@muxoai/platform 1.4.3 → 1.4.5

package/dist/skills-catalog.js

@@ -0,0 +1,840 @@
+import { ENTERPRISE_TOOLKITS_CATALOG, STRIPE_PROJECTS_DEPLOYABLE_CATALOG, isStripeProjectsExclusiveProvider, resolveStripeProjectsCanonicalToolSlug, } from "./composio-catalog.js";
+import { MUXO_VERSION } from "./version.js";
+const PROVIDER_SKILL_OVERRIDES = {
+    github: {
+        recommendedTools: [
+            "app.github.list_repos",
+            "app.github.create_issue",
+            "app.github.create_pull_request",
+        ],
+        workflowSteps: [
+            "Verify GitHub OAuth connection via `connection_status({ provider: \"github\" })`; if missing, call `start_connection({ provider: \"github\" })` and `wait_for_connection({ provider: \"github\" })`.",
+            "Inspect exact parameter schemas with `inspect_tool({ slug: \"app.github.create_issue\" })` or `search_tools({ query: \"github\" })`.",
+            "For mutating operations (creating issues, PRs, releases, or branch updates), call `plan_action` first and execute via `execute_write` with a stable `idempotency_key`.",
+        ],
+        pitfalls: [
+            "Always pass `owner` and `repo` as separate fields (never combined `owner/repo`) when calling `app.github.*` tools.",
+            "Check repository visibility and branch protection before attempting direct branch or pull request mutations.",
+            "Paginate repository and issue listings using `per_page` and `page` when auditing large organizations.",
+        ],
+    },
+    gmail: {
+        recommendedTools: [
+            "app.gmail.fetch_emails",
+            "app.gmail.send_email",
+            "app.gmail.create_email_draft",
+        ],
+        workflowSteps: [
+            "Check Gmail connection with `connection_status({ provider: \"gmail\" })`; if not active, run `start_connection({ provider: \"gmail\" })` and `wait_for_connection({ provider: \"gmail\" })`.",
+            "Use `execute_read` with `app.gmail.fetch_emails` and a scoped Gmail query (e.g., `is:inbox newer_than:7d`) before drafting or replying.",
+            "For outbound email (`app.gmail.send_email`), create a governed plan via `plan_action` so Cedar/OPA recipient domain guardrails and DLP checks run before `execute_write`.",
+        ],
+        pitfalls: [
+            "Prefer `app.gmail.create_email_draft` when human review is desired before external customer communication.",
+            "Always verify `recipient_email` against workspace parameter policy rules (`not_ends_with` / allowed domains) before sending.",
+            "Never resend a failed `app.gmail.send_email` call without the original `idempotency_key`.",
+        ],
+    },
+    slack: {
+        recommendedTools: [
+            "app.slack.list_channels",
+            "app.slack.send_message",
+        ],
+        workflowSteps: [
+            "Confirm Slack OAuth status via `connection_status({ provider: \"slack\" })`.",
+            "Resolve channel names to Slack channel IDs (`C0...`) using `execute_read({ tool_slug: \"app.slack.list_channels\", input: {} })`.",
+            "Plan and send formatted Slack messages using `plan_action` + `execute_write({ tool_slug: \"app.slack.send_message\", ... })`.",
+        ],
+        pitfalls: [
+            "Pass canonical Slack channel IDs (e.g. `C01234567`) rather than `#channel-name` strings whenever possible.",
+            "When replying in a thread, pass `thread_ts` explicitly to avoid noisy top-level channel broadcasts.",
+        ],
+    },
+    notion: {
+        recommendedTools: [
+            "app.notion.search",
+            "app.notion.create_page",
+        ],
+        workflowSteps: [
+            "Authenticate Notion via `start_connection({ provider: \"notion\" })` + `wait_for_connection({ provider: \"notion\" })`.",
+            "Search existing pages or databases first with `execute_read({ tool_slug: \"app.notion.search\", input: { query: \"...\" } })` to obtain parent UUIDs.",
+            "Create or update Notion pages via `plan_action` and `execute_write`.",
+        ],
+        pitfalls: [
+            "Notion page creation requires a valid parent `page_id` or `database_id` shared with the integration during OAuth authorization.",
+            "Strip hyphens or preserve canonical 36-char UUIDs consistently when referencing Notion parent objects.",
+        ],
+    },
+    linear: {
+        recommendedTools: [
+            "app.linear.list_issues",
+            "app.linear.create_issue",
+        ],
+        workflowSteps: [
+            "Verify Linear connection with `connection_status({ provider: \"linear\" })`.",
+            "List existing issues via `execute_read({ tool_slug: \"app.linear.list_issues\", input: {} })` to discover valid `team_id` and state identifiers.",
+            "Create or update Linear issues via `plan_action` and `execute_write`.",
+        ],
+        pitfalls: [
+            "Linear `create_issue` requires a valid UUID `team_id` (not the short team key like `ENG`); resolve it from `app.linear.list_issues` or workspace memory first.",
+            "Priority values in Linear are integers (`0` = No priority, `1` = Urgent, `2` = High, `3` = Medium, `4` = Low).",
+        ],
+    },
+    jira: {
+        recommendedTools: [
+            "app.jira.search_issues",
+            "app.jira.create_issue",
+        ],
+        workflowSteps: [
+            "Ensure Jira connection is active via `connection_status({ provider: \"jira\" })`.",
+            "Run JQL queries via `execute_read({ tool_slug: \"app.jira.search_issues\", input: { jql: \"project = ENG ORDER BY created DESC\" } })`.",
+            "Create or transition issues using `plan_action` + `execute_write`.",
+        ],
+        pitfalls: [
+            "`project_key` (e.g., `ENG`) and `issue_type` (e.g., `Task`, `Bug`) are case-sensitive in Jira Cloud.",
+            "Always bound JQL queries with a project filter or `max_results` to avoid large payload truncation.",
+        ],
+    },
+    hubspot: {
+        recommendedTools: [
+            "app.hubspot.search_contacts",
+            "app.hubspot.create_contact",
+            "app.hubspot.create_deal",
+        ],
+        workflowSteps: [
+            "Verify HubSpot OAuth status via `connection_status({ provider: \"hubspot\" })`.",
+            "Deduplicate contacts first using `execute_read({ tool_slug: \"app.hubspot.search_contacts\", input: { query: \"email@domain.com\" } })`.",
+            "Create or update CRM contacts and deals via `plan_action` and `execute_write`.",
+        ],
+        pitfalls: [
+            "Always search by email before calling `app.hubspot.create_contact` to prevent 409 Conflict errors on existing contacts.",
+            "Deal `amount` values should be passed as numeric strings without currency symbols.",
+        ],
+    },
+    salesforce: {
+        recommendedTools: [
+            "app.salesforce.query_soql",
+            "app.salesforce.create_lead",
+            "app.salesforce.update_opportunity",
+        ],
+        workflowSteps: [
+            "Confirm Salesforce OAuth connection via `connection_status({ provider: \"salesforce\" })`.",
+            "Run bounded SOQL queries with `execute_read` before mutating Leads, Contacts, or Opportunities.",
+            "Use `plan_action` + `execute_write` with an `idempotency_key` for all CRM record writes.",
+        ],
+        pitfalls: [
+            "Always include a `LIMIT` clause in SOQL queries (`SELECT Id, Name FROM Account LIMIT 50`).",
+            "Salesforce `Lead` creation requires `LastName` and `Company` as mandatory fields.",
+        ],
+    },
+    shopify: {
+        recommendedTools: [
+            "app.shopify.list_orders",
+            "app.shopify.get_order",
+            "app.shopify.create_Order_refund",
+        ],
+        workflowSteps: [
+            "Check Shopify connection via `connection_status({ provider: \"shopify\" })`.",
+            "Inspect order line items and fulfillment status via `execute_read` before planning any order update or refund.",
+            "Route refunds or financial adjustments through `plan_action` and `execute_financial`.",
+        ],
+        pitfalls: [
+            "Verify currency and remaining refundable amount on the order before planning a refund.",
+            "Financial mutations in Shopify trigger Muxo's `financial` risk ring and require explicit policy clearance or human approval.",
+        ],
+    },
+    metaads: {
+        recommendedTools: [
+            "app.metaads.get_insights",
+            "app.metaads.list_campaigns",
+            "app.metaads.update_campaign_budget",
+        ],
+        workflowSteps: [
+            "Verify Meta Ads OAuth connection with `connection_status({ provider: \"metaads\" })`.",
+            "Pull campaign ROAS, CPA, and spend metrics via `execute_read` before proposing budget or status changes.",
+            "Plan campaign budget updates via `plan_action` so spend caps and Cedar/OPA parameter policies are evaluated before `execute_write`.",
+        ],
+        pitfalls: [
+            "Meta Ads `ad_account_id` must include the `act_` prefix (e.g., `act_123456789`).",
+            "Meta Ads budgets (`daily_budget`, `lifetime_budget`) are specified in minor currency units (cents) on upstream endpoints.",
+        ],
+    },
+    googleads: {
+        recommendedTools: [
+            "app.googleads.list_campaigns",
+            "app.googleads.get_campaign_metrics",
+            "app.googleads.update_campaign_budget",
+        ],
+        workflowSteps: [
+            "Confirm Google Ads OAuth status via `connection_status({ provider: \"googleads\" })`.",
+            "Fetch campaign performance metrics via `execute_read` before adjusting budgets or bidding targets.",
+            "Execute budget changes through `plan_action` + `execute_write`.",
+        ],
+        pitfalls: [
+            "Format Google Ads `customer_id` as a 10-digit string without hyphens (`1234567890`).",
+            "Google Ads currency amounts in GAQL/mutations use micros (`1,000,000` micros = `$1.00`).",
+        ],
+    },
+    stripe: {
+        recommendedTools: [
+            "app.stripe.list_customers",
+            "app.stripe.create_invoice",
+            "app.stripe.create_payment_link",
+        ],
+        workflowSteps: [
+            "Verify Stripe connected app status via `connection_status({ provider: \"stripe\" })`.",
+            "Look up existing Stripe customers by email via `execute_read` before creating invoices or payment links.",
+            "Plan financial operations with `plan_action` and execute via `execute_financial`.",
+        ],
+        pitfalls: [
+            "Stripe amounts are always in integer minor units (e.g., `2500` for `$25.00 USD`).",
+            "Always supply a deterministic `idempotency_key` on `execute_financial` to guarantee zero duplicate charges.",
+        ],
+    },
+    google_analytics: {
+        recommendedTools: [
+            "app.google_analytics.run_report",
+            "app.google_analytics.get_metadata",
+            "app.google_analytics.list_accounts",
+        ],
+        workflowSteps: [
+            "Verify Google Analytics (GA4) OAuth connection via `connection_status({ provider: \"google_analytics\" })`.",
+            "Discover available properties and custom dimensions via `execute_read` (`app.google_analytics.list_accounts` / `app.google_analytics.get_metadata`).",
+            "Run bounded GA4 reports via `execute_read({ tool_slug: \"app.google_analytics.run_report\", input: { property: \"properties/123456\", dateRanges: [{ startDate: \"7daysAgo\", endDate: \"today\" }] } })`.",
+        ],
+        pitfalls: [
+            "GA4 `property` parameter must include the `properties/` prefix (e.g., `properties/123456789`).",
+            "Verify custom dimension/metric API names with `get_metadata` before including them in `run_report`.",
+        ],
+    },
+    discord: {
+        recommendedTools: [
+            "app.discord.list_channels",
+            "app.discord.send_message",
+            "app.discord.create_thread",
+        ],
+        workflowSteps: [
+            "Check Discord connection via `connection_status({ provider: \"discord\" })`.",
+            "Resolve guild and channel snowflake IDs with `execute_read` before posting messages.",
+            "Plan and execute channel messages or threads via `plan_action` + `execute_write`.",
+        ],
+        pitfalls: [
+            "Discord `channel_id` and `guild_id` must be 64-bit snowflake strings, not human channel names.",
+            "Keep message `content` under 2,000 characters or use `embeds` for longer structured reports.",
+        ],
+    },
+    airtable: {
+        recommendedTools: [
+            "app.airtable.list_records",
+            "app.airtable.create_records",
+            "app.airtable.update_record",
+        ],
+        workflowSteps: [
+            "Verify Airtable OAuth status via `connection_status({ provider: \"airtable\" })`.",
+            "Inspect existing base records and field names with `execute_read` (`app.airtable.list_records`).",
+            "Create or update records via `plan_action` + `execute_write` with exact case-sensitive field names.",
+        ],
+        pitfalls: [
+            "Airtable `baseId` starts with `app...`, `tableIdOrName` starts with `tbl...` (or exact table name), and `recordId` starts with `rec...`.",
+            "Batch record writes in Airtable accept at most 10 records per request.",
+        ],
+    },
+    figma: {
+        recommendedTools: [
+            "app.figma.get_file",
+            "app.figma.get_comments",
+            "app.figma.post_comment",
+        ],
+        workflowSteps: [
+            "Confirm Figma OAuth connection via `connection_status({ provider: \"figma\" })`.",
+            "Fetch file node trees or design tokens via `execute_read` (`app.figma.get_file`).",
+            "Post design review comments through `plan_action` + `execute_write`.",
+        ],
+        pitfalls: [
+            "Extract `file_key` from the Figma URL segment `/design/<file_key>/...` or `/file/<file_key>/...`.",
+            "Pass `depth: 2` when inspecting large Figma files to avoid oversized node payloads.",
+        ],
+    },
+    zendesk: {
+        recommendedTools: [
+            "app.zendesk.list_tickets",
+            "app.zendesk.get_ticket",
+            "app.zendesk.reply_ticket",
+        ],
+        workflowSteps: [
+            "Verify Zendesk connection via `connection_status({ provider: \"zendesk\" })`.",
+            "Read ticket history and requester details via `execute_read` (`app.zendesk.get_ticket`).",
+            "Plan public replies or internal notes with `plan_action` and execute via `execute_write`.",
+        ],
+        pitfalls: [
+            "Explicitly set `public: false` on `comment` when posting internal agent notes so drafts are not emailed to customers.",
+            "Always verify ticket `status` (`new`, `open`, `pending`, `solved`) before mutating.",
+        ],
+    },
+    asana: {
+        recommendedTools: [
+            "app.asana.list_tasks",
+            "app.asana.create_task",
+            "app.asana.update_task",
+        ],
+        workflowSteps: [
+            "Check Asana OAuth connection with `connection_status({ provider: \"asana\" })`.",
+            "Resolve `workspace` and `projects` GIDs via `execute_read` before creating tasks.",
+            "Use `plan_action` + `execute_write` with an `idempotency_key` for task creation and status updates.",
+        ],
+        pitfalls: [
+            "Asana `workspace`, `projects`, and `assignee` fields require string GIDs, not display names.",
+            "Date fields (`due_on`) must be formatted as `YYYY-MM-DD`.",
+        ],
+    },
+    posthog: {
+        recommendedTools: [
+            "app.posthog.list_projects",
+            "app.posthog.query_insights",
+            "app.posthog.list_feature_flags",
+        ],
+        workflowSteps: [
+            "Confirm PostHog connection via `connection_status({ provider: \"posthog\" })`.",
+            "Resolve `project_id` with `execute_read` (`app.posthog.list_projects`) before querying HogQL insights or feature flags.",
+            "Route any feature flag rollout changes through `plan_action` + `execute_write`.",
+        ],
+        pitfalls: [
+            "Always bound HogQL queries with a date range and `LIMIT` clause.",
+            "Feature flag percentage rollouts affect live production traffic and should require human approval.",
+        ],
+    },
+    sentry: {
+        recommendedTools: [
+            "app.sentry.list_issues",
+            "app.sentry.get_issue_events",
+            "app.sentry.update_issue",
+        ],
+        workflowSteps: [
+            "Verify Sentry OAuth connection via `connection_status({ provider: \"sentry\" })`.",
+            "Fetch unresolved issues and stacktraces via `execute_read` (`app.sentry.list_issues`).",
+            "Resolve or assign issues via `plan_action` + `execute_write`.",
+        ],
+        pitfalls: [
+            "Sentry `organization_slug` and `project_slug` are URL slugs, whereas `issue_id` is a numeric string.",
+        ],
+    },
+};
+const CURATED_WORKFLOW_SKILLS = [
+    {
+        slug: "changelog-generator",
+        name: "changelog-generator",
+        title: "Muxo Governed Changelog & Release Notes Generator",
+        description: "Generate customer-facing changelogs and release readiness briefs from GitHub commits/PRs, Linear/Jira issues, and publish to Notion or Slack under Muxo governance.",
+        category: "workflow",
+        lane: "hybrid",
+        providerSlug: "github",
+        providerName: "GitHub + Linear + Notion + Slack",
+        requiresMcp: ["muxo"],
+        mcpServerUrl: "https://api.muxo.ai/mcp",
+        recommendedTools: [
+            "app.github.list_repos",
+            "app.linear.list_issues",
+            "instant.composio.workbench",
+            "app.notion.create_page",
+            "app.slack.send_message",
+        ],
+        workflowSteps: [
+            "Check active connections for `github`, `linear`, `notion`, and `slack` via `connection_status`.",
+            "Fetch recent merged pull requests and closed issues using `execute_read` (`app.github.list_repos`, `app.linear.list_issues`).",
+            "Synthesize and categorize changes (Features, Fixes, Security, Breaking Changes) in `instant.composio.workbench`.",
+            "Create a governed plan (`plan_action`) and publish the release notes to Notion (`app.notion.create_page`) or Slack (`app.slack.send_message`) via `execute_write`.",
+        ],
+        pitfalls: [
+            "Filter out internal chore commits and redact internal ticket URLs or secret identifiers before publishing externally.",
+            "Always preview the formatted Markdown changelog via `plan_action` before posting to public or announcement channels.",
+        ],
+        sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
+    },
+    {
+        slug: "lead-research-assistant",
+        name: "lead-research-assistant",
+        title: "Muxo Governed Lead Research & CRM Enrichment Assistant",
+        description: "Research target accounts and leads using zero-OAuth Muxo Instant Web Search & Scraper, enrich company intelligence, and sync qualified leads into HubSpot or Salesforce.",
+        category: "workflow",
+        lane: "hybrid",
+        providerSlug: "hubspot",
+        providerName: "Muxo Instant Web + HubSpot / Salesforce",
+        requiresMcp: ["muxo"],
+        mcpServerUrl: "https://api.muxo.ai/mcp",
+        recommendedTools: [
+            "instant.web.search",
+            "instant.web.scrape",
+            "instant.composio.workbench",
+            "app.hubspot.search_contacts",
+            "app.hubspot.create_contact",
+        ],
+        workflowSteps: [
+            "Use `execute_read` with `instant.web.search` and `instant.web.scrape` (zero OAuth required) to gather verified company, funding, and role signals.",
+            "Score and normalize the lead profile using `instant.composio.workbench`.",
+            "Check existing CRM records via `execute_read({ tool_slug: \"app.hubspot.search_contacts\", ... })` to avoid duplicate entries.",
+            "Plan and write the enriched contact or deal via `plan_action` + `execute_write`.",
+        ],
+        pitfalls: [
+            "Always deduplicate by email domain and contact email in HubSpot/Salesforce before creating a new contact.",
+            "Do not store unverified scraped PII without attributing the public source URL in the CRM note.",
+        ],
+        sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
+    },
+    {
+        slug: "meeting-insights-analyzer",
+        name: "meeting-insights-analyzer",
+        title: "Muxo Governed Meeting Insights & Action Item Extractor",
+        description: "Analyze meeting transcripts and calendar threads, extract owner-assigned action items, file follow-up tasks in Linear/Jira, and post structured recaps to Slack or Notion.",
+        category: "workflow",
+        lane: "hybrid",
+        providerSlug: "slack",
+        providerName: "Google Calendar + Linear + Notion + Slack",
+        requiresMcp: ["muxo"],
+        mcpServerUrl: "https://api.muxo.ai/mcp",
+        recommendedTools: [
+            "app.googlecalendar.list_events",
+            "instant.composio.workbench",
+            "app.linear.create_issue",
+            "app.notion.create_page",
+            "app.slack.send_message",
+        ],
+        workflowSteps: [
+            "Retrieve meeting context and attendees via `execute_read` (`app.googlecalendar.list_events` or `app.notion.search`).",
+            "Extract structured decisions, risks, and owner-assigned action items in `instant.composio.workbench`.",
+            "Create follow-up tickets (`app.linear.create_issue`) and share the recap (`app.slack.send_message` / `app.notion.create_page`) via `plan_action` + `execute_write`.",
+        ],
+        pitfalls: [
+            "Resolve attendee names to canonical workspace user/team IDs before creating Linear or Jira issues.",
+            "Batch ticket creation carefully and include a deterministic `idempotency_key` per action item.",
+        ],
+        sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
+    },
+    {
+        slug: "invoice-organizer",
+        name: "invoice-organizer",
+        title: "Muxo Governed Invoice & Financial Reconciliation Organizer",
+        description: "Extract invoice details from Gmail threads, reconcile against Stripe customers/invoices, and archive structured financial records with cryptographic Muxo receipts.",
+        category: "workflow",
+        lane: "hybrid",
+        providerSlug: "stripe",
+        providerName: "Gmail + Stripe + Notion",
+        requiresMcp: ["muxo"],
+        mcpServerUrl: "https://api.muxo.ai/mcp",
+        recommendedTools: [
+            "app.gmail.fetch_emails",
+            "app.stripe.list_customers",
+            "app.stripe.create_invoice",
+            "instant.composio.workbench",
+        ],
+        workflowSteps: [
+            "Search billing emails via `execute_read({ tool_slug: \"app.gmail.fetch_emails\", input: { query: \"invoice OR receipt newer_than:30d\" } })`.",
+            "Normalize vendor, amount, currency, and due date in `instant.composio.workbench`.",
+            "Reconcile against Stripe records (`app.stripe.list_customers`) and route any invoice creation through `plan_action` + `execute_financial`.",
+            "Verify the HMAC-SHA256 + Ed25519 execution receipt via `get_receipt`.",
+        ],
+        pitfalls: [
+            "Always verify currency minor units (cents) and tax line items before calling `execute_financial`.",
+            "Use `reconcile_run` (`get_run_context({ action: \"reconcile_run\" })`) after financial runs to confirm zero drift.",
+        ],
+        sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
+    },
+    {
+        slug: "competitive-ads-extractor",
+        name: "competitive-ads-extractor",
+        title: "Muxo Governed Competitive Ads & Growth Intelligence Extractor",
+        description: "Extract competitor landing pages, ad positioning, and SEO signals using Muxo Instant Web Search & Scraper, compare against Meta Ads / Google Ads performance, and publish a growth brief.",
+        category: "workflow",
+        lane: "hybrid",
+        providerSlug: "metaads",
+        providerName: "Muxo Instant Web + Meta Ads + Google Ads",
+        requiresMcp: ["muxo"],
+        mcpServerUrl: "https://api.muxo.ai/mcp",
+        recommendedTools: [
+            "instant.web.search",
+            "instant.web.scrape",
+            "instant.seo.audit",
+            "app.metaads.get_insights",
+            "instant.composio.workbench",
+        ],
+        workflowSteps: [
+            "Run `execute_read` with `instant.web.search`, `instant.web.scrape`, and `instant.seo.audit` against competitor domains.",
+            "Synthesize messaging hooks, CTAs, and keyword gaps in `instant.composio.workbench`.",
+            "Optionally join with live `app.metaads.get_insights` or `app.googleads.get_campaign_metrics` and publish the growth brief to Notion or Slack.",
+        ],
+        pitfalls: [
+            "Respect public page rate limits and cap `maxChars` on `instant.web.scrape` to keep context windows lean.",
+            "Never auto-increase ad campaign budgets without an explicit `plan_action` approval preview.",
+        ],
+        sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
+    },
+    {
+        slug: "security-audit",
+        name: "security-audit",
+        title: "Muxo Governed Cloud, Endpoint & Workspace Security Audit",
+        description: "Audit HTTP security headers, TLS/CORS posture, workspace Cedar/OPA policies, and active OAuth connections with signed Muxo receipts.",
+        category: "workflow",
+        lane: "hybrid",
+        providerSlug: "security",
+        providerName: "Muxo Security + Cedar/OPA Governance",
+        requiresMcp: ["muxo"],
+        mcpServerUrl: "https://api.muxo.ai/mcp",
+        recommendedTools: [
+            "instant.security.headers_audit",
+            "get_organization",
+            "get_run_context",
+            "instant.composio.workbench",
+        ],
+        workflowSteps: [
+            "Audit public web endpoints using `execute_read({ tool_slug: \"instant.security.headers_audit\", input: { url: \"https://...\" } })`.",
+            "Inspect workspace Cedar/OPA guardrails and compiled policies via `get_organization({ action: \"export_cedar_opa\" })`.",
+            "Review recent blocked or high-risk runs via `get_run_context({ action: \"otel_traces\" })` and generate a remediation report.",
+        ],
+        pitfalls: [
+            "Never log or output raw BYOK keys or vault credentials when summarizing security findings.",
+            "Use `get_organization({ action: \"simulate_policy\" })` to test stricter guardrails before applying policy updates.",
+        ],
+        sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
+    },
+];
+export function transpileAwesomeClaudeSkillToMuxo(rawMarkdown, baseUrl = "https://api.muxo.ai") {
+    const cleanBase = baseUrl.replace(/\/+$/, "");
+    let out = rawMarkdown;
+    // Rewrite frontmatter MCP server requirement from rube/composio to muxo
+    out = out.replace(/requires:\s*\n\s*mcp:\s*\n\s*-\s*(?:rube|composio)/gi, "requires:\n  mcp:\n    - muxo");
+    out = out.replace(/https?:\/\/rube\.app\/mcp\/?/gi, `${cleanBase}/mcp`);
+    out = out.replace(/https?:\/\/connect\.composio\.dev\/mcp\/?/gi, `${cleanBase}/mcp`);
+    // Rewrite Rube / Composio meta-tools to Muxo governed 18-tool contract
+    const replacements = [
+        [/\bRUBE_SEARCH_TOOLS\b/g, "search_tools"],
+        [/\bCOMPOSIO_SEARCH_TOOLS\b/g, "search_tools"],
+        [/\bRUBE_GET_TOOL_SCHEMAS\b/g, "inspect_tool"],
+        [/\bCOMPOSIO_GET_TOOL_SCHEMAS\b/g, "inspect_tool"],
+        [
+            /\bRUBE_MANAGE_CONNECTIONS\b/g,
+            "start_connection + wait_for_connection",
+        ],
+        [
+            /\bCOMPOSIO_MANAGE_CONNECTIONS\b/g,
+            "start_connection + wait_for_connection",
+        ],
+        [/\bRUBE_MULTI_EXECUTE_TOOL\b/g, "plan_action + execute_write (or execute_read)"],
+        [
+            /\bCOMPOSIO_MULTI_EXECUTE_TOOL\b/g,
+            "plan_action + execute_write (or execute_read)",
+        ],
+        [/\bRUBE_REMOTE_WORKBENCH\b/g, "instant.composio.workbench"],
+        [/\bCOMPOSIO_REMOTE_WORKBENCH\b/g, "instant.composio.workbench"],
+        [/\bRube MCP\b/gi, "Muxo Governed MCP"],
+    ];
+    for (const [pattern, replacement] of replacements) {
+        out = out.replace(pattern, replacement);
+    }
+    return out;
+}
+function buildCatalogSkills(baseUrl = "https://api.muxo.ai") {
+    const cleanBase = baseUrl.replace(/\/+$/, "");
+    const mcpServerUrl = `${cleanBase}/mcp`;
+    const skills = [];
+    const seenSlugs = new Set();
+    const addSkill = (skill) => {
+        if (seenSlugs.has(skill.slug))
+            return;
+        seenSlugs.add(skill.slug);
+        skills.push(skill);
+    };
+    // 1. Curated workflow skills first
+    for (const wf of CURATED_WORKFLOW_SKILLS) {
+        addSkill({
+            ...wf,
+            mcpServerUrl,
+        });
+    }
+    // 2. Stripe Projects Cloud Infrastructure skills (Zero-OAuth enforced)
+    for (const item of STRIPE_PROJECTS_DEPLOYABLE_CATALOG) {
+        const prov = item.providerSlug.toLowerCase();
+        const canonicalSlug = resolveStripeProjectsCanonicalToolSlug(prov) || item.slug;
+        const provisioningSlug = `${prov}-provisioning`;
+        const definition = {
+            slug: provisioningSlug,
+            name: provisioningSlug,
+            title: `${item.providerName} Zero-OAuth Cloud Provisioning (${canonicalSlug})`,
+            description: `Provision and manage ${item.providerName} (${item.name}) directly through Muxo Stripe Projects (${canonicalSlug}) with zero OAuth handoff and automatic AES-256-GCM vault credential storage.`,
+            category: "cloud_infrastructure",
+            lane: "stripe_projects",
+            providerSlug: prov,
+            providerName: item.providerName,
+            requiresMcp: ["muxo"],
+            mcpServerUrl,
+            recommendedTools: [
+                canonicalSlug,
+                "get_run_context",
+                "execute_provisioning",
+            ],
+            workflowSteps: [
+                `Do NOT call \`start_connection\` or \`wait_for_connection\` for ${item.providerName} — ${item.providerName} is a Stripe Projects cloud infrastructure provider with zero OAuth required.`,
+                `Inspect the provisioning schema via \`inspect_tool({ slug: "${canonicalSlug}" })\`.`,
+                `Create a governed provisioning plan via \`plan_action({ tool_slug: "${canonicalSlug}", input: { resource_name: "prod-${prov}", plan: "${item.defaultPlan}" } })\`.`,
+                `Execute via \`execute_provisioning({ tool_slug: "${canonicalSlug}", plan_id: "<plan_id>", idempotency_key: "prov-${prov}-01" })\` — credentials are automatically encrypted into the workspace AES-256-GCM vault.`,
+            ],
+            pitfalls: [
+                `CRITICAL: Never route ${item.providerName} infrastructure requests through \`app.${prov}.*\` or OAuth handoff; always use \`${canonicalSlug}\` on the \`stripe_projects\` lane.`,
+                "Retrieve connection strings or API keys safely via `get_run_context({ action: \"vault\" })` rather than hardcoding secrets in prompts.",
+            ],
+            stripeProjectsOverride: {
+                enforced: true,
+                canonicalToolSlug: canonicalSlug,
+                reason: `${item.providerName} is provisioned natively via Stripe Projects (${item.upstreamSlug}) with zero OAuth handoff.`,
+            },
+            sourceRepo: "ComposioHQ/awesome-claude-skills + Muxo Stripe Projects Catalog",
+        };
+        addSkill(definition);
+        // Also register `<provider>-automation` alias for cloud providers that appear in awesome-claude-skills (e.g. supabase-automation, vercel-automation, cloudflare-automation, render-automation)
+        const automationAliasSlug = `${prov}-automation`;
+        if (isStripeProjectsExclusiveProvider(prov) ||
+            ["supabase", "vercel", "cloudflare", "turso", "neon", "upstash", "render", "netlify", "herenow"].includes(prov)) {
+            addSkill({
+                ...definition,
+                slug: automationAliasSlug,
+                name: automationAliasSlug,
+                title: `${item.providerName} Automation & Zero-OAuth Provisioning`,
+            });
+        }
+    }
+    // 3. Enterprise Connected App Automation skills (`<provider>-automation`)
+    for (const tk of ENTERPRISE_TOOLKITS_CATALOG) {
+        const prov = tk.slug.toLowerCase();
+        if (isStripeProjectsExclusiveProvider(prov)) {
+            continue;
+        }
+        const slug = `${prov}-automation`;
+        if (seenSlugs.has(slug))
+            continue;
+        const override = PROVIDER_SKILL_OVERRIDES[prov];
+        const sampleTools = override?.recommendedTools ||
+            (tk.sampleActions.length > 0
+                ? tk.sampleActions.map((act) => act.muxoSlug || `app.${prov}.${act.upstreamSlug.toLowerCase().replace(new RegExp(`^${prov}_`), "")}`)
+                : [`app.${prov}.list`, `app.${prov}.get`, `app.${prov}.create`]);
+        const workflowSteps = override?.workflowSteps || [
+            `Check active OAuth status via \`connection_status({ provider: "${prov}" })\`; if not connected, call \`start_connection({ provider: "${prov}" })\` and \`wait_for_connection({ provider: "${prov}" })\`.`,
+            `Discover and inspect ${tk.name} tools with \`search_tools({ query: "${prov}" })\` and \`inspect_tool({ slug: "${sampleTools[0]}" })\`.`,
+            `Execute read-only queries directly with \`execute_read\`; for any write, admin, financial, or destructive action, call \`plan_action\` first and then \`execute_<risk>\` with an \`idempotency_key\`.`,
+        ];
+        const pitfalls = override?.pitfalls || [
+            `Always inspect the input schema via \`inspect_tool\` before calling \`${sampleTools[0]}\` to ensure required IDs and pagination cursors match.`,
+            `Never bypass \`plan_action\` on mutating ${tk.name} operations — Muxo evaluates Cedar/OPA guardrails and generates an \`ApprovalImpactPreview\` before execution.`,
+            `Pass a deterministic \`idempotency_key\` on every write call so network retries never duplicate ${tk.name} records.`,
+        ];
+        addSkill({
+            slug,
+            name: slug,
+            title: `${tk.name} Governed Automation Skill`,
+            description: `${tk.description} Governed by Muxo MCP (${mcpServerUrl}) with OAuth connection management, Cedar/OPA policy checks, and signed execution receipts.`,
+            category: "app_automation",
+            lane: "composio_sdk",
+            providerSlug: prov,
+            providerName: tk.name,
+            requiresMcp: ["muxo"],
+            mcpServerUrl,
+            recommendedTools: sampleTools,
+            workflowSteps,
+            pitfalls,
+            sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
+        });
+    }
+    // 4. Ensure all curated PROVIDER_SKILL_OVERRIDES are registered even if not in ENTERPRISE_TOOLKITS_CATALOG
+    const DISPLAY_NAMES = {
+        metaads: "Meta Ads",
+        googleads: "Google Ads",
+        google_analytics: "Google Analytics (GA4)",
+        discord: "Discord",
+        airtable: "Airtable",
+        figma: "Figma",
+        zendesk: "Zendesk",
+        asana: "Asana",
+        posthog: "PostHog",
+        sentry: "Sentry",
+    };
+    for (const [prov, override] of Object.entries(PROVIDER_SKILL_OVERRIDES)) {
+        if (isStripeProjectsExclusiveProvider(prov))
+            continue;
+        const slug = `${prov}-automation`;
+        if (seenSlugs.has(slug))
+            continue;
+        const displayName = DISPLAY_NAMES[prov] || prov.charAt(0).toUpperCase() + prov.slice(1);
+        addSkill({
+            slug,
+            name: slug,
+            title: `${displayName} Governed Automation Skill`,
+            description: `Automate ${displayName} workflows through Muxo MCP (${mcpServerUrl}) with managed OAuth connections, Cedar/OPA parameter guardrails, and signed execution receipts.`,
+            category: "app_automation",
+            lane: "composio_sdk",
+            providerSlug: prov,
+            providerName: displayName,
+            requiresMcp: ["muxo"],
+            mcpServerUrl,
+            recommendedTools: override.recommendedTools,
+            workflowSteps: override.workflowSteps,
+            pitfalls: override.pitfalls,
+            sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
+        });
+    }
+    return skills;
+}
+export function listMuxoSkills(filter, baseUrl = "https://api.muxo.ai") {
+    const all = buildCatalogSkills(baseUrl);
+    if (!filter)
+        return all;
+    const cat = filter.category?.trim().toLowerCase();
+    const prov = filter.provider?.trim().toLowerCase();
+    const q = filter.query?.trim().toLowerCase();
+    return all.filter((skill) => {
+        if (cat && skill.category.toLowerCase() !== cat)
+            return false;
+        if (prov && skill.providerSlug.toLowerCase() !== prov)
+            return false;
+        if (q) {
+            const hay = `${skill.slug} ${skill.title} ${skill.description} ${skill.providerName} ${skill.recommendedTools.join(" ")}`.toLowerCase();
+            if (!hay.includes(q))
+                return false;
+        }
+        return true;
+    });
+}
+export function getMuxoSkill(slug, baseUrl = "https://api.muxo.ai") {
+    const clean = String(slug || "")
+        .trim()
+        .toLowerCase()
+        .replace(/\.md$/i, "");
+    if (!clean)
+        return null;
+    const all = buildCatalogSkills(baseUrl);
+    return (all.find((s) => s.slug.toLowerCase() === clean) ||
+        all.find((s) => s.category !== "workflow" && s.providerSlug.toLowerCase() === clean) ||
+        all.find((s) => s.providerSlug.toLowerCase() === clean) ||
+        null);
+}
+export function renderMuxoSkillMarkdown(slug, baseUrl = "https://api.muxo.ai") {
+    const skill = getMuxoSkill(slug, baseUrl);
+    if (!skill)
+        return null;
+    const cleanBase = baseUrl.replace(/\/+$/, "");
+    const overrideBanner = skill.stripeProjectsOverride?.enforced
+        ? [
+            "",
+            "## Zero-OAuth Cloud Infrastructure Rule (Stripe Projects Override)",
+            `- **Mandatory Tool**: \`${skill.stripeProjectsOverride.canonicalToolSlug}\` (\`stripe_projects\` lane)`,
+            `- **Why**: ${skill.stripeProjectsOverride.reason}`,
+            "- **Rule**: Never call `start_connection` or `app.*` OAuth tools for this provider. Provisioning and SQL/deployment run directly via `plan_action` -> `execute_provisioning`.",
+        ].join("\n")
+        : "";
+    const rawMd = `---
+name: ${skill.slug}
+description: "${skill.description.replace(/"/g, '\\"')}"
+requires:
+  mcp:
+    - muxo
+---
+
+# ${skill.title}
+
+${skill.description}
+
+## Governed MCP Connection
+- **MCP Server**: \`${cleanBase}/mcp\` (Streamable HTTP, \`Bearer mk_live_...\`)
+- **Provider Lane**: \`${skill.lane}\` (\`${skill.providerName}\`)
+- **Skill URI**: \`skill://muxo/${skill.slug}/SKILL.md\` / \`muxo://skills/${skill.slug}\`
+${overrideBanner}
+
+## Recommended Muxo Tool Slugs
+${skill.recommendedTools.map((t) => `- \`${t}\``).join("\n")}
+
+## Step-by-Step Governed Execution Plan
+${skill.workflowSteps.map((step, idx) => `${idx + 1}. ${step}`).join("\n")}
+
+## Known Pitfalls & Parameter Guardrails
+${skill.pitfalls.map((p) => `- ${p}`).join("\n")}
+
+## Multi-Tool Chaining & Workbench
+- For multi-step data joins, filtering, or payload transformation across tools, invoke \`execute_read({ tool_slug: "instant.composio.workbench", input: { code: "...", thought: "..." } })\`.
+- Every mutating execution returns a signed \`ExecutionReceipt\` with \`businessSummary\` and can be verified or reconciled via \`get_run_context({ action: "reconcile_run", run_id: "<run_id>" })\`.
+`;
+    return transpileAwesomeClaudeSkillToMuxo(rawMd, cleanBase);
+}
+const FEATURED_MCP_SKILL_SLUGS = [
+    "github-automation",
+    "gmail-automation",
+    "slack-automation",
+    "notion-automation",
+    "linear-automation",
+    "hubspot-automation",
+    "salesforce-automation",
+    "shopify-automation",
+    "metaads-automation",
+    "stripe-automation",
+    "supabase-provisioning",
+    "vercel-provisioning",
+    "turso-provisioning",
+    "changelog-generator",
+    "lead-research-assistant",
+    "security-audit",
+];
+export function getProviderSkillHint(toolOrProviderSlug, baseUrl = "https://api.muxo.ai") {
+    const raw = String(toolOrProviderSlug || "").trim().toLowerCase();
+    if (!raw)
+        return null;
+    const cleanBase = baseUrl.replace(/\/+$/, "");
+    let candidateProvider = raw;
+    if (raw.startsWith("app.") || raw.startsWith("resource.") || raw.startsWith("instant.")) {
+        const parts = raw.split(".");
+        if (parts.length >= 2) {
+            candidateProvider = parts[1];
+        }
+    }
+    const skill = getMuxoSkill(raw, cleanBase) ||
+        getMuxoSkill(`${candidateProvider}-provisioning`, cleanBase) ||
+        getMuxoSkill(`${candidateProvider}-automation`, cleanBase) ||
+        getMuxoSkill(candidateProvider, cleanBase);
+    if (!skill)
+        return null;
+    return {
+        slug: skill.slug,
+        title: skill.title,
+        category: skill.category,
+        lane: skill.lane,
+        mcpResourceUri: `muxo://skills/${skill.slug}`,
+        skillUrl: `${cleanBase}/skills/${skill.slug}/SKILL.md`,
+        recommendedTools: skill.recommendedTools,
+        pitfalls: skill.pitfalls,
+        ...(skill.stripeProjectsOverride
+            ? { stripeProjectsOverride: skill.stripeProjectsOverride }
+            : {}),
+    };
+}
+export function buildMuxoMcpSkillBundles(baseUrl = "https://api.muxo.ai", options) {
+    const skills = options?.includeAll
+        ? listMuxoSkills(undefined, baseUrl)
+        : FEATURED_MCP_SKILL_SLUGS.map((s) => getMuxoSkill(s, baseUrl)).filter((s) => Boolean(s));
+    return skills.map((skill) => {
+        const content = renderMuxoSkillMarkdown(skill.slug, baseUrl) || `# ${skill.title}\n`;
+        const uri = `skill://muxo/${skill.slug}/SKILL.md`;
+        return {
+            name: skill.slug,
+            description: skill.description,
+            version: MUXO_VERSION,
+            uri,
+            frontmatter: {
+                name: skill.slug,
+                description: skill.description,
+            },
+            content,
+            files: [
+                {
+                    path: "SKILL.md",
+                    uri,
+                    mimeType: "text/markdown",
+                    content,
+                },
+            ],
+        };
+    });
+}