mirror of https://github.com/affaan-m/ECC.git synced 2026-10-16 05:05:30 +02:00

Files

T

rhmatzeka eb30409fc5 fix(skills): authorize laravel-security download on the model before signing a URL

The secure-storage example authorized `download` against a raw path string
taken from the request and generated the temporary URL before the check.
A string argument never resolves to a policy, and authorizing a
client-supplied path teaches an IDOR-prone pattern.

Bind a model (Document), authorize against it first, then sign the URL for
the stored path on the s3 disk configured just below. pi/core regenerated
via scripts/build-pi-core.js; skill-triggers registryDigest rebound.

2026-09-30 11:32:33 +07:00

commands

feat(pi): curated pi/core skills+prompts profile, CI load test, and 2.2.2 release sync (#3264 )

2026-09-29 20:24:05 -05:00

skills

fix(skills): authorize laravel-security download on the model before signing a URL

2026-09-30 11:32:33 +07:00

CURATION.md

feat(pi): curated pi/core skills+prompts profile, CI load test, and 2.2.2 release sync (#3264 )

2026-09-29 20:24:05 -05:00

LICENSE

feat(pi): curated pi/core skills+prompts profile, CI load test, and 2.2.2 release sync (#3264 )

2026-09-29 20:24:05 -05:00

package.json

feat(pi): curated pi/core skills+prompts profile, CI load test, and 2.2.2 release sync (#3264 )

2026-09-29 20:24:05 -05:00

README.md

feat(pi): curated pi/core skills+prompts profile, CI load test, and 2.2.2 release sync (#3264 )

2026-09-29 20:24:05 -05:00

README.md

ecc-pi-core

A curated, Pi-native profile of ECC (Everything Claude Code): 123 portable engineering skills and 24 pure prompt-workflow commands, with no extensions, no hooks, no runtime downloads, and no network or SaaS dependencies.

skills/ - language, framework, testing/TDD, code review, security review, planning, refactoring, docs, and git/PR workflow skills.
commands/ - prompt commands that are pure prompt workflows.
CURATION.md - every excluded skill and command with its reason.

Use

Copy this directory into your project (or pin a release tarball) and load it with the Pi coding agent:

pi --no-extensions --extension pi/core

Offline load test (as run in CI):

PI_OFFLINE=1 pi --offline --mode rpc --no-session --no-context-files --no-extensions \
  --extension pi/core </dev/null >/dev/null

Regenerate

pi/core is generated from manifests/pi-core.json and committed so release tarballs contain it verbatim. After changing the manifest or any included source content, run:

node scripts/build-pi-core.js

and commit the result. CI verifies the committed profile is up to date.

README.md

ecc-pi-core

Contents

Use

Regenerate