agentic-bundle-aas-security-engineer

AAS Core — Agentic Awesome Skills

Local, deterministic skill-stack composition for coding agents—from an explicit project profile to a reviewable plan before any target change.

Current release: V15.0.0. This release includes AAS Core under the Agent-First Preview claim for local search, inspection, recommendation, manifest validation, planning, and diagnosis. Apply and recovery remain experimental and outside the supported preview path.

Codex or Claude inspects your project using its own capabilities; AAS does not scan it. The agent sends the local, read-only AAS MCP an explicit project profile. AAS Core evaluates that profile and your policy against a verified local catalog, returns an explainable recommendation, and lets the agent propose aas-stack.json. The aas CLI validates that desired state and creates an immutable per-target plan before any skill changes are made.

Read the AAS Core preview guide →

Project
  -> inspected by Codex or Claude (not by AAS)
  -> explicit, allowlisted project profile
  -> AAS MCP (local stdio, read-only)
  -> deterministic AAS Core + verified local catalog
  -> recommendation with evidence, exclusions, coverage, and unknowns
  -> agent proposes aas-stack.json
  -> AAS CLI validate + immutable plan preview
  -> human review (optionally in Workbench)

The 1,967+ reusable SKILL.md playbooks, specialized plugins, bundles, workflows, and direct installers remain important. They are the content, curation, distribution, and compatibility layers around AAS Core—not competing primary products.

This is an independent community project. It is not affiliated with, sponsored by, endorsed by, or authorized by Google. Google, Antigravity, Gemini, and related product names are referenced only to describe compatibility and install targets. The GitHub repository is canonical; the hosted catalog and browser-local Workbench are companion discovery and review surfaces, not a hosted control plane.

AAS Core: Agent-First Preview

The agent composes. You control. AAS keeps the stack reproducible.

AAS Core gives the repository one product model:

• Discover and recommend through the agent. The local MCP exposes search_skills, get_skill, recommend_stack, inspect_stack, and diff_stack; it does not install skills, scan source files, call a remote model, or write to the project.
• Keep approved intent in aas-stack.json. The manifest pins catalog identity, targets, goals, policy, and exact skill IDs without storing repository source or model reasoning.
• Validate and preview through the CLI. aas stack validate checks the proposal, while aas stack plan produces an immutable, per-target plan without applying it.
• Review in Workbench. The hosted Workbench imports and reviews stack/plan JSON in browser memory; it does not access your filesystem or install anything.
• Retain every useful distribution path. Direct installs, plugins, bundles, workflows, and the full catalog remain available as payload and compatibility surfaces.