tody-agent

Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.

[Deprecated] deploy safety merged. Use `cm-safe-deploy` instead.

Use at end of sprint to append operational learnings as structured JSONL to the project retro log.

Use when you need visual QA, screenshots, or post-deploy smoke testing through a real browser with Playwright.

Verify and lock project identity before ANY git push, Cloudflare deploy, or Supabase operation. Essential when working with multiple GitHub accounts (personal + work), multiple Cloudflare accounts, or multiple Supabase/Neon projects. Prevents wrong-account deploys, cross-project secret leaks, and git history contamination.

[Deprecated] parallel execution mode. Use `cm-execution` instead.

Use when executing implementation plans — choose mode: batch execution with checkpoints, subagent-per-task, or parallel dispatch for independent problems.

Progressive Disclosure skill index — efficient skill loading in 3 layers. Layer 1 (index, ~100 tokens) always loaded. Layer 2 (summary, ~300 tokens) loaded on context need. Layer 3 (full SKILL.md) loaded on execution only.

Strategic codebase re-direction when requirements change, architecture doesn't fit, or tech debt blocks progress. TRIZ-powered pivot protocol for large codebases.

Use when you need to check if a destructive command is blocked or run guardian freeze checks.

Google App Script form-to-sheet integration with auto-retry, toast notifications, and Zalo/contact fallback. Reusable across any static website.

[Deprecated] skill lifecycle merged. Use `cm-skill-evolution` instead.