@1aboveio/skills 0.20.3 → 0.21.0

package/runtime/skills/distribution/scripts/bundles.mjs

@@ -204,18 +204,22 @@ export function newMemberCandidates(action, groupIds, priorState, transport = {}
   return candidates;
 }
 
-// Archived members are offered only to users who previously accepted them in the same group.
-// This keeps retirement explicit and prevents a release from treating filesystem presence as
-// consent. A successful removal drops the old acceptance; a decline or failure preserves it so a
-// later update offers the archive again.
+// Archived members of a selected group are offered when they were previously accepted or are
+// still installed. Presence of a named leftover is not group inference: the group is already
+// selected. A successful removal drops the old acceptance; a decline or failure preserves it so a
+// later run offers the archive again.
 export function archivedMemberCandidates(action, groupIds, priorState, transport = {}) {
-  if (action !== 'update' || !priorState) return [];
+  if (!ACTIONS.has(action)) return [];
   const recipes = readRecipes(resolveBundleTransport(transport).recipesPath);
   const selected = new Set(groupIds);
-  const acceptedByGroup = new Map(priorState.groups
+  const acceptedByGroup = new Map((priorState?.groups ?? [])
     .map((group) => [group.id, new Set(group.acceptedMembers)]));
+  const leftover = (name) => Boolean(
+    transport.skillsRoot
+    && statSync(join(transport.skillsRoot, name), { throwIfNoEntry: false }),
+  );
   return (recipes.archives ?? []).filter((archive) => selected.has(archive.formerGroupId)
-    && acceptedByGroup.get(archive.formerGroupId)?.has(archive.installName));
+    && (acceptedByGroup.get(archive.formerGroupId)?.has(archive.installName) || leftover(archive.installName)));
 }
 
 // Prior acceptance for the new-member consent delta on explicit selections (picker, --group,
@@ -305,19 +309,14 @@ function localFirstPartyCommand(command, localRoot, groupId) {
   return command.replace(NATIVE_ADD_SOURCE, (_match, prefix) => `${prefix}${shellArgument(localRoot)}`);
 }
 
-// The coordinator executes one native add PER SKILL (#1129) rather than coalescing a whole source
-// into one invocation. A coalesced add can only attribute a failure to the entire source; per-skill
-// adds let the run record exactly which skill failed, continue with the remaining skills, and keep
-// only the succeeded skills in selection memory. Recipe step/member order is preserved
-// (dependency-first), and a member shared by several selected groups (harness-runtime) is still
-// planned exactly once, at its first occurrence. The pinned native CLI has no `--symlink` selector,
-// so the coordinator adds `--yes` to choose its default symlink deployment without one installation-
-// method prompt per skill. Attribution, ordering and deduplication remain coordinator-owned.
-const SKILL_TAIL = /^(.*? --skill )(.+?)( && .*)?$/;
+// The coordinator preserves generated dependency/member order, then coalesces each contiguous run
+// from one source into a native add. A member shared by groups is included once and retains every
+// owning selection for memory. Per-member attribution comes from post-install digest verification,
+// not process count.
+const SKILL_TAIL = /^(.*? --skill )(.+?)( --yes)?( && .*)?$/;
 
-// The generated step binds its runtime suffix (` && npm ci ...`) to the whole coalesced command.
-// Per skill it belongs to the runtime member's own add, so the dependency install runs only after
-// engineering-runtime itself was actually added — never after a sibling, never when it was skipped.
+// The generated step binds its runtime suffix (` && npm ci ...`) to engineering-runtime. Keep it on
+// the source batch only when that member remains selected after digest and consent filtering.
 const RUNTIME_MEMBER = 'engineering-runtime';
 
 function skillsFromCommand(command) {
@@ -329,14 +328,14 @@ function skillsFromCommand(command) {
 function withSkills(command, skills) {
   const match = SKILL_TAIL.exec(command);
   if (!match) throw new Error(`Native add has no --skill list to rewrite: ${command}`);
-  return `${match[1]}${skills.join(' ')}${match[3] || ''}`;
+  return `${match[1]}${skills.join(' ')}${match[3] || ''}${match[4] || ''}`;
 }
 
 function withYesFlag(command) {
   // --yes must bind to `skills`, not to a trailing `&& npm ci ...`.
   const match = SKILL_TAIL.exec(command);
   if (!match) return `${command} --yes`;
-  return `${match[1]}${match[2]} --yes${match[3] || ''}`;
+  return `${match[1]}${match[2]} --yes${match[4] || ''}`;
 }
 
 export function planBundleCommands(action, groupIds, {
@@ -363,12 +362,10 @@ export function planBundleCommands(action, groupIds, {
     if (!requested.includes(groupId)) requested.push(groupId);
   }
 
-  // Plan from the selected groups (not recipes.all). A public package may expose only a subset of
-  // groups while still shipping a full recipes.all from the private catalog; using that all-plan
-  // would install skills that are not in the selection / not in the package.
+  // Plan individual member records first. The execution boundary coalesces adjacent records from
+  // the same source without weakening per-member dependency, policy, or selection metadata.
   const planned = [];
   const plannedByMember = new Map();
-
   for (const groupId of requested) {
     const group = groups.get(groupId);
     for (const step of group[action].steps) {
@@ -379,14 +376,10 @@ export function planBundleCommands(action, groupIds, {
       const command = step.sourceId === 'first-party'
         ? localFirstPartyCommand(generated.command, localRoot, groupId)
         : generated.command;
-      // An explicit member subset (the digest skip) removes members from the native add but never
-      // reorders the rest: the remaining skills keep recipe order, support dependency first.
-      // Declined new members (#1128) are also filtered out, but consent never applies to support
-      // dependencies (harness-runtime): they are silent install dependencies, not capabilities.
       const skills = skillsFromCommand(command)
         .filter((skill) => !skipMembers?.has(skill))
         .filter((skill) => SUPPORT_GROUPS.has(skill) || !omit.has(skill));
-      const suffix = SKILL_TAIL.exec(command)?.[3] || '';
+      const suffix = SKILL_TAIL.exec(command)?.[4] || '';
       const bare = suffix ? command.slice(0, command.length - suffix.length) : command;
       for (const skill of skills) {
         const existing = plannedByMember.get(skill);
@@ -396,8 +389,6 @@ export function planBundleCommands(action, groupIds, {
         }
         let skillCommand = withSkills(bare, [skill]);
         if (suffix && skill === RUNTIME_MEMBER) skillCommand = `${skillCommand}${suffix}`;
-        // The pinned CLI has no --symlink flag. --yes is its only supported way to select the
-        // default symlink deployment without presenting the install-method chooser.
         skillCommand = withYesFlag(skillCommand);
         const invocationPolicy = skill === 'tdd' && enableTdd
           ? undefined
@@ -415,22 +406,51 @@ export function planBundleCommands(action, groupIds, {
           ...(memberMetadata.get(skill)?.requires?.length > 0
             ? { requires: memberMetadata.get(skill).requires }
             : {}),
+          metadata: memberMetadata.get(skill) ?? { installName: skill },
         };
         plannedByMember.set(skill, entry);
         planned.push(entry);
       }
     }
   }
-
   return planned;
 }
 
-// Continue-on-failure (#1129): planned per-skill adds run in dependency order. A failed skill blocks
-// only members that require it; unrelated later skills still run. The caller summarizes the buckets,
-// decides the exit status, and persists only members whose required closure is ready.
-export function runBundleCommands(commands, {
+export function coalesceBundleCommands(commands) {
+  const batches = [];
+  for (const planned of commands) {
+    const previous = batches.at(-1);
+    if (!previous || previous.sourceId !== planned.sourceId || previous.cwd !== planned.cwd) {
+      batches.push({
+        sourceId: planned.sourceId,
+        members: [planned],
+        command: planned.command,
+        cwd: planned.cwd,
+        failureMessage: planned.failureMessage,
+      });
+      continue;
+    }
+    previous.members.push(planned);
+    const suffix = previous.members.map(({ command }) => SKILL_TAIL.exec(command)?.[4] || '').find(Boolean) || '';
+    const bare = suffix && previous.command.endsWith(suffix)
+      ? previous.command.slice(0, previous.command.length - suffix.length)
+      : previous.command;
+    previous.command = withSkills(bare, previous.members.map(({ member }) => member));
+    if (suffix) previous.command = `${previous.command}${suffix}`;
+  }
+  for (const batch of batches) {
+    batch.groupIds = [...new Set(batch.members.flatMap((member) => member.groupIds))];
+    batch.groupName = [...new Set(batch.members.map((member) => member.groupName))].join(', ');
+  }
+  return batches;
+}
+
+// Source batches continue independently. Within each batch, command status is only process evidence;
+// installed-content verification is the per-member authority used for attribution and memory.
+export function runBundleCommands(batches, {
   execute = (command, cwd) => spawnSync('/bin/bash', ['-lc', command], { cwd, stdio: 'inherit' }),
   applyPolicy = applyInvocationPolicy,
+  verifyMember,
   skillsRoot,
   stdout = process.stdout,
   stderr = process.stderr,
@@ -439,35 +459,79 @@ export function runBundleCommands(commands, {
   const succeeded = [];
   const failed = [];
   const available = new Set(satisfiedMembers);
-  for (const planned of commands) {
-    const blockedBy = (planned.requires ?? []).filter((dependency) => !available.has(dependency));
-    if (blockedBy.length > 0) {
-      stderr.write(`Dependency failed for ${planned.member}: ${blockedBy.join(', ')} is not available\n`);
-      failed.push({ planned, status: 1, blockedBy });
-      continue;
+  for (const candidate of batches) {
+    const legacySingle = !Array.isArray(candidate.members);
+    const batch = legacySingle ? { ...candidate, members: [candidate] } : candidate;
+    let runnable = [...batch.members];
+    let changed = true;
+    while (changed) {
+      changed = false;
+      const runnableNames = new Set(runnable.map(({ member }) => member));
+      for (const planned of [...runnable]) {
+        const blockedBy = (planned.requires ?? [])
+          .filter((dependency) => !available.has(dependency) && !runnableNames.has(dependency));
+        if (blockedBy.length === 0) continue;
+        stderr.write(`Dependency failed for ${planned.member}: ${blockedBy.join(', ')} is not available\n`);
+        failed.push({ planned, status: 1, blockedBy });
+        runnable = runnable.filter((candidate) => candidate !== planned);
+        changed = true;
+      }
     }
-    stdout.write(`\nInstalling ${planned.member} (${planned.sourceId})...\n`);
-    const result = execute(planned.command, planned.cwd);
-    if (result.status === 0) {
-      try {
-        if (planned.invocationPolicy) {
+    if (runnable.length === 0) continue;
+    let command = batch.command;
+    let batchSuffix = '';
+    if (!legacySingle) {
+      batchSuffix = SKILL_TAIL.exec(batch.command)?.[4] || '';
+      command = withSkills(batch.command, runnable.map(({ member }) => member));
+      if (batchSuffix && !runnable.some(({ member }) => member === RUNTIME_MEMBER)) {
+        command = command.slice(0, command.length - batchSuffix.length);
+      }
+    }
+    stdout.write(`\nInstalling ${runnable.map(({ member }) => member).join(', ')} (${batch.sourceId})...\n`);
+    const result = execute(command, batch.cwd);
+    const status = Number.isInteger(result.status) ? result.status : 1;
+    const policyFailures = new Set();
+    if (status === 0) {
+      for (const planned of runnable) {
+        if (!planned.invocationPolicy) continue;
+        try {
           applyPolicy({
             installName: planned.member,
             policy: planned.invocationPolicy,
             ...(skillsRoot ? { skillsRoot } : {}),
           });
+        } catch (error) {
+          stderr.write(`Invocation policy failed for ${planned.member}: ${error.message}\n`);
+          policyFailures.add(planned.member);
         }
-        succeeded.push(planned);
-        available.add(planned.member);
+      }
+    } else {
+      stderr.write(`${batch.failureMessage}\n`);
+    }
+    for (const planned of runnable) {
+      if (policyFailures.has(planned.member)) {
+        failed.push({ planned, status: 1 });
         continue;
+      }
+      if (status !== 0 && batchSuffix && planned.member === RUNTIME_MEMBER) {
+        stderr.write(`Post-install command failed for ${planned.member}\n`);
+        failed.push({ planned, status });
+        continue;
+      }
+      try {
+        const verified = verifyMember ? verifyMember(planned) : status === 0;
+        if (verified) {
+          succeeded.push(planned);
+          available.add(planned.member);
+        } else {
+          stderr.write(`Post-install verification failed for ${planned.member}\n`);
+          failed.push({ planned, status: status || 1 });
+        }
       } catch (error) {
-        stderr.write(`Invocation policy failed for ${planned.member}: ${error.message}\n`);
+        stderr.write(`Post-install verification failed for ${planned.member}: ${error.message}\n`);
         failed.push({ planned, status: 1 });
-        continue;
       }
     }
-    stderr.write(`${planned.failureMessage}\n`);
-    failed.push({ planned, status: Number.isInteger(result.status) ? result.status : 1 });
   }
   return { succeeded, failed };
 }
@@ -626,8 +690,8 @@ install without --group/--all opens the interactive picker; update without them
 remembered selection (\${XDG_STATE_HOME:-~/.local/state}/1aboveio-skills/selection.json).
 When a remembered group's current recipe declares members you have not accepted yet, each new skill
 is offered individually and defaults to No; --yes accepts them all, --dry-run lists them without
-prompting. Retired accepted skills are likewise kept by default; --yes archives them through the
-native Skills CLI after their replacement is current. TDD implicit model invocation is enabled by default; --disable-tdd makes TDD explicit-only,
+prompting. Retired leftovers in a selected group are archived by default through the native Skills
+CLI after their replacement is current; decline interactively to keep them. TDD implicit model invocation is enabled by default; --disable-tdd makes TDD explicit-only,
 and --enable-tdd restores implicit invocation. --manual-tdd remains a compatibility alias for
 --disable-tdd.
 `;
@@ -802,29 +866,24 @@ async function consentNewMembers(candidates, { yes, stdin, stdout, stderr }) {
   return declined;
 }
 
-async function consentArchivedMembers(candidates, { yes, stdin, stdout, stderr }) {
+async function consentArchivedMembers(candidates, { yes, stdin, stdout }) {
   const declined = new Set();
-  if (yes) {
-    for (const candidate of candidates) stdout.write(`Accepting archive of retired skill "${candidate.installName}" (--yes)\n`);
-    return declined;
-  }
-  if (!stdin.isTTY) {
+  if (yes || !stdin.isTTY) {
+    const how = yes ? '--yes' : 'default Yes';
     for (const candidate of candidates) {
-      stderr.write(`Keeping retired skill "${candidate.installName}": no interactive terminal (default No; re-run with --yes to archive)\n`);
-      declined.add(candidate.installName);
+      stdout.write(`Archiving retired skill "${candidate.installName}" (${how}; replaced by ${candidate.replacement})\n`);
     }
     return declined;
   }
   const prompter = createLinePrompter({ stdin, stdout });
   for (const candidate of candidates) {
     const answer = await prompter.ask(
-      `Archive retired skill "${candidate.installName}" (replaced by ${candidate.replacement})? [y/N] `,
+      `Archive retired skill "${candidate.installName}" (replaced by ${candidate.replacement})? [Y/n] `,
     );
-    if (/^y(es)?$/i.test(answer)) stdout.write(`Archiving ${candidate.installName}\n`);
-    else {
+    if (/^n(o)?$/i.test(answer)) {
       stdout.write(`Keeping ${candidate.installName}\n`);
       declined.add(candidate.installName);
-    }
+    } else stdout.write(`Archiving ${candidate.installName}\n`);
   }
   return declined;
 }
@@ -873,6 +932,7 @@ function selectionIncludesTdd(groupIds, catalog) {
 export async function runCli(args, {
   execute,
   applyPolicy,
+  verifyMember,
   stdin = process.stdin,
   stdout = process.stdout,
   stderr = process.stderr,
@@ -932,18 +992,21 @@ export async function runCli(args, {
     } else if (candidates.length > 0) {
       declined = await consentNewMembers(candidates, { yes: parsed.yes, stdin, stdout, stderr });
     }
-    const archiveCandidates = archivedMemberCandidates(parsed.action, groupIds, priorState, transport);
+    const skillsRoot = join(env.HOME || homedir(), '.agents', 'skills');
+    const archiveCandidates = archivedMemberCandidates(parsed.action, groupIds, priorState, {
+      ...transport,
+      skillsRoot,
+    });
     let declinedArchives = new Set();
     if (archiveCandidates.length > 0 && parsed.dryRun) {
       for (const candidate of archiveCandidates) {
-        stdout.write(`Retired skill "${candidate.installName}" (replaced by ${candidate.replacement}) — would prompt to archive (default: No); --yes accepts archival\n`);
+        stdout.write(`Retired skill "${candidate.installName}" (replaced by ${candidate.replacement}) — would archive by default; decline interactively to keep\n`);
       }
     } else if (archiveCandidates.length > 0) {
       declinedArchives = await consentArchivedMembers(archiveCandidates, {
         yes: parsed.yes,
         stdin,
         stdout,
-        stderr,
       });
     }
     // Digest skip (#1127): `update` classifies the accepted members against the installed tree and
@@ -952,7 +1015,6 @@ export async function runCli(args, {
     // from classification: they never run, so they are not buckets.
     let buckets;
     let skipMembers;
-    const skillsRoot = join(env.HOME || homedir(), '.agents', 'skills');
     if (parsed.action === 'update') {
       buckets = classifySelectedMembers(parsed.action, groupIds, { ...transport, enableTdd, skillsRoot });
       skipMembers = new Set(buckets.unchanged.map((entry) => entry.member));
@@ -968,10 +1030,11 @@ export async function runCli(args, {
       skipMembers,
       omitMembers: declined,
     });
+    const batches = coalesceBundleCommands(commands);
     if (parsed.dryRun) {
       if (buckets) printUpdateBuckets(stdout, buckets);
-      for (const planned of commands) {
-        stdout.write(`\n${planned.groupName} / ${planned.sourceId} / ${planned.member}\n${planned.command}\n`);
+      for (const batch of batches) {
+        stdout.write(`\n${batch.groupName} / ${batch.sourceId} / ${batch.members.map(({ member }) => member).join(', ')}\n${batch.command}\n`);
       }
       if (buckets && commands.length === 0 && archiveCandidates.length === 0) {
         stdout.write('Nothing to do: every accepted skill is already up to date.\n');
@@ -984,9 +1047,21 @@ export async function runCli(args, {
       const skipping = buckets.unchanged.map((entry) => entry.member).filter((member) => !SUPPORT_GROUPS.has(member));
       if (skipping.length > 0) stdout.write(`Up to date, skipping: ${skipping.join(', ')}\n`);
     }
-    const { succeeded, failed } = runBundleCommands(commands, {
+    const verificationTransport = resolveBundleTransport(transport);
+    const verificationSources = new Map(readRecipes(verificationTransport.recipesPath).sources
+      .map((source) => [source.id, source]));
+    const verifyInstalledMember = verifyMember ?? (execute ? undefined : (planned) => {
+      const source = verificationSources.get(planned.sourceId);
+      return classifyInstalledMember(source, planned.metadata, {
+        enableTdd,
+        localRoot: verificationTransport.localRoot,
+        skillsRoot,
+      }).status === 'unchanged';
+    });
+    const { succeeded, failed } = runBundleCommands(batches, {
       execute,
       applyPolicy,
+      verifyMember: verifyInstalledMember,
       skillsRoot,
       stdout,
       stderr,
@@ -1001,13 +1076,14 @@ export async function runCli(args, {
       [...commands, ...(buckets?.unchanged ?? [])],
       stderr,
     ));
+    const coherentSucceeded = succeeded.filter((planned) => readyMembers.has(planned.member));
     const archives = runArchiveCommands(
       archiveCandidates.filter((candidate) => !declinedArchives.has(candidate.installName)),
       readyMembers,
       { execute, skillsRoot, stdout, stderr },
     );
     printRunSummary(stdout, {
-      succeeded,
+      succeeded: coherentSucceeded,
       failed,
       unchanged: buckets?.unchanged.map((entry) => entry.member),
       declined: [...declined],

package/runtime/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs

@@ -86,7 +86,7 @@ export const WORKFLOW_TRUSTED_SOURCES = deepFreeze({
     id: 'first-party',
     type: 'first-party',
     package: '@1aboveio/skills',
-    version: '0.20.3',
+    version: '0.21.0',
   },
   matt: {
     id: 'matt-pocock',

package/skills/compliance/doc-authenticity/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: doc-authenticity
-version: 0.4.0
+version: 0.4.1
 description: "Screen PDF documents and raster images for fabrication, tampering, Photoshop or other image-editor use, and content validity. Detects file type, runs format-specific authenticity forensics, classifies bank statements, conversation logs, invoices, agreements, and other documents, then applies type-specific validity checks. Produces separate authenticity (NO_EVIDENCE_OF_MODIFICATION / SUSPICIOUS / LIKELY_MODIFIED / INCONCLUSIVE) and validity (VALID / INVALID / INCONCLUSIVE) verdicts. Use whenever a user asks whether a document, screenshot, scan, statement, invoice, contract, chat log, receipt, or payment evidence is genuine, original, edited, Photoshopped, manipulated, fake, or valid."
+disable-model-invocation: true
 ---
 
 # Document and Image Authenticity

package/skills/compliance/doc-authenticity/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "Document Authenticity"
+  short_description: "Explicit-only document and image authenticity screening"
+
+policy:
+  # Codex counterpart to SKILL.md disable-model-invocation: true.
+  # Keeps explicit invocation while blocking description-based selection.
+  allow_implicit_invocation: false

package/skills/content-creator/article-review/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/content-creator/article-review/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: article-review
+description: >
+  Evaluate and score articles across multiple dimensions including originality,
+  readability, shareability, timeliness, and factual accuracy.
+  Use when a user shares an article, pastes article text, sends a URL, or asks to
+  review, rate, critique, evaluate, 评价, 点评, 分析, or 看看 any article, post, or 文章.
+  Default template is 公众号-支付行业.
+---
+
+# 文章评审引擎
+
+模板化的文章评审系统。评审标准由模板文件定义，引擎负责执行评审流程并输出标准化报告。
+
+**开始任何评审前，先读取 `references/report-format.md`**，熟悉输出结构。
+
+## 可用模板
+
+- **公众号-支付行业** (`references/template-wechat-payments.md`) — 面向支付/金融科技从业者的公众号内容（默认）
+
+如需其他模板，或用户请求的模板不存在，读取 `references/template-guide.md` 创建新模板，再继续评审。
+
+## 输入处理
+
+**粘贴文字：** 直接进入评审流程。
+
+**URL：** 用 `web_fetch` 抓取文章正文。若被拦截（如微信需要登录），提示用户粘贴文章内容后继续。
+
+## 评审流程
+
+### 第一步：确认模板
+在每次评审开始时，读取对应模板文件（默认 `references/template-wechat-payments.md`），获取维度列表和 Level 2 细则。用户未指定模板时使用默认。
+
+### 第二步：通读文章
+通读全文，理解核心主张、论据、结构、受众定位。
+
+### 第三步：事实核查（Fact-Check Pass）
+在逐维度评分之前，先做事实核查：
+
+1. 提取文章中所有可验证的主张：
+   - 数字、统计、比例、排名
+   - 引用他人言论或研究结论
+   - 行业事实陈述（市场规模、政策、技术参数等）
+
+2. 对每条主张用 `web_search` 核查，标注结果：
+   - ✅ **已核实** — 找到一致的可信来源
+   - ❌ **有误** — 找到与之矛盾的可信来源，记录正确值
+   - ⚠️ **无法核实** — 无法找到来源或来源相互矛盾，标注存疑
+
+3. 将核查结果用于事实准确性维度的评分依据
+
+### 第四步：逐维度评分
+按模板定义的每个 Level 1 维度：
+- 给出 1-10 分
+- 引用文章原文 2-3 处作为依据
+- 给出 1-2 条具体可执行的改进建议（如有）
+
+事实准确性维度的评分必须基于第三步的核查结果，而非主观判断。
+
+### 第五步：输出报告
+按 `references/report-format.md` 中的模板输出完整报告。
+
+## 注意事项
+
+严格按流程执行：评分必须有原文引用，不接受笼统判断；事实准确性必须基于 web_search 核查；改进建议要具体可执行；发布建议根据综合分和事实核查结果综合判断。

package/skills/content-creator/article-review/references/report-format.md

@@ -0,0 +1,68 @@
+# 评审报告输出格式
+
+使用以下模板输出完整评审报告。
+
+---
+
+```
+# 文章评审报告
+
+**文章标题：** [标题]
+**评审模板：** [模板名称]
+**评审时间：** [日期]
+
+---
+
+## 综合评分：X.X / 10
+（各维度等权平均）
+
+---
+
+## 事实核查结果
+
+- ✅ "[原文陈述]" — 来源：[来源名]
+- ❌ "[原文陈述]" — 实际应为：[正确值]，来源：[来源名]
+- ⚠️ "[原文陈述]" — 无法核实，建议补充来源
+
+---
+
+## 详细评分
+
+### [维度名] X/10
+**依据：**
+- [引用原文 + 分析]
+
+**改进建议：**
+- [具体建议]
+
+[其余维度同上格式...]
+
+---
+
+## 传播潜力分析
+
+**最强传播钩子：**
+> "[从文章中提取或改写的最具传播力的 1-2 句话，可直接用作转发文案]"
+
+**建议传播渠道：**
+- 微信群（行业/专业群）：[适合/不适合，理由一句]
+- 朋友圈：[适合/不适合，理由一句]
+- LinkedIn：[适合/不适合，理由一句]
+
+**传播半径预估：**
+- [ ] 圈内传播（支付/金融科技从业者为主）
+- [ ] 破圈传播（有潜力触达行业外受众）
+
+**提升传播力的快速改动（可选）：**
+- [1-2 条具体改动建议]
+
+---
+
+## 总结
+[2-3 句总体评价，突出最大优势和最需改进的地方]
+
+## 发布建议
+[ ] 可直接发布
+[ ] 修改后发布（需解决上述改进点）
+[ ] 建议重写（存在严重问题）
+```

package/skills/content-creator/article-review/references/template-guide.md

@@ -0,0 +1,79 @@
+# 新建评审模板指南
+
+新建模板时，复制以下结构，保存为 `references/template-<name>.md`，
+然后在 `SKILL.md` 的"可用模板"列表中添加一行。
+
+---
+
+## 模板文件结构
+
+```markdown
+# 评审模板：[模板名称]
+
+**适用范围：** [描述适用的文章类型]
+**目标受众：** [描述文章面向的读者群体]
+**模板版本：** v1.0
+
+---
+
+## 评审维度（Level 1）及细则（Level 2）
+
+### 1. [维度名] [英文名]
+
+[维度说明，1-2句]
+
+**Level 2 细则：**
+- **[细则名]**：[说明]
+- **[细则名]**：[说明]
+- （2-5条）
+
+**评分参考：**
+- 9-10：[优秀标准]
+- 6-8：[良好标准]
+- 3-5：[及格标准]
+- 1-2：[不合格标准]
+
+---
+
+### 2. [下一个维度...]
+```
+
+---
+
+## 设计原则
+
+**维度数量：** 建议 4-6 个 Level 1 维度。维度太多会分散注意力；太少则覆盖不全。
+
+**维度选择：** 每个维度应该：
+- 相互独立（不重叠）
+- 合起来覆盖文章质量的核心方面
+- 与受众和文章类型紧密相关
+
+**事实准确性注意：** 若模板包含"事实准确性"维度，必须包含以下说明：
+> ⚠️ 本维度评分必须基于 web_search 实际核查结果，不接受主观判断。
+
+**Level 2 细则：** 每个维度建议 3-5 条细则，每条清晰说明考察什么。
+
+---
+
+## 模板示例说明
+
+| 场景 | 文件名建议 | 差异化维度 |
+|------|-----------|-----------|
+| 面向 B 端 CFO 的行业报告 | `template-cfo-report.md` | 数据严谨性、决策价值 |
+| 面向年轻用户的品牌故事 | `template-brand-story.md` | 情感温度、品牌一致性 |
+| 合规/政策解读类 | `template-policy.md` | 准确性权重更高、实操指导 |
+| 产品功能介绍 | `template-product.md` | 清晰度、用例覆盖、CTA |
+
+---
+
+## 注册新模板
+
+完成模板文件后，更新 `SKILL.md` 中的"可用模板"列表：
+
+```markdown
+## 可用模板
+
+- **通用** (`references/template-general.md`) — 适用于大多数 [品牌] 公众号内容（默认）
+- **[新模板名]** (`references/template-<name>.md`) — [一句话描述]
+```