cue-ai 0.9.2 → 0.9.4

package/resources/skills/skills/media/youtube-shorts/scripts/run-youtube-shorts.sh

@@ -0,0 +1,141 @@
+#!/bin/bash
+# YouTube Shorts Generator — Platform-aware preset over the AI Clipping primitive.
+#
+# Picks platform-specific defaults (aspect ratio + clip count) for short-form
+# social and delegates to muapi.ai's /ai-clipping endpoint, which handles
+# transcription, highlight ranking, dedupe, and face-tracked auto-crop server-side.
+#
+# Usage:
+#   bash run-youtube-shorts.sh --source "<URL>" [options]
+#
+# Requires: bash 3.2+, jq, muapi-cli
+
+set -euo pipefail
+
+# ============================================================
+# Locate skills root
+# ============================================================
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SKILLS_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+AI_CLIPPING_SCRIPT="$SKILLS_ROOT/ai-clipping/scripts/run-ai-clipping.sh"
+
+if [ -f "$SKILLS_ROOT/.env" ]; then
+    set +u; source "$SKILLS_ROOT/.env" 2>/dev/null || true; set -u
+fi
+
+# ============================================================
+# Defaults
+# ============================================================
+SOURCE=""
+PLATFORM="shorts"
+NUM_CLIPS=""
+ASPECT_RATIO=""
+OUTPUT_JSON=""
+VIEW=false
+ASYNC=false
+POLL_INTERVAL="${MUAPI_POLL_INTERVAL:-5}"
+POLL_TIMEOUT="${MUAPI_POLL_TIMEOUT:-1800}"
+
+# ============================================================
+# Argument parsing
+# ============================================================
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --source|-s)        SOURCE="$2";        shift 2 ;;
+        --platform|-p)      PLATFORM="$2";      shift 2 ;;
+        --num-clips|-n)     NUM_CLIPS="$2";     shift 2 ;;
+        --aspect-ratio|-a)  ASPECT_RATIO="$2";  shift 2 ;;
+        --output-json|-o)   OUTPUT_JSON="$2";   shift 2 ;;
+        --view)             VIEW=true;          shift   ;;
+        --async)            ASYNC=true;         shift   ;;
+        --poll-interval)    POLL_INTERVAL="$2"; shift 2 ;;
+        --poll-timeout)     POLL_TIMEOUT="$2";  shift 2 ;;
+        --help|-h)
+            cat <<'HELP'
+YouTube Shorts Generator — platform-aware preset over AI Clipping
+Usage: bash run-youtube-shorts.sh --source "<URL>" [options]
+
+REQUIRED
+  --source, -s URL          YouTube URL, hosted mp4 URL, or local file path
+
+PLATFORM PRESETS  (sets ratio + clip-count defaults)
+  --platform shorts         9:16, 3 clips    (YouTube Shorts — default)
+  --platform tiktok         9:16, 5 clips    (TikTok)
+  --platform reels          9:16, 3 clips    (Instagram Reels)
+  --platform feed           1:1,  3 clips    (Instagram Feed)
+
+OVERRIDES
+  --num-clips, -n N         Override clip count
+  --aspect-ratio, -a RATIO  Override ratio: 9:16 | 1:1 | 4:5
+
+OUTPUT
+  --output-json, -o PATH    Dump full result here (use "-" for stdout)
+  --view                    Download clips and open in system viewer (macOS)
+  --async                   Return request_id immediately without polling
+
+POLLING
+  --poll-interval SEC       Seconds between job-status polls (default: 5)
+  --poll-timeout SEC        Give up after this long (default: 1800)
+
+EXAMPLES
+  # Defaults — three 9:16 YouTube Shorts
+  bash run-youtube-shorts.sh --source "https://youtube.com/watch?v=VIDEO_ID"
+
+  # TikTok — 5 clips, view in player
+  bash run-youtube-shorts.sh -s "<URL>" -p tiktok --view
+
+  # Instagram Feed — square clips
+  bash run-youtube-shorts.sh -s "<URL>" -p feed -n 3
+HELP
+            exit 0
+            ;;
+        *)  echo "Unknown flag: $1" >&2; exit 2 ;;
+    esac
+done
+
+# ============================================================
+# Validation
+# ============================================================
+if [[ -z "$SOURCE" ]]; then
+    echo "ERROR: --source is required" >&2
+    exit 2
+fi
+if [[ ! -f "$AI_CLIPPING_SCRIPT" ]]; then
+    echo "ERROR: ai-clipping primitive not found at $AI_CLIPPING_SCRIPT" >&2
+    exit 3
+fi
+
+# ============================================================
+# Platform preset → defaults
+# ============================================================
+case "$PLATFORM" in
+    shorts)  PLATFORM_RATIO="9:16"; PLATFORM_NUM=3 ;;
+    tiktok)  PLATFORM_RATIO="9:16"; PLATFORM_NUM=5 ;;
+    reels)   PLATFORM_RATIO="9:16"; PLATFORM_NUM=3 ;;
+    feed)    PLATFORM_RATIO="1:1";  PLATFORM_NUM=3 ;;
+    *)
+        echo "ERROR: --platform must be one of: shorts, tiktok, reels, feed (got: $PLATFORM)" >&2
+        exit 2
+        ;;
+esac
+
+[[ -z "$ASPECT_RATIO" ]] && ASPECT_RATIO="$PLATFORM_RATIO"
+[[ -z "$NUM_CLIPS"    ]] && NUM_CLIPS="$PLATFORM_NUM"
+
+# ============================================================
+# Delegate to AI Clipping primitive
+# ============================================================
+echo ">> Platform: $PLATFORM (ratio=$ASPECT_RATIO, num=$NUM_CLIPS)"
+
+ARGS=(
+    --video "$SOURCE"
+    --num-clips "$NUM_CLIPS"
+    --aspect-ratio "$ASPECT_RATIO"
+    --poll-interval "$POLL_INTERVAL"
+    --poll-timeout "$POLL_TIMEOUT"
+)
+[[ -n "$OUTPUT_JSON" ]] && ARGS+=(--output-json "$OUTPUT_JSON")
+[[ "$VIEW"  == true  ]] && ARGS+=(--view)
+[[ "$ASYNC" == true  ]] && ARGS+=(--async)
+
+exec bash "$AI_CLIPPING_SCRIPT" "${ARGS[@]}"

package/resources/skills/skills/media/youtube-thumbnail/SKILL.md

@@ -0,0 +1,66 @@
+---
+slug: muapi-youtube-thumbnail
+name: muapi-youtube-thumbnail
+version: "1.0.0"
+description: Design a high-CTR YouTube thumbnail — striking imagery, bold text placement, and emotional face/subject if needed.
+acceptLicenseTerms: true
+---
+
+
+# YouTube Thumbnail
+
+**Design a high-CTR YouTube thumbnail — striking imagery, bold text placement, and emotional face/subject if needed.**
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|:---|:---|:---|:---|:---|
+| `title` | text | yes | — | The video title or topic (e.g. "I tried 7 AI tools in 24 hours — here's what happened"). |
+| `channel_style` | text | no | bold, high contrast, bright colors, clean design, YouTube tech aesthetic | Channel brand style (e.g. "dark moody gaming", "bright educational", "minimal corporate"). |
+| `subject_description` | text | no | — | Optional description of the person or subject to feature (e.g. "a surprised young man in a hoodie"). |
+
+
+## Steps
+
+Thumbnails are the #1 factor in YouTube CTR. Generate a single, maximum-impact 16:9 image.
+
+### Phase A — Plan the composition
+
+Before generating, briefly reason about the best thumbnail formula for this topic:
+- **Emotion-first**: shocked/curious face if relevant + bold text = high CTR
+- **Text overlay**: 3–5 words max, high-contrast (white/yellow on dark, or vice-versa)
+- **Contrast & saturation**: thumbnails compete in a grid — they must pop
+
+### Phase B — Generate the thumbnail
+
+1. Build the image generation prompt:
+   - Subject: `{{subject_description}}` if provided, otherwise design an object/scene that dramatizes the topic.
+   - Mood: derives from `{{channel_style}}`.
+   - Composition: rule-of-thirds, subject on left or right with empty space for text.
+   - Style tags: `{{channel_style}}, youtube thumbnail composition, ultra detailed, vibrant, high contrast, 16:9`.
+2. Call `muapi image generate` (model=gpt-image-2-text-to-image, aspect_ratio=16:9).
+
+### Phase C — Text overlay guidance
+
+After generation, return:
+- **Suggested overlay text**: 3–5 bold words that complement the title `{{title}}`.
+- **Text placement**: where on the canvas to position text (e.g. "bold yellow text, top-right third").
+- **Font recommendation**: style suggestion (e.g. "Impact-style all-caps with black outline").
+
+## Notes
+- Never put too much text in the prompt — text rendering in image models is unreliable. Guide the user on adding text in post-production (Canva, Photoshop).
+- If the user already has a channel image or face photo in the session, use `muapi image edit` to incorporate it.
+- Suggest A/B variants only if the user asks.
+
+## Trigger Keywords
+
+`youtube thumbnail`, `yt thumbnail`, `thumbnail`, `video thumbnail`, `youtube cover`
+
+
+---
+
+## Notes for the Executing Agent
+
+- This recipe is LLM-orchestrated: read each phase, gather any missing inputs from the user, then call `muapi` CLI commands. Use `muapi auth configure` first if `MUAPI_API_KEY` is unset.
+- For model IDs without a CLI alias yet, fall back to the raw endpoint via `curl -X POST https://api.muapi.ai/api/v1/<endpoint> -H "x-api-key: $MUAPI_API_KEY" -H 'content-type: application/json' -d '{...}'` and poll with `muapi predict wait <request_id>`.
+- Substitute `{{input_name}}` placeholders with the user's actual inputs before issuing each call.

package/resources/skills/skills/meta/cue-developer/references/architecture.md

@@ -20,8 +20,8 @@ allocation-light and avoid adding synchronous network or heavy parsing to it.
 ## Profile resolution order
 
 1. `--cue-profile X` flag (explicit).
-2. `.cue-profile` file in cwd, walking up to `$HOME`.
-3. Repo-level default (`.cue-profile` at the git root).
+2. `.cue.profile` file in cwd, walking up to `$HOME`.
+3. Repo-level default (`.cue.profile` at the git root).
 4. Global default (`~/.config/cue/default-profile`).
 5. TUI picker (interactive fallback).
 

package/resources/skills/skills/meta/cue-usage/SKILL.md

@@ -169,5 +169,5 @@ Or interactively: `cue init`
 - **Skills** are SKILL.md files that teach the agent specific tasks
 - **MCPs** are tool servers (local or remote via Smithery)
 - **Packs** group related skills for reuse
-- `.cue-profile` file pins a profile to a directory
+- `.cue.profile` file pins a profile to a directory
 - Changes require `/cue-reload` to take effect

package/resources/skills/skills/meta/profile-fit-monitor/SKILL.md

@@ -14,11 +14,11 @@ Track how well the active profile matches what the user is actually doing. If yo
 Then **after completing the user's immediate request**, surface the mismatch with a one-line suggestion:
 
 > 💡 This session has been mostly [backend / infra / docs / …] work — your current profile is **{active-profile}**.
-> A better fit might be **[suggested]**. Switch with: `/cue switch [name]` or `echo [name] > .cue-profile`
+> A better fit might be **[suggested]**. Switch with: `/cue switch [name]` or `echo [name] > .cue.profile`
 
 ## Rules
 
 - Only suggest once per session — don't nag.
 - Never interrupt urgent or in-flight work to suggest a switch; wait for a natural break.
-- If the user has explicitly pinned the profile (`.cue-profile` present, or recently ran `/cue switch`), assume they meant it and stay quiet unless the mismatch is extreme.
+- If the user has explicitly pinned the profile (`.cue.profile` present, or recently ran `/cue switch`), assume they meant it and stay quiet unless the mismatch is extreme.
 - Match the suggested profile to the work category — don't suggest randomly. If unsure, just describe the mismatch without picking a target.

package/resources/skills/skills/meta/profile-optimizer/SKILL.md

@@ -37,7 +37,7 @@ the worst-possible failure mode for this skill.
 Run the optimizer for the active profile:
 
 ```bash
-cue optimizer $(cat .cue-profile 2>/dev/null || cue current 2>/dev/null | head -1)
+cue optimizer $(cat .cue.profile 2>/dev/null || cue current 2>/dev/null | head -1)
 ```
 
 Present the output to the user. Highlight:

package/resources/skills/skills/meta/profile-suggest/SKILL.md

@@ -2,10 +2,10 @@
 name: profile-suggest
 description: >-
   Analyzes a repo on the first message and suggests the best cue profile
-  when no .cue-profile is set, then self-removes from the project CLAUDE.md.
+  when no .cue.profile is set, then self-removes from the project CLAUDE.md.
   Use when user says "suggest a profile", "which profile", "auto-detect
   profile", "scan this repo", or arrives in a directory with no
-  .cue-profile.
+  .cue.profile.
 tags: [meta, cue, profiles, onboarding]
 category: meta
 version: 1.0.0
@@ -15,7 +15,7 @@ allowed-tools: Bash
 
 # Profile Suggestion (First-Time Repo Setup)
 
-**This skill activates ONLY on the first message in a repo without a `.cue-profile`.**
+**This skill activates ONLY on the first message in a repo without a `.cue.profile`.**
 
 ## Trigger
 
@@ -58,13 +58,13 @@ I detected: [Next.js + Stripe + Supabase project]
 → Recommended: **🦋 frontend** — has ui-ux-pro-max, playwright, image-to-code
   Also relevant: stripe-webhooks, supabase (from backend profile)
 
-Pin it? I'll run: `echo frontend > .cue-profile` — or pick another with `cue list`
+Pin it? I'll run: `echo frontend > .cue.profile` — or pick another with `cue list`
 ```
 
 ### 4. If user agrees (or says nothing against it)
 
 ```bash
-echo "<profile-name>" > .cue-profile
+echo "<profile-name>" > .cue.profile
 ```
 
 Then tell them: "Done! Next time you run `claude` here, it'll boot with the **<name>** profile. Restart to activate, or continue — current session still works."
@@ -72,7 +72,7 @@ Then tell them: "Done! Next time you run `claude` here, it'll boot with the **<n
 ### 5. Remove the first-time marker
 
 After suggesting (whether accepted or not), the marker is gone next session
-because `.cue-profile` now exists (or user explicitly skipped).
+because `.cue.profile` now exists (or user explicitly skipped).
 
 ## Rules
 
@@ -80,7 +80,7 @@ because `.cue-profile` now exists (or user explicitly skipped).
 - **Don't block.** Show the suggestion, then immediately proceed with the user's actual request.
 - **One suggestion only.** Don't nag if they ignore it.
 - **If the repo is ambiguous** (could be frontend or backend), suggest the broader one and mention the alternative.
-- **If a profile already exists** (`.cue-profile` is present), do nothing — this skill shouldn't have fired.
+- **If a profile already exists** (`.cue.profile` is present), do nothing — this skill shouldn't have fired.
 
 ## Matching heuristics
 

package/resources/skills/skills/meta/profile-summon/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: profile-summon
+description: >-
+  Use when a directory has no .cue.profile, or the user says "summon",
+  "load", "apply", or "pull in" a profile, or "no profile here". Soft-loads
+  a profile's persona and skills into the LIVE session and pins it, no restart.
+tags: [meta, cue, routing, profile]
+category: meta
+version: 1.0.0
+requires_mcps: []
+allowed-tools: Bash(cue:*), Bash(jq:*), Read
+triggers:
+  - "summon a profile"
+  - "load a profile"
+  - "apply the vercel profile"
+  - "pull in the X profile"
+  - "no profile here"
+  - "bind a profile"
+  - "which profile for this repo"
+---
+
+# profile-summon
+
+## Prerequisites
+
+- `cue` CLI on PATH (the profile manager that ships this skill).
+- `jq` (`apt install jq` / `brew install jq`) to read `cue summon --json`.
+
+Open a directory with no `.cue.profile` and the right profile's skills and MCPs
+normally need a pin plus a full `claude` restart, because `CLAUDE_CONFIG_DIR`, the
+`Skill()` list, MCP servers, `/slash` commands, and plugins are all frozen at boot.
+This skill is the bridge: it binds a profile into the **running** session now and
+hands back a warm re-exec for the parts a soft load cannot provide.
+
+## Two tiers, honestly
+
+1. **Now, zero restart (soft-load).** `cue summon` lists the profile's persona and
+   each skill's `SKILL.md` path. You `Read` those paths and apply the persona plus
+   the relevant skill playbooks inline. Same mechanism as `meta/smart-loader`, just
+   whole-profile.
+2. **Durable plus full fidelity (warm re-exec).** `cue summon` pins `.cue.profile`
+   so the next launch is correct, and prints `claude --continue`. Running that
+   resumes THIS conversation under the fully materialized profile, the only path to
+   its MCP servers and `/slash` commands.
+
+## Iron contract
+
+1. **Never fake the harness.** MCP tools, `/slash` commands, and plugins cannot be
+   hot-added. Do not pretend to call an MCP tool or run a `/command` that is not in
+   your actual tool list. The warm re-exec is the sanctioned path to them.
+2. **Only follow SKILL.md you actually read.** Read each path from `cue summon`
+   output this session before applying it. No paraphrasing from memory.
+3. **Honest framing.** Tell the user once, plainly, what soft-loaded and what still
+   needs `claude --continue` (see the example below).
+4. **Propose, then apply.** On a no-profile directory, show the detected profile and
+   what it will soft-load in 3 to 4 lines, then apply on the user's OK. Do not inject
+   a profile's persona silently.
+5. **One summon per topic per session.** Once a profile is soft-loaded, it stays
+   applied. Do not re-run for the same directory.
+
+## When to summon
+
+Summon when **any** holds:
+
+- The directory has no `.cue.profile` (the first-time launch block points here).
+- The user names a profile to load: "summon vercel", "apply the backend profile".
+- The user asks "which profile for this repo" and wants it active now, not later.
+
+Do not summon when a `.cue.profile` is already pinned and active, or when a loaded
+skill already covers the task (use `Skill()` directly).
+
+## The recipe
+
+### Step 1, resolve and inspect
+
+Auto-detect from the repo, or pass an explicit profile:
+
+```bash
+cue summon --json            # auto-detect from cwd
+cue summon vercel --json     # force a known profile
+```
+
+Parse the result. The useful fields:
+
+```bash
+cue summon vercel --json | jq '{profile, detected, confidence,
+  soft_loadable: [.skills[] | select(.mcp_status=="ok") | {id, path}],
+  gated: [.skills[] | select(.mcp_status!="ok") | {id, mcp_status}],
+  mcps, commands, plugins, reexec_cmd}'
+```
+
+`--json` writes the `.cue.profile` pin by default. Add `--no-pin` to inspect first,
+`--pick` to list candidates without acting, `--dry-run` to compute and write nothing.
+
+### Step 2, propose
+
+When you auto-detected (no profile named), show the user a short proposal before
+applying:
+
+```
+No .cue.profile here. Detected: vercel (97% match: vercel.json, @vercel dep).
+Summon it? Soft-loads persona + N skills now, pins .cue.profile, no restart.
+The Vercel MCP and /deploy need `claude --continue` after.
+```
+
+### Step 3, apply inline
+
+On the user's OK, apply the persona, then `Read` each `mcp_status:"ok"` skill path
+and follow the ones the task needs. Skills with `mcp_status:"missing:..."`, npx
+skills, `/slash` commands, and plugins do not soft-load: list them as available
+after the warm re-exec.
+
+### Step 4, hand back the warm re-exec
+
+Close with the honest summary:
+
+> Soft-loaded the `vercel` persona plus N skill playbooks into this session and
+> pinned `.cue.profile`. The Vercel MCP (`mcp.vercel.com`) and `/deploy` `/env`
+> commands ride in the plugin, which needs the harness. To get them, run
+> `claude --continue`: it resumes this exact conversation under the full profile.
+
+## What can never be faked (needs `claude --continue`)
+
+| Capability | Why it is frozen | Soft-load? |
+|---|---|---|
+| MCP servers (e.g. `mcp.vercel.com`) | Registered at `claude` boot from CLAUDE_CONFIG_DIR | No |
+| `/slash` commands (`/deploy`, `/env`) | Wired into the harness at boot | No |
+| Plugins | Loaded at boot | No |
+| `Skill()` invocation of a new skill | Skill list frozen at boot | No (apply as prose) |
+| Skill **playbooks** (the SKILL.md body) | Plain files on disk | **Yes** |
+| Profile **persona** | Plain prose | **Yes** |
+
+## Example: Vercel summon
+
+User opens a Next.js plus Vercel repo (has `vercel.json`) with no `.cue.profile`.
+
+```bash
+cue summon --json | jq '{profile, confidence, reasons}'
+# → { "profile": "vercel", "confidence": 0.97,
+#     "reasons": ["vercel.json", "package.json @vercel/* or vercel"] }
+```
+
+Propose `vercel`, apply on OK: persona plus the soft-loadable skills (`agent-browser`,
+the framework playbooks) apply now. The hosted MCP, `/deploy`, and `/env` are flagged
+as needing `claude --continue`. The pin is written so that re-exec lands the full
+profile and resumes the chat.
+
+## What this skill is NOT
+
+- Not an MCP shim. It never calls `mcp.vercel.com` for you.
+- Not a slash-command emulator. `/deploy` stays a harness command.
+- Not a search engine. To find one off-profile skill for a topic, use
+  `meta/smart-loader`. profile-summon binds a whole profile.
+
+## Linking
+
+- Related: [[smart-loader]], soft-loads a single off-profile skill by topic.
+- Related: [[profile-suggest]], suggests a profile when none is pinned.
+- Related: [[focus]], routes among already-loaded skills.

package/resources/skills/skills/meta/profile-summon/evals/evals.json

@@ -0,0 +1,53 @@
+[
+  {
+    "id": "summon-001-no-profile-vercel",
+    "question": "I just opened this Next.js app deployed on Vercel and there's no .cue.profile pinned. What profile should I use?",
+    "expected_skill": "profile-summon",
+    "expected_script": null,
+    "ground_truth": "The agent runs `cue summon --json` to auto-detect from the repo, sees the vercel profile detected from vercel.json plus the @vercel dependency, and proposes it in 3 to 4 lines before applying. On the user's OK it applies the vercel persona and reads the soft-loadable skill paths from the JSON, applying the ones the task needs. It states plainly which capabilities soft-loaded now (persona plus skill playbooks) and which need the harness (the hosted Vercel MCP and the /deploy, /env slash commands), and hands back `claude --continue` as the warm re-exec that resumes the conversation under the full profile. It does not pretend to call the Vercel MCP or run /deploy.",
+    "expected_behavior": [
+      "Runs `cue summon --json` (or `cue summon vercel`) to resolve the profile",
+      "Proposes the detected profile before applying, not silently",
+      "Reads the SKILL.md paths from the summon output before applying them",
+      "Distinguishes what soft-loads now from what needs claude --continue",
+      "Names `claude --continue` as the warm re-exec for the MCP / slash-command tail",
+      "Does not fake an MCP tool call or a /slash command"
+    ]
+  },
+  {
+    "id": "summon-002-explicit-load",
+    "question": "Summon the backend profile into this session.",
+    "expected_skill": "profile-summon",
+    "expected_script": null,
+    "ground_truth": "The agent treats this as an explicit summon, runs `cue summon backend --json`, applies the backend persona and the soft-loadable skill playbooks inline, pins .cue.profile to backend, and reports which MCPs or commands still need a warm re-exec. It does not require a restart for the persona and skill bodies.",
+    "expected_behavior": [
+      "Runs `cue summon backend --json` with the explicit profile name",
+      "Applies persona plus soft-loadable skills inline, no restart",
+      "Confirms the .cue.profile pin was written",
+      "Surfaces any MCP-gated skills or commands as needing claude --continue"
+    ]
+  },
+  {
+    "id": "summon-003-pinned-noop",
+    "question": "This repo already has .cue.profile set to medusa-dev and it's the active profile. Can you re-summon it?",
+    "expected_skill": "profile-summon",
+    "expected_script": null,
+    "ground_truth": "The agent recognizes the profile is already pinned and active, so a summon is unnecessary. It says the active session already has medusa-dev loaded and does not re-inject the persona or re-read skills. It offers smart-loader only if the user needs an off-profile skill for a specific task.",
+    "expected_behavior": [
+      "Recognizes a pinned, active profile needs no summon",
+      "Does not re-inject the persona or re-run the soft-load",
+      "Stays honest rather than performing a no-op summon for show"
+    ]
+  },
+  {
+    "id": "summon-004-no-trigger-general-chat",
+    "question": "What's the difference between edge and node runtimes on Vercel?",
+    "expected_skill": null,
+    "expected_script": null,
+    "ground_truth": "This is a conceptual question with a profile already active, not a request to bind a profile. The agent answers directly and does not invoke profile-summon.",
+    "expected_behavior": [
+      "Answers the conceptual question directly",
+      "Does not invoke profile-summon for a non-binding request"
+    ]
+  }
+]

package/resources/skills/skills/meta/save-profile/SKILL.md

@@ -30,7 +30,7 @@ Flags:
 - `--inherits` — parent profile (default `core`)
 - `--skills` — comma-separated `category/slug` paths
 - `--mcps` — comma-separated MCP IDs
-- `--pin` — also write `.cue-profile` in the cwd
+- `--pin` — also write `.cue.profile` in the cwd
 - `--force` — overwrite an existing profile
 
 ## Workflow inside Claude Code

package/resources/skills/skills/meta/skill-reviewer/SKILL.md

@@ -38,6 +38,9 @@ detail — load on demand, don't inline:
   expansion (R001–R008 + manual checks).
 - [references/roi-model.md](references/roi-model.md) — full ROI scoring
   model with the data-gathering commands.
+- [references/tdd-for-skills.md](references/tdd-for-skills.md): baseline-first
+  authoring (RED-GREEN-REFACTOR). Prove a skill changes behavior under pressure,
+  not just that it fires. Ported from obra/superpowers.
 
 Read the references when the workflow says "see references/X.md", not
 preemptively.

package/resources/skills/skills/meta/skill-reviewer/references/tdd-for-skills.md

@@ -0,0 +1,55 @@
+# TDD for skills: baseline-first authoring
+
+Ported from `obra/superpowers` (`skills/writing-skills`, 217K★). cue already
+scores activation (`skill-eval`) and optimizes triggers (`description-optimizer`).
+This adds the missing discipline: prove the skill changes **behavior under
+pressure**, not just that it fires.
+
+## Core principle
+
+> If you did not watch an agent fail **without** the skill, you do not know if
+> the skill teaches the right thing.
+
+Writing a skill is test-driven development applied to process documentation.
+Run the test (a pressure scenario) before you write the skill, watch it fail,
+write the minimal skill that fixes the exact failure, watch it pass.
+
+## The RED-GREEN-REFACTOR loop for a skill
+
+| TDD step | Skill authoring |
+|---|---|
+| Write the test first | Write a pressure scenario a subagent will face |
+| Watch it fail (RED) | Run it with **no skill loaded**; record the exact rationalizations the agent uses to dodge the right behavior |
+| Minimal code | Write the smallest skill that closes those specific rationalizations |
+| Watch it pass (GREEN) | Re-run the same scenario with the skill loaded; confirm the agent complies |
+| Refactor | Hunt for *new* loopholes the agent invents, plug them, re-run |
+
+The baseline (RED) is the part teams skip. Without it you are guessing what to
+write, and you cannot tell a skill that works from one that just sounds good.
+
+## How to run it in cue
+
+1. **Pick the behavior** the skill must enforce (e.g. "always run the check
+   before claiming done").
+2. **Scaffold the scenario** with `skill-eval`, but add a *no-skill* baseline
+   arm, not only the activation arm. Capture the agent's transcript.
+3. **Read the failure**, quote the rationalizations verbatim (these become the
+   "Common mistakes" section of the skill).
+4. **Write the minimal skill** addressing those exact dodges.
+5. **Re-run**; if the agent finds a new escape hatch, that is the next RED.
+   Loop until two clean passes.
+
+## What this changes about review
+
+When reviewing a skill, ask: *was there a baseline?* A skill written without
+watching a failure first is a hypothesis. Flag it 🟡 and request the RED
+transcript, or run one before trusting the skill in a profile.
+
+## Related
+
+- `description` is WHEN, never WHAT. Never summarize the workflow in the
+  description (see [decision-brief-format.md](decision-brief-format.md) and the
+  description-optimizer skill). superpowers calls this Claude Search Optimization.
+- Skills are reusable techniques, **not** narratives of how you solved something
+  once. If it only applies to this repo, it belongs in CLAUDE.md, not a skill.
+- Close loopholes iteratively. See the REFACTOR row above.

package/resources/skills/skills/research/find-skills/SKILL.md

@@ -106,7 +106,7 @@ After user picks which skills to add:
 
 ```bash
 # Check current profile
-PROFILE=$(cat .cue-profile 2>/dev/null || cue current --json 2>/dev/null | jq -r '.profile')
+PROFILE=$(cat .cue.profile 2>/dev/null || cue current --json 2>/dev/null | jq -r '.profile')
 
 # Show what will be added
 echo "Adding to profile: $PROFILE"

package/resources/skills/skills/review/code-review-deep/SKILL.md

@@ -43,6 +43,26 @@ Two non-negotiables:
    diff is > 2000 lines, warn the user — quality drops on huge diffs;
    suggest splitting.
 
+## Pass 0 — Supply-chain gate (Trivy, always run)
+
+Before reviewing the diff by hand, run the dependency/secret/misconfig
+scanner. Code review does not catch a known CVE in a transitive
+dependency or a leaked key. Trivy does.
+
+Invoke the `security/trivy-scan` skill (the single source of truth for
+the gate). In short:
+
+```bash
+trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs "**/node_modules" --skip-dirs "**/_cache" --skip-dirs "**/dist" --skip-dirs "**/.next" --skip-dirs "**/vendor" .
+```
+
+- **Exit 1 (HIGH/CRITICAL found)** → this is a **CRITICAL review finding**.
+  Report the rows and **block the merge**, same as any Pass 1 critical.
+- **Exit 0** → note "Trivy: clean" and continue to Pass 1.
+- **Trivy missing / errored** → run `security/trivy-scan`'s installer; if
+  it still can't run, report that the gate could not run and treat as
+  block, not a silent pass.
+
 ## Pass 1 — CRITICAL (always run)
 
 Run the checks in [`checklist.md`](checklist.md), section "Pass 1".