acaprino/defect-taxonomy
plugins/senior-review/skills/defect-taxonomy/SKILL.md
Comprehensive defect taxonomy knowledge base - 16 macro-categories, 140+ subcategories of source code defects with CWE/OWASP mappings, detection strategies, fix patterns, and review frameworks. Used by senior-review agents (code-auditor, security-auditor, ui-race-auditor) to enrich analysis with structured defect knowledge.
$ install --global
skillsauthnpx skillsauth add acaprino/anvil-toolset defect-taxonomyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 28, 2026, 4:05 AM126.2s10 files scanned
SKILL.md
- name:
- defect-taxonomy
- description:
- >
Defect Taxonomy Knowledge Base
Unified classification of source code defects synthesizing MITRE CWE, OWASP Top 10, NASA Power of 10, IBM ODC, IEEE 1044, and Beizer's taxonomy into actionable detection references.
Reference Files
Load relevant references based on the code domain under review. Do NOT load all files -- select only what applies.
Taxonomy References (defect patterns)
| Reference | When to load |
|-----------|-------------|
| references/concurrency-state.md | Concurrent/parallel code, shared state, async patterns, closures, variable scoping |
| references/logic-types.md | Comparisons, boolean logic, type conversions, generics, serialization |
| references/memory-resources.md | Memory management (C/C++/Rust), resource lifecycle, error handling, performance bottlenecks |
| references/security.md | Security review -- injection, auth, crypto, secrets, CORS, SSRF, input validation |
| references/distributed-integration.md | Microservices, APIs, distributed state, message queues, service mesh, migrations |
| references/data-design-ops.md | Database/ORM, design patterns, build/deploy, testing, observability |
| references/detection-matrix.md | Cross-cutting: detection channels per category, language-weighted focus, ROI prioritization |
Review Frameworks (analysis methodology)
| Reference | When to load |
|-----------|-------------|
| references/review-frameworks.md | Always load for code-auditor. Contains cognitive models, failure flow methodology, anti-pattern checklist, mental models, severity/scoring system |
Language-Weighted Category Focus
- C/C++: concurrency-state.md + memory-resources.md (categories 1, 5)
- JVM (Java/Kotlin/Scala): concurrency-state.md + logic-types.md + memory-resources.md (categories 2, 7, 8)
- JavaScript/TypeScript: concurrency-state.md + logic-types.md + security.md (categories 2, 4, 6)
- Python: logic-types.md + security.md + memory-resources.md (categories 4, 6, 7)
- Go/Rust: concurrency-state.md + memory-resources.md (categories 1, 5, 7)
- Microservices (any): distributed-integration.md + data-design-ops.md (categories 8-12)
Usage Instructions
- Identify the language(s) and domain of the code under review
- Load the review-frameworks.md reference (for code-auditor agent)
- Load 1-3 taxonomy references matching the language/domain
- Apply detection strategies from the loaded references during analysis
- Map findings to CWE identifiers where applicable
- Use the detection-matrix.md to prioritize detection approach
Related Skills
acaprino/review-quality-gates
development
VerifiedTrustedCommunity
Quality gates for multi-reviewer code review pipelines: adversarial verification panel, completeness critic, reviewer pipeline conventions, and the context sharing pattern for parallel reviewers. TRIGGER WHEN: running /senior-review:team-review quality gates; running /senior-review:code-review Steps 4b/4c (adversarial verification and completeness check); consolidating or deduplicating findings from multiple parallel reviewers. DO NOT TRIGGER WHEN: single-reviewer style review without a consolidation phase, or generic team coordination (the upstream agent-teams skills cover that).
6SKILL.mdUpdated Jul 28, 2026
acaprino/abstraction-architect
development
VerifiedTrustedCommunity
Knowledge base for pure-architecture decisions on when to unify duplicated logic into a shared abstraction versus leave it duplicated. Covers the canonical theory (Rule of Three, DRY/WET/AHA, Wrong Abstraction, Locality of Behaviour, Bounded Contexts, Tidy First options framing, CUPID vs SOLID), 12 essential-duplication patterns that justify unification, 12 wrong-abstraction patterns that justify inlining or decomposition, an operational decision frame, and a verified reading list. TRIGGER WHEN: the user is making an architectural decision about whether to centralize, extract, or remove a layer; reviewing an abstraction for premature generality; auditing scattered cross-cutting concerns; spawned by the abstraction-architect agent during /abstraction-architect:audit or as the Abstraction dimension of /senior-review:team-review or /senior-review:code-review; the user asks "should I extract this into a service" / "is this DRY enough" / "is this wrong abstraction". DO NOT TRIGGER WHEN: the task is code formatting and readability cleanup (use clean-code:clean-code), Python-specific refactoring with metrics (use python-development:python-refactor), generic dead-code removal (use senior-review:cleanup-dead-code), security review (use senior-review:security-auditor), or pure pattern-consistency review without an architecture lens (use senior-review:code-auditor).
6SKILL.mdUpdated May 26, 2026
acaprino/frontend-css
development
VerifiedTrustedCommunity
Unified web frontend knowledge base covering CSS architecture, UX psychology, UI components, distinctive aesthetics, and interface design generation. TRIGGER WHEN: working on web styling, design systems, component decisions, responsive strategy, distinctive frontend aesthetics, or exploring multiple interface designs. DO NOT TRIGGER WHEN: the task is purely backend or unrelated to web frontend.
6SKILL.mdUpdated May 13, 2026
acaprino/stripe
development
VerifiedTrustedCommunity
Stripe payments knowledge base - API patterns, checkout optimization, subscription lifecycle, pricing strategies, webhook reliability, Firebase integration, cost analysis, and revenue modeling. Loaded by stripe-integrator and revenue-optimizer agents; also consumable directly when the user asks for Stripe-specific patterns without needing an agent. TRIGGER WHEN: working with Stripe API (Payment Intents, Customers, Subscriptions, Checkout Sessions, Connect, webhooks, tax, usage-based billing), pricing strategy, or revenue modeling. DO NOT TRIGGER WHEN: payment work is non-Stripe (PayPal, Square, crypto) or the task is generic e-commerce unrelated to payments.
6SKILL.mdUpdated Apr 20, 2026