[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M754NE52CNAGT2YYZC8XWHC4":3,"skill-same:01M754NE52CNAGT2YYZC8XWHC4":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":32,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":35,"ownerDescription":36,"updatedAt":37,"install":38,"resources":50},"01M754NE52CNAGT2YYZC8XWHC4","x-generate-security-dashboard",null,"Aggregates results from all security scanning skills into a unified posture view with score 0-100, trend tracking, OWASP risk heatmap, per-dimension breakdown, and remediation priority queue. Never executes scans — reads existing results only (RULE-011).","review-bench\u002Federcnj_ia-dev-environment","review-bench","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F286778065?v=4","01M7517F9NTEPDZDAXJBR30FWT","ReviewBench","01M7517FAC9F4P7TGWCNJ8VYVW",0,"MIT","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-generate-security-dashboard\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: x-generate-security-dashboard\ndescription: \"Aggregates results from all security scanning skills into a unified posture view with score 0-100, trend tracking, OWASP risk heatmap, per-dimension breakdown, and remediation priority queue. Never executes scans — reads existing results only (RULE-011).\"\nuser-invocable: true\nallowed-tools: Read, Write, Bash, Grep, Glob\nargument-hint: \"[--period last-7d|last-30d|last-90d|all] [--format markdown|json] [--compare-previous]\"\ncontext-budget: medium\nrequires-capabilities: []\n---\n\n## Global Output Policy\n\n- **Language**: English ONLY.\n- **Tone**: Technical, Direct, and Concise.\n- **Efficiency**: Remove all conversational fillers and greetings to save tokens.\n\n# Skill: Security Posture Dashboard\n\n## Purpose\n\nGenerates a consolidated security posture dashboard for {{PROJECT_NAME}} by aggregating results from all security scanning skills. This is the central visibility point for the project's security status.\n\n**Critical constraint (RULE-011 — Skill Composability):** This skill NEVER executes scans. It reads existing scan results from `results\u002Fsecurity\u002F` and aggregates them. Each scanning dimension is owned by its atomic skill; the dashboard only consumes their output.\n\n## Triggers\n\n- `\u002Fx-generate-security-dashboard` — full dashboard with all available dimensions (period: all)\n- `\u002Fx-generate-security-dashboard --period last-30d` — dashboard for the last 30 days\n- `\u002Fx-generate-security-dashboard --format json` — JSON output instead of Markdown\n- `\u002Fx-generate-security-dashboard --compare-previous` — include trend comparison with previous period\n- `\u002Fx-generate-security-dashboard --period last-7d --compare-previous` — 7-day window with trend\n\n## Parameters\n\n| Parameter | Type | Default | Validation | Description |\n|-----------|------|---------|------------|-------------|\n| `--period` | String | all | enum: last-7d, last-30d, last-90d, all | Analysis time window |\n| `--format` | String | markdown | enum: markdown, json | Output format |\n| `--compare-previous` | boolean | false | -- | Include comparison with the preceding period of equal length |\n\n### Parameter Rules\n\n- `--period` controls which scan result files are included (by timestamp in filename)\n- `--compare-previous` requires `--period` to be one of `last-7d`, `last-30d`, `last-90d` (not `all`)\n- When `--compare-previous` is used with `--period all`, ignore the flag and omit trend data\n\n## Aggregated Dimensions\n\nThe dashboard aggregates results from 10 security dimensions. Each dimension maps to one or more atomic scanning skills:\n\n| Dimension | Source Skill(s) | Weight | Results Pattern |\n|-----------|----------------|--------|-----------------|\n| Static Analysis | x-run-sast | 20% | `results\u002Fsecurity\u002Fsast-*.sarif.json` |\n| Dynamic Analysis | x-run-dast | 15% | `results\u002Fsecurity\u002Fdast-*.sarif.json` |\n| Secrets | x-scan-secrets | 15% | `results\u002Fsecurity\u002Fsecret-scan-*.sarif.json` |\n| Container Security | x-scan-container-security | 10% | `results\u002Fsecurity\u002Fcontainer-scan-*.sarif.json` |\n| Infrastructure | x-assess-infrastructure-security | 10% | `results\u002Fsecurity\u002Finfra-scan-*.sarif.json` |\n| OWASP Compliance | x-scan-owasp | 10% | `results\u002Fsecurity\u002Fowasp-scan-*.sarif.json` |\n| Code Quality (Security) | x-run-sonar-security | 5% | `results\u002Fsecurity\u002Fsonar-gate-*.sarif.json` |\n| Hardening | x-evaluate-hardening | 5% | `results\u002Fsecurity\u002Fhardening-eval-*.sarif.json` |\n| Runtime Protection | x-evaluate-runtime | 5% | `results\u002Fsecurity\u002Fruntime-protection-*.sarif.json` |\n| Supply Chain | x-audit-supply-chain + x-audit-dependencies | 5% | `results\u002Fsecurity\u002Fsupply-chain-*.sarif.json`, `results\u002Fsecurity\u002Fdependency-audit-*.sarif.json` |\n\n**Weight redistribution:** When a dimension has no results, its weight is redistributed proportionally among available dimensions. The formula:\n\n```\nadjusted_weight[i] = base_weight[i] \u002F sum(base_weight[available_dimensions])\n```\n\n## Workflow\n\n```\n1. SCAN DIRECTORY  -> List all files in results\u002Fsecurity\u002F\n2. FILTER PERIOD   -> Keep only files within the selected time window\n3. PARSE RESULTS   -> Read SARIF files and extract findings per dimension\n4. SCORE           -> Compute per-dimension and overall scores\n5. TREND           -> Compare with previous period (if --compare-previous)\n6. HEATMAP         -> Build OWASP category x severity matrix\n7. TOP FINDINGS    -> Select top 10 findings by risk\n8. QUEUE           -> Build remediation priority queue\n9. RENDER          -> Output dashboard in selected format\n```\n\n### Step 1 — Scan Results Directory\n\nRead the `results\u002Fsecurity\u002F` directory. For each file, extract the scan type and timestamp from the filename:\n\n```\nresults\u002Fsecurity\u002F{scan-type}-{YYYYMMDD}-{HHMMSS}.sarif.json\n```\n\nMap each file to its dimension using the Results Pattern column from the dimensions table.\n\n### Step 2 — Filter by Period\n\nApply the `--period` filter based on the timestamp extracted from filenames:\n\n| Period | Include Files From |\n|--------|--------------------|\n| last-7d | Now minus 7 days to now |\n| last-30d | Now minus 30 days to now |\n| last-90d | Now minus 90 days to now |\n| all | All available results |\n\nFor each dimension, use the **most recent** file within the period.\n\n### Step 3 — Parse SARIF Results\n\nFor each dimension's SARIF file, extract:\n- `runs[0].results[]` — all findings\n- Per finding: `ruleId`, `level`, `message.text`, `locations[].physicalLocation`, `properties.severity`, `properties.owasp-category`\n- Count findings by severity: CRITICAL, HIGH, MEDIUM, LOW, INFO\n\n### Step 4 — Compute Scores\n\nPer-dimension score uses the security scoring model:\n\n```\ndimension_score = max(0, 100 - sum(severity_weight * count_per_severity))\n```\n\nSeverity weights (from `references\u002Fsecurity-scoring.md`):\n\n| Severity | Weight |\n|----------|--------|\n| CRITICAL | 10 |\n| HIGH | 5 |\n| MEDIUM | 2 |\n| LOW | 1 |\n| INFO | 0 |\n\nGrade thresholds:\n\n| Grade | Score Range |\n|-------|------------|\n| A | 90-100 |\n| B | 80-89 |\n| C | 70-79 |\n| D | 60-69 |\n| F | 0-59 |\n\nOverall score is the weighted average of available dimension scores:\n\n```\noverall_score = round(\n    sum(dimension_score[i] * adjusted_weight[i])\n    for i in available_dimensions\n)\n```\n\n### Step 5 — Trend Analysis\n\nWhen `--compare-previous` is active, compute the previous period window:\n\n| Current Period | Previous Period |\n|---------------|----------------|\n| last-7d | 14 days ago to 7 days ago |\n| last-30d | 60 days ago to 30 days ago |\n| last-90d | 180 days ago to 90 days ago |\n\nTrend classification per dimension and overall:\n\n| Trend | Condition |\n|-------|-----------|\n| improving | current_score - previous_score >= 5 |\n| stable | abs(current_score - previous_score) \u003C 5 |\n| degrading | previous_score - current_score >= 5 |\n\nWhen no previous period data exists for a dimension, set trend to `null` (omit from output).\n\n### Step 6 — Risk Heatmap\n\nBuild a matrix of OWASP Top 10 categories (rows) x severity levels (columns):\n\n**Rows:** A01 (Broken Access Control), A02 (Cryptographic Failures), A03 (Injection), A04 (Insecure Design), A05 (Security Misconfiguration), A06 (Vulnerable Components), A07 (Auth Failures), A08 (Data Integrity Failures), A09 (Logging Failures), A10 (SSRF), CUSTOM (unmapped findings)\n\n**Columns:** CRITICAL, HIGH, MEDIUM, LOW\n\nEach cell contains the count of findings matching that category-severity pair across ALL dimensions.\n\n### Step 7 — Top 10 Findings\n\nSelect the 10 highest-risk findings across all dimensions, ordered by:\n1. Severity (CRITICAL > HIGH > MEDIUM > LOW > INFO)\n2. OWASP category priority (A01-A03 higher than A04-A10)\n3. Most recent scan date\n\nFor each finding, include: dimension, ruleId, severity, OWASP category, file location, message, and remediation recommendation.\n\n### Step 8 — Remediation Priority Queue\n\nOrder ALL findings by remediation priority:\n\n```\npriority = severity_weight * (1 + owasp_priority_bonus) \u002F estimated_effort\n```\n\nWhere:\n- `severity_weight`: CRITICAL=10, HIGH=5, MEDIUM=2, LOW=1\n- `owasp_priority_bonus`: A01-A03=0.5, A04-A06=0.3, A07-A10=0.1, CUSTOM=0.0\n- `estimated_effort`: based on fix complexity (default 1.0 when unknown)\n\n### Step 9 — Render Output\n\n#### 9.1 — Markdown Format\n\n```markdown\n# Security Posture Dashboard\n\n**Project**: {{PROJECT_NAME}}\n**Period**: {period}\n**Generated**: {YYYY-MM-DD HH:MM:SS}\n**Dimensions Available**: {count}\u002F{total}\n\n## Overall Score\n\n| Metric | Value |\n|--------|-------|\n| Score | {overall_score}\u002F100 |\n| Grade | {overall_grade} |\n| Trend | {overall_trend} {delta} |\n| Total Findings | {total_findings} |\n| Critical | {critical_count} |\n| High | {high_count} |\n| Medium | {medium_count} |\n| Low | {low_count} |\n\n## Per-Dimension Scores\n\n| Dimension | Source | Score | Grade | Trend | Findings | Critical | High |\n|-----------|--------|-------|-------|-------|----------|----------|------|\n| Static Analysis | x-run-sast | {score} | {grade} | {trend} | {count} | {c} | {h} |\n| Dynamic Analysis | x-run-dast | {score} | {grade} | {trend} | {count} | {c} | {h} |\n| ... | ... | ... | ... | ... | ... | ... | ... |\n\n### Missing Dimensions\n\n{list of dimensions with no results, if any}\n\n## Risk Heatmap (OWASP Top 10 x Severity)\n\n| Category | CRITICAL | HIGH | MEDIUM | LOW | Total |\n|----------|----------|------|--------|-----|-------|\n| A01 Broken Access Control | {n} | {n} | {n} | {n} | {n} |\n| A02 Cryptographic Failures | {n} | {n} | {n} | {n} | {n} |\n| A03 Injection | {n} | {n} | {n} | {n} | {n} |\n| ... | ... | ... | ... | ... | ... |\n| **Total** | **{n}** | **{n}** | **{n}** | **{n}** | **{n}** |\n\n## Top 10 Findings\n\n### 1. [{severity}] {ruleId} ({dimension})\n- **File**: {file}:{line}\n- **OWASP**: {category}\n- **Message**: {message}\n- **Fix**: {remediation}\n\n...\n\n## Remediation Priority Queue\n\n| # | Severity | Rule | Dimension | File | Priority Score |\n|---|----------|------|-----------|------|---------------|\n| 1 | CRITICAL | {rule} | {dim} | {file} | {score} |\n| 2 | HIGH | {rule} | {dim} | {file} | {score} |\n| ... | ... | ... | ... | ... | ... |\n```\n\n#### 9.2 — JSON Format\n\n```json\n{\n  \"project\": \"{{PROJECT_NAME}}\",\n  \"period\": \"{period}\",\n  \"generatedAt\": \"{ISO-8601}\",\n  \"overallScore\": 74,\n  \"overallGrade\": \"C\",\n  \"overallTrend\": \"improving\",\n  \"totalFindings\": 87,\n  \"dimensionsAvailable\": 8,\n  \"dimensionsMissing\": [\"x-scan-container-security\", \"x-assess-infrastructure-security\"],\n  \"dimensions\": [\n    {\n      \"dimension\": \"Static Analysis\",\n      \"source\": \"x-run-sast\",\n      \"weight\": 0.20,\n      \"score\": 85,\n      \"grade\": \"B\",\n      \"findingsCount\": 12,\n      \"criticalCount\": 1,\n      \"highCount\": 3,\n      \"trend\": \"improving\",\n      \"lastScanDate\": \"2026-04-05\",\n      \"available\": true\n    }\n  ],\n  \"riskHeatmap\": {\n    \"rows\": [\"A01\", \"A02\", \"A03\", \"A04\", \"A05\", \"A06\", \"A07\", \"A08\", \"A09\", \"A10\", \"CUSTOM\"],\n    \"columns\": [\"CRITICAL\", \"HIGH\", \"MEDIUM\", \"LOW\"],\n    \"cells\": {\n      \"A01\": {\"CRITICAL\": 1, \"HIGH\": 3, \"MEDIUM\": 2, \"LOW\": 0},\n      \"A03\": {\"CRITICAL\": 0, \"HIGH\": 2, \"MEDIUM\": 5, \"LOW\": 1}\n    },\n    \"totals\": {\"CRITICAL\": 3, \"HIGH\": 12, \"MEDIUM\": 18, \"LOW\": 8}\n  },\n  \"top10Findings\": [\n    {\n      \"rank\": 1,\n      \"dimension\": \"Static Analysis\",\n      \"ruleId\": \"SAST-001\",\n      \"severity\": \"CRITICAL\",\n      \"owaspCategory\": \"A03\",\n      \"file\": \"src\u002Fmain\u002Fjava\u002FHandler.java\",\n      \"line\": 42,\n      \"message\": \"SQL Injection vulnerability\",\n      \"remediation\": \"Use parameterized queries\"\n    }\n  ],\n  \"remediationQueue\": [\n    {\n      \"priority\": 1,\n      \"severity\": \"CRITICAL\",\n      \"ruleId\": \"SAST-001\",\n      \"dimension\": \"Static Analysis\",\n      \"file\": \"src\u002Fmain\u002Fjava\u002FHandler.java\",\n      \"priorityScore\": 15.0\n    }\n  ]\n}\n```\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| `results\u002Fsecurity\u002F` empty or missing | Set score to 0, grade to F, list all 10 dimensions as missing |\n| Partial results (some dimensions available) | Score from available dimensions, redistribute weights, list missing |\n| Malformed SARIF file | Log warning with filename and parse error, exclude dimension, continue |\n| No previous period data (with --compare-previous) | Set trend to null, note \"No previous period data available\" |\n| --compare-previous with --period all | Ignore the flag, omit trend data |\n| Invalid --period value | Error with valid options list |\n\n## Idempotency\n\n### Output Files\n\n```\nresults\u002Fsecurity\u002Fdashboard-{YYYYMMDD}-{HHMMSS}.md\nresults\u002Fsecurity\u002Fdashboard-{YYYYMMDD}-{HHMMSS}.json\n```\n\n- Each dashboard run creates a new timestamped file\n- Previous dashboard outputs are never modified\n- Both Markdown and JSON files are generated regardless of `--format` flag\n- The `--format` flag controls what is displayed to the user\n\n### Performance\n\n- Dashboard generation MUST complete in under 5 seconds\n- SARIF file parsing uses streaming when files exceed 1MB\n- Dimension aggregation can be parallelized (no shared state between dimensions)\n\n## Composability (RULE-011 — Skill Composability)\n\nThis skill is an **aggregator**, not a scanner. It MUST:\n- NEVER invoke x-run-sast, x-run-dast, or any other scanning skill\n- NEVER duplicate scanning logic from any atomic skill\n- Read ONLY from `results\u002Fsecurity\u002F` (the shared output directory)\n- Respect the SARIF 2.1.0 schema defined in `references\u002Fsarif-template.md`\n- Use the scoring model defined in `references\u002Fsecurity-scoring.md`\n\nIf a user needs fresh scan data, run the individual scanning skills first, then invoke this dashboard.\n\n## Knowledge Pack References\n\n| # | Knowledge Pack | Path | Purpose |\n|---|----------------|------|---------|\n| 1 | Security Scoring | `knowledge\u002Fsecurity\u002Fsecurity-scoring.md` | Scoring model and grade thresholds |\n| 2 | Security Skill Template | `knowledge\u002Fsecurity\u002Fsecurity-skill-template.md` | Output conventions for scan results |\n\n## Integration Notes\n\n| Skill | Relationship | Context |\n|-------|-------------|---------|\n| x-run-sast | Consumes output | Static analysis SARIF results (20% weight) |\n| x-run-dast | Consumes output | Dynamic analysis SARIF results (15% weight) |\n| x-scan-secrets | Consumes output | Secrets detection SARIF results (15% weight) |\n| x-scan-owasp | Consumes output | OWASP compliance SARIF results (10% weight) |\n| x-audit-dependencies | Consumes output | Supply chain SARIF results (5% weight) |\n| x-audit-supply-chain | Consumes output | Supply chain SARIF results (5% weight) |\n","## Global Output Policy\n\n- **Language**: English ONLY.\n- **Tone**: Technical, Direct, and Concise.\n- **Efficiency**: Remove all conversational fillers and greetings to save tokens.\n\n# Skill: Security Posture Dashboard\n\n## Purpose\n\nGenerates a consolidated security posture dashboard for {{PROJECT_NAME}} by aggregating results from all security scanning skills. This is the central visibility point for the project's security status.\n\n**Critical constraint (RULE-011 — Skill Composability):** This skill NEVER executes scans. It reads existing scan results from `results\u002Fsecurity\u002F` and aggregates them. Each scanning dimension is owned by its atomic skill; the dashboard only consumes their output.\n\n## Triggers\n\n- `\u002Fx-generate-security-dashboard` — full dashboard with all available dimensions (period: all)\n- `\u002Fx-generate-security-dashboard --period last-30d` — dashboard for the last 30 days\n- `\u002Fx-generate-security-dashboard --format json` — JSON output instead of Markdown\n- `\u002Fx-generate-security-dashboard --compare-previous` — include trend comparison with previous period\n- `\u002Fx-generate-security-dashboard --period last-7d --compare-previous` — 7-day window with trend\n\n## Parameters\n\n| Parameter | Type | Default | Validation | Description |\n|-----------|------|---------|------------|-------------|\n| `--period` | String | all | enum: last-7d, last-30d, last-90d, all | Analysis time window |\n| `--format` | String | markdown | enum: markdown, json | Output format |\n| `--compare-previous` | boolean | false | -- | Include comparison with the preceding period of equal length |\n\n### Parameter Rules\n\n- `--period` controls which scan result files are included (by timestamp in filename)\n- `--compare-previous` requires `--period` to be one of `last-7d`, `last-30d`, `last-90d` (not `all`)\n- When `--compare-previous` is used with `--period all`, ignore the flag and omit trend data\n\n## Aggregated Dimensions\n\nThe dashboard aggregates results from 10 security dimensions. Each dimension maps to one or more atomic scanning skills:\n\n| Dimension | Source Skill(s) | Weight | Results Pattern |\n|-----------|----------------|--------|-----------------|\n| Static Analysis | x-run-sast | 20% | `results\u002Fsecurity\u002Fsast-*.sarif.json` |\n| Dynamic Analysis | x-run-dast | 15% | `results\u002Fsecurity\u002Fdast-*.sarif.json` |\n| Secrets | x-scan-secrets | 15% | `results\u002Fsecurity\u002Fsecret-scan-*.sarif.json` |\n| Container Security | x-scan-container-security | 10% | `results\u002Fsecurity\u002Fcontainer-scan-*.sarif.json` |\n| Infrastructure | x-assess-infrastructure-security | 10% | `results\u002Fsecurity\u002Finfra-scan-*.sarif.json` |\n| OWASP Compliance | x-scan-owasp | 10% | `results\u002Fsecurity\u002Fowasp-scan-*.sarif.json` |\n| Code Quality (Security) | x-run-sonar-security | 5% | `results\u002Fsecurity\u002Fsonar-gate-*.sarif.json` |\n| Hardening | x-evaluate-hardening | 5% | `results\u002Fsecurity\u002Fhardening-eval-*.sarif.json` |\n| Runtime Protection | x-evaluate-runtime | 5% | `results\u002Fsecurity\u002Fruntime-protection-*.sarif.json` |\n| Supply Chain | x-audit-supply-chain + x-audit-dependencies | 5% | `results\u002Fsecurity\u002Fsupply-chain-*.sarif.json`, `results\u002Fsecurity\u002Fdependency-audit-*.sarif.json` |\n\n**Weight redistribution:** When a dimension has no results, its weight is redistributed proportionally among available dimensions. The formula:\n\n```\nadjusted_weight[i] = base_weight[i] \u002F sum(base_weight[available_dimensions])\n```\n\n## Workflow\n\n```\n1. SCAN DIRECTORY  -> List all files in results\u002Fsecurity\u002F\n2. FILTER PERIOD   -> Keep only files within the selected time window\n3. PARSE RESULTS   -> Read SARIF files and extract findings per dimension\n4. SCORE           -> Compute per-dimension and overall scores\n5. TREND           -> Compare with previous period (if --compare-previous)\n6. HEATMAP         -> Build OWASP category x severity matrix\n7. TOP FINDINGS    -> Select top 10 findings by risk\n8. QUEUE           -> Build remediation priority queue\n9. RENDER          -> Output dashboard in selected format\n```\n\n### Step 1 — Scan Results Directory\n\nRead the `results\u002Fsecurity\u002F` directory. For each file, extract the scan type and timestamp from the filename:\n\n```\nresults\u002Fsecurity\u002F{scan-type}-{YYYYMMDD}-{HHMMSS}.sarif.json\n```\n\nMap each file to its dimension using the Results Pattern column from the dimensions table.\n\n### Step 2 — Filter by Period\n\nApply the `--period` filter based on the timestamp extracted from filenames:\n\n| Period | Include Files From |\n|--------|--------------------|\n| last-7d | Now minus 7 days to now |\n| last-30d | Now minus 30 days to now |\n| last-90d | Now minus 90 days to now |\n| all | All available results |\n\nFor each dimension, use the **most recent** file within the period.\n\n### Step 3 — Parse SARIF Results\n\nFor each dimension's SARIF file, extract:\n- `runs[0].results[]` — all findings\n- Per finding: `ruleId`, `level`, `message.text`, `locations[].physicalLocation`, `properties.severity`, `properties.owasp-category`\n- Count findings by severity: CRITICAL, HIGH, MEDIUM, LOW, INFO\n\n### Step 4 — Compute Scores\n\nPer-dimension score uses the security scoring model:\n\n```\ndimension_score = max(0, 100 - sum(severity_weight * count_per_severity))\n```\n\nSeverity weights (from `references\u002Fsecurity-scoring.md`):\n\n| Severity | Weight |\n|----------|--------|\n| CRITICAL | 10 |\n| HIGH | 5 |\n| MEDIUM | 2 |\n| LOW | 1 |\n| INFO | 0 |\n\nGrade thresholds:\n\n| Grade | Score Range |\n|-------|------------|\n| A | 90-100 |\n| B | 80-89 |\n| C | 70-79 |\n| D | 60-69 |\n| F | 0-59 |\n\nOverall score is the weighted average of available dimension scores:\n\n```\noverall_score = round(\n    sum(dimension_score[i] * adjusted_weight[i])\n    for i in available_dimensions\n)\n```\n\n### Step 5 — Trend Analysis\n\nWhen `--compare-previous` is active, compute the previous period window:\n\n| Current Period | Previous Period |\n|---------------|----------------|\n| last-7d | 14 days ago to 7 days ago |\n| last-30d | 60 days ago to 30 days ago |\n| last-90d | 180 days ago to 90 days ago |\n\nTrend classification per dimension and overall:\n\n| Trend | Condition |\n|-------|-----------|\n| improving | current_score - previous_score >= 5 |\n| stable | abs(current_score - previous_score) \u003C 5 |\n| degrading | previous_score - current_score >= 5 |\n\nWhen no previous period data exists for a dimension, set trend to `null` (omit from output).\n\n### Step 6 — Risk Heatmap\n\nBuild a matrix of OWASP Top 10 categories (rows) x severity levels (columns):\n\n**Rows:** A01 (Broken Access Control), A02 (Cryptographic Failures), A03 (Injection), A04 (Insecure Design), A05 (Security Misconfiguration), A06 (Vulnerable Components), A07 (Auth Failures), A08 (Data Integrity Failures), A09 (Logging Failures), A10 (SSRF), CUSTOM (unmapped findings)\n\n**Columns:** CRITICAL, HIGH, MEDIUM, LOW\n\nEach cell contains the count of findings matching that category-severity pair across ALL dimensions.\n\n### Step 7 — Top 10 Findings\n\nSelect the 10 highest-risk findings across all dimensions, ordered by:\n1. Severity (CRITICAL > HIGH > MEDIUM > LOW > INFO)\n2. OWASP category priority (A01-A03 higher than A04-A10)\n3. Most recent scan date\n\nFor each finding, include: dimension, ruleId, severity, OWASP category, file location, message, and remediation recommendation.\n\n### Step 8 — Remediation Priority Queue\n\nOrder ALL findings by remediation priority:\n\n```\npriority = severity_weight * (1 + owasp_priority_bonus) \u002F estimated_effort\n```\n\nWhere:\n- `severity_weight`: CRITICAL=10, HIGH=5, MEDIUM=2, LOW=1\n- `owasp_priority_bonus`: A01-A03=0.5, A04-A06=0.3, A07-A10=0.1, CUSTOM=0.0\n- `estimated_effort`: based on fix complexity (default 1.0 when unknown)\n\n### Step 9 — Render Output\n\n#### 9.1 — Markdown Format\n\n```markdown\n# Security Posture Dashboard\n\n**Project**: {{PROJECT_NAME}}\n**Period**: {period}\n**Generated**: {YYYY-MM-DD HH:MM:SS}\n**Dimensions Available**: {count}\u002F{total}\n\n## Overall Score\n\n| Metric | Value |\n|--------|-------|\n| Score | {overall_score}\u002F100 |\n| Grade | {overall_grade} |\n| Trend | {overall_trend} {delta} |\n| Total Findings | {total_findings} |\n| Critical | {critical_count} |\n| High | {high_count} |\n| Medium | {medium_count} |\n| Low | {low_count} |\n\n## Per-Dimension Scores\n\n| Dimension | Source | Score | Grade | Trend | Findings | Critical | High |\n|-----------|--------|-------|-------|-------|----------|----------|------|\n| Static Analysis | x-run-sast | {score} | {grade} | {trend} | {count} | {c} | {h} |\n| Dynamic Analysis | x-run-dast | {score} | {grade} | {trend} | {count} | {c} | {h} |\n| ... | ... | ... | ... | ... | ... | ... | ... |\n\n### Missing Dimensions\n\n{list of dimensions with no results, if any}\n\n## Risk Heatmap (OWASP Top 10 x Severity)\n\n| Category | CRITICAL | HIGH | MEDIUM | LOW | Total |\n|----------|----------|------|--------|-----|-------|\n| A01 Broken Access Control | {n} | {n} | {n} | {n} | {n} |\n| A02 Cryptographic Failures | {n} | {n} | {n} | {n} | {n} |\n| A03 Injection | {n} | {n} | {n} | {n} | {n} |\n| ... | ... | ... | ... | ... | ... |\n| **Total** | **{n}** | **{n}** | **{n}** | **{n}** | **{n}** |\n\n## Top 10 Findings\n\n### 1. [{severity}] {ruleId} ({dimension})\n- **File**: {file}:{line}\n- **OWASP**: {category}\n- **Message**: {message}\n- **Fix**: {remediation}\n\n...\n\n## Remediation Priority Queue\n\n| # | Severity | Rule | Dimension | File | Priority Score |\n|---|----------|------|-----------|------|---------------|\n| 1 | CRITICAL | {rule} | {dim} | {file} | {score} |\n| 2 | HIGH | {rule} | {dim} | {file} | {score} |\n| ... | ... | ... | ... | ... | ... |\n```\n\n#### 9.2 — JSON Format\n\n```json\n{\n  \"project\": \"{{PROJECT_NAME}}\",\n  \"period\": \"{period}\",\n  \"generatedAt\": \"{ISO-8601}\",\n  \"overallScore\": 74,\n  \"overallGrade\": \"C\",\n  \"overallTrend\": \"improving\",\n  \"totalFindings\": 87,\n  \"dimensionsAvailable\": 8,\n  \"dimensionsMissing\": [\"x-scan-container-security\", \"x-assess-infrastructure-security\"],\n  \"dimensions\": [\n    {\n      \"dimension\": \"Static Analysis\",\n      \"source\": \"x-run-sast\",\n      \"weight\": 0.20,\n      \"score\": 85,\n      \"grade\": \"B\",\n      \"findingsCount\": 12,\n      \"criticalCount\": 1,\n      \"highCount\": 3,\n      \"trend\": \"improving\",\n      \"lastScanDate\": \"2026-04-05\",\n      \"available\": true\n    }\n  ],\n  \"riskHeatmap\": {\n    \"rows\": [\"A01\", \"A02\", \"A03\", \"A04\", \"A05\", \"A06\", \"A07\", \"A08\", \"A09\", \"A10\", \"CUSTOM\"],\n    \"columns\": [\"CRITICAL\", \"HIGH\", \"MEDIUM\", \"LOW\"],\n    \"cells\": {\n      \"A01\": {\"CRITICAL\": 1, \"HIGH\": 3, \"MEDIUM\": 2, \"LOW\": 0},\n      \"A03\": {\"CRITICAL\": 0, \"HIGH\": 2, \"MEDIUM\": 5, \"LOW\": 1}\n    },\n    \"totals\": {\"CRITICAL\": 3, \"HIGH\": 12, \"MEDIUM\": 18, \"LOW\": 8}\n  },\n  \"top10Findings\": [\n    {\n      \"rank\": 1,\n      \"dimension\": \"Static Analysis\",\n      \"ruleId\": \"SAST-001\",\n      \"severity\": \"CRITICAL\",\n      \"owaspCategory\": \"A03\",\n      \"file\": \"src\u002Fmain\u002Fjava\u002FHandler.java\",\n      \"line\": 42,\n      \"message\": \"SQL Injection vulnerability\",\n      \"remediation\": \"Use parameterized queries\"\n    }\n  ],\n  \"remediationQueue\": [\n    {\n      \"priority\": 1,\n      \"severity\": \"CRITICAL\",\n      \"ruleId\": \"SAST-001\",\n      \"dimension\": \"Static Analysis\",\n      \"file\": \"src\u002Fmain\u002Fjava\u002FHandler.java\",\n      \"priorityScore\": 15.0\n    }\n  ]\n}\n```\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| `results\u002Fsecurity\u002F` empty or missing | Set score to 0, grade to F, list all 10 dimensions as missing |\n| Partial results (some dimensions available) | Score from available dimensions, redistribute weights, list missing |\n| Malformed SARIF file | Log warning with filename and parse error, exclude dimension, continue |\n| No previous period data (with --compare-previous) | Set trend to null, note \"No previous period data available\" |\n| --compare-previous with --period all | Ignore the flag, omit trend data |\n| Invalid --period value | Error with valid options list |\n\n## Idempotency\n\n### Output Files\n\n```\nresults\u002Fsecurity\u002Fdashboard-{YYYYMMDD}-{HHMMSS}.md\nresults\u002Fsecurity\u002Fdashboard-{YYYYMMDD}-{HHMMSS}.json\n```\n\n- Each dashboard run creates a new timestamped file\n- Previous dashboard outputs are never modified\n- Both Markdown and JSON files are generated regardless of `--format` flag\n- The `--format` flag controls what is displayed to the user\n\n### Performance\n\n- Dashboard generation MUST complete in under 5 seconds\n- SARIF file parsing uses streaming when files exceed 1MB\n- Dimension aggregation can be parallelized (no shared state between dimensions)\n\n## Composability (RULE-011 — Skill Composability)\n\nThis skill is an **aggregator**, not a scanner. It MUST:\n- NEVER invoke x-run-sast, x-run-dast, or any other scanning skill\n- NEVER duplicate scanning logic from any atomic skill\n- Read ONLY from `results\u002Fsecurity\u002F` (the shared output directory)\n- Respect the SARIF 2.1.0 schema defined in `references\u002Fsarif-template.md`\n- Use the scoring model defined in `references\u002Fsecurity-scoring.md`\n\nIf a user needs fresh scan data, run the individual scanning skills first, then invoke this dashboard.\n\n## Knowledge Pack References\n\n| # | Knowledge Pack | Path | Purpose |\n|---|----------------|------|---------|\n| 1 | Security Scoring | `knowledge\u002Fsecurity\u002Fsecurity-scoring.md` | Scoring model and grade thresholds |\n| 2 | Security Skill Template | `knowledge\u002Fsecurity\u002Fsecurity-skill-template.md` | Output conventions for scan results |\n\n## Integration Notes\n\n| Skill | Relationship | Context |\n|-------|-------------|---------|\n| x-run-sast | Consumes output | Static analysis SARIF results (20% weight) |\n| x-run-dast | Consumes output | Dynamic analysis SARIF results (15% weight) |\n| x-scan-secrets | Consumes output | Secrets detection SARIF results (15% weight) |\n| x-scan-owasp | Consumes output | OWASP compliance SARIF results (10% weight) |\n| x-audit-dependencies | Consumes output | Supply chain SARIF results (5% weight) |\n| x-audit-supply-chain | Consumes output | Supply chain SARIF results (5% weight) |\n",{"name":5,"description":7,"allowed-tools":24,"argument-hint":25,"context-budget":26,"user-invocable":27,"requires-capabilities":28},"Read, Write, Bash, Grep, Glob","[--period last-7d|last-30d|last-90d|all] [--format markdown|json] [--compare-previous]","medium",true,[],"main","952a630c6f38d193a349d86fa18db1de8843e837","src\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-generate-security-dashboard",1,"https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment","https:\u002F\u002Fgithub.com\u002Freview-bench","https:\u002F\u002Freview-bench.ai","An open benchmark for AI code review.","2026-10-27 06:56:37",{"source":8,"skillName":5,"commands":39,"prompt":49,"zipAvailable":27},[40,43,46],{"tool":41,"command":42},"npx","npx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-generate-security-dashboard",{"tool":44,"command":45},"bunx","bunx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-generate-security-dashboard",{"tool":47,"command":48},"pnpm","pnpm dlx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-generate-security-dashboard","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-generate-security-dashboard\u002FSKILL.md",[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"README.md","REFERENCE","参考文档",2441,"https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-generate-security-dashboard\u002FREADME.md",[58,65,72,79,86,93],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M757M8J48TQ1Y3X25GSJBXAS","x-parallel-eval","Detects and classifies file-collision risks between work units (tasks, stories, or epic phases) before parallel execution. Reads ## File Footprint blocks produced by x-task-plan \u002F x-story-plan, applies the parallelism-heuristics knowledge pack (hard \u002F regen \u002F soft categories + hotspot overrides), and emits a collision matrix + serialization recommendation in Markdown (default) or JSON.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fx-parallel-eval\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M757M57XMR9546S69466HDWT","parallelism-heuristics","Canonical catalog of file-collision heuristics for parallel task, story, and epic execution. Defines the File Footprint block format, the three Conflict Categories (hard \u002F regen \u002F soft), a hotspot list of high-contention paths, and the degrade-with-warning policy. Consumed by x-task-plan, x-story-plan, x-epic-map, x-parallel-eval, and x-dev-*-implement.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fparallelism-heuristics\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M757M11SZ8P1VCQABT08QVYA","x-watch-pr-ci","Polls a PR's CI checks and Copilot review status, blocking until checks complete or timeout. Returns one of 8 stable exit codes (SUCCESS=0, CI_PENDING_PROCEED=10, CI_FAILED=20, TIMEOUT=30, PR_ALREADY_MERGED=40, NO_CI_CONFIGURED=50, PR_CLOSED=60, PR_NOT_FOUND=70). Writes a versioned state-file for session resume.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-watch-pr-ci\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M757KW53K8KFPGADFB4PH949","x-validate-docs","Documentation freshness gate: validates 6 dimensions (readme, api-specs, grpc-proto, adr, skill-docs, system-architecture) against code changes in a PR. Stack-aware — only validates targets declared\u002Fauto-detected from ProjectConfig.documentation.targets. Returns exit non-zero on staleness; produces structured report.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-validate-docs\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M757KQZHSA10MKC0CR571D60","x-update-system-architecture","Incrementally updates docs\u002Farchitecture\u002Fsystem.md after an epic completes. Appends new entries to the Decision Log (§11) using x-internal-write-report --append (dedup by ## ID: marker) and surgically inserts component\u002Fintegration changes into sections 1-10 via Edit. Idempotent: re-running with the same epic produces a byte-identical system.md.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-update-system-architecture\u002FSKILL.md",[],[],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":19},"01M757KKBT5Q1SVF8DMJBVF46M","x-update-architecture","Incrementally updates the service architecture document with changes from architecture plans. Adds new components, integrations, flows, and ADR references without rewriting existing content. Use after implementation to keep architecture documentation current.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-update-architecture\u002FSKILL.md",[],[]]