[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71KQQREFKM53TYCAB13FABN":3,"skill-same:01M71KQQREFKM53TYCAB13FABN":49},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":22,"linkOnly":23,"markdownContent":24,"markdownBody":25,"frontMatter":26,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":32,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":34,"install":35,"resources":48},"01M71KQQREFKM53TYCAB13FABN","sec-review-fixes",null,"tbeack\u002Ffsad_training","tbeack","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206807984?v=4","01M6K7Q3C3VRTCVC55T71A1SY9","Theo Beack","01M71KPJZ6H9P6B793RT1JXX9R",4,"MIT","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_training\u002Fblob\u002Fmain\u002Fskills\u002Fsec-review-fixes\u002FSKILL.md",[],[18,19,20,21],"fixes","review","review fixes","sec review fixes","2026-11-10 10:56:23",false,"---\nname: sec-review-fixes\ndescription: Companion to `sec-review-team`. Takes the `REPORT.md` or `findings.jsonl` from a security review run and produces fix PRs (one per finding or one consolidated) with interactive approval. Each candidate finding becomes a proposed diff + a regression test that would have caught it + a commit\u002FPR citing the finding ID. Filters by default to `severity IN (critical, high) AND confidence IN (certain, likely)`. Modes: interactive (default), `--dry-run` (produces a fix-plan document with no code changes), `--re-verify` (re-runs sec-review-team against a specific set of finding IDs and reports fixed \u002F still-present \u002F inconclusive). Safeguards: branch-only commits (never main), no force-push, clean-working-tree required, regression-test must pass before commit lands. Use when the user says \"fix the security findings\", \"apply sec-review fixes\", \"open PRs for the security report\", \"re-verify the security fixes\", or similar.\nargument-hint: `[path to REPORT.md or findings.jsonl] [--dry-run | --re-verify \u003Cid>...] [--one-pr | --pr-per-finding]`\n---\n\n# sec-review-fixes — Fix-Workflow Orchestration\n\nCompanion to `sec-review-team`. Never applies a code change without explicit user approval.\n\n## Step 0: Locate findings source\n\nParse `$ARGUMENTS`:\n- **Source path** — either a `REPORT.md` or a `\u003Cagent>.findings.jsonl` file (or a directory containing them, e.g. `\u003Ctarget>\u002F.planning\u002Fsecurity-review\u002F`).\n  - If source is a directory, aggregate every `*.findings.jsonl` in it.\n  - If source is `REPORT.md`, prefer the sibling `*.findings.jsonl` files if they exist (structured parse). Fall back to parsing the markdown if only the prose report is available.\n- **Mode:**\n  - default = interactive\n  - `--dry-run` = write a fix-plan markdown, no code changes\n  - `--re-verify \u003Cid>...` = re-run sec-review-team on the specified finding IDs and report status (skip Steps 2–5)\n- **PR granularity:** `--one-pr` (all fixes in one PR) or `--pr-per-finding` (default for ≤ 3 fixes; for ≥ 4, default switches to one-PR to avoid PR storm).\n\nDo **not** operate on the source target repo yet. Just read metadata.\n\n## Step 1: Filter candidate findings\n\nApply default filter:\n- `severity IN (critical, high)` — medium\u002Flow need manual review first, they are not eligible for auto-fix.\n- `confidence IN (certain, likely)` — `possible`\u002F`unverified` require human triage first; they are not eligible for auto-fix.\n- User may relax the filter explicitly (prompt: \"N findings matched default filter. X additional findings available at lower severity\u002Fconfidence — include them?\").\n\nFor `--re-verify`, skip filtering; use the specified IDs literally.\n\n## Step 2: Safety preflight\n\nBefore touching any file, verify:\n\n1. **Target git state:** Working tree clean (`git status --porcelain` empty). If dirty, abort with explanation. The user must stash\u002Fcommit first.\n2. **Current branch is NOT `main` \u002F `master` \u002F `trunk` \u002F default-branch.** If it is, offer to create `sec-review-fix\u002F\u003Ctimestamp>` and switch. Never operate directly on default.\n3. **No in-progress rebase \u002F merge \u002F cherry-pick** (`git status` shows no in-progress operation).\n4. **Remote reachable** (if PR mode, not dry-run): `git ls-remote --exit-code origin` succeeds.\n5. **`gh` CLI available and authenticated** (if PR mode).\n\nIf any check fails, abort with a specific message. Never proceed past a failed safety check.\n\n## Step 3: Per-finding fix authoring (spawn subagents in parallel)\n\nFor each candidate finding, spawn a `fix-author` `Agent` with:\n\n- **Subagent type:** `general-purpose` (or a typed `code-writer` if available).\n- **Brief:** \"Here is one security finding from sec-review-team: `\u003Cfinding>`. The current state of the code at `\u003Cfile>:\u003Cline_range>` is `\u003Csnippet>`. Produce (1) a diff that implements the `fix` field, (2) a regression test that would fail before the fix and pass after. Write to `\u003CTARGET>\u002F.planning\u002Fsec-review-fixes\u002F\u003Cid>.diff` and `\u003Cid>.test.\u003Cext>` respectively. Also write a one-paragraph commit message at `\u003Cid>.commit-msg.txt`.\"\n- **Allowed tools:** `Read`, `Grep`, `Glob`, read-only `Bash` allowlist. `Write` scoped to the three output paths only. **No `Edit` on target files** — the orchestrator applies diffs later, not the subagent.\n\nSubagents don't mutate target code. They produce candidate artifacts.\n\n## Step 4: Interactive approval (one finding at a time)\n\nFor each candidate:\n\n```\n━━ Finding \u003Cid>: \u003Ctitle> ━━\n  Severity:    \u003Csev>\n  Confidence:  \u003Cconf>\n  File:        \u003Cfile>:\u003Cline_range>\n  Root issue:  \u003Croot_issue>\n\nExploit:\n  \u003Cexploit>\n\nProposed fix:\n  \u003Cfix>\n\nProposed diff:\n  \u003Cdiff contents>\n\nProposed regression test:\n  \u003Ctest contents>\n\nApprove \u002F edit-fix \u002F skip \u002F abort? [a\u002Fe\u002Fs\u002Fx]\n```\n\n- **a** (approve) — move to Step 5 for this finding.\n- **e** (edit-fix) — let the user type revised instructions; respawn the fix-author with the revised brief.\n- **s** (skip) — finding stays un-fixed; continue to next.\n- **x** (abort) — stop all further processing; do not apply any pending approved fixes that haven't been committed yet.\n\nDefault if no response: treat as skip (never auto-approve).\n\nException: `--dry-run` skips this step entirely. The fix-plan is just the collected proposals.\n\n## Step 5: Apply + test + commit + push + PR (per approved finding)\n\n**Still safeguarded.** Even after approval:\n\n1. **Create or checkout the fix branch:** `sec-review-fix\u002F\u003Cfinding-id>` (for per-PR mode) or `sec-review-fix\u002F\u003Ctimestamp>` (for one-PR mode). Never operate on main.\n2. **Apply the diff** via `git apply \u003Cid>.diff`. On failure: mark finding as `apply-failed`, do not commit, continue to next.\n3. **Run the regression test.** How: detect target's test runner (`package.json scripts.test`, `cargo test`, `pytest`, `go test`, etc.) and invoke. The test must pass before proceeding. If it fails, revert (`git checkout -- \u003Caffected>`), mark as `regression-test-failed`, continue to next.\n4. **Commit with message:** the contents of `\u003Cid>.commit-msg.txt`, plus a trailer `Fixes-finding: \u003Cid>` + `Ref: \u003Csource path of findings>`. Default commit message ends with `Co-Authored-By: Claude (sec-review-fixes) \u003Cnoreply@anthropic.com>`.\n5. **Push to origin** (for PR mode only). `git push -u origin \u003Cbranch>`.\n6. **Open PR** via `gh pr create`:\n   - Title: `fix(security): \u003Cfinding title>`\n   - Body: full finding (exploit + fix + evidence), the regression test description, a checklist for the reviewer (manual verification + security implications + adjacent review).\n   - Label: `security`, `sec-review-team`.\n\nSafeguards that stay on throughout:\n- **Never force-push.**\n- **Never push to main.**\n- **Never amend an existing commit.**\n- **Never modify `.git\u002F` directly.**\n- If any safeguard tripping is requested, abort and surface it to the user.\n\n## Step 6: Report\n\nEmit a summary table:\n\n| Finding | Status | PR | Branch |\n|---|---|---|---|\n| auth-001 | fixed + PR opened | #1234 | sec-review-fix\u002Fauth-001 |\n| iv-003 | skipped | — | — |\n| sc-001 | regression-test-failed | — | — |\n| de-002 | apply-failed | — | — |\n\nPrint absolute paths to `.planning\u002Fsec-review-fixes\u002F` artifacts for every candidate (even skipped ones, so the user can come back later).\n\n## `--re-verify` mode\n\nAlternate flow triggered by `--re-verify \u003Cid>...`:\n\n1. Parse the finding IDs from args.\n2. For each ID, look up the original finding metadata (severity, file, root_issue, evidence) from the source `findings.jsonl`.\n3. Invoke `sec-review-team` against the same target and same scope. Wait for new `findings.jsonl`.\n4. For each requested ID:\n   - If no finding with the same `root_issue` + `file` appears in the new run → **fixed**.\n   - If a finding with the same `root_issue` appears → **still-present**. Show the diff between old and new evidence.\n   - If the specialist that would cover this category is not in the new roster (stack changed), or the category was `not-checked` → **inconclusive** (explain why).\n5. Emit a re-verify report at `.planning\u002Fsec-review-fixes\u002Fre-verify-\u003Ctimestamp>.md`.\n\nNever apply fixes in re-verify mode. Pure audit.\n\n## `--dry-run` mode\n\nTriggered by `--dry-run`. Steps 2, 4 (modified), 5 are skipped:\n\n- Step 2 safety preflight still runs (we still inspect repo state) but doesn't require branch-switching.\n- Step 3 still spawns fix-authors (artifact-only).\n- Step 4 shows proposals but doesn't prompt for apply — just collects them.\n- Step 5 is skipped entirely.\n- Instead: write `.planning\u002Fsec-review-fixes\u002Ffix-plan.md` — a human-readable document with every proposed fix + test + commit message, organized by severity. User can hand off to a team for manual implementation.\n\n## Related\n\n- **Companion skill:** [`sec-review-team`](..\u002Fsec-review-team\u002FSKILL.md) produces the input to this skill.\n- **Schema:** [`sec-review-team\u002Fschema\u002Ffinding.schema.json`](..\u002Fsec-review-team\u002Fschema\u002Ffinding.schema.json) — what `findings.jsonl` lines conform to.\n- **Safeguard details:** [`docs\u002Fsafeguards.md`](docs\u002Fsafeguards.md)\n- **Design tradeoffs:** [`sec-review-team\u002Fdocs\u002Ftradeoffs.md`](..\u002Fsec-review-team\u002Fdocs\u002Ftradeoffs.md) — item #5 (no-auto-fix) explains why this skill exists separately.\n","# sec-review-fixes — Fix-Workflow Orchestration\n\nCompanion to `sec-review-team`. Never applies a code change without explicit user approval.\n\n## Step 0: Locate findings source\n\nParse `$ARGUMENTS`:\n- **Source path** — either a `REPORT.md` or a `\u003Cagent>.findings.jsonl` file (or a directory containing them, e.g. `\u003Ctarget>\u002F.planning\u002Fsecurity-review\u002F`).\n  - If source is a directory, aggregate every `*.findings.jsonl` in it.\n  - If source is `REPORT.md`, prefer the sibling `*.findings.jsonl` files if they exist (structured parse). Fall back to parsing the markdown if only the prose report is available.\n- **Mode:**\n  - default = interactive\n  - `--dry-run` = write a fix-plan markdown, no code changes\n  - `--re-verify \u003Cid>...` = re-run sec-review-team on the specified finding IDs and report status (skip Steps 2–5)\n- **PR granularity:** `--one-pr` (all fixes in one PR) or `--pr-per-finding` (default for ≤ 3 fixes; for ≥ 4, default switches to one-PR to avoid PR storm).\n\nDo **not** operate on the source target repo yet. Just read metadata.\n\n## Step 1: Filter candidate findings\n\nApply default filter:\n- `severity IN (critical, high)` — medium\u002Flow need manual review first, they are not eligible for auto-fix.\n- `confidence IN (certain, likely)` — `possible`\u002F`unverified` require human triage first; they are not eligible for auto-fix.\n- User may relax the filter explicitly (prompt: \"N findings matched default filter. X additional findings available at lower severity\u002Fconfidence — include them?\").\n\nFor `--re-verify`, skip filtering; use the specified IDs literally.\n\n## Step 2: Safety preflight\n\nBefore touching any file, verify:\n\n1. **Target git state:** Working tree clean (`git status --porcelain` empty). If dirty, abort with explanation. The user must stash\u002Fcommit first.\n2. **Current branch is NOT `main` \u002F `master` \u002F `trunk` \u002F default-branch.** If it is, offer to create `sec-review-fix\u002F\u003Ctimestamp>` and switch. Never operate directly on default.\n3. **No in-progress rebase \u002F merge \u002F cherry-pick** (`git status` shows no in-progress operation).\n4. **Remote reachable** (if PR mode, not dry-run): `git ls-remote --exit-code origin` succeeds.\n5. **`gh` CLI available and authenticated** (if PR mode).\n\nIf any check fails, abort with a specific message. Never proceed past a failed safety check.\n\n## Step 3: Per-finding fix authoring (spawn subagents in parallel)\n\nFor each candidate finding, spawn a `fix-author` `Agent` with:\n\n- **Subagent type:** `general-purpose` (or a typed `code-writer` if available).\n- **Brief:** \"Here is one security finding from sec-review-team: `\u003Cfinding>`. The current state of the code at `\u003Cfile>:\u003Cline_range>` is `\u003Csnippet>`. Produce (1) a diff that implements the `fix` field, (2) a regression test that would fail before the fix and pass after. Write to `\u003CTARGET>\u002F.planning\u002Fsec-review-fixes\u002F\u003Cid>.diff` and `\u003Cid>.test.\u003Cext>` respectively. Also write a one-paragraph commit message at `\u003Cid>.commit-msg.txt`.\"\n- **Allowed tools:** `Read`, `Grep`, `Glob`, read-only `Bash` allowlist. `Write` scoped to the three output paths only. **No `Edit` on target files** — the orchestrator applies diffs later, not the subagent.\n\nSubagents don't mutate target code. They produce candidate artifacts.\n\n## Step 4: Interactive approval (one finding at a time)\n\nFor each candidate:\n\n```\n━━ Finding \u003Cid>: \u003Ctitle> ━━\n  Severity:    \u003Csev>\n  Confidence:  \u003Cconf>\n  File:        \u003Cfile>:\u003Cline_range>\n  Root issue:  \u003Croot_issue>\n\nExploit:\n  \u003Cexploit>\n\nProposed fix:\n  \u003Cfix>\n\nProposed diff:\n  \u003Cdiff contents>\n\nProposed regression test:\n  \u003Ctest contents>\n\nApprove \u002F edit-fix \u002F skip \u002F abort? [a\u002Fe\u002Fs\u002Fx]\n```\n\n- **a** (approve) — move to Step 5 for this finding.\n- **e** (edit-fix) — let the user type revised instructions; respawn the fix-author with the revised brief.\n- **s** (skip) — finding stays un-fixed; continue to next.\n- **x** (abort) — stop all further processing; do not apply any pending approved fixes that haven't been committed yet.\n\nDefault if no response: treat as skip (never auto-approve).\n\nException: `--dry-run` skips this step entirely. The fix-plan is just the collected proposals.\n\n## Step 5: Apply + test + commit + push + PR (per approved finding)\n\n**Still safeguarded.** Even after approval:\n\n1. **Create or checkout the fix branch:** `sec-review-fix\u002F\u003Cfinding-id>` (for per-PR mode) or `sec-review-fix\u002F\u003Ctimestamp>` (for one-PR mode). Never operate on main.\n2. **Apply the diff** via `git apply \u003Cid>.diff`. On failure: mark finding as `apply-failed`, do not commit, continue to next.\n3. **Run the regression test.** How: detect target's test runner (`package.json scripts.test`, `cargo test`, `pytest`, `go test`, etc.) and invoke. The test must pass before proceeding. If it fails, revert (`git checkout -- \u003Caffected>`), mark as `regression-test-failed`, continue to next.\n4. **Commit with message:** the contents of `\u003Cid>.commit-msg.txt`, plus a trailer `Fixes-finding: \u003Cid>` + `Ref: \u003Csource path of findings>`. Default commit message ends with `Co-Authored-By: Claude (sec-review-fixes) \u003Cnoreply@anthropic.com>`.\n5. **Push to origin** (for PR mode only). `git push -u origin \u003Cbranch>`.\n6. **Open PR** via `gh pr create`:\n   - Title: `fix(security): \u003Cfinding title>`\n   - Body: full finding (exploit + fix + evidence), the regression test description, a checklist for the reviewer (manual verification + security implications + adjacent review).\n   - Label: `security`, `sec-review-team`.\n\nSafeguards that stay on throughout:\n- **Never force-push.**\n- **Never push to main.**\n- **Never amend an existing commit.**\n- **Never modify `.git\u002F` directly.**\n- If any safeguard tripping is requested, abort and surface it to the user.\n\n## Step 6: Report\n\nEmit a summary table:\n\n| Finding | Status | PR | Branch |\n|---|---|---|---|\n| auth-001 | fixed + PR opened | #1234 | sec-review-fix\u002Fauth-001 |\n| iv-003 | skipped | — | — |\n| sc-001 | regression-test-failed | — | — |\n| de-002 | apply-failed | — | — |\n\nPrint absolute paths to `.planning\u002Fsec-review-fixes\u002F` artifacts for every candidate (even skipped ones, so the user can come back later).\n\n## `--re-verify` mode\n\nAlternate flow triggered by `--re-verify \u003Cid>...`:\n\n1. Parse the finding IDs from args.\n2. For each ID, look up the original finding metadata (severity, file, root_issue, evidence) from the source `findings.jsonl`.\n3. Invoke `sec-review-team` against the same target and same scope. Wait for new `findings.jsonl`.\n4. For each requested ID:\n   - If no finding with the same `root_issue` + `file` appears in the new run → **fixed**.\n   - If a finding with the same `root_issue` appears → **still-present**. Show the diff between old and new evidence.\n   - If the specialist that would cover this category is not in the new roster (stack changed), or the category was `not-checked` → **inconclusive** (explain why).\n5. Emit a re-verify report at `.planning\u002Fsec-review-fixes\u002Fre-verify-\u003Ctimestamp>.md`.\n\nNever apply fixes in re-verify mode. Pure audit.\n\n## `--dry-run` mode\n\nTriggered by `--dry-run`. Steps 2, 4 (modified), 5 are skipped:\n\n- Step 2 safety preflight still runs (we still inspect repo state) but doesn't require branch-switching.\n- Step 3 still spawns fix-authors (artifact-only).\n- Step 4 shows proposals but doesn't prompt for apply — just collects them.\n- Step 5 is skipped entirely.\n- Instead: write `.planning\u002Fsec-review-fixes\u002Ffix-plan.md` — a human-readable document with every proposed fix + test + commit message, organized by severity. User can hand off to a team for manual implementation.\n\n## Related\n\n- **Companion skill:** [`sec-review-team`](..\u002Fsec-review-team\u002FSKILL.md) produces the input to this skill.\n- **Schema:** [`sec-review-team\u002Fschema\u002Ffinding.schema.json`](..\u002Fsec-review-team\u002Fschema\u002Ffinding.schema.json) — what `findings.jsonl` lines conform to.\n- **Safeguard details:** [`docs\u002Fsafeguards.md`](docs\u002Fsafeguards.md)\n- **Design tradeoffs:** [`sec-review-team\u002Fdocs\u002Ftradeoffs.md`](..\u002Fsec-review-team\u002Fdocs\u002Ftradeoffs.md) — item #5 (no-auto-fix) explains why this skill exists separately.\n",{},"main","e32e0d2b9fad831f2915fc773e03fd68d98c8c1e","skills\u002Fsec-review-fixes",0,"https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_training","https:\u002F\u002Ffsad-training.vercel.app","https:\u002F\u002Fgithub.com\u002Ftbeack","2026-10-12 21:23:30",{"source":7,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add tbeack\u002Ffsad_training --skill sec-review-fixes",{"tool":41,"command":42},"bunx","bunx skills add tbeack\u002Ffsad_training --skill sec-review-fixes",{"tool":44,"command":45},"pnpm","pnpm dlx skills add tbeack\u002Ffsad_training --skill sec-review-fixes","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_training\u002Fblob\u002Fmain\u002Fskills\u002Fsec-review-fixes\u002FSKILL.md",true,[],[50,59,67,89,110,119],{"skillNo":51,"name":52,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":22},"01M71KR8NEVXYHFZ9YF9PBEMH9","verify-ac","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_training\u002Fblob\u002Fmain\u002Fskills\u002Fverify-ac\u002FSKILL.md",[],[56,57,58],"verify ac","ac","verify",{"skillNo":60,"name":61,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":22},"01M71KR6NR71VM37PJX36EM18X","spec-review","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_training\u002Fblob\u002Fmain\u002Fskills\u002Fspec-review\u002FSKILL.md",[],[65,19,66],"spec","spec review",{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":73,"publishedAt":22},"01M71KR55DS0Q45W9YF0516AX4","ship","Short alias for \u002Ffsad-harness:ship-it. Wrap up finished work, cut a version, commit, push, and open a PR.","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_training\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002FSKILL.md",[],[69,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88],"it","commit","version","wrap up","open","wrap","up","short","cut","for","pr","push","alias","work","harness",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":22},"01M71KR0YNJ99YAJGEDPHZTTTQ","ship-it","Wrap up a finished round of work — verify README and CHANGELOG are current, cut a version if warranted, move completed task files into the completed\u002F folder, then create a feature branch if needed, commit, push, and open a PR. Run after `\u002Ffsad-harness:do-task` has marked one or more tasks done. Takes no arguments.","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_training\u002Fblob\u002Fmain\u002Fskills\u002Fship-it\u002FSKILL.md",[],[74,69,96,97,98,99,100,101,102,103,80,78,104,105,106,107,75,108,109,87],"ship it","files","ls","branch","checkout","parse","move","gh pr","remote","done","Bash","tasks","log","create",{"skillNo":111,"name":112,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":22},"01M71KQZ640W3AQ707NFDANCMW","set-context","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_training\u002Fblob\u002Fmain\u002Fskills\u002Fset-context\u002FSKILL.md",[],[116,117,118],"context","set context","SET",{"skillNo":120,"name":121,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":22},"01M71KQV6HR3HP3G2K0BFC011Y","sec-review-team","https:\u002F\u002Fgithub.com\u002Ftbeack\u002Ffsad_training\u002Fblob\u002Fmain\u002Fskills\u002Fsec-review-team\u002FSKILL.md",[],[19,125,126,127],"team","review team","sec review team"]