WEBDIENSTE/ECC

Fork 0

mirror of https://github.com/affaan-m/ECC.git synced 2026-09-20 08:38:05 +02:00

Files

T

d29cf651c7 fix(skills): declare activation triggers in descriptions and normalize version metadata (#2618 )

* fix(skills): move version into metadata and normalize to semver

29 skills declared `version` at the top level of their frontmatter. The
schema reads it from `metadata`, so tooling that follows the schema either
misses it or has to special-case the top level.

Three motion skills also declared `version: 1.0`, which is not a valid
semantic version; normalized to `1.0.0`.

No behavioral change — frontmatter metadata only.

* fix(skills): state activation triggers in skill descriptions

148 skills described what they cover but never named the situation that
should trigger them. Since the description is what Claude matches against
to decide whether to load a skill, a description without a trigger makes
activation guesswork — the skill is either missed or loaded at the wrong
time.

Added a "Use when ..." clause to each, derived from the skill's own body
(most already stated the trigger under "## When to Use" or in the opening
line; that intent is now reflected in the frontmatter where it is actually
read from).

Descriptions were only appended to; no existing wording was removed.

* fix(skills): sync activation triggers into the Codex skill mirror

10 of the skills whose descriptions changed are also mirrored under
`.agents/skills/`, where the description was previously a verbatim copy.
Left alone, the two surfaces would disagree about when the skill applies.

Only the description line is synced; the Codex copies keep their reduced
frontmatter, since that validator accepts only name, description,
metadata, license, and allowed-tools.

* fix(skills): correct three activation clauses from review

- autonomous-loops: the clause pulled new loop work into a skill that its
  own body marks as a compatibility shim retained for one release. It now
  points at the canonical continuous-agent-loop instead.
- continuous-learning: the description carried the v1 routing directive
  twice; collapsed to one.
- homelab-pihole-dns: the clause fired on any broken home DNS. Narrowed to
  tasks that actually involve Pi-hole.

* chore: retain current main lockfile

---------

Co-authored-by: Çağrı Solakoğlu <cagri.solakoglu@vtcenerji.com>
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>

2026-08-11 23:58:14 -04:00

3.5 KiB

Raw Blame History

name, description, metadata

name

description

metadata

hipaa-compliance

HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.

version	origin
1.0.0	ECC direct-port adaptation

HIPAA Compliance

Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical:

healthcare-phi-compliance remains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention.
healthcare-reviewer remains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass.
security-review still applies for general auth, input-handling, secrets, API, and deployment hardening.

When to Use

The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs
Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI
Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure
Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter

How It Works

Treat HIPAA as an overlay on top of the broader healthcare privacy skill:

Start with healthcare-phi-compliance for the concrete implementation rules.
Apply HIPAA-specific decision gates:
- Is this data PHI?
- Is this actor a covered entity or business associate?
- Does a vendor or model provider require a BAA before touching the data?
- Is access limited to the minimum necessary scope?
- Are read/write/export events auditable?
Escalate to healthcare-reviewer if the task affects patient safety, clinical workflows, or regulated production architecture.

HIPAA-Specific Guardrails

Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.
Never expose PHI in URLs, browser storage, screenshots, or copied example payloads.
Require authenticated access, scoped authorization, and audit trails for PHI reads and writes.
Treat third-party SaaS, observability, support tooling, and LLM providers as blocked-by-default until BAA status and data boundaries are clear.
Follow minimum necessary access: the right user should only see the smallest PHI slice needed for the task.
Prefer opaque internal IDs over names, MRNs, phone numbers, addresses, or other identifiers.

Examples

Example 1: Product request framed as HIPAA

User request:

Add AI-generated visit summaries to our clinician dashboard. We serve US clinics and need to stay HIPAA compliant.

Response pattern:

Activate hipaa-compliance
Use healthcare-phi-compliance to review PHI movement, logging, storage, and prompt boundaries
Verify whether the summarization provider is covered by a BAA before any PHI is sent
Escalate to healthcare-reviewer if the summaries influence clinical decisions

Example 2: Vendor/tooling decision