contextos-agents 2.0.0 → 2.1.1

package/catalog/skills/react/EXAMPLES.md

@@ -0,0 +1,79 @@
+# React Examples - Anti-patterns vs ContextOS Standard
+
+## Example 1: Derived State vs. useEffect
+
+### Anti-pattern: Anti-pattern (Redundant state + extra render with useEffect)
+
+```tsx
+// BAD: causes an unnecessary extra render cycle and potential state desync
+function OrderSummary({ items }: { items: CartItem[] }) {
+  const [total, setTotal] = useState(0);
+
+  useEffect(() => {
+    const calculated = items.reduce((sum, item) => sum + item.price * item.quantity, 0);
+    setTotal(calculated);
+  }, [items]);
+
+  return <div>Total: ${total}</div>;
+}
+```
+
+### Best practice: ContextOS Standard (Inline derived calculation / useMemo)
+
+```tsx
+// GOOD: calculated instantly during render with zero extra render pass
+function OrderSummary({ items }: { items: CartItem[] }) {
+  const total = useMemo(
+    () => items.reduce((sum, item) => sum + item.price * item.quantity, 0),
+    [items]
+  );
+
+  return <div>Total: ${total.toFixed(2)}</div>;
+}
+```
+
+---
+
+## Example 2: Custom Hook Encapsulation
+
+### Anti-pattern: Anti-pattern (Scattered listener logic inside component)
+
+```tsx
+// BAD: window listener logic cluttering UI component
+function NavHeader() {
+  const [isScrolled, setIsScrolled] = useState(false);
+  useEffect(() => {
+    const handleScroll = () => setIsScrolled(window.scrollY > 50);
+    window.addEventListener('scroll', handleScroll);
+    return () => window.removeEventListener('scroll', handleScroll);
+  }, []);
+  return <header className={isScrolled ? 'scrolled' : ''}>Header</header>;
+}
+```
+
+### Best practice: ContextOS Standard (Reusable Custom Hook)
+
+```tsx
+// GOOD: extracted into a reusable, testable custom hook
+export function useScrollThreshold(threshold = 50): boolean {
+  const [isPassed, setIsPassed] = useState(() => typeof window !== 'undefined' && window.scrollY > threshold);
+
+  useEffect(() => {
+    let ticking = false;
+    const handleScroll = () => {
+      if (!ticking) {
+        window.requestAnimationFrame(() => {
+          setIsPassed(window.scrollY > threshold);
+          ticking = false;
+        });
+        ticking = true;
+      }
+    };
+
+    window.addEventListener('scroll', handleScroll, { passive: true });
+    return () => window.removeEventListener('scroll', handleScroll);
+  }, [threshold]);
+
+  return isPassed;
+}
+```

package/catalog/skills/react/SKILL.md

@@ -0,0 +1,132 @@
+---
+name: React
+description: >
+  ContextOS skill for modern React (v18/v19), component architecture, state colocation, render optimization, and Vercel performance rules.
+---
+
+# React Engineering & Performance Best Practices
+
+## Overview
+
+Enforces declarative, component-driven UI architecture with optimal re-render cycles, state colocation, responsive optimistic updates, and robust accessibility standards.
+
+## When to Use
+
+Activate whenever creating, refactoring, or optimizing React functional components, custom hooks, context providers, or UI interaction states.
+
+## Negative Constraints (What NOT to Do)
+
+1. **NEVER use `useEffect` to synchronize or compute derived state**: Calculate derived state inline during render. Use `useMemo` only for computationally intensive derivations.
+2. **NEVER use array indices as `key` props on dynamic or reorderable lists**: Always use stable, unique entity identifiers (`item.id`).
+3. **NEVER mutate React state directly**: Always return new immutable references (`[...prev, newItem]` or `{ ...prev, key: value }`).
+4. **NEVER declare subcomponents inside the render body of parent components**: Declare components at module scope or in dedicated files to prevent DOM node remounting and lost focus state.
+5. **NEVER create memory leaks in `useEffect`**: Always provide clean-up functions for event listeners, `AbortController`, timers, and websocket subscriptions.
+6. **NEVER lift state higher than necessary**: Colocate state to the nearest common ancestor or leaf component to prevent wasteful re-renders of unrelated subtrees.
+
+## Rules & Patterns
+
+### 1. State Colocation & Re-render Optimization
+
+- **State Colocation**: Keep state as close as possible to the components that consume it.
+- **Composition to Prevent Re-renders**: Pass expensive static subtrees as `children` to wrapper components holding state so the children do not re-render when the wrapper updates.
+
+```tsx
+export function ExpandableCard({ title, children }: { title: string; children: React.ReactNode }) {
+  const [isOpen, setIsOpen] = useState(false);
+
+  return (
+    <div className="rounded-xl border p-4">
+      <button 
+        type="button"
+        onClick={() => setIsOpen(v => !v)}
+        className="flex w-full justify-between font-semibold"
+        aria-expanded={isOpen}
+      >
+        <span>{title}</span>
+        <span>{isOpen ? '−' : '+'}</span>
+      </button>
+      {isOpen && <div className="mt-3 pt-3 border-t">{children}</div>}
+    </div>
+  );
+}
+```
+
+### 2. Optimistic UI Updates & Concurrent Actions (`useOptimistic`, `useTransition`)
+
+- Provide instantaneous visual feedback for user actions without waiting for server network roundtrips.
+
+```tsx
+import { useOptimistic, useTransition } from 'react';
+
+export function TodoList({ todos, onAdd }: { todos: Todo[]; onAdd: (text: string) => Promise<void> }) {
+  const [isPending, startTransition] = useTransition();
+  const [optimisticTodos, addOptimisticTodo] = useOptimistic(
+    todos,
+    (state, newText: string) => [...state, { id: 'temp-' + Date.now(), text: newText, isPending: true }]
+  );
+
+  const handleAction = async (formData: FormData) => {
+    const text = formData.get('todo') as string;
+    if (!text?.trim()) return;
+
+    startTransition(async () => {
+      addOptimisticTodo(text);
+      await onAdd(text);
+    });
+  };
+
+  return (
+    <form action={handleAction} className="space-y-4">
+      <input name="todo" placeholder="Add a new task..." className="border p-2 rounded" />
+      <button type="submit" disabled={isPending} className="bg-primary text-white px-4 py-2 rounded">
+        {isPending ? 'Saving...' : 'Add'}
+      </button>
+      <ul className="divide-y">
+        {optimisticTodos.map(todo => (
+          <li key={todo.id} className={todo.isPending ? 'opacity-50 italic' : ''}>
+            {todo.text}
+          </li>
+        ))}
+      </ul>
+    </form>
+  );
+}
+```
+
+### 3. Derived State vs. Effects Anti-Pattern
+
+```tsx
+// [GOOD] Computed directly during render (or memoized if expensive)
+function SearchResults({ query, items }: { query: string; items: Item[] }) {
+  const filtered = useMemo(() => {
+    const q = query.trim().toLowerCase();
+    if (!q) return items;
+    return items.filter(i => i.title.toLowerCase().includes(q));
+  }, [query, items]);
+
+  return <List items={filtered} />;
+}
+```
+
+## Code Examples
+
+See `EXAMPLES.md` for detailed code examples and hook implementations.
+
+## Validation Checklist
+
+- [ ] Zero `useEffect` hooks used for derived calculations.
+- [ ] Every list mapping has a unique, non-index entity ID key.
+- [ ] Subcomponents declared in parent render functions are extracted to top-level scope.
+- [ ] Effects with event listeners, timers, or abortable requests include clean-up returns.
+- [ ] Reusable components are composed cleanly via `children` or render props.
+
+## Common Mistakes
+
+- Setting state inside `useEffect` based on prop changes rather than deriving values inline.
+- Declaring nested components within component bodies.
+- Using index keys causing input focus loss or animations breaking on list mutations.
+
+## Integration Notes
+
+- Pairs with `typescript` for type safety on props, generics, and ref forwarding.
+- Pairs with `ui-ux-pro` and `web-accessibility` for UI tokens and ARIA standards.

package/catalog/skills/react/TROUBLESHOOTING.md

@@ -0,0 +1,19 @@
+# react Troubleshooting & Common Mistakes
+
+## 1. Infinite Render Loops in useEffect
+
+- **Symptom**: Browser freezes, "Maximum update depth exceeded" error.
+- **Root Cause**: Creating new object or array literals inside component body and passing them to useEffect dependency array.
+- **Fix**: Colocate state, compute derived state during render without useEffect, or use primitive dependency values.
+
+## 2. Stale Closures in Callbacks
+
+- **Symptom**: Event handler or setTimeout accesses outdated state values.
+- **Root Cause**: Callback closing over initial state without updated dependency.
+- **Fix**: Use functional state updates (`setCount(c => c + 1)`) or `useRef` for mutable references.
+
+## 3. Prop Drilling vs Context Performance
+
+- **Symptom**: Changing a small state variable causes the entire component tree to re-render.
+- **Root Cause**: Storing rapidly changing state in a single monolithic React Context.
+- **Fix**: Split contexts by domain or migrate client UI state to Zustand with granular selectors.

package/catalog/skills/react/VALIDATION.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "rules_followed": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "rules_followed"
+  ]
+}

package/catalog/skills/react/skill.yaml

@@ -0,0 +1,14 @@
+schemaVersion: 2
+id: react
+name: React
+category: frontend
+type: instruction-only
+requires: [typescript]
+optional: [tailwind, react-query, zustand, next-auth]
+conflicts: [vue, angular, svelte]
+weight: 8
+resources:
+  - EXAMPLES.md
+  - SKILL.md
+  - TROUBLESHOOTING.md
+  - VALIDATION.json

package/catalog/skills/react-best-practices/SKILL.md

@@ -0,0 +1,158 @@
+---
+name: vercel-react-best-practices
+description: React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
+license: MIT
+metadata:
+  author: vercel
+  version: "1.0.0"
+---
+
+# Vercel React Best Practices
+
+## Overview
+
+Comprehensive performance optimization guide for React and Next.js applications, maintained by Vercel. Contains 70 rules across 8 categories, prioritized by impact to guide automated refactoring, code generation, and production review.
+
+## When to Use
+
+- When authoring new React functional components or Next.js App Router pages.
+- When implementing data fetching (client or server-side Server Actions, RSC).
+- When reviewing pull requests for rendering bottlenecks or memory leaks.
+- When optimizing bundle size, eliminating network waterfalls, or improving Core Web Vitals (LCP, INP, CLS).
+
+## Rules & Patterns
+
+### Rule Categories by Priority
+
+| Priority | Category | Impact | Prefix |
+|----------|----------|--------|--------|
+| 1 | Eliminating Waterfalls | CRITICAL | `async-` |
+| 2 | Bundle Size Optimization | CRITICAL | `bundle-` |
+| 3 | Server-Side Performance | HIGH | `server-` |
+| 4 | Client-Side Data Fetching | MEDIUM-HIGH | `client-` |
+| 5 | Re-render Optimization | MEDIUM | `rerender-` |
+| 6 | Rendering Performance | MEDIUM | `rendering-` |
+| 7 | JavaScript Performance | LOW-MEDIUM | `js-` |
+| 8 | Advanced Patterns | LOW | `advanced-` |
+
+### 1. Eliminating Waterfalls (CRITICAL)
+
+- `async-cheap-condition-before-await` - Check cheap sync conditions before awaiting flags or remote values.
+- `async-defer-await` - Move await into branches where actually used.
+- `async-parallel` - Use `Promise.all()` for independent asynchronous operations.
+- `async-dependencies` - Use better-all for partial dependencies.
+- `async-api-routes` - Start promises early, await late in API routes.
+- `async-suspense-boundaries` - Use Suspense to stream content progressively.
+
+### 2. Bundle Size Optimization (CRITICAL)
+
+- `bundle-barrel-imports` - Import directly from specific modules, avoid broad barrel files (`index.ts`).
+- `bundle-analyzable-paths` - Prefer statically analyzable import paths to avoid bloated traces.
+- `bundle-dynamic-imports` - Use `next/dynamic` or `React.lazy()` for heavy interactive components.
+- `bundle-defer-third-party` - Load analytics and logging scripts after hydration.
+- `bundle-conditional` - Load modules only when feature flags or user actions require them.
+- `bundle-preload` - Preload assets on hover or focus for perceived instant navigation.
+
+### 3. Server-Side Performance (HIGH)
+
+- `server-auth-actions` - Always authenticate server actions like API routes.
+- `server-cache-react` - Use `React.cache()` for per-request deduplication.
+- `server-cache-lru` - Use LRU cache for cross-request caching.
+- `server-dedup-props` - Avoid duplicate serialization in RSC props.
+- `server-hoist-static-io` - Hoist static I/O to module level.
+- `server-no-shared-module-state` - Avoid module-level mutable request state in RSC/SSR.
+- `server-serialization` - Minimize data passed across the server-client boundary.
+- `server-parallel-fetching` - Restructure components to parallelize fetches.
+- `server-after-nonblocking` - Use `after()` for non-blocking operations like analytics logging.
+
+### 4. Client-Side Data Fetching (MEDIUM-HIGH)
+
+- `client-swr-dedup` - Use SWR or TanStack Query for automatic request deduplication.
+- `client-event-listeners` - Deduplicate global event listeners.
+- `client-passive-event-listeners` - Use passive listeners for scroll and touch.
+- `client-localstorage-schema` - Version and minimize data stored in localStorage.
+
+### 5. Re-render Optimization (MEDIUM)
+
+- `rerender-defer-reads` - Don't subscribe to state only used in callbacks.
+- `rerender-memo` - Extract expensive work into memoized components.
+- `rerender-memo-with-default-value` - Hoist default non-primitive props.
+- `rerender-dependencies` - Use primitive dependencies in effects and callbacks.
+- `rerender-derived-state` - Subscribe to derived booleans, not raw high-frequency values.
+- `rerender-derived-state-no-effect` - Derive state during render, never in `useEffect`.
+- `rerender-functional-setstate` - Use functional `setState` for stable callback references.
+- `rerender-lazy-state-init` - Pass initializer functions to `useState` for expensive computations.
+- `rerender-transitions` - Use `startTransition` for non-urgent state updates.
+- `rerender-use-deferred-value` - Defer expensive renders to keep input responsive.
+- `rerender-no-inline-components` - Never define subcomponents inside component render bodies.
+
+### 6. Rendering Performance (MEDIUM)
+
+- `rendering-content-visibility` - Use `content-visibility: auto` for long offscreen lists.
+- `rendering-hoist-jsx` - Extract static JSX elements outside components.
+- `rendering-conditional-render` - Use ternary (`condition ? <Comp /> : null`), not `&&` to avoid 0 rendering.
+- `rendering-usetransition-loading` - Prefer `useTransition` for loading state indicators.
+
+### 7. JavaScript Performance (LOW-MEDIUM)
+
+- `js-index-maps` - Build `Map` for repeated lookups instead of repeated array searches.
+- `js-cache-property-access` - Cache object properties in tight loops.
+- `js-early-exit` - Return early from functions to avoid nested complexity.
+- `js-hoist-regexp` - Hoist RegExp creation outside loops and functions.
+- `js-set-map-lookups` - Use `Set` / `Map` for O(1) lookups.
+
+### 8. Advanced Patterns (LOW)
+
+- `advanced-effect-event-deps` - Don't put `useEffectEvent` results in effect deps.
+- `advanced-event-handler-refs` - Store event handlers in refs for stable listener attachments.
+- `advanced-init-once` - Initialize app singletons once per lifecycle.
+- `advanced-compound-components` - Use React Context with compound components for composable sub-parts instead of monolithic prop bags.
+- `advanced-error-boundary-colocation` - Colocate Error Boundaries and Suspense boundaries close to the fault-prone tree, preserving the rest of the UI.
+
+## Code Examples
+
+
+```tsx
+// [GOOD] Parallel server fetching without waterfall
+import { cache } from 'react';
+
+export const getUser = cache(async (id: string) => {
+  return db.user.findUnique({ where: { id } });
+});
+
+export default async function UserPage({ params }: { params: { id: string } }) {
+  // Parallel dispatch
+  const userPromise = getUser(params.id);
+  const postsPromise = getPosts(params.id);
+
+  const [user, posts] = await Promise.all([userPromise, postsPromise]);
+
+  return (
+    <main>
+      <h1>{user.name}</h1>
+      <PostList posts={posts} />
+    </main>
+  );
+}
+```
+
+## Validation Checklist
+
+- [ ] All independent async fetches use `Promise.all()` instead of sequential `await`.
+- [ ] Direct imports used instead of barrel file imports for large libraries.
+- [ ] No `useEffect` used for deriving computed state from props or state.
+- [ ] Heavy interactive modals/drawers loaded dynamically via `next/dynamic`.
+- [ ] Server actions perform authentication checks before data mutations.
+- [ ] Zero subcomponents defined inside the body of parent components.
+
+## Common Mistakes
+
+- Writing sequential `await fetchA(); await fetchB();` creating avoidable network waterfalls.
+- Importing from package root barrel files triggering full bundle inclusion.
+- Setting state inside `useEffect` in response to prop changes.
+- Serializing full database models with sensitive or unused fields to Client Components.
+
+## Integration Notes
+
+- Pairs with `react` and `nextjs` skills for idiomatic App Router patterns.
+- Complements `performance` for Lighthouse and Core Web Vitals verification.

package/catalog/skills/react-best-practices/VALIDATION.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "rules_followed": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "rules_followed"
+  ]
+}

package/catalog/skills/react-best-practices/skill.yaml

@@ -0,0 +1,13 @@
+schemaVersion: 2
+name: react-best-practices
+category: frontend
+type: instruction-only
+description: React and Next.js performance optimization guidelines from Vercel Engineering.
+version: 1.0.0
+deprecated: true
+canonical: react
+requires:
+  - react
+resources:
+  - SKILL.md
+  - VALIDATION.json

package/catalog/skills/redesign-audit/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: redesign-existing-projects
+description: Upgrades existing websites and apps to premium quality. Audits current design, identifies generic AI patterns, and applies high-end design standards without breaking functionality. Works with any CSS framework or vanilla CSS.
+---
+
+# Redesign Skill & UI Audit
+
+## Overview
+
+A systematic redesign and auditing protocol designed to elevate existing websites, dashboards, and web applications to world-class agency quality. It diagnoses and eradicates generic AI design fingerprints, sloppy typography, inconsistent palettes, and absent interaction states without breaking business logic or underlying component contracts.
+
+## When to Use
+
+- When auditing an existing UI codebase for design quality, responsiveness, or accessibility.
+- When modernizing a legacy application or uplifting generic templates.
+- When tasked to "redesign", "clean up the layout", "audit UI", or "make it look expensive and modern".
+
+## Rules & Patterns
+
+### 1. Workflow: Scan → Diagnose → Fix
+
+1. **Scan:** Read the codebase. Identify the framework, styling method (Tailwind v3/v4, vanilla CSS, CSS Modules), and established design tokens.
+2. **Diagnose:** Run through the design audit categories. Catalog generic patterns, missing states, and optical alignment flaws.
+3. **Fix:** Apply surgical, targeted upgrades working within the existing stack. Do not rewrite from scratch.
+
+### 2. Design Audit Categories
+
+#### Typography
+
+- **Replace Browser Defaults:** Swap generic `Inter`, `Roboto`, or system fonts with expressive typefaces (`Geist`, `Outfit`, `Cabinet Grotesk`, `Satoshi`).
+- **Presence & Scale:** Increase display text size, tighten letter-spacing (`-0.02em` to `-0.04em`), reduce line-height on headlines.
+- **Reading Comfort:** Limit body text to 65 characters per line (`max-w-prose`), increase line-height to 1.6.
+- **Figures:** Enable tabular figures (`font-variant-numeric: tabular-nums`) for numbers in tables and data readouts.
+- **Orphan Prevention:** Apply `text-wrap: balance` on headlines and `text-wrap: pretty` on paragraphs.
+
+#### Color and Surfaces
+
+- **No Pure Black Backgrounds:** Replace `#000000` with tinted dark charcoal (`#0A0A0A`, `#121212`).
+- **Desaturate Accents:** Keep accent saturation below 80% so it blends harmoniously with neutrals.
+- **Single Accent Color:** Commit to one dominant accent hue; remove conflicting secondary tints.
+- **Tinted Shadows:** Tint shadows to match the background hue rather than harsh black opacity.
+- **Background Depth:** Prevent sterile flat sections by layering subtle noise overlays, ambient gradients, or masked imagery.
+
+#### Layout and Space
+
+- **Asymmetry & Bento Grids:** Break repetitive 3-column Bootstrap grids with asymmetrical spans or offset cards.
+- **Mobile Viewport Bug Fix:** Never use `height: 100vh`; always use `min-height: 100dvh`.
+- **Vertical Alignment:** Pin action buttons to the bottom of card groups (`mt-auto` or grid alignment) to maintain horizontal baseline harmony across differing text heights.
+- **Optical Centering:** Adjust icons, badges, and play buttons optically by 1-2px rather than relying solely on pure mathematical centering.
+
+#### Interactivity and States
+
+- **Interactive Feedback:** Add 200-300ms transitions, distinct hover shifts, and physical active presses (`scale(0.98)`).
+- **Visible Focus Rings:** Mandatory `:focus-visible` styling for keyboard navigation.
+- **States Completeness:** Always provide designed skeleton loaders, empty states, and inline error messages.
+
+#### Content & Code Quality
+
+- **Eradicate AI Clichés:** Remove buzzwords ("Elevate", "Seamless", "Unleash", "Next-Gen") and placeholder latin text.
+- **Semantic HTML:** Replace nested div containers with `<nav>`, `<main>`, `<article>`, `<section>`, `<aside>`.
+- **Relative Units:** Use `rem`, `%`, and CSS Grid rather than hardcoded pixel widths.
+
+### 3. Fix Priority
+
+1. **Font Swap:** Biggest instant aesthetic elevation with lowest regression risk.
+2. **Palette Cleanup:** Eliminate clashing or oversaturated colors.
+3. **States & Feedback:** Add hover, active, focus, loading, and empty states.
+4. **Layout & Alignment:** Fix container widths, baseline alignment, and mobile viewport heights.
+5. **Component Polish:** Replace generic cards and accordion boxes with modern minimal equivalents.
+
+## Code Examples
+
+```tsx
+// [BEFORE] Generic, misaligned card with generic shadow
+<div className="bg-white border rounded shadow p-4">
+  <h2>{title}</h2>
+  <p>{desc}</p>
+  <button className="bg-blue-500 text-white p-2">Click</button>
+</div>
+
+// [AFTER] Polished card with optical baseline alignment, tinted surface, and micro-interaction
+<div className="flex flex-col bg-[#FFFFFF] dark:bg-[#121212] border border-black/5 dark:border-white/10 rounded-2xl p-6 hover:shadow-[0_4px_20px_rgba(0,0,0,0.04)] transition-all duration-200">
+  <h3 className="font-semibold text-lg tracking-tight text-neutral-900 dark:text-neutral-100 text-balance mb-2">
+    {title}
+  </h3>
+  <p className="text-sm text-neutral-600 dark:text-neutral-400 leading-relaxed text-pretty mb-6">
+    {desc}
+  </p>
+  <button 
+    type="button" 
+    className="mt-auto inline-flex items-center justify-center font-medium text-sm px-4 py-2.5 rounded-xl bg-neutral-900 dark:bg-neutral-100 text-white dark:text-black hover:bg-neutral-800 active:scale-[0.98] transition-transform duration-150 focus-visible:ring-2 focus-visible:ring-neutral-400"
+  >
+    Continue
+  </button>
+</div>
+```
+
+## Validation Checklist
+
+- [ ] All headings have `text-wrap: balance` and appropriate negative letter tracking.
+- [ ] No pure black `#000000` backgrounds or oversaturated accent colors (>80% saturation).
+- [ ] All interactive elements include `:hover`, `:active`, and `:focus-visible` styles.
+- [ ] Cards in side-by-side grids align primary CTA buttons along the same bottom baseline.
+- [ ] Viewport containers use `100dvh` instead of `100vh`.
+- [ ] All lists, tables, and feeds have a designed empty state.
+
+## Common Mistakes
+
+- Rewriting components from scratch and breaking existing prop contracts or unit tests.
+- Forcing full-width sections without `max-w` constraints on ultra-wide screens.
+- Leaving action buttons at random heights inside differing text content cards.
+- Introducing external UI libraries without checking existing `package.json` dependencies.
+
+## Integration Notes
+
+- Complements `impeccable-design` for hard 50-rule QA verification.
+- Works alongside `ui-ux-pro` for token generation and color theory.

package/catalog/skills/redesign-audit/VALIDATION.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "rules_followed": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "rules_followed"
+  ]
+}

package/catalog/skills/redesign-audit/skill.yaml

@@ -0,0 +1,9 @@
+schemaVersion: 2
+name: redesign-audit
+category: design
+type: instruction-only
+description: Audits and upgrades existing web codebases with high-end typography, color, layout, and interaction polish.
+version: 1.0.0
+resources:
+  - SKILL.md
+  - VALIDATION.json

package/catalog/skills/security-audit/EXAMPLES.md

@@ -0,0 +1,79 @@
+# Security Audit - Examples & Verification Scenarios
+
+## Example 1: Adversarial Validation of Path Traversal
+
+### Hunter Report (Initial Finding)
+```markdown
+ID: CANDIDATE-01
+Component: User Avatar Download
+Location: src/routes/avatar.ts:18
+Sink: fs.createReadStream(path.join(__dirname, '../../uploads', req.query.file))
+Hypothesis: Attacker passes `?file=../../etc/passwd` to read arbitrary host files.
+```
+
+### Verifier Execution (Disproving Attempt)
+The verifier inspects the middleware chain and creates an isolated reproduction test:
+```typescript
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+
+function resolveAvatarPath(baseDir: string, requestedFile: string): string {
+  const safePath = path.resolve(baseDir, requestedFile);
+  if (!safePath.startsWith(baseDir)) {
+    throw new Error('Access denied: directory traversal detected');
+  }
+  return safePath;
+}
+
+describe('Avatar Path Resolution', () => {
+  const uploadsDir = path.resolve('/var/app/uploads');
+
+  it('rejects traversal attempts escaping uploads root', () => {
+    assert.throws(
+      () => resolveAvatarPath(uploadsDir, '../../etc/passwd'),
+      /Access denied: directory traversal detected/
+    );
+  });
+
+  it('allows safe filenames inside uploads root', () => {
+    const resolved = resolveAvatarPath(uploadsDir, 'user-123.png');
+    assert.equal(resolved, path.join(uploadsDir, 'user-123.png'));
+  });
+});
+```
+
+### Verifier Verdict
+- If `resolveAvatarPath` was missing in source: Finding is **CONFIRMED** with source trace.
+- If middleware sanitized input before the handler: Finding is **DISPROVEN** and logged as invalid candidate with reason.
+
+---
+
+## Example 2: Minimal Remediated Code Block
+
+```typescript
+// Vulnerable:
+// app.get('/files', (req, res) => {
+//   res.sendFile(path.join(PUBLIC_DIR, req.query.path as string));
+// });
+
+// Remediated (Surgical Blast Radius):
+import path from 'node:path';
+
+app.get('/files', (req, res) => {
+  const rawPath = String(req.query.path ?? '');
+  const normalizedPath = path.normalize(rawPath).replace(/^(\.\.[\/\\])+/, '');
+  const resolved = path.resolve(PUBLIC_DIR, normalizedPath);
+
+  if (!resolved.startsWith(PUBLIC_DIR)) {
+    return res.status(403).json({
+      error: {
+        code: 'FORBIDDEN',
+        message: 'Path traversal attempted'
+      }
+    });
+  }
+
+  res.sendFile(resolved);
+});
+```