{"owner":"prowler-cloud","repo":"prowler","hasSkills":true,"hasMcp":true,"mcpConfig":{"mcpServers":{"prowler":{"command":"npx","args":["-y","@modelcontextprotocol/server-prowler"]}}},"found":["AGENTS.md"],"skills":{"AGENTS.md":"# Repository Guidelines\n\n## How to Use This Guide\n\n- Start here for cross-project norms. Prowler is a monorepo with several components.\n- Each component has an `AGENTS.md` file with specific guidelines (e.g., `api/AGENTS.md`, `ui/AGENTS.md`).\n- Component docs override this file when guidance conflicts.\n\n## Available Skills\n\nUse these skills for detailed patterns on-demand:\n\n### Generic Skills (Any Project)\n\n| Skill | Description | URL |\n|-------|-------------|-----|\n| `typescript` | Const types, flat interfaces, utility types | [SKILL.md](skills/typescript/SKILL.md) |\n| `react-19` | No useMemo/useCallback, React Compiler | [SKILL.md](skills/react-19/SKILL.md) |\n| `nextjs-16` | App Router, Server Actions, proxy.ts, streaming | [SKILL.md](skills/nextjs-16/SKILL.md) |\n| `tailwind-4` | cn() utility, no var() in className | [SKILL.md](skills/tailwind-4/SKILL.md) |\n| `playwright` | Page Object Model, MCP workflow, selectors | [SKILL.md](skills/playwright/SKILL.md) |\n| `pytest` | Fixtures, mocking, markers, parametrize | [SKILL.md](skills/pytest/SKILL.md) |\n| `django-drf` | ViewSets, Serializers, Filters | [SKILL.md](skills/django-drf/SKILL.md) |\n| `jsonapi` | Strict JSON:API v1.1 spec compliance | [SKILL.md](skills/jsonapi/SKILL.md) |\n| `zod-4` | New API (z.email(), z.uuid()) | [SKILL.md](skills/zod-4/SKILL.md) |\n| `zustand-5` | Persist, selectors, slices | [SKILL.md](skills/zustand-5/SKILL.md) |\n| `ai-sdk-5` | UIMessage, streaming, LangChain | [SKILL.md](skills/ai-sdk-5/SKILL.md) |\n| `vitest` | Unit testing, React Testing Library | [SKILL.md](skills/vitest/SKILL.md) |\n| `tdd` | Test-Driven Development workflow | [SKILL.md](skills/tdd/SKILL.md) |\n\n### Prowler-Specific Skills\n\n| Skill | Description | URL |\n|-------|-------------|-----|\n| `prowler` | Project overview, component navigation | [SKILL.md](skills/prowler/SKILL.md) |\n| `prowler-api` | Django + RLS + JSON:API patterns | [SKILL.md](skills/prowler-api/SKILL.md) |\n| `prowler-ui` | Next.js + shadcn conventions | [SKILL.md](skills/prowler-ui/SKILL.md) |\n| `prowler-sdk-check` | Create new security checks | [SKILL.md](skills/prowler-sdk-check/SKILL.md) |\n| `prowler-mcp` | MCP server tools and models | [SKILL.md](skills/prowler-mcp/SKILL.md) |\n| `prowler-test-sdk` | SDK testing (pytest + moto) | [SKILL.md](skills/prowler-test-sdk/SKILL.md) |\n| `prowler-test-api` | API testing (pytest-django + RLS) | [SKILL.md](skills/prowler-test-api/SKILL.md) |\n| `prowler-test-ui` | E2E testing (Playwright) | [SKILL.md](skills/prowler-test-ui/SKILL.md) |\n| `prowler-compliance` | Compliance framework structure | [SKILL.md](skills/prowler-compliance/SKILL.md) |\n| `prowler-compliance-review` | Review compliance framework PRs | [SKILL.md](skills/prowler-compliance-review/SKILL.md) |\n| `prowler-provider` | Add new cloud providers | [SKILL.md](skills/prowler-provider/SKILL.md) |\n| `prowler-changelog` | Changelog entries (keepachangelog.com) | [SKILL.md](skills/prowler-changelog/SKILL.md) |\n| `prowler-ci` | CI checks and PR gates (GitHub Actions) | [SKILL.md](skills/prowler-ci/SKILL.md) |\n| `prowler-commit` | Professional commits (conventional-commits) | [SKILL.md](skills/prowler-commit/SKILL.md) |\n| `prowler-pr` | Pull request conventions | [SKILL.md](skills/prowler-pr/SKILL.md) |\n| `prowler-docs` | Documentation style guide | [SKILL.md](skills/prowler-docs/SKILL.md) |\n| `django-migration-psql` | Django migration best practices for PostgreSQL | [SKILL.md](skills/django-migration-psql/SKILL.md) |\n| `postgresql-indexing` | PostgreSQL indexing, EXPLAIN, monitoring, maintenance | [SKILL.md](skills/postgresql-indexing/SKILL.md) |\n| `prowler-attack-paths-query` | Create Attack Paths openCypher queries | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |\n| `prowler-tour` | Keep product-tour definitions aligned with the UI | [SKILL.md](skills/prowler-tour/SKILL.md) |\n| `gh-aw` | GitHub Agentic Workflows (gh-aw) | [SKILL.md](skills/gh-aw/SKILL.md) |\n| `skill-creator` | Create new AI agent skills | [SKILL.md](skills/skill-creator/SKILL.md) |\n\n### Auto-invoke Skills\n\nWhen performing these actions, ALWAYS invoke the corresponding skill FIRST:\n\n| Action | Skill |\n|--------|-------|\n| Add changelog entry for a PR or feature | `prowler-changelog` |\n| Adding ConfigRequirements guardrails to compliance requirements | `prowler-compliance` |\n| Adding DRF pagination or permissions | `django-drf` |\n| Adding a compliance output formatter (per-provider class + table dispatcher) | `prowler-compliance` |\n| Adding indexes or constraints to database tables | `django-migration-psql` |\n| Adding new providers | `prowler-provider` |\n| Adding privilege escalation detection queries | `prowler-attack-paths-query` |\n| Adding services to existing providers | `prowler-provider` |\n| Adding, updating, or removing a tour definition (*.tour.ts) | `prowler-tour` |\n| After creating/modifying a skill | `skill-sync` |\n| App Router / Server Actions | `nextjs-16` |\n| Auditing check-to-requirement mappings as a cloud auditor | `prowler-compliance` |\n| Building AI chat features | `ai-sdk-5` |\n| Changing button labels or section headings on a tour-covered page | `prowler-tour` |\n| Committing changes | `prowler-commit` |\n| Configuring MCP servers in agentic workflows | `gh-aw` |\n| Create PR that requires changelog entry | `prowler-changelog` |\n| Create a PR with gh pr create | `prowler-pr` |\n| Creating API endpoints | `jsonapi` |\n| Creating Attack Paths queries | `prowler-attack-paths-query` |\n| Creating GitHub Agentic Workflows | `gh-aw` |\n| Creating ViewSets, serializers, or filters in api/ | `django-drf` |\n| Creating Zod schemas | `zod-4` |\n| Creating a git commit | `prowler-commit` |\n| Creating a universal (multi-provider) compliance framework | `prowler-compliance` |\n| Creating new checks | `prowler-sdk-check` |\n| Creating new skills | `skill-creator` |\n| Creating or reviewing Django migrations | `django-migration-psql` |\n| Creating/modifying Prowler UI components | `prowler-ui` |\n| Creating/modifying models, views, serializers | `prowler-api` |\n| Creating/updating compliance frameworks | `prowler-compliance` |\n| Debug why a GitHub Actions job is failing | `prowler-ci` |\n| Debugging gh-aw compilation errors | `gh-aw` |\n| Editing a UI file containing data-tour-id attributes | `prowler-tour` |\n| Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist) | `prowler-pr` |\n| Fixing bug | `tdd` |\n| Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs) | `prowler-compliance` |\n| General Prowler development questions | `prowler` |\n| Implementing JSON:API endpoints | `django-drf` |\n| Implementing feature | `tdd` |\n| Importing Copilot Custom Agents into workflows | `gh-aw` |\n| Inspect PR CI checks and gates (.github/workflows/*) | `prowler-ci` |\n| Inspect PR CI workflows (.github/workflows/*): conventional-commit, pr-check-changelog, pr-conflict-checker, labeler | `prowler-pr` |\n| Mapping checks to compliance controls | `prowler-compliance` |\n| Mocking AWS with moto in tests | `prowler-test-sdk` |\n| Modifying API responses | `jsonapi` |\n| Modifying component | `tdd` |\n| Modifying gh-aw workflow frontmatter or safe-outputs | `gh-aw` |\n| Refactoring code | `tdd` |\n| Regenerate AGENTS.md Auto-invoke tables (sync.sh) | `skill-sync` |\n| Renaming or removing a data-tour-id attribute value | `prowler-tour` |\n| Restructuring routes or layouts covered by a tour | `prowler-tour` |\n| Review PR requirements: template, title conventions, changelog gate | `prowler-pr` |\n| Review changelog format and conventions | `prowler-changelog` |\n| Reviewing JSON:API compliance | `jsonapi` |\n| Reviewing Prowler UI components | `prowler-ui` |\n| Reviewing compliance framework PRs | `prowler-compliance-review` |\n| Running makemigrations or pgmakemigrations | `django-migration-psql` |\n| Syncing compliance framework with upstream catalog | `prowler-compliance` |\n| Testing RLS tenant isolation | `prowler-test-api` |\n| Testing hooks or utilities | `vitest` |\n| Troubleshoot why a skill is missing from AGENTS.md auto-invoke | `skill-sync` |\n| Understand CODEOWNERS/labeler-based automation | `prowler-ci` |\n| Understand PR title conventional-commit validation | `prowler-ci` |\n| Understand changelog gate and no-changelog label behavior | `prowler-ci` |\n| Understand review ownership with CODEOWNERS | `prowler-pr` |\n| Update CHANGELOG.md in any component | `prowler-changelog` |\n| Updating README.md provider statistics table | `prowler-readme-table` |\n| Updating checks, services, compliance, or categories count in README.md | `prowler-readme-table` |\n| Updating existing Attack Paths queries | `prowler-attack-paths-query` |\n| Updating existing checks and metadata | `prowler-sdk-check` |\n| Using Zustand stores | `zustand-5` |\n| Working on MCP server tools | `prowler-mcp` |\n| Working on Prowler UI structure (actions/adapters/types/hooks) | `prowler-ui` |\n| Working on task | `tdd` |\n| Working with Prowler UI test helpers/pages | `prowler-test-ui` |\n| Working with Tailwind classes | `tailwind-4` |\n| Writing Playwright E2E tests | `playwright` |\n| Writing Prowler API tests | `prowler-test-api` |\n| Writing Prowler SDK tests | `prowler-test-sdk` |\n| Writing Prowler UI E2E tests | `prowler-test-ui` |\n| Writing Python tests with pytest | `pytest` |\n| Writing React component tests | `vitest` |\n| Writing React components | `react-19` |\n| Writing TypeScript types/interfaces | `typescript` |\n| Writing Vitest tests | `vitest` |\n| Writing data backfill or data migration | `django-migration-psql` |\n| Writing documentation | `prowler-docs` |\n| Writing unit tests for UI | `vitest` |\n\n---\n\n## Project Overview\n\nProwler is an open-source cloud security assessment tool supporting AWS, Azure, GCP, Kubernetes, GitHub, M365, and more.\n\n| Component | Location | Tech Stack |\n|-----------|----------|------------|\n| SDK | `prowler/` | Python 3.10+, uv |\n| API | `api/` | Django 5.1, DRF, Celery |\n| UI | `ui/` | Next.js 16, React 19, Tailwind 4 |\n| MCP Server | `mcp_server/` | FastMCP, Python 3.12+ |\n| Dashboard | `dashboard/` | Dash, Plotly |\n\n---\n\n## Python Development\n\n```bash\n# Setup\nuv sync\nuv run prek install\n\n# Code quality\nuv run make lint\nuv run make format\nuv run prek run --all-files\n```\n\n---\n\n## Commit & Pull Request Guidelines\n\nFollow conventional-commit style: `<type>[scope]: <description>`\n\n**Types:** `feat`, `fix`, `docs`, `chore`, `perf`, `refactor`, `style`, `test`\n\nBefore creating a PR:\n1. Complete checklist in `.github/pull_request_template.md`\n2. Run all relevant tests and linters\n3. Link screenshots for UI changes\n"},"files":{"AGENTS.md":"# Repository Guidelines\n\n## How to Use This Guide\n\n- Start here for cross-project norms. Prowler is a monorepo with several components.\n- Each component has an `AGENTS.md` file with specific guidelines (e.g., `api/AGENTS.md`, `ui/AGENTS.md`).\n- Component docs override this file when guidance conflicts.\n\n## Available Skills\n\nUse these skills for detailed patterns on-demand:\n\n### Generic Skills (Any Project)\n\n| Skill | Description | URL |\n|-------|-------------|-----|\n| `typescript` | Const types, flat interfaces, utility types | [SKILL.md](skills/typescript/SKILL.md) |\n| `react-19` | No useMemo/useCallback, React Compiler | [SKILL.md](skills/react-19/SKILL.md) |\n| `nextjs-16` | App Router, Server Actions, proxy.ts, streaming | [SKILL.md](skills/nextjs-16/SKILL.md) |\n| `tailwind-4` | cn() utility, no var() in className | [SKILL.md](skills/tailwind-4/SKILL.md) |\n| `playwright` | Page Object Model, MCP workflow, selectors | [SKILL.md](skills/playwright/SKILL.md) |\n| `pytest` | Fixtures, mocking, markers, parametrize | [SKILL.md](skills/pytest/SKILL.md) |\n| `django-drf` | ViewSets, Serializers, Filters | [SKILL.md](skills/django-drf/SKILL.md) |\n| `jsonapi` | Strict JSON:API v1.1 spec compliance | [SKILL.md](skills/jsonapi/SKILL.md) |\n| `zod-4` | New API (z.email(), z.uuid()) | [SKILL.md](skills/zod-4/SKILL.md) |\n| `zustand-5` | Persist, selectors, slices | [SKILL.md](skills/zustand-5/SKILL.md) |\n| `ai-sdk-5` | UIMessage, streaming, LangChain | [SKILL.md](skills/ai-sdk-5/SKILL.md) |\n| `vitest` | Unit testing, React Testing Library | [SKILL.md](skills/vitest/SKILL.md) |\n| `tdd` | Test-Driven Development workflow | [SKILL.md](skills/tdd/SKILL.md) |\n\n### Prowler-Specific Skills\n\n| Skill | Description | URL |\n|-------|-------------|-----|\n| `prowler` | Project overview, component navigation | [SKILL.md](skills/prowler/SKILL.md) |\n| `prowler-api` | Django + RLS + JSON:API patterns | [SKILL.md](skills/prowler-api/SKILL.md) |\n| `prowler-ui` | Next.js + shadcn conventions | [SKILL.md](skills/prowler-ui/SKILL.md) |\n| `prowler-sdk-check` | Create new security checks | [SKILL.md](skills/prowler-sdk-check/SKILL.md) |\n| `prowler-mcp` | MCP server tools and models | [SKILL.md](skills/prowler-mcp/SKILL.md) |\n| `prowler-test-sdk` | SDK testing (pytest + moto) | [SKILL.md](skills/prowler-test-sdk/SKILL.md) |\n| `prowler-test-api` | API testing (pytest-django + RLS) | [SKILL.md](skills/prowler-test-api/SKILL.md) |\n| `prowler-test-ui` | E2E testing (Playwright) | [SKILL.md](skills/prowler-test-ui/SKILL.md) |\n| `prowler-compliance` | Compliance framework structure | [SKILL.md](skills/prowler-compliance/SKILL.md) |\n| `prowler-compliance-review` | Review compliance framework PRs | [SKILL.md](skills/prowler-compliance-review/SKILL.md) |\n| `prowler-provider` | Add new cloud providers | [SKILL.md](skills/prowler-provider/SKILL.md) |\n| `prowler-changelog` | Changelog entries (keepachangelog.com) | [SKILL.md](skills/prowler-changelog/SKILL.md) |\n| `prowler-ci` | CI checks and PR gates (GitHub Actions) | [SKILL.md](skills/prowler-ci/SKILL.md) |\n| `prowler-commit` | Professional commits (conventional-commits) | [SKILL.md](skills/prowler-commit/SKILL.md) |\n| `prowler-pr` | Pull request conventions | [SKILL.md](skills/prowler-pr/SKILL.md) |\n| `prowler-docs` | Documentation style guide | [SKILL.md](skills/prowler-docs/SKILL.md) |\n| `django-migration-psql` | Django migration best practices for PostgreSQL | [SKILL.md](skills/django-migration-psql/SKILL.md) |\n| `postgresql-indexing` | PostgreSQL indexing, EXPLAIN, monitoring, maintenance | [SKILL.md](skills/postgresql-indexing/SKILL.md) |\n| `prowler-attack-paths-query` | Create Attack Paths openCypher queries | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |\n| `prowler-tour` | Keep product-tour definitions aligned with the UI | [SKILL.md](skills/prowler-tour/SKILL.md) |\n| `gh-aw` | GitHub Agentic Workflows (gh-aw) | [SKILL.md](skills/gh-aw/SKILL.md) |\n| `skill-creator` | Create new AI agent skills | [SKILL.md](skills/skill-creator/SKILL.md) |\n\n### Auto-invoke Skills\n\nWhen performing these actions, ALWAYS invoke the corresponding skill FIRST:\n\n| Action | Skill |\n|--------|-------|\n| Add changelog entry for a PR or feature | `prowler-changelog` |\n| Adding ConfigRequirements guardrails to compliance requirements | `prowler-compliance` |\n| Adding DRF pagination or permissions | `django-drf` |\n| Adding a compliance output formatter (per-provider class + table dispatcher) | `prowler-compliance` |\n| Adding indexes or constraints to database tables | `django-migration-psql` |\n| Adding new providers | `prowler-provider` |\n| Adding privilege escalation detection queries | `prowler-attack-paths-query` |\n| Adding services to existing providers | `prowler-provider` |\n| Adding, updating, or removing a tour definition (*.tour.ts) | `prowler-tour` |\n| After creating/modifying a skill | `skill-sync` |\n| App Router / Server Actions | `nextjs-16` |\n| Auditing check-to-requirement mappings as a cloud auditor | `prowler-compliance` |\n| Building AI chat features | `ai-sdk-5` |\n| Changing button labels or section headings on a tour-covered page | `prowler-tour` |\n| Committing changes | `prowler-commit` |\n| Configuring MCP servers in agentic workflows | `gh-aw` |\n| Create PR that requires changelog entry | `prowler-changelog` |\n| Create a PR with gh pr create | `prowler-pr` |\n| Creating API endpoints | `jsonapi` |\n| Creating Attack Paths queries | `prowler-attack-paths-query` |\n| Creating GitHub Agentic Workflows | `gh-aw` |\n| Creating ViewSets, serializers, or filters in api/ | `django-drf` |\n| Creating Zod schemas | `zod-4` |\n| Creating a git commit | `prowler-commit` |\n| Creating a universal (multi-provider) compliance framework | `prowler-compliance` |\n| Creating new checks | `prowler-sdk-check` |\n| Creating new skills | `skill-creator` |\n| Creating or reviewing Django migrations | `django-migration-psql` |\n| Creating/modifying Prowler UI components | `prowler-ui` |\n| Creating/modifying models, views, serializers | `prowler-api` |\n| Creating/updating compliance frameworks | `prowler-compliance` |\n| Debug why a GitHub Actions job is failing | `prowler-ci` |\n| Debugging gh-aw compilation errors | `gh-aw` |\n| Editing a UI file containing data-tour-id attributes | `prowler-tour` |\n| Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist) | `prowler-pr` |\n| Fixing bug | `tdd` |\n| Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs) | `prowler-compliance` |\n| General Prowler development questions | `prowler` |\n| Implementing JSON:API endpoints | `django-drf` |\n| Implementing feature | `tdd` |\n| Importing Copilot Custom Agents into workflows | `gh-aw` |\n| Inspect PR CI checks and gates (.github/workflows/*) | `prowler-ci` |\n| Inspect PR CI workflows (.github/workflows/*): conventional-commit, pr-check-changelog, pr-conflict-checker, labeler | `prowler-pr` |\n| Mapping checks to compliance controls | `prowler-compliance` |\n| Mocking AWS with moto in tests | `prowler-test-sdk` |\n| Modifying API responses | `jsonapi` |\n| Modifying component | `tdd` |\n| Modifying gh-aw workflow frontmatter or safe-outputs | `gh-aw` |\n| Refactoring code | `tdd` |\n| Regenerate AGENTS.md Auto-invoke tables (sync.sh) | `skill-sync` |\n| Renaming or removing a data-tour-id attribute value | `prowler-tour` |\n| Restructuring routes or layouts covered by a tour | `prowler-tour` |\n| Review PR requirements: template, title conventions, changelog gate | `prowler-pr` |\n| Review changelog format and conventions | `prowler-changelog` |\n| Reviewing JSON:API compliance | `jsonapi` |\n| Reviewing Prowler UI components | `prowler-ui` |\n| Reviewing compliance framework PRs | `prowler-compliance-review` |\n| Running makemigrations or pgmakemigrations | `django-migration-psql` |\n| Syncing compliance framework with upstream catalog | `prowler-compliance` |\n| Testing RLS tenant isolation | `prowler-test-api` |\n| Testing hooks or utilities | `vitest` |\n| Troubleshoot why a skill is missing from AGENTS.md auto-invoke | `skill-sync` |\n| Understand CODEOWNERS/labeler-based automation | `prowler-ci` |\n| Understand PR title conventional-commit validation | `prowler-ci` |\n| Understand changelog gate and no-changelog label behavior | `prowler-ci` |\n| Understand review ownership with CODEOWNERS | `prowler-pr` |\n| Update CHANGELOG.md in any component | `prowler-changelog` |\n| Updating README.md provider statistics table | `prowler-readme-table` |\n| Updating checks, services, compliance, or categories count in README.md | `prowler-readme-table` |\n| Updating existing Attack Paths queries | `prowler-attack-paths-query` |\n| Updating existing checks and metadata | `prowler-sdk-check` |\n| Using Zustand stores | `zustand-5` |\n| Working on MCP server tools | `prowler-mcp` |\n| Working on Prowler UI structure (actions/adapters/types/hooks) | `prowler-ui` |\n| Working on task | `tdd` |\n| Working with Prowler UI test helpers/pages | `prowler-test-ui` |\n| Working with Tailwind classes | `tailwind-4` |\n| Writing Playwright E2E tests | `playwright` |\n| Writing Prowler API tests | `prowler-test-api` |\n| Writing Prowler SDK tests | `prowler-test-sdk` |\n| Writing Prowler UI E2E tests | `prowler-test-ui` |\n| Writing Python tests with pytest | `pytest` |\n| Writing React component tests | `vitest` |\n| Writing React components | `react-19` |\n| Writing TypeScript types/interfaces | `typescript` |\n| Writing Vitest tests | `vitest` |\n| Writing data backfill or data migration | `django-migration-psql` |\n| Writing documentation | `prowler-docs` |\n| Writing unit tests for UI | `vitest` |\n\n---\n\n## Project Overview\n\nProwler is an open-source cloud security assessment tool supporting AWS, Azure, GCP, Kubernetes, GitHub, M365, and more.\n\n| Component | Location | Tech Stack |\n|-----------|----------|------------|\n| SDK | `prowler/` | Python 3.10+, uv |\n| API | `api/` | Django 5.1, DRF, Celery |\n| UI | `ui/` | Next.js 16, React 19, Tailwind 4 |\n| MCP Server | `mcp_server/` | FastMCP, Python 3.12+ |\n| Dashboard | `dashboard/` | Dash, Plotly |\n\n---\n\n## Python Development\n\n```bash\n# Setup\nuv sync\nuv run prek install\n\n# Code quality\nuv run make lint\nuv run make format\nuv run prek run --all-files\n```\n\n---\n\n## Commit & Pull Request Guidelines\n\nFollow conventional-commit style: `<type>[scope]: <description>`\n\n**Types:** `feat`, `fix`, `docs`, `chore`, `perf`, `refactor`, `style`, `test`\n\nBefore creating a PR:\n1. Complete checklist in `.github/pull_request_template.md`\n2. Run all relevant tests and linters\n3. Link screenshots for UI changes\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","title":"AGENTS.md","content":"# Repository Guidelines\n\n## How to Use This Guide\n\n- Start here for cross-project norms. Prowler is a monorepo with several components.\n- Each component has an `AGENTS.md` file with specific guidelines (e.g., `api/AGENTS.md`, `ui/AGENTS.md`).\n- Component docs override this file when guidance conflicts.\n\n## Available Skills\n\nUse these skills for detailed patterns on-demand:\n\n### Generic Skills (Any Project)\n\n| Skill | Description | URL |\n|-------|-------------|-----|\n| `typescript` | Const types, flat interfaces, utility types | [SKILL.md](skills/typescript/SKILL.md) |\n| `react-19` | No useMemo/useCallback, React Compiler | [SKILL.md](skills/react-19/SKILL.md) |\n| `nextjs-16` | App Router, Server Actions, proxy.ts, streaming | [SKILL.md](skills/nextjs-16/SKILL.md) |\n| `tailwind-4` | cn() utility, no var() in className | [SKILL.md](skills/tailwind-4/SKILL.md) |\n| `playwright` | Page Object Model, MCP workflow, selectors | [SKILL.md](skills/playwright/SKILL.md) |\n| `pytest` | Fixtures, mocking, markers, parametrize | [SKILL.md](skills/pytest/SKILL.md) |\n| `django-drf` | ViewSets, Serializers, Filters | [SKILL.md](skills/django-drf/SKILL.md) |\n| `jsonapi` | Strict JSON:API v1.1 spec compliance | [SKILL.md](skills/jsonapi/SKILL.md) |\n| `zod-4` | New API (z.email(), z.uuid()) | [SKILL.md](skills/zod-4/SKILL.md) |\n| `zustand-5` | Persist, selectors, slices | [SKILL.md](skills/zustand-5/SKILL.md) |\n| `ai-sdk-5` | UIMessage, streaming, LangChain | [SKILL.md](skills/ai-sdk-5/SKILL.md) |\n| `vitest` | Unit testing, React Testing Library | [SKILL.md](skills/vitest/SKILL.md) |\n| `tdd` | Test-Driven Development workflow | [SKILL.md](skills/tdd/SKILL.md) |\n\n### Prowler-Specific Skills\n\n| Skill | Description | URL |\n|-------|-------------|-----|\n| `prowler` | Project overview, component navigation | [SKILL.md](skills/prowler/SKILL.md) |\n| `prowler-api` | Django + RLS + JSON:API patterns | [SKILL.md](skills/prowler-api/SKILL.md) |\n| `prowler-ui` | Next.js + shadcn conventions | [SKILL.md](skills/prowler-ui/SKILL.md) |\n| `prowler-sdk-check` | Create new security checks | [SKILL.md](skills/prowler-sdk-check/SKILL.md) |\n| `prowler-mcp` | MCP server tools and models | [SKILL.md](skills/prowler-mcp/SKILL.md) |\n| `prowler-test-sdk` | SDK testing (pytest + moto) | [SKILL.md](skills/prowler-test-sdk/SKILL.md) |\n| `prowler-test-api` | API testing (pytest-django + RLS) | [SKILL.md](skills/prowler-test-api/SKILL.md) |\n| `prowler-test-ui` | E2E testing (Playwright) | [SKILL.md](skills/prowler-test-ui/SKILL.md) |\n| `prowler-compliance` | Compliance framework structure | [SKILL.md](skills/prowler-compliance/SKILL.md) |\n| `prowler-compliance-review` | Review compliance framework PRs | [SKILL.md](skills/prowler-compliance-review/SKILL.md) |\n| `prowler-provider` | Add new cloud providers | [SKILL.md](skills/prowler-provider/SKILL.md) |\n| `prowler-changelog` | Changelog entries (keepachangelog.com) | [SKILL.md](skills/prowler-changelog/SKILL.md) |\n| `prowler-ci` | CI checks and PR gates (GitHub Actions) | [SKILL.md](skills/prowler-ci/SKILL.md) |\n| `prowler-commit` | Professional commits (conventional-commits) | [SKILL.md](skills/prowler-commit/SKILL.md) |\n| `prowler-pr` | Pull request conventions | [SKILL.md](skills/prowler-pr/SKILL.md) |\n| `prowler-docs` | Documentation style guide | [SKILL.md](skills/prowler-docs/SKILL.md) |\n| `django-migration-psql` | Django migration best practices for PostgreSQL | [SKILL.md](skills/django-migration-psql/SKILL.md) |\n| `postgresql-indexing` | PostgreSQL indexing, EXPLAIN, monitoring, maintenance | [SKILL.md](skills/postgresql-indexing/SKILL.md) |\n| `prowler-attack-paths-query` | Create Attack Paths openCypher queries | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |\n| `prowler-tour` | Keep product-tour definitions aligned with the UI | [SKILL.md](skills/prowler-tour/SKILL.md) |\n| `gh-aw` | GitHub Agentic Workflows (gh-aw) | [SKILL.md](skills/gh-aw/SKILL.md) |\n| `skill-creator` | Create new AI agent skills | [SKILL.md](skills/skill-creator/SKILL.md) |\n\n### Auto-invoke Skills\n\nWhen performing these actions, ALWAYS invoke the corresponding skill FIRST:\n\n| Action | Skill |\n|--------|-------|\n| Add changelog entry for a PR or feature | `prowler-changelog` |\n| Adding ConfigRequirements guardrails to compliance requirements | `prowler-compliance` |\n| Adding DRF pagination or permissions | `django-drf` |\n| Adding a compliance output formatter (per-provider class + table dispatcher) | `prowler-compliance` |\n| Adding indexes or constraints to database tables | `django-migration-psql` |\n| Adding new providers | `prowler-provider` |\n| Adding privilege escalation detection queries | `prowler-attack-paths-query` |\n| Adding services to existing providers | `prowler-provider` |\n| Adding, updating, or removing a tour definition (*.tour.ts) | `prowler-tour` |\n| After creating/modifying a skill | `skill-sync` |\n| App Router / Server Actions | `nextjs-16` |\n| Auditing check-to-requirement mappings as a cloud auditor | `prowler-compliance` |\n| Building AI chat features | `ai-sdk-5` |\n| Changing button labels or section headings on a tour-covered page | `prowler-tour` |\n| Committing changes | `prowler-commit` |\n| Configuring MCP servers in agentic workflows | `gh-aw` |\n| Create PR that requires changelog entry | `prowler-changelog` |\n| Create a PR with gh pr create | `prowler-pr` |\n| Creating API endpoints | `jsonapi` |\n| Creating Attack Paths queries | `prowler-attack-paths-query` |\n| Creating GitHub Agentic Workflows | `gh-aw` |\n| Creating ViewSets, serializers, or filters in api/ | `django-drf` |\n| Creating Zod schemas | `zod-4` |\n| Creating a git commit | `prowler-commit` |\n| Creating a universal (multi-provider) compliance framework | `prowler-compliance` |\n| Creating new checks | `prowler-sdk-check` |\n| Creating new skills | `skill-creator` |\n| Creating or reviewing Django migrations | `django-migration-psql` |\n| Creating/modifying Prowler UI components | `prowler-ui` |\n| Creating/modifying models, views, serializers | `prowler-api` |\n| Creating/updating compliance frameworks | `prowler-compliance` |\n| Debug why a GitHub Actions job is failing | `prowler-ci` |\n| Debugging gh-aw compilation errors | `gh-aw` |\n| Editing a UI file containing data-tour-id attributes | `prowler-tour` |\n| Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist) | `prowler-pr` |\n| Fixing bug | `tdd` |\n| Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs) | `prowler-compliance` |\n| General Prowler development questions | `prowler` |\n| Implementing JSON:API endpoints | `django-drf` |\n| Implementing feature | `tdd` |\n| Importing Copilot Custom Agents into workflows | `gh-aw` |\n| Inspect PR CI checks and gates (.github/workflows/*) | `prowler-ci` |\n| Inspect PR CI workflows (.github/workflows/*): conventional-commit, pr-check-changelog, pr-conflict-checker, labeler | `prowler-pr` |\n| Mapping checks to compliance controls | `prowler-compliance` |\n| Mocking AWS with moto in tests | `prowler-test-sdk` |\n| Modifying API responses | `jsonapi` |\n| Modifying component | `tdd` |\n| Modifying gh-aw workflow frontmatter or safe-outputs | `gh-aw` |\n| Refactoring code | `tdd` |\n| Regenerate AGENTS.md Auto-invoke tables (sync.sh) | `skill-sync` |\n| Renaming or removing a data-tour-id attribute value | `prowler-tour` |\n| Restructuring routes or layouts covered by a tour | `prowler-tour` |\n| Review PR requirements: template, title conventions, changelog gate | `prowler-pr` |\n| Review changelog format and conventions | `prowler-changelog` |\n| Reviewing JSON:API compliance | `jsonapi` |\n| Reviewing Prowler UI components | `prowler-ui` |\n| Reviewing compliance framework PRs | `prowler-compliance-review` |\n| Running makemigrations or pgmakemigrations | `django-migration-psql` |\n| Syncing compliance framework with upstream catalog | `prowler-compliance` |\n| Testing RLS tenant isolation | `prowler-test-api` |\n| Testing hooks or utilities | `vitest` |\n| Troubleshoot why a skill is missing from AGENTS.md auto-invoke | `skill-sync` |\n| Understand CODEOWNERS/labeler-based automation | `prowler-ci` |\n| Understand PR title conventional-commit validation | `prowler-ci` |\n| Understand changelog gate and no-changelog label behavior | `prowler-ci` |\n| Understand review ownership with CODEOWNERS | `prowler-pr` |\n| Update CHANGELOG.md in any component | `prowler-changelog` |\n| Updating README.md provider statistics table | `prowler-readme-table` |\n| Updating checks, services, compliance, or categories count in README.md | `prowler-readme-table` |\n| Updating existing Attack Paths queries | `prowler-attack-paths-query` |\n| Updating existing checks and metadata | `prowler-sdk-check` |\n| Using Zustand stores | `zustand-5` |\n| Working on MCP server tools | `prowler-mcp` |\n| Working on Prowler UI structure (actions/adapters/types/hooks) | `prowler-ui` |\n| Working on task | `tdd` |\n| Working with Prowler UI test helpers/pages | `prowler-test-ui` |\n| Working with Tailwind classes | `tailwind-4` |\n| Writing Playwright E2E tests | `playwright` |\n| Writing Prowler API tests | `prowler-test-api` |\n| Writing Prowler SDK tests | `prowler-test-sdk` |\n| Writing Prowler UI E2E tests | `prowler-test-ui` |\n| Writing Python tests with pytest | `pytest` |\n| Writing React component tests | `vitest` |\n| Writing React components | `react-19` |\n| Writing TypeScript types/interfaces | `typescript` |\n| Writing Vitest tests | `vitest` |\n| Writing data backfill or data migration | `django-migration-psql` |\n| Writing documentation | `prowler-docs` |\n| Writing unit tests for UI | `vitest` |\n\n---\n\n## Project Overview\n\nProwler is an open-source cloud security assessment tool supporting AWS, Azure, GCP, Kubernetes, GitHub, M365, and more.\n\n| Component | Location | Tech Stack |\n|-----------|----------|------------|\n| SDK | `prowler/` | Python 3.10+, uv |\n| API | `api/` | Django 5.1, DRF, Celery |\n| UI | `ui/` | Next.js 16, React 19, Tailwind 4 |\n| MCP Server | `mcp_server/` | FastMCP, Python 3.12+ |\n| Dashboard | `dashboard/` | Dash, Plotly |\n\n---\n\n## Python Development\n\n```bash\n# Setup\nuv sync\nuv run prek install\n\n# Code quality\nuv run make lint\nuv run make format\nuv run prek run --all-files\n```\n\n---\n\n## Commit & Pull Request Guidelines\n\nFollow conventional-commit style: `<type>[scope]: <description>`\n\n**Types:** `feat`, `fix`, `docs`, `chore`, `perf`, `refactor`, `style`, `test`\n\nBefore creating a PR:\n1. Complete checklist in `.github/pull_request_template.md`\n2. Run all relevant tests and linters\n3. Link screenshots for UI changes\n","category":"root","tokens":2646}]}