opencode-skills-collection 4.0.7 → 4.0.9

package/bundled-skills/docs/users/claude-code-skills.md

@@ -17,7 +17,7 @@ Configure AAS Core for Claude Code, describe the task and constraints, let Claud
 - It lets Claude search the verified local catalog without loading the full library into context.
 - It preserves Claude's exact selection without using metadata as an eligibility gate.
 - It keeps MCP discovery read-only and CLI changes approval-gated.
-- It includes 1,969+ skills instead of a narrow single-domain starter pack.
+- It includes 1,987+ skills instead of a narrow single-domain starter pack.
 - It supports the standard `.claude/skills/` path and the Claude Code plugin marketplace flow.
 - It also ships generated bundle plugins so teams can install focused packs like `Essentials` or `Security Developer` from the marketplace metadata.
 - It includes onboarding docs, bundles, and workflows so new users do not need to guess where to begin.

package/bundled-skills/docs/users/faq.md

@@ -231,6 +231,8 @@ npx agentic-awesome-skills
 
 If you have an older clone created around the removed symlink workaround, reinstall into a fresh directory or rerun `npx agentic-awesome-skills`.
 
+For AAS Core MCP configuration, native Windows 10 and 11 with Node.js 22 are supported preview targets. A preview failure with `AAS_ADAPTER_WINDOWS_ACL_FAILED` refers to the Codex/Claude configuration directory or file checked with PowerShell `Get-Acl`, not the AAS cache and not `icacls`. Read the returned `path`, `phase`, `status`, and bounded diagnostic; correct the named configuration-path ownership problem, then rerun preview. Never add `--approve` before an approval digest is produced. See the [AAS Core Windows notes](aas-core.md#native-windows-and-codex).
+
 ### I hit a truncation or context crash loop on Windows. How do I recover?
 
 If Antigravity or a Jetski/Cortex-based host keeps reopening into:

package/bundled-skills/docs/users/gemini-cli-skills.md

@@ -12,7 +12,7 @@ Install into the Gemini skills path, then ask Gemini to apply one skill at a tim
 
 - It installs directly into the expected Gemini skills path.
 - It includes both core software engineering skills and deeper agent/LLM-oriented skills.
-- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,969+ files.
+- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,987+ files.
 - It is useful whether you want a broad internal skill library or a single repo to test many workflows quickly.
 
 ## Install Gemini CLI Skills

package/bundled-skills/docs/users/kiro-integration.md

@@ -18,7 +18,7 @@ Kiro is AWS's agentic AI IDE that combines:
 
 Kiro's agentic capabilities are enhanced by skills that provide:
 
-- **Domain expertise** across 1,969+ specialized areas
+- **Domain expertise** across 1,987+ specialized areas
 - **Best practices** from Anthropic, OpenAI, Google, Microsoft, and AWS
 - **Workflow automation** for common development tasks
 - **AWS-specific patterns** for serverless, infrastructure, and cloud architecture

package/bundled-skills/docs/users/usage.md

@@ -21,7 +21,7 @@ use compose_stack with a project profile, inspect the schema 2 manifest returned
 in memory, and do not apply it.
 ```
 
-The agent must use `search_skills` and `get_skill` across the complete catalog, build a capability-to-skill coverage map, continue searching while a primary capability remains uncovered, choose the exact IDs itself, call `compose_stack`, then check the in-memory proposal with `inspect_stack` before presenting it. All 1,968 current catalog skills remain individually searchable, readable, and selectable. A client or the CLI can persist the reviewed `aas-stack.json`; an audit-enabled flow can then call `export_selection_evidence`, validate it with `inspect_selection_evidence`, and atomically publish the manifest and separate `aas-selection-evidence.json` sidecar in an `artifact-dir`. Use `aas stack plan` to preview the exact operations without materializing skills or managed state in the target.
+The agent must use `search_skills` and `get_skill` across the complete catalog, build a capability-to-skill coverage map, continue searching while a primary capability remains uncovered, choose the exact IDs itself, call `compose_stack`, then check the in-memory proposal with `inspect_stack` before presenting it. Every current catalog skill remains individually searchable, readable, and selectable. A client or the CLI can persist the reviewed `aas-stack.json`; an audit-enabled flow can then call `export_selection_evidence`, validate it with `inspect_selection_evidence`, and atomically publish the manifest and separate `aas-selection-evidence.json` sidecar in an `artifact-dir`. Use `aas stack plan` to preview the exact operations without materializing skills or managed state in the target.
 
 Selection evidence contains the raw `search_skills` queries observed during the MCP session. Do not place secrets, credentials, private source text, or personal data in catalog queries.
 
@@ -39,7 +39,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of AAS Core
 
 When you ran `npx agentic-awesome-skills` or cloned the repository, you:
 
-✅ **Downloaded 1,969+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
+✅ **Downloaded 1,987+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
 ✅ **Made them available** to your AI assistant
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)
 
@@ -231,7 +231,7 @@ Let's actually use a skill right now. Follow these steps:
 
 ## Direct-install Step 5: Pick Skills Manually
 
-Don't try to use all 1,969+ skills at once. Here's a sensible approach:
+Don't try to use all 1,987+ skills at once. Here's a sensible approach:
 
 If you want a tool-specific starting point before choosing skills, use:
 
@@ -362,7 +362,7 @@ Usually no, but if your AI doesn't recognize a skill:
 
 ### "Can I load all skills into the model at once?"
 
-No. Even though you have 1,969+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 1,987+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
 
 The intended pattern is:
 

package/bundled-skills/docs/users/visual-guide.md

@@ -40,7 +40,7 @@ agentic-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 1,969+ skills live here
+├── 📁 skills/                          ← 1,987+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -53,7 +53,7 @@ agentic-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (1,969+ total)
+│   └── ... (1,987+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -106,7 +106,7 @@ agentic-awesome-skills/
 
 ```
                     ┌─────────────────────────┐
-                    │  1,969+ SKILLS          │
+                    │  1,987+ SKILLS          │
                     └────────────┬────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
@@ -207,7 +207,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (1,969+ total)                │
+│   └── ... (1,987+ total)                │
 └─────────────────────────────────────────┘
 ```
 

package/bundled-skills/docs/vietnamese/README.vi.md

@@ -4,7 +4,7 @@
 
 Codex hoặc Claude tự kiểm tra dự án; AAS không quét repository. Agent tìm kiếm catalog cục bộ đầy đủ theo thứ tự ổn định, tự đánh giá kết quả không có điểm số hay xếp hạng, rồi gửi `profile` cùng chính xác các ID đã chọn tới `compose_stack`. AAS Core ghi nhận lựa chọn trong `aas-stack.json` schema 2; CLI xác thực manifest và tạo kế hoạch preview bất biến trước khi thay đổi kỹ năng.
 
-> **Ranh giới phát hành:** Gói npm 14.6.0 đã phát hành trước AAS Core và không thể dùng để bootstrap Core. Các gói hỗ trợ Core bắt đầu từ dòng 15.x; chỉ dùng một phiên bản chính xác có release notes tuyên bố rõ rằng nó bao gồm Core. Luồng preview được hỗ trợ dừng sau khi xem kế hoạch; `apply` và `recover` vẫn mang tính thử nghiệm. [Tìm hiểu AAS Core](AAS_CORE.vi.md).
+> **Ranh giới phát hành:** Dòng 15.x hiện tại bao gồm AAS Core. Chỉ dùng một phiên bản chính xác có release notes tuyên bố rõ rằng nó bao gồm Core. Luồng preview được hỗ trợ dừng sau khi xem kế hoạch; `apply` và `recover` vẫn mang tính thử nghiệm. [Tìm hiểu AAS Core](AAS_CORE.vi.md).
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Claude Code](https://img.shields.io/badge/Claude%20Code-Anthropic-purple)](https://claude.ai)
@@ -15,7 +15,7 @@ Codex hoặc Claude tự kiểm tra dự án; AAS không quét repository. Agent
 [![OpenCode](https://img.shields.io/badge/OpenCode-CLI-gray)](https://github.com/opencode-ai/opencode)
 [![Antigravity](https://img.shields.io/badge/Antigravity-DeepMind-red)](https://github.com/sickn33/agentic-awesome-skills)
 
-Catalog gồm **1,968+ kỹ năng `SKILL.md`**, plugin chuyên biệt, bundle, workflow và installer trực tiếp vẫn rất quan trọng. Chúng là lớp nội dung, tuyển chọn, phân phối và tương thích xung quanh AAS Core, không phải sản phẩm chính cạnh tranh với Core:
+Các playbook `SKILL.md`, plugin chuyên biệt, bundle, workflow và installer trực tiếp vẫn rất quan trọng. Chúng là lớp nội dung, tuyển chọn, phân phối và tương thích xung quanh AAS Core, không phải sản phẩm chính cạnh tranh với Core:
 
 - 🟣 **Claude Code** (Anthropic CLI)
 - 🔵 **Gemini CLI** (Google DeepMind)
@@ -26,7 +26,7 @@ Catalog gồm **1,968+ kỹ năng `SKILL.md`**, plugin chuyên biệt, bundle, w
 - ⚪ **OpenCode** (Mã nguồn mở CLI)
 - 🟡 **Kiro CLI / IDE** và **AdaL CLI**
 
-**Ranh giới phiên bản:** Dòng 14.x là baseline phân phối kỹ năng trực tiếp và không chứa AAS Core; các gói hỗ trợ Core bắt đầu từ dòng 15.x. GitHub là nguồn chuẩn cho Core, catalog, plugin và tài liệu; website được host chỉ là bề mặt duyệt catalog và review trong trình duyệt, không phải control plane được host.
+**Ranh giới phiên bản:** Dòng 14.x là baseline phân phối kỹ năng trực tiếp và không chứa AAS Core; dòng 15.x hiện tại chứa Core. GitHub là nguồn chuẩn cho Core, catalog, plugin và tài liệu; website được host chỉ là bề mặt duyệt catalog và review trong trình duyệt, không phải control plane được host.
 
 ### 1. 🐣 Bối cảnh: Đây là gì?
 
@@ -59,7 +59,7 @@ Repository được tổ chức thành các lĩnh vực chuyên biệt để bi
 
 [Xem các Gói khởi đầu tại docs/vietnamese/BUNDLES.md](BUNDLES.vi.md) để tìm bộ công cụ hoàn hảo cho vai trò của bạn.
 
-## Duyệt hơn 1,967 Kỹ năng
+## Duyệt kỹ năng
 
 Chúng tôi đã chuyển danh sách đầy đủ các kỹ năng sang một danh mục riêng biệt để giữ cho file README này gọn gàng.
 

package/bundled-skills/hf-cloud-aws-context-discovery/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: hf-cloud-aws-context-discovery
+description: "Discover the effective local AWS profile, region, account, and caller identity before any AWS task without exposing credentials."
+risk: safe
+source: https://github.com/huggingface/skills/tree/main/skills/hf-cloud-aws-context-discovery
+source_repo: huggingface/skills
+source_type: official
+date_added: "2026-07-21"
+author: Hugging Face
+license: Apache-2.0
+license_source: https://github.com/huggingface/skills/blob/main/LICENSE
+tags: [hugging-face, aws, credentials, discovery, cloud]
+tools: [claude, codex, cursor]
+---
+
+# AWS Context Discovery
+
+Before doing any AWS work, inspect only masked AWS CLI metadata. Don't guess the region, and don't ask the user for things the CLI already answers. Never open or print `~/.aws/credentials`, credential-process output, secret environment variables, access keys, session tokens, or SSO token caches.
+
+## When to Use
+
+- Establish the effective AWS profile, region, account, and caller before AWS work.
+- Diagnose expired SSO sessions, missing profiles, or configuration overrides.
+- Provide verified context to later SageMaker planning and deployment skills.
+
+## What to discover
+
+Run these at the start of the AWS work and remember the results for the rest of the session.
+
+### 1. Active profile
+
+Use a profile the user explicitly named, otherwise use the profile identified by masked AWS CLI metadata. If the named profile is absent from `aws configure list-profiles`, surface that clearly.
+
+### 2. Region
+
+Resolution order — stop at the first one that produces a value:
+1. Region the user explicitly named in this conversation
+2. Region reported by `aws configure list --profile "$profile"`
+3. Region reported by `aws configure get region --profile "$profile"`
+5. Ask the user — but only after the first four have failed
+
+Do not fall back to `us-east-1` or any other hardcoded default.
+
+### 3. Credentials, account ID, caller ARN
+
+```bash
+aws sts get-caller-identity --profile "$profile" --region "$region"
+```
+
+Three purposes in one call: confirms credentials are valid (stop if not), returns the `Account` ID (needed for ARN construction), returns the `Arn` of the caller.
+
+### 4. Identify SSO / assumed-role principals
+
+The `Arn` field tells you what kind of principal this is. The pattern matters because it determines what IAM operations the caller can do.
+
+| ARN pattern | Type | IAM write capability |
+|---|---|---|
+| `arn:aws:iam::<acct>:user/<name>` | IAM user | Depends on attached policies |
+| `arn:aws:sts::<acct>:assumed-role/AWSReservedSSO_<...>/<email>` | **SSO assumed-role** | Typically **none** — can't create/modify IAM roles |
+| `arn:aws:sts::<acct>:assumed-role/<role>/<session>` | Regular assumed-role | Depends on the role |
+
+**If the caller is SSO**, surface this immediately before later skills hit `iam:CreateRole` and fail:
+
+> Heads up: you're authenticated via SSO (`AWSReservedSSO_<PermissionSet>_...`). SSO principals usually can't create IAM roles directly. If we need a SageMaker execution role, I'll look for an existing one first — if none exists, you'll need to ask whoever manages your AWS access to create one.
+
+This is the highest-leverage thing this skill does. Surfacing it now turns a confusing mid-deployment error into a five-second conversation.
+
+## Commands to run
+
+```bash
+# Profiles and masked effective metadata; never read credential files directly
+aws configure list-profiles
+aws configure list --profile "$profile"
+aws configure get region --profile "$profile"
+
+# Validate credentials and get identity
+aws sts get-caller-identity --profile "$profile" --region "$region"
+```
+
+`aws configure list` masks credential values and identifies their source. Use these metadata commands instead of parsing AWS files or inspecting secret-bearing environment variables. If the CLI cannot resolve a profile or region without exposing credentials, stop and ask the user for the non-secret profile or region value.
+
+## What to report back
+
+One or two lines, not a wall of text:
+
+> Working with profile `my-profile` in `eu-west-1`, account `123456789012`. You're authenticated via SSO, so we'll need to use an existing IAM role rather than create one.
+
+Don't ask the user to confirm the region you just read from their config — they configured it; that is the confirmation.
+
+If something is wrong (credentials expired, profile doesn't exist, no region anywhere), stop and surface the specific error before continuing.
+
+## Limitations
+
+- Discovery may reveal account IDs, role ARNs, or profile names; report only what the task needs and never expose secrets or session tokens.
+- STS identity checks require network access and valid credentials.
+- A valid identity does not imply permission to change resources.

package/bundled-skills/loki-mode/examples/todo-app-generated/backend/package-lock.json

@@ -336,9 +336,9 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.5",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
-      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "version": "1.20.6",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
+      "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",

package/bundled-skills/markstream-angular/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: markstream-angular
+description: "Integrate the alpha markstream-angular renderer into Angular 20+ applications with standalone components, signals, safe HTML defaults, and optional peer features."
+category: frontend
+risk: critical
+source: https://github.com/Simon-He95/markstream-vue/tree/main/.agents/skills/markstream-angular
+source_repo: Simon-He95/markstream-vue
+source_type: official
+date_added: "2026-07-21"
+author: Simon-He95
+tags: [angular, markdown, streaming, ai-chat, frontend]
+tools: [claude, cursor, gemini, codex]
+license: MIT
+license_source: https://github.com/Simon-He95/markstream-vue/blob/main/license
+---
+
+# Markstream Angular
+
+## Overview
+
+Add Markstream to Angular 20+ while preserving standalone-component patterns, signal-friendly bindings, safe rendering defaults, and explicit optional dependencies. Use `markstream-install` for framework selection; use this skill once Angular is confirmed.
+
+## When to Use
+
+Use for Angular-specific standalone imports, CSS, signals, custom tags or components, streaming state, and optional peers. Do not use below Angular 20 or when the application cannot accept an alpha renderer API.
+
+## Workflow
+
+Before changing dependencies or source files, inspect the existing package manager and project conventions, preview the intended edits, and obtain explicit user approval.
+
+1. Confirm Angular 20+ and record that `markstream-angular` is alpha.
+2. Install the package plus only requested peers. Import `markstream-angular/index.css`; add KaTeX CSS only for math.
+3. Import `MarkstreamAngularComponent` into the standalone component's `imports`.
+4. Start with `[content]` and `[smoothStreaming]="'auto'"`. Use `nodes` plus `final` only when another layer owns the AST.
+5. For live chat use `[fade]="false"` and opt into `[typewriter]="true"`. On completion set `[final]="true"`, disable pacing/cursor, and enable fade only if desired.
+6. Use `[customHtmlTags]` and `[customComponents]` only for trusted tag workflows.
+7. Keep `[htmlPolicy]="'safe'"` and Mermaid strict mode unless a narrowly scoped trusted legacy surface requires otherwise.
+8. Validate with the smallest Angular build, typecheck, or dev command.
+
+## Example
+
+```ts
+import { Component, signal } from '@angular/core'
+import { MarkstreamAngularComponent } from 'markstream-angular'
+import 'markstream-angular/index.css'
+
+@Component({
+  selector: 'app-answer',
+  standalone: true,
+  imports: [MarkstreamAngularComponent],
+  template: `
+    <markstream-angular
+      [content]="markdown()"
+      [final]="done()"
+      [fade]="done()"
+      [typewriter]="!done()"
+      [smoothStreaming]="done() ? false : 'auto'"
+      [htmlPolicy]="'safe'"
+    />
+  `,
+})
+export class AnswerComponent {
+  markdown = signal('# Streaming answer')
+  done = signal(false)
+}
+```
+
+## Limitations
+
+- Requires Angular 20+ and an alpha package.
+- Browser-heavy peers may need bundler or client-boundary work.
+- This skill does not design the host chat architecture or visual system.
+
+## Security & Safety Notes
+
+Review dependency changes before installation. Never broaden HTML or Mermaid trust settings for untrusted model output.

package/bundled-skills/markstream-custom-components/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: markstream-custom-components
+description: "Override Markstream node renderers and add trusted custom tags across Vue, React, Svelte, and Angular using scoped or renderer-local mappings."
+category: frontend
+risk: critical
+source: https://github.com/Simon-He95/markstream-vue/tree/main/.agents/skills/markstream-custom-components
+source_repo: Simon-He95/markstream-vue
+source_type: official
+date_added: "2026-07-21"
+author: Simon-He95
+tags: [markdown, components, vue, react, svelte, angular]
+tools: [claude, cursor, gemini, codex]
+license: MIT
+license_source: https://github.com/Simon-He95/markstream-vue/blob/main/license
+---
+
+# Markstream Custom Components
+
+## Overview
+
+Customize specific Markstream nodes or trusted custom tags without replacing the parser or leaking global renderer state. Read [references/patterns.md](references/patterns.md) first.
+
+## When to Use
+
+Use to replace built-ins such as `image`, `link`, `code_block`, `mermaid`, or `inline_code`; render trusted tags such as `thinking`; or scope overrides to one renderer or app. Use parser transforms only when token or AST reshaping is required.
+
+## Workflow
+
+Before changing dependencies or source files, inspect the existing package manager and project conventions, preview the intended edits, and obtain explicit user approval.
+
+1. Classify the change as a built-in override, trusted tag, or parser transform.
+2. Prefer scoped mappings. Vue, Vue 2, Svelte, and Angular can use `setCustomComponents(customId, mapping)`; Svelte and Angular can also pass renderer-local maps.
+3. In React, prefer `streamingComponents` for parser-backed nodes and `htmlComponents` for sanitized attributes plus children.
+4. Start with leaf nodes before containers that must preserve children.
+5. For trusted tag bodies containing Markdown, use a nested renderer with the same allowlist. Do not add a second smooth-streaming loop.
+6. Preserve node/loading props, identity keys, scope IDs, theme state, and preview-height estimates for async diagrams.
+7. Remove temporary scoped registrations on cleanup and validate repeated and nested tags.
+
+## Example
+
+```tsx
+import MarkdownRender, {
+  type NodeComponentProps,
+  setCustomComponents,
+} from 'markstream-react'
+import 'markstream-react/index.css'
+
+function ThinkingNode({ node }: NodeComponentProps<any>) {
+  return <details><summary>Thinking</summary>{node.content}</details>
+}
+
+setCustomComponents('assistant-panel', { thinking: ThinkingNode })
+
+export function Answer({ markdown }: { markdown: string }) {
+  return (
+    <MarkdownRender
+      content={markdown}
+      customId="assistant-panel"
+      customHtmlTags={['thinking']}
+      htmlPolicy="safe"
+    />
+  )
+}
+```
+
+## Limitations
+
+- Component overrides cannot reproduce arbitrary remark/rehype transforms.
+- Container overrides require careful child rendering and accessibility review.
+- Framework registration APIs are not interchangeable.
+
+## Security & Safety Notes
+
+Treat custom HTML-like tags as trusted input only. Keep safe HTML enabled and do not pass unsanitized attributes into host components.

package/bundled-skills/markstream-custom-components/references/patterns.md

@@ -0,0 +1,14 @@
+# Override Patterns
+
+| Key | Typical use |
+|---|---|
+| `image` | Lightboxes, captions, lazy loading |
+| `link` | Routing, analytics, tooltips |
+| `code_block` | Fenced code blocks |
+| `mermaid`, `d2`, `infographic` | One diagram renderer |
+| `inline_code` | Inline typography |
+| `heading`, `paragraph`, `list_item` | Containers preserving children |
+
+For Vue, Vue 2, Svelte, or Angular shared registration, allowlist the tag, register it under a scoped `customId`, and pass that scope to the renderer. Prefer renderer-local maps when sharing is unnecessary.
+
+For React, use `streamingComponents` for parser-backed tags and `htmlComponents` for sanitized HTML-style props. When a tag body contains Markdown, use a nested renderer with the same allowlist and no independent pacing.

package/bundled-skills/markstream-install/SKILL.md

@@ -2,7 +2,7 @@
 name: markstream-install
 description: "Install and configure Markstream streaming Markdown renderers for Vue, React, Svelte, Angular, Nuxt, Next.js, and Vue 2 applications."
 category: frontend
-risk: safe
+risk: critical
 source: https://github.com/Simon-He95/markstream-vue/tree/main/.agents/skills/markstream-install
 source_repo: Simon-He95/markstream-vue
 source_type: official
@@ -48,6 +48,8 @@ Do not select `markstream-vue` merely because the source repository has Vue in i
 
 ### 2. Install the smallest dependency set
 
+Before installing or changing source files, preview the exact dependency and code changes and obtain explicit user approval. Do not switch package managers or replace an existing renderer implicitly.
+
 Install exactly one framework package and preserve the repository's package manager. Add optional peers only when the requested UI uses their feature.
 
 Examples:

package/bundled-skills/markstream-migration/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: markstream-migration
+description: "Audit and migrate an existing Markdown renderer to Markstream while preserving custom renderers, security policy, streaming behavior, and explicit parity gaps."
+category: frontend
+risk: critical
+source: https://github.com/Simon-He95/markstream-vue/tree/main/.agents/skills/markstream-migration
+source_repo: Simon-He95/markstream-vue
+source_type: official
+date_added: "2026-07-21"
+author: Simon-He95
+tags: [markdown, migration, streaming, security, frontend]
+tools: [claude, cursor, gemini, codex]
+license: MIT
+license_source: https://github.com/Simon-He95/markstream-vue/blob/main/license
+---
+
+# Markstream Migration
+
+## Overview
+
+Replace an existing Markdown renderer without silently dropping transforms, custom components, URL policy, raw-HTML behavior, or streaming semantics. Read [references/adoption-checklist.md](references/adoption-checklist.md) first.
+
+## When to Use
+
+Use when replacing `react-markdown`, `markdown-it`, `marked`, or another renderer; migrating node renderers; or choosing between Markstream `content`, smooth streaming, and `nodes`.
+
+## Workflow
+
+Before changing dependencies or source files, inspect the existing package manager and project conventions, preview the intended edits, and obtain explicit user approval.
+
+1. Inventory renderer imports, call sites, plugins, HTML policy, URL transforms, allowlists, custom renderers, CSS, and tests.
+2. Classify the migration as direct, renderer-custom, plugin-heavy, or security-heavy.
+3. Install the framework package and explicit CSS. Preserve visible behavior before optional features.
+4. Map built-ins to scoped overrides; in React prefer renderer-local component maps.
+5. Use trusted custom tags only for trusted content and reserve parse transforms for irreducible token/AST requirements.
+6. Keep `content` with smooth streaming for ordinary token streams. Use `nodes` only for worker parsing, shared AST ownership, or structural transforms.
+7. Preserve safe HTML and strict Mermaid defaults; scope and document any trusted legacy exception.
+8. Run relevant builds and behavior tests. Report mappings, intentional differences, and unresolved review.
+
+## Example
+
+```tsx
+// Before:
+// import ReactMarkdown from 'react-markdown'
+// return <ReactMarkdown>{markdown}</ReactMarkdown>
+
+import MarkdownRender from 'markstream-react'
+import 'markstream-react/index.css'
+
+export function AssistantAnswer({
+  markdown,
+  isDone,
+}: {
+  markdown: string
+  isDone: boolean
+}) {
+  return (
+    <MarkdownRender
+      content={markdown}
+      final={isDone}
+      fade={isDone}
+      typewriter={!isDone}
+      smoothStreaming={isDone ? false : 'auto'}
+      htmlPolicy="safe"
+    />
+  )
+}
+```
+
+## Limitations
+
+- Markstream cannot reproduce every remark, rehype, or markdown-it plugin automatically.
+- Visual parity does not prove security or URL-policy parity.
+- Large migrations may require staged conversion.
+
+## Security & Safety Notes
+
+Do not weaken sanitization for screenshot parity. Review dependencies, raw HTML, URL transforms, and trust boundaries explicitly.

package/bundled-skills/markstream-migration/references/adoption-checklist.md

@@ -0,0 +1,10 @@
+# Adoption Checklist
+
+Search for `react-markdown`, `remarkPlugins`, `rehypePlugins`, `markdown-it`, `marked`, `rehypeRaw`, `skipHtml`, allow/deny lists, `urlTransform`, custom renderers, CSS, and tests.
+
+- `direct`: plain renderer swap
+- `renderer-custom`: custom components can become overrides
+- `plugin-heavy`: transform chains need manual mapping
+- `security-heavy`: HTML and URL policy need explicit review
+
+Swap the package first, preserve CSS order, prefer scoped mappings, and adopt `nodes` only when another layer owns parsing or structural updates.

package/bundled-skills/markstream-nuxt/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: markstream-nuxt
+description: "Integrate markstream-vue into Nuxt 3 or 4 with SSR-safe client boundaries, renderer modes, explicit CSS, and browser-only optional peers."
+category: frontend
+risk: critical
+source: https://github.com/Simon-He95/markstream-vue/tree/main/.agents/skills/markstream-nuxt
+source_repo: Simon-He95/markstream-vue
+source_type: official
+date_added: "2026-07-21"
+author: Simon-He95
+tags: [nuxt, vue, ssr, markdown, streaming]
+tools: [claude, cursor, gemini, codex]
+license: MIT
+license_source: https://github.com/Simon-He95/markstream-vue/blob/main/license
+---
+
+# Markstream Nuxt
+
+## Overview
+
+Integrate `markstream-vue` into Nuxt while keeping hydration, browser-only peers, workers, and streaming behavior on the correct side of SSR boundaries.
+
+## When to Use
+
+Use for Nuxt 3 or 4 pages, components, or plugins. Use `markstream-vue` for non-Nuxt Vue applications and `markstream-install` when the framework is not yet known.
+
+## Workflow
+
+Before changing dependencies or source files, inspect the existing package manager and project conventions, preview the intended edits, and obtain explicit user approval.
+
+1. Confirm Nuxt 3 or 4 and install only requested peers.
+2. Put browser-only peers behind `<ClientOnly>`, `.client` plugins, dynamic imports, or guarded initialization.
+3. Import `markstream-vue/index.css` explicitly from a client-safe shell or plugin.
+4. Start with `content`: `mode="chat"` for AI streams, `docs` for rich documents, and `minimal` for lightweight non-chat surfaces.
+5. Keep smooth streaming in `auto` mode for SSR; do not force `true` on first-screen server content.
+6. When a chat row completes, keep its mode stable, set `final`, disable pacing/cursor, and enable fade only if desired.
+7. Keep HTML safe and Mermaid strict. Put optional code, diagram, and worker runtimes behind client boundaries.
+8. Validate build/typecheck, hydration, and one incremental client update.
+
+## Example
+
+```vue
+<script setup lang="ts">
+import MarkdownRender from 'markstream-vue'
+import 'markstream-vue/index.css'
+
+defineProps<{ markdown: string; done: boolean }>()
+</script>
+
+<template>
+  <MarkdownRender
+    mode="chat"
+    :content="markdown"
+    :final="done"
+    :fade="done"
+    :typewriter="!done"
+    :smooth-streaming="done ? false : 'auto'"
+    html-policy="safe"
+  />
+</template>
+```
+
+## Limitations
+
+- Browser-only peers cannot run during SSR.
+- Hydration depends on correct host plugin/component boundaries.
+- This skill does not configure deployment adapters.
+
+## Security & Safety Notes
+
+Do not expose trusted HTML or loose Mermaid settings to untrusted model output. Review dependency and runtime-boundary changes.