ievo

Use this skill when CLAUDE.md/AGENTS.md references many files and it's unclear what lives where, the same rule appears in multiple files, or — via `/ievo:evo`'s post-capture offer — an evolution overlay has grown large enough to warrant extracting a skill or agent. Consolidates fragmented docs or an iEvo evolution overlay. Two modes, auto-detected from the root file. Doc-graph mode (default, root e.g. CLAUDE.md) maps the reference graph, finds duplicates and contradictions, proposes a target structure, executes the migration. Entry-cluster mode (root is an overlay file like `.ievo/evolution/project.md`) judges whether accumulated entries describing a recurring procedure or role generalize into a new skill/agent, merge into one entry, or — for fact/convention entries — digest into a compact rule list, all within the same overlay. Five phases (Discovery, Analysis, Proposal, Migration, Verification), three mandatory checkpoints in both modes — nothing created, merged, or deleted without explicit approval.

Use this skill when the user wants to revoke iEvo 'contributor mode' for this project — trigger words "turn off contributor mode", "disable contributor mode", "stop sharing diagnostics", "revoke contributor mode". Removes the project-local flag `.ievo/contributor.flag`. Reverts `/ievo:feedback` to its default payload — it stops offering to attach the tool-failure/permission-denial capture stream. Non-destructive: the underlying `.ievo/evolution-candidates/` capture data (if any) is untouched. Inverse of `/ievo:contributor-mode-on`.

Use this skill when the user wants to opt in to iEvo 'contributor mode' for this project — trigger words "turn on contributor mode", "enable contributor mode", "I am a contributor", "share more diagnostics with feedback", "widen feedback payload". Enables a project-local, off-by-default consent flag (`.ievo/contributor.flag`) that widens what `/ievo:feedback` MAY offer to attach to a filed report: the environment context it already collects for every report, plus — only when available — the existing scrubbed tool-failure/permission-denial capture stream from `/ievo:evo-auto-enable`. The existing per-report Submit/Cancel confirmation in `/ievo:feedback` is unchanged; this flag only widens the attachment OPTIONS offered and never auto-posts. Does NOT add a session-transcript export or standing consent to skip the per-report confirmation — both are separate, unbuilt proposals (see `## Scope` below).

Use this skill when debugging is complete and the user wants to stop accumulating large trace logs — trigger words "turn off debug", "stop verbose", "disable trace", "debug off". Disables verbose / trace-level logging for the iEvo pipeline. Reverts to normal logging (concise `.ievo/log/init-*.md` only).

Use this skill when the user wants to debug an init, evo, or security-audit session, or wants to attribute iEvo token costs in a usage dashboard — trigger words "turn on debug", "verbose mode", "log everything", "trace level", "debug logging", "cost monitoring", "OTel cost attribution", "OTEL_RESOURCE_ATTRIBUTES", "tag iEvo usage by team or project". Enables verbose / trace-level logging across the iEvo pipeline — captures full prompts, full sub-agent returns, every Task tool dispatch, every gh/git/network call, environment dump — and documents how to label Claude Code's OTel metrics so iEvo token spend can be sliced separately from ordinary coding usage in an OTel-backed dashboard. Output goes to `.ievo/log/debug/<session-id>/` for post-mortem analysis. Activates by writing `.ievo/debug.flag` (project-level setting).

Use this skill before committing significant changes, after a refactor, or when you want a second opinion on a diff — not for auditing a third-party skill/plugin's safety before install (use /ievo:security-check for that). Structured 11-point gap-detection review of a diff before commit. Spawns a deep-reviewer subagent for independent eyes (fresh context, separate token budget). Catches issues that survive pre-commit hooks, linters, and test suites but surface in human PR review — completeness gaps, test/impl drift, dead code from partial refactors, naming/behaviour mismatch, doc-paraphrase drift, cross-file consistency, error-path coverage, API contract fidelity, security surface, concurrency/state, and leaked secrets. Supports scope modes — staged changes (default), working tree, or arbitrary git range.

Use this skill when the user identifies a behavior to improve, a mistake to prevent, a project convention, a team role, a tech-stack constraint, or any pattern worth persisting beyond the current session. Captures a lesson and adds it to the appropriate evolution overlay — a per-agent file, per-skill file, or project-wide rules file. Appends to `.ievo/evolution/<scope>/<name>.md` (overlay file). The agent/skill body is never modified — overlays are read at dispatch time via a one-time marker injection.

Use this skill when the user wants to stop iEvo from capturing lessons automatically — trigger words "turn off auto evolution", "stop auto-evolve", "evo auto off", "stop capturing lessons automatically". Disables auto-evolution mode for this project. Stops iEvo from accumulating "corrections from the user" as evolution candidates; reverts to explicit `/ievo:evo` only. Removes the project-local flag `.ievo/evo-auto.flag`. Non-destructive: already-parked candidates in `.ievo/evolution-candidates/` are preserved for review. Inverse of `/ievo:evo-auto-enable`.

Use this skill when the user wants to capture lessons automatically without invoking /ievo:evo explicitly — trigger words "turn on auto evolution", "auto-evolve", "capture lessons automatically", "evo auto on", "evolve without asking". Enables auto-evolution mode for this project — iEvo accumulates "corrections from the user" as evolution candidates during a session and surfaces them for review via /ievo:evo. Sets the project-local flag `.ievo/evo-auto.flag` and prepares the pending-candidate queue at `.ievo/evolution-candidates/`. Asks whether to also capture tool failures/denials (opt-in, scrubbed for privacy). Auto-mode writes ONLY unambiguous project-wide overlays; ambiguous or user-level matches are parked for manual review, never written silently.

Use this skill when a workflow repeated this session, wrapping up and wondering if anything should become a skill, or asked to extract best practices from this session. Mines the current session for repeated multi-step workflows, decision frameworks, or error-recovery patterns never explicitly captured via /ievo:evo. Cross-checks against installed skills/agents, then presents candidates for explicit selection before anything is authored — generalizable patterns become new skills/agents (reusing consolidate's package-authoring machinery); patterns too narrow to stand alone, or refining an existing skill/agent, route to /ievo:evo rather than reinventing overlay-writing. For a marketplace-worthy new package, optionally offers (explicit permission, never silent) to submit a distilled version upstream to ievo-ai/skills, mirroring evo/SKILL.md's upstream-escalation for a full package instead of a lesson. Distinct from /ievo:consolidate's entry-cluster mode, which only clusters already-captured overlay entries.

Use this skill when the user says "send feedback", "report a bug", "this didn't work", "I want to suggest a feature", "where do I file an issue for iEvo", or after iEvo has done something the user would want to comment on. Submits feedback about the iEvo plugin — bug reports, feature requests, suggestions, or general comments. Posts as a GitHub issue in `ievo-ai/skills` via `gh` CLI. When `/ievo:contributor-mode-on` has been enabled for this project, may also offer to attach the existing scrubbed tool-failure/permission-denial capture stream — still gated by the same Submit/Cancel confirmation as every other report.

Use this skill when the user says "hand off", "hand this off", "create a handoff", "branch this to another session", "pass context to next session", "start a new session for X", or invokes /ievo:handoff. Compacts the current conversation into a portable handoff document for a fresh agent session. Solves the context-window degradation problem — reasoning quality drops past ~120k tokens, so instead of /compact (lossy summarization), branch out-of-scope work into a focused parallel session with curated context. Produces a Markdown document with the next session's purpose, relevant context excerpts, suggested iEvo skills, artifact pointers (file paths, PR/issue links), and redacted secrets. Saved to OS temp dir for easy copy-paste into a new session.

Use this skill when the user asks "notify me when ievo finishes", "add hooks for ievo", "set up ievo notifications", "tell me when background agents are done", "configure ievo lifecycle hooks", or "nudge me when ievo is out of date" — not for the full iEvo installation pipeline (use /ievo:init for that). Configures Claude Code lifecycle hooks for iEvo pipeline events — init complete, security RED verdict, evolution captured, and (optional) all-background-agents-complete via a Stop hook. Writes PostToolUse and Stop hook entries to `.claude/settings.json` using exec-form (`args: string[]`) and optionally `terminalSequence` for desktop notifications. Requires Claude Code v2.1.139+ (exec-form); v2.1.141+ for `terminalSequence` (iTerm2/WezTerm-class terminal); v2.1.145+ for the optional background-complete Stop hook (`background_tasks`/`session_crons` fields). Also installs an optional fail-silent SessionStart nudge when the installed iEvo plugin is behind latest.

Use this skill when expanding a small set of candidate skills into the full breadth of what their host repos offer. Enumerates the full content of one or more GitHub repos that host Claude Code skills, agents, and plugins. Thin wrapper around `scripts/scan_repo.mjs` (deterministic Node scanner — no LLM required). Returns structured markdown indices per repo.

Use this skill when the user runs `/ievo:init`, opens a new project that does not yet have `.ievo/`, or asks "set up iEvo here" / "find skills for this project" — not for configuring lifecycle hooks alone (use /ievo:hooks-setup for that). Initializes iEvo in the current project — discover relevant skills and agents from skills.sh and the broader GitHub ecosystem (via own discover.mjs script, no prereq install), audit them for safety via senior-security-engineer review, install through an interactive interview. Composes two lower-level skills (index-repos, security-check) plus discover.mjs + repo-indexer + security-auditor sub-agents into a complete setup pipeline.

Use this skill when the user asks "what does owner/repo contain", "inspect this skill before install", "show me what's in owner/repo", "summarise owner/repo without installing", "what skills does this repo have", or invokes /ievo:inspect <owner>/<repo> — not for listing your own project's already-installed evolution overlays (use /ievo:overlay-status for that). Pre-install structured summary of a remote skill/plugin repo. Fetches the repo tree and key files via gh API, then renders a human-readable capability overview — skills, agents, commands, scripts, permission footprint — without triggering discovery, security scan, or install.

Use this skill when the user asks "what evolutions have I captured", "show my iEvo overlays", "what rules are active in this project", "list installed overlays", "summarize .ievo/evolution" — not for previewing a remote repo's contents before install (use /ievo:inspect for that). Surfaces the current state of iEvo evolution overlays in this project. Lists every overlay under `.ievo/evolution/` grouped by scope (project, agents, skills), with a one-line summary + last-modified date per file. Read-only — never modifies, deletes, or rewrites overlay content. Closes the legibility gap iEvo's own `coverage-audit.md` flagged as "Standalone 'list installed iEvo overlays' command".

Use this skill right after a pull request merges, or any time you want to mine an already-merged PR's review history for durable evolution lessons — not for reviewing an open/unmerged diff (use /ievo:deep-review for that) and not for capturing a lesson you already know in your own words (use /ievo:evo directly for that). Given an explicit merged PR URL or number, collects every formal review, inline review comment, review thread, and issue comment on it with full provenance (review/comment URL, head commit SHA, current-or-stale status, responsible target), dedupes and clusters the findings by both root cause and responsible target (project-wide, a named agent, a named skill, or unknown), classifies each cluster (stale, one-off code defect, already covered by an existing rule, ordinary follow-up, or durable evolution lesson), and previews the clusters for your confirmation.

Use this skill when the user asks "schedule an iEvo audit", "set up weekly security scan", "automate iEvo", "run iEvo on a schedule", "periodic security check", or "create a routine for iEvo". Configures a Claude Code Routine for periodic iEvo operations — recurring security audits, skill-update checks, or custom iEvo commands on a schedule. Three-step wizard: pick operation (security audit / skill refresh / custom), pick frequency (daily / weekly / monthly / one-off / custom cron), confirm and create via the in-session /schedule command. Routines run on Anthropic-managed infrastructure (research preview). Falls back to the claude.ai/code/routines web UI, or to CI cron instructions when Routines are unavailable (API-key auth, Free plan).

Use this skill before installing ANY third-party skill, agent, or plugin — not for scanning your own project's source code (use /ievo:vuln-scan for that) and not for a structured pre-commit gap-detection review of a diff (use /ievo:deep-review for that). Vulnerability assessment by a senior application security engineer for a skill, agent, or plugin (Claude Code or Codex marketplace item) before installation. Domain expertise — prompt injection, credential exfiltration, supply-chain compromise, hook abuse, indirection attacks, encoded payloads, social engineering in technical artifacts, tool-model bypass. Deep content review across SKILL.md/agent.md body + ALL dependencies (scripts/, references/, assets/, bundled plugin files). Threat detection by expert reasoning, not regex. Returns structured verdict (GREEN/YELLOW/RED) with cited evidence (file + excerpt + concern). Invoked by the security-auditor agent in parallel per selected item.

Use this skill when the user asks "which iEvo version am I on", "what iEvo version is installed", "am I up to date", "how far behind is iEvo", "what changed since my iEvo version", "show the iEvo changelog", "what would /plugin update give me", or invokes /ievo:version. Shows the installed iEvo plugin version (plus commit SHA when resolvable) and the changelog of what changed between it and the latest published release, so you can decide whether to update. Reads the installed `version` from the plugin's `plugin.json`, fetches the latest version from the marketplace manifest on `main`, and prints the intervening `CHANGELOG.md` entries. Read-only — never writes, installs, or updates.

Use this skill when the user runs /ievo:vuln-scan, asks to scan for vulnerabilities, or says "security scan my code" — not for auditing a third-party skill/plugin before installation (use /ievo:security-check for that). CWE-aware deep source code vulnerability scan for a single module or file set, inspired by Project Glasswing. Uses AI reasoning (not regex) to trace data flows, detect vulnerabilities, and validate findings via complete exploit chains. Every finding requires an attack narrative (entry point, data flow, impact); no chain means no finding. Applied per-module by the vuln-scanner agent, orchestrated by the /ievo:vuln-scan command. Covers OWASP top 10, CWE-anchored threat taxonomy (injection, auth bypass, crypto misuse, data exposure, race conditions, deserialization, path traversal, SSRF, business logic, supply chain).