opencode-skills-collection 4.0.24 → 4.0.26

package/bundled-skills/docs/users/plugins.md

@@ -1,6 +1,6 @@
-# Plugins for Claude Code and Codex
+# Plugins for compatible agent clients
 
-Release `9.0.0` adds first-class plugin distributions for both **Claude Code** and **Codex**.
+AAS ships first-class plugin distributions for **Claude Code** and **Codex**, plus portable [Agent Plugins 1.0](https://agent-plugins.org/specification) manifests for compatible specialized bundles.
 
 This page explains how plugins fit beneath **AAS Core**, the orchestration layer for Codex and Claude Code. Plugins and direct installs deliver skill payloads; Core exposes the complete catalog and validates, records, and plans the exact stack chosen by the agent.
 
@@ -44,10 +44,11 @@ Choose the full library when you want:
 
 ### Plugin install
 
-Use the plugin marketplace or repo-local plugin metadata when you want a curated, installable distribution:
+Use the plugin marketplace, repo-local metadata, or portable package when you want a curated, installable distribution:
 
 - **Claude Code** uses `.claude-plugin/marketplace.json` and `.claude-plugin/plugin.json`
 - **Codex** uses `.agents/plugins/marketplace.json` and `plugins/agentic-awesome-skills/.codex-plugin/plugin.json`
+- **Agent Plugins clients** load a specialized bundle's root `plugin.json` and discover its skills from the fixed `skills/` directory
 
 Choose the plugin route when you want:
 
@@ -103,6 +104,28 @@ Use a specialized plugin when you want:
 - a curated subset instead of the broad root plugin
 - a plugin with a clear promise, such as building web apps, auditing security, maintaining OSS repos, automating documents, or creating growth content
 
+## Portable Agent Plugins surface
+
+The [Agent Plugins specification](https://agent-plugins.org/specification) defines a shared package floor for Agent Skills and MCP server configuration. A portable AAS bundle has this shape:
+
+```text
+plugins/agentic-bundle-<bundle-id>/
+├── plugin.json
+└── skills/
+    └── <skill-id>/
+        └── SKILL.md
+```
+
+The root `plugin.json` targets the canonical `1.0.0` schema. It deliberately does not copy the host-specific `skills` or `interface` fields used by Codex: Agent Plugins discovers components from fixed locations and its manifest schema is closed.
+
+AAS generates this portable manifest only when every skill in the bundle is plugin-safe for both existing host targets and can be represented as a unique immediate child of `skills/`. Canonical qualified paths are flattened in the generated package without changing their instruction bodies; a basename collision fails the packaging gate. AAS-specific frontmatter such as provenance and risk is preserved as string values under the standard `metadata` field instead of leaking non-standard top-level keys. If any condition fails, the generator omits `plugin.json` instead of making a false portability claim. The per-bundle status in [Bundles](bundles.md) shows that result.
+
+These packages are currently **skills-only**. They do not bundle AAS Core's MCP server, credentials, hooks, or a portable `mcp.json`. Installation and enablement remain client-owned parts of the ecosystem, so use the instructions for your [compatible client](https://agent-plugins.org/compatible-clients) and point it at the desired `plugins/agentic-bundle-*` directory.
+
+`AAS Agent & MCP Builder` is the first public-directory flagship. Its version-controlled [submission dossier](../plugin-submissions/aas-agent-mcp-builder/) contains listing copy, public policy and support URLs, starter prompts, and reviewer-reproducible positive and negative evaluations. The dossier being ready does not mean the plugin is already public: OpenAI Platform review and the verified publisher's final publish action remain separate steps.
+
+The broad Codex and Claude root plugins remain host-specific because their filtered skill sets are not identical. They intentionally do not have a root Agent Plugins manifest. Choose a portable specialized bundle when cross-client packaging matters.
+
 ## Claude Code plugin surface
 
 Claude Code uses the repository's root `.claude-plugin` metadata.
@@ -161,6 +184,7 @@ Choose a **specialized plugin** if:
 - you are onboarding a team around one domain
 - you want plugin convenience without the breadth of the root plugin
 - you want the plugin itself to communicate a clear job, audience, and workflow
+- you want one package directory that compatible Agent Plugins clients can load without host-specific manifest fields
 
 The hosted [specialized plugin landing page](https://sickn33.github.io/agentic-awesome-skills/plugins) is the quickest way to compare the current AAS plugin packs.
 
@@ -174,3 +198,4 @@ The hosted [specialized plugin landing page](https://sickn33.github.io/agentic-a
 - [Bundles](bundles.md)
 - [Specialized Plugin Roadmap](specialized-plugin-roadmap.md)
 - [Usage](usage.md)
+- [AAS Agent & MCP Builder submission dossier](../plugin-submissions/aas-agent-mcp-builder/)

package/bundled-skills/docs/users/usage.md

@@ -39,7 +39,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of AAS Core
 
 When you ran `npx agentic-awesome-skills` or cloned the repository, you:
 
-✅ **Downloaded 2,003+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
+✅ **Downloaded 2,005+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
 ✅ **Made them available** to your AI assistant
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)
 
@@ -231,7 +231,7 @@ Let's actually use a skill right now. Follow these steps:
 
 ## Direct-install Step 5: Pick Skills Manually
 
-Don't try to use all 2,003+ skills at once. Here's a sensible approach:
+Don't try to use all 2,005+ skills at once. Here's a sensible approach:
 
 If you want a tool-specific starting point before choosing skills, use:
 
@@ -362,7 +362,7 @@ Usually no, but if your AI doesn't recognize a skill:
 
 ### "Can I load all skills into the model at once?"
 
-No. Even though you have 2,003+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 2,005+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
 
 The intended pattern is:
 

package/bundled-skills/docs/users/visual-guide.md

@@ -40,7 +40,7 @@ agentic-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 2,003+ skills live here
+├── 📁 skills/                          ← 2,005+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -53,7 +53,7 @@ agentic-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (2,003+ total)
+│   └── ... (2,005+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -106,7 +106,7 @@ agentic-awesome-skills/
 
 ```
                     ┌─────────────────────────┐
-                    │  2,003+ SKILLS          │
+                    │  2,005+ SKILLS          │
                     └────────────┬────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
@@ -207,7 +207,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (2,003+ total)                │
+│   └── ... (2,005+ total)                │
 └─────────────────────────────────────────┘
 ```
 

package/bundled-skills/ingest-youtube/ingest.py

@@ -310,7 +310,7 @@ def main() -> int:
     word_count = len(transcript.split()) if transcript else 0
     seeds = detect_seeds(transcript) if transcript else []
 
-    body = transcript or (
+    body = markdown_text(transcript) if transcript else (
         f"# {markdown_text(title)}\n\n"
         f"No subtitles or auto-captions available for this video.\n\n"
         "To capture this transcript, add captions to the source video or transcribe the audio "

package/bundled-skills/instagram/scripts/auth.py

@@ -19,16 +19,19 @@ from __future__ import annotations
 
 import argparse
 import asyncio
+import hmac
 import html
 import json
 import os
+import secrets
 import sys
+import time
 import webbrowser
 from datetime import datetime, timedelta, timezone
 from http.server import HTTPServer, BaseHTTPRequestHandler
 from pathlib import Path
 from typing import Optional
-from urllib.parse import parse_qs, urlparse
+from urllib.parse import parse_qs, urlencode, urlparse
 
 sys.path.insert(0, str(Path(__file__).parent))
 
@@ -62,11 +65,30 @@ def _mask_secret(value: str, keep: int = 4) -> str:
 class OAuthCallbackHandler(BaseHTTPRequestHandler):
     """Servidor HTTP mínimo para capturar o callback OAuth."""
     authorization_code: Optional[str] = None
+    expected_state: Optional[str] = None
 
     def do_GET(self):
         parsed = urlparse(self.path)
         params = parse_qs(parsed.query)
 
+        expected_path = urlparse(OAUTH_REDIRECT_URI).path or "/"
+        supplied_states = params.get("state", [])
+        state_is_valid = (
+            len(supplied_states) == 1
+            and OAuthCallbackHandler.expected_state is not None
+            and hmac.compare_digest(supplied_states[0], OAuthCallbackHandler.expected_state)
+        )
+
+        if parsed.path != expected_path or not state_is_valid:
+            self.send_response(400)
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(
+                b"<html><body><h2>Callback OAuth non valido.</h2>"
+                b"<p>Ripeti l'autorizzazione dal terminale.</p></body></html>"
+            )
+            return
+
         if "code" in params:
             OAuthCallbackHandler.authorization_code = params["code"][0]
             self.send_response(200)
@@ -91,20 +113,23 @@ class OAuthCallbackHandler(BaseHTTPRequestHandler):
         pass  # silencia logs do servidor
 
 
-def wait_for_oauth_code() -> Optional[str]:
+def wait_for_oauth_code(expected_state: str) -> Optional[str]:
     """Inicia servidor local e espera pelo código de autorização."""
+    OAuthCallbackHandler.authorization_code = None
+    OAuthCallbackHandler.expected_state = expected_state
     server = HTTPServer(("localhost", OAUTH_REDIRECT_PORT), OAuthCallbackHandler)
-    server.timeout = 120  # 2 minutos
+    server.timeout = 1
+    deadline = time.monotonic() + 120
     print("Aguardando autorização no callback OAuth local...")
     print("(Timeout: 2 minutos)\n")
 
-    while OAuthCallbackHandler.authorization_code is None:
+    while OAuthCallbackHandler.authorization_code is None and time.monotonic() < deadline:
         server.handle_request()
-        if OAuthCallbackHandler.authorization_code is not None:
-            break
 
     server.server_close()
-    return OAuthCallbackHandler.authorization_code
+    code = OAuthCallbackHandler.authorization_code
+    OAuthCallbackHandler.expected_state = None
+    return code
 
 
 # ── Token Exchange ────────────────────────────────────────────────────────────
@@ -287,22 +312,22 @@ async def setup() -> None:
         sys.exit(1)
 
     # Construir URL de autorização
-    scopes = ",".join(OAUTH_SCOPES)
-    auth_url = (
-        f"{OAUTH_AUTHORIZE_URL}?"
-        f"client_id={app_id}&"
-        f"redirect_uri={OAUTH_REDIRECT_URI}&"
-        f"scope={scopes}&"
-        f"response_type=code"
-    )
+    oauth_state = secrets.token_urlsafe(32)
+    auth_params = {
+        'client_id': app_id,
+        'redirect_uri': OAUTH_REDIRECT_URI,
+        'scope': ','.join(OAUTH_SCOPES),
+        'response_type': 'code',
+        'state': oauth_state,
+    }
+    auth_url = f"{OAUTH_AUTHORIZE_URL}?{urlencode(auth_params)}"
 
     print("\nAbrindo browser para autorização...")
     print("A URL de autorização e o App ID não serão exibidos para evitar vazamento de credenciais.\n")
     webbrowser.open(auth_url)
 
     # Esperar callback
-    OAuthCallbackHandler.authorization_code = None
-    code = wait_for_oauth_code()
+    code = wait_for_oauth_code(oauth_state)
 
     if not code:
         print("ERRO: Timeout ou falha na autorização.")

package/bundled-skills/instagram/scripts/csv_utils.py

@@ -0,0 +1,20 @@
+"""CSV helpers that keep exported cells inert in spreadsheet applications."""
+
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+
+def spreadsheet_safe_cell(value: Any) -> Any:
+    """Prefix formula-like strings so spreadsheet software treats them as text."""
+    if not isinstance(value, str):
+        return value
+    candidate = value.lstrip(" \t\r\n")
+    if candidate.startswith(("=", "+", "-", "@")):
+        return "'" + value
+    return value
+
+
+def spreadsheet_safe_record(record: Mapping[str, Any]) -> dict[str, Any]:
+    """Return a copy of *record* with every string cell neutralized."""
+    return {key: spreadsheet_safe_cell(value) for key, value in record.items()}

package/bundled-skills/instagram/scripts/export.py

@@ -17,6 +17,10 @@ import sys
 from datetime import datetime, timezone
 from pathlib import Path
 
+sys.path.insert(0, str(Path(__file__).parent))
+
+from csv_utils import spreadsheet_safe_record
+
 
 def safe_user_path(path_value, base_dir="."):
     """Resolve a CLI path under the current workspace."""
@@ -30,8 +34,6 @@ def safe_user_path(path_value, base_dir="."):
         raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
     return resolved_path
 
-sys.path.insert(0, str(Path(__file__).parent))
-
 _db = None
 
 
@@ -96,7 +98,7 @@ def export_csv_file(records: list, output_dir: Path, name: str) -> Path:
     with safe_user_path(path).open("w", newline="", encoding="utf-8-sig") as f:
         writer = csv.DictWriter(f, fieldnames=list(records[0].keys()), extrasaction="ignore")
         writer.writeheader()
-        writer.writerows(records)
+        writer.writerows(spreadsheet_safe_record(record) for record in records)
     print(f"[CSV] {len(records)} registros ->{path}")
     return path
 

package/bundled-skills/instagram/scripts/serve_api.py

@@ -30,6 +30,7 @@ from pathlib import Path
 sys.path.insert(0, str(Path(__file__).parent))
 
 from config import STATIC_DIR
+from csv_utils import spreadsheet_safe_record
 from db import Database
 
 try:
@@ -183,7 +184,7 @@ def export_csv():
     output = io.StringIO()
     writer = csv.DictWriter(output, fieldnames=list(posts[0].keys()), extrasaction="ignore")
     writer.writeheader()
-    writer.writerows(posts)
+    writer.writerows(spreadsheet_safe_record(post) for post in posts)
     output.seek(0)
     return StreamingResponse(
         iter([output.getvalue()]),

package/bundled-skills/landing-page-generator/scripts/landing_page_scaffolder.py

@@ -17,6 +17,7 @@ from typing import Dict, List, Any, Optional
 from datetime import datetime
 import html as html_module
 from pathlib import Path
+from urllib.parse import urlsplit
 
 
 def safe_user_path(path_value, base_dir="."):
@@ -37,6 +38,30 @@ def escape(text: str) -> str:
     return html_module.escape(str(text))
 
 
+def tsx_string(value: object) -> str:
+    """Encode config-derived text as a JavaScript string literal."""
+    return json.dumps(str(value), ensure_ascii=True)
+
+
+def tsx_value(value: object) -> str:
+    """Encode config-derived text as an inert JSX expression."""
+    return "{" + tsx_string(value) + "}"
+
+
+def tsx_href(value: object) -> str:
+    """Encode a link while refusing executable URL schemes and controls."""
+    raw = str(value).strip()
+    if not raw or any(ord(character) < 32 or ord(character) == 127 for character in raw):
+        raw = "#"
+    try:
+        scheme = urlsplit(raw).scheme.lower()
+    except ValueError:
+        scheme = "invalid"
+    if scheme and scheme not in {"http", "https", "mailto", "tel"}:
+        raw = "#"
+    return tsx_value(raw)
+
+
 # ---------------------------------------------------------------------------
 # Tailwind style mappings for TSX output
 # ---------------------------------------------------------------------------
@@ -86,18 +111,18 @@ def tsx_nav(config: Dict[str, Any], style: Dict[str, str]) -> str:
     nav_links = config.get("nav_links", [])
     cta = config.get("nav_cta", {"text": "Get Started", "url": "#"})
     links_jsx = "\n          ".join(
-        f'<a href="{l.get("url", "#")}" className="{style["muted"]} hover:{style["text"]} font-medium transition-colors">{l.get("text", "")}</a>'
+        f'<a href={tsx_href(l.get("url", "#"))} className="{style["muted"]} hover:{style["text"]} font-medium transition-colors">{tsx_value(l.get("text", ""))}</a>'
         for l in nav_links
     )
     return f'''function Navbar() {{
   return (
     <nav className="sticky top-0 z-50 {style["bg"]} border-b {style["border"]} backdrop-blur-sm">
       <div className="mx-auto flex max-w-7xl items-center justify-between px-6 py-4">
-        <a href="#" className="text-xl font-bold {style["text"]}">{brand}</a>
+        <a href="#" className="text-xl font-bold {style["text"]}">{tsx_value(brand)}</a>
         <div className="hidden items-center gap-8 md:flex">
           {links_jsx}
-          <a href="{cta.get("url", "#")}" className="rounded-lg {style["btn"]} px-5 py-2.5 text-sm font-semibold transition-colors">
-            {cta.get("text", "Get Started")}
+          <a href={tsx_href(cta.get("url", "#"))} className="rounded-lg {style["btn"]} px-5 py-2.5 text-sm font-semibold transition-colors">
+            {tsx_value(cta.get("text", "Get Started"))}
           </a>
         </div>
       </div>
@@ -114,22 +139,22 @@ def tsx_hero(hero: Dict[str, Any], style: Dict[str, str]) -> str:
     secondary_jsx = ""
     if secondary_cta:
         secondary_jsx = f'''
-          <a href="{secondary_cta.get("url", "#")}" className="rounded-lg {style["btn_secondary"]} px-8 py-3 text-lg font-semibold transition-colors">
-            {secondary_cta.get("text", "Learn More")}
+          <a href={tsx_href(secondary_cta.get("url", "#"))} className="rounded-lg {style["btn_secondary"]} px-8 py-3 text-lg font-semibold transition-colors">
+            {tsx_value(secondary_cta.get("text", "Learn More"))}
           </a>'''
     return f'''function Hero() {{
   return (
     <section className="flex min-h-[80vh] flex-col items-center justify-center px-6 py-24 text-center {style["bg"]}">
       <div className="mx-auto max-w-4xl">
         <h1 className="mb-6 text-5xl font-bold tracking-tight {style["text"]} md:text-7xl">
-          {h1}
+          {tsx_value(h1)}
         </h1>
         <p className="mx-auto mb-10 max-w-2xl text-xl {style["muted"]}">
-          {sub}
+          {tsx_value(sub)}
         </p>
         <div className="flex flex-col items-center gap-4 sm:flex-row sm:justify-center">
-          <a href="{primary_cta.get("url", "#")}" className="rounded-lg {style["btn"]} px-8 py-3 text-lg font-semibold transition-colors">
-            {primary_cta.get("text", "Get Started")}
+          <a href={tsx_href(primary_cta.get("url", "#"))} className="rounded-lg {style["btn"]} px-8 py-3 text-lg font-semibold transition-colors">
+            {tsx_value(primary_cta.get("text", "Get Started"))}
           </a>{secondary_jsx}
         </div>
       </div>
@@ -144,9 +169,9 @@ def tsx_features(features: Dict[str, Any], style: Dict[str, str]) -> str:
     items = features.get("items", [])
     cards_jsx = "\n        ".join(
         f'''<div className="{style["card_bg"]} rounded-xl p-8">
-          <div className="mb-4 text-3xl">{f.get("icon", "")}</div>
-          <h3 className="mb-3 text-xl font-semibold {style["text"]}">{f.get("title", "")}</h3>
-          <p className="{style["muted"]}">{f.get("description", "")}</p>
+          <div className="mb-4 text-3xl">{tsx_value(f.get("icon", ""))}</div>
+          <h3 className="mb-3 text-xl font-semibold {style["text"]}">{tsx_value(f.get("title", ""))}</h3>
+          <p className="{style["muted"]}">{tsx_value(f.get("description", ""))}</p>
         </div>'''
         for f in items
     )
@@ -154,8 +179,8 @@ def tsx_features(features: Dict[str, Any], style: Dict[str, str]) -> str:
   return (
     <section className="{style["section_alt"]} px-6 py-24">
       <div className="mx-auto max-w-7xl">
-        <h2 className="mb-4 text-center text-4xl font-bold {style["text"]}">{title}</h2>
-        <p className="mx-auto mb-16 max-w-2xl text-center text-lg {style["muted"]}">{subtitle}</p>
+        <h2 className="mb-4 text-center text-4xl font-bold {style["text"]}">{tsx_value(title)}</h2>
+        <p className="mx-auto mb-16 max-w-2xl text-center text-lg {style["muted"]}">{tsx_value(subtitle)}</p>
         <div className="grid gap-8 md:grid-cols-2 lg:grid-cols-3">
         {cards_jsx}
         </div>
@@ -172,10 +197,10 @@ def tsx_testimonials(testimonials: Dict[str, Any], style: Dict[str, str]) -> str
         return ""
     cards_jsx = "\n        ".join(
         f'''<div className="rounded-xl border {style["border"]} p-8">
-          <p className="mb-6 text-lg italic {style["muted"]}">"{t.get("quote", "")}"</p>
+          <p className="mb-6 text-lg italic {style["muted"]}">{tsx_value('"' + str(t.get("quote", "")) + '"')}</p>
           <div>
-            <p className="font-semibold {style["text"]}">{t.get("name", "")}</p>
-            <p className="text-sm {style["muted"]}">{t.get("title", "")}, {t.get("company", "")}</p>
+            <p className="font-semibold {style["text"]}">{tsx_value(t.get("name", ""))}</p>
+            <p className="text-sm {style["muted"]}">{tsx_value(t.get("title", ""))}, {tsx_value(t.get("company", ""))}</p>
           </div>
         </div>'''
         for t in items
@@ -184,7 +209,7 @@ def tsx_testimonials(testimonials: Dict[str, Any], style: Dict[str, str]) -> str
   return (
     <section className="px-6 py-24 {style["bg"]}">
       <div className="mx-auto max-w-7xl">
-        <h2 className="mb-16 text-center text-4xl font-bold {style["text"]}">{title}</h2>
+        <h2 className="mb-16 text-center text-4xl font-bold {style["text"]}">{tsx_value(title)}</h2>
         <div className="grid gap-8 md:grid-cols-2 lg:grid-cols-3">
         {cards_jsx}
         </div>
@@ -206,18 +231,18 @@ def tsx_pricing(pricing: Dict[str, Any], style: Dict[str, str]) -> str:
         border_cls = f"border-2 border-{accent}-500 ring-4 ring-{accent}-500/20" if featured else f"border {style['border']}"
         badge = f'\n            <div className="absolute -top-3 left-1/2 -translate-x-1/2 rounded-full bg-{accent}-600 px-4 py-1 text-xs font-semibold text-white">Most Popular</div>' if featured else ""
         features_jsx = "\n              ".join(
-            f'<li className="flex items-center gap-2 py-2"><span className="text-{accent}-500 font-bold">&#10003;</span> {feat}</li>'
+            f'<li className="flex items-center gap-2 py-2"><span className="text-{accent}-500 font-bold">&#10003;</span> {tsx_value(feat)}</li>'
             for feat in p.get("features", [])
         )
         cards.append(f'''<div className="relative rounded-2xl {border_cls} {style["card_bg"]} p-8 text-center">{badge}
-            <h3 className="mb-2 text-xl font-semibold {style["text"]}">{p.get("name", "")}</h3>
-            <div className="my-6 text-5xl font-extrabold {style["text"]}">${p.get("price", "0")}<span className="text-base font-normal {style["muted"]}">/mo</span></div>
-            <p className="{style["muted"]} mb-6">{p.get("description", "")}</p>
+            <h3 className="mb-2 text-xl font-semibold {style["text"]}">{tsx_value(p.get("name", ""))}</h3>
+            <div className="my-6 text-5xl font-extrabold {style["text"]}">${tsx_value(p.get("price", "0"))}<span className="text-base font-normal {style["muted"]}">/mo</span></div>
+            <p className="{style["muted"]} mb-6">{tsx_value(p.get("description", ""))}</p>
             <ul className="mb-8 space-y-1 text-left {style["muted"]}">
               {features_jsx}
             </ul>
-            <a href="{p.get("cta_url", "#")}" className="block w-full rounded-lg {style["btn"]} py-3 text-center font-semibold transition-colors">
-              {p.get("cta_text", "Choose Plan")}
+            <a href={tsx_href(p.get("cta_url", "#"))} className="block w-full rounded-lg {style["btn"]} py-3 text-center font-semibold transition-colors">
+              {tsx_value(p.get("cta_text", "Choose Plan"))}
             </a>
           </div>''')
     cards_jsx = "\n        ".join(cards)
@@ -225,7 +250,7 @@ def tsx_pricing(pricing: Dict[str, Any], style: Dict[str, str]) -> str:
   return (
     <section className="{style["section_alt"]} px-6 py-24">
       <div className="mx-auto max-w-5xl">
-        <h2 className="mb-16 text-center text-4xl font-bold {style["text"]}">{title}</h2>
+        <h2 className="mb-16 text-center text-4xl font-bold {style["text"]}">{tsx_value(title)}</h2>
         <div className="grid gap-8 lg:grid-cols-{min(len(plans), 3)}">
         {cards_jsx}
         </div>
@@ -241,10 +266,10 @@ def tsx_cta(cta: Dict[str, Any], style: Dict[str, str]) -> str:
   return (
     <section className="bg-{accent}-600 px-6 py-24 text-center text-white">
       <div className="mx-auto max-w-3xl">
-        <h2 className="mb-4 text-4xl font-bold">{cta.get("headline", "Ready to get started?")}</h2>
-        <p className="mb-10 text-xl opacity-90">{cta.get("subheadline", "")}</p>
-        <a href="{cta.get("url", "#")}" className="rounded-lg bg-white px-8 py-3 text-lg font-semibold text-{accent}-600 transition-colors hover:bg-gray-100">
-          {cta.get("text", "Start Free Trial")}
+        <h2 className="mb-4 text-4xl font-bold">{tsx_value(cta.get("headline", "Ready to get started?"))}</h2>
+        <p className="mb-10 text-xl opacity-90">{tsx_value(cta.get("subheadline", ""))}</p>
+        <a href={tsx_href(cta.get("url", "#"))} className="rounded-lg bg-white px-8 py-3 text-lg font-semibold text-{accent}-600 transition-colors hover:bg-gray-100">
+          {tsx_value(cta.get("text", "Start Free Trial"))}
         </a>
       </div>
     </section>
@@ -259,7 +284,7 @@ def tsx_footer(config: Dict[str, Any], style: Dict[str, str]) -> str:
     return f'''function Footer() {{
   return (
     <footer className="border-t {style["border"]} {style["bg"]} px-6 py-10 text-center {style["muted"]}">
-      <p>&copy; {footer_text}</p>
+      <p>&copy; {tsx_value(footer_text)}</p>
     </footer>
   );
 }}'''
@@ -267,8 +292,9 @@ def tsx_footer(config: Dict[str, Any], style: Dict[str, str]) -> str:
 
 def generate_tsx(config: Dict[str, Any]) -> str:
     """Generate complete Next.js/React TSX landing page with Tailwind CSS."""
-    style_name = config.get("design_style", "clean-minimal")
-    style = DESIGN_STYLES.get(style_name, DESIGN_STYLES["clean-minimal"])
+    requested_style = config.get("design_style", "clean-minimal")
+    style_name = requested_style if requested_style in DESIGN_STYLES else "clean-minimal"
+    style = DESIGN_STYLES[style_name]
 
     components = []
     component_names = []
@@ -312,11 +338,11 @@ def generate_tsx(config: Dict[str, Any]) -> str:
 import type {{ Metadata }} from "next";
 
 export const metadata: Metadata = {{
-  title: "{title}",
-  description: "{meta_desc}",
+  title: {tsx_string(title)},
+  description: {tsx_string(meta_desc)},
   openGraph: {{
-    title: "{title}",
-    description: "{meta_desc}",
+    title: {tsx_string(title)},
+    description: {tsx_string(meta_desc)},
     type: "website",
   }},
 }};

package/bundled-skills/loki-mode/README.md

@@ -455,7 +455,7 @@ Integrate with [Vibe Kanban](https://github.com/BloopAI/vibe-kanban) for a visua
 npx vibe-kanban
 
 # Export Loki tasks to Vibe Kanban
-./scripts/export-to-vibe-kanban.sh
+bash scripts/export-to-vibe-kanban.sh
 ```
 
 **Benefits:**

package/bundled-skills/loki-mode/integrations/vibe-kanban.md

@@ -157,7 +157,7 @@ while true; do
         inotifywait -e modify,create "$LOKI_DIR/queue/" 2>/dev/null
     fi
 
-    ./scripts/export-to-vibe-kanban.sh
+    bash scripts/export-to-vibe-kanban.sh
     sleep 2
 done
 ```