codymaster 7.0.2 → 7.0.3

package/skills/cm-security-gate/SKILL.archive.md

@@ -1,239 +0,0 @@
----
-name: cm-security-gate
-description: Pre-production security audit and vulnerability scanning. Run Snyk + Aikido dependency scans, OWASP analysis, and set up automated GitHub security checks with Jules. Use when asked to 'run security check', 'security audit', 'kiểm tra bảo mật', 'vulnerability scan', 'Snyk', 'OWASP', or before open-sourcing / commercializing a project.
----
-# cm-security-gate — Mandatory Security Audit & Vulnerability Gate
-
-> **No code goes public without a security pass.**
-> **No CodyMaster release ships without Snyk + Aikido green.**
-
-## Enforcement Policy
-
-| Context | Level | What Happens |
-|---------|-------|-------------|
-| **CodyMaster internal** | 🔴 MANDATORY | Both Snyk + Aikido MUST pass. No deploy, no PR merge without green. |
-| **User projects (normal)** | 🟡 SUGGESTED | Recommend scanning, provide easy commands. User may skip. |
-| **User projects (risk detected)** | 🔴 ESCALATED MANDATORY | If CVEs found, errors hit, or risk flags raised → block until resolved. |
-
-> [!CAUTION]
-> **The Escalation Rule:** When a user encounters security errors, CVE warnings, or suspicious dependency behavior during development, the agent MUST escalate from "suggested" to "mandatory" — triggering the full Snyk + Aikido scan before any further deploy or push.
-
----
-
-## When to Use
-
-**ALWAYS when:**
-- User asks to "run security check" or "kiểm thử bảo mật"
-- Preparing to open-source a repository or launch a commercial product
-- Adding major third-party dependencies
-- The project is graduating from alpha/beta to a wider release
-- A user encounters CVE warnings, npm audit alerts, or suspicious dependency behavior
-- Before any CodyMaster release or PR merge
-
-**Skip when:**
-- Doing quick local prototyping with no real user data
-- Exploring ideas without production intent
-
----
-
-## Core Capabilities
-
-1. **Aikido MCP Server:** Real-time scanning of AI-generated code inside the IDE (vulnerabilities + secrets)
-2. **Snyk CLI:** Dependency vulnerability scanning (`npm`, `pip`, `yarn`, `cargo`)
-3. **Aikido CLI:** SAST, IaC, Secrets, and Dependency scanning with release/PR gating
-4. **Continuous Monitoring:** Snyk dashboard + Aikido dashboard for ongoing protection
-5. **Jules CI/CD:** Automated security analysis via GitHub on every commit
-
----
-
-## The Process
-
-### Phase 0: Aikido MCP Setup (IDE-Level Real-Time Scanning)
-
-> [!IMPORTANT]
-> **One-time setup.** Once configured, every AI coding session automatically scans generated code for vulnerabilities and hardcoded secrets — BEFORE the code is even committed.
-
-**Step 1:** Create a Personal Access Token at [Aikido Settings → IDE → MCP](https://app.aikido.dev/settings/integrations/ide/mcp)
-
-**Step 2:** Install Aikido MCP server:
-```bash
-# For Antigravity / Gemini CLI
-gemini mcp add aikido \
-  --env AIKIDO_API_KEY=YOUR_TOKEN \
-  npx -y @aikidosec/mcp
-```
-
-**Step 3:** Download the Aikido agent rule:
-```bash
-mkdir -p ~/.gemini/skills/
-curl -fsSL "https://gist.githubusercontent.com/kidk/aa48cad6db80ba4a38493016aae67712/raw/3644397b7df43423e3da06434491b40bbb79dd47/aikido-rule.txt" \
-  -o ~/.gemini/skills/aikido-rule.txt
-```
-
-**Step 4:** Restart Antigravity IDE. Aikido MCP is now active.
-
-> **What this gives you:** Deterministic, independent security checks on EVERY AI-generated snippet. Not a replacement for CLI scanning — this is the first line of defense, catching issues at write-time.
-
----
-
-### Phase 1: Preparation (CLI Tooling Check)
-
-Verify if the Snyk CLI and Aikido CLI are available:
-```bash
-which snyk
-which aikido-api-client
-```
-
-**If Snyk is NOT installed:**
-- **macOS (Homebrew):** `brew tap snyk/tap && brew install snyk`
-- **npm:** `npm install -g snyk`
-- Authenticate: `snyk auth`
-
-**If Aikido CLI is NOT installed:**
-- **npm:** `npm install -g @aikidosec/ci-api-client`
-- Set API key: `aikido-api-client apikey <API-KEY>`
-- *API keys: [Aikido CI Integration Settings](https://app.aikido.dev/settings/integrations/continuous-integration)*
-
-> [!WARNING]
-> **Two different API keys!** Aikido MCP (real-time IDE scanning) uses a *Personal Access Token*. Aikido CLI (release/PR gating) uses a *CI API key*. Don't mix them.
-
----
-
-### Phase 2: Execution (Parallel Vulnerability Scan)
-
-Execute both tools **in parallel** to save time:
-
-**1. Snyk Dependency Scan:**
-```bash
-snyk test
-```
-
-**2. Aikido Release Scan:**
-```bash
-aikido-api-client scan-release <repository_id_or_name> <commit_id> \
-  --minimum-severity-level="HIGH"
-```
-
-#### Aikido Scan Flags Reference
-
-| Flag | Purpose |
-|------|---------|
-| `--minimum-severity-level` | `LOW`, `MEDIUM`, `HIGH`, `CRITICAL` — set the minimum severity that triggers a failure |
-| `--fail-on-sast-scan` | Fail if SAST (Static Analysis) issues are found |
-| `--fail-on-iac-scan` | Fail if Infrastructure as Code misconfigurations are found |
-| `--fail-on-secrets-scan` | Fail if hardcoded secrets are detected |
-
-#### CodyMaster Internal (Maximum Strictness)
-```bash
-aikido-api-client scan-release <repo> <commit> \
-  --minimum-severity-level="HIGH" \
-  --fail-on-sast-scan \
-  --fail-on-secrets-scan
-```
-
-#### User Projects (Standard)
-```bash
-aikido-api-client scan-release <repo> <commit> \
-  --minimum-severity-level="HIGH"
-```
-
-#### Analyzing Results
-- **Critical/High:** Must be resolved before making the project public.
-- **Medium/Low:** Document as technical debt or evaluate for false positives.
-- Run `snyk monitor` if the user wants continuous monitoring on the Snyk dashboard.
-
----
-
-### Phase 2.5: PR Gating (GitHub Integration)
-
-For projects with CI/CD pipelines, add Aikido PR gating to block merging PRs with security issues:
-
-```bash
-# In GitHub Actions or CI script
-aikido-api-client scan-pr <repository_id_or_name> <base_commit_id> <head_commit_id> \
-  --minimum-severity-level="HIGH"
-```
-
-**package.json integration:**
-```json
-{
-  "scripts": {
-    "test:security": "snyk test && aikido-api-client scan-release $npm_package_name $(git rev-parse HEAD) --minimum-severity-level=HIGH",
-    "test:security:strict": "snyk test && aikido-api-client scan-release $npm_package_name $(git rev-parse HEAD) --minimum-severity-level=HIGH --fail-on-dependency-scan --fail-on-sast-scan --fail-on-secrets-scan"
-  }
-}
-```
-
----
-
-### Phase 3: Vulnerability Remediation (Skill Discovery)
-
-If vulnerabilities are detected, **DO NOT just list errors**. CodyMaster must actively search for remediation skills:
-
-> 🚨 **Vulnerabilities Detected: Initiating Remediation**
-> 
-> Security issues were found. To systematically patch these risks, we need specialized weapons. I suggest finding and installing a dedicated remediation skill for your stack:
-> ```bash
-> npx skills add https://github.com/vercel-labs/skills --skill find-skills
-> ```
-> *(Once you discover and install the appropriate security patch skills, we will use them to eradicate the vulnerabilities and eliminate all security risks).*
-
----
-
-### Phase 4: Knowledge Retention (Memory Sync)
-
-Once vulnerabilities are remediated, the root causes and fixes **MUST** be memorized:
-
-**Action Required:**
-- Trigger `cm-continuity` to log flaw + fix into `CONTINUITY.md` → "Security Lessons" section.
-- If cloud memory is available, sync to `cm-notebooklm` for permanent retention.
-
----
-
-### Phase 5: Automation Handoff (Jules + Continuous Monitoring)
-
-> 🛡️ **Next Step: Automated Security Checks**
-> 
-> Manual checks aren't enough for production. Automate on every commit and PR:
->
-> **Option A — Google Jules** (GitHub automated analysis):
-> 👉 [http://jules.google.com/](http://jules.google.com/)
->
-> **Option B — Snyk Continuous Monitoring:**
-> ```bash
-> snyk monitor
-> ```
->
-> **Option C — Aikido Dashboard** (full visibility):
-> 👉 [https://app.aikido.dev/](https://app.aikido.dev/)
-
----
-
-## Escalation Protocol
-
-When the agent detects ANY of these signals, enforcement escalates from SUGGESTED → MANDATORY:
-
-| Signal | Action |
-|--------|--------|
-| `npm audit` reports HIGH/CRITICAL | Trigger full Snyk + Aikido scan |
-| User mentions "security error" or "hack" | Trigger full scan before proceeding |
-| New major dependency added (e.g., new ORM, auth lib) | Suggest scan, escalate if dep has known CVEs |
-| Pre-deploy / pre-PR-merge | Check if scan was run in this session, block if not (CodyMaster only) |
-| `.snyk` policy file has expired ignores | Re-scan and update policy |
-
----
-
-## Integration
-
-| Skill | Relationship |
-|-------|-------------|
-| `cm-quality-gate` | PRE-REQUISITE: Code should pass functional tests before security audits. Security scan PASS is required evidence for production deploy. |
-| `cm-secret-shield`| COMPLEMENTARY: Secret Shield catches hardcoded tokens at write/commit time; `cm-security-gate` catches vulnerable dependencies and SAST issues. Both are needed. |
-| `cm-safe-deploy`  | INTEGRATED: Security scan is Gate 0.5 in the deploy pipeline (between Secret Hygiene and Syntax). |
-| `cm-test-gate`    | INTEGRATED: `test:security` script pattern uses Snyk + Aikido CLI for automated scanning in the test suite. |
-| `cm-continuity`   | MEMORY: Records discovered vulnerabilities and fixes into working memory. |
-| `cm-notebooklm`   | LONG-TERM MEMORY: Syncs critical security lessons to the permanent cloud AI brain. |
-
-## The Bottom Line
-
-**Scan before deploy. Remediate before release. Memorize before repeating. Non-negotiable.**

package/skills/cm-security-gate/SKILL.md

@@ -1,26 +0,0 @@
----
-name: cm-security-gate
-description: "[Deprecated] deploy safety merged. Use `cm-safe-deploy` instead."
-deprecated: true
-merged_into: cm-safe-deploy
----
-
-# cm-security-gate — Deprecated
-
-> ⚠️ This skill is deprecated as of CodyMaster v6.0.0 and will be removed in v6.1.0.
->
-> **Use `cm-safe-deploy` instead.** deploy safety merged.
->
-> See [docs/migration-v2.md](../../docs/migration-v2.md) for the full mapping.
-
-The original content is preserved at [SKILL.archive.md](SKILL.archive.md) for reference.
-
-## Migration
-
-```bash
-# Old:           cm <use this skill>
-# New (v6.0+):   cm safe-deploy <equivalent action>
-```
-
-If you depend on a capability that didn't carry over, please file an issue:
-https://github.com/tody-agent/codymaster/issues

package/skills/cm-skill-health/SKILL.archive.md

@@ -1,83 +0,0 @@
----
-name: cm-skill-health
-description: "Operational health review for CodyMaster skills using current repo signals: validate-skills, suggest, retro logs, memory, and test gates."
----
-
-# cm-skill-health
-
-Use this skill when a CodyMaster skill feels stale, misleading, unreliable, or under-documented.
-
-## What it checks
-
-1. Discovery drift
-   - Is the skill present in `skills/`, docs indexes, profiles, and README surfaces?
-2. Invocation friction
-   - Does `cm suggest` point users to the skill when the task matches?
-3. Operational evidence
-   - Are there recurring failures or learnings in `.cm/operational-learnings.jsonl`?
-4. Contract health
-   - Does the skill reference commands, files, or paths that still exist?
-5. Release safety
-   - Does the repo still pass `npm run validate:skills`, `npm run check:skills`, and the test gate?
-
-## Workflow
-
-1. Confirm the symptom.
-   - Missing from docs
-   - Missing from profiles
-   - Broken references inside `SKILL.md`
-   - Repeated runtime pain in retro notes
-2. Compare the live skill against:
-   - `docs/skills/index.md`
-   - `skills/profiles/full.txt`
-   - `README.md`
-   - related changelog promises
-3. Scan evidence sources.
-   - `cm advisory handoff --for cm-skill-health`
-   - `cm suggest --project .`
-   - `cm retro summary --project .`
-   - `.cm/CONTINUITY.md`
-   - `rg` over `skills/`, `docs/`, and `src/`
-4. Score the issue.
-   - `healthy`: discoverable, accurate, references valid
-   - `degraded`: present but misleading or inconsistent
-   - `broken`: missing, invalid, or unusable
-5. Hand off to:
-   - `cm-skill-evolution` to repair or derive the next version
-
-## Output
-
-Produce a short health note:
-
-```md
-## Skill Health
-- Skill: cm-...
-- Status: healthy | degraded | broken
-- Symptoms: ...
-- Evidence: ...
-- Recovery path: FIX | DERIVED | CAPTURED
-```
-
-Preferred input contract:
-
-```md
-## Advisory Handoff
-- Consumer: cm-skill-health
-- Skill: cm-...
-- Recovery path: FIX | DERIVED | CAPTURED | NONE
-- Confidence: 0.xx
-- Source analysis: EA-...
-- Task: ...
-- Status: completed | partial | failed
-- Evidence: ...
-- Selected skills: ...
-- Target skills: ...
-- Quality weight: 0.xx
-- Next step: ...
-```
-
-## Red flags
-
-- Do not claim metric dashboards or automatic scoring unless the repo actually implements them.
-- Do not treat README marketing copy as proof that a skill exists.
-- Do not evolve the skill before identifying whether the problem is docs drift, packaging drift, or missing implementation.

package/skills/cm-skill-health/SKILL.md

@@ -1,26 +0,0 @@
----
-name: cm-skill-health
-description: "[Deprecated] skill lifecycle merged. Use `cm-skill-evolution` instead."
-deprecated: true
-merged_into: cm-skill-evolution
----
-
-# cm-skill-health — Deprecated
-
-> ⚠️ This skill is deprecated as of CodyMaster v6.0.0 and will be removed in v6.1.0.
->
-> **Use `cm-skill-evolution` instead.** skill lifecycle merged.
->
-> See [docs/migration-v2.md](../../docs/migration-v2.md) for the full mapping.
-
-The original content is preserved at [SKILL.archive.md](SKILL.archive.md) for reference.
-
-## Migration
-
-```bash
-# Old:           cm <use this skill>
-# New (v6.0+):   cm skill-evolution <equivalent action>
-```
-
-If you depend on a capability that didn't carry over, please file an issue:
-https://github.com/tody-agent/codymaster/issues

package/skills/cm-skill-mastery/SKILL.archive.md

@@ -1,156 +0,0 @@
----
-name: cm-skill-mastery
-description: "Meta-skill for the Cody Master kit — when to invoke skills, how to create new skills, and skill discovery. Use at conversation start to establish skill discipline."
----
-
-# Skill Mastery — Use + Create + Discover
-
-> **The meta-skill:** How to find, use, and create cm-* skills.
-
-## Part A: Using Skills
-
-### The Rule
-
-**Invoke relevant skills BEFORE any response or action.** Even 1% chance = check the skill.
-
-### Decision Flow
-
-```
-User message received
-  → Might any skill apply? (even 1%)
-    → YES: Read the skill → Follow it
-    → NO: Respond directly
-```
-
-### Skill Priority
-
-1. **Process skills first** (cm-planning, cm-debugging) — determine HOW to approach
-2. **Implementation skills second** (cm-tdd, cm-safe-deploy) — guide execution
-
-### Red Flags
-
-| Thought | Reality |
-|---------|---------|
-| "This is just a simple question" | Questions are tasks. Check for skills. |
-| "I need more context first" | Skill check BEFORE clarifying questions. |
-| "The skill is overkill" | Simple things become complex. Use it. |
-| "I remember this skill" | Skills evolve. Read current version. |
-| "Let me just do this one thing first" | Check BEFORE doing anything. |
-
-### Skill Types
-
-- **Rigid** (cm-tdd, cm-debugging): Follow exactly. Don't adapt away discipline.
-- **Flexible** (cm-planning): Adapt principles to context.
-
----
-
-## Part B: Creating Skills
-
-### When to Create
-
-- Pattern repeated across 3+ projects
-- Complex process that needs documentation
-- Team convention that should be enforced
-
-### Skill Structure
-
-```markdown
----
-name: cm-[skill-name]
-description: "One line: when to use this skill"
----
-
-# [Skill Title]
-
-## Overview
-What and why. Core principle.
-
-## When to Use
-Specific triggers.
-
-## The Process
-Step-by-step instructions.
-
-## Red Flags
-What NOT to do.
-
-## Integration
-How it connects to other cm-* skills.
-```
-
-### Rules
-
-```
-✅ DO:
-- Keep under 400 lines (token optimization)
-- Use tables and code blocks for density
-- Include Red Flags section
-- Reference other cm-* skills by name
-- Test skill with real scenarios before deploying
-
-❌ DON'T:
-- Write prose when a table works
-- Duplicate content from other skills (reference instead)
-- Create skills for one-time tasks
-- Exceed 600 lines without good reason
-```
-
-### Token Optimization
-
-| Technique | Saves |
-|-----------|-------|
-| Tables over prose | ~40% |
-| Code blocks over explanation | ~30% |
-| Reference other skills vs duplicate | ~50% |
-| Remove obvious examples | ~20% |
-
----
-
-## Part C: Discovering Skills
-
-### Adaptive Skills Discovery
-
-When you encounter something you don't have a skill for:
-
-```
-1. DETECT  → "I need to do X but no matching skill"
-2. SEARCH  → npx skills find "{keyword}"
-3. REVIEW  → Read the SKILL.md — safe? relevant?
-4. ASK     → "Found skill '{name}'. Install?"
-5. INSTALL → npx skills add {source} --skill {name} -a antigravity
-6. USE     → Apply the skill
-7. LOG     → Record in .cm-skills-log.json
-```
-
-### Safety Rules
-
-- Always show user what you found before installing
-- Prefer known repos (vercel-labs/agent-skills)
-- Project-level by default, global only if agreed
-- Check `npx skills list` to avoid duplicates
-- Never override existing cm-* skills with external ones
-
----
-
-## The Cody Master Kit (14 skills)
-
-| # | Skill | Purpose |
-|---|-------|---------|
-| 1 | `cm-project-bootstrap` | Start new projects |
-| 2 | `cm-brainstorm-idea` | Strategic analysis gate for enhancements (9 Windows + Double Diamond) |
-| 3 | `cm-planning` | Brainstorm + write plans |
-| 4 | `cm-execution` | Execute plans (batch/subagent/parallel) |
-| 5 | `cm-tdd` | Test-driven development |
-| 6 | `cm-quality-gate` | Test + verify + frontend safety |
-| 7 | `cm-code-review` | Request + receive + finish branch |
-| 8 | `cm-safe-deploy` | 6-gate deploy pipeline |
-| 9 | `cm-safe-i18n` | i18n batching + safety |
-| 10 | `cm-debugging` | Systematic root-cause debugging |
-| 11 | `cm-terminal` | Terminal command monitoring |
-| 12 | `cm-git-worktrees` | Isolated workspaces |
-| 13 | `cm-skill-mastery` | This skill (meta) |
-| 14 | `cm-identity-guard` | Git/deploy identity safety |
-
-## The Bottom Line
-
-**Skills are discipline, not overhead. Use them. Create them. Never skip them.**

package/skills/cm-skill-mastery/SKILL.md

@@ -1,26 +0,0 @@
----
-name: cm-skill-mastery
-description: "[Deprecated] discovery and meta-skill merged. Use `cm-skill-index` instead."
-deprecated: true
-merged_into: cm-skill-index
----
-
-# cm-skill-mastery — Deprecated
-
-> ⚠️ This skill is deprecated as of CodyMaster v6.0.0 and will be removed in v6.1.0.
->
-> **Use `cm-skill-index` instead.** discovery and meta-skill merged.
->
-> See [docs/migration-v2.md](../../docs/migration-v2.md) for the full mapping.
-
-The original content is preserved at [SKILL.archive.md](SKILL.archive.md) for reference.
-
-## Migration
-
-```bash
-# Old:           cm <use this skill>
-# New (v6.0+):   cm skill-index <equivalent action>
-```
-
-If you depend on a capability that didn't carry over, please file an issue:
-https://github.com/tody-agent/codymaster/issues

package/skills/cm-skill-search/SKILL.archive.md

@@ -1,49 +0,0 @@
----
-name: cm-skill-search
-description: "Find the best CodyMaster skill using the shipped indexes, profiles, docs, and contextual suggestions."
----
-
-# cm-skill-search
-
-Use this skill when you need to find the right CodyMaster skill quickly and avoid loading the wrong `SKILL.md`.
-
-## Search order
-
-1. Fast path
-   - `cm suggest --project .`
-2. Library index
-   - `docs/skills/index.md`
-   - `docs/skills/*.md` category pages
-3. Progressive disclosure
-   - `skills/cm-skill-index/SKILL.md`
-4. Raw filesystem search
-   - `rg -n "<keyword>" skills docs README.md`
-5. Fallback
-   - if nothing matches, use `cm-skill-health` to check whether the missing skill is docs drift or a real gap
-
-## Query workflow
-
-1. Normalize the intent into 2-5 keywords.
-2. Search category pages before opening full skills.
-3. Open only the top 1-3 candidate `SKILL.md` files.
-4. Prefer the skill whose triggers, outputs, and lifecycle placement best match the task.
-5. If two skills overlap:
-   - choose the earlier lifecycle gate first
-   - example: `cm-brainstorm-idea` before `cm-planning`
-
-## Tie-breakers
-
-- Need diagnosis before repair: choose `cm-skill-health`
-- Need to repair a skill: choose `cm-skill-evolution`
-- Need to distribute a skill pack: choose `cm-skill-share`
-- Need the general index first: choose `cm-skill-index`
-
-## Output
-
-```md
-## Skill Search Result
-- Task: ...
-- Best match: cm-...
-- Runner-up: cm-...
-- Why: ...
-```

package/skills/cm-skill-search/SKILL.md

@@ -1,26 +0,0 @@
----
-name: cm-skill-search
-description: "[Deprecated] discovery merged. Use `cm-skill-index` instead."
-deprecated: true
-merged_into: cm-skill-index
----
-
-# cm-skill-search — Deprecated
-
-> ⚠️ This skill is deprecated as of CodyMaster v6.0.0 and will be removed in v6.1.0.
->
-> **Use `cm-skill-index` instead.** discovery merged.
->
-> See [docs/migration-v2.md](../../docs/migration-v2.md) for the full mapping.
-
-The original content is preserved at [SKILL.archive.md](SKILL.archive.md) for reference.
-
-## Migration
-
-```bash
-# Old:           cm <use this skill>
-# New (v6.0+):   cm skill-index <equivalent action>
-```
-
-If you depend on a capability that didn't carry over, please file an issue:
-https://github.com/tody-agent/codymaster/issues

package/skills/cm-skill-share/SKILL.archive.md

@@ -1,58 +0,0 @@
----
-name: cm-skill-share
-description: "Package, review, export, and import CodyMaster skill folders safely across machines or teams."
----
-
-# cm-skill-share
-
-Use this skill when moving a CodyMaster skill between repos, machines, or teammates.
-
-## What to share
-
-Always treat a skill as a folder, not just `SKILL.md`.
-
-Check for:
-- `SKILL.md`
-- templates
-- scripts
-- references
-- assets
-- profile/index entries that must move with it
-
-## Export checklist
-
-1. Validate the source skill.
-   - `npm run validate:skills`
-2. Inspect companion files inside the skill folder.
-3. Note external dependencies the target repo must already have.
-4. Copy the entire folder.
-5. Update destination discovery surfaces if the skill becomes user-facing.
-
-## Import checklist
-
-1. Place the folder under `skills/cm-.../`
-2. Run:
-   - `npm run validate:skills`
-   - `npm run check:skills`
-3. Add it to:
-   - `skills/profiles/full.txt`
-   - docs skill index pages
-   - README only if the skill is part of the public catalog
-4. Verify referenced commands and files exist in the target repo.
-
-## Red flags
-
-- Do not import only the markdown file if the skill depends on scripts or templates.
-- Do not advertise the skill publicly before it is indexed and validated.
-- Do not overwrite an existing skill without comparing behavior and references first.
-
-## Output
-
-```md
-## Skill Share
-- Skill: cm-...
-- Direction: export | import
-- Companion files checked: yes | no
-- Discovery surfaces updated: yes | no
-- Validation: pass | fail
-```