misuse
Retrospective protocol contract violation detector. Scan past sessions for /ground (Sₐ confabulation) and /induce (stereotype misconflation) contract violations and surface structured violation records for user-constituted review. Use this skill whenever the user asks to 'audit my misuse', 'check protocol misuse', 'scan past invocations', 'misuse history', wants retrospective audit of past /ground or /induce calls, or suspects silent contract violations in prior sessions.
What this skill does
# Misuse Skill
Retrospective Contract Violation Detector — when the user wants to audit past `/ground` and `/induce` invocations for silent contract violations, scan session history against contract integrity criteria and surface candidate violations for user-constituted review. Type: `(ContractIntegrityOpaque, AI, AUDIT, SessionHistory) → ViolationReview`.
Invoke directly with `/misuse` when the user wants a retrospective audit of past protocol invocations against their declared Phase 0 contracts.
## Definition
**Misuse** (ἔλεγχος, *élenchos*: examination by drawing out, Socratic refutation): A dialogical act of resolving the opacity of past protocol contract integrity into a recognized violation history, where AI scans session JSONL for `/ground` and `/induce` invocations, classifies each against the contract criteria in `references/violation-taxonomy.md` (LEGITIMATE / VIOLATION / AMBIGUOUS), and the user constitutes the verdict via per-invocation recognition — never AI-resolved verdict assertion.
This skill stands in time-axis dual relationship to `/probe`. Probe is prospective: when a deficit is unrecognized at the present moment, surface candidate hypotheses with reverse-evidence so the user routes forward. Misuse is retrospective: when contract integrity in past invocations is opaque, surface candidate violations with operational evidence so the user audits backward. Both refuse AI-side resolution; both treat user recognition as the constitutive act.
Phase 4 recognition is structurally homologous to Anamnesis Phase 2 — past-identity synthesis (verifying whether a past act conformed to its contract), not future-trajectory selection. The Differential Future Requirement does not apply: a 1-correct option structure (was-violation / was-legitimate) is legitimate by purpose, not a degradation.
## When to Use
Invoke this skill when:
- The user suspects past `/ground` or `/induce` invocations may have violated contract integrity
- The user wants to audit a recent session or set of sessions for silent Sₐ confabulation or stereotype misconflation
- The user wants empirical evidence about misuse patterns to inform calibration of future live nudges or contract refinement
Skip when:
- The deficit is forward-looking (use `/probe` for prospective deficit recognition)
- The user wants accumulated session analytics without contract-violation focus (use `/report` or `/dashboard`)
- The user wants strength-shadow analysis of behavioral patterns (use `/curses`)
- The user is asking about a present-moment invocation, not past invocations
## Distinction from Adjacent Skills
| Skill | Time axis | Subject | Output |
|-------|-----------|---------|--------|
| `/probe` | Prospective (present situation) | Deficit recognition fit review | ProtocolRoute or FitReviewNote |
| `/misuse` | Retrospective (past invocations) | Contract integrity audit | ViolationReview (per-invocation verdict) |
| `/sophia` | Retrospective (behavioral patterns) | Philosophical tradition match | Philosopher profile |
| `/curses` | Retrospective (strengths) | Strength-shadow extraction | Shadow-cost analysis |
| `/report` | Retrospective (usage) | Growth Map | Aggregated insight integration |
| `/dashboard` | Retrospective (coverage) | Protocol coverage analytics | Coverage statistics |
The skill family coexists by phenomenology — none replaces the others. Misuse is for contract integrity; the other retrospective skills serve user-pattern questions.
## Protocol
### Phase 0: Scope Determination
Determine the audit scope before scanning. Decisions:
- **Target protocols** — fixed at `/ground` and `/induce` for v1.0. Other protocols deferred pending accumulated use evidence.
- **Session window** — default is the current session only. Cross-session scanning requires explicit user confirmation per Rule 4.
- **Cross-project scope** — default off. Scanning across `~/.claude/projects/` requires explicit user confirmation.
If the user's `/misuse` invocation does not specify scope, present a Constitution interaction soliciting scope before proceeding to Phase 1. If the user has already specified scope in the invocation, accept it and proceed.
Phase 0 is otherwise silent — no surfacing of detection heuristics. If the user has no past `/ground` or `/induce` invocations in the chosen scope, deactivate with a brief no-op note (Phase 1 will be empty).
### Phase 1: Invocation Extraction
Delegate to the `epistemic-cooperative:session-analyzer` subagent in friction-pointers mode to extract `/ground` and `/induce` slash command invocations from session JSONL files within the chosen scope. For each invocation, retrieve:
- The invocation turn (slash command line)
- 10–20 turns of preceding user messages (pre-invocation context window)
- The assistant turn(s) immediately following the invocation (Phase 0 output of the invoked protocol)
Optional auxiliary read: the `~/.claude/projects/{slug}/hypomnesis/{session-id}/misfit.md` file if present and the user has consented to cross-session scope. This is opt-in evidence enrichment, not a primary data source.
Construct the candidate set `I[]` of `{invocation, pre_context, post_output}` triples.
If `|I[]| = 0`, deactivate with no-op note.
### Phase 2: Per-Invocation Classification
Read `references/violation-taxonomy.md` to load the contract integrity criteria. For each invocation in `I[]`:
1. **Surface shape match** — does the invocation pattern superficially resemble a violation type (e.g., `/ground` with multiple instances and no apparent abstract structure)?
2. **Operation-kind verification** — examine the cognitive operation actually performed against the protocol's declared operation. Surface match alone is insufficient (Rule 1).
3. **Classification** — assign one of:
- `LEGITIMATE` — contract integrity verified by evidence
- `VIOLATION` — contract violated; specify violation type (Sₐ confabulation, stereotype misconflation) and cite textual evidence
- `AMBIGUOUS` — surface match but operation-kind verification produces uncertain result; defaults toward AMBIGUOUS, not VIOLATION (Rule 2)
Each classification must cite specific turn evidence — the user message demonstrating absent framework prior to /ground, or the AI binding of Sₐ without prior user framework, or the named-candidate comparison pattern preceding /induce.
### Phase 3: Pattern Aggregation
Cluster classifications across `I[]`:
- Group by violation type (Sₐ confabulation cluster, stereotype misconflation cluster)
- Identify recurring contexts (project, time period, situation shape)
- Rank candidates by evidential strength (clearest evidence first)
- Suppress AMBIGUOUS classifications from primary presentation; surface them only on user request after VIOLATION review completes
Construct presentation order: highest-evidence VIOLATION candidate first, then descending evidential strength.
Phase 3 produces no cumulative score or rate. No "user reliability index", no "violation percentage", no "trustworthiness metric" (Rule 6).
### Phase 4: Per-Invocation Recognition
Present the highest-priority VIOLATION candidate for user-constituted recognition. Format per candidate:
```
Candidate N — [VIOLATION_TYPE]
Session: <session_id>, turn <turn_index>
Invocation: /ground or /induce, with original argument
Pre-context (10-20 turns): <quoted excerpt or paraphrase showing absence of required framework / presence of named-candidate comparison>
Phase 0 output: <quoted AI response showing Sₐ binding or stereotype acceptance>
Violation criterion: <specific clause from violation-taxonomy.md that this invocation contradicts>
```
Then present the recognition Constitution interaction:
```
Did this past invocation violate its contract?
Options:
1. Recognize — violation confirmed (the cited evidence is correctly read)
2. Dismiss — legitimate invocation (the framework was implicit, the context was elsewhere, the cited evidence is misread)
3. Reorient — different violation kind thaRelated in Security
mac-ops
IncludedComprehensive macOS workstation operations — diagnose kernel panics, identify failing drives, audit launchd startup items, decode wake reasons, triage TCC permission denials, manage APFS snapshots, recover from no-boot. Use for: Mac is slow, slow bootup, won't boot, kernel panic, kernel_task hot, mds_stores CPU, photoanalysisd, cloudd, login loop, gray screen, sleep wake failure, drive failing, IO errors, APFS snapshots eating space, Time Machine local snapshots, Spotlight indexing, launchd, LaunchAgent, LaunchDaemon, login items, TCC permissions, Full Disk Access, Screen Recording denied, Gatekeeper, quarantine, com.apple.quarantine, app is damaged, helper tool, /Library/PrivilegedHelperTools, pmset, wake reasons, dark wake, sysdiagnose, panic.ips, DiagnosticReports, configuration profile, MDM profile, remote diagnostics over SSH.
a11y-audit
IncludedRun accessibility audits on web projects combining automated scanning (axe-core, Lighthouse) with WCAG 2.1 AA compliance mapping, manual check guidance, and structured reporting. Output is configurable: markdown report only, markdown plus machine-readable JSON, or markdown plus issue tracker integration. Use this skill whenever the user mentions "accessibility audit", "a11y audit", "WCAG audit", "accessibility check", "compliance scan", or asks to check a web project for accessibility issues. Also trigger when the user wants to verify WCAG conformance or map findings to a specific standard (CAN-ASC-6.2, EN 301 549, ADA/AODA).
erpclaw
IncludedAI-native ERP system with self-extending OS. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial reporting. 413 actions across 14 domains, 43 expansion modules. Constitutional guardrails, adversarial audit, schema migration. Double-entry GL, immutable audit trail, US GAAP.
assess
IncludedAssesses and rates quality 0-10 across multiple dimensions (correctness, maintainability, security, performance, testability, simplicity) with pros/cons analysis. Compares against project conventions and prior decisions from memory. Produces structured evaluation reports with actionable improvement suggestions. Use when evaluating code, designs, architectures, or comparing alternative approaches.
spring-boot-security-jwt
IncludedProvides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.
code-hardcode-audit
IncludedDetect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.