git:20260610.c15894f to git:20260615.d11a2d9

141 added, 132 removed. Audit B to B.

---

name: acquire-skills

- description: "Find and install skills for project tech gaps. Use when entering a project with unfamiliar tech or when no local skill matches a task context."

+ description: "Find and install skills for what you're doing — tech stack AND thinking/reasoning gaps. Analyzes activity type (deciding, strategizing, challenging, analyzing, planning) and tech context to surface relevant skills. Use when entering unfamiliar tech, stuck on a reasoning challenge, or when no local skill covers the current task."

effort: low

model: haiku

- keywords: [skills, marketplace, install, gap, discovery, external]

+ keywords: [skills, marketplace, install, gap, discovery, external, reasoning, frameworks, thinking]

task_strategies: [feature, spike]

stream_affinity: [roadmap, tech-debt]

group: brana

allowed-tools:

- Read

- Write

- Bash

- Glob

- Grep

- WebSearch

- WebFetch

- AskUserQuestion

- Agent

status: stable

growth_stage: evergreen

---

# Acquire Skills

- Scan project context, identify missing skills, search external marketplaces, install what you approve.

+ Find and install skills for the current task — across both tech and thinking/reasoning dimensions.

## Usage

```

- /brana:acquire-skills — scan current project

+ /brana:acquire-skills — scan current activity + project

/brana:acquire-skills <task-id> — scan a specific task's needs

- /brana:acquire-skills <keyword> — direct search ("cloudflare")

+ /brana:acquire-skills <keyword> — direct search ("cloudflare", "decision matrix")

```

+ ## Never suggest these (brana workflow internals)

+ The following skills are system workflow tools, not capability skills. Never surface them as recommendations:

+ `build`, `backlog`, `close`, `sitrep`, `onboard`, `align`, `reconcile`, `ship`, `docs`,

+ `retrospective`, `review`, `gemini`, `claudemd`, `plugin`, `scheduler`, `do`, `log`,

+ `export-pdf`, `verify-docs`, `client-retire`, `cargo-machete`, `bash-defensive-patterns`,

+ `rust-skills`, `gsheets`, `meta-templates`, `mcp-builder`, `memory`, `discover`.

+ Thinking skills ARE valid to recommend: `decide`, `brainstorm`, `challenge`, `swot-analysis`,

+ `decision-matrix`, `critical-thinking-logical-reasoning`, `pre-mortem`, `inversion`,

+ `first-principles`, `second-order-thinking`, `six-thinking-hats`, `systems-thinking`,

+ `jobs-to-be-done`.

## Process

- ### Step 1: Gather — Read project signals

+ ### Step 0: Detect mode

- Detect the input mode from the argument:

+ From `$ARGUMENTS`:

+ - **No argument:** run Steps 1a + 1b (activity detection + tech scan)

+ - **Task ID (t-NNN):** read task from `.claude/tasks.json`, extract subject + tags + description → use as context for both Steps 1a and 1b

+ - **Keyword:** skip Steps 1a + 1b entirely, use keyword directly in Step 3

- - **No argument:** scan project from CWD

- - **Task ID (t-NNN):** read that task from `.claude/tasks.json`, extract tags + description

- - **Keyword:** skip scan, use keyword directly in Step 3

+ ---

+ ### Step 1a: Detect activity type

+ Read the current conversation context (recent turns) and any task/argument provided.

+ Classify the primary activity the user is doing right now:

+ | Activity | Signals | Relevant thinking skills |

+ |----------|---------|--------------------------|

+ | **Deciding** | "should I", "A or B", "which option", "choose between" | `decide`, `decision-matrix`, `six-thinking-hats` |

+ | **Strategizing** | "market", "competitive", "direction", "positioning", "business model" | `swot-analysis`, `systems-thinking`, `second-order-thinking`, `scenario-planning` |

+ | **Analyzing problem** | "why is", "root cause", "debug", "understand", "what caused" | `critical-thinking-logical-reasoning`, `first-principles`, `systems-thinking` |

+ | **Challenging / stress-testing** | "risk", "what could go wrong", "is this right", "review this plan" | `challenge`, `pre-mortem`, `inversion`, `critical-thinking-logical-reasoning` |

+ | **Ideating / exploring** | "idea", "what if", "explore", "brainstorm", "new approach" | `brainstorm`, `first-principles`, `jobs-to-be-done`, `second-order-thinking` |

+ | **Planning** | "how to approach", "phases", "roadmap", "before starting" | `pre-mortem`, `second-order-thinking`, `systems-thinking` |

+ | **Researching** | "learn about", "understand", "how does X work" | `critical-thinking-logical-reasoning`, `systems-thinking`, `jobs-to-be-done` |

+ | **Building** | implementation, coding, writing features | tech skills only (Step 1b) |

+ If activity is **Building only** → thinking skills aren't the gap, skip to Step 1b.

+ Otherwise → note the detected activity and the recommended thinking skills. These surface in Step 2 as "thinking gaps" even if they're already installed (they may not be well-known).

+ ---

+ ### Step 1b: Gather tech signals

For project scan, read these files (skip missing ones silently):

| File | Extract |

|------|---------|

| `package.json` | `dependencies` + `devDependencies` keys |

| `requirements.txt` / `pyproject.toml` | package names |

| `Dockerfile` / `docker-compose.yml` | `FROM` images, service names |

| `.tool-versions` / `.nvmrc` | runtime names |

| `CLAUDE.md` / `.claude/CLAUDE.md` | stack keywords from description |

| `.claude/tasks.json` | tags from all `pending` + `in_progress` tasks |

Collect into a flat list of **tech keywords** (deduplicated, lowercased).

- Example output:

- ```

- Tech detected: next.js, prisma, postgres, tailwind, cloudflare-workers,

- docker, redis, stripe

- ```

+ ---

- ### Step 2: Diff — Compare against local skills

+ ### Step 2: Surface gaps

- Scan all SKILL.md files in the plugin's `system/skills/` directory:

+ Scan local skills:

```bash

for d in system/skills/*/; do

[ -f "$d/SKILL.md" ] || continue

name=$(basename "$d")

desc=$(head -10 "$d/SKILL.md" 2>/dev/null | grep -m1 "^description:" | sed 's/^description: *"//' | sed 's/"$//')

- echo "$name: $desc"

+ group=$(head -10 "$d/SKILL.md" 2>/dev/null | grep -m1 "^group:" | sed 's/^group: *//')

+ echo "$name|$desc|$group"

done

```

+ **Thinking gaps (from Step 1a):**

+ For each recommended thinking skill:

+ - If already installed locally → show as "available" (might not be well-known to user)

+ - If not installed → show as "gap"

+ Always present the thinking skills relevant to the detected activity — even installed ones. The user may not know they exist.

+ **Tech gaps (from Step 1b):**

For each tech keyword, check if any local skill name or description contains it.

- Present the diff:

+ Present in two sections:

```

- Already covered:

- docker → (general knowledge, no dedicated skill)

- postgres → gsheets (partial, queries only)

+ Activity detected: [Deciding / Strategizing / ...]

- Gaps (no matching skill):

- cloudflare-workers, prisma, stripe, redis

+ Thinking skills for this activity:

+ ✓ decision-matrix (installed) — weighted scoring of alternatives

+ ✓ six-thinking-hats (installed) — 6-perspective parallel analysis

+ ✗ scenario-planning (not installed) — 3-4 plausible futures

+ Tech stack: next.js, prisma, postgres, tailwind

+ Tech gaps (no local skill):

+ prisma, cloudflare-workers

```

- Use **AskUserQuestion** to confirm:

- - question: "Search marketplaces for these gaps?"

- - options: ["All gaps (Recommended)", "Pick which ones", "Skip"]

+ Ask:

- If "Skip": report and exit.

- If "Pick which ones": let user select from gap list.

+ ```

+ AskUserQuestion:

+ question: "What should we look for?"

+ options:

+ - "Thinking skills for [detected activity] (Recommended if not well-known)"

+ - "Tech gaps: [gap list]"

+ - "Both"

+ - "Skip"

+ ```

- ### Step 3: Search — Query marketplaces

+ ---

+ ### Step 3: Search marketplaces

Search for each gap keyword using the first available source:

**Tier 1a: Vercel skills CLI** (check: `npx skills --version 2>/dev/null`)

```bash

- # Keyword search — use `find`, not `search` (search outputs logo only, no results)

npx skills find "<keyword>" 2>/dev/null

- # Enumerate skills from known orgs via --list flag

- for org in anthropics vercel-labs trailofbits supabase redis fastapi; do

- npx skills add "$org" --list 2>/dev/null

- done

```

- **Tier 1b: skills.sh** (always available via WebFetch)

+ **Tier 1b: skills.sh** (always available via WebFetch — results here are Verified tier)

```

WebFetch: https://skills.sh

```

- Parse the official skills directory for keyword matches. Results here are **Verified** trust tier (see Step 3b).

- **Tier 2: WebSearch** (fallback if Tier 1 yields no results)

+ **Tier 2: WebSearch** (fallback if Tier 1 yields nothing)

```

WebSearch: "SKILL.md <keyword> site:github.com claude"

```

- For each search result, collect:

- - Skill name and author

- - Description (first 1-2 sentences)

- - Source (npm package, GitHub repo URL, or skills.sh listing)

- - Install count or stars (if available)

- Report which search tier is active:

- ```

- Searching via: Vercel skills CLI + skills.sh

- ```

- or:

- ```

- Searching via: skills.sh + web (install `npx skills` for CLI results)

- ```

- ### Step 3b: Classify source trust tier

+ For thinking skill gaps, search terms to use:

+ - `decision matrix`, `pre-mortem`, `inversion thinking`, `first principles`, `SWOT`, `jobs to be done`, `systems thinking`, `second order thinking`, `six thinking hats`

- Each search result is classified by its source into a trust tier. The tier determines

- install behavior (step 5) and tool access for the installed skill.

+ ---

- |--------|-----------|-----------------|-------------|

- | `github.com/anthropics/*` | **Trusted** | Auto-install with confirmation | Full (all tools) |

- | `skills.sh` official section, `trailofbits/*` | **Verified** | Install with review prompt | Default set |

+ ### Step 3b: Trust tier classification

- **Classification logic:**

- ```

- if source URL contains "github.com/anthropics" → trusted

- elif source marked "official" on skills.sh OR author in verified-authors list → verified

- elif source is a GitHub repo or npm package → community

- else → blocked (skip candidate, warn user)

- ```

+ | Source | Trust tier | Install behavior |

+ |--------|-----------|-----------------|

+ | `github.com/anthropics/*` | **Trusted** | Auto-install with confirmation |

+ | `skills.sh` official, `trailofbits/*` | **Verified** | Install with review prompt |

+ | Other GitHub repos, npm packages | **Community** | Quarantine — read-only tools |

+ | Unknown URL, no source info | **Blocked** | Reject |

- **Verified authors list** (extend as trust is established):

- `anthropics`, `trailofbits`, `vercel-labs`, `slavingia`

+ **Verified authors:** `anthropics`, `trailofbits`, `vercel-labs`, `slavingia`

- Display the trust tier next to each candidate in step 4:

- ```

- 1. @anthropics/skills/cloudflare [TRUSTED]

- 2. @secondsky/cloudflare-deploy [COMMUNITY — quarantine]

- ```

+ ---

### Step 4: Evaluate and present

- For each candidate, if possible fetch the SKILL.md content:

- - CLI: `npx skills info <package>` or `npx skills cat <package>`

+ For each candidate, fetch the SKILL.md content:

+ - CLI: `npx skills add <package>` (stages to `.agents/skills/`)

- Web: `WebFetch` the raw SKILL.md from GitHub

**Safety scan** (discard if any trigger):

- Empty or under 100 characters

- - Contains `rm -rf`, `sudo`, `curl | sh`, `eval(`, or similar dangerous patterns

+ - Contains `rm -rf`, `sudo`, `curl | sh`, `eval(`

- No description or purpose statement

- - **Blocked** trust tier (unknown source — reject entirely)

+ - **Blocked** trust tier

- Present grouped by gap:

+ Present grouped by gap, with trust tier shown:

```

- cloudflare-workers (2 candidates):

+ Thinking — deciding:

- 1. @anthropics/skills/cloudflare

- "Cloudflare Workers and Pages deployment patterns..."

- Source: github.com/anthropics/skills · official

+ (already installed — may be useful now)

+ ✓ decision-matrix "Compare alternatives with weighted criteria..."

+ ✓ six-thinking-hats "6 perspectives: facts, risks, benefits, creativity..."

- 2. @secondsky/cloudflare-workers-deploy

- "Production deployment, wrangler config, D1 bindings..."

- Source: npm:@secondsky/cloudflare-workers-deploy · 2.1K installs

+ (not installed)

+ 1. andurilcode/skills@scenario-planning [COMMUNITY]

+ "Build 3-4 plausible futures, stress-test strategy against each..."

- prisma (1 candidate):

+ Tech — prisma:

- 1. @vercel-labs/prisma-orm

+ 1. @vercel-labs/prisma-orm [VERIFIED]

"Prisma ORM — schema design, migrations, queries..."

- Source: npm:@vercel-labs/prisma-orm · 8.4K installs

- stripe, redis: no skills found (Claude will use general knowledge)

```

- Use **AskUserQuestion** (multiSelect: true):

- - question: "Which skills to install?"

- - options: one per candidate + "Skip all"

+ AskUserQuestion (multiSelect):

+ - question: "Which skills to install? (Installed ones are shown for awareness only)"

+ - options: one per NOT-INSTALLED candidate + "Skip all"

+ ---

### Step 5: Install (trust-tier-aware)

For each selected skill:

- **1. Get the SKILL.md content:**

- - CLI: `npx skills add <package> --dir /tmp/skill-staging/` then read the file

- - Web: already fetched in Step 4, use that content

+ **1. Get the SKILL.md content** from `.agents/skills/` (staged by CLI) or fetched in Step 4.

- **2. Apply trust-tier restrictions before saving:**

+ **2. Apply trust-tier restrictions:**

| Trust tier | Action |

|-----------|--------|

- | **Trusted** | Install as-is. Full allowed-tools preserved. |

- | **Verified** | Install. Keep existing allowed-tools but warn if `Bash` is unrestricted. |

- | **Community** | Quarantine: rewrite `allowed-tools` to read-only set (`Read`, `Glob`, `Grep`, `AskUserQuestion`). Add `quarantine: true` to frontmatter. User can promote later via `/brana:reconcile`. |

- | **Blocked** | Should not reach here (rejected in step 4). |

- For quarantine installs, inform user:

- ```

- Installed in quarantine mode (read-only tools).

- Run /brana:reconcile --scope security to review and promote to full access.

- ```

+ | **Trusted** | Install as-is. |

+ | **Verified** | Install. Warn if `Bash` is unrestricted. |

+ | **Community** | Quarantine: rewrite `allowed-tools` to `[Read, Glob, Grep, AskUserQuestion]`. Add `quarantine: true`. |

+ | **Blocked** | Reject (never reaches here). |

- **3. Install as inline skill (per ADR-034 amendment 2026-06-10, t-1941):**

+ **3. Write to `system/skills/<skill-name>/SKILL.md`** with brana frontmatter:

- Write the full skill to `system/skills/<skill-name>/SKILL.md` — frontmatter followed by the complete procedure body. Do NOT create a `system/procedures/<skill-name>.md` file or a stub pointer; new stubs fail the inline-layout structural test (only the big four are allowlisted until t-1942).

```yaml

---

name: <skill-name>

description: "<description from source>"

- group: brana

+ group: thinking # or appropriate group

keywords: [<extracted keywords>]

allowed-tools: [<per trust tier>]

status: acquired

source: "<source URL>"

acquired: "<YYYY-MM-DD>"

quarantine: <true if community tier>

---

```

- **Frontmatter fixup** — marketplace skills often lack these fields. Always add:

- - `group: brana` (required for plugin discovery)

- - `status: acquired` (distinguishes from native skills)

- - `allowed-tools` (per trust tier — community gets read-only set)

- - `source` and `acquired` (provenance tracking)

- **4. Index in ruflo (best-effort):**

+ Always add: `group`, `status: acquired`, `allowed-tools`, `source`, `acquired`.

+ **4. Reindex:**

```bash

brana skills reindex

```

- This indexes the new skill's frontmatter into ruflo's `skills` namespace, making it discoverable by `/brana:backlog start` skill routing and `/brana:do`. If CLI unavailable, skip — next session start will reindex.

+ ---

### Step 6: Report

```

- Acquired 2 skills:

+ Activity: [detected type]

- + cloudflare-workers-deploy (npm, @secondsky) → system/skills/

- + prisma-orm (npm, @vercel-labs) → system/skills/

+ Thinking skills available for this activity:

+ ✓ decision-matrix, six-thinking-hats (already installed)

+ + scenario-planning (just installed)

- Not found (general knowledge):

- stripe, redis

+ Tech:

+ + prisma-orm (installed)

+ - stripe (not found — Claude will use general knowledge)

- Indexed in ruflo: yes

- Available as: /brana:cloudflare-workers-deploy, /brana:prisma-orm

+ Total: [N] skills now available for [activity type]

```

## Notes

- - Acquired skills follow the inline model (ADR-034 amendment, t-1941): full body in `system/skills/<name>/SKILL.md`, no procedure file. Git-tracked like native skills.

- - If no marketplace CLI is installed, WebSearch finds GitHub repos with SKILL.md files. Lower quality but always works.

- - Never auto-install. Always present candidates and let the user choose.

+ - Never auto-install. Always present and let the user choose.

+ - Installed thinking skills are always shown for awareness even if already present — the user may not know what's available.

+ - Thinking skills can be suggested even without keyword arguments — activity detection from conversation context is enough.

- If a skill turns out to be low quality after use, delete the skill directory.

+ - Acquired skills follow inline model (ADR-034 amendment, t-1941): full body in `system/skills/<name>/SKILL.md`.