external/tgd-skills/tgd-router/SKILL.md
Discovers and invokes agent skills. Use when starting a session or when you need to discover which skill applies to the current task. This is the meta-skill that governs how all other skills are discovered and invoked.
npx skillsauth add seikaikyo/dash-skills tgd-routerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
First, load the
tgd-rulesskill. It is the core rules — the Verification Iron Law, the per-phase tone, the Command Closing Report, and the human sign-off protocol — and it governs every phase. This router is injected at session start; loadingtgd-rulesfrom here is how the rules reliably enter context (there is no separate hook that injects them).
tGD is a collection of engineering workflow skills organized by development phase. Each skill encodes a specific process that senior engineers follow. This meta-skill helps you discover and apply the right skill for your current task.
When a task arrives, identify the development phase and apply the corresponding skill:
Task arrives
│
├── Don't know what you want yet? ──────→ tgd-interview-me
├── Have a rough concept, need variants? → tgd-idea-refine
├── New project/feature/change? ──→ tgd-spec-driven-development
│ └── UI feature? Mock variants → tgd-sketch
├── Have a spec, need tasks? ──────→ tgd-planning-and-task-breakdown
│ └── Want Jira tickets from TASKS.md? → tgd-jira-auto-sync
├── Implementing code? ────────────→ tgd-incremental-implementation
│ ├── Multi-task plan / high-stakes path? → tgd-subagent-driven-development
│ ├── UI work? ─────────────────→ tgd-frontend-ui-engineering
│ ├── API work? ────────────────→ tgd-api-and-interface-design
│ ├── Need better context? ─────→ tgd-context-engineering
│ ├── Need doc-verified code? ───→ tgd-source-driven-development
│ └── Stakes high / unfamiliar code? ──→ tgd-doubt-driven-development
├── Writing/running tests? ────────→ tgd-test-driven-development
│ └── Browser-based? ───────────→ tgd-agent-browser
├── Something broke? ──────────────→ tgd-debugging-and-error-recovery
├── About to claim "done"? ────────→ tgd-verification-before-completion
├── Reviewing code? ───────────────→ tgd-code-review-and-quality
│ ├── Works but overly complex? → tgd-code-simplification
│ ├── Security concerns? ───────→ tgd-security-and-hardening
│ └── Performance concerns? ────→ tgd-performance-optimization
├── Committing/branching? ─────────→ tgd-git-workflow-and-versioning
├── CI/CD pipeline work? ──────────→ tgd-ci-cd-and-automation
├── Writing docs/ADRs? ───────────→ tgd-documentation-and-adrs
├── Removing/migrating old systems? → tgd-deprecation-and-migration
└── Deploying/launching? ─────────→ tgd-shipping-and-launch
These behaviors apply at all times, across all skills. They are non-negotiable.
Before implementing anything non-trivial, explicitly state your assumptions:
ASSUMPTIONS I'M MAKING:
1. [assumption about requirements]
2. [assumption about architecture]
3. [assumption about scope]
→ Correct me now or I'll proceed with these.
Don't silently fill in ambiguous requirements. The most common failure mode is making wrong assumptions and running with them unchecked. Surface uncertainty early — it's cheaper than rework.
When you encounter inconsistencies, conflicting requirements, or unclear specifications:
Bad: Silently picking one interpretation and hoping it's right. Good: "I see X in the spec but Y in the existing code. Which takes precedence?"
You are not a yes-machine. When an approach has clear problems:
Sycophancy is a failure mode. "Of course!" followed by implementing a bad idea helps no one. Honest technical disagreement is more valuable than false agreement.
Your natural tendency is to overcomplicate. Actively resist it.
Before finishing any implementation, ask:
If you build 1000 lines and 100 would suffice, you have failed. Prefer the boring, obvious solution. Cleverness is expensive.
Touch only what you're asked to touch.
Do NOT:
Your job is surgical precision, not unsolicited renovation.
Every skill includes a verification step. A task is not complete until verification passes. "Seems right" is never sufficient — there must be evidence (passing tests, build output, runtime data).
These are the subtle errors that look like productivity but create problems:
Check for an applicable skill before starting work. Skills encode processes that prevent common mistakes.
Skills are workflows, not suggestions. Follow the steps in order. Don't skip verification steps.
Multiple skills can apply. A feature implementation might involve tgd-idea-refine → tgd-spec-driven-development → tgd-planning-and-task-breakdown → tgd-incremental-implementation → tgd-test-driven-development → tgd-code-review-and-quality → tgd-shipping-and-launch in sequence.
When in doubt, start with a spec. If the task is non-trivial and there's no spec, begin with tgd-spec-driven-development.
For a complete feature, the typical skill sequence is:
1. tgd-interview-me → Extract what the user actually wants
2. tgd-idea-refine → Refine vague ideas
3. tgd-spec-driven-development → Define what we're building
4. tgd-planning-and-task-breakdown → Break into verifiable chunks
5. tgd-context-engineering → Load the right context
6. tgd-source-driven-development → Verify against official docs
7. tgd-subagent-driven-development OR tgd-incremental-implementation
→ Fresh subagents per task, or build slice by slice
8. tgd-doubt-driven-development → Cross-examine non-trivial decisions in-flight
9. tgd-test-driven-development → Prove each slice works
10. tgd-verification-before-completion → Evidence before claiming any task done
11. tgd-code-review-and-quality → Review before merge
12. tgd-git-workflow-and-versioning → Clean commit history
13. tgd-documentation-and-adrs → Document decisions
14. tgd-shipping-and-launch → Deploy safely
Not every task needs every skill. A bug fix might only need: tgd-debugging-and-error-recovery → tgd-test-driven-development → tgd-code-review-and-quality.
| Phase | Skill | One-Line Summary | |-------|-------|-----------------| | Define | tgd-interview-me | Surface what the user actually wants before any plan, spec, or code exists | | Define | tgd-idea-refine | Refine ideas through structured divergent and convergent thinking | | Define | tgd-spec-driven-development | Requirements and acceptance criteria before code | | Define | tgd-sketch | Throwaway HTML mockups — 2-3 design variants to compare | | Plan | tgd-planning-and-task-breakdown | Decompose into small, verifiable tasks | | Plan | tgd-jira-auto-sync | Auto-create Jira issues from TASKS.md (opt-in, after /tgd-plan) | | Build | tgd-incremental-implementation | Thin vertical slices, test each before expanding | | Build | tgd-subagent-driven-development | Fresh subagent per task with two-stage review | | Build | tgd-verification-before-completion | Evidence before completion claims, always | | Build | tgd-source-driven-development | Verify against official docs before implementing | | Build | tgd-doubt-driven-development | Adversarial fresh-context review of every non-trivial decision | | Build | tgd-context-engineering | Right context at the right time | | Build | tgd-frontend-ui-engineering | Production-quality UI with accessibility | | Build | tgd-api-and-interface-design | Stable interfaces with clear contracts | | Verify | tgd-test-driven-development | Failing test first, then make it pass | | Verify | tgd-agent-browser | CDP-based browser automation for E2E verification | | Verify | tgd-debugging-and-error-recovery | Reproduce → localize → fix → guard | | Review | tgd-code-review-and-quality | Five-axis review with quality gates | | Review | tgd-security-and-hardening | OWASP prevention, input validation, least privilege | | Review | tgd-performance-optimization | Measure first, optimize only what matters | | Review | tgd-code-simplification | Simplify for clarity without changing behavior | | Release | tgd-git-workflow-and-versioning | Atomic commits, clean history | | Release | tgd-ci-cd-and-automation | Automated quality gates on every change | | Release | tgd-documentation-and-adrs | Document the why, not just the what | | Release | tgd-deprecation-and-migration | Sunset old systems and migrate users safely | | Release | tgd-shipping-and-launch | Pre-launch checklist, monitoring, rollback plan |
tools
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
tools
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
development
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
testing
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.