opencode-skills-collection 4.0.53 → 4.0.54

package/bundled-skills/docs/maintainers/categorization-implementation.md

@@ -1,160 +0,0 @@
-# Smart Categorization Implementation - Complete Summary
-
-## ✅ What Was Done
-
-### 1. **Intelligent Auto-Categorization Script**
-Created [`tools/scripts/auto_categorize_skills.py`](../../tools/scripts/auto_categorize_skills.py) that:
-- Analyzes skill names and descriptions
-- Matches against keyword libraries that seeded the current generated category metadata
-- Automatically assigns meaningful categories
-- Removes "uncategorized" bulk assignment
-
-**Historical initial-run result:**
-- ✅ 776 skills auto-categorized
-- ✅ 46 already had categories preserved
-- ✅ 124 remained uncategorized at the time of that run
-
-For current counts, use `skills_index.json`; the active repository has grown beyond this historical snapshot.
-
-### 2. **Category Distribution**
-
-**Before:**
-```
-uncategorized: 926 (98%)
-game-development: 10
-libreoffice: 5
-security: 4
-```
-
-**After:**
-```
-Generated category metadata is now derived from the current skills_index.json.
-Do not preserve these historical counts in user-facing docs.
-```
-
-### 3. **Updated Index Generation**
-Modified [`tools/scripts/generate_index.py`](../../tools/scripts/generate_index.py):
-- **Frontmatter categories now take priority**
-- Falls back to folder structure if needed
-- Generates clean, organized skills_index.json
-- Exported to apps/web-app/public/skills.json
-
-### 4. **Improved Web App Filter**
-
-**Home Page Changes:**
-- ✅ Categories sorted by skill count (most first)
-- ✅ "Uncategorized" moved to bottom
-- ✅ Each shows counts computed from the generated index
-- ✅ Much easier to navigate
-
-**Updated Code:**
-- [`apps/web-app/src/pages/Home.tsx`](../../apps/web-app/src/pages/Home.tsx) - Smart category sorting
-- Sorts categories by count using categoryStats
-- Uncategorized always last
-- Displays generated counts in dropdown
-
-### 5. **Categorization Keywords** (seed buckets)
-
-| Category | Key Keywords |
-|----------|--------------|
-| **Backend** | nodejs, express, fastapi, django, server, api, database |
-| **Web Dev** | react, vue, angular, frontend, css, html, tailwind |
-| **Automation** | workflow, scripting, automation, robot, trigger |
-| **DevOps** | docker, kubernetes, ci/cd, deploy, container |
-| **AI/ML** | ai, machine learning, tensorflow, nlp, gpt, llm |
-| **Content** | markdown, documentation, content, writing |
-| **Database** | sql, postgres, mongodb, redis, orm |
-| **Testing** | test, jest, pytest, cypress, unit test |
-| **Security** | encryption, auth, oauth, jwt, vulnerability |
-| **Cloud** | aws, azure, gcp, serverless, lambda |
-| **Mobile** | react native, flutter, ios, android, swift |
-| **Game Dev** | game, unity, webgl, threejs, 3d, physics |
-| **Data Science** | pandas, numpy, analytics, statistics |
-
-### 6. **Documentation**
-Created [`smart-auto-categorization.md`](smart-auto-categorization.md) with:
-- How the system works
-- Using the script (`--dry-run` and apply modes)
-- Category reference
-- Customization guide
-- Troubleshooting
-
-## 🎯 The Result
-
-### No More Uncategorized Chaos
-- **Before**: the vast majority of skills were lumped into "uncategorized"
-- **After**: most skills are organized into meaningful buckets, with a much smaller review queue remaining
-
-### Better UX
-1. **Smarter Filtering**: Categories sorted by relevance
-2. **Visual Cues**: Shows current generated counts
-3. **Uncategorized Last**: Put bad options out of sight
-4. **Meaningful Groups**: Find skills by actual function
-
-### Example Workflow
-User wants to find database skills:
-1. Opens web app
-2. Sees filter dropdown with generated category counts
-3. Clicks the current database-related category
-4. Gets the current matching SQL/MongoDB/Postgres skills
-5. Done! 🎉
-
-## 🚀 Usage
-
-### Run Auto-Categorization
-```bash
-# Test first
-python tools/scripts/auto_categorize_skills.py --dry-run
-
-# Apply changes
-python tools/scripts/auto_categorize_skills.py
-
-# Regenerate index
-python tools/scripts/generate_index.py
-
-# Deploy to web app
-cp skills_index.json apps/web-app/public/skills.json
-```
-
-### For New Skills
-Add to frontmatter:
-```yaml
----
-name: my-skill
-description: "..."
-category: backend
-date_added: "2026-03-06"
----
-```
-
-## 📁 Files Changed
-
-### New Files
-- `tools/scripts/auto_categorize_skills.py` - Auto-categorization engine
-- `docs/maintainers/smart-auto-categorization.md` - Full documentation
-
-### Modified Files
-- `tools/scripts/generate_index.py` - Category priority logic
-- `apps/web-app/src/pages/Home.tsx` - Smart category sorting
-- `apps/web-app/public/skills.json` - Regenerated with categories
-
-## 📊 Quality Metrics
-
-- **Coverage**: 87% of skills in meaningful categories
-- **Accuracy**: Keyword-based matching with word boundaries
-- **Performance**: fast enough to categorize the full repository in a single local pass
-- **Maintainability**: Easily add keywords/categories for future growth
-
-## 🎁 Bonus Features
-
-1. **Dry-run mode**: See changes before applying
-2. **Weighted scoring**: Exact matches score 2x partial matches
-3. **Customizable keywords**: Easy to add more categories
-4. **Fallback logic**: folder → frontmatter → uncategorized
-5. **UTF-8 support**: Works on Windows/Mac/Linux
-
----
-
-**Status**: ✅ Complete and deployed to web app!
-
-The web app now has a clean, intelligent category filter instead of "uncategorized" chaos. 🚀

package/bundled-skills/docs/maintainers/ci-drift-fix.md

@@ -1,64 +0,0 @@
-# CI Drift Fix Guide
-
-**Problem**: The failing job is caused by tracked drift left behind after the canonical sync steps run on `main`.
-
-**Error**:
-
-```
-❌ Detected uncommitted changes produced by registry/readme/catalog scripts.
-```
-
-**Cause**:
-The canonical sync contract is broader than just the root registry files. Scripts such as `generate_index.py`, `update_readme.py`, `build-catalog.js`, `setup_web.js`, and plugin sync helpers can legitimately update:
-
-- `README.md`
-- `CATALOG.md`
-- `skills_index.json`
-- `data/*.json`
-- tracked web assets under `apps/web-app/public/`
-- generated plugin metadata and plugin-safe copies
-
-The workflow expects the repository to be clean after those sync steps finish. Any remaining tracked or unmanaged changes mean `main` is out of sync with what the generation pipeline actually produces.
-
-## Pull Requests vs Main
-
-- **Pull requests**: PRs are now **source-only**. Contributors should not commit derived registry artifacts (`CATALOG.md`, `skills_index.json`, `data/*.json`). CI blocks those direct edits and reports generated drift as an informational preview only.
-- **`main` pushes**: drift is still strict. The workflow may publish only managed drift through `automation/canonical-repo-state`; required CI must reproduce that PR as the exact expected Git tree before an immediate protected merge.
-
-## How to Fix on `main`
-
-1. Run the canonical maintainer sync locally:
-
-   ```bash
-   npm run sync:repo-state
-   ```
-
-2. Check whether anything is still dirty:
-
-   ```bash
-   git status
-   git diff
-   ```
-
-3. If the sync produced only canonical/generated changes, open a source-free PR rather than pushing to protected `main`. Prefer the generated-files contract instead of a hand-maintained file list:
-
-   ```bash
-   node tools/scripts/generated_files.js --include-mixed
-   git add $(node tools/scripts/generated_files.js --include-mixed)
-   git switch -c chore/canonical-artifact-repair
-   git commit -m "chore: sync canonical artifacts"
-   git push -u origin chore/canonical-artifact-repair
-   gh pr create --base main --fill
-   ```
-
-4. If `sync:repo-state` leaves unrelated or unmanaged drift, stop and inspect it. The bot is only allowed to publish the canonical/generated subset; anything else must fail instead of being silently included.
-
-## Maintainer guidance for PRs
-
-- Validate the source change, not the absence of committed generated artifacts.
-- If a contributor PR includes direct edits to `CATALOG.md`, `skills_index.json`, or `data/*.json`, ask them to drop those files from the PR or remove them while refreshing the branch.
-- If merge conflicts touch generated registry files, keep `main`'s version for those files and let `main` auto-sync the final generated artifact set after merge.
-- If CI on `main` detects drift, expect one `chore: synchronize canonical repository state` PR. Its special lane still requires managed-only paths and exact reproducibility; it is not a license to include arbitrary changes.
-
-**Summary**:
-Use generator drift as a hard failure only on `main`. On PRs, the contract is simpler: source-only changes are reviewed, generated output is previewed, and `main` produces the final canonical artifact set.

package/bundled-skills/docs/maintainers/date-tracking-implementation.md

@@ -1,66 +0,0 @@
-# Date Tracking Implementation Summary
-
-This note explains how `date_added` support fits into the current repository structure after the `apps/` and `tools/` refactor.
-
-## What Exists Today
-
-### Frontmatter support
-
-New skills can include a `date_added` field in `SKILL.md` frontmatter:
-
-```yaml
----
-name: skill-name
-description: "Description"
-date_added: "2026-03-06"
----
-```
-
-### Validator support
-
-The active validators understand `date_added`:
-
-- `tools/scripts/validate_skills.py` checks the `YYYY-MM-DD` format.
-- Supporting JS validation/test helpers are aware of the field where relevant.
-
-### Index and web app support
-
-- `tools/scripts/generate_index.py` exports `date_added` into `skills_index.json`.
-- `npm run app:setup` copies the generated index to `apps/web-app/public/skills.json`.
-- The web app can render the field anywhere the UI surfaces it.
-
-### Maintenance scripts
-
-- `tools/scripts/manage_skill_dates.py` manages skill dates.
-- `tools/scripts/generate_skills_report.py` produces JSON reports from current skill metadata.
-
-## Canonical Documentation
-
-The canonical docs for date tracking now live here:
-
-- [`skills-date-tracking.md`](skills-date-tracking.md)
-- [`../contributors/skill-template.md`](../contributors/skill-template.md)
-- [`../contributors/skill-anatomy.md`](../contributors/skill-anatomy.md)
-
-Use those files as the source of truth instead of older root-level doc names.
-
-## Common Commands
-
-```bash
-# View current date coverage
-python tools/scripts/manage_skill_dates.py list
-
-# Add missing dates
-python tools/scripts/manage_skill_dates.py add-missing
-
-# Update one skill
-python tools/scripts/manage_skill_dates.py update skill-name 2026-03-06
-
-# Generate a report
-python tools/scripts/generate_skills_report.py --output reports/skills_report.json
-```
-
-## Notes
-
-- Repository-wide coverage can change over time as new community skills are added, so this document avoids hardcoding counts.
-- `date_added` is useful metadata, but the operational contributor gate remains `npm run validate`; strict validation is a separate hardening target for legacy cleanup.

package/bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.md

@@ -1,289 +0,0 @@
-# Full repository audit - 2026-05-23
-
-Status: complete
-
-This audit tracks the current deep pass over the repository for bugs, inconsistencies, drift, documentation issues, and release/process risks. The working tree was checked from `/Users/nicco/Projects/antigravity-awesome-skills` on `main`.
-
-Patch follow-up:
-
-- Resolved in follow-up patches: unsafe archive fallback extraction, Telegram Node vulnerable dependency stack, installer symlink target migration, stale web SEO counts/social card, stale web canonical URL docs, malformed WhatsApp HMAC signature handling, Telegram token-in-URL webhook guidance, `.disabled` web asset publishing, Junta TLS bypasses, legacy manifest verification drift, Telegram HTML escaping, Remotion chart typo, nested skill ID collision coverage, Chinese/localized docs staleness, path-aware internal markdown link repair, and deterministic link/glossary validation reports.
-- Still open after these patches: none from this audit report. The legacy strict skill-quality warnings remain tracked as explicit backlog debt behind `tools/config/audit-skills-strict-budget.json`.
-
-## Validation evidence
-
-Passed:
-
-- `npm run validate`
-- `npm run validate:strict`
-- `npm run validate:references`
-- `npm run plugin-compat:check`
-- `npm run check:warning-budget`
-- `npm run audit:skills`
-- `npm run audit:consistency`
-- `npm run audit:maintainer` reported version/count/warning/consistency clean, then exited non-zero because this audit report itself is an untracked changed file
-- `npm run check:stale-claims`
-- `npm run bundles:check`
-- `npm run check:readme-credits`
-- `npm run security:docs`
-- `npm test`
-- `npm run test:local`
-- `npm run pr:preflight`
-- `npm run app:test`
-- `npm run app:test:coverage`
-- `npm run app:build`
-- `cd apps/web-app && npm run lint`
-- `cd apps/web-app && npm run verify:seo`
-- `npm audit --audit-level=high --omit=dev`
-- `npm audit --audit-level=moderate`
-- `cd apps/web-app && npm audit --audit-level=moderate`
-- `cd data && npm audit --audit-level=moderate`
-- `cd skills/loki-mode/examples/todo-app-generated/backend && npm audit --audit-level=moderate`
-- `cd skills/loki-mode/examples/todo-app-generated/frontend && npm audit --audit-level=moderate`
-- `cd skills/loki-mode/examples/todo-app-generated/backend && npm run build`
-- `cd skills/loki-mode/examples/todo-app-generated/frontend && npm run build`
-- Temp-copy `npm run build` for `skills/telegram/assets/boilerplate/nodejs`
-- Temp-copy `npm run build` for `skills/whatsapp-cloud-api/assets/boilerplate/nodejs`
-- Temp-copy `npm audit --audit-level=moderate` for `skills/whatsapp-cloud-api/assets/boilerplate/nodejs`
-- `npm pack --dry-run --json`
-- `bash scripts/validate-links.sh`
-- `python3 -m py_compile` equivalent pass over tracked Python sources, excluding generated mirrors/output
-- `bash -n` pass over tracked shell scripts, excluding generated mirrors/output
-- `node --check` over tracked JavaScript/CommonJS/ESM source files, excluding generated web output and plugin mirrors
-- JSON/JSONL parse over tracked JSON-like files
-- Ruby/Psych YAML parse over `.github/workflows/*.yml`, discussion templates, and issue templates
-- Ruby/Psych YAML parse over all tracked `*.yml` and `*.yaml`
-- Python XML parser over tracked XML/XSD/SVG files
-- `actionlint v1.7.12` run from `/tmp` over `.github/workflows/*.yml`
-- Global frontmatter parse over all tracked `*SKILL.md` files
-- Full-plugin and bundle-plugin file drift checks against canonical `skills/` sources
-- Plugin manifest parse/check over `.codex-plugin/plugin.json` and `.claude-plugin/plugin.json`
-- Canonical `skills_index.json` ID/path duplicate check
-- Targeted typo/refuso scan for common English misspellings across active repo sources, excluding generated output and plugin mirrors
-- Tracked temporary/bytecode artifact scan for `__pycache__`, `*.pyc`, `.DS_Store`, `*.tmp`, `*.bak`, and `*.orig`
-
-Observed counts:
-
-- Root visible skills: 1465
-- Tracked `*SKILL.md` files: 4559
-- Canonical indexed skills: 1465 files, 0 duplicate index IDs, 0 duplicate index paths
-- Canonical skill frontmatter: 0 duplicate names, 0 missing `risk`/`source`, 229 missing `date_added`
-- Nested indexed skills: 20 entries under second-level category paths such as `skills/game-development/2d-games`, `skills/libreoffice/base`, and `skills/security/aws-iam-best-practices`
-- Root `skills_index.json` and `data/skills_index.json`: equal
-- `audit:skills`: 1465 scanned, 0 errors, 740 warning-only
-- App coverage: 12 test files / 72 tests passed, 89.58% statements, 76.84% branches
-- Web app lint: passed with `--max-warnings 0`
-- Web app SEO verifier: passed, with the manifest coverage caveat noted below
-- Python syntax pass: 1077 files checked, 0 errors
-- Shell syntax pass: 61 scripts checked, 0 errors
-- JavaScript syntax pass: 74 source files checked, 0 errors
-- YAML parse pass: 81 files checked, 0 errors
-- XML/XSD/SVG parse pass: 342 files checked, 0 errors
-- Tracked symlinks: 7 checked, all targets exist
-- Plugin mirror `SKILL.md` files: 3094 matched canonical sources byte-for-byte, 0 drift
-- Global tracked skill frontmatter: 4559 `SKILL.md` files parsed, 0 frontmatter errors, 0 missing frontmatter, 0 missing `name`
-- Disabled source skills: 34 `skills/.disabled/*/SKILL.md` files present and included in the global frontmatter parse
-- Full plugin file drift: 11561 files checked in `plugins/antigravity-awesome-skills*`, 0 missing canonical files, 0 drift
-- Bundle plugin file drift: 950 files checked in `plugins/antigravity-bundle-*`, 0 missing canonical files, 0 drift
-- Plugin manifests: 76 manifests parsed, 0 missing name/version/reference errors
-- Maintainer audit: repository `sickn33/antigravity-awesome-skills`, version `11.5.0`, skills `1,465+`, warning budget `0/135`, consistency clean; tracked working tree clean, but the untracked audit report makes the full gate fail until added/removed
-- Stale-claims checker: no stale claims detected in active docs
-- Editorial bundles: manifest and generated doc are in sync
-- README credits check: no changed skill files detected
-- Telegram and WhatsApp TypeScript boilerplates build successfully in temp copies after `npm install --ignore-scripts`
-- WhatsApp TypeScript boilerplate temp-copy moderate audit: `0 vulnerabilities`
-
-Failed / issue-producing checks:
-
-- Temp-copy `npm audit --audit-level=moderate` for `skills/telegram/assets/boilerplate/nodejs`: 5 vulnerabilities, including 1 critical (`form-data <2.5.4`) through `node-telegram-bot-api -> @cypress/request-promise -> request`
-- `npm run audit:skills:strict`: 1465 scanned, 0 errors, but 740 warning-only skills / 865 warnings made the strict audit exit non-zero
-- Strict JSON parsing found 5 JSONC-style files with comments: `apps/web-app/tsconfig.json` plus the canonical and mirrored `typescript-expert/references/tsconfig-strict.json` files
-- Targeted typo scan found one confirmed source typo: `skills/remotion-best-practices/rules/charts.md:20`
-
-## Findings
-
-### High - archive refresh fallback extracts untrusted archives without path validation
-
-- File: `apps/web-app/refresh-skills-plugin.js`
-- Lines: `220-261`
-- Evidence: `syncWithArchive()` downloads GitHub tar/zip archives and extracts them with `tar -xzf`, `Expand-Archive`, or `unzip -o` directly into `update_temp`.
-- Risk: an archive containing path traversal entries or malicious symlinks can write outside the intended extraction root before the code checks for `antigravity-awesome-skills-main/skills`.
-- Current tests: `apps/web-app/src/__tests__/refresh-skills-plugin.security.test.js` covers loopback/auth and fast-forward behavior but does not cover archive extraction safety.
-- Suggested fix: replace shell extraction with a safe extraction helper that rejects absolute paths, `..` segments, unsafe symlinks, and post-extraction realpaths outside `update_temp`; add tar/zip regression tests.
-
-### High - Telegram Node boilerplate resolves a vulnerable request stack
-
-- File: `skills/telegram/assets/boilerplate/nodejs/package.json`
-- Lines: `11-21`
-- Evidence: a temp-copy install/audit of this package reported 5 vulnerabilities: critical `form-data <2.5.4`, moderate `request`, `qs`, `tough-cookie`, and `uuid`. `npm ls` traces the critical path through `node-telegram-bot-api@0.66.0 -> @cypress/request-promise@5.0.0 -> request@2.88.2 -> form-data@2.3.3`.
-- Risk: users following this boilerplate get a vulnerable dependency graph even though the boilerplate TypeScript itself compiles.
-- Current tests: the root dependency audits do not cover this package because it has no committed lockfile and is not part of the root workspace install.
-- Suggested fix: replace `node-telegram-bot-api` with a maintained Telegram client that does not depend on deprecated `request`, or commit a tested lockfile/override strategy that removes the vulnerable transitive versions.
-
-### Medium - full-repo install migration preserves target symlinks
-
-- File: `tools/bin/install.js`
-- Lines: `474-493`
-- Evidence: when `target.path/.git` exists and `target.path` itself is a symlink, the migration renames the symlink to a backup and then recreates the same symlink at `target.path`.
-- Risk: this diverges from the non-symlink migration path, where a fresh directory is created. Subsequent writes continue through the symlink target, which is surprising during a "skills-only layout" migration and weaker as a trust boundary.
-- Suggested fix: either reject symlinked full-repo migration targets with a clear error, or materialize a real directory at `target.path` after backing up the symlink.
-
-### Medium - prerendered web app SEO count is stale
-
-- File: `apps/web-app/scripts/prerender-routes.js`
-- Lines: `12`, `156-159`
-- Evidence: `HOME_CATALOG_COUNT` is `1273` and the generated title is hardcoded to `1,273+`, while the current registry has 1465 skills. The checked `apps/web-app/dist/index.html` contains `1,273+ installable AI skills catalog`.
-- Risk: search/social metadata undersells the catalog and drifts from README/CATALOG counts.
-- Suggested fix: derive the title count from the actual `skills.json` count used by prerendering, or update the constant/title together with generated assets.
-
-### Medium - source web metadata and social card are stale before prerendering
-
-- Files: `apps/web-app/index.html`, `apps/web-app/public/social-card.svg`
-- Evidence: `index.html` still contains `1,326+` in title, description, Open Graph, and Twitter metadata. `social-card.svg` also displays `1,326+ Agentic Skills` and describes a `1,326 plus` headline.
-- Risk: the built homepage is partially corrected by prerendering, but source metadata, fallback HTML, and social preview assets remain stale and can leak into previews or static hosting paths.
-- Suggested fix: derive counts from the same generated registry source used by the app, or update these assets during the web asset sync step.
-
-### Medium - app environment docs name an unused canonical URL variable
-
-- File: `apps/web-app/README.md`
-- Line: `59`
-- Evidence: the README documents `VITE_SITE_URL`, but `apps/web-app/scripts/generate-sitemap.js` reads `SEO_SITE_URL || WEBSITE_BASE_URL` and `apps/web-app/scripts/prerender-routes.js` reads `SEO_SITE_URL`.
-- Risk: maintainers testing non-default hosts may set an environment variable that has no effect on sitemap/prerender canonical URLs.
-- Suggested fix: document `SEO_SITE_URL` and optionally `WEBSITE_BASE_URL`; remove or implement `VITE_SITE_URL`.
-
-### Medium - WhatsApp webhook HMAC validation throws on malformed signature length
-
-- File: `skills/whatsapp-cloud-api/assets/boilerplate/nodejs/src/webhook-handler.ts`
-- Lines: `38-41`
-- Evidence: `crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))` is called without first checking that the two buffers have the same byte length. A direct Node check with a short signature throws `RangeError: Input buffers must have the same byte length`.
-- Risk: malformed `x-hub-signature-256` headers can turn an invalid webhook request into an exception/500 path instead of a clean `401`, creating avoidable error noise and a small DoS surface.
-- Suggested fix: validate the `sha256=<64 hex chars>` shape before comparison, or compare only after checking equal buffer lengths; return `401` for malformed signatures.
-
-### Medium - Telegram webhook URL embeds the bot token
-
-- File: `skills/telegram/assets/boilerplate/nodejs/src/bot-client.ts`
-- Lines: `24-45`
-- Evidence: the Express route and registered webhook URL both use `/webhook/${this.token}` while Telegram already supports `secret_token`.
-- Risk: bot tokens placed in URL paths are likely to appear in reverse-proxy logs, request logs, telemetry, browser history, and webhook provider dashboards. The optional secret header loses much of its value if the bearer token itself is the path secret.
-- Suggested fix: use a random non-secret route ID or fixed `/webhook` route plus `x-telegram-bot-api-secret-token`; never include the bot token in URLs.
-
-### Medium - strict skill audit is not clean even though standard gates pass
-
-Resolved in follow-up patch: `npm run audit:skills:strict` now enforces a versioned warning budget in `tools/config/audit-skills-strict-budget.json`, with explicit limits for total warnings, warning-only skills, and the top strict finding codes. The current legacy baseline is documented and the command fails on errors or warning regressions above that budget.
-
-- Command: `npm run audit:skills:strict`
-- Evidence: strict mode scanned 1465 skills and found 0 errors, but still exited non-zero because 740 skills are warning-only with 865 total warnings. Top findings were `risk_suggestion` (1013), `missing_examples` (387), and `skill_too_long` (193).
-- Risk: regular validation and warning-budget gates can look clean while the stricter skill-quality bar is materially unmet.
-- Suggested fix: either wire a consciously scoped subset of strict findings into CI/release gating, or document strict mode as an advisory backlog with explicit thresholds and owners.
-
-### Medium - web asset setup publishes disabled skills as static files
-
-- File: `tools/scripts/setup_web.js`
-- Lines: `70-80`
-- Evidence: `app:setup` copies the entire `skills/` directory into `apps/web-app/public/skills` without excluding dot directories. Current generated assets contain `apps/web-app/public/skills/.disabled` and `apps/web-app/dist/skills/.disabled`, each around 17 MiB, with 1294 files copied from 34 disabled skill directories. `skills_index.json` correctly excludes `.disabled` and reports 0 disabled entries.
-- Risk: disabled skills are not shown in the catalog but are still shipped as static web assets and can be fetched directly by path, which conflicts with the validator/indexer semantics that hidden/disabled directories are excluded.
-- Suggested fix: make `copyFolderSync()` skip dot-prefixed directories, or explicitly skip `.disabled` when copying web assets; add a web setup test that asserts `public/skills/.disabled` is absent after `app:setup`.
-
-### Low - Junta scrapers bypass the shared TLS verification switch
-
-- Files: `skills/junta-leiloeiros/scripts/scraper/jucisrs.py`, `skills/junta-leiloeiros/scripts/scraper/jucesp.py`, `skills/junta-leiloeiros/scripts/scraper/jucema.py`
-- Lines: `jucisrs.py:178-182`, `jucisrs.py:223-229`, `jucisrs.py:245-257`, `jucesp.py:115-121`, `jucema.py:161-169`
-- Evidence: `base_scraper.py` provides `should_verify_tls()` and tests assert TLS verification is enabled by default, but these state-specific scrapers instantiate `httpx.AsyncClient(verify=False)` or Playwright with `ignore_https_errors=True` directly.
-- Risk: the test suite proves the shared base helper default, but not the actual transport behavior of these scraper implementations; network interception can still tamper with scraper input by default.
-- Suggested fix: replace direct `verify=False` / `ignore_https_errors=True` with `should_verify_tls()` in state-specific scrapers, and extend `test_junta_tls_security.py` to scan or monkeypatch concrete scraper clients.
-
-### Low - nested skill IDs lose their category namespace in generated routes
-
-- Files: `tools/scripts/generate_index.py`, `apps/web-app/src/pages/SkillDetail.tsx`, `apps/web-app/src/components/SkillCard.tsx`
-- Lines: `generate_index.py:879-887`, `SkillDetail.tsx:61-79`, `SkillCard.tsx:16`
-- Evidence: `generate_index.py` sets each skill `id` to `os.path.basename(root)` while keeping the full nested path separately. The current index has 20 nested skills, including `base => skills/libreoffice/base`, `templates => skills/app-builder/templates`, and `2d-games => skills/game-development/2d-games`. The web app routes to `/skill/${skill.id}` and resolves detail pages with `skills.find(s => s.id === id)`.
-- Risk: there are currently 0 duplicate IDs, so this is not breaking today. A future top-level `base`, another nested `base`, or similarly generic nested name would create an ambiguous route/star/canonical-ID collision because the public ID omits the category namespace.
-- Suggested fix: either generate route-safe IDs from the relative path for nested skills, or add a uniqueness test that fails when any future nested basename collides with another indexed skill.
-
-### Low - SEO verifier checks a legacy manifest filename, not the linked manifest
-
-- Files: `apps/web-app/index.html`, `apps/web-app/scripts/verify-seo-assets.js`, `.github/workflows/pages.yml`
-- Evidence: `index.html` links `%BASE_URL%site.webmanifest`, while `verify-seo-assets.js` and the Pages workflow check `dist/manifest.webmanifest`. Both files currently exist, so the gate passes, but it does not prove the linked manifest is present.
-- Risk: a future build could break `site.webmanifest` while the verifier still passes because `manifest.webmanifest` remains.
-- Suggested fix: make the verifier and Pages workflow check `site.webmanifest`, or explicitly verify every manifest referenced by `index.html`.
-
-### Low - Telegram HTML messages interpolate display names without escaping
-
-- File: `skills/telegram/assets/boilerplate/nodejs/src/handlers.ts`
-- Lines: `8-14`, `31-37`
-- Evidence: `/start` injects `msg.from?.first_name` into a message sent with `parse_mode: 'HTML'`; `/about` does the same with bot profile fields.
-- Risk: Telegram display names containing `<`, `>`, or `&` can break formatting, cause send failures, or create unintended markup in generated bot replies.
-- Suggested fix: HTML-escape interpolated values whenever `parse_mode: 'HTML'` is used, or switch these messages to plain text/Markdown with appropriate escaping.
-
-### Low - Chinese documentation is release/count stale
-
-- Files: `docs_zh-CN/README.md`, `docs_zh-CN/users/getting-started.md`, `docs_zh-CN/final-validation-report.md`
-- Evidence: English docs and package metadata are at `11.5.0` / `1465`, while `docs_zh-CN/README.md` is synced to `10.7.0` / `1436`, contains an internal mention of version `8.10.0`, and `docs_zh-CN/users/getting-started.md` still says `V10.7.0`. `docs_zh-CN/final-validation-report.md` is also for `V8.10.0`.
-- Risk: localized entry points give outdated release and catalog information.
-- Suggested fix: either refresh translated docs after canonical English updates or mark old translation reports as historical snapshots so they are not read as current documentation.
-
-### Low - internal markdown links are broken in integration and localized docs
-
-- Files: `docs/integrations/jetski-gemini-loader/README.md`, `docs_zh-CN/README.md`, `docs/vietnamese/*.vi.md`, `docs_zh-CN/integrations/jetski-gemini-loader/README.md`
-- Evidence: a relative-path-aware local scan over `README.md`, `docs/`, and `docs_zh-CN/` found 105 broken internal links. Confirmed examples:
-  - `docs/integrations/jetski-gemini-loader/README.md` links to `../../docs/integrations/jetski-cortex.md`, which resolves to nonexistent `docs/docs/integrations/jetski-cortex.md`; the real target is `docs/integrations/jetski-cortex.md`.
-  - `docs_zh-CN/README.md` links to paths such as `docs/users/bundles.md`, which resolve under `docs_zh-CN/docs/...` instead of the repo root.
-- Risk: GitHub users following localized or integration docs hit dead links even though the current `validate:references` gate passes.
-- Suggested fix: add a path-aware markdown link checker to CI, then repair localized relative paths and the Jetski integration link.
-
-### Low - Remotion chart rule has a visible typo
-
-- File: `skills/remotion-best-practices/rules/charts.md`
-- Line: `20`
-- Evidence: the sentence reads `See Bar Chart Example for a basic example implmentation.`
-- Risk: low editorial quality issue in a user-facing skill rule.
-- Suggested fix: change `implmentation` to `implementation`.
-
-### Low - link validation script writes a stale, machine-specific translated report
-
-- Files: `scripts/validate-links.sh`, `docs_zh-CN/link-validation-report.txt`
-- Evidence: `scripts/validate-links.sh` writes `docs_zh-CN/link-validation-report.txt` with a timestamp and absolute local paths. The script labels this as a translated report but scans `docs/`, not `docs_zh-CN/`, and resolves internal links by basename only. The script itself notes that links such as `../../CATALOG.md` can be false positives.
-- Risk: rerunning the script creates non-portable tracked drift and produces a report that can mix real broken links with known false positives.
-- Suggested fix: either make the report deterministic and unambiguous, or stop tracking it. Resolve links relative to each source file and run separate checks for canonical docs and translated docs.
-
-### Low - deliberate pipe-to-shell examples remain allowlisted
-
-Resolved in follow-up patch: executable `curl|bash`, `curl|sh`, and `irm|iex` install examples in canonical skill sources were replaced with package-manager or download-inspect-execute flows, and obsolete pipe-to-shell allowlists were removed. The remaining `security-allowlist` comments cover non-pipe rule families or sandbox notes.
-
-- Files include `skills/bun-development/SKILL.md`, `skills/linkerd-patterns/SKILL.md`, `skills/cloud-penetration-testing/SKILL.md`, `skills/varlock/SKILL.md`, `skills/evolution/SKILL.md`, and plugin mirrors.
-- Evidence: `npm run security:docs` passes because these examples are allowlisted, but the repo still contains executable `curl|bash`, `curl|sh`, and `irm|iex` examples.
-- Risk: this is accepted by current policy, but remains risky guidance for automated agents.
-- Suggested fix: where practical, replace executable pipe-to-shell examples with package-manager or checksum-verified alternatives; keep allowlists only where no safe practical alternative exists.
-
-### Low - documentation examples use realistic-looking secret placeholders
-
-Resolved in follow-up patch: canonical examples now use `<AWS_ACCESS_KEY_ID>`, `<AWS_SECRET_ACCESS_KEY>`, and `<BASE64_PRIVATE_KEY>`, and `npm run security:docs` blocks those realistic placeholder patterns from returning.
-
-- Files include `skills/comfyui-gateway/references/integration.md`, `skills/security/aws-iam-best-practices/SKILL.md`, `skills/k8s-manifest-generator/resources/implementation-playbook.md`, and plugin mirrors.
-- Evidence: secret-pattern scanning found `AKIAIOSFODNN7EXAMPLE`, `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`, and `-----BEGIN PRIVATE KEY-----` examples. These are not confirmed live secrets: the AWS values are standard examples and the private key block is an ellipsis placeholder.
-- Risk: realistic secret-looking examples can create noisy secret-scan alerts and make it harder to distinguish documentation placeholders from real leaks.
-- Suggested fix: replace realistic credential examples with unmistakable placeholders such as `<AWS_ACCESS_KEY_ID>`, `<AWS_SECRET_ACCESS_KEY>`, and `<BASE64_PRIVATE_KEY>`.
-
-## Non-findings / bounded checks
-
-- The apparent `--- ` frontmatter prefix in eight skills is accepted by the repo parser (`^---\s*\n`) and those skills are indexed, so this is not currently a validator bug.
-- Duplicate names under `skills/.disabled` are intentionally skipped by validator/index generation.
-- Root npm production audit reported `0 vulnerabilities`.
-- Root, web app, and data package moderate audits reported `0 vulnerabilities`.
-- Loki todo-app frontend and backend moderate audits reported `0 vulnerabilities`.
-- Loki todo-app frontend and backend builds completed successfully.
-- Telegram and WhatsApp Node boilerplates compile successfully when installed in temp copies.
-- WhatsApp Node boilerplate moderate audit reported `0 vulnerabilities` in a temp copy.
-- Python syntax checking found 0 errors across 1077 source files.
-- Shell syntax checking found 0 errors across 61 shell scripts.
-- JavaScript syntax checking found 0 errors across 74 source files.
-- YAML and XML-family parse checks found 0 syntax errors in tracked files.
-- The 7 tracked symlinks all resolve to in-repo targets.
-- The strict JSON parse failures are JSONC/commented config files rather than malformed runtime JSON; TypeScript accepts `tsconfig.json` comments, and the commented `tsconfig-strict.json` is a reference artifact mirrored byte-for-byte.
-- Plugin mirror skill files are byte-for-byte synchronized with canonical `skills/` sources: 3094 matched, 0 drift.
-- Full-library plugin skill counts differ from the root visible catalog intentionally: the Codex plugin advertises `1,429 plugin-safe skills`, and omitted root skills are compatibility-filtered rather than missing files.
-- Duplicate `name` values across all tracked `SKILL.md` files are expected because canonical skills are copied into full plugins and bundle plugins; canonical-vs-plugin byte checks found no content drift.
-- All 76 plugin manifests parsed with required identity/version fields present.
-- `npm run audit:maintainer` did not reveal a repo health issue beyond the intentional untracked audit report; `git status --porcelain --untracked-files=no` was clean.
-- `npm pack --dry-run --json` produced the expected installer-only package contents: `LICENSE`, `README.md`, `package.json`, `tools/bin/install.js`, and `tools/lib/*`.
-- No tracked temporary/bytecode/macOS artifact files were found for `__pycache__`, `*.pyc`, `*.pyo`, `.DS_Store`, `*.tmp`, `*.bak`, or `*.orig`.
-- The targeted common-typo scan produced two `Teh` matches that are a person's surname in the Geoffrey Hinton skill, not typos.

package/bundled-skills/docs/maintainers/legacy-redirect-bridge.md

@@ -1,46 +0,0 @@
-# Legacy Redirect Bridge
-
-The compatibility site at `https://sickn33.github.io/antigravity-awesome-skills/` is published from the separate `sickn33/sickn33.github.io` repository. It preserves old indexed URLs while the canonical site lives at `https://sickn33.github.io/agentic-awesome-skills/`.
-
-## Managed deployment surface
-
-Only these paths belong to the redirect generator:
-
-- `.nojekyll`
-- `redirect-manifest.json`
-- `antigravity-awesome-skills/**`
-
-The target repository's `README.md` and `.github/**` automation are deliberately outside that managed set.
-
-Generate a fresh bridge from the current catalog:
-
-```bash
-npm run pages:redirect-bridge -- --output /new/output/directory
-```
-
-The generator keeps the curated sitemap route count locked while deriving the skill count from `skills_index.json`. It also preserves the legacy Google verification file and the Bing verification meta tag on the legacy root page.
-
-Manifest schema version `3` records source-repository provenance, redirect coverage, and webmaster-verification evidence for automation consumers.
-
-Verify a checked-out target repository byte-for-byte:
-
-```bash
-npm run pages:redirect-verify -- --deployment-root /path/to/sickn33.github.io
-```
-
-Add a bounded live probe after deployment:
-
-```bash
-npm run pages:redirect-verify -- \
-  --deployment-root /path/to/sickn33.github.io \
-  --live-root https://sickn33.github.io/ \
-  --live-mode sample
-```
-
-Use `--live-mode all` for a complete route-pair audit.
-
-## Publication contract
-
-The target repository owns the scheduled synchronization workflow. It checks out this repository at `main`, regenerates only the managed deployment surface, opens a fixed-branch PR when drift exists, dispatches the exact-head verifier, and merges only after the protected check succeeds. The same run explicitly requests and verifies the legacy Pages build so automation is not dependent on GitHub events suppressed for `GITHUB_TOKEN`-authored changes.
-
-Target `main` must remain protected with strict `legacy-bridge-verify`, administrator enforcement, pull requests required, and force pushes/deletions disabled.