agentic-awesome-skills 14.3.1 → 14.4.0

package/README.md

@@ -1,9 +1,9 @@
-<!-- registry-sync: version=14.3.1; skills=1948; stars=43042; updated_at=2026-07-13T08:55:06+00:00 -->
+<!-- registry-sync: version=14.4.0; skills=1958; stars=43124; updated_at=2026-07-14T07:01:47+00:00 -->
 [![Agentic Awesome Skills social preview](apps/web-app/public/social-card.png)](https://github.com/sickn33/agentic-awesome-skills)
 
-# 🌌 Agentic Awesome Skills: 1,948+ Agentic Skills for Claude Code, Gemini CLI, Cursor, Autohand Code, Copilot & More
+# 🌌 Agentic Awesome Skills: 1,958+ Agentic Skills for Claude Code, Gemini CLI, Cursor, Autohand Code, Copilot & More
 
-> **Installable GitHub library of 1,948+ agentic skills for Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, and other AI coding assistants.**
+> **Installable GitHub library of 1,958+ agentic skills for Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, and other AI coding assistants.**
 
 Agentic Awesome Skills is an installable GitHub library and npm installer for reusable `SKILL.md` playbooks. It is designed for Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, Kiro, OpenCode, GitHub Copilot, and other AI coding assistants that benefit from structured operating instructions. Instead of collecting one-off prompt snippets, this repository gives you a searchable, installable catalog of skills, bundles, workflows, plugin-safe distributions, and practical docs that help agents perform recurring tasks with better context, stronger constraints, and clearer outputs.
 
@@ -13,7 +13,7 @@ You can use this repo to install a broad multi-tool skill library, start from fo
 
 The canonical project page is the GitHub repository at <https://github.com/sickn33/agentic-awesome-skills>; the hosted catalog is a companion discovery surface for search, plugins, skill detail pages, and exact-set composition.
 
-**Start here:** [Install in 1 minute](#installation) · [Build an exact set](https://sickn33.github.io/agentic-awesome-skills/workbench) · [Recommended plugins](#recommended-specialized-plugins) · [Compare plugin packs](https://sickn33.github.io/agentic-awesome-skills/plugins) · [Choose your tool](#choose-your-tool) · [📚 Browse 1,948+ Skills](#browse-1948-skills) · [Bundles & workflows](#bundles--workflows) · [Support the project](#support-the-project)
+**Start here:** [Install in 1 minute](#installation) · [Build an exact set](https://sickn33.github.io/agentic-awesome-skills/workbench) · [Recommended plugins](#recommended-specialized-plugins) · [Compare plugin packs](https://sickn33.github.io/agentic-awesome-skills/plugins) · [Choose your tool](#choose-your-tool) · [📚 Browse 1,958+ Skills](#browse-1958-skills) · [Bundles & workflows](#bundles--workflows) · [Support the project](#support-the-project)
 
 [![GitHub stars](https://img.shields.io/badge/⭐%2043%2C000%2B%20Stars-gold?style=for-the-badge)](https://github.com/sickn33/agentic-awesome-skills/stargazers)
 [![Follow @AASkills_ on X](https://img.shields.io/badge/Follow-%40AASkills__-black?style=for-the-badge&logo=x)](https://x.com/AASkills_)
@@ -30,13 +30,13 @@ The canonical project page is the GitHub repository at <https://github.com/sickn
 [![OpenCode](https://img.shields.io/badge/OpenCode-CLI-gray?style=for-the-badge)](https://github.com/opencode-ai/opencode)
 [![Antigravity](https://img.shields.io/badge/Antigravity-AI%20IDE-red?style=for-the-badge)](https://github.com/sickn33/agentic-awesome-skills)
 
-**Current release: V14.3.1.** Trusted by 43k+ GitHub stargazers, this repository combines official and community skill collections with bundles, workflows, installation paths, and docs that help you go from first install to daily use quickly.
+**Current release: V14.4.0.** Trusted by 43k+ GitHub stargazers, this repository combines official and community skill collections with bundles, workflows, installation paths, and docs that help you go from first install to daily use quickly.
 
 ## Why This Repo
 
 - **Installable, not just inspirational**: use `npx agentic-awesome-skills` to put skills where your tool expects them.
 - **Built for major agent workflows**: Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, Kiro, OpenCode, Copilot, and more.
-- **Broad coverage with real utility**: 1,948+ skills across development, testing, security, infrastructure, product, and marketing.
+- **Broad coverage with real utility**: 1,958+ skills across development, testing, security, infrastructure, product, and marketing.
 - **Inspect before installing**: the hosted [Skill Workbench](https://sickn33.github.io/agentic-awesome-skills/workbench) filters recorded risk, provenance, host compatibility, and setup evidence, then generates release-pinned preview and install commands for exact IDs.
 - **Focused by default**: specialized plugins help you start with the web, security, data, docs, DevOps, QA, OSS, or agent/MCP workflows you actually need.
 - **Useful whether you want breadth or curation**: install the full catalog, choose a specialized plugin, start with bundles, or compare alternatives before installing.
@@ -49,7 +49,7 @@ The canonical project page is the GitHub repository at <https://github.com/sickn
 - [Choose Your Tool](#choose-your-tool)
 - [Quick FAQ](#quick-faq)
 - [Bundles & Workflows](#bundles--workflows)
-- [Browse 1,948+ Skills](#browse-1948-skills)
+- [Browse 1,958+ Skills](#browse-1958-skills)
 - [Troubleshooting](#troubleshooting)
 - [Stable Skills Manifest v1](#stable-skills-manifest-v1)
 - [Support the Project](#support-the-project)
@@ -171,7 +171,7 @@ Use the table above for install targets. Use specialized plugins when you are ch
 
 ### What is Agentic Awesome Skills?
 
-**Agentic Awesome Skills** (Release 14.3.1) is a large, installable skill library for AI coding assistants. It packages 1,948+ reusable `SKILL.md` playbooks, specialized plugins, bundles, workflows, generated catalogs, and a CLI installer so Claude Code, Codex CLI, Autohand Code, Cursor, Gemini CLI, Antigravity, and similar tools can reuse proven operating instructions instead of one-off prompts.
+**Agentic Awesome Skills** (Release 14.4.0) is a large, installable skill library for AI coding assistants. It packages 1,958+ reusable `SKILL.md` playbooks, specialized plugins, bundles, workflows, generated catalogs, and a CLI installer so Claude Code, Codex CLI, Autohand Code, Cursor, Gemini CLI, Antigravity, and similar tools can reuse proven operating instructions instead of one-off prompts.
 
 ### How do I install it?
 
@@ -246,7 +246,7 @@ Remove `--dry-run` only after reviewing the install, update, and removal plan. U
 
 The hosted [Skill Workbench](https://sickn33.github.io/agentic-awesome-skills/workbench) builds the same pinned command from catalog evidence and exposes conflicts before you copy it.
 
-## Browse 1,948+ Skills
+## Browse 1,958+ Skills
 
 Use the root repo as a landing page, then jump into the deeper surface that matches your intent.
 
@@ -386,6 +386,11 @@ Key source families include:
 
 ### Community Contributors
 
+- **[0xsarwagya/ontoly](https://github.com/0xsarwagya/ontoly)**: Source for the `ontoly-software-graph` skill - deterministic TypeScript software graphs, MCP-backed architecture review, request tracing, impact analysis, and dependency analysis (MIT).
+- [amElnagdy/guard-skills](https://github.com/amElnagdy/guard-skills) — Code Quality & Testing Guard Skills (by amElnagdy)
+
+- [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill) — Cloudflare Web Security Audit Skill (by Cloudflare)
+
 - **[supernovae-st/nika-agents](https://github.com/supernovae-st/nika-agents)**: Official upstream source for the `nika` skill and its deterministic, budget-aware AI workflow runner (MIT skill content; AGPL-3.0 engine).
 - **[atdy/maoxuan-product-agent](https://github.com/atdy/maoxuan-product-agent)**: Source for the `product-decision-agent` skill - Chinese-first product judgment across prioritization, growth, operations, data, delivery, and cross-functional collaboration, with 36 tested scenarios (MIT).
 - **[hafiz-actyte/idea-autopsy](https://github.com/hafiz-actyte/idea-autopsy)**: Source for the `idea-autopsy` skill - business-idea validation that hunts the one sentence that kills an idea before you build: kill-list check, five hard filters, free-AI one-prompt test, and live ad-market verification (MIT).
@@ -419,6 +424,7 @@ Key source families include:
 - **[mskadu/opencode-agent-skills](https://github.com/mskadu/opencode-agent-skills)**: Source for opencode behavior, permission, skill-suggestion, and smart Git automation skills.
 - **[adelaidasofia/ai-brain-starter](https://github.com/adelaidasofia/ai-brain-starter)**: Source for the `ingest-youtube` skill - YouTube transcript ingestion into markdown vaults with yt-dlp metadata, VTT cleanup, and capture-seed stubs (MIT).
 - **[JDDavenport/context-kit](https://github.com/JDDavenport/context-kit)**: Source reference for the `context-kit` skill - local-first Personal Context Artifact setup, installer review, and private context hygiene for Claude Code and adjacent agent workflows.
+- **[JunsW/feature-track](https://github.com/JunsW/feature-track)**: Source for the `feature-tracking` skill - lightweight repository-native feature memory for current status, source-of-truth documents, decisions, risks, and cross-session handoff (MIT).
 - **[JularDepick/user-thoughts.SKILL](https://github.com/JularDepick/user-thoughts.SKILL)**: Source for the `user-thoughts` skill - persistent project idea repository workflows for capturing decisions, tech stack notes, UI/UX rationale, and MDBASE-backed project memory (MIT).
 - **[TheaDust/lore](https://github.com/TheaDust/lore)**: Source for the `lore` skill - Markdown-only, zero-dependency long-term project memory for AI coding agents, with monorepo scopes, two-section platform mirrors, and stdlib Python helpers (MIT).
 - **[ZeroPointRepo/youtube-skills](https://github.com/ZeroPointRepo/youtube-skills)**: Source for the `youtube-full` skill - TranscriptAPI-backed YouTube transcripts, search, channel browsing, playlists, and cloud-safe video research workflows (MIT).
@@ -555,6 +561,7 @@ Key source families include:
 - **[sergebulaev/linkedin-skills](https://github.com/sergebulaev/linkedin-skills)**: Source for the `linkedin-post-writer` skill - LinkedIn post drafting from 16 tested hook formulas mapped to engagement goals, with 2026 formatting rules and an AI-tell scrub pass, from a 10-skill LinkedIn bundle for Claude Code and Codex (MIT).
 - **[Sharrmavishal/operating-kit](https://github.com/Sharrmavishal/operating-kit)**: Source for the `pre-ship-gate` skill - a pre-deploy gate that walks the silent failure modes (migrations, feature flags, stale build cache, release pointer, staged rollout, missing env) and verifies the live revision instead of trusting deploy output (MIT).
 - **[Ducksss/codex-profiles](https://github.com/Ducksss/codex-profiles)**: Source for the `codex-profiles` skill - Codex CLI/Desktop profile isolation around separate `CODEX_HOME` directories, diagnostics, and account-context boundaries without copying auth tokens (MIT).
+- **[kimtth/agent-pptify-kit](https://github.com/kimtth/agent-pptify-kit)**: Source for the `pptx-deck-creation` skill - editable, production-ready PowerPoint deck creation with narrative planning, explicit layouts, asset guidance, and quality checks (MIT).
 
 </details>
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentic-awesome-skills",
-  "version": "14.3.1",
-  "description": "1,948+ agentic skills for Claude Code, Gemini CLI, Cursor, Antigravity & more. Installer CLI.",
+  "version": "14.4.0",
+  "description": "1,958+ agentic skills for Claude Code, Gemini CLI, Cursor, Antigravity & more. Installer CLI.",
   "license": "MIT",
   "scripts": {
     "validate": "node tools/scripts/run-python.js tools/scripts/validate_skills.py",
@@ -45,6 +45,7 @@
     "security:docs": "node tools/scripts/tests/docs_security_content.test.js",
     "security:scan": "node tools/scripts/run-python.js tools/scripts/security_scanner.py",
     "security:scan:strict": "node tools/scripts/run-python.js tools/scripts/security_scanner.py --strict",
+    "lint:workflows": "node tools/scripts/run_actionlint.js",
     "score:skills": "node tools/scripts/run-python.js tools/scripts/score_skills.py",
     "score:skills:json": "node tools/scripts/run-python.js tools/scripts/score_skills.py --json",
     "score:skills:report": "node tools/scripts/run-python.js tools/scripts/score_skills.py --output data/scores.json",
@@ -52,6 +53,8 @@
     "drift:update": "node tools/scripts/run-python.js tools/scripts/detect_drift.py --update-baseline",
     "registry:report": "node tools/scripts/run-python.js tools/scripts/generate_registry_report.py",
     "pr:preflight": "node tools/scripts/pr_preflight.cjs",
+    "pr:evidence": "node tools/scripts/run-python.js tools/scripts/changed_skill_evidence.py",
+    "pr:decision": "node tools/scripts/pr_decision_manifest.cjs",
     "merge:batch": "node tools/scripts/merge_batch.cjs",
     "release:preflight": "node tools/scripts/release_workflow.js preflight",
     "release:prepare": "node tools/scripts/release_workflow.js prepare",

package/tools/lib/git-raw-diff.js

@@ -0,0 +1,83 @@
+function splitNulFields(buffer, options = {}) {
+  if (!Buffer.isBuffer(buffer)) {
+    throw new Error("Raw Git diff must be provided as a Buffer.");
+  }
+  if (buffer.length === 0 && options.allowEmpty) {
+    return [];
+  }
+  if (buffer.length === 0 || buffer[buffer.length - 1] !== 0) {
+    throw new Error("Raw Git diff is empty or missing its final NUL terminator.");
+  }
+
+  const fields = [];
+  let start = 0;
+  for (let index = 0; index < buffer.length; index += 1) {
+    if (buffer[index] === 0) {
+      fields.push(buffer.subarray(start, index));
+      start = index + 1;
+    }
+  }
+  return fields;
+}
+
+function decodeGitPath(buffer) {
+  let value;
+  try {
+    value = new TextDecoder("utf-8", { fatal: true }).decode(buffer);
+  } catch {
+    throw new Error("Raw Git diff contains a path that is not canonical UTF-8.");
+  }
+  if (Buffer.from(value, "utf8").compare(buffer) !== 0) {
+    throw new Error("Raw Git diff path did not round-trip to canonical UTF-8 bytes.");
+  }
+  return value;
+}
+
+function parseRawDiff(buffer, options = {}) {
+  const fields = splitNulFields(buffer, options);
+  if (!fields.length) return [];
+  const records = [];
+
+  for (let index = 0; index < fields.length;) {
+    const header = fields[index].toString("ascii");
+    if (!fields[index].equals(Buffer.from(header, "ascii"))) {
+      throw new Error("Raw Git diff contains a non-ASCII record header.");
+    }
+    index += 1;
+
+    const match = header.match(
+      /^:(?<oldMode>[0-7]{6}) (?<newMode>[0-7]{6}) (?<oldOid>[0-9a-f]{40}|[0-9a-f]{64}) (?<newOid>[0-9a-f]{40}|[0-9a-f]{64}) (?<status>[ACDMRTUXB])(?<score>[0-9]{0,3})$/u,
+    );
+    if (!match?.groups || match.groups.oldOid.length !== match.groups.newOid.length) {
+      throw new Error(`Malformed raw Git diff header: ${header}`);
+    }
+
+    if (index >= fields.length) throw new Error("Raw Git diff record is missing its path.");
+    const firstPath = decodeGitPath(fields[index]);
+    index += 1;
+    const isRenameOrCopy = match.groups.status === "R" || match.groups.status === "C";
+    let secondPath = null;
+    if (isRenameOrCopy) {
+      if (index >= fields.length) {
+        throw new Error("Raw Git rename/copy record is missing its destination path.");
+      }
+      secondPath = decodeGitPath(fields[index]);
+      index += 1;
+    }
+
+    const status = match.groups.status;
+    records.push({
+      status,
+      old_path: status === "A" ? null : firstPath,
+      new_path: status === "D" ? null : isRenameOrCopy ? secondPath : firstPath,
+      old_mode: match.groups.oldMode,
+      new_mode: match.groups.newMode,
+      old_oid: match.groups.oldOid,
+      new_oid: match.groups.newOid,
+      similarity: match.groups.score ? Number(match.groups.score) : null,
+    });
+  }
+  return records;
+}
+
+module.exports = { decodeGitPath, parseRawDiff, splitNulFields };

package/tools/lib/pr-decision.js

@@ -0,0 +1,135 @@
+const { classifyChangeRecords, classifyPathPolicy } = require("./workflow-contract");
+
+const DECISION_SCHEMA_VERSION = 1;
+const VALID_SEMANTIC_REVIEW_STATES = new Set(["available", "unavailable", "unknown"]);
+
+function normalizePath(value) {
+  return String(value || "").replace(/^\.\//, "");
+}
+
+function isSensitivePath(filePath) {
+  const normalized = normalizePath(filePath);
+  return !classifyPathPolicy(normalized).approvalSafe;
+}
+
+function stableUnique(values) {
+  return [...new Set(values.filter(Boolean))].sort();
+}
+
+function changeType(change) {
+  return String(change?.change_type || change?.status || "").toLowerCase();
+}
+
+function buildDecisionManifest({ preflight, evidence, semanticReviewState = "unknown" }) {
+  if (!preflight || !Array.isArray(preflight.changedFiles)) {
+    throw new Error("preflight.changedFiles is required");
+  }
+  if (!evidence || !Array.isArray(evidence.changes) || typeof evidence.blocking !== "boolean") {
+    throw new Error("changed-skill evidence is incomplete");
+  }
+  if (!VALID_SEMANTIC_REVIEW_STATES.has(semanticReviewState)) {
+    throw new Error(`Invalid semantic review state: ${semanticReviewState}`);
+  }
+
+  const changedFiles = stableUnique(preflight.changedFiles.map(normalizePath));
+  const sensitivePaths = changedFiles.filter(isSensitivePath);
+  const changeRecords = Array.isArray(preflight.changeRecords) ? preflight.changeRecords : [];
+  const recordChangedFiles = stableUnique(changeRecords.flatMap((record) => [record?.old_path, record?.new_path])
+    .filter(Boolean)
+    .map(normalizePath));
+  const recordsConsistent = JSON.stringify(recordChangedFiles) === JSON.stringify(changedFiles);
+  const recordPolicy = changeRecords.length > 0
+    ? classifyChangeRecords(changeRecords, { requireBlobSizes: false })
+    : {
+        approvalSafe: changedFiles.length === 0,
+        reasons: changedFiles.length === 0 ? [] : ["missing_change_records"],
+        paths: [],
+      };
+  if (!recordsConsistent) {
+    recordPolicy.approvalSafe = false;
+    recordPolicy.reasons = stableUnique([...recordPolicy.reasons, "changed_files_records_mismatch"]);
+  }
+  const changedSkills = stableUnique(
+    evidence.changes.map((change) => change.skill_id || change.new_skill_id || change.old_skill_id),
+  );
+  const reasons = [];
+  let route = "eligible_for_later_automation";
+
+  if ((preflight.directDerivedChanges || []).length > 0) {
+    route = "block";
+    reasons.push("direct_derived_changes");
+  }
+  if (evidence.blocking) {
+    route = "block";
+    reasons.push("changed_skill_regression");
+    reasons.push(...(evidence.reasons || []).map((reason) => `evidence:${reason}`));
+  }
+
+  if (route !== "block") {
+    if (sensitivePaths.length > 0) {
+      route = "human_review";
+      reasons.push("sensitive_paths");
+    }
+    if (!recordPolicy.approvalSafe) {
+      route = "human_review";
+      reasons.push("unsafe_change_records");
+      reasons.push(...recordPolicy.reasons.map((reason) => `record:${reason}`));
+    }
+    if (evidence.changes.length > 0) {
+      route = "human_review";
+      reasons.push("canonical_skill_content_changed");
+    }
+    if (evidence.changes.some((change) => ["added", "renamed", "copied"].includes(changeType(change)))) {
+      route = "human_review";
+      reasons.push("new_or_relocated_skill");
+    }
+    if (semanticReviewState !== "available" && evidence.changes.length > 0) {
+      route = "human_review";
+      reasons.push(
+        semanticReviewState === "unavailable"
+          ? "semantic_review_unavailable"
+          : "semantic_review_unknown",
+      );
+    }
+  }
+
+  if (route === "eligible_for_later_automation") {
+    reasons.push("deterministic_low_risk_candidate");
+  }
+
+  return {
+    schema_version: DECISION_SCHEMA_VERSION,
+    mode: "shadow",
+    untrusted_advisory: true,
+    route,
+    reason_codes: stableUnique(reasons),
+    base_ref: evidence.base_ref || preflight.baseRef || null,
+    head_ref: evidence.head_ref || preflight.headRef || null,
+    semantic_review: { state: semanticReviewState },
+    change: {
+      primary_category: preflight.primaryCategory || "none",
+      categories: stableUnique(preflight.categories || []),
+      changed_files_count: changedFiles.length,
+      changed_files: changedFiles,
+      change_records: changeRecords,
+      record_policy: {
+        approval_safe: recordPolicy.approvalSafe,
+        reasons: stableUnique(recordPolicy.reasons),
+      },
+      sensitive_paths: sensitivePaths,
+      direct_derived_changes: stableUnique(preflight.directDerivedChanges || []),
+      changed_skills: changedSkills,
+    },
+    deterministic_gate: {
+      blocking: Boolean(evidence.blocking || (preflight.directDerivedChanges || []).length > 0),
+      evidence_reasons: stableUnique(evidence.reasons || []),
+    },
+  };
+}
+
+module.exports = {
+  DECISION_SCHEMA_VERSION,
+  buildDecisionManifest,
+  isSensitivePath,
+  normalizePath,
+};

package/tools/lib/workflow-contract.js

@@ -17,10 +17,306 @@ const REFERENCES_FILES = new Set([
   "package-lock.json",
 ]);
 
+const REGULAR_FILE_MODE = "100644";
+const ABSENT_FILE_MODE = "000000";
+const MAX_APPROVAL_BLOB_BYTES = 1024 * 1024;
+const MAX_APPROVAL_CHANGE_RECORDS = 500;
+const MAX_APPROVAL_TOTAL_BLOB_BYTES = 8 * 1024 * 1024;
+const SKILL_PATH_SEGMENT = "[a-z0-9]+(?:-[a-z0-9]+)*";
+const CANONICAL_SKILL_PATH = new RegExp(`^skills\\/(?:${SKILL_PATH_SEGMENT}\\/)+SKILL\\.md$`, "u");
+const SKILL_SUPPORT_PATH = new RegExp(
+  `^skills\\/(?:${SKILL_PATH_SEGMENT}\\/)+(?:assets|references|resources)\\/(?:[^/]+\\/)*[^/]+$`,
+  "u",
+);
+const NARROW_DOC_PATH = /^(?:README\.md|CONTRIBUTING\.md|docs\/(?:[^/]+\/)*[^/]+\.md)$/;
+const LOW_RISK_EXTENSIONS = new Set([
+  ".csv",
+  ".gif",
+  ".jpeg",
+  ".jpg",
+  ".json",
+  ".md",
+  ".pdf",
+  ".png",
+  ".txt",
+  ".webp",
+  ".yaml",
+  ".yml",
+]);
+const CHANGE_STATUS_SIDES = Object.freeze({
+  A: { old: false, new: true },
+  C: { old: true, new: true },
+  D: { old: true, new: false },
+  M: { old: true, new: true },
+  R: { old: true, new: true },
+});
+
 function normalizeRepoPath(filePath) {
   return String(filePath || "").replace(/\\/g, "/").replace(/^\.\//, "");
 }
 
+function validateRawRepoPath(filePath) {
+  const value = typeof filePath === "string" ? filePath : "";
+  const reasons = [];
+
+  if (!value) {
+    reasons.push("missing_path");
+  }
+  if (/[\u0000-\u001f\u007f]/u.test(value)) {
+    reasons.push("control_character_path");
+  }
+  if (value.includes("\\")) {
+    reasons.push("backslash_path");
+  }
+  if (value.startsWith("/") || /^[A-Za-z]:/u.test(value)) {
+    reasons.push("absolute_path");
+  }
+  if (value.startsWith("./") || value.includes("//")) {
+    reasons.push("noncanonical_path");
+  }
+
+  const segments = value.split("/");
+  if (segments.some((segment) => (
+    !segment ||
+    segment === "." ||
+    segment === ".." ||
+    segment.trim() !== segment ||
+    segment.endsWith(".") ||
+    segment.includes(":") ||
+    Buffer.byteLength(segment, "utf8") > 255
+  ))) {
+    reasons.push("noncanonical_path");
+  }
+  if (Buffer.byteLength(value, "utf8") > 4096) {
+    reasons.push("noncanonical_path");
+  }
+  if (value && path.posix.normalize(value) !== value) {
+    reasons.push("noncanonical_path");
+  }
+  if (value && value.normalize("NFC") !== value) {
+    reasons.push("noncanonical_unicode_path");
+  }
+
+  return {
+    safe: reasons.length === 0,
+    reasons: [...new Set(reasons)],
+  };
+}
+
+function classifyPathPolicy(filePath) {
+  const pathValidation = validateRawRepoPath(filePath);
+  if (!pathValidation.safe) {
+    return {
+      safe: false,
+      sensitive: true,
+      approvalSafe: false,
+      kind: "invalid",
+      reasons: pathValidation.reasons,
+    };
+  }
+
+  let kind = "unknown";
+  if (CANONICAL_SKILL_PATH.test(filePath)) {
+    kind = "canonical_skill";
+  } else if (SKILL_SUPPORT_PATH.test(filePath)) {
+    kind = "skill_support";
+  } else if (NARROW_DOC_PATH.test(filePath)) {
+    kind = "documentation";
+  }
+
+  const extension = path.posix.extname(filePath).toLowerCase();
+  const recognizedExtension = LOW_RISK_EXTENSIONS.has(extension);
+  const reasons = [];
+  if (kind === "unknown") {
+    reasons.push("unapproved_path");
+  }
+  if (!recognizedExtension) {
+    reasons.push("unknown_extension");
+  }
+
+  const approvalSafe = reasons.length === 0;
+  return {
+    safe: approvalSafe,
+    sensitive: !approvalSafe,
+    approvalSafe,
+    kind,
+    reasons,
+  };
+}
+
+function isFullObjectId(value, options = {}) {
+  const allowZero = Boolean(options.allowZero);
+  if (typeof value !== "string" || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(value)) {
+    return false;
+  }
+  return allowZero || !/^0+$/u.test(value);
+}
+
+function readBlobSize(record, side, blobSizes) {
+  const inlineSize = record[`${side}_size`];
+  if (Object.prototype.hasOwnProperty.call(record, `${side}_size`)) {
+    return Number.isSafeInteger(inlineSize) && inlineSize >= 0 ? inlineSize : undefined;
+  }
+
+  const oid = record[`${side}_oid`];
+  if (blobSizes instanceof Map) {
+    return blobSizes.get(oid);
+  }
+  if (blobSizes && typeof blobSizes === "object") {
+    return blobSizes[oid];
+  }
+  return undefined;
+}
+
+function classifyChangeRecords(records, options = {}) {
+  const requireBlobSizes = options.requireBlobSizes !== false;
+  const maxBlobBytes = Number.isSafeInteger(options.maxBlobBytes) && options.maxBlobBytes >= 0
+    ? options.maxBlobBytes
+    : MAX_APPROVAL_BLOB_BYTES;
+  const maxChangeRecords = Number.isSafeInteger(options.maxChangeRecords) && options.maxChangeRecords >= 0
+    ? options.maxChangeRecords
+    : MAX_APPROVAL_CHANGE_RECORDS;
+  const maxTotalBlobBytes = Number.isSafeInteger(options.maxTotalBlobBytes) && options.maxTotalBlobBytes >= 0
+    ? options.maxTotalBlobBytes
+    : MAX_APPROVAL_TOTAL_BLOB_BYTES;
+  const reasons = [];
+  const paths = [];
+  const canonicalSkillChanges = [];
+  const skillContentChanges = [];
+  let sensitive = false;
+  let totalBlobBytes = 0;
+
+  if (!Array.isArray(records) || records.length === 0) {
+    return {
+      safe: false,
+      sensitive: true,
+      approvalSafe: false,
+      reasons: ["missing_change_records"],
+      paths,
+      requiresHumanReview: false,
+      canonicalSkillChanges,
+      skillContentChanges,
+    };
+  }
+  if (records.length > maxChangeRecords) {
+    reasons.push("too_many_change_records");
+    sensitive = true;
+  }
+
+  records.forEach((record, index) => {
+    const prefix = `record_${index}`;
+    if (!record || typeof record !== "object") {
+      reasons.push(`${prefix}:malformed_record`);
+      sensitive = true;
+      return;
+    }
+
+    const status = String(record.status || "");
+    const expectedSides = CHANGE_STATUS_SIDES[status];
+    if (!expectedSides) {
+      reasons.push(`${prefix}:unknown_status`);
+      sensitive = true;
+      return;
+    }
+
+    for (const side of ["old", "new"]) {
+      const expected = expectedSides[side];
+      const filePath = record[`${side}_path`];
+      const mode = String(record[`${side}_mode`] || "");
+      const oid = String(record[`${side}_oid`] || "");
+
+      if (!expected) {
+        if (filePath !== null) {
+          reasons.push(`${prefix}:${side}_invalid_absent_path`);
+        }
+        if (mode !== ABSENT_FILE_MODE || !isFullObjectId(oid, { allowZero: true }) || !/^0+$/u.test(oid)) {
+          reasons.push(`${prefix}:${side}_invalid_absent_side`);
+        }
+        continue;
+      }
+
+      if (typeof filePath !== "string" || !filePath) {
+        reasons.push(`${prefix}:${side}_missing_path`);
+        sensitive = true;
+        continue;
+      }
+
+      const pathPolicy = classifyPathPolicy(filePath);
+      paths.push({ record: index, side, path: filePath, ...pathPolicy });
+      if (!pathPolicy.approvalSafe) {
+        sensitive = true;
+        for (const reason of pathPolicy.reasons) {
+          reasons.push(`${prefix}:${side}_${reason}`);
+        }
+      }
+      if (pathPolicy.kind === "canonical_skill") {
+        canonicalSkillChanges.push(filePath);
+      }
+      if (["canonical_skill", "skill_support"].includes(pathPolicy.kind)) {
+        skillContentChanges.push(filePath);
+      }
+
+      if (mode !== REGULAR_FILE_MODE) {
+        sensitive = true;
+        if (mode === "100755") {
+          reasons.push(`${prefix}:${side}_executable_mode`);
+        } else if (mode === "120000") {
+          reasons.push(`${prefix}:${side}_symlink_mode`);
+        } else if (mode === "160000") {
+          reasons.push(`${prefix}:${side}_gitlink_mode`);
+        } else {
+          reasons.push(`${prefix}:${side}_unknown_mode`);
+        }
+      }
+
+      if (!isFullObjectId(oid)) {
+        sensitive = true;
+        reasons.push(`${prefix}:${side}_invalid_object_id`);
+      } else {
+        const blobSize = readBlobSize(record, side, options.blobSizes);
+        if ((!Number.isSafeInteger(blobSize) || blobSize < 0) && requireBlobSizes) {
+          sensitive = true;
+          reasons.push(`${prefix}:${side}_missing_blob_size`);
+        } else if (Number.isSafeInteger(blobSize) && blobSize > maxBlobBytes) {
+          sensitive = true;
+          reasons.push(`${prefix}:${side}_oversized_blob`);
+        } else if (Number.isSafeInteger(blobSize)) {
+          totalBlobBytes += blobSize;
+        }
+      }
+    }
+
+    if (status === "M" && record.old_path !== record.new_path) {
+      reasons.push(`${prefix}:path_changed_without_rename`);
+      sensitive = true;
+    }
+    if ((status === "R" || status === "C") && record.old_path === record.new_path) {
+      reasons.push(`${prefix}:rename_copy_path_unchanged`);
+      sensitive = true;
+    }
+  });
+
+  if (totalBlobBytes > maxTotalBlobBytes) {
+    reasons.push("oversized_total_diff");
+    sensitive = true;
+  }
+
+  const uniqueReasons = [...new Set(reasons)];
+  const uniqueCanonicalSkillChanges = [...new Set(canonicalSkillChanges)].sort();
+  const uniqueSkillContentChanges = [...new Set(skillContentChanges)].sort();
+  const approvalSafe = uniqueReasons.length === 0 && !sensitive;
+  return {
+    safe: approvalSafe,
+    sensitive: !approvalSafe,
+    approvalSafe,
+    reasons: uniqueReasons,
+    paths,
+    requiresHumanReview: uniqueSkillContentChanges.length > 0,
+    canonicalSkillChanges: uniqueCanonicalSkillChanges,
+    skillContentChanges: uniqueSkillContentChanges,
+  };
+}
+
 function matchesContractEntry(filePath, entry) {
   const normalizedPath = normalizeRepoPath(filePath);
   const normalizedEntry = normalizeRepoPath(entry);
@@ -182,7 +478,9 @@ function hasIssueLink(body) {
 }
 
 module.exports = {
+  classifyChangeRecords,
   classifyChangedFiles,
+  classifyPathPolicy,
   extractChangelogSection,
   getDirectDerivedChanges,
   getManagedFiles,
@@ -191,7 +489,11 @@ module.exports = {
   isDerivedFile,
   isMixedFile,
   loadWorkflowContract,
+  maxApprovalBlobBytes: MAX_APPROVAL_BLOB_BYTES,
+  maxApprovalChangeRecords: MAX_APPROVAL_CHANGE_RECORDS,
+  maxApprovalTotalBlobBytes: MAX_APPROVAL_TOTAL_BLOB_BYTES,
   normalizeRepoPath,
   matchesContractEntry,
   requiresReferencesValidation,
+  validateRawRepoPath,
 };