mental model, a learning from a meeting that should outlast the meeting, a synthesis across multiple sources.

0
installs
▌
Copilot Deep Dive · themarmack
copilot-deep-dive

0
installs
▌
Vault Conventions · themarmack
Load the Obsidian vault's conventions, folder schemas, and controlled tag vocabulary into a compact structured summary so that any skill which reads or writes the vault follows the rules. Returns folders, frontmatter schemas (all 9), tag vocabulary, research-topic vocabulary, and inbox-promotion rules in one bundle. Call this first before any vault read or write. Caches within a session — re-call only if vault `_meta/` has changed. Use before the first vault read or write in any session — every vault-touching skill (vault-querier, vault-writer, memory-curator, digest-writer, every Category 1 researcher and Category 2 scheduled agent) calls this first.

0
installs
▌
Meeting Prep Brief · themarmack
Generate a one-page prep brief for a meeting from the user's notes + recent vault activity. Sections — meeting context, the participants (with their likely concerns, sourced from objection-response-library and people notes), the asks (what user needs to walk in prepared for), the prior context (relevant vault notes + decisions + facts), and the "if X comes up, here's the response" pre-empts. Use before any stakeholder meeting where the user wants to be ahead of the conversation rather than reacting to it.

0
installs
▌
Sdlc Best Practice · themarmack
On-demand Category 1 researcher for narrow SDLC concerns — trunk-based development, ephemeral environments, IaC promotion patterns, secrets-handling lifecycle, golden paths / platform engineering, branch strategies, change-freeze patterns, feature-flag governance, blue-green vs canary. For a focused question, produces a research note with current-state-of-practice + regulated-org constraints + recommended approach. Output at vault/research/sdlc-best-practice/YYYY-MM-DD-{slug}.md. Use when the user asks to research a general SDLC practice or pattern that no topic-specific researcher covers — producing a fresh, cited research note — as opposed to Copilot (copilot-deep-dive), GitHub platform (github-platform-watch), regulator (financial-regulator-watch), or supply-chain (supply-chain-security-watch) questions.

0
installs
▌
Weekly Self Review · themarmack
End-of-week personal-reflection skill, distinct from weekly-review (which surveys the vault's writes). This is about the **user's** week — what they worked on, what energized vs drained, what they want to focus on next week, what's nagging at them. Outputs a private reflection note that doesn't aim for objectivity. Use when the user asks for a personal end-of-week reflection or self-review — typically Friday afternoon or Sunday evening — NOT when they ask for the weekly review of vault activity, which routes to `weekly-review` (the scheduled vault retrospective).

0
installs
▌
Demo Script Builder · themarmack
Build a tailored demo script for an AI-coding / SDLC-modernization audience. Inputs — audience type (skeptical dev / curious leader / risk-focused auditor / vendor evaluator), demo goal (familiarization / objection-handling / specific-feature showcase / posture demonstration), time budget (10 / 20 / 45 minutes). Output is a moment-by-moment script with prep checklist, the specific Copilot prompts / commands the demoer will type, expected output narration, and the fallback plan if a step fails live. Use when prepping for a stakeholder demo, audit conversation, vendor-account-team meeting, or all-hands familiarization.

0
installs
▌
Dependabot Strategy · themarmack
On-demand Category 1 researcher focused on Dependabot best practices for a regulated organization — triage workflows, grouped-update strategies, auto-merge gates, ecosystem coverage, private-registry integration, cooldown periods for zero-day waiting, and the auto-triage rules that turn alert volume into actionable signal. Enforces Obsidian-first contract. Findings land at vault/research/dependabot/YYYY-MM-DD-{slug}.md; verified facts get staged for memory-curator promotion to vault/facts/ghas-dependabot/. Used by dependabot-config-helper as the source of defaults. Use when the user asks a strategic, policy, triage, or tooling question about Dependabot that needs a research-grade answer with citations — not when generating or reviewing a concrete dependabot.yml (dependabot-config-helper) or researching a non-Dependabot GHAS feature (ghas-feature-research).

0
installs
▌
Threat Model Helper · themarmack
threat-model-helper

0
installs
▌
Copilot Faq Answerer · themarmack bundle
Answer the recurring GitHub Copilot questions a regulated-environment GitHub admin fields daily (data handling, IP indemnity, content exclusions, audit logs, model selection, public code filter, knowledge bases, AGENTS.md governance). Reads canonical answers from `./canonical-answers.md` in this skill folder, applies them with the compliance-relevant lens, and cites GitHub's authoritative source. Also checks the Obsidian vault (`facts/copilot/*`) for any more recent fact that should override the canonical answer. Use whenever the user (or a stakeholder via the user) asks a Copilot policy / controls question.

0
installs
▌
Decision Memo Writer · themarmack
decision-memo-writer

0
installs
▌
Frontier Model Watch · themarmack
On-demand Category 1 researcher for frontier-model news (Anthropic, OpenAI, Google, Meta, Mistral, emerging) with the "what changes for enterprise dev tooling" angle. Specifically — which models route through Copilot per-feature? What deprecations are imminent? What new capabilities affect AI-tool TPRM posture or model-risk reviews? Output at vault/research/frontier-model/YYYY-MM-DD-{slug}.md. Composes with ai-coding-tools-compare (model side of the tool comparison) and the weekly-intelligence-digest (the recurring intelligence pipe). Use when the user asks to research a specific frontier-model release, deprecation, availability shift, or benchmark on demand — producing a fresh, cited research note — not the scheduled quarterly landscape survey (quarterly-ai-coding-landscape), a tool-level comparison (ai-coding-tools-compare), or a recurring news sweep (weekly-intelligence-digest).

0
installs
▌
Ghas Config Reviewer · themarmack
Audit a GitHub repo or org's GitHub Advanced Security configuration against the org's baseline. Checks code scanning enablement, secret scanning + push protection, Dependabot alerts + version updates, dependency review, branch protection requiring GHAS checks, and CODEOWNERS hygiene. Uses `gh api` for live inspection of a target repo or org; falls back to documented baseline check items the user can run manually. Produces a structured finding list with severity, current vs expected state, and remediation steps. Use when the user asks to audit or review a repo's or org's GitHub Advanced Security (GHAS) configuration — code scanning, secret scanning + push protection, Dependabot, dependency review, branch protection — during repo onboarding, periodic GHAS audits, or before a stakeholder review of GHAS posture. This owns "is code scanning / secret scanning / push protection / Dependabot enabled?" questions at **repo or org** level. For researching how a single GHAS feature works use ghas-feature-research; for no

0
installs
▌
Peer Bank Tech Intel · themarmack
Collect what other major banks publicly share about their developer platforms, AI coding adoption, platform engineering, and SDLC modernization — engineering blogs (JPMorgan, Goldman Sachs, Morgan Stanley, Capital One, BofA, Wells Fargo, Citi, HSBC, Deutsche Bank, Barclays), conference talks (FS-ISAC, QCon Financial Services tracks), public RFCs / open-source projects, and named-analyst commentary. Output at vault/research/peer-bank/YYYY-MM-DD-{slug}.md. Composes with stakeholder-update-writer (exec asks "what are peers doing?") and decision-memo-writer. Use when the user asks what peer banks are publicly doing or saying about developer platforms, AI coding, or SDLC modernization — producing a fresh, cited research note from public sources only — not for evaluating a specific vendor's security posture (vendor-security-eval) or comparing AI coding tools (ai-coding-tools-compare).

0
installs
▌
Vendor Security Eval · themarmack
Standardized security / risk evaluation of a dev or AI vendor against org policy — data flow diagram, SIG (Standardized Information Gathering) Lite/Full responses, SOC 2 Type 2 review, ISO 27001 review, model training opt-out terms, breach history (public + private disclosure), TPRM-file readiness scorecard. Produces a structured pre-procurement evaluation note the TPRM team can use as input to their formal process. Composes with ai-coding-tools-compare (broad comparison) and compliance-framework-lookup (specific control questions). Use before any new dev/AI vendor moves to formal TPRM intake.

0
installs
▌
Codeql Pattern Finder · themarmack
Given a vulnerability class or business rule (e.g. "find SQL injection via string concat in Java", "find calls to deprecated crypto APIs", "find unchecked PII handling at API boundaries"), search the standard github/codeql packs and community packs for an existing query that matches. If no off-the-shelf query exists, sketch a custom query in CodeQL with annotated reasoning. Output is a research note with the chosen query (or sketch) + how to deploy it via codeql-onboarding-helper. Use when planning a custom pack rollout, when an internal pattern keeps appearing in incidents, or when a regulator-specific control needs a code-level enforcement.

0
installs
▌
Ghas Feature Research · themarmack
On-demand Category 1 researcher for a specific GitHub Advanced Security feature — secret scanning push protection, code scanning autofix, security campaigns, dependency review action, security advisories database, custom auto-triage rules. For a chosen feature, produces a research note with current state, rollout caveats, regulated-org applicability, and recommendations. Output at vault/research/ghas/YYYY-MM-DD-{feature-slug}.md. Composes with ghas-config-reviewer (baseline-checking side) and the various GHAS-touching ops skills. Use when the user asks to research a single GHAS feature in depth — adoption, rollout, tuning, regulated-org caveats — producing a fresh, cited research note; not for checking a repo or org config against the baseline (ghas-config-reviewer), Dependabot strategy questions (dependabot-strategy), or platform-wide GitHub questions (github-platform-watch).

0
installs
▌
Github Platform Watch · themarmack
github-platform-watch

0
installs
▌
Iac Security Reviewer · themarmack bundle
iac-security-reviewer

0
installs
▌
Voices Roster Curator · themarmack
Enrich `voices.csv` (at repo root) by finding missing publishing surfaces — Substack, YouTube, blog, podcast, LinkedIn — for the voices already in the roster. Given a name, @handle, or row index, searches the web for the person's surfaces, validates URLs, and updates the CSV in place. Idempotent on re-run; refresh mode re-checks every existing row. Also accepts new voices to add. Composes on source-fetcher + prompt-injection-guard + a CSV writer helper. Use whenever the user wants to broaden voices-watcher's polling reach without manually researching each voice.

0
installs
▌
AI Governance Research · themarmack
On-demand Category 1 researcher targeting AI governance frameworks and regulations applicable to internal AI dev tooling — NIST AI RMF, EU AI Act, US executive orders, state AI laws (California, Colorado, etc.), ISO 42001, model cards, and the org-specific application of each. Enforces Obsidian-first contract. Outputs at vault/research/ai-governance/YYYY-MM-DD-{slug}.md; verified facts get staged for memory-curator promotion to vault/facts/{framework-entity}/. Use when the user asks to research whether or how an AI governance framework or AI-specific law applies to internal AI dev tooling — producing a fresh, cited research note — as opposed to financial-services regulator guidance (financial-regulator-watch) or a cross-framework control-ID mapping for a single control question (compliance-framework-lookup).

0
installs
▌
Prompt Injection Guard · themarmack bundle
Scan fetched web content for prompt injection patterns before it is passed to a downstream LLM call. Returns the content with suspicious blocks quarantined plus a verdict (clean / quarantined / suspicious). Mandatory for any skill that ingests arbitrary web text — including source-fetcher, voices-watcher, weekly-intelligence-digest, every on-demand researcher, and any skill that promotes content from _inbox/. Do not use for trusted user input or for already-curated vault content.

0
installs
▌
Scheduled Agent Runner · themarmack
scheduled-agent-runner

0
installs
▌
Secure Design Reviewer · themarmack
Critique a service / architecture design doc against the org's control objectives — data classification handling, key management, IAM (auth + authz), logging + monitoring, disaster recovery, third-party integrations, AI tool exposure. Produces a structured finding list per control category with `current_state` vs `expected_state`, severity, and remediation. Composes with threat-model-helper (threats identified there → controls validated here) and ai-tooling-data-flow-reviewer for the AI-specific data-flow dimension. Use during architecture review, before change-advisory-board approval, or when retrofitting a legacy service's design documentation.

0
installs
▌
AI Coding Tools Compare · themarmack
Produce a side-by-side comparison of AI coding tools — GitHub Copilot vs Cursor vs Windsurf vs Cody vs Tabnine vs JetBrains AI vs Amazon Q Developer vs emerging entrants — against the org's enterprise rubric. Rubric axes — auth (SSO/SAML/SCIM), data flow (residency, content exclusion, training-data policy), IP indemnity, on-prem / single-tenant options, admin telemetry, FedRAMP/SOC2/ISO certifications, model routing transparency, audit log access. Use when the user asks to compare AI coding tools (Copilot vs Cursor vs Windsurf vs Cody vs others) against the org's enterprise rubric, or asks "should we switch to X?" — during periodic re-evaluation, vendor selection for a specific use case, or before responding to leadership. For an in-depth single-tool study (not a comparison) use copilot-deep-dive.

0
installs
▌
Github Org Audit Runner · themarmack
Audit a GitHub organization's admin-surface settings — SAML / SCIM, EMU posture, base permissions, secret scanning + push-protection org defaults, allowed Actions list, runner groups, repository creation policies, IP allow-list — against the org's baseline. Uses `gh api` for live inspection where authenticated; falls back to a structured manual-checklist a human admin can walk through in the UI. Produces a posture report with `current_state` vs `expected_state` per item, severity, and remediation. Use during quarterly admin reviews, before audit conversations, or when troubleshooting a "why can't users do X" complaint that might be an org-wide policy.

0
installs
▌
Monthly Regulator Watch · themarmack
monthly-regulator-watch

0
installs
▌
Repo Golden Path Scorer · themarmack
Score a repo against the org's golden-path standards — CODEOWNERS, branch protection, required checks, signed commits, dependabot.yml currency, SECURITY.md, AGENTS.md, code-scanning enabled, secret scanning + push protection, license declared, README/CONTRIBUTING basics. Produces a 100-point scorecard with category subtotals and prioritized remediation. Use during repo onboarding, periodic sweeps of high-blast-radius repos, before a stakeholder review where you need a posture summary, or as the basis for an org-wide consistency report.

0
installs
▌
Codeql Onboarding Helper · themarmack
Given a target repo's stack + risk profile, decide default vs advanced CodeQL setup, recommend a query suite (code-scanning / security-extended / security-and-quality), select custom packs (community + org's internal), document the alert triage workflow, and define the exception process. Produces an onboarding plan ready to hand to the repo owner. Use during repo GHAS onboarding or when refactoring a repo's existing CodeQL setup that's drowning in low-signal alerts or missing real ones.

0
installs
▌
Copilot Metrics Analyzer · themarmack
Take raw Copilot Usage Metrics API output (per-user, daily granularity, including the new `ai_credits_used` field) and produce structured findings — top cost/usage anomalies, per-dev chargeback math with the 10% data-residency surcharge applied, and actionable recommendations. Uses facts from `vault/facts/copilot/` (usage-metrics-ai-credits-per-user, data-residency-surcharge) so cost math reflects the org's actual configuration, not generic per-seat assumptions. Use when the user has raw Copilot usage-metrics output to analyze — during weekly cost monitoring, before a cost-attribution conversation with finance, or when hunting dormant licenses.

0
installs
▌
Copilot Rollout Playbook · themarmack
Generate a tailored Copilot expansion plan for a target team or BU. Takes a team description (size, language stack, current Copilot adoption state, business priorities, regulatory exposure) and produces a 5-phase rollout — prerequisites, training, pilot, expansion, steady-state. Pulls org-specific constants (data residency, content exclusion, public code filter, IP indemnity terms) from `vault/facts/copilot/` so the plan reflects the current configuration, not generic GitHub guidance. Use when a team lead asks "how do we roll Copilot out to my team?" or when planning an org-wide expansion wave.

0
installs
▌
Dependabot Config Helper · themarmack
Generate or review a `.github/dependabot.yml` for a target repo or service, calibrated to org policy (regulated-environment defaults from `dependabot-strategy` research) and the repo's actual stack. Handles grouped updates (security + version separately), schedule cadence per ecosystem, private-registry integration, auto-merge gating, reviewer routing, and the open-pull-requests-limit per ecosystem. Use whenever onboarding a repo to Dependabot, refactoring an existing config that's drowning the team in PRs, or auditing a sample of org repos for config consistency.

0
installs
▌
Executive Summary Writer · themarmack bundle
Turn an existing research note into a 1-page executive summary personalized to a named audience (e.g. `ciso`, `vp-eng`, `ceo`, or `default`). **Invoke ONLY when the user explicitly asks for an exec summary** — never as a post-write step in a Category 1 researcher flow. Loads audience preferences — length, voice, format, emphasize/avoid lists, special interests, section toggles — from `~/Obsidian/Research-Brain/_config/exec-preferences.md`. Writes the summary to `vault/insights/YYYY-MM-DD-exec-summary-{audience}-{slug}.md` via `vault-writer.write_insight`, then composes with `email-sender.prompt_then_send` to optionally deliver via Gmail. The 8-section structure (BLUF, Why This Matters Now, Key Findings, Implications, Recommended Action, Risks, Next Decision Point, Sources) is the spine — three sections are mandatory; the other five are toggleable per audience. Stop-and-reports on missing source note, missing prefs file, missing `## Default` section, or unknown audience. Use when the user asks to summarize a r

0
installs
▌
Reading Queue Summarizer · themarmack
Triage and summarize a backlog of saved articles / papers. For each item — 1-paragraph summary, salient quotes, vault connections, and a verdict (promote to a research note / capture as an insight / dismiss / defer). Especially useful after a busy intelligence-digest week when the user has marked items for follow-up reading. Output at vault/insights/YYYY-MM-DD-reading-triage-{slug}.md plus per-item promotion notes where applicable. Use when the user asks to triage, clear, or summarize their reading queue, saved articles, or marked follow-up items.

0
installs
▌
Regulated Finance Framer · themarmack
Reusable prompt-fragment skill consolidating the regulated-org framing rules that every Category 1 research skill and Category 5 comms skill currently bakes into its own SKILL.md. Any topic skill that needs the compliance-relevant lens can include this fragment via a single reference rather than re-implementing the framing. When the org's posture, regulatory environment, or control catalog evolves, edit this skill once and every downstream skill inherits. Use as an `import` from any skill that wants the standard compliance framing applied to its output — when authoring or updating a Category 1 research or Category 5 comms skill, or before framing any research, synthesis, or communication output with the regulated-org lens.

0
installs
▌
Runner Security Reviewer · themarmack
Assess a self-hosted runner pool (or a single runner image) against the org's runner-security baseline — ephemeral lifecycle, restricted network egress, runner-group scoping, OS image hardening, secret handling, log retention. Produces a posture report with current state vs expected per item. Use during runner-pool design review, after a runner-related incident, when planning a new restricted runner group for a regulated workload, or as part of quarterly GHAS posture audit.

0
installs
▌
Secrets Hygiene Reviewer · themarmack
Review a repo / service for secret-handling problems BEYOND what GHAS secret scanning catches at commit time. Focus areas — runtime exposure (env-var passthrough into logs / error pages / metrics labels / observability tags), rotation gaps (secrets used past their declared lifetime), config-file secrets in inheritable paths (`.env.example` with real values, dotfiles in dev containers), shell-history leakage in entry points, secrets in container layers (visible via `docker history`), and secret reuse across environments (prod credentials used in non-prod). Produces a structured finding list with severity, evidence, remediation. Use during service onboarding to GHAS, after a secret-leakage near-miss, or as a portfolio audit step.

0
installs
▌
Survey Thematic Analyzer · themarmack
Cluster open-text survey responses into themes with representative quotes. Takes raw responses (developer experience surveys, Copilot rollout retros, post-incident surveys) and produces a structured analysis with theme labels, response counts per theme, 2-3 representative quotes per theme, and outlier responses worth surfacing individually. Use when analyzing developer surveys or Copilot rollout feedback.

0
installs
▌
Actions Workflow Hardener · themarmack bundle
Review a GitHub Actions workflow YAML file for security hardening issues — unpinned action SHAs, overpermissive GITHUB_TOKEN, missing OIDC for cloud auth, pull_request_target misuse, secret-handling problems, self-hosted-runner risks. Produces a structured finding list with severity, line reference, remediation, and a citation to the underlying GitHub recommendation. Baseline derived from `vault/research/github/2026-06-20-actions-hardening-post-shai-hulud.md` (7 hardening practices from GitHub Docs). Use whenever the user is reviewing a workflow file before merge or auditing inherited workflows.

0
installs
▌
Conference Talk Distiller · themarmack
Turn a conference talk's slides / transcript / recording into the 3 things that matter for the user's program. Most talks have 1-3 substantive ideas wrapped in 30-45 minutes; this skill extracts the substance. Output at vault/insights/YYYY-MM-DD-talk-{slug}.md with the 3 key ideas + compliance-relevant takeaways + speaker recommendations to track. Use after attending or watching a recorded talk that the user wants to retain value from.

0
installs
▌
Copilot Exception Handler · themarmack
Walk through a non-standard Copilot config request — public-code-filter-off, alternate model pin, content-exclusion-override, license-assignment outside the standard process — decide justified / partially justified / not justified, and produce the formal exception document with risk statement, compensating controls, expiry, owner, and renewal trigger. Pulls org constants from vault/facts/copilot/ and canonical answers from copilot-faq-answerer; pre-empts objector arguments via objection-response-library. Use whenever a team lead or developer submits a request that breaks the standard Copilot configuration.

0
installs
▌
Exception Request Drafter · themarmack
exception-request-drafter

0
installs
▌
Financial Regulator Watch · themarmack
financial-regulator-watch

0
installs
▌
Monthly Copilot Changelog · themarmack
monthly-copilot-changelog

0
installs
▌
Stakeholder Update Writer · themarmack
Produce a tiered stakeholder update from raw progress notes + recent vault activity. Outputs three tiered versions in one go — exec (CIO/CISO/eng VP), eng lead (managers, principal engineers), IC (individual developers) — each tuned to that audience's decision authority, time budget, and what they actually need to act on. Composes on vault-querier (pulls last N days of digests/research/decisions for context), digest-writer's section conventions (TL;DR / What Changed), and the user's raw notes. Lands at vault/insights/YYYY-MM-DD-stakeholder-update-{slug}.md. Use when the user asks to write, draft, or put together a stakeholder update, a status update, a progress update, or an update for exec / eng-lead / IC audiences — any time raw progress notes need to become an audience-ready update. A single-audience summary of one research note routes to executive-summary-writer; a leadership decision ask routes to decision-memo-writer.

0
installs
▌
Enablement Content Creator · themarmack
Generate training / enablement content for the SDLC modernization program — Copilot prompting, secure coding with AI, CodeQL triage, GHAS workflows, AGENTS.md authoring. Produces tiered content (dev / lead / exec) with the same factual backbone but different framing, depth, and call-to-action per audience. Pulls from copilot-faq-answerer canonical answers (recently extended via memory-curator's promoted facts) and objection-response-library steel-manned concerns. Output lands at vault/insights/YYYY-MM-DD-enablement-{topic-slug}.md. Use when the user needs to create or refresh training / enablement material — before a rollout training phase, after cited vault facts change past a module's `last_verified`, or when a recurring question merits standalone content.

0
installs
▌
License Compliance Checker · themarmack
license-compliance-checker

0
installs
▌
Objection Response Library · themarmack bundle
objection-response-library

0
installs
▌
Weekly Intelligence Digest · themarmack
The flagship weekly scheduled agent. Polls high-signal sources across GitHub/Copilot/Anthropic/OpenAI/regulators/supply-chain, surfaces what changed in the past 7 days, and produces a single ranked markdown digest at vault/digests/weekly/YYYY-MM-DD-weekly-intelligence-digest.md framed with the regulated-org lens. Composes the full Phase-1 foundation via scheduled-agent-runner. Run weekly on Monday morning (or invoke ad-hoc). Use when the user asks to run the weekly digest or weekly intelligence roundup, or to see what changed across GitHub, Copilot, AI vendors, regulators, and supply-chain in the past week — distinct from the single-day CVE roundup (daily-cve-digest).

0
installs
▌
Compliance Framework Lookup · themarmack
Cross-reference a specific control question against the org's relevant compliance frameworks — NIST 800-53 / 800-218 SSDF, PCI-DSS 4.0, SOX ITGC, ISO 27001 / 27034 / 42001, CIS Controls / Benchmarks, FFIEC IT Handbook. For a single question (e.g., "what's the relevant SOX ITGC control objective for AI-generated code in production?"), produces a side-by-side mapping showing which frameworks address it, which control IDs match, and where they conflict. Use when drafting policy that cites multiple frameworks, responding to an audit ask, or building a compensating-control matrix for an exception request.

0
installs
▌
Supply Chain Security Watch · themarmack
On-demand Category 1 researcher for software supply-chain security — SBOM standards (CycloneDX, SPDX), SLSA framework, Sigstore, in-toto, OpenSSF Scorecard, npm / PyPI / Maven malware trends, and major supply-chain incidents. Output at vault/research/supply-chain/YYYY-MM-DD-{slug}.md. Composes with sbom-reviewer (control side), daily-cve-digest (active matching side), and actions-workflow-hardener (workflow side). The Mini Shai-Hulud research at [[2026-06-20-actions-hardening-post-shai-hulud]] is the kind of output this skill produces on demand. Use when the user asks to research a supply-chain security standard, framework, ecosystem trend, or landscape question on demand — producing a fresh, cited research note — not for the scheduled stack-matched CVE roundup (daily-cve-digest), auditing a specific SBOM (sbom-reviewer), or dissecting one specific incident (incident-postmortem-research).

0
installs
▌
Incident Postmortem Research · themarmack
On-demand Category 1 researcher for publicly-reported dev-tooling / supply-chain / AI-system incidents relevant to a current bank decision. Pulls the public postmortem (vendor disclosure, CISA advisory, post-incident analyst commentary, peer-bank disclosure if applicable), distills the technique + the missing control + the lesson, and maps to the org's current posture. Output at vault/research/incident/YYYY-MM-DD-{slug}.md. The Mini Shai-Hulud research at [[2026-06-20-actions-hardening-post-shai-hulud]] is an existing instance of this skill's output. Use when the user asks to research, distill, or learn from a specific publicly-reported incident — producing a fresh, cited research note mapped to org posture — not for internal incidents (org incident-response process), the recurring news sweep (weekly-intelligence-digest), or landscape-level supply-chain questions (supply-chain-security-watch).

0
installs
▌
AI Tooling Data Flow Reviewer · themarmack
Given a proposed AI tool integration (Copilot Chat knowledge base, Cursor on a regulated repo, an internal LLM gateway routing to an external provider, a Copilot agentic action that touches a system of record), map the complete data flow and flag every place regulated data could leave the org's boundary. Cross-references vault facts (data residency, content exclusion, audit log paths) to validate the org's posture matches the integration's actual flows. Produces a data-flow diagram (ASCII), a per-hop classification table, and a findings list. Use before greenlighting any new AI tool integration touching production systems or regulated data.

0
installs
▌
Quarterly AI Coding Landscape · themarmack
quarterly-ai-coding-landscape

0
installs
▌
Conference Cfp And Recap Watch · themarmack
conference-cfp-and-recap-watch

0
installs
▌
Secure Coding Standard Checker · themarmack
secure-coding-standard-checker

0
installs
▌
Biweekly Codeql Community Pulse · themarmack
Biweekly scheduled agent. Surveys the github/codeql repo + community packs for new queries, modified queries, and new packs published in the past 14 days. Relevance-scores each against the org's stack (using daily-cve-digest's stack.yml as the source of in-scope ecosystems) — surface only ecosystem-matching results. Output at vault/digests/biweekly/YYYY-MM-DD-codeql-community-pulse.md. Feeds the codeql-pattern-finder skill — every relevant new community query is a candidate for the org's adoption queue. Use when the user asks to run the CodeQL community pulse or see what new community queries or packs shipped upstream — and on its biweekly schedule.

0
installs
▌
Enterprise Audit Log Investigator · themarmack
Run common saved searches against the GitHub enterprise audit log — Copilot policy changes, secret-scanning push-protection bypasses, SSO events, allowed-Actions list edits, content-exclusion changes. Each canonical search has a structured query (the `gh api`-equivalent of the audit log search syntax), the matching `action` types, expected normal volume, alert threshold, and what to do if results spike. Use during incident response (something changed and we need to know who/when), during quarterly audit prep, or proactively as part of a security-monitoring rhythm.

0
installs
▌
Adr Writer · themarmack
Draft an Architecture Decision Record using the org's ADR template. ADRs document **technical decisions** with their context, the decision itself, and the consequences — focused on the "what" and "why" rather than implementation steps. Distinct from RFCs (which propose for discussion) and decision memos (which inform leadership). Output lands as a `decisions/` note in the vault. Use when capturing a technical architecture choice that's been made (or is about to be made) and needs to be discoverable + reviewable by future readers.

0
installs
▌
Rfc Writer · themarmack
Draft a Request for Comments document — a structured proposal for an org-wide change that needs review and discussion before becoming a decision. RFCs go further than ADRs because they propose (not declare) and emphasize the rollout, rollback, risk, and migration mechanics that org-wide changes require. Distinct from ADRs (technical decisions) and decision memos (leadership-facing asks). Output lands as a `decisions/` note with status `proposed`. Use when proposing a change that affects more than one team and requires comment + revision before commitment.

0
installs
▌
Email Sender · themarmack bundle
Send, or preview and show, email delivery of a vault note (digest or research) to your distribution list. Delivery is deterministic — Markdown rendered to styled HTML with the raw `.md` attached, via a committed `render_and_send.py` (no AI call). Scheduled digests auto-send to everyone on the list; research notes prompt `[y/n]` first. A `show_list` action loads and prints the distribution list — who would receive the next send — without sending anything. Recipients come from a plain-Markdown list at `vault/_config/email-distribution.md`. Use when the user asks to email, send, forward, or distribute a digest or research note to their list, OR to show, list, view, preview, check, or validate their email distribution list (who's on it, who would get the next digest) — and immediately after `vault-writer.write_digest` or `vault-writer.write_research` succeeds. Not for composing an ad-hoc personal email or answering a generic SMTP question.

0
installs
▌
Feed Watcher · themarmack
Poll RSS / Atom / JSON-Feed / GitHub-releases sources from the source-registry and return items new since last poll. Dedup state is persisted via seen-tracker under `<repo>/.state/<agent_name>/seen.jsonl`, keyed by the calling agent — feed-watcher holds no state of its own. Composes on source-registry (which sources to poll) and source-fetcher (one-off URL fetch for HTML sources without native feeds). Use when a Category 2 scheduled agent starts its run (its first action, to learn what changed since the last run) and when the user wants a one-shot "what's new in the last N days from sources tagged X" lookup.

0
installs
▌
Seen Tracker · themarmack
Persistent per-skill dedup primitive. Stores `{key, content_hash, seen_at, source_id, metadata}` JSONL state at `<repo>/.state/<consumer-skill>/seen.jsonl` so scheduled agents and curators know what they've already surfaced across runs. Without this, weekly digests repeat last week's news. Exposes `is_new(item)` and `mark_surfaced(item)` semantics. Default-keyed on `url + content_hash`; supports optional title-embedding cluster keys for semantic dedup later. Feed-watcher delegates all its dedup state here, keyed by the calling agent. Use whenever a scheduled agent or curator needs to filter candidates to "new since last run" — after feed-watcher fetches and before digest assembly, and again when marking published items surfaced.

0
installs
▌
Vault Writer · themarmack
Write notes to the Obsidian vault (`vault/`) with the correct folder, filename, and frontmatter schema per surface (fact / event / decision / insight / person / project / research / digest / inbox). Idempotent on key fields — patches existing notes instead of duplicating. Always loads vault-conventions for the canonical schemas; composes with vault-querier for wikilink generation and prompt-injection-guard for any body content sourced from web fetches. Use whenever any skill needs to persist content to the vault; never call Write/Edit on vault files directly.

0
installs

76 published skills