claudecode-omc 5.11.0 → 5.12.0

package/bundled/upstream/ecc/skills/repo-scan/SKILL.md

@@ -1,22 +1,23 @@
----
-name: repo-scan
-description: Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.
-origin: community
----
-
-# repo-scan
-
-> Every ecosystem has its own dependency manager, but no tool looks across C++, Android, iOS, and Web to tell you: how much code is actually yours, what's third-party, and what's dead weight.
-
-## When to Use
-
-- Taking over a large legacy codebase and need a structural overview
-- Before major refactoring — identify what's core, what's duplicate, what's dead
-- Auditing third-party dependencies embedded directly in source (not declared in package managers)
-- Preparing architecture decision records for monorepo reorganization
-
-## Installation
-
+---
+name: repo-scan
+description: Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.
+metadata:
+  origin: community
+---
+
+# repo-scan
+
+> Every ecosystem has its own dependency manager, but no tool looks across C++, Android, iOS, and Web to tell you: how much code is actually yours, what's third-party, and what's dead weight.
+
+## When to Use
+
+- Taking over a large legacy codebase and need a structural overview
+- Before major refactoring — identify what's core, what's duplicate, what's dead
+- Auditing third-party dependencies embedded directly in source (not declared in package managers)
+- Preparing architecture decision records for monorepo reorganization
+
+## Installation
+
 ```bash
 # Fetch only the pinned commit for reproducibility
 mkdir -p ~/.claude/skills/repo-scan
@@ -27,52 +28,52 @@ git fetch --depth 1 origin 2742664
 git checkout --detach FETCH_HEAD
 cp -r . ~/.claude/skills/repo-scan
 ```
-
-> Review the source before installing any agent skill.
-
-## Core Capabilities
-
-| Capability | Description |
-|---|---|
-| **Cross-stack scanning** | C/C++, Java/Android, iOS (OC/Swift), Web (TS/JS/Vue) in one pass |
-| **File classification** | Every file tagged as project code, third-party, or build artifact |
-| **Library detection** | 50+ known libraries (FFmpeg, Boost, OpenSSL…) with version extraction |
-| **Four-level verdicts** | Core Asset / Extract & Merge / Rebuild / Deprecate |
-| **HTML reports** | Interactive dark-theme pages with drill-down navigation |
-| **Monorepo support** | Hierarchical scanning with summary + sub-project reports |
-
-## Analysis Depth Levels
-
-| Level | Files Read | Use Case |
-|---|---|---|
-| `fast` | 1-2 per module | Quick inventory of huge directories |
-| `standard` | 2-5 per module | Default audit with full dependency + architecture checks |
-| `deep` | 5-10 per module | Adds thread safety, memory management, API consistency |
-| `full` | All files | Pre-merge comprehensive review |
-
-## How It Works
-
+
+> Review the source before installing any agent skill.
+
+## Core Capabilities
+
+| Capability | Description |
+|---|---|
+| **Cross-stack scanning** | C/C++, Java/Android, iOS (OC/Swift), Web (TS/JS/Vue) in one pass |
+| **File classification** | Every file tagged as project code, third-party, or build artifact |
+| **Library detection** | 50+ known libraries (FFmpeg, Boost, OpenSSL…) with version extraction |
+| **Four-level verdicts** | Core Asset / Extract & Merge / Rebuild / Deprecate |
+| **HTML reports** | Interactive dark-theme pages with drill-down navigation |
+| **Monorepo support** | Hierarchical scanning with summary + sub-project reports |
+
+## Analysis Depth Levels
+
+| Level | Files Read | Use Case |
+|---|---|---|
+| `fast` | 1-2 per module | Quick inventory of huge directories |
+| `standard` | 2-5 per module | Default audit with full dependency + architecture checks |
+| `deep` | 5-10 per module | Adds thread safety, memory management, API consistency |
+| `full` | All files | Pre-merge comprehensive review |
+
+## How It Works
+
 1. **Classify the repo surface**: enumerate files, then tag each as project code, embedded third-party code, or build artifact.
 2. **Detect embedded libraries**: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.
 3. **Score each module**: group files by module or subsystem, then assign one of the four verdicts based on ownership, duplication, and maintenance cost.
 4. **Highlight structural risks**: call out dead-weight artifacts, duplicated wrappers, outdated vendored code, and modules that should be extracted, rebuilt, or deprecated.
 5. **Produce the report**: return a concise summary plus the interactive HTML output with per-module drill-down so the audit can be reviewed asynchronously.
-
-## Examples
-
-On a 50,000-file C++ monorepo:
-- Found FFmpeg 2.x (2015 vintage) still in production
-- Discovered the same SDK wrapper duplicated 3 times
-- Identified 636 MB of committed Debug/ipch/obj build artifacts
-- Classified: 3 MB project code vs 596 MB third-party
-
-## Best Practices
-
-- Start with `standard` depth for first-time audits
-- Use `fast` for monorepos with 100+ modules to get a quick inventory
-- Run `deep` incrementally on modules flagged for refactoring
-- Review the cross-module analysis for duplicate detection across sub-projects
-
-## Links
-
-- [GitHub Repository](https://github.com/haibindev/repo-scan)
+
+## Examples
+
+On a 50,000-file C++ monorepo:
+- Found FFmpeg 2.x (2015 vintage) still in production
+- Discovered the same SDK wrapper duplicated 3 times
+- Identified 636 MB of committed Debug/ipch/obj build artifacts
+- Classified: 3 MB project code vs 596 MB third-party
+
+## Best Practices
+
+- Start with `standard` depth for first-time audits
+- Use `fast` for monorepos with 100+ modules to get a quick inventory
+- Run `deep` incrementally on modules flagged for refactoring
+- Review the cross-module analysis for duplicate detection across sub-projects
+
+## Links
+
+- [GitHub Repository](https://github.com/haibindev/repo-scan)

package/bundled/upstream/ecc/skills/research-ops/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: research-ops
 description: Evidence-first current-state research workflow for ECC. Use when the user wants fresh facts, comparisons, enrichment, or a recommendation built from current public evidence and any supplied local context.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Research Ops

package/bundled/upstream/ecc/skills/returns-reverse-logistics/SKILL.md

@@ -11,8 +11,8 @@ description: >
 license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
-origin: ECC
 metadata:
+  origin: ECC
   author: evos
   clawdbot:
     emoji: ""

package/bundled/upstream/ecc/skills/rules-distill/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: rules-distill
 description: "Scan skills to extract cross-cutting principles and distill them into rules — append, revise, or create new rule files"
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Rules Distill

package/bundled/upstream/ecc/skills/rust-patterns/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: rust-patterns
 description: Idiomatic Rust patterns, ownership, error handling, traits, concurrency, and best practices for building safe, performant applications.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Rust Development Patterns

package/bundled/upstream/ecc/skills/rust-testing/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: rust-testing
 description: Rust testing patterns including unit tests, integration tests, async testing, property-based testing, mocking, and coverage. Follows TDD methodology.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Rust Testing Patterns

package/bundled/upstream/ecc/skills/safety-guard/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: safety-guard
 description: Use this skill to prevent destructive operations when working on production systems or running agents autonomously.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Safety Guard — Prevent Destructive Operations

package/bundled/upstream/ecc/skills/santa-method/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: santa-method
 description: "Multi-agent adversarial verification with convergence loop. Two independent review agents must both pass before output ships."
-origin: "Ronald Skelton - Founder, RapportScore.ai"
+metadata:
+  origin: "Ronald Skelton - Founder, RapportScore.ai"
 ---
 
 # Santa Method

package/bundled/upstream/ecc/skills/scientific-db-pubmed-database/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: pubmed-database
 description: Direct PubMed and NCBI E-utilities search workflows for biomedical literature, MeSH queries, PMID lookup, citation retrieval, and API-backed literature monitoring.
-origin: community
+metadata:
+  origin: community
 ---
 
 # PubMed Database

package/bundled/upstream/ecc/skills/scientific-db-uspto-database/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: uspto-database
 description: USPTO patent and trademark data workflow for official record lookup, PatentSearch queries, TSDR checks, assignment data, and reproducible IP research logs.
-origin: community
+metadata:
+  origin: community
 ---
 
 # USPTO Database

package/bundled/upstream/ecc/skills/scientific-pkg-gget/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: gget
 description: gget CLI and Python workflow for quick genomic database queries, sequence lookup, BLAST-style searches, enrichment checks, and reproducible bioinformatics evidence logs.
-origin: community
+metadata:
+  origin: community
 ---
 
 # gget

package/bundled/upstream/ecc/skills/scientific-thinking-literature-review/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: literature-review
 description: Systematic literature-review workflow for academic, biomedical, technical, and scientific topics, including search planning, source screening, synthesis, citation checks, and evidence logging.
-origin: community
+metadata:
+  origin: community
 ---
 
 # Literature Review

package/bundled/upstream/ecc/skills/scientific-thinking-scholar-evaluation/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: scholar-evaluation
 description: Structured scholarly-work evaluation for papers, proposals, literature reviews, methods sections, evidence quality, citation support, and research-writing feedback.
-origin: community
+metadata:
+  origin: community
 ---
 
 # Scholar Evaluation

package/bundled/upstream/ecc/skills/search-first/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: search-first
 description: Research-before-coding workflow. Search for existing tools, libraries, and patterns before writing custom code. Invokes the researcher agent.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # /search-first — Research Before You Code

package/bundled/upstream/ecc/skills/security-bounty-hunter/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: security-bounty-hunter
 description: Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.
-origin: ECC direct-port adaptation
+metadata:
+  origin: ECC direct-port adaptation
 version: "1.0.0"
 ---
 

package/bundled/upstream/ecc/skills/security-review/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: security-review
 description: Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Security Review Skill

package/bundled/upstream/ecc/skills/security-scan/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: security-scan
 description: Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Security Scan Skill

package/bundled/upstream/ecc/skills/seo/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: seo
 description: Audit, plan, and implement SEO improvements across technical SEO, on-page optimization, structured data, Core Web Vitals, and content strategy. Use when the user wants better search visibility, SEO remediation, schema markup, sitemap/robots work, or keyword mapping.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # SEO

package/bundled/upstream/ecc/skills/skill-comply/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: skill-comply
 description: Visualize whether skills, rules, and agent definitions are actually followed — auto-generates scenarios at 3 prompt strictness levels, runs agents, classifies behavioral sequences, and reports compliance rates with full tool call timelines
-origin: ECC
+metadata:
+  origin: ECC
 tools: Read, Bash
 ---
 

package/bundled/upstream/ecc/skills/skill-comply/scripts/runner.py

@@ -15,6 +15,11 @@ from scripts.scenario_generator import Scenario
 
 SANDBOX_BASE = Path("/tmp/skill-comply-sandbox")
 ALLOWED_MODELS = frozenset({"haiku", "sonnet", "opus"})
+ALLOWED_SETUP_EXECUTABLES = frozenset({
+    "git", "npm", "pip", "pip3",
+    "touch", "mkdir", "cp", "mv", "echo",
+    "chmod", "unzip", "tar",
+})
 # Shell builtins cannot be invoked via subprocess.run; cwd is already
 # controlled by the cwd= keyword. Scenarios that include these in
 # setup_commands (a common shell-style convention) must be tolerated.
@@ -106,6 +111,9 @@ def _setup_sandbox(sandbox_dir: Path, scenario: Scenario) -> None:
         if not parts or parts[0] in SHELL_BUILTINS:
             # Shell builtins (cd/pushd/popd) cannot run as subprocess; skip.
             continue
+        if parts[0] not in ALLOWED_SETUP_EXECUTABLES:
+            # Restrict to known-safe executables to prevent arbitrary code execution.
+            continue
         try:
             subprocess.run(parts, cwd=sandbox_dir, capture_output=True)
         except FileNotFoundError:

package/bundled/upstream/ecc/skills/skill-scout/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: skill-scout
 description: Search existing local, marketplace, GitHub, and web skill sources before creating a new skill. Use when the user wants to create, build, fork, or find a skill for a workflow.
-origin: community
+metadata:
+  origin: community
 ---
 
 # Skill Scout

package/bundled/upstream/ecc/skills/skill-stocktake/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: skill-stocktake
 description: "Use when auditing Claude skills and commands for quality. Supports Quick Scan (changed skills only) and Full Stocktake modes with sequential subagent batch evaluation."
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # skill-stocktake

package/bundled/upstream/ecc/skills/social-graph-ranker/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: social-graph-ranker
 description: Weighted social-graph ranking for warm intro discovery, bridge scoring, and network gap analysis across X and LinkedIn. Use when the user wants the reusable graph-ranking engine itself, not the broader outreach or network-maintenance workflow layered on top of it.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Social Graph Ranker

package/bundled/upstream/ecc/skills/social-publisher/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: social-publisher
 description: Agent-driven scheduling and publishing of social media posts across 13 platforms via SocialClaw. Use when the user wants to publish to X, LinkedIn, Instagram, Facebook Pages, TikTok, Discord, Telegram, YouTube, Reddit, WordPress, or Pinterest — or when managing campaigns, uploading media, or monitoring post delivery status.
-origin: community
+metadata:
+  origin: community
 ---
 
 # Social Publisher (SocialClaw)
@@ -23,7 +24,8 @@ Connects Claude Code to [SocialClaw](https://getsocialclaw.com) for agent-driven
 export SC_API_KEY="<workspace-key>"
 
 # Verify access
-curl -sS -H "Authorization: Bearer $SC_API_KEY" https://getsocialclaw.com/v1/keys/validate
+printf 'header = "Authorization: Bearer %s"\n' "$SC_API_KEY" |
+  curl -sS -K - https://getsocialclaw.com/v1/keys/validate
 
 # Install CLI (optional but recommended)
 npm install -g socialclaw@0.1.12
@@ -63,6 +65,18 @@ socialclaw assets upload --file ./image.png --json
 }
 ```
 
+### Optional X/Twitter evidence packet
+
+Before building an X schedule, collect a source packet when the campaign depends on live audience signals rather than the draft alone.
+
+For OpenClaw users who have already approved TweetClaw in their dependency policy, use the pinned package as a separate evidence source:
+
+```bash
+openclaw plugins install npm:@xquik/tweetclaw@1.6.31
+```
+
+Use it for public tweet search, reply search, follower export, user lookup, media review, monitors, or giveaway evidence. Keep the output as research input for `schedule.json`; SocialClaw remains responsible for validation, scheduling, publishing, and delivery status. Store TweetClaw credentials in its plugin config, not in `SC_API_KEY`, schedule files, or campaign assets. Do not install it as a default ECC or SocialClaw dependency.
+
 ### 4. Validate before publishing
 ```bash
 socialclaw validate -f schedule.json --json
@@ -108,6 +122,7 @@ socialclaw posts list --json
 
 - `x-api` — direct X/Twitter API operations
 - `social-graph-ranker` — network analysis for outreach targeting
+- `TweetClaw` - optional approved OpenClaw X/Twitter source evidence before SocialClaw scheduling
 
 ## Source
 

package/bundled/upstream/ecc/skills/springboot-patterns/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: springboot-patterns
 description: Spring Boot architecture patterns, REST API design, layered services, data access, caching, async processing, and logging. Use for Java Spring Boot backend work.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Spring Boot Development Patterns

package/bundled/upstream/ecc/skills/springboot-security/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: springboot-security
 description: Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Spring Boot Security Review

package/bundled/upstream/ecc/skills/springboot-tdd/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: springboot-tdd
 description: Test-driven development for Spring Boot using JUnit 5, Mockito, MockMvc, Testcontainers, and JaCoCo. Use when adding features, fixing bugs, or refactoring.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Spring Boot TDD Workflow

package/bundled/upstream/ecc/skills/springboot-verification/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: springboot-verification
 description: "Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR."
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Spring Boot Verification Loop

package/bundled/upstream/ecc/skills/strategic-compact/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: strategic-compact
 description: Suggests manual context compaction at logical intervals to preserve context through task phases rather than arbitrary auto-compaction.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Strategic Compact Skill
@@ -30,11 +31,12 @@ Strategic compaction at logical boundaries:
 
 ## How It Works
 
-The `suggest-compact.js` script runs on PreToolUse (Edit/Write) and:
+The `suggest-compact.js` script runs on PreToolUse (Edit/Write) and combines two signals:
 
-1. **Tracks tool calls** — Counts tool invocations in session
-2. **Threshold detection** — Suggests at configurable threshold (default: 50 calls)
-3. **Periodic reminders** — Reminds every 25 calls after threshold
+1. **Context size (primary)** — Reads the latest `usage` record from the session transcript (`transcript_path` in the hook payload) and sums `input_tokens + cache_read_input_tokens + cache_creation_input_tokens` (the true context size of the turn). Suggests `/compact` at a window-scaled threshold — 160k tokens on a 200k window, 250k on a 1M window (detected from a `[1m]` model marker, or inferred when observed tokens already exceed 200k) — and re-reminds after every additional 60k tokens of context growth
+2. **Tool-call count (secondary)** — Counts tool invocations in session; suggests at a configurable threshold (default: 50 calls), then every 25 calls after
+
+Tool count alone is a weak proxy for window pressure: a few large file reads or MCP responses can fill the window in very few calls, while many tiny calls can cross 50 with a near-empty window. The context-size signal fires when it actually matters.
 
 ## Hook Setup
 
@@ -61,6 +63,9 @@ Add to your `~/.claude/settings.json`:
 
 Environment variables:
 - `COMPACT_THRESHOLD` — Tool calls before first suggestion (default: 50)
+- `COMPACT_CONTEXT_THRESHOLD` — Context tokens before the context-size suggestion (default: 160000 on a 200k window, 250000 on a 1M window; `0` disables the context signal)
+- `COMPACT_CONTEXT_INTERVAL` — Additional context tokens before the suggestion repeats (default: 60000)
+- `COMPACT_STATE_TTL_DAYS` — Days before stale per-session state files in the temp dir are swept (default: 14)
 
 ## Compaction Decision Guide
 

package/bundled/upstream/ecc/skills/swift-actor-persistence/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: swift-actor-persistence
 description: Thread-safe data persistence in Swift using actors — in-memory cache with file-backed storage, eliminating data races by design.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Swift Actors for Thread-Safe Persistence

package/bundled/upstream/ecc/skills/swift-protocol-di-testing/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: swift-protocol-di-testing
 description: Protocol-based dependency injection for testable Swift code — mock file system, network, and external APIs using focused protocols and Swift Testing.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Swift Protocol-Based Dependency Injection for Testing