feat: install full skill pack

README.md

@@ -1,13 +1,23 @@
-# Security Audit Skill
+# Security Audit Skill Pack
 
-This installs the `securityaudit` audit/fix workflow for Codex or Claude Code.
+This repository contains four practical Codex/Claude Code skills:
+
+| Skill | Use it when you need to... |
+| --- | --- |
+| `securityaudit` | run an evidence-based application security audit, write audit reports, or apply confirmed fixes with `--fix`. |
+| `aitm` | create or update an `AITM.md` architecture input for automated threat modelling. |
+| `debullshit` | turn confusing corporate email into clear, British-English, ADHD-friendly plain English. |
+| `summarise` | create or update a repository `SUMMARY.md` based on code and Git history. |
 
 ## Codex install
 
-Paste this into Codex:
+Paste these into Codex if you prefer installing through `$skill-installer`:
 
 ```text
 Use $skill-installer to install https://github.com/andydixon/securityaudit-skill/tree/main/securityaudit
+Use $skill-installer to install https://github.com/andydixon/securityaudit-skill/tree/main/aitm
+Use $skill-installer to install https://github.com/andydixon/securityaudit-skill/tree/main/debullshit
+Use $skill-installer to install https://github.com/andydixon/securityaudit-skill/tree/main/summarise
 ```
 
 Restart Codex after it installs.
@@ -18,6 +28,8 @@ Or paste this into Terminal on macOS/Linux:
 curl -fsSL https://raw.githubusercontent.com/andydixon/securityaudit-skill/main/install.sh | bash
 ```
 
+That script installs all four skills into `~/.codex/skills`.
+
 Or paste this into PowerShell on Windows:
 
 ```powershell
@@ -26,6 +38,8 @@ powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager
 
 Restart Codex after it installs.
 
+To install only selected skills, set `SECURITYAUDIT_SKILLS` to a space- or comma-separated list before running the script, for example `SECURITYAUDIT_SKILLS="securityaudit aitm"`.
+
 ## Claude Code install
 
 Paste this into Terminal on macOS/Linux:
@@ -34,6 +48,8 @@ Paste this into Terminal on macOS/Linux:
 curl -fsSL https://raw.githubusercontent.com/andydixon/securityaudit-skill/main/install-claude.sh | bash
 ```
 
+That script installs all four skills into `~/.claude/skills`.
+
 Or paste this into PowerShell on Windows:
 
 ```powershell
@@ -42,7 +58,13 @@ powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager
 
 Restart Claude Code if it was already open.
 
-## Codex usage
+To install only selected Claude Code skills, set `SECURITYAUDIT_SKILLS` to a space- or comma-separated list before running the script.
+
+## Skill usage
+
+### `securityaudit`
+
+Use this for a project-wide secure code review, dependency/configuration review, DoS review, frontend robustness review, and practical remediation planning.
 
 Audit only:
 
@@ -56,22 +78,86 @@ Audit and fix:
 $securityaudit --fix
 ```
 
-## Claude Code usage
-
-Audit only:
+Claude Code:
 
 ```text
 /securityaudit
-```
-
-Audit and fix:
-
-```text
 /securityaudit --fix
 ```
 
-## What it does
+Normal mode writes reports under `audits/` and avoids changing application code, apart from safe git bootstrap/report creation when needed. Fix mode requires an explicit `--fix`, works from evidence-backed findings, runs relevant checks, and commits successful fixes.
 
-Normal mode writes a project security audit report and does not change code.
+### `aitm`
 
-Fix mode only changes files when the project is already in a git repository. It runs tests before committing successful fixes. If the project is not a git repository, it refuses to make changes.
+Use this when you need a repository architecture document suitable as input to automated threat modelling. It recursively analyses the current project and creates or updates `AITM.md`.
+
+```text
+$aitm
+/aitm
+```
+
+Good prompts:
+
+```text
+$aitm
+$aitm create a threat-modelling architecture input for this repo
+```
+
+It focuses on components, data flows, actors, trust boundaries, auth/authz, sensitive data, entry points, external integrations, deployment evidence, and uncertainty. It should not modify app code.
+
+### `debullshit`
+
+Use this for pasted emails that are too corporate, vague, passive-aggressive, over-formal, or generally allergic to plain English.
+
+```text
+$debullshit
+/debullshit
+```
+
+Example:
+
+```text
+$debullshit
+<paste the email here>
+```
+
+It returns:
+
+- the short version;
+- what they actually want;
+- what you need to do;
+- important details;
+- what is vague or missing;
+- a corporate-to-human rewrite.
+
+It preserves names, dates, figures, links, responsibilities, deadlines, nuance, and security warnings. If an email smells like phishing, payment fraud, credential harvesting, or process-bypass nonsense, it calls that out near the top.
+
+### `summarise`
+
+Use this to generate or update a project `SUMMARY.md` that explains what the software is, what it does now, and how it evolved through Git history.
+
+```text
+$summarise
+/summarise
+```
+
+Good prompts:
+
+```text
+$summarise
+$summarise write the summary to docs/project-summary.md
+```
+
+It inspects high-signal project files, uses Git status/tags/commits as evidence, highlights significant milestones, and keeps the result management-readable without inflating weak evidence into fake certainty.
+
+## Installer behaviour
+
+The install scripts are intentionally boring and defensive:
+
+- install `securityaudit`, `aitm`, `debullshit`, and `summarise` by default;
+- validate each `SKILL.md` name before installing it;
+- back up any existing installed skill directory before replacing it;
+- install from the local checkout when run inside this repository;
+- otherwise download the requested branch from GitHub;
+- accept the existing `SECURITYAUDIT_REPO` and `SECURITYAUDIT_REF` overrides;
+- accept `SECURITYAUDIT_SKILLS` for installing a subset.