EthicApp-Development/ethicapp-agent-skills

Procedural skills for coding agents (Claude Code) working on the EthicApp
repositories: ethicapp-main, ethicapp-ai-additions and
ethicapp-deployment. The repository is a Claude Code plugin marketplace;
each plugin groups the skills of one concern.
| Plugin | Skill | Invoke as | Purpose |
| ethicapp-security | dependency-vulnerabilities | /ethicapp-security:dependency-vulnerabilities | Audit and remediate known dependency vulnerabilities, verified in the built images, ending in an issue and a pull request. |
| ethicapp-release | cut-release | /ethicapp-release:cut-release | Choose the tag, write the CHANGELOG.md entry in a release pull request, then create the annotated tag and the GitHub Release. |
| ethicapp-release | publish-images | /ethicapp-release:publish-images | Build and push the release's images from a clean worktree of the tag, and verify their digests and labels. |
| ethicapp-release | pin-deployment | /ethicapp-release:pin-deployment | Pin the release on an ethicapp-deployment target, with contract sync, validation, a session record and a pull request. |
## Using the skills in a repository
Each EthicApp repository commits a .claude/settings.json that registers
this marketplace and enables the plugins, so anyone who clones it and trusts
the folder gets the skills:
json
"extraKnownMarketplaces": {
"ethicapp-agent-skills": {
"source": { "source": "github", "repo": "EthicApp-Development/ethicapp-agent-skills" }
},
"enabledPlugins": {
"ethicapp-security@ethicapp-agent-skills": true,
"ethicapp-release@ethicapp-agent-skills": true
Interactive equivalent, for a personal setup or another repository:
text
/plugin marketplace add EthicApp-Development/ethicapp-agent-skills
/plugin install ethicapp-security@ethicapp-agent-skills
/plugin install ethicapp-release@ethicapp-agent-skills
The repository is public, so cloning needs no credentials. Claude Code uses
the machine's git configuration (SSH if ssh -T git@github.com works,
otherwise HTTPS).
## How the skills relate to each repository
A skill holds a procedure, its checklists and its scripts. Facts about a
particular repository (which images exist, how tests run, pinning rules,
branch conventions) stay in that repository's AGENTS.md, and every skill
starts by reading it. If a skill starts accumulating service names or paths,
that content belongs to the repository, not here.
Skills end in artifacts for human review (issues, pull requests, reports).
They do not merge or deploy. The release skills push a release tag, its
GitHub Release and its images, each only after the maintainer confirms that
step.
## Layout
text
.claude-plugin/marketplace.json marketplace manifest (name: ethicapp-agent-skills)