opencode-skills-collection 4.0.47 → 4.0.49

package/bundled-skills/docs/users/usage.md

@@ -39,7 +39,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of AAS Core
 
 When you ran `npx agentic-awesome-skills` or cloned the repository, you:
 
-✅ **Downloaded 2,098+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
+✅ **Downloaded 2,107+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
 ✅ **Made them available** to your AI assistant
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)
 
@@ -231,7 +231,7 @@ Let's actually use a skill right now. Follow these steps:
 
 ## Direct-install Step 5: Pick Skills Manually
 
-Don't try to use all 2,098+ skills at once. Here's a sensible approach:
+Don't try to use all 2,107+ skills at once. Here's a sensible approach:
 
 If you want a tool-specific starting point before choosing skills, use:
 
@@ -362,7 +362,7 @@ Usually no, but if your AI doesn't recognize a skill:
 
 ### "Can I load all skills into the model at once?"
 
-No. Even though you have 2,098+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 2,107+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
 
 The intended pattern is:
 

package/bundled-skills/docs/users/visual-guide.md

@@ -40,7 +40,7 @@ agentic-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 2,098+ skills live here
+├── 📁 skills/                          ← 2,107+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -53,7 +53,7 @@ agentic-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (2,098+ total)
+│   └── ... (2,107+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -106,7 +106,7 @@ agentic-awesome-skills/
 
 ```
                     ┌─────────────────────────┐
-                    │  2,098+ SKILLS          │
+                    │  2,107+ SKILLS          │
                     └────────────┬────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
@@ -207,7 +207,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (2,098+ total)                │
+│   └── ... (2,107+ total)                │
 └─────────────────────────────────────────┘
 ```
 

package/bundled-skills/extract-document-data/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: extract-document-data
+description: Extract structured, grounded fields from documents — values cite their page, missing values abstain instead of hallucinating. Use for parsing invoices, payslips, statements, contracts.
+category: document-verification
+risk: critical
+source: community
+source_repo: Sketchjar/stipple-agent-skills
+source_type: community
+date_added: "2026-08-31"
+author: Sketchjar
+tags: [document-verification, fact-checking, stipple, authenticity]
+tools: [claude, cursor, gemini, codex]
+license: "Apache-2.0"
+license_source: "https://github.com/Sketchjar/stipple-agent-skills/blob/main/LICENSE"
+---
+
+# Extract Document Data
+
+Extract structured JSON from documents with per-value grounding: every extracted value cites where it came from (page number, confidence), and values that aren't clearly present are reported in `not_found` rather than hallucinated. Uses the Stipple API (free anonymous tier).
+
+## When to use
+
+- Parsing payslips, invoices, bank statements, receipts, or contracts
+- Converting unstructured documents to JSON for downstream systems
+- Any extraction where hallucinated values are worse than missing values (lending, accounting, compliance)
+
+## Instructions
+
+1. **Get the document.** URL or local file path (PDF, PNG, JPEG, DOCX).
+
+2. **Choose the extraction mode:**
+   - **Ad-hoc fields** — tell the API exactly which fields you want:
+     ```bash
+     curl -X POST https://www.stipple.sh/v1/extract \
+       -F "file=@payslip.pdf" \
+       -F 'fields=[{"name":"employer_name"},{"name":"net_pay"},{"name":"pay_date"}]' \
+       -H "Authorization: Bearer $STIPPLE_API_KEY"
+     ```
+   - **Template** — use a built-in schema: `payslip`, `tax_invoice`, `bank_statement`, `receipt`, `contract`
+   - **Schema-free** — omit `fields` and let the model extract what it finds
+
+3. **Interpret the response.**
+
+   ```json
+   {
+     "mode": "schema_free",
+     "document_type": "payslip",
+     "pages_read": 1,
+     "fields": {
+       "employer_name": {"value": "Acme Cleaning Pty Ltd", "confidence": 0.95, "page": 1},
+       "net_pay": {"value": "2845.10", "confidence": 0.97, "page": 1}
+     },
+     "not_found": ["ytd_tax"]
+   }
+   ```
+
+   - Every value carries `confidence` (the model's self-report) and `page` (grounding)
+   - `not_found[]` lists requested fields the model couldn't find — **absences are reported, never guessed**
+   - `pages_read` shows how many pages were processed (page limits apply per document)
+
+4. **Report honestly.** This is *extraction, not verification* — values are what the document **shows**, not proof it's genuine:
+   - "Employer: Acme Cleaning Pty Ltd (confidence 0.95, page 1)"
+   - "ytd_tax: not found in document" — never "ytd_tax: 0" or a guess
+   - For "is this document genuine?", pair with the `verify-document` skill first
+
+## Output format
+
+```
+Payslip fields (grounded, not guessed):
+
+  Employer          Acme Cleaning Pty Ltd  (confidence 0.95, page 1)
+  Employee          J. Citizen             (confidence 0.98, page 1)
+  Net pay           2,845.10               (confidence 0.97, page 1)
+  Superannuation    268.20                 (confidence 0.93, page 1)
+
+not_found: ytd_tax
+(absences are reported, never hallucinated)
+```
+
+## Limitations and Safety
+
+- Invoices, statements, payslips, and contracts often contain sensitive personal,
+  financial, or commercial data. Obtain explicit approval before uploading them to
+  a hosted third party, minimize the submitted content, and confirm current
+  retention, residency, access, and deletion terms.
+- Confidence and page grounding do not prove that an extracted value is correct or
+  that the source document is authentic. Reconcile consequential values against the
+  original document and authoritative systems before payment, lending, accounting,
+  compliance, or legal action.
+- Keep the original file and extraction response so a human reviewer can reproduce
+  and correct disputed fields.
+
+## Notes
+
+- Costs 1 credit per page read by the model (minimum 1); free weekly allowance applies
+- Templates: `payslip`, `tax_invoice`, `bank_statement`, `receipt`, `contract` — pass as the `template` form field
+- Tables are extracted with structure preserved; multi-page documents are processed page by page
+- Pairs with `verify-document` (run first, for authenticity) — an extracted value from a tampered document is still wrong
+- Free key at https://www.stipple.sh for metering beyond the anonymous allowance

package/bundled-skills/falsify/SKILL.md

@@ -35,6 +35,20 @@ NO VERDICT WITHOUT A FALSIFIABLE HYPOTHESIS.
 If you cannot write down what would prove you wrong, you are not allowed to conclude. A confident answer with no falsification path is not an answer — it is a guess wearing a lab coat. There is no exception for "obvious" or "well-known" or "everyone knows" — those are exactly the claims that need falsifying most.
 </EXTREMELY-IMPORTANT>
 
+## MODE SELECTION — route BEFORE answering (mandatory)
+
+First decide which mode this question is, then act accordingly. **Do not run the five stages unless you picked Depth.** The wrong mode is itself a protocol failure.
+
+| If the ask is... | Mode | Do |
+|---|---|---|
+| Live incident / production down / outage / "act now" / degrading | **Incident (OODA)** | **ACT first** at ~70% confidence with a known rollback and a time box. Do NOT run the five stages. Stabilize, then falsify the effect. Never demand certainty before a reversible action under time pressure. |
+| Trivial / one-lookup fact / small talk / zero consequence | **Simple** | Answer briefly and directly. No protocol, no follow-up questions, no stage labels. |
+| Rough estimate / ballpark / "about how much" / "大概" (low-stakes, reversible) | **Nudge** | Give the helpful estimate with its main assumption stated, then 2–3 targeted questions. No five-stage ledger. If being wrong costs time/money/trust, escalate to Depth. |
+| Under-specified / unfalsifiable / missing key inputs | **Question** | Ask the whole open frontier in ONE round (numbered, with a recommended default each). Do not conclude, do not fabricate a default justification. |
+| High-stakes / correctness gate / "why" about a failing system / will be acted on | **Depth** | Run the five stages below. |
+
+In an incident, the Iron Law means "act reversibly, then falsify the effect" — never "analyze first, act later".
+
 ## When to Use This Skill
 
 
@@ -45,6 +59,9 @@ If you cannot write down what would prove you wrong, you are not allowed to conc
 - Claims about what a user, market, or system "will" do
 - Anything where being wrong costs time, money, or trust
 
+
+**Default to Nudge (not depth) when the ask is a rough ballpark** — "rough estimate", "ballpark", "about how much", "大概", "粗略": give the helpful estimate directly with its main assumption stated, then 2–3 questions. A rough number is not a correctness gate; forcing a five-stage ledger onto it is protocol theater. **Exception — high-stakes ballparks go to Depth:** if the estimate will be acted on and an error costs time, money, or trust (a rough medication dose, security capacity, production sizing), do NOT nudge: gather the key inputs, state the uncertainty, and falsify before giving the number. The shortcut only pays when the error is cheap.
+
 **Do NOT activate (answer simply)** for:
 - Factual recall you can verify in one lookup
 - Trivial questions where the answer is obvious and consequences are zero
@@ -181,7 +198,7 @@ For each detected bias, state the direction (pushes the estimate up or down) and
 ## The Nudge
 
 
-When the question does not warrant full depth but the answer will still be acted on, do not run the five stages — append **at most 2–3 short questions**, once per conversation, each tied to something specific in the answer just given:
+When the question does not warrant full depth but the answer will still be acted on, do not run the five stages — append **at most 2–3 short questions**, once per conversation, each tied to something specific in the answer just given. **High-stakes ballparks are NOT nudge territory:** a rough medication dose, security capacity, or production sizing estimate is Depth — being wrong there costs more than the shortcut saves.
 
 1. **Check a fact** — "which claim here would be worth verifying, and against what?"
 2. **Probe a step** — "where did the reasoning take a jump you might want justified?"

package/bundled-skills/find-matching-tenders/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: find-matching-tenders
+description: Find open AU/NZ government tenders matching what a company does, ranked by fit with why and gap analysis. Use when the user asks to find tenders, bid opportunities, government contracts, or RFPs for their business (or a client's).
+category: document-verification
+risk: critical
+source: community
+source_repo: Sketchjar/stipple-agent-skills
+source_type: community
+date_added: "2026-08-31"
+author: Sketchjar
+tags: [document-verification, fact-checking, stipple, authenticity]
+tools: [claude, cursor, gemini, codex]
+license: "Apache-2.0"
+license_source: "https://github.com/Sketchjar/stipple-agent-skills/blob/main/LICENSE"
+---
+
+# Find Matching Tenders
+
+Search live AU/NZ government tenders, rank them against what a company actually does (read from its website), and explain why each opportunity is relevant — including the capability gaps to prepare evidence for. Tender search is free forever on the Stipple API; no API key or signup needed.
+
+## When to use
+
+- Business development: "find tenders we could bid on"
+- Market research: "what government work is out there for cybersecurity firms in NSW?"
+- Bid pipeline maintenance: "check for new construction tenders this week"
+
+## Instructions
+
+1. **Get the company profile.** Ask for the company's website URL. If the user provides a description instead, skip resolution and use their description directly as capability context.
+
+2. **Resolve the company** (optional but improves matching):
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/companies/resolve \
+     -H "Content-Type: application/json" \
+     -d '{"query": "https://your-company.com"}'
+   ```
+
+   Returns the company's registered name, ABN, jurisdiction, and status.
+
+3. **Search open tenders** (free, no key):
+
+   ```bash
+   curl "https://www.stipple.sh/v1/tenders?q=construction&jurisdiction=AU&limit=10"
+   ```
+
+   Filters: `q` (keyword), `jurisdiction` (AU, AU-NSW, AU-VIC, NZ, ...), `limit`, `offset`.
+
+4. **Rank against the company** (optional, uses free weekly allowance):
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/tenders/match \
+     -H "Content-Type: application/json" \
+     -d '{"url": "https://your-company.com", "jurisdiction": "AU", "limit": 5}'
+   ```
+
+   Returns ranked matches with `why[]` (why it fits) and `gaps[]` (capability evidence to prepare).
+
+5. **Check data provenance** if results seem thin (free):
+
+   ```bash
+   curl "https://www.stipple.sh/v1/tenders/sources"
+   ```
+
+   Shows which government feeds are indexed and their freshness — explains why a search can be empty.
+
+6. **Report honestly.** Match scores are *fit signals*, not win probabilities. Present `gaps[]` as "prepare evidence for this", not disqualification.
+
+## Output format
+
+```
+Found 403 open tenders matching "construction" (AU/NZ)
+
+#1 [AU-NSW] Digital platform modernisation services
+    buyer:  NSW Department of ...
+    why:    matches 'cloud migration', 'API integration' from your services
+    gap:    no evidence found for 'ICT security assessment'
+    closes: 2026-09-15
+    https://...
+
+#2 [NZ] ...
+```
+
+## Limitations and Safety
+
+- The hosted service receives the search terms and, for matching, the supplied
+  company URL or description. Obtain approval before sending private capability or
+  client information and do not include secrets or non-public bid strategy.
+- Feed coverage and freshness can be incomplete. Confirm eligibility, scope,
+  amendments, deadlines, and submission instructions on the issuing authority's
+  primary tender page before investing time or submitting a bid.
+- Match scores and gap analysis are triage signals, not procurement advice, an
+  eligibility ruling, or a probability of winning.
+
+## Notes
+
+- Tender search and source listing are free forever — no key, no credits
+- Matching costs a small number of credits on the free weekly allowance
+- For ongoing monitoring, pair with a cron job that re-runs step 3 daily and diffs results
+- Data sources: NZ GETS, NSW eTendering, VendorPanel, and other government feeds

package/bundled-skills/graceful-shutdown/SKILL.md

@@ -97,20 +97,21 @@ async function drainAndExit(): Promise<void> {
 
 ### Step 4: Implement readiness and liveness probes
 
-Orchestrators use these to decide whether to route traffic and whether to restart the container.
+Orchestrators use these to decide whether to route traffic and whether to restart the container. Liveness proves the process is alive; readiness controls whether traffic is routed. While the listener is still available during a drain, keep liveness healthy and return 503 only from readiness. After the listener closes, new probes cannot connect, so do not promise that HTTP liveness remains reachable for the entire termination window.
 
 ```typescript
 import { createServer, IncomingMessage, ServerResponse } from "node:http";
 
 function handleHealthCheck(req: IncomingMessage, res: ServerResponse): void {
   if (req.url === "/healthz") {
-    // Liveness: is the process alive and not deadlocked?
+    // Keep liveness distinct from readiness while the listener is available.
+    // Drain-rejection middleware must not turn this endpoint into a 503.
     res.writeHead(200).end("ok");
     return;
   }
 
   if (req.url === "/readyz") {
-    // Readiness: should traffic be routed here?
+    // Readiness: 503 during shutdown so the load balancer stops routing.
     if (isShuttingDown) {
       res.writeHead(503).end("shutting down");
     } else {
@@ -123,21 +124,25 @@ function handleHealthCheck(req: IncomingMessage, res: ServerResponse): void {
 
 ### Step 5: Track active connections
 
-Maintain a count of in-flight requests so you know when draining is complete.
+Maintain a count of in-flight requests so you know when draining is complete. Use a once guard covering both `finish` and `close` events so that client disconnects (aborted requests) correctly decrement the counter.
 
 ```typescript
 let activeConnections = 0;
 let drainResolve: (() => void) | null = null;
 
-function onRequestStart(): void {
+function trackRequest(res: ServerResponse): void {
   activeConnections++;
-}
-
-function onRequestEnd(): void {
-  activeConnections--;
-  if (isShuttingDown && activeConnections === 0 && drainResolve) {
-    drainResolve();
+  let counted = true;
+  function release(): void {
+    if (!counted) return;
+    counted = false;
+    activeConnections--;
+    if (isShuttingDown && activeConnections === 0 && drainResolve) {
+      drainResolve();
+    }
   }
+  res.on("finish", release);
+  res.on("close", release);
 }
 
 function waitForActiveConnections(): Promise<void> {
@@ -160,25 +165,41 @@ const app = express();
 const server = createServer(app);
 let isShuttingDown = false;
 let activeRequests = 0;
+let drainResolve: (() => void) | null = null;
+
+// Health endpoints — registered BEFORE the drain-rejection middleware so it
+// cannot turn liveness into a 503 while the listener is still available.
+app.get("/healthz", (_, res) => res.send("ok"));
+app.get("/readyz", (_, res) => {
+  res.status(isShuttingDown ? 503 : 200).send(isShuttingDown ? "draining" : "ready");
+});
 
-// Track in-flight requests
+// Track in-flight requests and reject new application work during drain.
 app.use((req, res, next) => {
   if (isShuttingDown) {
     res.setHeader("Connection", "close");
     res.status(503).json({ error: "Server is shutting down" });
     return;
   }
+
   activeRequests++;
-  res.on("finish", () => activeRequests--);
+  let counted = true;
+  function release(): void {
+    if (!counted) return;
+    counted = false;
+    activeRequests--;
+    if (isShuttingDown && activeRequests === 0 && drainResolve) {
+      drainResolve();
+    }
+  }
+  // Listen for both finish (normal) and close (client abort) so the
+  // counter always decrements. The once guard prevents double-decrement
+  // when both events fire.
+  res.on("finish", release);
+  res.on("close", release);
   next();
 });
 
-// Health endpoints
-app.get("/healthz", (_, res) => res.send("ok"));
-app.get("/readyz", (_, res) => {
-  res.status(isShuttingDown ? 503 : 200).send(isShuttingDown ? "draining" : "ready");
-});
-
 // Application routes
 app.get("/api/data", async (req, res) => {
   const data = await fetchData();
@@ -199,13 +220,15 @@ function shutdown(signal: string): void {
   }, 25_000);
   forceExit.unref();
 
-  const poll = setInterval(() => {
-    if (activeRequests === 0) {
-      clearInterval(poll);
-      console.log("All requests drained — exiting cleanly");
-      process.exit(0);
-    }
-  }, 100);
+  if (activeRequests === 0) {
+    console.log("No active requests — exiting cleanly");
+    process.exit(0);
+  }
+
+  drainResolve = () => {
+    console.log("All requests drained — exiting cleanly");
+    process.exit(0);
+  };
 }
 
 process.on("SIGTERM", () => shutdown("SIGTERM"));
@@ -214,60 +237,28 @@ process.on("SIGINT", () => shutdown("SIGINT"));
 server.listen(3000, () => console.log("Server ready on :3000"));
 ```
 
-### Example 2: Python FastAPI with graceful shutdown
+### Example 2: Python FastAPI under Uvicorn
+
+Uvicorn owns SIGTERM handling and request draining. It stops accepting new connections, asks existing connections to shut down, waits for connections and tasks up to `--timeout-graceful-shutdown`, and only then sends the ASGI lifespan shutdown event. Do not replace its signal handler or wait for requests again inside `lifespan`; use that hook to release application resources after Uvicorn's drain.
 
 ```python
-import asyncio
-import signal
 from contextlib import asynccontextmanager
-from fastapi import FastAPI, Request, Response
-
-active_requests = 0
-is_shutting_down = False
-shutdown_event = asyncio.Event()
+from fastapi import FastAPI
 
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    # Startup
-    loop = asyncio.get_event_loop()
-    loop.add_signal_handler(signal.SIGTERM, begin_shutdown)
-    yield
-    # Shutdown — wait for in-flight requests
-    if active_requests > 0:
-        try:
-            await asyncio.wait_for(shutdown_event.wait(), timeout=25.0)
-        except asyncio.TimeoutError:
-            print(f"Drain timeout — {active_requests} requests abandoned")
-    print("Shutdown complete")
+    app.state.db_pool = await open_database_pool()
+    try:
+        yield
+    finally:
+        # Uvicorn has already completed or timed out its request drain.
+        await app.state.db_pool.close()
 
 
 app = FastAPI(lifespan=lifespan)
 
 
-def begin_shutdown():
-    global is_shutting_down
-    is_shutting_down = True
-    print(f"SIGTERM received — draining {active_requests} requests")
-    if active_requests == 0:
-        shutdown_event.set()
-
-
-@app.middleware("http")
-async def track_requests(request: Request, call_next):
-    global active_requests
-    if is_shutting_down:
-        return Response("Service shutting down", status_code=503)
-    active_requests += 1
-    try:
-        response = await call_next(request)
-        return response
-    finally:
-        active_requests -= 1
-        if is_shutting_down and active_requests == 0:
-            shutdown_event.set()
-
-
 @app.get("/healthz")
 async def healthz():
     return {"status": "ok"}
@@ -275,11 +266,17 @@ async def healthz():
 
 @app.get("/readyz")
 async def readyz():
-    if is_shutting_down:
-        return Response("draining", status_code=503)
     return {"status": "ready"}
 ```
 
+Run Uvicorn with a deadline shorter than the orchestrator's kill timeout:
+
+```bash
+uvicorn app:app --timeout-graceful-shutdown 25
+```
+
+If readiness must turn 503 before SIGTERM, coordinate a separately secured and tested pre-stop drain signal plus a propagation delay. FastAPI's lifespan shutdown hook is too late for that transition because Uvicorn invokes it after request draining.
+
 ### Example 3: Background worker with checkpoint
 
 ```typescript
@@ -325,6 +322,15 @@ async function processJobs(queue: JobQueue): Promise<void> {
 
 ## Common Pitfalls
 
+- **Problem:** Drain-rejection middleware turns both readiness and liveness into 503 while the HTTP listener is still available.
+  **Solution:** Register health routes before that middleware and flip only readiness. Once the listener closes, new probes may no longer connect; the shutdown deadline, not a promise of HTTP liveness, bounds termination.
+
+- **Problem:** Drain hangs until the force-exit timeout even though all clients have disconnected.
+  **Solution:** Track request completion with both `finish` and `close` events (Node.js) or equivalent. If a client aborts the connection, `finish` may never fire — `close` will. Use a once guard to prevent double-decrementing the counter.
+
+- **Problem:** A FastAPI application replaces Uvicorn's SIGTERM handler or waits for in-flight requests inside lifespan shutdown.
+  **Solution:** Let Uvicorn own signal handling, connection/task draining, and `--timeout-graceful-shutdown`. Use lifespan shutdown for resource cleanup; it runs after Uvicorn's request-drain phase.
+
 - **Problem:** Kubernetes kills the pod before connections drain because `terminationGracePeriodSeconds` is too short.
   **Solution:** Set it to at least drain timeout + 5s buffer. If your longest request takes 60s, use `terminationGracePeriodSeconds: 70` and drain timeout of 65s.
 

package/bundled-skills/grok-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: grok-delegate
 description: Delegate coding tasks to the Grok Build CLI only when the user explicitly
   requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/inngest/SKILL.md

@@ -37,6 +37,7 @@ and durable execution without managing queues or workers.
 ## Scope
 
 - redis-queues -> bullmq-specialist
+- serverless-queues -> upstash-qstash
 - workflow-orchestration -> temporal-craftsman
 - message-streaming -> event-architect
 - infrastructure -> infra-architect
@@ -388,6 +389,7 @@ Fix action: Add idempotency: 'event.data.orderId' to function config
 ### Delegation Triggers
 
 - redis|queue infrastructure|bullmq -> bullmq-specialist (Need Redis-based queue with existing infrastructure)
+- serverless queue|http queue|scheduled http -> upstash-qstash (Need plain HTTP delivery and cron without an event framework)
 - saga|compensation|rollback|long-running workflow -> temporal-craftsman (Need complex workflow orchestration with compensation)
 - event sourcing|event store|cqrs -> event-architect (Need event sourcing patterns)
 - vercel|deploy|production -> vercel-deployment (Need deployment configuration)

package/bundled-skills/kimi-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: kimi-delegate
 description: Delegate coding tasks to the Kimi Code CLI (`kimi`) only when the user
   explicitly requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/liuguang-banlan-ui/SKILL.md

@@ -90,9 +90,10 @@ Maintain a serializable manifest with these top-level fields:
 ### 7. Validate and report
 
 - Scaffold a clean starter with `scripts/scaffold_template.py` when a neutral implementation is needed.
-- Treat JavaScript manifests as executable code: inspect them first and run the
-  bundled helpers only on reviewed, locally authored configuration. Never pass
-  an untrusted or freshly downloaded manifest to either Python helper.
+- The bundled helpers parse only the restricted data-literal assignment used by
+  the starter. They reject expressions, function calls, duplicate keys,
+  unsupported syntax, trailing statements, and oversized manifests without
+  executing JavaScript. Keep runtime theme configs data-only as well.
 - Run `scripts/validate_manifest.py` on each theme config before rendering.
 - Capture desktop and mobile screenshots with a real browser. Inspect them directly if visual capability is available.
 - Run `scripts/measure_preview.py` on the pure field screenshot and retain measured chromatic ratio, luminance statistics, per-color coverage, and effective share.
@@ -122,7 +123,8 @@ Use the bundled starter under `assets/starter/` as a neutral base. Copy only the
 ### scripts/
 
 - `scaffold_template.py`: copy the neutral starter for `opal`, `obsidian`, or both.
-- `validate_manifest.py`: parse a JavaScript manifest through Node and validate required fields and ranges.
+- `manifest_parser.py`: statically parse the restricted data-only manifest grammar without executing JavaScript.
+- `validate_manifest.py`: validate required manifest fields and ranges.
 - `measure_preview.py`: measure a rendered pure-field PNG against the configured OKLCH palette.
 
 ### references/