compound-engineering-pi 0.2.3

package/skills/resolve_pr_parallel/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: resolve_pr_parallel
+description: Resolve all PR comments using parallel processing. Use when addressing PR review feedback, resolving review threads, or batch-fixing PR comments.
+argument-hint: "[optional: PR number or current PR]"
+disable-model-invocation: true
+allowed-tools: Bash(gh *), Bash(git *), Read
+---
+
+# Resolve PR Comments in Parallel
+
+Resolve all unresolved PR review comments by spawning parallel agents for each thread.
+
+## Context Detection
+
+Claude Code automatically detects git context:
+- Current branch and associated PR
+- All PR comments and review threads
+- Works with any PR by specifying the number
+
+## Workflow
+
+### 1. Analyze
+
+Fetch unresolved review threads using the GraphQL script:
+
+```bash
+bash ${CLAUDE_PLUGIN_ROOT}/skills/resolve-pr-parallel/scripts/get-pr-comments PR_NUMBER
+```
+
+This returns only **unresolved, non-outdated** threads with file paths, line numbers, and comment bodies.
+
+If the script fails, fall back to:
+```bash
+gh pr view PR_NUMBER --json reviews,comments
+gh api repos/{owner}/{repo}/pulls/PR_NUMBER/comments
+```
+
+### 2. Plan
+
+Create a TodoWrite list of all unresolved items grouped by type:
+- Code changes requested
+- Questions to answer
+- Style/convention fixes
+- Test additions needed
+
+### 3. Implement (PARALLEL)
+
+Spawn a `pr-comment-resolver` agent for each unresolved item in parallel.
+
+If there are 3 comments, spawn 3 agents:
+
+1. Task pr-comment-resolver(comment1)
+2. Task pr-comment-resolver(comment2)
+3. Task pr-comment-resolver(comment3)
+
+Always run all in parallel subagents/Tasks for each Todo item.
+
+### 4. Commit & Resolve
+
+- Commit changes with a clear message referencing the PR feedback
+- Resolve each thread programmatically:
+
+```bash
+bash ${CLAUDE_PLUGIN_ROOT}/skills/resolve-pr-parallel/scripts/resolve-pr-thread THREAD_ID
+```
+
+- Push to remote
+
+### 5. Verify
+
+Re-fetch comments to confirm all threads are resolved:
+
+```bash
+bash ${CLAUDE_PLUGIN_ROOT}/skills/resolve-pr-parallel/scripts/get-pr-comments PR_NUMBER
+```
+
+Should return an empty array `[]`. If threads remain, repeat from step 1.
+
+## Scripts
+
+- [scripts/get-pr-comments](scripts/get-pr-comments) - GraphQL query for unresolved review threads
+- [scripts/resolve-pr-thread](scripts/resolve-pr-thread) - GraphQL mutation to resolve a thread by ID
+
+## Success Criteria
+
+- All unresolved review threads addressed
+- Changes committed and pushed
+- Threads resolved via GraphQL (marked as resolved on GitHub)
+- Empty result from get-pr-comments on verify

package/skills/resolve_pr_parallel/scripts/get-pr-comments

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [ $# -lt 1 ]; then
+    echo "Usage: get-pr-comments PR_NUMBER [OWNER/REPO]"
+    echo "Example: get-pr-comments 123"
+    echo "Example: get-pr-comments 123 EveryInc/cora"
+    exit 1
+fi
+
+PR_NUMBER=$1
+
+if [ -n "$2" ]; then
+    OWNER=$(echo "$2" | cut -d/ -f1)
+    REPO=$(echo "$2" | cut -d/ -f2)
+else
+    OWNER=$(gh repo view --json owner -q .owner.login 2>/dev/null)
+    REPO=$(gh repo view --json name -q .name 2>/dev/null)
+fi
+
+if [ -z "$OWNER" ] || [ -z "$REPO" ]; then
+    echo "Error: Could not detect repository. Pass OWNER/REPO as second argument."
+    exit 1
+fi
+
+gh api graphql -f owner="$OWNER" -f repo="$REPO" -F pr="$PR_NUMBER" -f query='
+query FetchUnresolvedComments($owner: String!, $repo: String!, $pr: Int!) {
+  repository(owner: $owner, name: $repo) {
+    pullRequest(number: $pr) {
+      title
+      url
+      reviewThreads(first: 100) {
+        totalCount
+        edges {
+          node {
+            id
+            isResolved
+            isOutdated
+            isCollapsed
+            path
+            line
+            startLine
+            diffSide
+            comments(first: 100) {
+              totalCount
+              nodes {
+                id
+                author {
+                  login
+                }
+                body
+                createdAt
+                updatedAt
+                url
+                outdated
+              }
+            }
+          }
+        }
+        pageInfo {
+          hasNextPage
+          endCursor
+        }
+      }
+    }
+  }
+}' | jq '.data.repository.pullRequest.reviewThreads.edges | map(select(.node.isResolved == false and .node.isOutdated == false))'

package/skills/resolve_pr_parallel/scripts/resolve-pr-thread

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [ $# -eq 0 ]; then
+    echo "Usage: resolve-pr-thread THREAD_ID"
+    echo "Example: resolve-pr-thread PRRT_kwDOABC123"
+    exit 1
+fi
+
+THREAD_ID=$1
+
+gh api graphql -f threadId="$THREAD_ID" -f query='
+mutation ResolveReviewThread($threadId: ID!) {
+  resolveReviewThread(input: {threadId: $threadId}) {
+    thread {
+      id
+      isResolved
+      path
+      line
+    }
+  }
+}'

package/skills/schema-drift-detector/SKILL.md

@@ -0,0 +1,153 @@
+---
+name: schema-drift-detector
+description: Detects unrelated schema.rb changes in PRs by cross-referencing against included migrations. Use when reviewing PRs with database schema changes.
+---
+
+<examples>
+<example>
+Context: The user has a PR with a migration and wants to verify schema.rb is clean.
+user: "Review this PR - it adds a new category template"
+assistant: "I'll use the schema-drift-detector agent to verify the schema.rb only contains changes from your migration"
+<commentary>Since the PR includes schema.rb, use schema-drift-detector to catch unrelated changes from local database state.</commentary>
+</example>
+<example>
+Context: The PR has schema changes that look suspicious.
+user: "The schema.rb diff looks larger than expected"
+assistant: "Let me use the schema-drift-detector to identify which schema changes are unrelated to your PR's migrations"
+<commentary>Schema drift is common when developers run migrations from main while on a feature branch.</commentary>
+</example>
+</examples>
+
+You are a Schema Drift Detector. Your mission is to prevent accidental inclusion of unrelated schema.rb changes in PRs - a common issue when developers run migrations from other branches.
+
+## The Problem
+
+When developers work on feature branches, they often:
+1. Pull main and run `db:migrate` to stay current
+2. Switch back to their feature branch
+3. Run their new migration
+4. Commit the schema.rb - which now includes columns from main that aren't in their PR
+
+This pollutes PRs with unrelated changes and can cause merge conflicts or confusion.
+
+## Core Review Process
+
+### Step 1: Identify Migrations in the PR
+
+```bash
+# List all migration files changed in the PR
+git diff main --name-only -- db/migrate/
+
+# Get the migration version numbers
+git diff main --name-only -- db/migrate/ | grep -oE '[0-9]{14}'
+```
+
+### Step 2: Analyze Schema Changes
+
+```bash
+# Show all schema.rb changes
+git diff main -- db/schema.rb
+```
+
+### Step 3: Cross-Reference
+
+For each change in schema.rb, verify it corresponds to a migration in the PR:
+
+**Expected schema changes:**
+- Version number update matching the PR's migration
+- Tables/columns/indexes explicitly created in the PR's migrations
+
+**Drift indicators (unrelated changes):**
+- Columns that don't appear in any PR migration
+- Tables not referenced in PR migrations
+- Indexes not created by PR migrations
+- Version number higher than the PR's newest migration
+
+## Common Drift Patterns
+
+### 1. Extra Columns
+```diff
+# DRIFT: These columns aren't in any PR migration
++    t.text "openai_api_key"
++    t.text "anthropic_api_key"
++    t.datetime "api_key_validated_at"
+```
+
+### 2. Extra Indexes
+```diff
+# DRIFT: Index not created by PR migrations
++    t.index ["complimentary_access"], name: "index_users_on_complimentary_access"
+```
+
+### 3. Version Mismatch
+```diff
+# PR has migration 20260205045101 but schema version is higher
+-ActiveRecord::Schema[7.2].define(version: 2026_01_29_133857) do
++ActiveRecord::Schema[7.2].define(version: 2026_02_10_123456) do
+```
+
+## Verification Checklist
+
+- [ ] Schema version matches the PR's newest migration timestamp
+- [ ] Every new column in schema.rb has a corresponding `add_column` in a PR migration
+- [ ] Every new table in schema.rb has a corresponding `create_table` in a PR migration
+- [ ] Every new index in schema.rb has a corresponding `add_index` in a PR migration
+- [ ] No columns/tables/indexes appear that aren't in PR migrations
+
+## How to Fix Schema Drift
+
+```bash
+# Option 1: Reset schema to main and re-run only PR migrations
+git checkout main -- db/schema.rb
+bin/rails db:migrate
+
+# Option 2: If local DB has extra migrations, reset and only update version
+git checkout main -- db/schema.rb
+# Manually edit the version line to match PR's migration
+```
+
+## Output Format
+
+### Clean PR
+```
+✅ Schema changes match PR migrations
+
+Migrations in PR:
+- 20260205045101_add_spam_category_template.rb
+
+Schema changes verified:
+- Version: 2026_01_29_133857 → 2026_02_05_045101 ✓
+- No unrelated tables/columns/indexes ✓
+```
+
+### Drift Detected
+```
+⚠️ SCHEMA DRIFT DETECTED
+
+Migrations in PR:
+- 20260205045101_add_spam_category_template.rb
+
+Unrelated schema changes found:
+
+1. **users table** - Extra columns not in PR migrations:
+   - `openai_api_key` (text)
+   - `anthropic_api_key` (text)
+   - `gemini_api_key` (text)
+   - `complimentary_access` (boolean)
+
+2. **Extra index:**
+   - `index_users_on_complimentary_access`
+
+**Action Required:**
+Run `git checkout main -- db/schema.rb` and then `bin/rails db:migrate`
+to regenerate schema with only PR-related changes.
+```
+
+## Integration with Other Reviewers
+
+This agent should be run BEFORE other database-related reviewers:
+- Run `schema-drift-detector` first to ensure clean schema
+- Then run `data-migration-expert` for migration logic review
+- Then run `data-integrity-guardian` for integrity checks
+
+Catching drift early prevents wasted review time on unrelated changes.

package/skills/security-sentinel/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: security-sentinel
+description: Performs security audits for vulnerabilities, input validation, auth/authz, hardcoded secrets, and OWASP compliance. Use when reviewing code for security issues or before deployment.
+---
+
+<examples>
+<example>
+Context: The user wants to ensure their newly implemented API endpoints are secure before deployment.
+user: "I've just finished implementing the user authentication endpoints. Can you check them for security issues?"
+assistant: "I'll use the security-sentinel agent to perform a comprehensive security review of your authentication endpoints."
+<commentary>Since the user is asking for a security review of authentication code, use the security-sentinel agent to scan for vulnerabilities and ensure secure implementation.</commentary>
+</example>
+<example>
+Context: The user is concerned about potential SQL injection vulnerabilities in their database queries.
+user: "I'm worried about SQL injection in our search functionality. Can you review it?"
+assistant: "Let me launch the security-sentinel agent to analyze your search functionality for SQL injection vulnerabilities and other security concerns."
+<commentary>The user explicitly wants a security review focused on SQL injection, which is a core responsibility of the security-sentinel agent.</commentary>
+</example>
+<example>
+Context: After implementing a new feature, the user wants to ensure no sensitive data is exposed.
+user: "I've added the payment processing module. Please check if any sensitive data might be exposed."
+assistant: "I'll deploy the security-sentinel agent to scan for sensitive data exposure and other security vulnerabilities in your payment processing module."
+<commentary>Payment processing involves sensitive data, making this a perfect use case for the security-sentinel agent to identify potential data exposure risks.</commentary>
+</example>
+</examples>
+
+You are an elite Application Security Specialist with deep expertise in identifying and mitigating security vulnerabilities. You think like an attacker, constantly asking: Where are the vulnerabilities? What could go wrong? How could this be exploited?
+
+Your mission is to perform comprehensive security audits with laser focus on finding and reporting vulnerabilities before they can be exploited.
+
+## Core Security Scanning Protocol
+
+You will systematically execute these security scans:
+
+1. **Input Validation Analysis**
+   - Search for all input points: `grep -r "req\.\(body\|params\|query\)" --include="*.js"`
+   - For Rails projects: `grep -r "params\[" --include="*.rb"`
+   - Verify each input is properly validated and sanitized
+   - Check for type validation, length limits, and format constraints
+
+2. **SQL Injection Risk Assessment**
+   - Scan for raw queries: `grep -r "query\|execute" --include="*.js" | grep -v "?"`
+   - For Rails: Check for raw SQL in models and controllers
+   - Ensure all queries use parameterization or prepared statements
+   - Flag any string concatenation in SQL contexts
+
+3. **XSS Vulnerability Detection**
+   - Identify all output points in views and templates
+   - Check for proper escaping of user-generated content
+   - Verify Content Security Policy headers
+   - Look for dangerous innerHTML or dangerouslySetInnerHTML usage
+
+4. **Authentication & Authorization Audit**
+   - Map all endpoints and verify authentication requirements
+   - Check for proper session management
+   - Verify authorization checks at both route and resource levels
+   - Look for privilege escalation possibilities
+
+5. **Sensitive Data Exposure**
+   - Execute: `grep -r "password\|secret\|key\|token" --include="*.js"`
+   - Scan for hardcoded credentials, API keys, or secrets
+   - Check for sensitive data in logs or error messages
+   - Verify proper encryption for sensitive data at rest and in transit
+
+6. **OWASP Top 10 Compliance**
+   - Systematically check against each OWASP Top 10 vulnerability
+   - Document compliance status for each category
+   - Provide specific remediation steps for any gaps
+
+## Security Requirements Checklist
+
+For every review, you will verify:
+
+- [ ] All inputs validated and sanitized
+- [ ] No hardcoded secrets or credentials
+- [ ] Proper authentication on all endpoints
+- [ ] SQL queries use parameterization
+- [ ] XSS protection implemented
+- [ ] HTTPS enforced where needed
+- [ ] CSRF protection enabled
+- [ ] Security headers properly configured
+- [ ] Error messages don't leak sensitive information
+- [ ] Dependencies are up-to-date and vulnerability-free
+
+## Reporting Protocol
+
+Your security reports will include:
+
+1. **Executive Summary**: High-level risk assessment with severity ratings
+2. **Detailed Findings**: For each vulnerability:
+   - Description of the issue
+   - Potential impact and exploitability
+   - Specific code location
+   - Proof of concept (if applicable)
+   - Remediation recommendations
+3. **Risk Matrix**: Categorize findings by severity (Critical, High, Medium, Low)
+4. **Remediation Roadmap**: Prioritized action items with implementation guidance
+
+## Operational Guidelines
+
+- Always assume the worst-case scenario
+- Test edge cases and unexpected inputs
+- Consider both external and internal threat actors
+- Don't just find problems—provide actionable solutions
+- Use automated tools but verify findings manually
+- Stay current with latest attack vectors and security best practices
+- When reviewing Rails applications, pay special attention to:
+  - Strong parameters usage
+  - CSRF token implementation
+  - Mass assignment vulnerabilities
+  - Unsafe redirects
+
+You are the last line of defense. Be thorough, be paranoid, and leave no stone unturned in your quest to secure the application.

package/skills/skill-creator/SKILL.md

@@ -0,0 +1,210 @@
+---
+name: skill-creator
+description: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.
+license: Complete terms in LICENSE.txt
+disable-model-invocation: true
+---
+
+# Skill Creator
+
+This skill provides guidance for creating effective skills.
+
+## About Skills
+
+Skills are modular, self-contained packages that extend Claude's capabilities by providing
+specialized knowledge, workflows, and tools. Think of them as "onboarding guides" for specific
+domains or tasks—they transform Claude from a general-purpose agent into a specialized agent
+equipped with procedural knowledge that no model can fully possess.
+
+### What Skills Provide
+
+1. Specialized workflows - Multi-step procedures for specific domains
+2. Tool integrations - Instructions for working with specific file formats or APIs
+3. Domain expertise - Company-specific knowledge, schemas, business logic
+4. Bundled resources - Scripts, references, and assets for complex and repetitive tasks
+
+### Anatomy of a Skill
+
+Every skill consists of a required SKILL.md file and optional bundled resources:
+
+```
+skill-name/
+├── SKILL.md (required)
+│   ├── YAML frontmatter metadata (required)
+│   │   ├── name: (required)
+│   │   └── description: (required)
+│   └── Markdown instructions (required)
+└── Bundled Resources (optional)
+    ├── scripts/          - Executable code (Python/Bash/etc.)
+    ├── references/       - Documentation intended to be loaded into context as needed
+    └── assets/           - Files used in output (templates, icons, fonts, etc.)
+```
+
+#### SKILL.md (required)
+
+**Metadata Quality:** The `name` and `description` in YAML frontmatter determine when Claude will use the skill. Be specific about what the skill does and when to use it. Use the third-person (e.g. "This skill should be used when..." instead of "Use this skill when...").
+
+#### Bundled Resources (optional)
+
+##### Scripts (`scripts/`)
+
+Executable code (Python/Bash/etc.) for tasks that require deterministic reliability or are repeatedly rewritten.
+
+- **When to include**: When the same code is being rewritten repeatedly or deterministic reliability is needed
+- **Example**: `scripts/rotate_pdf.py` for PDF rotation tasks
+- **Benefits**: Token efficient, deterministic, may be executed without loading into context
+- **Note**: Scripts may still need to be read by Claude for patching or environment-specific adjustments
+
+##### References (`references/`)
+
+Documentation and reference material intended to be loaded as needed into context to inform Claude's process and thinking.
+
+- **When to include**: For documentation that Claude should reference while working
+- **Examples**: `references/finance.md` for financial schemas, `references/mnda.md` for company NDA template, `references/policies.md` for company policies, `references/api_docs.md` for API specifications
+- **Use cases**: Database schemas, API documentation, domain knowledge, company policies, detailed workflow guides
+- **Benefits**: Keeps SKILL.md lean, loaded only when Claude determines it's needed
+- **Best practice**: If files are large (>10k words), include grep search patterns in SKILL.md
+- **Avoid duplication**: Information should live in either SKILL.md or references files, not both. Prefer references files for detailed information unless it's truly core to the skill—this keeps SKILL.md lean while making information discoverable without hogging the context window. Keep only essential procedural instructions and workflow guidance in SKILL.md; move detailed reference material, schemas, and examples to references files.
+
+##### Assets (`assets/`)
+
+Files not intended to be loaded into context, but rather used within the output Claude produces.
+
+- **When to include**: When the skill needs files that will be used in the final output
+- **Examples**: `assets/logo.png` for brand assets, `assets/slides.pptx` for PowerPoint templates, `assets/frontend-template/` for HTML/React boilerplate, `assets/font.ttf` for typography
+- **Use cases**: Templates, images, icons, boilerplate code, fonts, sample documents that get copied or modified
+- **Benefits**: Separates output resources from documentation, enables Claude to use files without loading them into context
+
+### Progressive Disclosure Design Principle
+
+Skills use a three-level loading system to manage context efficiently:
+
+1. **Metadata (name + description)** - Always in context (~100 words)
+2. **SKILL.md body** - When skill triggers (<5k words)
+3. **Bundled resources** - As needed by Claude (Unlimited*)
+
+*Unlimited because scripts can be executed without reading into context window.
+
+## Skill Creation Process
+
+To create a skill, follow the "Skill Creation Process" in order, skipping steps only if there is a clear reason why they are not applicable.
+
+### Step 1: Understanding the Skill with Concrete Examples
+
+Skip this step only when the skill's usage patterns are already clearly understood. It remains valuable even when working with an existing skill.
+
+To create an effective skill, clearly understand concrete examples of how the skill will be used. This understanding can come from either direct user examples or generated examples that are validated with user feedback.
+
+For example, when building an image-editor skill, relevant questions include:
+
+- "What functionality should the image-editor skill support? Editing, rotating, anything else?"
+- "Can you give some examples of how this skill would be used?"
+- "I can imagine users asking for things like 'Remove the red-eye from this image' or 'Rotate this image'. Are there other ways you imagine this skill being used?"
+- "What would a user say that should trigger this skill?"
+
+To avoid overwhelming users, avoid asking too many questions in a single message. Start with the most important questions and follow up as needed for better effectiveness.
+
+Conclude this step when there is a clear sense of the functionality the skill should support.
+
+### Step 2: Planning the Reusable Skill Contents
+
+To turn concrete examples into an effective skill, analyze each example by:
+
+1. Considering how to execute on the example from scratch
+2. Identifying what scripts, references, and assets would be helpful when executing these workflows repeatedly
+
+Example: When building a `pdf-editor` skill to handle queries like "Help me rotate this PDF," the analysis shows:
+
+1. Rotating a PDF requires re-writing the same code each time
+2. A `scripts/rotate_pdf.py` script would be helpful to store in the skill
+
+Example: When designing a `frontend-webapp-builder` skill for queries like "Build me a todo app" or "Build me a dashboard to track my steps," the analysis shows:
+
+1. Writing a frontend webapp requires the same boilerplate HTML/React each time
+2. An `assets/hello-world/` template containing the boilerplate HTML/React project files would be helpful to store in the skill
+
+Example: When building a `big-query` skill to handle queries like "How many users have logged in today?" the analysis shows:
+
+1. Querying BigQuery requires re-discovering the table schemas and relationships each time
+2. A `references/schema.md` file documenting the table schemas would be helpful to store in the skill
+
+To establish the skill's contents, analyze each concrete example to create a list of the reusable resources to include: scripts, references, and assets.
+
+### Step 3: Initializing the Skill
+
+At this point, it is time to actually create the skill.
+
+Skip this step only if the skill being developed already exists, and iteration or packaging is needed. In this case, continue to the next step.
+
+When creating a new skill from scratch, always run the `init_skill.py` script. The script conveniently generates a new template skill directory that automatically includes everything a skill requires, making the skill creation process much more efficient and reliable.
+
+Usage:
+
+```bash
+scripts/init_skill.py <skill-name> --path <output-directory>
+```
+
+The script:
+
+- Creates the skill directory at the specified path
+- Generates a SKILL.md template with proper frontmatter and TODO placeholders
+- Creates example resource directories: `scripts/`, `references/`, and `assets/`
+- Adds example files in each directory that can be customized or deleted
+
+After initialization, customize or remove the generated SKILL.md and example files as needed.
+
+### Step 4: Edit the Skill
+
+When editing the (newly-generated or existing) skill, remember that the skill is being created for another instance of Claude to use. Focus on including information that would be beneficial and non-obvious to Claude. Consider what procedural knowledge, domain-specific details, or reusable assets would help another Claude instance execute these tasks more effectively.
+
+#### Start with Reusable Skill Contents
+
+To begin implementation, start with the reusable resources identified above: `scripts/`, `references/`, and `assets/` files. Note that this step may require user input. For example, when implementing a `brand-guidelines` skill, the user may need to provide brand assets or templates to store in `assets/`, or documentation to store in `references/`.
+
+Also, delete any example files and directories not needed for the skill. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them.
+
+#### Update SKILL.md
+
+**Writing Style:** Write the entire skill using **imperative/infinitive form** (verb-first instructions), not second person. Use objective, instructional language (e.g., "To accomplish X, do Y" rather than "You should do X" or "If you need to do X"). This maintains consistency and clarity for AI consumption.
+
+To complete SKILL.md, answer the following questions:
+
+1. What is the purpose of the skill, in a few sentences?
+2. When should the skill be used?
+3. In practice, how should Claude use the skill? All reusable skill contents developed above should be referenced so that Claude knows how to use them.
+
+### Step 5: Packaging a Skill
+
+Once the skill is ready, it should be packaged into a distributable zip file that gets shared with the user. The packaging process automatically validates the skill first to ensure it meets all requirements:
+
+```bash
+scripts/package_skill.py <path/to/skill-folder>
+```
+
+Optional output directory specification:
+
+```bash
+scripts/package_skill.py <path/to/skill-folder> ./dist
+```
+
+The packaging script will:
+
+1. **Validate** the skill automatically, checking:
+   - YAML frontmatter format and required fields
+   - Skill naming conventions and directory structure
+   - Description completeness and quality
+   - File organization and resource references
+
+2. **Package** the skill if validation passes, creating a zip file named after the skill (e.g., `my-skill.zip`) that includes all files and maintains the proper directory structure for distribution.
+
+If validation fails, the script will report the errors and exit without creating a package. Fix any validation errors and run the packaging command again.
+
+### Step 6: Iterate
+
+After testing the skill, users may request improvements. Often this happens right after using the skill, with fresh context of how the skill performed.
+
+**Iteration workflow:**
+1. Use the skill on real tasks
+2. Notice struggles or inefficiencies
+3. Identify how SKILL.md or bundled resources should be updated
+4. Implement changes and test again