What problem does it solve? Code that works today can still break under foreseeable conditions — slow upstreams, unbounded growth, unpinned CI tools, or silent failures that are impossible to diagnose in production. This Skill runs a single-pass find-and-fix sweep across five risk categories in the witwave-ai/witwave repo, turning fragile code into committed, tested fixes without manual triage. ## Core Features & Use Cases - Five-category risk taxonomy: Scans for security (CVEs, secrets, insecure patterns), reliability (missing timeouts, retries, unpinned CI tooling), performance (unbounded growth, blocking-in-async), observability (swallowed errors, missing metrics), and maintainability (flag-only structural issues). - Analyzer-driven and pattern-matched detection: Runs govulncheck, gosec, pip-audit, bandit, gitleaks, and trivy for security, plus targeted greps for the four operational categories. - Depth-gated validation and fix-bar: An 8-concern validation gauntlet filters false positives, and a 5-rule fix-bar decides which findings get atomic per-finding commits versus flagged in memory. - Use Case: After an outage, run "fix reliability risks in harness depth 6" to scan the harness section for missing timeouts and silent degradation, auto-fix the safe findings with per-finding commits, and delegate push plus CI watch to iris. ## Quick Start Ask the agent to work risks in the witwave repo, for example by saying "fix risks in operator depth 5" or "find reliability risks in harness".
