dsh-ecc-skills 0.5.0 → 0.5.2

package/README.en.md

@@ -4,6 +4,8 @@
 [![GitHub release](https://img.shields.io/github/v/release/gongyijie85/dsh-ecc)](https://github.com/gongyijie85/dsh-ecc/releases)
 [![CI](https://github.com/gongyijie85/dsh-ecc/actions/workflows/ci.yml/badge.svg)](https://github.com/gongyijie85/dsh-ecc/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![DSH](https://img.shields.io/badge/DSH-0.1.0--rc.8%2B-4d6bfe)](https://github.com/gongyijie85/dsh-ecc)
+[![-skills](https://img.shields.io/badge/-skills-4d6bfe)]() [![-patterns](https://img.shields.io/badge/-patterns-4d6bfe)]() [![-orchestration](https://img.shields.io/badge/-orchestration-4d6bfe)]() [![-vertical-domains](https://img.shields.io/badge/-vertical--domains-4d6bfe)]() [![-methodology](https://img.shields.io/badge/-methodology-4d6bfe)]()
 
 <div align="center">
 
@@ -12,7 +14,7 @@
 </div>
 
 [affaan-m/ECC](https://github.com/affaan-m/ECC) (the ~227k⭐ "operator system",
-285 skills) skills for the **DeepSeek Harness (DSH)** — a progressive port to
+286 skills) skills for the **DeepSeek Harness (DSH)** — a progressive port to
 DSH's Cordis plugin architecture.
 
 > **Unofficial port**: skill content adapted from
@@ -36,7 +38,7 @@ dsh plugin --profile web add D:\plugins\dsh-ecc
 
 Restart the profile (`dsh web`) — the skills then load with the `skill` tool.
 
-## Port status: 273 / 285 skills (95.8%)
+## Port status: 274 / 286 skills (95.8%)
 
 - **v0.1.0** ✅ 20 skills — engineering methodology, agent systems, foundations
 - **v0.2.0** ✅ 68 skills — framework/language patterns (react, vue, django,
@@ -48,16 +50,19 @@ Restart the profile (`dsh web`) — the skills then load with the `skill` tool.
 - **v0.4.0** ✅ 135 skills — vertical domains (healthcare, homelab, scientific,
   finance, design/content, network ops, supply chain, marketing, research &
   data)
+- **v0.5.0 (this release)** ✅ +1 skill — `tasteforge-video` (repeatable
+  taste-driven video workflow: taste interview → style pack → validate → apply
+  → editable EDL/FCPXML export; ported from upstream 2026-08-18 commit 9c45004)
 - **Not ported (12)**: 6 skills depending on `/ecc:*` commands/hooks
   (ecc-guide, ecc-recipes, gateguard, plan-orchestrate, strategic-compact,
-  continuous-learning-v2) and 7 with companion files — unless a hooks/commands
+  continuous-learning-v2) and 6 with companion files — unless a hooks/commands
   bridge layer is built later.
 
 ## Adaptation notes
 
 - `skills/<name>/SKILL.md` copied verbatim (standard format, frontmatter carries
   `metadata.origin: ECC`).
-- Zero harness-specific references in all 273 ported skills; only 2 command
+- Zero harness-specific references in all 274 ported skills; only 2 command
   references were renamed to DSH bare names in v0.1 (`/bug-check` →
   `bug-check`, `/prompt-optimize` → `prompt-optimizer`).
 - Skill identity comes from the frontmatter `name` (e.g. the five
@@ -71,7 +76,7 @@ Restart the profile (`dsh web`) — the skills then load with the `skill` tool.
 Host-layer `ctx.skills.registerProvider` (same pattern as
 [mattpocock-skills-dsh](https://github.com/gongyijie85/mattpocock-skills-dsh)).
 Drop a `skills/<kebab-name>/SKILL.md` and it is auto-discovered. Verify with
-`npm run verify` (273/273).
+`npm run verify` (274/274).
 
 ## License
 

package/README.md

@@ -4,6 +4,8 @@
 [![GitHub release](https://img.shields.io/github/v/release/gongyijie85/dsh-ecc)](https://github.com/gongyijie85/dsh-ecc/releases)
 [![CI](https://github.com/gongyijie85/dsh-ecc/actions/workflows/ci.yml/badge.svg)](https://github.com/gongyijie85/dsh-ecc/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![DSH](https://img.shields.io/badge/DSH-0.1.0--rc.8%2B-4d6bfe)](https://github.com/gongyijie85/dsh-ecc)
+[![-技能](https://img.shields.io/badge/-技能-4d6bfe)]() [![-模式](https://img.shields.io/badge/-模式-4d6bfe)]() [![-编排](https://img.shields.io/badge/-编排-4d6bfe)]() [![-垂直领域](https://img.shields.io/badge/-垂直领域-4d6bfe)]() [![-方法论文法](https://img.shields.io/badge/-方法论文法-4d6bfe)]()
 
 <div align="center">
 
@@ -11,7 +13,7 @@
 
 </div>
 
-把 [affaan-m/ECC](https://github.com/affaan-m/ECC)(~227k⭐ 的"操作员系统",285 个
+把 [affaan-m/ECC](https://github.com/affaan-m/ECC)(~227k⭐ 的"操作员系统",286 个
 技能)渐进移植到 **DeepSeek Harness (DSH)** 的 Cordis 插件架构。
 
 > **English:** ECC (227k⭐ operator system) skills for DeepSeek Harness —
@@ -27,6 +29,8 @@
 
 ## 安装
 
+**支持的 DSH 版本**：`>=0.1.0-rc.8`（宿主面仅 `ctx.skills.registerProvider`，覆盖 0.1.0-rc.8 起全部 rc/alpha 线；实测基线 0.1.1-rc.2）。
+
 ```sh
 # npm(包名 dsh-ecc 已被同名项目占用,本包发布为 dsh-ecc-skills)
 dsh plugin --profile web add dsh-ecc-skills
@@ -75,16 +79,19 @@ dsh plugin --profile web add D:\plugins\dsh-ecc
 - **v0.1.0** ✅ 20 个纯单文件、无 harness 依赖的技能
 - **v0.2.0** ✅ 68 个模式类批量(前端/后端/语言/数据/架构)
 - **v0.3.0** ✅ 50 个编排/自动化/运维类(orch-*、council、team-*、e2e-testing、benchmark 等)
-- **v0.4.0(本次,收官)** ✅ **135 个垂直领域与全部剩余可移植技能**:
+- **v0.4.0** ✅ **135 个垂直领域与全部剩余可移植技能**:
   医疗(healthcare-*、hipaa)、家庭网络(homelab-*)、科学(scientific-* / pubmed / uspto / gget)、
   金融(customer-billing / finance-billing / defi / prediction-market / evm / x402)、
   设计与内容(brand-*、motion-*、liquid-glass、manim、remotion、article-writing、seo)、
   网络运维(cisco-ios、netmiko、network-*、terminal-*)、供应链/物流、营销/销售、
   研究与数据(pytorch、recsys、mle、clickhouse、video/audio)等
-- **累计:273/285 技能已移植**(占 95.8%);未移植仅 12 个:
+- **v0.5.0(本次)** ✅ **+1 个技能**:`tasteforge-video`(可复现的 taste 驱动
+  视频工作流——风格访谈 → style pack → 校验 → 应用 → EDL/FCPXML 导出,
+  移植上游 2026-08-18 新增提交 9c45004)
+- **累计:274/286 技能已移植**(占 95.8%);未移植仅 12 个:
   - 依赖 ECC 专属基础设施(`ecc-guide`、`ecc-recipes`、`gateguard`、`plan-orchestrate`、
     `strategic-compact`、`continuous-learning-v2`)——除非后续做 hooks/commands 桥接层
-  - 带辅助文件的 7 个(`continuous-learning`、`frontend-slides`、`openclaw-persona-forge`、
+  - 带辅助文件的 6 个(`continuous-learning`、`frontend-slides`、`openclaw-persona-forge`、
     `security-review`、`skill-comply`、`visa-doc-translate`)
 
 ## 移植说明(对比上游)
@@ -102,7 +109,7 @@ dsh plugin --profile web add D:\plugins\dsh-ecc
 同 [mattpocock-skills-dsh](https://github.com/gongyijie85/mattpocock-skills-dsh)
 (host 层 `ctx.skills.registerProvider`;零运行时依赖;原生解析折叠 YAML
 frontmatter)。往 `skills/<kebab-name>/SKILL.md` 放文件即自动发现;验证:
-`npm run verify`(20/20)。
+`npm run verify`(274/274)。
 
 ## 许可证
 

package/dsh.plugin.json

@@ -0,0 +1,288 @@
+{
+  "id": "gongyijie85/dsh-ecc",
+  "version": "0.5.2",
+  "main": "./lib/index.js",
+  "description": "ECC (227k-star operator system) skills for DeepSeek Harness — progressive port of 274 curated single-file skills (agentic engineering, evaluation, testing, patterns, vertical domains, docs). Adapted from affaan-m/ECC (MIT)",
+  "engines": {
+    "dsh": ">=0.1.0-rc.8"
+  },
+  "contributes": {
+    "tools": [],
+    "skills": [
+      "accessibility",
+      "agent-architecture-audit",
+      "agent-eval",
+      "agent-harness-construction",
+      "agent-introspection-debugging",
+      "agent-payment-x402",
+      "agent-self-evaluation",
+      "agent-sort",
+      "agentic-engineering",
+      "agentic-os",
+      "ai-first-engineering",
+      "ai-regression-testing",
+      "android-clean-architecture",
+      "angular-developer",
+      "api-connector-builder",
+      "api-design",
+      "architecture-decision-records",
+      "article-writing",
+      "automation-audit-ops",
+      "autonomous-agent-harness",
+      "autonomous-loops",
+      "backend-patterns",
+      "benchmark",
+      "benchmark-methodology",
+      "benchmark-optimization-loop",
+      "blender-motion-state-inspection",
+      "blueprint",
+      "brand-discovery",
+      "brand-voice",
+      "browser-qa",
+      "bun-runtime",
+      "canary-watch",
+      "carrier-relationship-management",
+      "cisco-ios-patterns",
+      "ck",
+      "claude-devfleet",
+      "click-path-audit",
+      "clickhouse-io",
+      "code-tour",
+      "codebase-onboarding",
+      "codehealth-mcp",
+      "coding-standards",
+      "competitive-platform-analysis",
+      "competitive-report-structure",
+      "compose-multiplatform-patterns",
+      "config-gc",
+      "configure-ecc",
+      "connections-optimizer",
+      "content-engine",
+      "content-hash-cache-pattern",
+      "context-budget",
+      "continuous-agent-loop",
+      "contract-first",
+      "cost-aware-llm-pipeline",
+      "cost-tracking",
+      "council",
+      "council-multi-model",
+      "cpp-coding-standards",
+      "cpp-testing",
+      "crosspost",
+      "csharp-testing",
+      "customer-billing-ops",
+      "customs-trade-compliance",
+      "dart-flutter-patterns",
+      "dashboard-builder",
+      "data-scraper-agent",
+      "data-throughput-accelerator",
+      "database-migrations",
+      "deep-research",
+      "defi-amm-security",
+      "delivery-gate",
+      "deployment-patterns",
+      "design-system",
+      "dev-team",
+      "django-celery",
+      "django-patterns",
+      "django-security",
+      "django-tdd",
+      "django-verification",
+      "dmux-workflows",
+      "docker-patterns",
+      "documentation-lookup",
+      "dotnet-patterns",
+      "dynamic-workflow-mode",
+      "e2e-testing",
+      "ecc-tools-cost-audit",
+      "email-ops",
+      "energy-procurement",
+      "enterprise-agent-ops",
+      "error-handling",
+      "eval-harness",
+      "evm-token-decimals",
+      "exa-search",
+      "fal-ai-media",
+      "fastapi-patterns",
+      "finance-billing-ops",
+      "flox-environments",
+      "flutter-dart-code-review",
+      "foundation-models-on-device",
+      "frontend-a11y",
+      "frontend-design-direction",
+      "frontend-patterns",
+      "fsharp-testing",
+      "gan-style-harness",
+      "generating-python-installer",
+      "git-workflow",
+      "github-ops",
+      "golang-patterns",
+      "golang-testing",
+      "google-workspace-ops",
+      "growth-log",
+      "healthcare-cdss-patterns",
+      "healthcare-emr-patterns",
+      "healthcare-eval-harness",
+      "healthcare-phi-compliance",
+      "hermes-imports",
+      "hexagonal-architecture",
+      "hipaa-compliance",
+      "homelab-network-readiness",
+      "homelab-network-setup",
+      "homelab-pihole-dns",
+      "homelab-vlan-segmentation",
+      "homelab-wireguard-vpn",
+      "hookify-rules",
+      "inherit-legacy-style",
+      "intent-driven-development",
+      "inventory-demand-planning",
+      "investor-materials",
+      "investor-outreach",
+      "ios-icon-gen",
+      "iterative-retrieval",
+      "ito-baskets",
+      "ito-compute",
+      "ito-inference",
+      "ito-training",
+      "java-coding-standards",
+      "jira-integration",
+      "jpa-patterns",
+      "knowledge-ops",
+      "kotlin-coroutines-flows",
+      "kotlin-exposed-patterns",
+      "kotlin-ktor-patterns",
+      "kotlin-patterns",
+      "kotlin-testing",
+      "kubernetes-patterns",
+      "laravel-patterns",
+      "laravel-plugin-discovery",
+      "laravel-security",
+      "laravel-tdd",
+      "laravel-verification",
+      "latency-critical-systems",
+      "lead-intelligence",
+      "liquid-glass-design",
+      "living-docs-governance",
+      "llm-trading-agent-security",
+      "logistics-exception-management",
+      "loop-design-check",
+      "mailtrap-email-integration",
+      "make-interfaces-feel-better",
+      "manim-video",
+      "market-research",
+      "marketing-campaign",
+      "mcp-server-patterns",
+      "messages-ops",
+      "ml-adoption-playbook",
+      "mle-workflow",
+      "motion-advanced",
+      "motion-foundations",
+      "motion-patterns",
+      "motion-ui",
+      "mysql-patterns",
+      "nanoclaw-repl",
+      "nasiko-control-plane",
+      "nestjs-patterns",
+      "netmiko-ssh-automation",
+      "network-bgp-diagnostics",
+      "network-config-validation",
+      "network-interface-health",
+      "nextjs-turbopack",
+      "nodejs-keccak256",
+      "nutrient-document-processing",
+      "nuxt4-patterns",
+      "opensource-pipeline",
+      "orch-add-feature",
+      "orch-build-mvp",
+      "orch-change-feature",
+      "orch-fix-defect",
+      "orch-pipeline",
+      "orch-refine-code",
+      "parallel-execution-optimizer",
+      "perl-patterns",
+      "perl-security",
+      "perl-testing",
+      "plan-canvas",
+      "plankton-code-quality",
+      "postgres-patterns",
+      "prediction-market-oracle-research",
+      "prediction-market-risk-review",
+      "prisma-patterns",
+      "product-capability",
+      "product-lens",
+      "production-audit",
+      "production-scheduling",
+      "project-flow-ops",
+      "prompt-optimizer",
+      "python-patterns",
+      "python-testing",
+      "pytorch-patterns",
+      "quality-nonconformance",
+      "quarkus-patterns",
+      "quarkus-security",
+      "quarkus-tdd",
+      "quarkus-verification",
+      "ralphinho-rfc-pipeline",
+      "react-native-patterns",
+      "react-patterns",
+      "react-performance",
+      "react-testing",
+      "recsys-pipeline-architect",
+      "recursive-decision-ledger",
+      "redis-patterns",
+      "regex-vs-llm-structured-text",
+      "remotion-video-creation",
+      "repo-scan",
+      "research-ops",
+      "returns-reverse-logistics",
+      "rules-distill",
+      "rust-patterns",
+      "rust-testing",
+      "safety-guard",
+      "santa-method",
+      "scientific-db-pubmed-database",
+      "scientific-db-uspto-database",
+      "scientific-pkg-gget",
+      "scientific-thinking-literature-review",
+      "scientific-thinking-scholar-evaluation",
+      "search-first",
+      "security-bounty-hunter",
+      "security-scan",
+      "seo",
+      "skill-scout",
+      "skill-stocktake",
+      "social-graph-ranker",
+      "social-publisher",
+      "springboot-patterns",
+      "springboot-security",
+      "springboot-tdd",
+      "springboot-verification",
+      "swift-actor-persistence",
+      "swift-concurrency-6-2",
+      "swift-protocol-di-testing",
+      "swiftui-patterns",
+      "taste",
+      "tasteforge-video",
+      "tdd-workflow",
+      "team-agent-orchestration",
+      "team-builder",
+      "terminal-opener",
+      "terminal-ops",
+      "tinystruct-patterns",
+      "token-budget-advisor",
+      "ui-demo",
+      "ui-to-vue",
+      "uncloud",
+      "unified-memory",
+      "unified-notifications-ops",
+      "verification-loop",
+      "video-editing",
+      "videodb",
+      "vite-patterns",
+      "vue-patterns",
+      "windows-desktop-e2e",
+      "workspace-surface-audit",
+      "x-api"
+    ]
+  }
+}

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "dsh-ecc-skills",
   "description": "ECC (227k-star operator system) skills for DeepSeek Harness — progressive port of 274 curated single-file skills (agentic engineering, evaluation, testing, patterns, vertical domains, docs). Adapted from affaan-m/ECC (MIT)",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "private": false,
   "type": "module",
+  "engines": {
+    "dsh": ">=0.1.0-rc.8"
+  },
   "main": "lib/index.js",
   "exports": {
     ".": "./lib/index.js",
@@ -12,6 +15,7 @@
   "files": [
     "lib",
     "skills",
+    "dsh.plugin.json",
     "cordis.patch.yml",
     "README.md",
     "README.en.md",
@@ -42,6 +46,11 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "compatibility": {
+      "dshReleases": {
+        "0.1.1-rc.2": "compatible"
+      }
     }
   }
 }

package/skills/ito-compute/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Itô Compute"
+  short_description: "GPU inventory, RFQs, status, and revocation"
+  default_prompt: "Use $ito-compute to request a live GPU RFQ, inspect status, or revoke this device safely."

package/skills/nasiko-control-plane/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Nasiko Control Plane"
+  short_description: "Safely install and inspect the optional Nasiko control plane"
+  default_prompt: "Use $nasiko-control-plane to inspect or explicitly install the pinned Nasiko CLI without enabling telemetry or exposing secrets."

package/skills/skill-stocktake/scripts/quick-diff.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# quick-diff.sh — compare skill file mtimes against results.json evaluated_at
+# Usage: quick-diff.sh RESULTS_JSON [CWD_SKILLS_DIR]
+# Output: JSON array of changed/new files to stdout (empty [] if no changes)
+#
+# When CWD_SKILLS_DIR is omitted, defaults to $PWD/.claude/skills so the
+# script always picks up project-level skills without relying on the caller.
+#
+# Environment:
+#   SKILL_STOCKTAKE_GLOBAL_DIR   Override ~/.claude/skills (for testing only;
+#                                do not set in production — intended for bats tests)
+#   SKILL_STOCKTAKE_PROJECT_DIR  Override project dir detection (for testing only)
+
+set -euo pipefail
+
+RESULTS_JSON="${1:-}"
+CWD_SKILLS_DIR="${SKILL_STOCKTAKE_PROJECT_DIR:-${2:-$PWD/.claude/skills}}"
+GLOBAL_DIR="${SKILL_STOCKTAKE_GLOBAL_DIR:-$HOME/.claude/skills}"
+
+if [[ -z "$RESULTS_JSON" || ! -f "$RESULTS_JSON" ]]; then
+  echo "Error: RESULTS_JSON not found: ${RESULTS_JSON:-<empty>}" >&2
+  exit 1
+fi
+
+# Validate CWD_SKILLS_DIR looks like a .claude/skills path (defense-in-depth).
+# Only warn when the path exists — a nonexistent path poses no traversal risk.
+if [[ -n "$CWD_SKILLS_DIR" && -d "$CWD_SKILLS_DIR" && "$CWD_SKILLS_DIR" != */.claude/skills* ]]; then
+  echo "Warning: CWD_SKILLS_DIR does not look like a .claude/skills path: $CWD_SKILLS_DIR" >&2
+fi
+
+evaluated_at=$(jq -r '.evaluated_at' "$RESULTS_JSON")
+
+# Fail fast on a missing or malformed evaluated_at rather than producing
+# unpredictable results from ISO 8601 string comparison against "null".
+if [[ ! "$evaluated_at" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]; then
+  echo "Error: invalid or missing evaluated_at in $RESULTS_JSON: $evaluated_at" >&2
+  exit 1
+fi
+
+# Pre-extract known paths from results.json once (O(1) lookup per file instead of O(n*m))
+known_paths=$(jq -r '.skills[].path' "$RESULTS_JSON" 2>/dev/null)
+
+tmpdir=$(mktemp -d)
+# Use a function to avoid embedding $tmpdir in a quoted string (prevents injection
+# if TMPDIR were crafted to contain shell metacharacters).
+_cleanup() { rm -rf "$tmpdir"; }
+trap _cleanup EXIT
+
+# Shared counter across process_dir calls — intentionally NOT local
+i=0
+
+process_dir() {
+  local dir="$1"
+  while IFS= read -r file; do
+    local mtime dp is_new
+    mtime=$(date -u -r "$file" +%Y-%m-%dT%H:%M:%SZ)
+    dp="${file/#$HOME/~}"
+
+    # Check if this file is known to results.json (exact whole-line match to
+    # avoid substring false-positives, e.g. "python-patterns" matching "python-patterns-v2").
+    if echo "$known_paths" | grep -qxF "$dp"; then
+      is_new="false"
+      # Known file: only emit if mtime changed (ISO 8601 string comparison is safe)
+      [[ "$mtime" > "$evaluated_at" ]] || continue
+    else
+      is_new="true"
+      # New file: always emit regardless of mtime
+    fi
+
+    jq -n \
+      --arg path "$dp" \
+      --arg mtime "$mtime" \
+      --argjson is_new "$is_new" \
+      '{path:$path,mtime:$mtime,is_new:$is_new}' \
+      > "$tmpdir/$i.json"
+    i=$((i+1))
+  done < <(find "$dir" -name "*.md" -type f 2>/dev/null | sort)
+}
+
+[[ -d "$GLOBAL_DIR" ]] && process_dir "$GLOBAL_DIR"
+[[ -n "$CWD_SKILLS_DIR" && -d "$CWD_SKILLS_DIR" ]] && process_dir "$CWD_SKILLS_DIR"
+
+if [[ $i -eq 0 ]]; then
+  echo "[]"
+else
+  jq -s '.' "$tmpdir"/*.json
+fi

package/skills/skill-stocktake/scripts/save-results.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# save-results.sh — merge evaluated skills into results.json with correct UTC timestamp
+# Usage: save-results.sh RESULTS_JSON <<< "$EVAL_JSON"
+#
+# stdin format:
+#   { "skills": {...}, "mode"?: "full"|"quick", "batch_progress"?: {...} }
+#
+# Always sets evaluated_at to current UTC time via `date -u`.
+# Merges stdin .skills into existing results.json (new entries override old).
+# Optionally updates .mode and .batch_progress if present in stdin.
+
+set -euo pipefail
+
+RESULTS_JSON="${1:-}"
+
+if [[ -z "$RESULTS_JSON" ]]; then
+  echo "Error: RESULTS_JSON argument required" >&2
+  echo "Usage: save-results.sh RESULTS_JSON <<< \"\$EVAL_JSON\"" >&2
+  exit 1
+fi
+
+EVALUATED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+# Read eval results from stdin and validate JSON before touching the results file
+input_json=$(cat)
+if ! echo "$input_json" | jq empty 2>/dev/null; then
+  echo "Error: stdin is not valid JSON" >&2
+  exit 1
+fi
+
+if [[ ! -f "$RESULTS_JSON" ]]; then
+  # Bootstrap: create new results.json from stdin JSON + current UTC timestamp
+  echo "$input_json" | jq --arg ea "$EVALUATED_AT" \
+    '. + { evaluated_at: $ea }' > "$RESULTS_JSON"
+  exit 0
+fi
+
+# Merge: new .skills override existing ones; old skills not in input_json are kept.
+# Optionally update .mode and .batch_progress if provided.
+#
+# Use mktemp for a collision-safe temp file (concurrent runs on the same RESULTS_JSON
+# would race on a predictable ".tmp" suffix; random suffix prevents silent overwrites).
+tmp=$(mktemp "${RESULTS_JSON}.XXXXXX")
+trap 'rm -f "$tmp"' EXIT
+
+jq -s \
+  --arg ea "$EVALUATED_AT" \
+  '.[0] as $existing | .[1] as $new |
+   $existing |
+   .evaluated_at = $ea |
+   .skills = ($existing.skills + ($new.skills // {})) |
+   if ($new | has("mode")) then .mode = $new.mode else . end |
+   if ($new | has("batch_progress")) then .batch_progress = $new.batch_progress else . end' \
+  "$RESULTS_JSON" <(echo "$input_json") > "$tmp"
+
+mv "$tmp" "$RESULTS_JSON"

package/skills/skill-stocktake/scripts/scan.sh

@@ -0,0 +1,170 @@
+#!/usr/bin/env bash
+# scan.sh — enumerate skill files, extract frontmatter and UTC mtime
+# Usage: scan.sh [CWD_SKILLS_DIR]
+# Output: JSON to stdout
+#
+# When CWD_SKILLS_DIR is omitted, defaults to $PWD/.claude/skills so the
+# script always picks up project-level skills without relying on the caller.
+#
+# Environment:
+#   SKILL_STOCKTAKE_GLOBAL_DIR   Override ~/.claude/skills (for testing only;
+#                                do not set in production — intended for bats tests)
+#   SKILL_STOCKTAKE_PROJECT_DIR  Override project dir detection (for testing only)
+
+set -euo pipefail
+
+GLOBAL_DIR="${SKILL_STOCKTAKE_GLOBAL_DIR:-$HOME/.claude/skills}"
+CWD_SKILLS_DIR="${SKILL_STOCKTAKE_PROJECT_DIR:-${1:-$PWD/.claude/skills}}"
+# Path to JSONL file containing tool-use observations (optional; used for usage frequency counts).
+# Override via SKILL_STOCKTAKE_OBSERVATIONS env var if your setup uses a different path.
+OBSERVATIONS="${SKILL_STOCKTAKE_OBSERVATIONS:-$HOME/.claude/observations.jsonl}"
+
+# Validate CWD_SKILLS_DIR looks like a .claude/skills path (defense-in-depth).
+# Only warn when the path exists — a nonexistent path poses no traversal risk.
+if [[ -n "$CWD_SKILLS_DIR" && -d "$CWD_SKILLS_DIR" && "$CWD_SKILLS_DIR" != */.claude/skills* ]]; then
+  echo "Warning: CWD_SKILLS_DIR does not look like a .claude/skills path: $CWD_SKILLS_DIR" >&2
+fi
+
+# Extract a frontmatter field (handles both quoted and unquoted single-line values).
+# Does NOT support multi-line YAML blocks (| or >) or nested YAML keys.
+extract_field() {
+  local file="$1" field="$2"
+  awk -v f="$field" '
+    BEGIN { fm=0 }
+    /^---$/ { fm++; next }
+    fm==1 {
+      n = length(f) + 2
+      if (substr($0, 1, n) == f ": ") {
+        val = substr($0, n+1)
+        gsub(/^"/, "", val)
+        gsub(/"$/, "", val)
+        print val
+        exit
+      }
+    }
+    fm>=2 { exit }
+  ' "$file"
+}
+
+# Get UTC timestamp N days ago (supports both macOS and GNU date)
+date_ago() {
+  local n="$1"
+  date -u -v-"${n}d" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null ||
+  date -u -d "${n} days ago" +%Y-%m-%dT%H:%M:%SZ
+}
+
+# Count observations matching a file path since a cutoff timestamp
+count_obs() {
+  local file="$1" cutoff="$2"
+  if [[ ! -f "$OBSERVATIONS" ]]; then
+    echo 0
+    return
+  fi
+  jq -r --arg p "$file" --arg c "$cutoff" \
+    'select(.tool=="Read" and .path==$p and .timestamp>=$c) | 1' \
+    "$OBSERVATIONS" 2>/dev/null | wc -l | tr -d ' '
+}
+
+# Scan a directory and produce a JSON array of skill objects
+scan_dir_to_json() {
+  local dir="$1"
+  local c7 c30
+  c7=$(date_ago 7)
+  c30=$(date_ago 30)
+
+  local tmpdir
+  tmpdir=$(mktemp -d)
+  # Use a function to avoid embedding $tmpdir in a quoted string (prevents injection
+  # if TMPDIR were crafted to contain shell metacharacters).
+  local _scan_tmpdir="$tmpdir"
+  _scan_cleanup() { rm -rf "$_scan_tmpdir"; }
+  trap _scan_cleanup RETURN
+
+  # Pre-aggregate observation counts in two passes (one per window) instead of
+  # calling jq per-file — reduces from O(n*m) to O(n+m) jq invocations.
+  local obs_7d_counts obs_30d_counts
+  obs_7d_counts=""
+  obs_30d_counts=""
+  if [[ -f "$OBSERVATIONS" ]]; then
+    obs_7d_counts=$(jq -r --arg c "$c7" \
+      'select(.tool=="Read" and .timestamp>=$c) | .path' \
+      "$OBSERVATIONS" 2>/dev/null | sort | uniq -c)
+    obs_30d_counts=$(jq -r --arg c "$c30" \
+      'select(.tool=="Read" and .timestamp>=$c) | .path' \
+      "$OBSERVATIONS" 2>/dev/null | sort | uniq -c)
+  fi
+
+  local i=0
+  while IFS= read -r file; do
+    local name desc mtime u7 u30 dp
+    name=$(extract_field "$file" "name")
+    desc=$(extract_field "$file" "description")
+    mtime=$(date -u -r "$file" +%Y-%m-%dT%H:%M:%SZ)
+    # Use awk exact field match to avoid substring false-positives from grep -F.
+    # uniq -c output format: "   N /path/to/file" — path is always field 2.
+    u7=$(echo "$obs_7d_counts" | awk -v f="$file" '$2 == f {print $1}' | head -1)
+    u7="${u7:-0}"
+    u30=$(echo "$obs_30d_counts" | awk -v f="$file" '$2 == f {print $1}' | head -1)
+    u30="${u30:-0}"
+    dp="${file/#$HOME/~}"
+
+    jq -n \
+      --arg path "$dp" \
+      --arg name "$name" \
+      --arg description "$desc" \
+      --arg mtime "$mtime" \
+      --argjson use_7d "$u7" \
+      --argjson use_30d "$u30" \
+      '{path:$path,name:$name,description:$description,use_7d:$use_7d,use_30d:$use_30d,mtime:$mtime}' \
+      > "$tmpdir/$i.json"
+    i=$((i+1))
+  done < <(find "$dir" -name "*.md" -type f 2>/dev/null | sort)
+
+  if [[ $i -eq 0 ]]; then
+    echo "[]"
+  else
+    jq -s '.' "$tmpdir"/*.json
+  fi
+}
+
+# --- Main ---
+
+global_found="false"
+global_count=0
+global_skills="[]"
+
+if [[ -d "$GLOBAL_DIR" ]]; then
+  global_found="true"
+  global_skills=$(scan_dir_to_json "$GLOBAL_DIR")
+  global_count=$(echo "$global_skills" | jq 'length')
+fi
+
+project_found="false"
+project_path=""
+project_count=0
+project_skills="[]"
+
+if [[ -n "$CWD_SKILLS_DIR" && -d "$CWD_SKILLS_DIR" ]]; then
+  project_found="true"
+  project_path="$CWD_SKILLS_DIR"
+  project_skills=$(scan_dir_to_json "$CWD_SKILLS_DIR")
+  project_count=$(echo "$project_skills" | jq 'length')
+fi
+
+# Merge global + project skills into one array
+all_skills=$(jq -s 'add' <(echo "$global_skills") <(echo "$project_skills"))
+
+jq -n \
+  --arg global_found "$global_found" \
+  --argjson global_count "$global_count" \
+  --arg project_found "$project_found" \
+  --arg project_path "$project_path" \
+  --argjson project_count "$project_count" \
+  --argjson skills "$all_skills" \
+  '{
+    scan_summary: {
+      global: { found: ($global_found == "true"), count: $global_count },
+      project: { found: ($project_found == "true"), path: $project_path, count: $project_count }
+    },
+    skills: $skills
+  }'