@v587d/capital-generation 2.7.0 → 2.7.2

package/selected-skills/InvestSkill/SECURITY.md

@@ -0,0 +1,232 @@
+# Security Policy
+
+InvestSkill takes security seriously. This document outlines our security practices and how to report vulnerabilities responsibly.
+
+## Security Practices
+
+### What We Protect
+
+- **User data**: None collected. InvestSkill runs locally/client-side only.
+- **Code**: Open source, regularly reviewed, well-tested
+- **Dependencies**: Minimal (Node.js standard library only)
+- **Secrets**: No API keys stored in repository
+
+### What to Know
+
+> ⚠️ **Important**: InvestSkill provides analysis frameworks, not trading signals. Use analysis independently and consult financial advisors before trading.
+
+### No Data Collection
+
+InvestSkill:
+- ✅ Runs completely locally (all processing client-side)
+- ✅ Stores nothing on remote servers
+- ✅ Does not track users
+- ✅ Does not send data externally
+- ✅ Works offline (except Claude Code API calls)
+
+---
+
+## Reporting a Vulnerability
+
+### Security Issues
+
+If you discover a security vulnerability, **do NOT open a public issue**.
+
+**Instead, email**: security@example.com (or contact repo maintainer privately)
+
+Include:
+- Vulnerability type (e.g., injection, credential exposure)
+- Location in code (file, line number)
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if available)
+
+**Response timeline**: We aim to respond within 48 hours.
+
+### Privacy Issues
+
+If you have privacy concerns about how InvestSkill processes data:
+1. Review [Privacy](#privacy) section
+2. Check [Data practices](#what-we-protect)
+3. Contact maintainer if concerned
+
+---
+
+## Code Security
+
+### Dependency Policy
+
+- **Minimal dependencies**: We use only Node.js built-ins
+- **No npm packages**: Reduces attack surface
+- **Version pinning**: All versions locked to specific releases
+- **Regular audits**: Code reviewed before each release
+
+### Code Review
+
+All commits:
+- Reviewed before merge
+- Tested with full test suite
+- Validated across all platforms
+- Follow security best practices
+
+### Input Validation
+
+InvestSkill:
+- Doesn't accept or validate user credentials
+- Doesn't process payment information
+- Validates file formats (JSON, markdown)
+- Escapes output to prevent injection
+
+---
+
+## Supported Versions
+
+| Version | Status | Support |
+|---------|--------|---------|
+| 1.4.0 | ✅ Current | Full support |
+| 1.3.0 | ⚠️ Legacy | Critical fixes only |
+| 1.2.0 & earlier | ❌ Unsupported | No support |
+
+**Note**: Update to latest version for security patches and improvements.
+
+---
+
+## Security Checklist for Users
+
+Before using InvestSkill:
+
+- [ ] Running latest version (v1.4.0+)
+- [ ] Using trusted Claude Code/Cursor/platform version
+- [ ] No credentials or API keys stored in repository
+- [ ] Not sharing analysis with untrusted parties
+- [ ] Understand: Framework = Analysis tool, not trading advice
+
+---
+
+## Compliance & Standards
+
+### What We Follow
+
+- ✅ MIT License (open source, permissive)
+- ✅ OWASP Top 10 (security standards)
+- ✅ No GDPR concerns (no user data)
+- ✅ No HIPAA (not medical/healthcare)
+- ✅ No PCI-DSS (no payment processing)
+
+### What We Don't Do
+
+- ❌ Store personally identifiable information (PII)
+- ❌ Process payment information
+- ❌ Track user behavior
+- ❌ Require authentication
+- ❌ Connect to external APIs without user knowledge
+
+---
+
+## Incident Response
+
+If a security issue is discovered:
+
+1. **Report privately** (don't disclose publicly)
+2. **Assessment** (we evaluate severity)
+3. **Fix** (we develop and test a patch)
+4. **Release** (security patch published)
+5. **Announce** (security advisory posted)
+
+---
+
+## Responsible Disclosure
+
+We appreciate researchers and security professionals who discover issues.
+
+**Responsible disclosure means:**
+- ✅ Report privately first
+- ✅ Give us time to patch (typically 90 days)
+- ✅ Not sharing vulnerability publicly before patch
+- ✅ Not accessing systems/data you're not authorized to access
+
+**What NOT to do:**
+- ❌ Public disclosure before patch available
+- ❌ Unauthorized access or testing
+- ❌ Data extraction or exfiltration
+- ❌ Ransom or extortion
+
+---
+
+## FAQ
+
+### Is my data safe?
+
+**Yes.** InvestSkill:
+- Doesn't store any user data
+- Doesn't send data to external servers
+- Runs completely locally
+- Doesn't track usage
+
+### Do you sell my data?
+
+**No.** We don't collect data. There's nothing to sell.
+
+### Is the code trustworthy?
+
+**Open source** means the code is publicly auditable:
+- Anyone can review the code
+- Vulnerabilities are visible
+- Community can report issues
+- All changes tracked in git history
+
+### What platforms are safe to use?
+
+All InvestSkill platforms are equally safe:
+- Claude Code (official plugin)
+- Cursor IDE (uses local rules)
+- Gemini CLI (local prompts)
+- GitHub Copilot (VS Code, JetBrains)
+- Universal (copy-paste into any LLM)
+
+### What if I find a vulnerability?
+
+1. Email maintainer privately (don't post publicly)
+2. Include: type, location, steps to reproduce
+3. Wait for patch before public disclosure
+4. We'll issue security advisory and credit you
+
+---
+
+## Security Contact
+
+**Email**: yennanliu (at) gmail (dot) com or open private security discussion
+
+**Response time**: Within 48 hours
+
+**Please do NOT**:
+- Open public GitHub issues for vulnerabilities
+- Tweet/post vulnerability details publicly
+- Attempt unauthorized access
+
+---
+
+## Resources
+
+- [OWASP Top 10](https://owasp.org/www-project-top-ten/) — Security standards
+- [Responsible Disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure) — Best practices
+- [GitHub Security](https://github.blog/2021-12-01-how-github-keeps-your-data-safe/) — Platform security
+
+---
+
+## Changelog
+
+### Security Updates
+
+- **v1.4.0** (2026-02-27): Initial security policy
+- Future updates tracked here
+
+---
+
+<div align="center">
+
+### Security is Everyone's Responsibility
+
+Thank you for helping keep InvestSkill safe! 🔒
+
+</div>

package/selected-skills/InvestSkill/TODO.md

@@ -0,0 +1,28 @@
+# TODO — InvestSkill
+
+The curated top five. Everything else — with rationale, effort estimates, and release mapping — lives in the bilingual roadmap: [doc/IMPROVEMENT-ROADMAP.md](doc/IMPROVEMENT-ROADMAP.md) · [繁體中文](doc/IMPROVEMENT-ROADMAP-zh-TW.md). Progress against the roadmap's ten headline items is tracked in its §0 table.
+
+The previous long-form backlog (last updated 2026-02-24) is archived at [doc/archive/TODO-2026-02.md](doc/archive/TODO-2026-02.md).
+
+## Top 5
+
+1. **`full-report --depth comprehensive` runs every framework** — add the frameworks missing since v1.8 (`bear-case` above all) plus the new Tier 1 skills where they fit, swap the alias modules for their targets, add `--skip <skill>`. → roadmap §4.3
+2. **`--lang zh-TW` on every skill + a machine-readable JSON footer** — the remaining two items of the skill contract (§4.1); the footer is what lets `eval-skills.js` and `result-validator` parse results without regex on box-drawing characters.
+3. **Learning lessons: Macro & the Fed Cycle, Options for Stock Investors** — the two §5.1 lessons still open (Lesson 5 has the material); plus self-check quizzes for Lessons 1–8 and the printable cheat sheet (§5.4). → roadmap §5.1, §5.4
+4. **Non-US Investor Guide page** — Lesson 11's non-US section is the core; the page adds brokers, FX, and account opening (§5.4). Glossary: the ~16 filing / technical terms still missing (§5.3).
+5. **Tier 2 skills as demand shows** — `forensic-accounting`, `proxy-governance`, `trade-postmortem` (closed `thesis-tracker` files are its input), `investment-policy`. → roadmap §3.2
+
+## Recently shipped from the roadmap
+
+- Stale counts fixed and historical docs archived (§7)
+- Skill contract enforced on every analysis skill — `Data & Sources` header, Data Verification gate, Thesis Invalidation — with `scripts/check-skill-contract.js` in `npm test` (§4.1, §6.3)
+- The three redirect skills reclassified as aliases; honest count of 24 frameworks (§4.2)
+- `thesis-tracker` (§3.1)
+- The rest of Tier 1 — `etf-analysis`, `earnings-preview`, `tax-lens` (with `--non-us`), `risk-stress-test`, `learning-coach` (§3.1)
+- Learning track Part II — Lessons 9–13 (Before Your First Trade · ETFs · Taxes & Accounts incl. non-US · Earnings Season · Psychology & Process), the "When the Answer Is No" case study, self-check quizzes, glossary 44 → 76 (§5.1–5.3; see `doc/LEARNING-GAP-REVIEW.md`)
+- `fact-check` — claim-level verification against primary sources, recomputation, corrected report with inline citations and References; Verification Score feeds `result-validator` Data Quality (not on the roadmap; added on request)
+- `scripts/sync-prompts.js`, `scripts/new-skill.js`, `scripts/eval-skills.js`, `scripts/lib/signal-block.js` (§6.1, §6.2, §6.4, §6.11)
+
+## Deliberately not planned
+
+Live-data / broker APIs, crypto and forex, ML price prediction, and changes to the signal block — see roadmap §9 for why.

package/selected-skills/InvestSkill/UPSTREAM.md

@@ -0,0 +1,62 @@
+# Upstream Record
+
+- Project: InvestSkill（上游以 Claude Code plugin `us-stock-analysis` 的形式发布）
+- Repository: https://github.com/yennanliu/InvestSkill
+- Upstream commit: `c3f2a17cd2b6ac9731beb3b5739592446ad6f556`（main，2026-10-09）
+  - 这颗 HEAD 是上游机器人的 daily site review 提交；最后一次**内容**提交是
+    `113527fc7e44a723513dc2840becca7ab6eba823`（2026-09-25，PR #32 prompt-audit），同日打 `v1.12.0`。
+    catalog 的 `lastCommit` 记的是后者。
+- License: MIT；`LICENSE` 为上游原件（`Copyright (c) 2026 yennanliu`），未改写。
+- Imported content: 该 commit 的完整仓库快照，只移除上游自己的 `.gitignore`（见下）。
+  34 颗 skill 在 `plugins/us-stock-analysis/skills/<name>/SKILL.md`；`scripts/`、`prompts/`、
+  `site/`、`qa/`、`doc/`、`data/`、`.github/` 作为可审查材料保留，intake 与 activation 都不执行它们。
+- Local modifications（三类，逐条可复核；口径与理由见 `docs/dev/selected-skills.md` §8.6 的接入必查清单）：
+  1. **34 颗 `SKILL.md` 的 frontmatter 第一键补 `name: <目录名>`。** DSH filesystem provider 要求
+     frontmatter 同时有 `name` 与 `description`，缺 `name` 的文件是**静默跳过**（只 warn）——原样收录
+     时 34 颗一颗都不会被发现。上游依赖 Claude Code 从目录名推导，所以它自己不需要这一行。
+  2. **删除上游的 `.gitignore`。** 它在宿主仓库里会静默挡掉 `site/build/`：上游用 `build/` 这条目录
+     规则配上 `!site/build/*.js` 的反向白名单，而 git 在被排除的父目录之下无法再 include——留着一个
+     不完整、且与所钉 commit 不一致的快照，比少三个文件更糟。vendored 快照不把 ignore 规则带进宿主仓库。
+  3. **28 颗 catalog skill 的取数口径改写**（168 行删 / 161 行增，全部落在下面五类句子上；
+     不进 catalog 的 6 颗原文未动）。上游正文写给"什么工具都在手边"的宿主，与本插件的取数边界冲突：
+     - `1. **Fetch …** — use web search or ask the user for …` → 改为"走宿主自己的取数通道；
+       角色分流的宿主里把标的、字段、as-of 日期写进委派 brief 交出去"（24 处，含 economics / etf /
+       sector / risk-stress 的变体与 fact-check 的"只在主张需要时才取现价"）。
+     - `4. **Flag stale data explicitly** … display this warning before proceeding` 与
+       `> ⚠️ **Live data unavailable.** … training-data estimates …` → 改成 `**Stop on missing data**`：
+       点名缺哪些字段、该字段下的分析停止，不回填（23 + 25 处）。
+     - 收尾句 `Never silently substitute training-data estimates … ask the user to paste …` → 改成
+       "取数是宿主数据通道的职责（委派）；只有宿主完全没有检索路径时才谈用户粘贴"（24 处）。
+     - 出处块 `Retrieval: <pasted by user | web/tool retrieval | model memory>` → 去掉 `model memory`
+       这一档、加 `delegated retrieval`（27 处）；配套那条"`model memory` 配 `Confidence: LOW`"改成
+       "记忆不是取数途径：没取到的数字报缺，不写进这一栏"（27 处）。`result-validator` 的评分口径同步改，
+       `learning-coach` 检测的"没有检索路径"随之改名。
+     - 无密钥 EDGAR 取数阶梯（`10k-digest` / `financial-report-analyst` / `fact-check`）：A 档从
+       "宿主能抓就自己抓"改成"走宿主检索通道＝委派"；B 档只在"宿主完全没有检索路径"时谈用户粘贴；
+       C 档从"设成 model memory + LOW 继续"改成"缺的就缺着"。**删掉两处 `node scripts/fetch-*.js`
+       指令**——`scripts/` 不进发布包，根角色也没有 shell（AGENTS.md §1.6）。
+     分析结论、方法论、评分表、输出模板与其余正文**一字未改**。
+  复核方法：`git clone` 所钉 commit 后 `diff -r`，差异只应包含以上三类；
+  `test/selected-skills-content.test.mjs` 扫正文**结果**、本文件记**理由**，两边任一漂回去都会红。
+- Catalog scope: 28 颗进入 `selected-skills/catalog.js`，六颗留在快照里但不进可选清单：
+  - `fundamental-analysis`、`dcf-valuation`、`research-bundle`：上游自己标注的 alias 残片
+    （`scripts/lib/skill-registry.js` 的 `ALIAS_SKILLS`），正文已声明分别并入 `stock-eval` /
+    `stock-valuation` / `full-report`，勾到它们只会拿到一份速查表而不是在维护的完整模块。
+  - `full-report`：上游编排 skill（跑多个模块再合成总分），与 `china-stock-research-orchestrator`
+    被排除是同一条理由——本插件的角色路由是单点决策。
+  - `report-generator`：上游的输出口（把别的 skill 结果渲染成 HTML/PDF 存进 `output/`），与已删除并
+    禁止恢复的报告交付链路冲突（`AGENTS.md` §7）。
+  - `chart-master`：教 Agent 自己产出 HTML/Chart.js 与 Mermaid 图形，出图一律走 `render_chart`
+    且只有 `visualization_specialist` 持有（`AGENTS.md` §6.1）。
+- Maintenance snapshot（checked 2026-10-10）：251 次提交；近 90 天 47 次非机器人提交、近 180 天 111 次；
+  最新 release `v1.12.0`（2026-09-25）。维护活跃，因此标 `experimental`。
+  See [GitHub commit history](https://github.com/yennanliu/InvestSkill/commits/main/).
+- Runtime status: `experimental` / 显式实验。默认全关，只在使用者于「插件」→ Capital Generation →「配置」
+  逐格打开后，对**之后新建**的 Capital 根 Agent 可见；子 Agent 不继承。
+- Financial boundary: 正文口径天生是美股（SEC EDGAR / Form 4 / 13F、FRED、美国税制），并且多模块给出
+  0–10 打分与分批仓位的写法。本插件不提供投资建议：每条 catalog 的 `riskNote` 写明打分是自洽度信号、
+  股数区间是推演练习，不是订单，也不承诺表现。
+- Data-fetch assumption: 每颗 skill 开篇都要求 Agent 先用网页搜索取实时报价。**这不授予新权限**——
+  取数仍受本插件的角色与工具边界约束（主 Agent 委派、原始 rows 不出工具层），skill 正文只是方法论材料。
+- Review status: 收录供使用者自行实验，不构成对任何金融方法的背书。复核前先读上面的 Catalog scope，
+  确认排除项没有被人顺手加回。

package/selected-skills/InvestSkill/install.sh

@@ -0,0 +1,212 @@
+#!/usr/bin/env bash
+#
+# InvestSkill installer — wires the InvestSkill analysis frameworks into your AI coding agent.
+#
+#   curl -fsSL https://raw.githubusercontent.com/yennanliu/InvestSkill/main/install.sh | bash -s -- -a claude
+#
+# There is no runtime and nothing is compiled: the script copies markdown prompts
+# into your project and adds a small pointer block to your agent's config file.
+#
+set -euo pipefail
+
+REPO="yennanliu/InvestSkill"
+REF="main"
+AGENT="claude"
+DIR="$PWD"
+GLOBAL=0
+
+MARK_BEGIN="<!-- InvestSkill:begin -->"
+MARK_END="<!-- InvestSkill:end -->"
+
+AGENTS="claude cursor copilot gemini codex opencode any"
+
+# ── output helpers ───────────────────────────────────────────────────────────
+if [ -t 1 ]; then
+  B=$'\033[1m'; DIM=$'\033[2m'; GRN=$'\033[32m'; RED=$'\033[31m'; RST=$'\033[0m'
+else
+  B=''; DIM=''; GRN=''; RED=''; RST=''
+fi
+say()  { printf '%s\n' "$*"; }
+ok()   { printf '%s✓%s %s\n' "$GRN" "$RST" "$*"; }
+info() { printf '%s·%s %s\n' "$DIM" "$RST" "$*"; }
+die()  { printf '%s✗%s %s\n' "$RED" "$RST" "$*" >&2; exit 1; }
+
+usage() {
+  cat <<EOF
+${B}InvestSkill installer${RST}
+
+  curl -fsSL https://raw.githubusercontent.com/$REPO/main/install.sh | bash -s -- -a AGENT
+
+${B}Options${RST}
+  -a AGENT   Target agent: $AGENTS  (default: claude)
+  -d DIR     Install into DIR (default: current directory)
+  -g         Install for the user, not one project (\$HOME instead of DIR)
+  -r REF     Branch or tag to install from (default: main)
+  -l         List supported agents and where each one is wired
+  -h         Show this help
+
+${B}What it installs${RST}
+  .investskill/prompts/*.md   every framework (and alias), as plain markdown
+  plus one agent-native entry point (a skill, a rule, or an instructions block)
+EOF
+}
+
+list_agents() {
+  cat <<EOF
+${B}Agent            Installs to${RST}
+claude           .claude/skills/<skill>/SKILL.md   (slash commands)
+cursor           .cursor/rules/investskill.mdc
+copilot          .github/copilot-instructions.md
+gemini           GEMINI.md
+codex            AGENTS.md
+opencode         AGENTS.md
+any              .investskill/prompts/ only (paste into any LLM)
+EOF
+}
+
+while getopts ":a:d:r:glh" opt; do
+  case "$opt" in
+    a) AGENT="$OPTARG" ;;
+    d) DIR="$OPTARG" ;;
+    r) REF="$OPTARG" ;;
+    g) GLOBAL=1 ;;
+    l) list_agents; exit 0 ;;
+    h) usage; exit 0 ;;
+    :) die "Option -$OPTARG needs a value. Try -h." ;;
+    \?) die "Unknown option -$OPTARG. Try -h." ;;
+  esac
+done
+
+AGENT=$(printf '%s' "$AGENT" | tr '[:upper:]' '[:lower:]')
+case " $AGENTS " in
+  *" $AGENT "*) ;;
+  *) die "Unsupported agent '$AGENT'. Supported: $AGENTS" ;;
+esac
+
+[ "$GLOBAL" -eq 1 ] && DIR="$HOME"
+command -v curl >/dev/null 2>&1 || die "curl is required."
+command -v tar  >/dev/null 2>&1 || die "tar is required."
+mkdir -p "$DIR" || die "Cannot write to $DIR"
+
+# ── fetch ────────────────────────────────────────────────────────────────────
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+say ""
+say "${B}InvestSkill${RST} → $AGENT ${DIM}($DIR)${RST}"
+info "Downloading ${REPO}@${REF} …"
+curl -fsSL "https://codeload.github.com/$REPO/tar.gz/$REF" \
+  | tar -xzf - -C "$TMP" --strip-components=1 \
+  || die "Download failed. Check the network, or the -r ref '$REF'."
+[ -d "$TMP/prompts" ] || die "Archive has no prompts/ directory — wrong ref?"
+
+# ── always: the frameworks themselves ────────────────────────────────────────
+PROMPTS_REL=".investskill/prompts"
+mkdir -p "$DIR/$PROMPTS_REL"
+cp "$TMP/prompts/"*.md "$DIR/$PROMPTS_REL/"
+# report-generator is an output tool and fundamental-analysis / dcf-valuation /
+# research-bundle are alias stubs that redirect to the skill that absorbed them
+# — all are installed, none is counted as an analysis framework. Keep this list
+# in sync with ALIAS_SKILLS in scripts/lib/skill-registry.js (tests check it).
+COUNT=0
+ALIASES=0
+for f in "$DIR/$PROMPTS_REL"/*.md; do
+  # Bash leaves an unmatched glob literal — skip it rather than counting it.
+  [ -e "$f" ] || continue
+  case "$(basename "$f" .md)" in
+    report-generator) ;;
+    fundamental-analysis|dcf-valuation|research-bundle) ALIASES=$((ALIASES + 1)) ;;
+    *) COUNT=$((COUNT + 1)) ;;
+  esac
+done
+ok "$COUNT analysis frameworks (+ $ALIASES aliases + report-generator) → $PROMPTS_REL/"
+
+skill_names() { ls -1 "$TMP/prompts" | sed 's/\.md$//' | sort; }
+
+# A compact, agent-native pointer block. Kept short on purpose: the detail
+# lives in the prompt files, which the agent reads on demand.
+pointer_block() {
+  say "$MARK_BEGIN"
+  say "## InvestSkill — investment analysis frameworks"
+  say ""
+  say "This project includes $COUNT structured US-stock analysis frameworks in \`$PROMPTS_REL/\`."
+  say "When the user asks for investment analysis, read the matching framework file and"
+  say "follow it exactly — its output contract, tables, and Investment Signal Block."
+  say ""
+  say "Available frameworks:"
+  skill_names | sed 's|^|- `'"$PROMPTS_REL"'/|; s|$|.md`|'
+  say ""
+  say "Example: *\"Evaluate AAPL\"* → read \`$PROMPTS_REL/stock-eval.md\` and apply it to AAPL."
+  say "Educational frameworks only — not financial advice."
+  say "$MARK_END"
+}
+
+# Append the block once; re-running replaces nothing and duplicates nothing.
+wire_into() {
+  target="$DIR/$1"
+  mkdir -p "$(dirname "$target")"
+  if [ -f "$target" ] && grep -qF "$MARK_BEGIN" "$target"; then
+    info "$1 already wired — left untouched"
+    return
+  fi
+  if [ -f "$target" ]; then
+    { printf '\n'; pointer_block; } >>"$target"
+    ok "Appended InvestSkill block → $1"
+  else
+    pointer_block >"$target"
+    ok "Created $1"
+  fi
+}
+
+# ── per-agent wiring ─────────────────────────────────────────────────────────
+case "$AGENT" in
+  claude)
+    src="$TMP/plugins/us-stock-analysis/skills"
+    [ -d "$src" ] || die "Archive has no skills/ directory — wrong ref?"
+    mkdir -p "$DIR/.claude/skills"
+    cp -R "$src/." "$DIR/.claude/skills/"
+    ok "$(ls -1 "$src" | wc -l | tr -d ' ') skills → .claude/skills/"
+    say ""
+    say "Next: run ${B}claude${RST} → ${B}\"Evaluate AAPL with the stock-eval skill\"${RST}"
+    info "Prefer the marketplace? /plugin marketplace add $REPO"
+    ;;
+  cursor)
+    mkdir -p "$DIR/.cursor/rules"
+    {
+      say "---"
+      say "description: InvestSkill — US stock analysis frameworks"
+      say "globs: [\"**/*.md\"]"
+      say "alwaysApply: false"
+      say "---"
+      say ""
+      pointer_block
+    } >"$DIR/.cursor/rules/investskill.mdc"
+    ok "Created .cursor/rules/investskill.mdc"
+    say ""
+    say "Next: open the project in Cursor → ${B}@$PROMPTS_REL/stock-eval.md Evaluate Apple${RST}"
+    ;;
+  copilot)
+    wire_into ".github/copilot-instructions.md"
+    say ""
+    say "Next: in Copilot Chat → ${B}#file:$PROMPTS_REL/stock-eval.md Evaluate Apple${RST}"
+    ;;
+  gemini)
+    wire_into "GEMINI.md"
+    say ""
+    say "Next: run ${B}gemini${RST} → ${B}@$PROMPTS_REL/stock-eval.md Evaluate Apple${RST}"
+    ;;
+  codex|opencode)
+    wire_into "AGENTS.md"
+    say ""
+    say "Next: start $AGENT in this directory → ${B}Evaluate AAPL using the stock-eval framework${RST}"
+    ;;
+  any)
+    say ""
+    say "Next: paste a framework into any LLM →"
+    say "  ${B}cat $PROMPTS_REL/stock-eval.md${RST}"
+    ;;
+esac
+
+say ""
+info "Docs: https://yennj12.js.org/InvestSkill/ · Uninstall: rm -rf $PROMPTS_REL"
+say ""

package/selected-skills/InvestSkill/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "investskill",
+  "version": "1.12.0",
+  "description": "Professional investment analysis frameworks for US stock markets — works with Claude Code, Cursor, Gemini CLI, GitHub Copilot, and any AI assistant",
+  "main": "scripts/test-skills.js",
+  "scripts": {
+    "test": "node scripts/test-skills.js && node scripts/check-skill-contract.js --quiet && node scripts/sync-prompts.js --check && node scripts/test-edgar.js && node scripts/test-install.js",
+    "test:contract": "node scripts/check-skill-contract.js",
+    "sync:prompts": "node scripts/sync-prompts.js",
+    "sync:prompts:check": "node scripts/sync-prompts.js --check",
+    "new:skill": "node scripts/new-skill.js",
+    "eval:skills": "node scripts/eval-skills.js",
+    "fetch:edgar": "node scripts/fetch-edgar.js",
+    "fetch:fundamentals": "node scripts/fetch-fundamentals.js",
+    "test:skills": "node scripts/test-skills.js",
+    "test:install": "node scripts/test-install.js",
+    "test:edgar": "node scripts/test-edgar.js",
+    "validate": "node scripts/validate-prompts.js",
+    "validate:prompts": "node scripts/validate-prompts.js",
+    "build:site": "node site/build/build-site.js",
+    "check:links": "node site/build/build-site.js && node scripts/check-links.js",
+    "review": "node scripts/site-review.js",
+    "verify": "node scripts/setup-verify.js",
+    "verify:setup": "node scripts/setup-verify.js",
+    "pre-release-check": "node scripts/pre-release-check.js",
+    "pre-release": "node scripts/pre-release-check.js && node scripts/validate-prompts.js && npm test",
+    "release": "node scripts/release-interactive.js",
+    "release:dry-run": "node scripts/release-dry-run.js",
+    "publish:cursor": "node scripts/publish-cursor-rules.js",
+    "publish:gemini": "node scripts/publish-gemini.js",
+    "publish:release-notes": "node scripts/generate-platform-release-notes.js",
+    "record:deploy": "node scripts/record-deploy.js",
+    "integration-tests": "node scripts/integration-tests.js",
+    "integration-tests:verbose": "node scripts/integration-tests.js --verbose",
+    "notify:release": "node scripts/notify-release.js"
+  },
+  "keywords": [
+    "investment",
+    "stock-analysis",
+    "valuation",
+    "fundamental-analysis",
+    "technical-analysis",
+    "portfolio",
+    "finance",
+    "claude-code",
+    "cursor",
+    "gemini-cli",
+    "github-copilot",
+    "prompts"
+  ],
+  "author": "yennanliu",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/yennanliu/InvestSkill"
+  },
+  "homepage": "https://github.com/yennanliu/InvestSkill",
+  "bugs": {
+    "url": "https://github.com/yennanliu/InvestSkill/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}