AL-JANEF
UserJANEF Forge — engineering discipline, deterministic capability routing, verification, security, and context efficiency for AI coding agents.
Categories
Indexed Skills (35)
forge
Entry point and router for JANEF Forge, the engineering-discipline system for coding agents. Use at the start of any substantive software-engineering task (implement, fix, refactor, review, design, migrate, deploy, audit) to apply the engineering contract, estimate risk, and select the smallest sufficient capability set. Invoke as /forge <task>, /forge lean|standard|high-assurance <task>, or /forge security pass. Not for non-technical writing or research.
api-contracts
Design and change REST, GraphQL, RPC, and webhook contracts and the backend services and jobs behind them: validation, authorization scope, error semantics, pagination, idempotency, rate limits, retries, timeouts, versioning, and contract tests. Use for any endpoint, external integration, worker, or queue consumer.
architecture-integrity
Design or change system structure without breaking invariants: module and domain boundaries, dependency direction, new services, queues, caches, datastores, or frameworks, and lasting trade-offs recorded as ADRs. Use when a change crosses components, introduces a durable boundary, or is hard to reverse.
database-integrity
Schema design, migrations, transactions, indexes, query behavior, backfills, and tenant isolation or RLS. Treats every schema or migration change as high risk because deployed data already exists. Use for SQL, ORMs, data models, migration strategy, query performance, or data-integrity questions.
devops-reliability
CI/CD pipelines, containers, infrastructure as code, cloud services and IAM, deployment and rollout strategy, rollback, backups and restore, monitoring and alerting, and reliability controls. Use for any workflow, Dockerfile, Terraform, Kubernetes, cloud, deployment, or operations change. Production and infrastructure mutations require explicit authorization.
frontend-design-quality
Implement visual frontend work with an intentional design direction: inspect the existing design system and tokens, design mobile and desktop deliberately, implement every state (loading, empty, error, disabled, overflow, permission-denied), protect hierarchy and layout stability, and verify rendered behavior. Always composes with accessibility-quality. Use for UI implementation, styling, layout, and component work.
implementation-quality
Write or modify production code to a strict, evidence-gated standard: features, bug fixes, refactors, services, libraries, CLIs, workers, and application logic. Use whenever real application code is being implemented or changed, or when asked whether code is production-ready. Bans placeholders, dead code, silent failures, and unverified completion claims.
performance-scalability
Measure first, then fix latency, throughput, memory, CPU, bundle size, query count, contention, and scaling problems with before/after evidence under the same workload. Use for anything slow, expensive, or expected to scale; never optimize from intuition or trade correctness for speed silently.
root-cause-debugging
Diagnose regressions, flaky behavior, crashes, build errors, and unclear failures with an evidence loop: reproduce, bound, hypothesize, observe, fix the cause at the narrowest correct boundary, then add a regression test. Use for any bug report or failure before patching a symptom.
testing-verification
Select tests by risk, design strong regression and boundary tests, handle flaky suites, and run the completion gate with evidence: exact command, result, scope, and every skipped or blocked check. Use when choosing what to test, judging whether work is done, or producing release evidence. Never weaken a failing test to get green.
auth-hardening
Review, harden, and design authentication and session management: login, logout, session lifecycle, password storage, JWT and cookie handling, refresh tokens, brute-force and enumeration resistance, MFA/OTP, password reset, roles and permissions. Use whenever a task touches sign-in, sessions, tokens, or authorization, even casually. Defensive only.
secrets-guard
Keep secrets out of code, git history, logs, and client bundles: detect hardcoded API keys, credentials, tokens, and connection strings; move them to the environment or a secret manager; catch client-exposed prefixes; set up gitignore and pre-commit scanning; run the rotate-first response when a secret has leaked. Use for any credential, .env, or "where do I put my key?" question.
security-audit
Audit-grade multi-layer security pass: Semgrep SAST, Gitleaks secret scanning, and dependency audit as deterministic ground truth, then specialist review, variant analysis, fix verification, timing review, and an honest coverage verdict naming what was and was not covered. Use for "full security pass", security audit, pre-launch review, or any serious security assessment. Defensive only.
security-logging
Design and review security audit logging and detection: record who did what and when for auth events, data changes, and admin actions; never log passwords, tokens, or PII; keep logs tamper-evident; add a few high-value alerts such as failed-login thresholds. Use for audit trails, log redaction, monitoring, or incident investigation.
skill-security-audit
Gate before adopting any external agent skill, plugin, hook, script, installer, or MCP package: provenance and license review, deterministic static triage (scripts/audit_skill.py), optional NVIDIA SkillSpector scan, and manual review for prompt injection, credential access, exfiltration, and destructive commands. Fails closed on unresolved HIGH/CRITICAL findings or incomplete scans; scanning is a control, not proof of safety.
threat-model
Structured STRIDE threat modeling at design time, before code exists: name assets, actors, and trust boundaries, walk Spoofing/Tampering/Repudiation/Information disclosure/Denial of service/Elevation of privilege at each boundary, rate and prioritize, and turn mitigations into build tasks. Use when designing a system, feature, or API or asking what could go wrong. Defensive only.
variant-hunt
After any vulnerability or bug is confirmed, sweep the entire codebase for every other instance of the same pattern with ripgrep and custom Semgrep rules so the whole class is fixed, not one case. Use right after finding or fixing a security issue, when checking a fix is complete, or to prove a past pattern is eradicated. Defensive only.
vuln-audit
Audit application code for the OWASP Top 10 classes: injection (SQL/NoSQL/command), XSS, CSRF, SSRF, IDOR and broken access control, insecure deserialization, unsafe file upload, and misconfiguration. Use for any security review, "is this safe?", or code that handles untrusted input, queries, uploads, outbound URLs, or objects by ID. Produces a severity-ranked report with concrete fixes and proof. Defensive only.
engineering-standard
Enforce a strict, production-grade engineering standard on any serious coding task — writing, reviewing, refactoring, debugging, or completing a feature. Applies correctness, security, performance, and maintainability discipline; bans placeholder/dead code and silent failures; requires evidence for every claim of success; and gates completion on lint, typecheck, tests, and build. Use this skill whenever the user is building or reviewing real application code, fixing a bug, or asking whether code is production-ready — especially in TypeScript/Node/Next.js and multi-tenant systems. It raises quality and rigor; it does not attack systems or bypass controls.
accessibility-quality
Ship UI that works with keyboard and assistive technology: semantic HTML and native controls first, ARIA only to supplement, logical focus order with visible focus and escape paths, programmatic labels and error association, contrast and non-color meaning, alt text, reduced motion, zoom and reflow. Use for any user-facing UI change and for WCAG audits; never knowingly ship an accessibility regression.
context-efficiency
Tactics for large repositories, noisy tool output, long sessions, and token pressure: search before reading, read ranges not files, keep logs and generated output out of context, never reread unchanged files or rerun unchanged passing checks, prefer deterministic scripts. Use when context volume materially affects execution quality; never reduces necessary reasoning, security, or verification.
delegation-discipline
Decide whether subagents, parallel agents, or agent teams are justified and, if so, delegate safely: one agent unless work is bounded, independent, and clearly owned; explicit outcome, ownership, constraints, and return format per worker; the integrating agent owns final correctness, security review, and verification. Use whenever delegation or parallel execution is being considered.
documentation-integrity
Document implemented, verified reality in the repository's existing source of truth: READMEs, API references, ADRs, runbooks, migration notes, changelogs, and code comments. Use when documentation must be written, updated, or checked for drift; never document unverified capabilities.
git-discipline
Keep history safe and meaningful: inspect status and diff before and after editing, preserve unrelated user work, scope commits logically, write accurate messages, resolve conflicts by understanding both sides, and never rewrite shared history, force-push, or discard work without explicit authorization. Use for commits, branches, merges, rebases, and PR hygiene.
review-defect-first
Independent review of a diff, PR, or file that hunts concrete defects introduced by the change: correctness, security, data loss, authorization or tenant escape, production failure, broken contracts, performance regressions, missing critical tests. Severity-ordered findings citing a real code path; no style inflation; "no qualifying defect" is valid. Use for code review and as the independent gate at high risk.
ui-ux-quality
Make product flows clear and recoverable: primary action and next step obvious, forms with clear labels, validation timing, actionable errors, preserved input on failure, consistent navigation and terminology, and no hidden or surprising destructive actions. Use for user flows, forms, navigation, onboarding, dialogs, and interaction design.
secrets-guard
Prevent secrets from leaking into code, git history, logs, or client bundles — API keys, database credentials, tokens, private keys, and connection strings. Detects hardcoded secrets, guides correct secret management (env vars, secret managers), and sets up prevention (gitignore, pre-commit scanning). Use this skill whenever the user is handling API keys or credentials, setting up environment variables, connecting to external services, committing config, or asks about keeping secrets safe — even a casual "where do I put my API key?". Defensive only.
security-logging
Design and review security audit logging and monitoring — recording who did what and when, detecting suspicious activity (repeated failed logins, unusual access), and doing it without leaking sensitive data into the logs themselves. Use this skill whenever the user is building audit trails, adding logging to sensitive actions, setting up monitoring or alerting, investigating an incident, or asks "how do I track who did X?" — especially for auth events, data changes, and admin actions. Defensive only.
janef
Advanced orchestrated security & engineering command — the command layer of the janefskills suite. Invoke with /janef to run a rigorous, multi-layer security review that combines real automated tooling (Semgrep SAST, Gitleaks secret scanning, dependency audit) with expert LLM review, professional audit methodology (variant analysis, fix verification, timing/constant-time review), and an honest coverage verdict. Routes single tasks to the right specialist (auth-hardening, vuln-audit, threat-model, secrets-guard, security-logging, engineering-standard) or runs a full audit-grade pass. Use whenever the user wants a serious security review. Defensive only: it finds, verifies, and fixes — it never writes exploits or attacks systems.
variant-hunt
After any vulnerability or bug is found, hunt the entire codebase for every other instance of the same pattern — because one bug is almost never alone. Turns a single finding into a systematic sweep using ripgrep and custom Semgrep rules, so the whole class gets fixed, not just the reported case. Use this skill right after finding or fixing a security issue, when reviewing whether a fix is complete, or when a past incident's pattern must be proven eradicated. Defensive only: it finds and eradicates weaknesses, it does not exploit them.
auth-hardening
Review, harden, and design authentication and session management for web applications — login, logout, session lifecycle, password storage, token handling, and brute-force protection. Use this skill whenever the user is building or reviewing sign-in / sign-out flows, JWT or session cookies, password hashing, "remember me", refresh tokens, account lockout, OTP/MFA, or password reset — even if they only mention "login" or "auth" casually. Applies to Node.js, Next.js, and similar stacks. Defensive only: this skill hardens auth systems, it does not bypass or attack them.
threat-model
Run a structured threat-modeling pass at the design stage — before code — to find security risks in an architecture or feature. Uses STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) to systematically ask "how could this be attacked?". Use this skill whenever the user is designing a system, planning a new feature, drawing an architecture, defining APIs, or asks "what could go wrong security-wise?" — especially before implementation begins. Defensive only: it identifies risks and mitigations, it does not plan attacks.
vuln-audit
Audit web application code for common vulnerabilities — the OWASP Top 10 class of bugs: injection (SQL/NoSQL/command), XSS, CSRF, SSRF, IDOR / broken access control, insecure deserialization, unsafe file upload, and security misconfiguration. Use this skill whenever the user asks to review code for security, find vulnerabilities, do a security pass before shipping, or is writing code that handles user input, database queries, file uploads, or external requests — even if they only say "review this" or "is this safe?". Defensive only: this skill finds and fixes weaknesses, it does not write exploits.
janef
Deprecated compatibility alias for /janef from janefskills 1.x. Forwards to the forge entry point; /janef <task> behaves like /forge <task> and /janef full security pass behaves like /forge security pass. Do not use for new work.
risky-skill
A fixture skill that contains patterns the static auditor must flag.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.