Sanitize logs, configs, prompts, stack traces, and skill content before they are shared publicly. Use when a user wants a local, low-risk pass to remove API...
Security
Surgical Contributor (Minimal Diff PR Skill)
Try itDeliver small, high-signal contributions by finding and fixing one real pain point with the narrowest safe change, adding regression protection, and writing...
What it does
Deliver small, high-signal contributions by finding and fixing one real pain point with the narrowest safe change, adding regression protection, and writing...
The skill document
Surgical Contributor
Overview
Execute a disciplined contribution loop: reproduce, isolate, patch minimally, and protect against regressions.
Optimize for:
- Mergeability
- Trust
- Behavior stability
Core Principles
These principles govern all decisions:
- Think before coding: do not assume; surface uncertainty early
- Simplicity first: prefer the smallest solution that fully solves the problem
- Surgical changes: touch only what is required for the fix
- Goal-driven execution: define success via reproduction and verification
If uncertain:
- state assumptions explicitly
- prefer clarification over guessing
- choose the safer, narrower change
Contribution Doctrine
Apply this doctrine in every run:
- Regression-first
- Minimal-diff
- Maintainer-friendly
Refuse these by default unless explicitly requested:
- Broad refactors
- Speculative architecture shifts
- Opportunistic style rewrites
- Feature expansion beyond the bug or paper cut
What “Surgical” Means in Practice
- Only modify the minimal set of files and lines required
- Do not change unrelated code, comments, or formatting
- Match existing patterns and conventions
- Do not introduce abstractions unless strictly necessary
- If a smaller patch works, prefer it
Every changed line must trace directly to the identified problem.
Operating Modes
Choose exactly one mode at the start of work:
-
Bugfix mode
Reproduce a correctness issue, isolate root cause, apply narrow patch, add regression protection. -
Paper-cut mode
Fix high-frequency UX friction in hot paths with minimal behavioral surface area. -
Refactor-under-permission mode
Only when explicitly requested; keep each change independently safe and reviewable. -
Review-my-own-PR mode
Perform a strict maintainer-style critique before final output (no code changes).
Non-code repository fallback
If no executable bug exists, treat the repository as a specification system.
Fix exactly one deterministic weakness:
- ambiguity
- missing constraint
- contradiction
- scope leak
- unenforceable rule
Use the smallest reviewable documentation patch.
Standard Workflow
1. Find one pain point
Select one issue that is:
- Reproducible
- Narrow in scope
- High-value
Prefer:
- State/caching bugs
- Edge-case crashes
- UI-backend drift
- Startup/config issues
- Hot-path UX friction
Stack-Specific Focus
When working in UI-heavy or stateful codebases, prioritize issues where small state mistakes create disproportionate user impact.
Focus areas:
- State synchronization bugs
- Cache invalidation errors
- Selection / batch operation drift
- Undo/redo inconsistencies
- UI-backend contract mismatches
- Interaction edge cases (keyboard, focus, timing)
These bugs often:
- have small fixes
- but high user impact
- and low review resistance when isolated correctly
When available, consult:
references/risk-map.md
Use it during:
- target selection
- self-review
2. Write a tiny change plan before editing
Document:
- Observed behavior
- Expected behavior
- Suspected root cause
- Safest seam to modify
- Risk surface
State assumptions explicitly if any uncertainty exists.
3. Reproduce first
Create a minimal repro:
- Existing test
- New focused test
- Small harness
- Manual repro if needed
Do not fix before proving the failure.
4. Implement the narrowest safe fix
Rules:
- No unrelated cleanup
- Preserve all non-bug behavior
- Prefer local fixes over rewrites
- Avoid new abstractions unless required
- Keep code as simple as possible
If two solutions exist, choose the simpler one.
5. Add regression protection
Add exactly one durable protection:
- Automated test (preferred)
- Focused harness
- Manual verification protocol
Tie directly to the reproduced issue.
6. Run self-review before finalizing
Checklist:
- Is behavior outside the bug unchanged?
- Are state and cache flows still consistent?
- Are edge cases still safe?
- Are UI/interaction flows intact?
- Is platform behavior safe (if relevant)?
- Is naming consistent with the repo?
- Is this the smallest viable patch?
7. Produce maintainer-language PR summary
Use this exact structure:
## What broke
## Root cause
## Why this fix is minimal
## What I tested
## What I intentionally did not change
Related skills
Create CompleteTech LLC security, safety, permissions, and production-readiness review artifacts for agentic development workflows, including risk intake, to...
Sanitize and verify public GitHub contributions
Execute a behavior-preserving refactor with a proof of preservation — establishes a safety net first (existing tests or new characterization tests over every touched path), locks a baseline green run, then moves in small always-green steps where each step is one mechanical transformation, and treats any needed assertion change as a smuggled behavior change to surface, not fix. Use this skill whenever the user says "refactor this", "clean this up without changing behavior", "extract this into", "restructure this module", "rename this across the codebase", "inline this", "split this function/class", or "/safe-refactor" — even if they don't explicitly say "refactoring skill". Do not use for choosing WHAT to refactor (use improve-codebase-architecture) or for changes that are supposed to alter behavior (use task-executor).
Handle external content as untrusted data, verify before use, and isolate inspection in sandboxed environments.
Scan skills in a project directory for security issues and generate a markdown table report, then install skills from a local registry. Combines static analysis of code and markdown files with supply chain checks. Use when auditing a skills directory, generating a security summary table, or installi