Enterprise

Navigate enterprise software development with legacy integration, compliance requirements, stakeholder management, and architectural decisions at scale.

Security Scan

This is a high-level, instruction-only enterprise guidance skill that asks for no credentials, does not install software, and its requirements match its stated purpose.

Purpose & Capability

The name/description (enterprise guidance on legacy, compliance, architecture) aligns with the provided files (SKILL.md, architecture.md, compliance.md, legacy.md). There are no unrelated env vars, binaries, or install steps required.

Instruction Scope

Runtime instructions are high-level design and process guidance (ADR templates, trade-offs, compliance checklists, integration patterns). They do not instruct the agent to read system files, exfiltrate data, call external endpoints, or access credentials. The guidance is advisory and could influence agent decisions, but it stays within the stated domain.

Install Mechanism

No install spec and no code files — instruction-only. Nothing will be written to disk or downloaded by the skill itself.

Credentials

The skill requests no environment variables, credentials, or config paths. The absence of required secrets is proportional to a documentation/decision-support skill.

Persistence & Privilege

always is false and the skill does not request elevated or persistent system privileges. It will not modify other skills or system configuration based on the provided materials.

Assessment

This skill is instruction-only and appears coherent with its stated purpose, but consider these practical checks before installing: 1) Provenance: the owner and homepage are unknown — prefer skills from known sources or review the files yourself. 2) Test in a sandbox: let the agent use the skill in a controlled environment first to observe how its heuristics affect decisions. 3) Monitor actions: because the guidance can influence agent behavior, watch for any agent actions that attempt to access systems or secrets (the skill itself doesn't request them). 4) Align with policy: verify the compliance guidance matches your organization’s legal/regulatory requirements before relying on it. 5) Update process: decide how you will track updates to this skill since there is no homepage or established update channel.

When to Use

Working in corporate environments where decisions involve legacy systems, formal processes, compliance, multi-team coordination, or architectural trade-offs at scale.

Quick Reference

Topic	File
Legacy patterns	legacy.md
Compliance rules	compliance.md
Architecture decisions	architecture.md

Core Rules

1. Legacy First Mindset

• Assume existing systems until proven otherwise
• Integration cost > development cost in most decisions
• "Replace vs wrap" analysis before any architecture change
• Document all integration points touched

2. Stakeholder Mapping

Role	Cares About	Language
Engineering	Technical debt, velocity	Patterns, trade-offs
Product	Features, timeline	User impact, scope
Security	Risk, compliance	Threat models, controls
Finance	Cost, ROI	TCO, licensing
Legal	Liability, data	Contracts, GDPR

Translate technical decisions into each stakeholder's language.

3. Change Management

• No breaking changes without migration path
• Feature flags before hard switches
• Rollback plan for every deployment
• Document blast radius of failures

4. Compliance Awareness

• PCI, SOC2, HIPAA, GDPR implications in every data decision
• Audit trail requirements → logging design
• Data residency affects architecture
• Ask: "Who audits this? What do they need?"

5. Documentation as Deliverable

Enterprise code without docs = technical debt.

• ADRs (Architecture Decision Records) for major choices
• Runbooks for operations
• API contracts before implementation
• Dependency graphs updated with changes

6. Security by Default

• Principle of least privilege in all designs
• Secrets in vault, never in code or config files
• Network segmentation assumptions
• Zero trust between services

7. Observability Investment

• Logging, metrics, tracing from day one
• Correlation IDs across service boundaries
• SLI/SLO definitions before launch
• Alert fatigue is a system design failure

Enterprise Traps

• Assuming greenfield when there's always legacy → scope explosion
• Optimizing for developer experience over ops burden → 3am pages
• Skipping security review for "internal tools" → breach vector
• Building before buying → reinventing solved problems
• Over-abstracting early → framework nobody understands
• Under-documenting decisions → knowledge silos