Fix Institutional Memory Framework PR comments

.gitmodules

@@ -1,3 +1,6 @@
 [submodule "mcp-security"]
 	path = mcp-security
 	url = https://github.com/google/mcp-security.git
+[submodule "SuperClaude_Framework"]
+	path = SuperClaude_Framework
+	url = https://github.com/dandye/SuperClaude_Framework.git

LLMS.md

@@ -69,103 +69,6 @@ Run this after changing personas to ensure common steps remain accessible.
 - **Threat Intelligence**: Active integration with Google Threat Intelligence and security feeds
 - **Multi-Platform SIEM**: Chronicle, SOAR case management, and cloud security integration
 
-## Skills & Persona System
-
-The repository includes a skills-based workflow system with persona-driven orchestration.
-
-### Skills Directory Structure
-
-```
-skills/
-├── _personas/          # Persona manifest files (YAML)
-│   ├── tier1-analyst.yaml
-│   ├── tier2-analyst.yaml
-│   ├── threat-hunter.yaml
-│   └── incident-responder.yaml
-├── _workflows/         # Composite/meta-skills
-│   ├── full-alert-triage/
-│   └── full-investigation/
-├── _roles/             # IAM role documentation
-│   └── iam-matrix.md
-└── <skill-name>/       # Individual atomic skills
-    └── SKILL.md
-```
-
-### Using Personas
-
-Persona manifests define which skills each security role can use and their typical workflows.
-
-**Available Personas:**
-
-| Persona | Primary Function | Key Skills |
-|---------|-----------------|------------|
-| `tier1-analyst` | Alert triage, initial assessment | triage-alert, enrich-ioc, check-duplicates |
-| `tier2-analyst` | Deep investigation, escalated cases | deep-dive-ioc, correlate-ioc, triage-malware |
-| `threat-hunter` | Proactive hunting | hunt-apt, hunt-ioc, hunt-threat, hunt-lateral-movement |
-| `incident-responder` | PICERL lifecycle management | respond-ransomware, respond-malware, respond-phishing |
-
-**Activating a Persona:**
-
-Each LLM platform activates personas differently:
-
-- **Claude Code**: Uses Task tool with `subagent_type` parameter matching the persona
-- **Gemini CLI**: Reference persona file directly: `gemini -p "@skills/_personas/tier1-analyst.yaml Follow this persona workflow..."`
-- **Other LLMs**: Read the persona YAML and follow the defined workflows
-
-### Persona Manifest Structure
-
-Each persona YAML defines:
-
-```yaml
-name: tier1-analyst
-subagent_type: soc-analyst-tier-1  # Maps to Claude Code agent
-
-iam_requirements:
-  chronicle:
-    roles: [roles/chronicle.viewer]
-  soar:
-    roles: [roles/chronicle.editor]
-  gti:
-    license: GTI Standard
-
-skills:
-  primary: [triage-alert, enrich-ioc, check-duplicates]
-  allowed: [correlate-ioc, generate-report]
-  forbidden: [hunt-apt, respond-ransomware]
-
-workflows:
-  default_triage:
-    chain: [check-duplicates, triage-alert, enrich-ioc, close-or-escalate]
-```
-
-### IAM Role Requirements
-
-Skills require specific IAM roles to function. See `skills/_roles/iam-matrix.md` for the complete mapping.
-
-**Key Role Levels by Persona:**
-
-| Persona | Chronicle | SOAR | GTI | Primary Use Case |
-|---------|-----------|------|-----|------------------|
-| Tier 1 SOC Analyst | viewer | editor | Standard | Alert triage |
-| Tier 2 SOC Analyst | editor | editor | Enterprise | Deep investigation |
-| Threat Hunter | editor | viewer | Enterprise+ | Proactive hunting |
-| Incident Responder | admin | soarAdmin | Enterprise | Incident response |
-
-*Note: This is a simplified view. See `skills/_roles/iam-matrix.md` for complete role mappings including Tier 3 Analyst, SOC Manager, and other personas.*
-
-### Workflow Orchestration
-
-**Atomic Skills**: Single-purpose skills (e.g., `/enrich-ioc`, `/check-duplicates`)
-
-**Meta-Skills/Workflows**: Composite skills that chain atomic skills:
-- `/full-alert-triage` - Complete Tier 1 workflow
-- `/full-investigation` - Complete Tier 2 workflow
-
-**Skill Chaining Example (Tier 1 Triage):**
-```
-check-duplicates → triage-alert → enrich-ioc → [close OR escalate]
-```
-
 ## Working with the Codebase
 
 1. The primary content lives in `rules_bank/` - edit source files there, not in the symlinked directories
@@ -193,6 +96,7 @@ This repository includes multiple layers of context to help AI assistants unders
 - **`TAXONOMY_[date].md`** - Hierarchical classification systems for content organization
 
 ### Specialized Enhancement Files
+- **`SuperClaude_Framework/`** - Advanced command framework with specialized security slash commands
 - **`reporting_templates.md`** - Standardized formats for security report generation
 - **`./reports/`** - Real-world examples of generated security reports and investigations
 
@@ -235,6 +139,22 @@ The repository integrates with multiple security platforms through MCP tools:
 - **`gti`** - Google Threat Intelligence (threat analysis, IOC enrichment, malware research)
 - **`scc-mcp`** - Security Command Center (cloud security posture, vulnerability management)
 
+### Slash Commands (Claude-Specific)
+Specialized security commands available in Claude for advanced workflows:
+- **`/security:investigate`** - Comprehensive incident investigation and analysis
+- **`/security:hunt`** - Proactive threat hunting and pattern detection
+- **`/security:analyze`** - Deep analysis of rules, IOCs, and security events
+- **`/security:enrich`** - Threat intelligence enrichment and contextualization
+- **`/security:correlate`** - Multi-source correlation and pattern matching
+- **`/security:detect`** - Detection rule creation and optimization
+
+### Information Architecture Commands (Claude-Specific)
+Content organization and analysis capabilities:
+- **`/thesaurus`** - Generate controlled vocabulary and terminology maps
+- **`/content-audit`** - Comprehensive content quality assessment
+- **`/sitemap`** - Create structural navigation and content maps
+- **`/taxonomy`** - Develop hierarchical classification systems
+
 ## Important Notes & Best Practices
 
 ### Repository Guidelines