docs/archive/SKILLS_INSTALLED_UPDATED.md

🚀 RagBot Skills Roadmap - UPDATED (February 18, 2026)

Status: ✅ 13 Strategic Skills Installed & Ready
Goal: Take RagBot from production-ready to enterprise-grade with comprehensive improvements across testing, security, documentation, and code quality.

---

Executive Summary

Your RagBot system is production-ready with 83+ passing tests and a working REST API for medical biomarker analysis. We've identified and installed 13 critical skills to address gaps in:

1. ✅ Code Quality & Testing (3.7K installs)
2. ✅ API Security & Hardening (144 installs)
3. ✅ Security Compliance (OWASP) (148 installs)
4. ✅ API Rate Limiting (92 installs)
5. ✅ CI/CD Automation (2.8K installs)
6. ✅ Code Review Workflows (31 installs)
7. ✅ API Documentation (44 installs)
8. ✅ Code Review Excellence
9. ✅ FastAPI Best Practices
10. ✅ Python Design Patterns
11. ✅ Error Handling & Resilience
12. ✅ Observability & Monitoring
13. ✅ RAG Implementation Best Practices

---

Critical Issues Found in Deep Review

Based on analysis of your codebase, these issues were identified:

🔴 Critical Issues (Fix Immediately)

1. State Propagation Incomplete

   • biomarker_flags and safety_alerts not propagating through workflow
   • API output missing critical medical alerts
   • Impact: Medical data loss, incomplete patient analysis

2. Schema Mismatch

   • Workflow output schema vs API formatter schema misalignment
   • ResponseSynthesizerAgent returns different fields than API expects
   • Impact: API response formatting errors

3. Forced Prediction Confidence

   • Minimum confidence forced to 0.5, default disease always Diabetes
   • Impact: False confidence in low-evidence cases (dangerous in medical domain)

🟡 High Priority Issues

4. Biomarker Naming Inconsistency

   • API vs CLI use different normalization schemes
   • LDL in API vs "LDL Cholesterol" in CLI
   • Impact: Biomarker validation failures

5. JSON Parsing Fragility

   • LLM outputs parsed with minimal guardrails
   • Invalid JSON causes API 400 errors frequently
   • Impact: Poor user experience

6. Missing Citation Enforcement

   • RAG outputs don't enforce medical literature citations
   • Claims without evidence may pass through
   • Impact: Violates evidence-based requirements

---

Installed Skills - Details & Applications

1. ✅ Python Testing Patterns (3.7K installs)

Package: wshobson/agents@python-testing-patterns
Location: .agents/skills/python-testing-patterns/

Core Capabilities:

• Test structure & organization best practices
• Fixture patterns for complex setup (LLM mocking, FAISS setup)
• Parametrized testing for multiple biomarker scenarios
• Test coverage reporting (pytest-cov)
• Integration vs unit test patterns
• Property-based testing with hypothesis

For RagBot:

• ✅ Expand test suite from 83 to 150+ tests
• ✅ Mock LLM calls for faster CI/CD (no Groq/Gemini calls)
• ✅ Add parametrized tests for each biomarker combination
• ✅ Measure coverage metrics (target 90%+)
• ✅ Integration tests for API routes

Implementation Plan:

# Generate coverage report
pytest tests/ --cov=src --cov-report=html

# Run tests faster with mocked LLMs
pytest tests/ -m "not slowtest" -v

# Parametrize biomarker tests
@pytest.mark.parametrize("glucose,hba1c,expected_disease", [
    (140, 10, "Diabetes"),
    (120, 8, "Prediabetes"),
])

---

2. ✅ API Security Hardening (144 installs)

Package: aj-geddes/useful-ai-prompts@api-security-hardening
Location: .agents/skills/api-security-hardening/

Core Capabilities:

• JWT authentication & API key validation
• CORS configuration hardening
• Input validation & sanitization
• Security headers (CSP, X-Frame-Options, HSTS)
• SQL injection prevention
• Rate limiting integration

For RagBot (CRITICAL for HIPAA/medical data):

• ✅ Add API key authentication to /api/v1/analyze/* endpoints
• ✅ Validate biomarker names against whitelist
• ✅ Sanitize natural language input (SQL injection, XSS prevention)
• ✅ Add security headers to all responses
• ✅ Implement CORS for web integration

Implementation Priority:

# Add API key authentication
from fastapi import Depends, HTTPException, Header

async def verify_api_key(x_api_key: str = Header(...)):
    if x_api_key != os.getenv("RAGBOT_API_KEY"):
        raise HTTPException(status_code=403)
    return x_api_key

# Protect sensitive endpoints
@app.post("/api/v1/analyze/natural")
async def analyze(request: NaturalAnalysisRequest, key = Depends(verify_api_key)):
    ...

---

3. ✅ OWASP Security Check (148 installs)

Package: sergiodxa/agent-skills@owasp-security-check
Location: .agents/skills/owasp-security-check/

Core Capabilities:

• OWASP Top 10 vulnerability scanning
• Dependency security checks (CVE detection)
• Code pattern analysis for common flaws
• Logging security violations
• Authentication & authorization review
• Data protection assessment

For RagBot (Medical/HIPAA Compliance):

• ✅ Scan for patient data leakage in logs
• ✅ Verify no hardcoded API keys/secrets
• ✅ Check for unencrypted data handling
• ✅ Validate input sanitization (XSS, SQL injection)
• ✅ Audit access controls on medical endpoints

Quick Start:

# Run OWASP scan on your code
# Use to validate: no secrets in code, no dangerous patterns

# Key areas to audit:
# - api/app/main.py (endpoint security)
# - src/agents/* (data handling)
# - api/app/services/extraction.py (input validation)

---

4. ✅ API Rate Limiting (92 installs)

Package: aj-geddes/useful-ai-prompts@api-rate-limiting
Location: .agents/skills/api-rate-limiting/

Core Capabilities:

• Per-user rate limiting (requests/minute)
• Per-IP rate limiting
• Token bucket algorithm
• Redis/in-memory backends
• Graceful handling of limit exceeding

For RagBot:

• ✅ Prevent API abuse on /api/v1/analyze/* (critical medical endpoint)
• ✅ Implement tiered rate limits:
  • Free tier: 10 requests/minute
  • Pro tier: 100 requests/minute
• ✅ Return 429 with retry-after headers
• ✅ Log rate limit violations

Implementation:

# Add to api/app/main.py
from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)
app.state.limiter = limiter

@app.post("/api/v1/analyze/natural")
@limiter.limit("10/minute")  # 10 requests per minute
async def analyze_natural(request: NaturalAnalysisRequest):
    ...

---

5. ✅ GitHub Actions Templates (2.8K installs)

Package: wshobson/agents@github-actions-templates
Location: .agents/skills/github-actions-templates/

Core Capabilities:

• Production-ready CI/CD workflows
• Automated testing on every commit/PR
• Security scanning (SAST, dependency checks)
• Docker image building & pushing
• Code quality checks (linting, formatting)
• Build matrix for multiple Python versions

For RagBot:

• ✅ Auto-run pytest on every PR
• ✅ Build & push Docker images to registry
• ✅ Dependency scanning (pip-audit)
• ✅ Code style checks (black, flake8)
• ✅ Coverage reporting

Create .github/workflows/ci.yml:

name: CI/CD
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Test
        run: python -m pytest tests/ -v --cov=src
      - name: Security Scan
        run: pip-audit

---

6. ✅ GitHub PR Review Workflow (31 installs)

Package: uwe-schwarz/skills@github-pr-review-workflow
Location: .agents/skills/github-pr-review-workflow/

Core Capabilities:

• PR template enforcement
• Commit message standards
• Required approval workflows
• Code ownership files (CODEOWNERS)
• Automated reviewer assignment
• Branch protection rules

For RagBot:

• ✅ Enforce PR description (what changed, why)
• ✅ Require tests for all changes
• ✅ Require approval before merge
• ✅ Define CODEOWNERS for critical files
• ✅ Automate reviewer assignment

Create .github/CODEOWNERS:

# API changes
api/ @ragbot-maintainers

# Workflow & agents (critical)
src/workflow.py @ragbot-maintainers
src/agents/ @ragbot-maintainers

# Tests
tests/ @ragbot-maintainers

---

7. ✅ API Docs Generator (44 installs)

Package: patricio0312rev/skills@api-docs-generator
Location: .agents/skills/api-docs-generator/

Core Capabilities:

• OpenAPI/Swagger spec auto-generation
• Interactive API documentation (Swagger UI, ReDoc)
• Request/response example generation
• Multi-version API support
• Client SDK generation

For RagBot:

• ✅ Auto-generate OpenAPI spec from FastAPI code
• ✅ Serve at /docs (Swagger UI) and /redoc (ReDoc)
• ✅ Generate Python client library
• ✅ Create API reference documentation
• ✅ Include auth requirements in docs

Already Enabled in FastAPI:

# Your api/app/main.py already has:
app = FastAPI(
    title="RagBot API",
    description="Medical biomarker analysis",
    version="1.0.0",
    docs_url="/docs",
    redoc_url="/redoc",
)

---

8. ✅ Code Review Excellence (New)

Package: wshobson/agents@code-review-excellence
Location: .agents/skills/code-review-excellence/

Provides:

• Review checklist for Python code
• Common code smell detection
• Security review guidelines
• Performance review patterns
• Testing adequacy assessment

For RagBot:

• ✅ Review all PRs against medical safety checklist
• ✅ Ensure biomarker validation in all paths
• ✅ Verify error handling in API routes
• ✅ Check logging doesn't expose patient data

---

9. ✅ FastAPI Templates (New)

Package: wshobson/agents@fastapi-templates
Location: .agents/skills/fastapi-templates/

Provides:

• FastAPI best practices & patterns
• Dependency injection patterns
• Exception handling templates
• Middleware patterns
• Testing patterns specific to FastAPI

For RagBot:

• ✅ Improve error responses (consistent JSON format)
• ✅ Add custom exception handlers
• ✅ Middleware for logging & observability
• ✅ Request/response validation

---

10. ✅ Python Design Patterns (New)

Package: wshobson/agents@python-design-patterns
Location: .agents/skills/python-design-patterns/

Provides:

• Singleton, Factory, Strategy patterns
• Dependency injection patterns
• Observer patterns
• Builder patterns

For RagBot:

• ✅ Centralize LLM configuration (Singleton pattern)
• ✅ Factory pattern for creating agents
• ✅ Strategy pattern for different prediction algorithms
• ✅ Improve code maintainability

---

11. ✅ Python Error Handling (New)

Package: wshobson/agents@python-error-handling
Location: .agents/skills/python-error-handling/

For RagBot:

• ✅ Custom exception hierarchy (MedicalAnalysisError, etc.)
• ✅ Better error context propagation through workflow
• ✅ Graceful degradation when LLM calls fail
• ✅ Distinguish between recoverable and fatal errors

---

12. ✅ Python Observability (New)

Package: wshobson/agents@python-observability
Location: .agents/skills/python-observability/

Provides:

• Structured logging patterns
• Metrics collection (Prometheus)
• Distributed tracing
• Performance monitoring

For RagBot:

• ✅ Structured logs (JSON format)
• ✅ Track LLM API latency
• ✅ Monitor biomarker extraction success rates
• ✅ Alert on workflow failures

---

13. ✅ RAG Implementation (New)

Package: wshobson/agents@rag-implementation
Location: .agents/skills/rag-implementation/

Provides:

• RAG pipeline best practices
• Chunk size optimization
• Retrieval evaluation patterns
• Citation enforcement
• Relevance scoring

For RagBot (Critical for medical RAG):

• ✅ Enforce minimum retrieval relevance (score > 0.7)
• ✅ Require citations in all RAG outputs
• ✅ Optimize chunk size for medical documents
• ✅ Implement citation verification
• ✅ Handle retrieval failures gracefully

---

🎯 Implementation Priority (Roadmap)

Phase 1: SECURITY & CRITICAL FIXES (Week 1) 🔒

Estimated Time: 2-3 days

1. Use OWASP Security Check

   • Scan entire codebase for vulnerabilities
   • Create vulnerability remediation plan
   • Document security fixes

2. Implement API Security Hardening

   • Add API key authentication
   • Add input validation & sanitization
   • Add security headers
   • Implement CORS properly

3. Add Rate Limiting

   • Protect /api/v1/analyze/* endpoints
   • Implement tiered limits
   • Add retry-after headers

Skills Used: owasp-security-check, api-security-hardening, api-rate-limiting

---

Phase 2: CODE QUALITY & TESTING (Week 2) 🧪

Estimated Time: 2-3 days

1. Expand Test Suite

   • Use python-testing-patterns to add parametrized tests
   • Add integration tests for API routes
   • Mock LLM calls for faster CI/CD
   • Measure & improve coverage to 90%+

2. Error Handling Improvements

   • Use python-error-handling to create exception hierarchy
   • Add contextual error messages
   • Implement retry logic for LLM calls

3. Code Organization

   • Apply python-design-patterns refactoring
   • Centralize configuration management
   • Improve code maintainability

Skills Used: python-testing-patterns, python-error-handling, python-design-patterns

---

Phase 3: DOCUMENTATION & CI/CD (Week 3) 📚

Estimated Time: 1-2 days

1. CI/CD Setup

   • Use github-actions-templates to create workflows
   • Auto-run tests on every PR
   • Dependency scanning

2. Documentation

   • OpenAPI spec already auto-generated by FastAPI
   • Use api-docs-generator to enhance docs
   • Create API client libraries

3. Code Review Process

   • Set up with github-pr-review-workflow
   • Create CODEOWNERS file
   • Define review standards with code-review-excellence

Skills Used: github-actions-templates, api-docs-generator, github-pr-review-workflow, code-review-excellence

---

Phase 4: OBSERVABILITY & RAG IMPROVEMENTS (Week 4) 📊

Estimated Time: 1-2 days

1. Observability

   • Add structured logging with python-observability
   • Track metrics (LLM latency, success rates)
   • Implement distributed tracing

2. RAG Optimization

   • Use rag-implementation to enforce citations
   • Improve retrieval quality scoring
   • Add citation verification

3. FastAPI Improvements

   • Use fastapi-templates for better exception handling
   • Add observability middleware
   • Improve request/response logging

Skills Used: python-observability, rag-implementation, fastapi-templates

---

📋 Critical Fixes Required (From Deep Review)

Fix 1: Biomarker Flags & Safety Alerts Propagation

File: src/agents/biomarker_analyzer.py
Issue: Not returning biomarker_flags and safety_alerts to state

# BEFORE
return {"agent_outputs": [output]}

# AFTER
return {
    "agent_outputs": [output],
    "biomarker_flags": output.biomarker_flags,
    "safety_alerts": output.safety_alerts,
}

Fix 2: Unified Biomarker Normalization

Files: api/app/services/extraction.py, scripts/chat.py
Issue: Different normalization schemes in API vs CLI

# Create src/biomarker_normalization.py with shared map
from src.biomarker_normalization import normalize_biomarker_name

# Use in both API and CLI
normalized = normalize_biomarker_name("ldl")  # "LDL Cholesterol"

Fix 3: Remove Forced Confidence & Default Disease

File: api/app/services/extraction.py
Issue: Minimum confidence forced to 0.5, default to Diabetes

# BEFORE
confidence = max(0.5, computed_confidence)  # WRONG!
disease = "Diabetes" if confidence < 0.7 else predicted

# AFTER
confidence = computed_confidence  # Use actual value
disease = predicted if confidence > 0.5 else None

Fix 4: Schema Alignment

Files: src/workflow.py, api/app/services/ragbot.py
Issue: ResponseSynthesizerAgent output != API formatter input

Choose one schema and commit to it across whole system.

---

📊 Expected Improvements

Metric	Before	After	Impact
Test Coverage	70%	90%+	Faster development, fewer bugs
API Security	Basic	OWASP-compliant	Medical data protection
Production Readiness	Good	Excellent	Enterprise deployment
Documentation	Auto-generated	Enhanced	Better developer experience
Deployment	Manual	Automated	CI/CD pipelines
Code Review	Ad-hoc	Standardized	Consistent quality
Observability	Basic	Comprehensive	Better debugging

---

🚀 Next Steps

1. Read the skills (each has a README in .agents/skills/*/)
2. Run OWASP scan immediately
3. Fix critical issues from the Deep Review
4. Implement Phase 1 (Security) first
5. Roll out Phases 2-4 according to priority

---

📚 Skill Locations

All skills installed to: ~/.agents/skills/

• ✅ Python Testing Patterns: python-testing-patterns/
• ✅ API Security Hardening: api-security-hardening/
• ✅ OWASP Security: owasp-security-check/
• ✅ API Rate Limiting: api-rate-limiting/
• ✅ GitHub Actions: github-actions-templates/
• ✅ GitHub PR Review: github-pr-review-workflow/
• ✅ API Docs: api-docs-generator/
• ✅ Code Review: code-review-excellence/
• ✅ FastAPI: fastapi-templates/
• ✅ Design Patterns: python-design-patterns/
• ✅ Error Handling: python-error-handling/
• ✅ Observability: python-observability/
• ✅ RAG: rag-implementation/

Access them anytime: npx skills list

---

✅ Summary

You now have 13 enterprise-grade skills installed and ready to transform RagBot into an industry-leading medical AI system with:

• 🔒 Medical-grade security
• 🧪 Comprehensive test coverage
• 📚 Professional documentation
• 🚀 Automated CI/CD
• 📊 Complete observability
• 🎯 Best practice code quality

Recommendation: Start with Phase 1 (Security) this week. All skills are accessible and documented in .agents/skills/.

Good luck! 🚀