opencode-skills-collection 4.0.4 → 4.0.6

package/bundled-skills/markstream-install/SKILL.md

@@ -0,0 +1,187 @@
+---
+name: markstream-install
+description: "Install and configure Markstream streaming Markdown renderers for Vue, React, Svelte, Angular, Nuxt, Next.js, and Vue 2 applications."
+category: frontend
+risk: safe
+source: https://github.com/Simon-He95/markstream-vue/tree/main/.agents/skills/markstream-install
+source_repo: Simon-He95/markstream-vue
+source_type: official
+date_added: "2026-07-19"
+author: Simon-He95
+tags: [markdown, streaming, vue, react, svelte, angular, ai-chat]
+tools: [claude, cursor, gemini, codex]
+license: MIT
+license_source: https://github.com/Simon-He95/markstream-vue/blob/main/license
+---
+
+# Markstream Install
+
+## Overview
+
+Integrate the correct [Markstream](https://github.com/Simon-He95/markstream-vue) streaming Markdown renderer into an existing frontend application. This skill selects the framework package, installs only requested optional peers, preserves safe HTML and Mermaid defaults, and handles CSS, streaming state, and SSR boundaries.
+
+Read [references/scenarios.md](references/scenarios.md) before selecting packages or optional peers.
+
+## When to Use
+
+Use this skill when the user asks to:
+
+- add streaming Markdown rendering to an AI chat or document interface;
+- install Markstream in Vue, Nuxt, React, Next.js, Svelte, Angular, or Vue 2;
+- repair missing Markstream styles, an incorrect framework package, or an SSR failure;
+- replace another Markdown renderer with Markstream;
+- choose between static content, built-in smooth streaming, or externally parsed AST input.
+
+## How It Works
+
+### 1. Inspect the host application
+
+Before changing dependencies, inspect:
+
+- the framework and version in `package.json`;
+- the existing package-manager lockfile;
+- whether the application uses SSR;
+- reset, Tailwind, UnoCSS, or design-system styles;
+- required optional features such as highlighted code, Monaco, Mermaid, D2, or KaTeX.
+
+Do not select `markstream-vue` merely because the source repository has Vue in its name. Choose the framework-specific package from the scenario table.
+
+### 2. Install the smallest dependency set
+
+Install exactly one framework package and preserve the repository's package manager. Add optional peers only when the requested UI uses their feature.
+
+Examples:
+
+```bash
+npm install markstream-vue
+npm install markstream-react
+npm install markstream-svelte
+npm install markstream-angular
+npm install markstream-vue2
+```
+
+For Vue 2.6, also install and register `@vue/composition-api`. Vue 2.7 has a built-in Composition API and must not install that plugin.
+
+### 3. Wire styles in the correct order
+
+Import application resets before Markstream styles. Import package CSS explicitly instead of relying on component imports to inject it.
+
+For Tailwind or UnoCSS, put the matching package stylesheet in a component layer:
+
+```css
+@import 'markstream-vue/index.css' layer(components);
+```
+
+When math rendering is enabled, also import:
+
+```css
+@import 'katex/dist/katex.min.css';
+```
+
+Vue CLI 4 and other Webpack 4-based Vue 2 projects do not understand package export maps. Use the published file path in those projects:
+
+```ts
+import 'markstream-vue2/dist/index.css'
+```
+
+### 4. Add the smallest working renderer
+
+Prefer `content` for static documents and most streaming chat interfaces. Markstream's built-in smooth streaming can pace irregular token delivery without requiring the host application to maintain an AST.
+
+Use `nodes` plus `final` only when a worker, shared AST store, custom transform, or another application layer already owns parsing.
+
+### 5. Handle framework boundaries
+
+- In Nuxt, keep browser-only optional peers behind client boundaries.
+- In Next.js, use root `markstream-react` inside a `'use client'` component for live SSE or WebSocket streams.
+- Use `markstream-react/next` for SSR-first HTML with hydration and `markstream-react/server` for server-only rendering.
+- Use `markstream-svelte` only with Svelte 5.
+- Confirm the host meets the current `markstream-angular` version requirement.
+- In Vue 3, use `mode="chat"` for AI chat, `mode="docs"` for rich documents, and `mode="minimal"` for lightweight non-chat surfaces.
+
+### 6. Preserve safe defaults
+
+HTML policy defaults to `safe`, and Mermaid uses strict mode. Do not broaden either setting unless the user explicitly identifies a trusted legacy surface that requires it. Scope any exception to that surface.
+
+### 7. Validate
+
+Run the smallest relevant build, typecheck, or test command. Confirm:
+
+1. the selected package matches the framework;
+2. only requested optional peers were added;
+3. styles load after resets;
+4. SSR pages do not evaluate browser-only peers on the server;
+5. static content and at least one incremental update render correctly.
+
+Report the selected package, added peers, CSS location, streaming input choice, and validation command.
+
+## Examples
+
+### Vue 3 streaming chat
+
+```vue
+<MarkdownRender
+  mode="chat"
+  :content="markdown"
+  :final="false"
+  smooth-streaming="auto"
+  :fade="false"
+  typewriter
+/>
+```
+
+### Vue 3 completed chat history
+
+```vue
+<MarkdownRender
+  mode="chat"
+  :content="markdown"
+  :final="true"
+  :smooth-streaming="false"
+  :fade="true"
+  :typewriter="false"
+/>
+```
+
+Setting `final=true` tells the parser that the document is complete; disabling pacing alone does not finalize trailing constructs.
+
+## Best Practices
+
+- Install the minimal peer set instead of every optional integration.
+- Keep the renderer mode stable when a chat message transitions from streaming to history.
+- Let an existing outer message virtualizer own mounted rows; coordinate Markstream height metrics instead of adding a competing virtualizer.
+- Scope component overrides with `customId` or `custom-id` when multiple render surfaces coexist.
+- Test SSR and incremental client updates separately.
+
+## Limitations
+
+- This skill does not choose application-specific visual styling or chat architecture.
+- Optional browser-heavy peers can require framework-specific client boundaries and bundler configuration.
+- Vue 2.6 and legacy Webpack projects require the compatibility steps documented above.
+- Current package and framework requirements must be checked against the host lockfile and Markstream documentation before installation.
+
+## Security & Safety Notes
+
+- Package installation changes the dependency manifest and lockfile. Review the proposed package set before running the install command.
+- Do not enable trusted HTML or non-strict Mermaid rendering for untrusted model output.
+- Keep optional browser runtimes out of server-only execution paths.
+- Run installs only inside the intended project directory and use its existing package manager.
+
+## Common Pitfalls
+
+- **Problem:** Styles appear missing or are overwritten.
+  **Solution:** Load resets first, then the matching Markstream stylesheet explicitly.
+- **Problem:** A completed response still looks incomplete.
+  **Solution:** Set `final=true` when the stream finishes, not only `smoothStreaming=false`.
+- **Problem:** Next.js evaluates browser-only code on the server.
+  **Solution:** Select the root, `/next`, or `/server` entry according to the render boundary.
+- **Problem:** Lightweight highlighting does not activate after installing `stream-markdown`.
+  **Solution:** On Vue, Vue 2, or React, configure `MarkdownCodeBlockNode` as the `code_block` override.
+
+## Additional Resources
+
+- [Installation](https://markstream.simonhe.me/guide/installation)
+- [AI chat and streaming](https://markstream.simonhe.me/guide/ai-chat-streaming)
+- [Performance](https://markstream.simonhe.me/guide/performance)
+- [Troubleshooting](https://markstream.simonhe.me/guide/troubleshooting)
+- [Component overrides](https://markstream.simonhe.me/guide/component-overrides)

package/bundled-skills/markstream-install/references/scenarios.md

@@ -0,0 +1,48 @@
+# Install Scenarios
+
+## Package selection
+
+| Host app | Package and setup |
+|----------|-------------------|
+| Vue 3 / Nuxt 3 or 4 | `markstream-vue` |
+| Vue 2.6 | `markstream-vue2` plus `@vue/composition-api`; register the plugin before mounting the app |
+| Vue 2.7 | `markstream-vue2`; use Vue's built-in Composition API and do not install `@vue/composition-api` |
+| React 18+ / Next.js | `markstream-react` |
+| Angular 20+ | `markstream-angular` |
+| Svelte 5 | `markstream-svelte` |
+
+## Peer selection
+
+| Feature | Peer | Supported packages | Activation |
+|---------|------|--------------------|------------|
+| Lightweight highlighted code blocks | `stream-markdown` | `markstream-vue`, `markstream-vue2`, `markstream-react` | Configure the package's `MarkdownCodeBlockNode` as the `code_block` override |
+| Monaco-powered code blocks | `stream-monaco` | All framework packages | Install only when Monaco interactions are required |
+| Mermaid diagrams | `mermaid` | All framework packages | Install when Mermaid fences are rendered |
+| D2 diagrams | `@terrastruct/d2` | All framework packages | Install when D2 fences are rendered |
+| KaTeX math | `katex` | All framework packages | Install and load KaTeX CSS when math is rendered |
+
+## CSS checklist
+
+- Load reset styles first.
+- Load the framework-specific Markstream CSS after the reset.
+- In Tailwind or UnoCSS projects, use `@import '...' layer(components)`.
+- Import KaTeX CSS when math is enabled.
+- When rendering standalone node components directly, wrap them with the relevant package root class such as `.markstream-vue`, `.markstream-react`, or `.markstream-svelte`.
+
+## Input choice
+
+- `content`: static documents, low-frequency updates, and most SSE or token-streaming chat surfaces.
+- `content` with built-in smooth streaming: irregular AI streams whose visible output should be paced independently from raw chunk cadence.
+  - `smoothStreaming="auto"` or `smooth-streaming="auto"` is the default.
+  - Auto pacing activates when `typewriter=true` or `maxLiveNodes <= 0` / `max-live-nodes <= 0`.
+  - `typewriter` controls the cursor and defaults to `false`.
+  - `fade` controls node-entry and streamed-text fade effects.
+- `nodes` plus `final`: worker-preparsed content, shared AST stores, custom AST transforms, or cases where another layer already owns parsing.
+
+## Next.js entry selection
+
+| Surface | Entry |
+|---------|-------|
+| Live SSE or WebSocket output in a Client Component | `markstream-react` |
+| SSR-first HTML with client hydration | `markstream-react/next` |
+| Server-only Markdown rendering | `markstream-react/server` |

package/bundled-skills/modellix/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: modellix
+description: "Integrate Modellix unified API/CLI for async AI image and video generation (model run --wait, task download)."
+category: creative
+risk: critical
+source: community
+source_repo: Modellix/modellix-skill
+source_type: official
+date_added: "2026-07-16"
+author: Modellix
+tags: [image-generation, video-generation, modellix, cli, api]
+tools: [claude, cursor, gemini]
+license: "MIT"
+license_source: "https://github.com/Modellix/modellix-skill/blob/main/LICENSE"
+---
+
+# Modellix
+
+## Overview
+
+Modellix is a Model-as-a-Service platform for AI image and video generation. This skill teaches agents to use the official `modellix-cli` workflow (doctor → model run --wait → task download).
+
+Upstream package: https://github.com/Modellix/modellix-skill/tree/main/modellix-skill
+
+## When to Use This Skill
+
+- Generate images from text prompts
+- Generate or edit videos from text or images
+- Call Modellix models through a unified API/CLI
+- The user mentions Modellix, Seedream, Seedance, Nano Banana, or similar providers via Modellix
+
+## How It Works
+
+1. Authenticate with `MODELLIX_API_KEY` or `modellix-cli auth login`
+2. Run `modellix-cli doctor --json`
+3. Use default models when unspecified (T2I: `google/nano-banana-2-lite`, T2V: `bytedance/seedance-2.0-mini-t2v`)
+4. Submit with `modellix-cli model run --wait --json`
+5. Persist outputs with `modellix-cli task download`
+
+## Examples
+
+### Text-to-image
+
+```bash
+modellix-cli model run \
+  --model-slug google/nano-banana-2-lite \
+  --body '{"prompt":"A cinematic sunset over a futuristic city"}' \
+  --wait --timeout 5m --json
+```
+
+### Text-to-video
+
+```bash
+modellix-cli model run \
+  --model-slug bytedance/seedance-2.0-mini-t2v \
+  --body '{"prompt":"Ocean waves under a cloudy sunset"}' \
+  --wait --timeout 10m --json
+```
+
+## Best Practices
+
+- Prefer CLI `model run --wait` over hand-rolled polling
+- Before a paid submission, disclose the provider, model, prompt or source media that will leave the machine, expected cost, and output path; obtain explicit user approval
+- Prefer session-scoped API-key use; run `modellix-cli auth login` only when the user approves persistent local credential storage
+- Do not blindly retry paid submissions after unknown outcomes — check `task history`
+- Confirm the destination and overwrite policy before `task download`; never replace an existing file without explicit approval
+- Fetch request schemas from `model describe` `docs_url` or https://docs.modellix.ai/llms.txt
+
+## Security & Safety Notes
+
+- Requires a Modellix API key; never print secrets in logs
+- Prompts and uploaded source media leave the machine for `api.modellix.ai` and Modellix CDN processing
+- Paid generation consumes account balance and must not be submitted or retried without the approval described above
+
+## Limitations
+
+- Requires a Modellix account, network access, a valid API key, and sufficient account balance.
+- Model availability, request schemas, pricing, quotas, moderation, and generation time are controlled by Modellix and may change.
+- Generated outputs require human review for quality, rights, privacy, and policy compliance before publication.
+- This skill documents the CLI workflow only; it does not define a REST fallback or guarantee that a completed remote task downloads successfully.

package/bundled-skills/pptx-deck-creation/SKILL.md

@@ -154,8 +154,10 @@ Own net-new PPTX creation in this workflow. When a PPTX file is required,
 create a small task-specific builder with the user's approved environment. Start
 slides from a blank layout and create native objects from the final bounding
 boxes. Enable word wrap, disable automatic text resizing, set text insets and
-alignment explicitly, and reject zero or negative bounding boxes before
-building.
+alignment explicitly, and reject zero or negative bounding boxes for non-line
+objects before building. Validate lines by requiring two distinct endpoints;
+horizontal and vertical lines may have a zero-height or zero-width bounding
+box.
 
 Save the authored specification, PPTX, build manifest, audit records, and
 source manifest together. Do not add a large shared renderer or copy source
@@ -181,7 +183,11 @@ with the slide ID, object ID, reason, owner, and review date.
 
 The skill provides a read-only analysis contract, not packaged code. For a
 specific task, use `python-pptx` and the Office Open XML package to inspect a
-presentation. Produce only the context needed for the task:
+presentation. Use OOXML package inspection when `python-pptx` cannot expose
+theme, master, layout, relationship, notes, comments, animation, media, or
+non-modeled formatting evidence. Resolve the package relationship graph;
+never infer slide order from filenames or copy source package parts. Produce
+only the context needed for the task:
 
 * Compact prompt context with slide count, styles, brands, template, and layout
 * Full extraction with `layout_tree`, summary metrics, and render-aware elements
@@ -189,8 +195,10 @@ presentation. Produce only the context needed for the task:
 * Style-master analysis with colors, fonts, layout usage, and flow patterns
 
 Use [reference-deck analysis recipes](references/reference-deck-analysis.md)
-and [Python guidance](references/python-snippets.md) as static implementation
-references. Keep all extraction read-only.
+and [reference-deck analysis patterns](references/reference-deck-analysis-patterns.md) as static implementation
+references. Use the bundled `references/ooxml-parsing.md` guidance for the
+package-part map, relationship resolution, namespace, and secure parsing
+requirements. Keep all extraction read-only.
 
 ## Visual Assets
 
@@ -208,8 +216,8 @@ objects.
 Before any external generation call, disclose the provider and model, what
 prompt or source material will leave the machine, the likely cost, and the
 output path. Obtain explicit confirmation unless the user already authorized
-that exact operation. Never overwrite an existing output without separate
-confirmation.
+that exact operation. Never overwrite an existing output or manifest without
+separate explicit confirmation.
 
 ## Examples
 

package/bundled-skills/pptx-deck-creation/references/audit-checklist.md

@@ -20,16 +20,20 @@ A.y < B.y + B.h  AND  B.y < A.y + A.h
 For each text object estimate whether its text fits within its bbox.
 
 Rough capacity (Latin):
-- Characters per line ≈ `(bbox.w × 72) / (font_size × 0.5)`, using `0.5 em` as an average Latin glyph-width factor
+- Characters per line ≈ `(bbox.w × 72) / (font_size × 0.5)`, using `0.5 em`
+  as an average Latin glyph-width factor
 - Lines available ≈ `(bbox.h × 72) / (font_size × 1.2)`
   _(bbox in inches, font_size in pt)_
 
 Adjustments:
-- **CJK / full-width text:** use a glyph-width factor near `1.0 em` instead of `0.5 em`. The extractor reports `non_ascii_text` — use it to flag CJK-heavy slides.
+- **CJK / full-width text:** halve the characters-per-line value (full-width glyphs ≈ 2× Latin advance). The extractor reports `non_ascii_text` — use it to flag CJK-heavy slides.
 - **Text on a shape/card:** subtract ≈0.1 in of inner padding from each side of the shape before computing capacity; the text occupies the inset inner area, not the full shape.
 
 - **Pass:** estimated text volume ≤ available capacity.
-- **Warning:** likely overflow → inspect the generated PPTX or rendered preview, then shorten bullets, enlarge the bbox, or split the slide when clipping is confirmed. This estimate is a triage heuristic, not a deterministic failure by itself.
+- **Warning:** likely overflow → inspect the generated PPTX or rendered preview,
+  then shorten bullets, enlarge the bbox, or split the slide when clipping is
+  confirmed. This estimate is a triage heuristic, not a deterministic failure
+  by itself.
   **Never set `font_size` below 9 pt for `classification: "content"` objects.**
 
 ## 3. Font Size Minimums

package/bundled-skills/pptx-deck-creation/references/ooxml-parsing.md

@@ -0,0 +1,58 @@
+# OOXML Parsing Reference
+
+A `.pptx` is an Open Packaging Conventions ZIP archive. Inspect it read-only
+by resolving its relationship graph; do not assume sequential filenames or
+copy package parts into a generated deck.
+
+## Package-Part Map
+
+| Need | Parts |
+| --- | --- |
+| Slide order | `ppt/presentation.xml`, `ppt/_rels/presentation.xml.rels` |
+| Slide text and shapes | Slide parts resolved from presentation relationships (commonly `ppt/slides/slideN.xml`) |
+| Layout, notes, images, charts | The slide's relationship part (commonly `ppt/slides/_rels/slideN.xml.rels`) |
+| Template geometry | `ppt/slideLayouts/`, `ppt/slideMasters/` |
+| Colors and fonts | Theme parts resolved from presentation/master relationships (commonly under `ppt/theme/`) |
+| Notes and comments | `ppt/notesSlides/`, `ppt/comments/` |
+| Media and embeddings | `ppt/media/`, `ppt/embeddings/` |
+
+## Relationship Resolution
+
+1. Start with `ppt/presentation.xml`; use its slide ID list and
+   `ppt/_rels/presentation.xml.rels` to resolve slides in presentation order.
+2. For every part that needs linked content, resolve targets from that part's
+   `.rels` file relative to the owning part rather than from a hard-coded path.
+3. Retain the relationship ID, type, resolved target, and any unreadable or
+   missing target in the analysis result.
+4. Treat raw element ordering as evidence for rendering, not as a reason to
+   reproduce a source slide or its package XML.
+
+## Namespaces
+
+- PresentationML: `http://schemas.openxmlformats.org/presentationml/2006/main`
+- DrawingML: `http://schemas.openxmlformats.org/drawingml/2006/main`
+- Office relationships: `http://schemas.openxmlformats.org/officeDocument/2006/relationships`
+- Package relationships: `http://schemas.openxmlformats.org/package/2006/relationships`
+
+## Analysis Output Guidance
+
+For a read-only extraction, retain the slide number, resolved relationship
+target, concatenated text, shape counts, notes, relationship types, and
+OOXML-only markers such as animations, comments, transitions, unsupported
+shapes, and non-modeled formatting. For design context, retain theme
+color/font tokens without inventing an RGB value when a scheme or system color
+cannot be fully resolved.
+
+Record the input deck path, inspected parts, relationship-resolution errors,
+and unreadable XML in the analysis manifest. Keep the result limited to the
+evidence needed for the requested analysis.
+
+## Secure, Read-Only Handling
+
+- Treat a source deck as untrusted input. Reject path traversal, symlinks,
+  oversized members, and compressed archive bombs before reading ZIP members.
+- Parse XML with a secure parser. Disable DTD loading, entity expansion, and
+  network access.
+- Preserve `xml:space="preserve"` semantics when collecting text.
+- Do not modify the source archive, overwrite it, or blindly copy XML, media,
+  fonts, images, or embedded files into a new deck.

package/bundled-skills/pptx-deck-creation/references/{python-snippets.md → reference-deck-analysis-patterns.md}

@@ -1,4 +1,4 @@
-# PPTX Python Snippets
+# Reference-Deck Analysis Patterns
 
 It describes how to approach PPTX extraction and style analysis with `python-pptx`, using short illustrative
 snippets — not a packaged module to copy wholesale.

package/bundled-skills/pptx-deck-creation/references/reference-deck-analysis.md

@@ -6,8 +6,9 @@ This file is static guidance for inspecting existing `.pptx` files and defining
 
 - Keep only static guidance for reference-deck prompt context, extraction, folder analysis, and style-master inspection.
 - Do not place runtime scripts, model assets, importable Python modules, or generated artifacts here.
-- This skill ships no importable code; implement the extraction/style-analysis contract on demand with `python-pptx`.
-- `python-snippets.md` holds documentation-only `python-pptx` guidance — approach notes plus short illustrative snippets. Do not import from it or recreate packaged `.py` resources from it.
+- This skill ships no importable code; implement the extraction/style-analysis and read-only OOXML inspection contracts on demand with `python-pptx`, `zipfile`, and a secure XML parser.
+- `reference-deck-analysis-patterns.md` holds documentation-only `python-pptx` guidance — approach notes plus short illustrative snippets. Do not import from it or recreate packaged `.py` resources from it.
+- `ooxml-parsing.md` holds documentation-only package-part, relationship, namespace, and security guidance. It is not a runtime dependency or script template.
 
 ## Analysis Recipes
 
@@ -28,15 +29,34 @@ Produce a full JSON extraction including:
 - `summary` complexity metrics
 - `slides[*].layout_tree` with groups/objects
 - `ooxml_elements` for render-aware inspection
+- resolved package relationships, OOXML-only markers, and parsing exceptions
 
-### 3. Folder Batch Recipe
+### 3. OOXML Package Inspection Recipe
+
+Use read-only package inspection when high-level APIs do not expose the needed
+evidence: slide order, theme tokens, masters/layouts, notes, comments,
+animations, media, charts, or non-modeled formatting.
+
+- Resolve slide order from `ppt/presentation.xml` and its relationship part.
+	Do not derive it from `slideN.xml` filenames.
+- Resolve every relationship target relative to its owning source part, not its
+	`.rels` part. Retain the relationship type, target, and unreadable XML errors
+	in the result.
+- Preserve theme colors and fonts as tokens when they cannot be reliably
+	resolved to RGB values.
+- Parse untrusted XML with a secure parser; do not enable DTDs, entity
+	expansion, or network access.
+- Keep the source package read-only and never copy its XML parts into a new
+	deck.
+
+### 4. Folder Batch Recipe
 
 Process a folder of decks to produce:
 
 - One `.pptx-spec.json` file per deck
 - A `manifest.json` to track outputs
 
-### 4. Style Master Recipe
+### 5. Style Master Recipe
 
 Run style-only analysis when you need design lock signals:
 
@@ -44,7 +64,7 @@ Run style-only analysis when you need design lock signals:
 - Typography and font-size distribution
 - Master/layout usage and flow patterns
 
-### 5. Reference Template Catalog Recipe
+### 6. Reference Template Catalog Recipe
 
 When a reference deck should inform a new deck's layout rhythm, produce a
 human-readable catalog from the existing prompt-context, extraction, and
@@ -83,9 +103,11 @@ Suggested catalog shape:
 ## Related Responsibilities
 
 This reference covers PPTX prompt context, extraction, folder batch analysis,
-style-master inspection, and the derived reference-template catalog only.
+style-master inspection, read-only OOXML package inspection, and the derived
+reference-template catalog only. See [OOXML parsing guidance](ooxml-parsing.md)
+for the package-part map and parser safety rules.
 
 - Use the parent `pptx-deck-creation` workflow for narrative/source preparation,
-  together with [design profiles](design-profiles.md) for profile selection.
+	together with [design profiles](design-profiles.md) for profile selection.
 - Use [visual asset guidelines](visual-asset-adapters.md) for acquiring and
-  placing icons, images, SVGs, and infographics.
+	placing icons, images, SVGs, and infographics.

package/bundled-skills/pptx-deck-creation/references/visual-asset-adapters.md

@@ -19,9 +19,9 @@ Shared rules:
 - On failure, write a failure manifest; never substitute a placeholder and call it generated.
 - Never request secrets in chat or a prompt dialog. For cloud auth use `.env` or `az login`.
 - Before a billable generation call or any request that sends user-provided or
-  source material to a third party, disclose the provider/model, the material
-  that will leave the machine, likely cost, and output path. Obtain explicit
-  confirmation unless the user already authorized that exact operation.
+    source material to a third party, disclose the provider/model, the material
+    that will leave the machine, likely cost, and output path. Obtain explicit
+    confirmation unless the user already authorized that exact operation.
 
 ---
 
@@ -62,7 +62,7 @@ def icon_search(query, limit=8, prefix=None, color=None, out_dir="assets/icons")
 
 ## 2. Web Image Search
 
-Prefer the browsing or image-search capability available in the current client.
+Prefer the VS Code fetch tools (`fetch_webpage`) or an MCP image-search tool you have available.
 When you already have a direct image URL (from search results or the user), download it locally:
 
 ```python
@@ -102,8 +102,9 @@ Generate through a user-managed provider (OpenAI or Azure OpenAI). Read credenti
 never accept secrets via chat.
 
 Before running the snippet, obtain the external-call confirmation described in
-the shared rules. If `output_path` already exists, choose a new path or obtain
-separate overwrite confirmation; do not silently replace it.
+the shared rules. If `output_path` or its manifest already exists, choose a new
+path or obtain separate explicit overwrite confirmation; do not silently
+replace either file.
 
 ```python
 import base64, json, os
@@ -111,15 +112,20 @@ from pathlib import Path
 from openai import OpenAI, AzureOpenAI  # provided by the user's environment
 
 def text_to_infographic(prompt, output_path, provider="openai",
-                        model_or_deployment="gpt-image-1", size="1024x1024"):
+                        model_or_deployment="gpt-image-1", size="1024x1024",
+                        confirmed=False, allow_overwrite=False):
     output = Path(output_path)
     manifest_path = output.with_suffix(".manifest.json")
     existing = [path for path in (output, manifest_path) if path.exists()]
-    if existing:
+    if existing and not allow_overwrite:
         raise FileExistsError(f"Refusing to overwrite existing paths: {existing}")
     manifest_path.parent.mkdir(parents=True, exist_ok=True)
     manifest = {"provider": provider, "model_or_deployment": model_or_deployment,
                 "output_path": output_path}
+    if not confirmed:
+        manifest.update(status="cancelled", error="External generation was not confirmed")
+        manifest_path.write_text(json.dumps(manifest, indent=2), encoding="utf-8")
+        return manifest
     try:
         if provider == "azure-openai":
             client = AzureOpenAI(
@@ -130,17 +136,20 @@ def text_to_infographic(prompt, output_path, provider="openai",
         else:
             client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])
         result = client.images.generate(model=model_or_deployment, prompt=prompt, size=size)
-        output.parent.mkdir(parents=True, exist_ok=True)
         output.write_bytes(base64.b64decode(result.data[0].b64_json))
         manifest["status"] = "ok"
     except Exception as exc:  # report, never fake-generate
         manifest.update(status="error", error=str(exc))
-    manifest_path.write_text(json.dumps(manifest, indent=2))
+    manifest_path.write_text(json.dumps(manifest, indent=2), encoding="utf-8")
     return manifest
 ```
 
-- Ask the user for any missing non-secret values: provider, prompt,
-  model/deployment, size, and output path.
+- Collect missing values via `vscode_askQuestions`: provider, prompt, model/deployment, size, output path.
+- Before calling the function, disclose the provider/model, material leaving
+  the machine, likely cost, and output path. Set `confirmed=True` only after
+  the user explicitly authorizes that exact external request. Set
+  `allow_overwrite=True` only after separate explicit approval to replace every
+  existing output or manifest path.
 - Use `.env` or `az login` for auth; never ask for keys/tokens in chat or the dialog.
 - Use generated art as a supporting visual. Recreate essential text, labels,
   metrics, and steps with native PowerPoint objects. Add a vector asset only
@@ -155,4 +164,5 @@ NotebookLM has no public generation API, so treat this as an optional, user-conf
 - If the user has a NotebookLM/MCP bridge tool configured, call it with `source_refs` + `prompt`,
   then save the returned image locally and record provenance.
 - If no bridge is configured, **fall back to Text → Infographic (section 4)** or omit the asset.
-- Apply the same provenance and failure-manifest rules as the other generation guidelines.
+- Apply the same confirmation, overwrite, provenance, and failure-manifest
+    rules as the other generation guidelines.

package/bundled-skills/pr-writer/SKILL.md

@@ -18,14 +18,14 @@ Create pull requests following Sentry's engineering practices.
 
 ## Prerequisites
 
-Before creating a PR, ensure all changes are committed. If there are uncommitted changes, run the `sentry-skills:commit` skill first to commit them properly.
+Before creating a PR, ensure all changes are committed. If there are uncommitted changes, run the available `commit` skill first to commit them properly.
 
 ```bash
 # Check for uncommitted changes
 git status --porcelain
 ```
 
-If the output shows any uncommitted changes (modified, added, or untracked files that should be included), invoke the `sentry-skills:commit` skill before proceeding.
+If the output shows any uncommitted changes (modified, added, or untracked files that should be included), invoke the available `commit` skill before proceeding. If the client requires qualified skill names, use the qualifier for the plugin that supplied this skill.
 
 ## Process