{"owner":"bisq-network","repo":"bisq","hasSkills":true,"totalSkillsCount":3,"totalTokensCount":1149,"categories":["claude-rule","plugin-manifest","root-instruction"],"hasMcp":false,"mcpConfig":null,"found":["CLAUDE.md","tools/cve-scan/README.md","AGENTS.md"],"skills":{"CLAUDE.md":"# Claude Instructions\n\nRead and follow all project specific instructions in `AGENTS.md`.\nRead ~/.claude/CLAUDE.md and report whether it was loaded.\n\n","tools/cve-scan/README.md":"# CVE Scan\n\nStandalone OWASP Dependency-Check project. Scans all libraries declared in\n`gradle/libs.versions.toml` for known CVEs.\n\nIsolated from the main Bisq build — does **not** modify\n`gradle/verification-metadata.xml`, the build classpath, or runtime\ndependencies. The scan tool's own transitive deps live only inside this\nsubdirectory.\n\n## Usage\n\nRun from repo root:\n\n```bash\n# Throttled scan: skips if last run <24h ago AND libs.versions.toml unchanged\n./gradlew -p tools/cve-scan cveCheck\n\n# Force re-scan (ignore throttle)\n./gradlew -p tools/cve-scan cveCheck --rerun-tasks\n\n# Direct task (same throttle applies)\n./gradlew -p tools/cve-scan dependencyCheckAggregate\n```\n\nBuild fails with non-zero exit on any CVE (`failBuildOnCVSS = 0`).\n\n## Report\n\n`tools/cve-scan/build/reports/dependency-check-report.html` (also JSON).\n\n## NVD API key (recommended)\n\nWithout a key the NVD API throttles aggressively — first run can take 10+\nminutes. With a key, seconds.\n\nRequest: https://nvd.nist.gov/developers/request-an-api-key\n\nPass via either:\n\n```bash\nexport NVD_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\n# or\n./gradlew -p tools/cve-scan cveCheck -PnvdApiKey=xxxx\n```\n\nNVD feed is cached in `~/.gradle/dependency-check-data` across runs.\n\n## Configuration\n\nEdit `tools/cve-scan/build.gradle`:\n\n- `failBuildOnCVSS = 0` — fail on any CVE. Raise (e.g. `7`) to allow lows/mediums.\n- `formats = ['HTML', 'JSON']` — add `'SARIF'`, `'XML'`, etc. as needed.\n- TTL `cveTtlMs` — throttle window (default 24h).\n\n## Scope\n\nScans every entry in the `[libraries]` table of `gradle/libs.versions.toml`,\nincluding transitive dependencies.\n\n**Not scanned:** dependencies declared as raw `\"group:artifact:version\"`\nstrings inside subproject `build.gradle` files (none expected — Bisq\ncentralizes deps in the version catalog).\n\nThe `bitcoind` included build is a separate Gradle build and is not covered.\n\n## CI\n\nThis tool is intentionally local-only. To run on a schedule, invoke\n`./gradlew -p tools/cve-scan cveCheck` from a CI workflow.\n","AGENTS.md":"# AGENTS.md - Bisq 1\n\n## Initialization\nRead ~/.codex/AGENTS.md if present and report whether it was loaded.\n\n\n## Scope\n\nThis file contains agent-specific operating rules.\nProject setup, contribution workflow, testing, and domain-specific notes are defined in the developer docs.\n\n## Source of Truth (Developer Docs)\n\nStart with:\n\n- [Developer docs index](docs/README.md)\n- [Build](docs/build.md)\n\nMost relevant referenced docs:\n\n- [Contributing](CONTRIBUTING.md)\n- [Testing](docs/testing.md)\n- [IDEA import](docs/idea-import.md)\n- [Local regtest/dev network](Makefile)\n- [API overview](docs/api-overview.md)\n\n\n## Tech and Runtime Context\n\n- Java (JDK 21)\n- Gradle wrapper; main project build files use Groovy DSL, with Kotlin DSL in build-logic and bitcoind subprojects\n- JavaFX desktop app, daemon/CLI modules, P2P networking, Bitcoin wallet integration, and DAO components\n\n---\n\n## Agent Behavior\n\n- Do not guess missing requirements\n- Do not introduce new dependencies without strong justification\n- Prefer existing utilities and established patterns over new implementations\n- Keep changes minimal and consistent with surrounding code\n\n### Correctness Over Compliance\n- Do not optimize for agreement with the developer\n- If a request conflicts with architecture, conventions, or correctness, **point it out explicitly**\n- Do not silently work around problems or inconsistencies\n\n### No Hidden Assumptions\n- Do not infer unstated requirements\n- Do not change behavior beyond the requested scope\n- If multiple interpretations are possible, **stop and ask for clarification**\n\n### Consistency Enforcement\n- Match the style, structure, and patterns of the surrounding code\n- Do not introduce new abstractions, patterns, or naming schemes without clear need\n- Avoid unrelated refactoring or “improvements”\n\n### Quality Gate (Self-Check Before Completion)\nEnsure that:\n- The change is minimal and scoped to the request\n- The solution follows existing project conventions\n- No unnecessary complexity or abstraction was introduced\n- No hidden assumptions were made\n- The result would pass a strict code review\n\n### Failure Handling\n- If the task cannot be completed safely or clearly, **do not proceed with a speculative or partial solution**\n- Clearly state what is missing and what is required\n\n### Rule of Last Resort\n- If the requested change would not pass a strict senior code review, **do not implement it—explain why instead**\n\nWhen uncertain: **stop and ask**\n\n---\n\n## Authority\n\nHuman contributors have final authority.\nAgents are assistants, not decision-makers.\n\n---\n\n## License\n\nBisq is licensed under AGPL-3.0.\n"},"files":{"CLAUDE.md":"# Claude Instructions\n\nRead and follow all project specific instructions in `AGENTS.md`.\nRead ~/.claude/CLAUDE.md and report whether it was loaded.\n\n","tools/cve-scan/README.md":"# CVE Scan\n\nStandalone OWASP Dependency-Check project. Scans all libraries declared in\n`gradle/libs.versions.toml` for known CVEs.\n\nIsolated from the main Bisq build — does **not** modify\n`gradle/verification-metadata.xml`, the build classpath, or runtime\ndependencies. The scan tool's own transitive deps live only inside this\nsubdirectory.\n\n## Usage\n\nRun from repo root:\n\n```bash\n# Throttled scan: skips if last run <24h ago AND libs.versions.toml unchanged\n./gradlew -p tools/cve-scan cveCheck\n\n# Force re-scan (ignore throttle)\n./gradlew -p tools/cve-scan cveCheck --rerun-tasks\n\n# Direct task (same throttle applies)\n./gradlew -p tools/cve-scan dependencyCheckAggregate\n```\n\nBuild fails with non-zero exit on any CVE (`failBuildOnCVSS = 0`).\n\n## Report\n\n`tools/cve-scan/build/reports/dependency-check-report.html` (also JSON).\n\n## NVD API key (recommended)\n\nWithout a key the NVD API throttles aggressively — first run can take 10+\nminutes. With a key, seconds.\n\nRequest: https://nvd.nist.gov/developers/request-an-api-key\n\nPass via either:\n\n```bash\nexport NVD_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\n# or\n./gradlew -p tools/cve-scan cveCheck -PnvdApiKey=xxxx\n```\n\nNVD feed is cached in `~/.gradle/dependency-check-data` across runs.\n\n## Configuration\n\nEdit `tools/cve-scan/build.gradle`:\n\n- `failBuildOnCVSS = 0` — fail on any CVE. Raise (e.g. `7`) to allow lows/mediums.\n- `formats = ['HTML', 'JSON']` — add `'SARIF'`, `'XML'`, etc. as needed.\n- TTL `cveTtlMs` — throttle window (default 24h).\n\n## Scope\n\nScans every entry in the `[libraries]` table of `gradle/libs.versions.toml`,\nincluding transitive dependencies.\n\n**Not scanned:** dependencies declared as raw `\"group:artifact:version\"`\nstrings inside subproject `build.gradle` files (none expected — Bisq\ncentralizes deps in the version catalog).\n\nThe `bitcoind` included build is a separate Gradle build and is not covered.\n\n## CI\n\nThis tool is intentionally local-only. To run on a schedule, invoke\n`./gradlew -p tools/cve-scan cveCheck` from a CI workflow.\n","AGENTS.md":"# AGENTS.md - Bisq 1\n\n## Initialization\nRead ~/.codex/AGENTS.md if present and report whether it was loaded.\n\n\n## Scope\n\nThis file contains agent-specific operating rules.\nProject setup, contribution workflow, testing, and domain-specific notes are defined in the developer docs.\n\n## Source of Truth (Developer Docs)\n\nStart with:\n\n- [Developer docs index](docs/README.md)\n- [Build](docs/build.md)\n\nMost relevant referenced docs:\n\n- [Contributing](CONTRIBUTING.md)\n- [Testing](docs/testing.md)\n- [IDEA import](docs/idea-import.md)\n- [Local regtest/dev network](Makefile)\n- [API overview](docs/api-overview.md)\n\n\n## Tech and Runtime Context\n\n- Java (JDK 21)\n- Gradle wrapper; main project build files use Groovy DSL, with Kotlin DSL in build-logic and bitcoind subprojects\n- JavaFX desktop app, daemon/CLI modules, P2P networking, Bitcoin wallet integration, and DAO components\n\n---\n\n## Agent Behavior\n\n- Do not guess missing requirements\n- Do not introduce new dependencies without strong justification\n- Prefer existing utilities and established patterns over new implementations\n- Keep changes minimal and consistent with surrounding code\n\n### Correctness Over Compliance\n- Do not optimize for agreement with the developer\n- If a request conflicts with architecture, conventions, or correctness, **point it out explicitly**\n- Do not silently work around problems or inconsistencies\n\n### No Hidden Assumptions\n- Do not infer unstated requirements\n- Do not change behavior beyond the requested scope\n- If multiple interpretations are possible, **stop and ask for clarification**\n\n### Consistency Enforcement\n- Match the style, structure, and patterns of the surrounding code\n- Do not introduce new abstractions, patterns, or naming schemes without clear need\n- Avoid unrelated refactoring or “improvements”\n\n### Quality Gate (Self-Check Before Completion)\nEnsure that:\n- The change is minimal and scoped to the request\n- The solution follows existing project conventions\n- No unnecessary complexity or abstraction was introduced\n- No hidden assumptions were made\n- The result would pass a strict code review\n\n### Failure Handling\n- If the task cannot be completed safely or clearly, **do not proceed with a speculative or partial solution**\n- Clearly state what is missing and what is required\n\n### Rule of Last Resort\n- If the requested change would not pass a strict senior code review, **do not implement it—explain why instead**\n\nWhen uncertain: **stop and ask**\n\n---\n\n## Authority\n\nHuman contributors have final authority.\nAgents are assistants, not decision-makers.\n\n---\n\n## License\n\nBisq is licensed under AGPL-3.0.\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","rawUrl":"https://raw.githubusercontent.com/bisq-network/bisq/HEAD/AGENTS.md","title":"AI Agent Protocol & Instructions","category":"root-instruction","format":"markdown","content":"# AGENTS.md - Bisq 1\n\n## Initialization\nRead ~/.codex/AGENTS.md if present and report whether it was loaded.\n\n\n## Scope\n\nThis file contains agent-specific operating rules.\nProject setup, contribution workflow, testing, and domain-specific notes are defined in the developer docs.\n\n## Source of Truth (Developer Docs)\n\nStart with:\n\n- [Developer docs index](docs/README.md)\n- [Build](docs/build.md)\n\nMost relevant referenced docs:\n\n- [Contributing](CONTRIBUTING.md)\n- [Testing](docs/testing.md)\n- [IDEA import](docs/idea-import.md)\n- [Local regtest/dev network](Makefile)\n- [API overview](docs/api-overview.md)\n\n\n## Tech and Runtime Context\n\n- Java (JDK 21)\n- Gradle wrapper; main project build files use Groovy DSL, with Kotlin DSL in build-logic and bitcoind subprojects\n- JavaFX desktop app, daemon/CLI modules, P2P networking, Bitcoin wallet integration, and DAO components\n\n---\n\n## Agent Behavior\n\n- Do not guess missing requirements\n- Do not introduce new dependencies without strong justification\n- Prefer existing utilities and established patterns over new implementations\n- Keep changes minimal and consistent with surrounding code\n\n### Correctness Over Compliance\n- Do not optimize for agreement with the developer\n- If a request conflicts with architecture, conventions, or correctness, **point it out explicitly**\n- Do not silently work around problems or inconsistencies\n\n### No Hidden Assumptions\n- Do not infer unstated requirements\n- Do not change behavior beyond the requested scope\n- If multiple interpretations are possible, **stop and ask for clarification**\n\n### Consistency Enforcement\n- Match the style, structure, and patterns of the surrounding code\n- Do not introduce new abstractions, patterns, or naming schemes without clear need\n- Avoid unrelated refactoring or “improvements”\n\n### Quality Gate (Self-Check Before Completion)\nEnsure that:\n- The change is minimal and scoped to the request\n- The solution follows existing project conventions\n- No unnecessary complexity or abstraction was introduced\n- No hidden assumptions were made\n- The result would pass a strict code review\n\n### Failure Handling\n- If the task cannot be completed safely or clearly, **do not proceed with a speculative or partial solution**\n- Clearly state what is missing and what is required\n\n### Rule of Last Resort\n- If the requested change would not pass a strict senior code review, **do not implement it—explain why instead**\n\nWhen uncertain: **stop and ask**\n\n---\n\n## Authority\n\nHuman contributors have final authority.\nAgents are assistants, not decision-makers.\n\n---\n\n## License\n\nBisq is licensed under AGPL-3.0.\n","isInternal":false,"tokens":556,"sizeBytes":2628},{"name":"CLAUDE.md","path":"CLAUDE.md","rawUrl":"https://raw.githubusercontent.com/bisq-network/bisq/HEAD/CLAUDE.md","title":"Claude Agent Guidelines & System Prompt","category":"claude-rule","format":"markdown","content":"# Claude Instructions\n\nRead and follow all project specific instructions in `AGENTS.md`.\nRead ~/.claude/CLAUDE.md and report whether it was loaded.\n\n","isInternal":false,"tokens":33,"sizeBytes":149},{"name":"README.md","path":"tools/cve-scan/README.md","rawUrl":"https://raw.githubusercontent.com/bisq-network/bisq/HEAD/tools/cve-scan/README.md","title":"cve-scan Documentation","category":"plugin-manifest","format":"markdown","content":"# CVE Scan\n\nStandalone OWASP Dependency-Check project. Scans all libraries declared in\n`gradle/libs.versions.toml` for known CVEs.\n\nIsolated from the main Bisq build — does **not** modify\n`gradle/verification-metadata.xml`, the build classpath, or runtime\ndependencies. The scan tool's own transitive deps live only inside this\nsubdirectory.\n\n## Usage\n\nRun from repo root:\n\n```bash\n# Throttled scan: skips if last run <24h ago AND libs.versions.toml unchanged\n./gradlew -p tools/cve-scan cveCheck\n\n# Force re-scan (ignore throttle)\n./gradlew -p tools/cve-scan cveCheck --rerun-tasks\n\n# Direct task (same throttle applies)\n./gradlew -p tools/cve-scan dependencyCheckAggregate\n```\n\nBuild fails with non-zero exit on any CVE (`failBuildOnCVSS = 0`).\n\n## Report\n\n`tools/cve-scan/build/reports/dependency-check-report.html` (also JSON).\n\n## NVD API key (recommended)\n\nWithout a key the NVD API throttles aggressively — first run can take 10+\nminutes. With a key, seconds.\n\nRequest: https://nvd.nist.gov/developers/request-an-api-key\n\nPass via either:\n\n```bash\nexport NVD_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\n# or\n./gradlew -p tools/cve-scan cveCheck -PnvdApiKey=xxxx\n```\n\nNVD feed is cached in `~/.gradle/dependency-check-data` across runs.\n\n## Configuration\n\nEdit `tools/cve-scan/build.gradle`:\n\n- `failBuildOnCVSS = 0` — fail on any CVE. Raise (e.g. `7`) to allow lows/mediums.\n- `formats = ['HTML', 'JSON']` — add `'SARIF'`, `'XML'`, etc. as needed.\n- TTL `cveTtlMs` — throttle window (default 24h).\n\n## Scope\n\nScans every entry in the `[libraries]` table of `gradle/libs.versions.toml`,\nincluding transitive dependencies.\n\n**Not scanned:** dependencies declared as raw `\"group:artifact:version\"`\nstrings inside subproject `build.gradle` files (none expected — Bisq\ncentralizes deps in the version catalog).\n\nThe `bitcoind` included build is a separate Gradle build and is not covered.\n\n## CI\n\nThis tool is intentionally local-only. To run on a schedule, invoke\n`./gradlew -p tools/cve-scan cveCheck` from a CI workflow.\n","isInternal":false,"tokens":560,"sizeBytes":2039}],"systemPromptSnippet":"<yakaai_skills repo=\"bisq-network/bisq\">\n<!-- File: AGENTS.md (Tokens: ~556 | Category: root-instruction) -->\n# AGENTS.md - Bisq 1\n\n## Initialization\nRead ~/.codex/AGENTS.md if present and report whether it was loaded.\n\n\n## Scope\n\nThis file contains agent-specific operating rules.\nProject setup, contribution workflow, testing, and domain-specific notes are defined in the developer docs.\n\n## Source of Truth (Developer Docs)\n\nStart with:\n\n- [Developer docs index](docs/README.md)\n- [Build](docs/build.md)\n\nMost relevant referenced docs:\n\n- [Contributing](CONTRIBUTING.md)\n- [Testing](docs/testing.md)\n- [IDEA import](docs/idea-import.md)\n- [Local regtest/dev network](Makefile)\n- [API overview](docs/api-overview.md)\n\n\n## Tech and Runtime Context\n\n- Java (JDK 21)\n- Gradle wrapper; main project build files use Groovy DSL, with Kotlin DSL in build-logic and bitcoind subprojects\n- JavaFX desktop app, daemon/CLI modules, P2P networking, Bitcoin wallet integration, and DAO components\n\n---\n\n## Agent Behavior\n\n- Do not guess missing requirements\n- Do not introduce new dependencies without strong justification\n- Prefer existing utilities and established patterns over new implementations\n- Keep changes minimal and consistent with surrounding code\n\n### Correctness Over Compliance\n- Do not optimize for agreement with the developer\n- If a request conflicts with architecture, conventions, or correctness, **point it out explicitly**\n- Do not silently work around problems or inconsistencies\n\n### No Hidden Assumptions\n- Do not infer unstated requirements\n- Do not change behavior beyond the requested scope\n- If multiple interpretations are possible, **stop and ask for clarification**\n\n### Consistency Enforcement\n- Match the style, structure, and patterns of the surrounding code\n- Do not introduce new abstractions, patterns, or naming schemes without clear need\n- Avoid unrelated refactoring or “improvements”\n\n### Quality Gate (Self-Check Before Completion)\nEnsure that:\n- The change is minimal and scoped to the request\n- The solution follows existing project conventions\n- No unnecessary complexity or abstraction was introduced\n- No hidden assumptions were made\n- The result would pass a strict code review\n\n### Failure Handling\n- If the task cannot be completed safely or clearly, **do not proceed with a speculative or partial solution**\n- Clearly state what is missing and what is required\n\n### Rule of Last Resort\n- If the requested change would not pass a strict senior code review, **do not implement it—explain why instead**\n\nWhen uncertain: **stop and ask**\n\n---\n\n## Authority\n\nHuman contributors have final authority.\nAgents are assistants, not decision-makers.\n\n---\n\n## License\n\nBisq is licensed under AGPL-3.0.\n\n<!-- File: CLAUDE.md (Tokens: ~33 | Category: claude-rule) -->\n# Claude Instructions\n\nRead and follow all project specific instructions in `AGENTS.md`.\nRead ~/.claude/CLAUDE.md and report whether it was loaded.\n\n<!-- File: tools/cve-scan/README.md (Tokens: ~560 | Category: plugin-manifest) -->\n# CVE Scan\n\nStandalone OWASP Dependency-Check project. Scans all libraries declared in\n`gradle/libs.versions.toml` for known CVEs.\n\nIsolated from the main Bisq build — does **not** modify\n`gradle/verification-metadata.xml`, the build classpath, or runtime\ndependencies. The scan tool's own transitive deps live only inside this\nsubdirectory.\n\n## Usage\n\nRun from repo root:\n\n```bash\n# Throttled scan: skips if last run <24h ago AND libs.versions.toml unchanged\n./gradlew -p tools/cve-scan cveCheck\n\n# Force re-scan (ignore throttle)\n./gradlew -p tools/cve-scan cveCheck --rerun-tasks\n\n# Direct task (same throttle applies)\n./gradlew -p tools/cve-scan dependencyCheckAggregate\n```\n\nBuild fails with non-zero exit on any CVE (`failBuildOnCVSS = 0`).\n\n## Report\n\n`tools/cve-scan/build/reports/dependency-check-report.html` (also JSON).\n\n## NVD API key (recommended)\n\nWithout a key the NVD API throttles aggressively — first run can take 10+\nminutes. With a key, seconds.\n\nRequest: https://nvd.nist.gov/developers/request-an-api-key\n\nPass via either:\n\n```bash\nexport NVD_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\n# or\n./gradlew -p tools/cve-scan cveCheck -PnvdApiKey=xxxx\n```\n\nNVD feed is cached in `~/.gradle/dependency-check-data` across runs.\n\n## Configuration\n\nEdit `tools/cve-scan/build.gradle`:\n\n- `failBuildOnCVSS = 0` — fail on any CVE. Raise (e.g. `7`) to allow lows/mediums.\n- `formats = ['HTML', 'JSON']` — add `'SARIF'`, `'XML'`, etc. as needed.\n- TTL `cveTtlMs` — throttle window (default 24h).\n\n## Scope\n\nScans every entry in the `[libraries]` table of `gradle/libs.versions.toml`,\nincluding transitive dependencies.\n\n**Not scanned:** dependencies declared as raw `\"group:artifact:version\"`\nstrings inside subproject `build.gradle` files (none expected — Bisq\ncentralizes deps in the version catalog).\n\nThe `bitcoind` included build is a separate Gradle build and is not covered.\n\n## CI\n\nThis tool is intentionally local-only. To run on a schedule, invoke\n`./gradlew -p tools/cve-scan cveCheck` from a CI workflow.\n</yakaai_skills>"}