opencode-skills-collection 4.1.14 → 4.1.16

package/bundled-skills/fact-check-x-unified/SKILL.md

@@ -6,11 +6,13 @@ source_repo: asi2030/fact-check-x
 source_type: official
 source: asi2030
 date_added: '2026-09-21'
-risk: unknown
+risk: critical
+compatibility: Requires Python 3, separately reviewed sibling skills and their runtime; online collection/search needs authorized accounts and data-sharing approval.
 ---
 ## When to Use
-- Use when this upstream workflow matches the user's stated goal.
-- Use when the task requires the procedures documented in this skill.
+- 用户需要比较一个或多个平台的回答、区分未核验草案与已核验结论，并保留来源、逐知识点裁决和可迁移报告。
+- 已有采集结果或准备好独立安装并审查的三个依赖技能；联网、账户配置和本机写入必须符合用户授权。
+- 中文是原始工作流的目标语言；用户指定其他语言时用其语言交互，保留数据契约中的字段名。
 
 # Fact-Check-X 统一入口
 
@@ -24,13 +26,15 @@ risk: unknown
 
 ## 依赖定位
 
-四个技能放在同一目录时可直接运行。也可设置：
+AAS 仅分发本编排技能的脚本与测试，**未分发** `llm-answer-reference-compare`、`fact-check-x-knowledge-compare`、`fact-check-x-authoritative-verify` 的采集器、渲染器和夹具。因此单独安装本技能不能运行完整流水线，也不能假称已经打开登录页面。
+
+依赖恢复：从 [已核对的官方来源](https://github.com/asi2030/fact-check-x/tree/0984307468e58113220215a2639392d6627eb8da) 取得四个完整技能及其依赖。先审查固定修订的来源、许可证、锁文件、浏览器与账户数据边界；不要由本技能静默下载或安装。单独安装的完整三个依赖目录可通过以下变量定位；自动配置组件使用相同的目录：
 
 ```bash
-export FACTCHECK_SKILLS_DIR="<四个技能的父目录>"
+export FACTCHECK_SKILLS_DIR="<已审查的完整上游分发包的 skills 绝对目录>"
 ```
 
-检查依赖：
+脚本路径相对于本技能安装目录；执行前进入该目录。先检查依赖（缺少可执行入口时明确失败，不以仅存在 SKILL.md 作为就绪证明）：
 
 ```bash
 python3 scripts/fact_check_x.py locate
@@ -56,11 +60,11 @@ python3 scripts/fact_check_x.py acknowledge-stage \
   --token <checkpoint.acknowledgement.token> --decision continue
 ```
 
-未确认时，下一阶段命令会直接失败。即使用户最初要求完整连续执行，也必须依次展示每个阶段产物并取得确认；不存在可绕过确认的自动推进模式。
+未确认时，下一阶段命令会直接失败。当前程序实现的是逐阶段确认模式；执行完整流程前说明这一约束。用户要求连续执行时不要假称已经支持自动模式，也不要伪造确认令牌。
 
 当前智能体读取 `<run>/comparison-task.json`，写入 `<run>/comparison-analysis.json`，再执行：
 
-`comparison-task.json` 是自包含的紧凑工作集。阶段确认后只允许“读取任务包一次、写入分析一次、执行验收一次”，最多三次工具调用；不得读取技能源码、契约或完整 `results.json` 探路，不得打印或转储完整任务包。`capturedText` 只是有界原文预览，完整正文由程序在验收时从 `results.json` 校验和重建。
+`comparison-task.json` 是自包含的紧凑工作集。阶段确认后只允许“读取任务包一次、写入分析一次、执行验收一次”，以紧凑任务包为主要输入，避免无必要的重复读取或完整转储。发生错误、歧义或契约问题时应读取必要的源码或证据定位原因；三次调用是上游效率建议，不得用它阻止正确性或安全检查。`capturedText` 只是有界原文预览，完整正文由程序在验收时从 `results.json` 校验和重建。
 
 拆解时，原子性同时约束知识点和各平台 `claim`。一个原句包含多个独立义务、条件、对象、数值或后果时必须拆点，每个 `claim` 只保留当前事实；平台独有的实质新增事实也要另起无锚点知识点，不能并入宽泛知识点后复用深知晓锚点免查。每个知识点同时标明 `claimType=fact|recommendation`：纯操作建议可标为 `recommendation`，不因缺少逐句脚标而判引用不忠实；建议中包含的制度事实、条件、数字或时效必须拆成独立 `fact`。
 
@@ -81,7 +85,7 @@ python3 scripts/fact_check_x.py search-authority --run-dir <run> --max-workers 1
 
 深知晓采集同时保留回答内逐句脚标和“知识专库”中的回答级来源；相同 URL 合并为 `inline_and_global`。回答级来源只有经当前知识点逐条语义匹配且原文可定位时才可支持该事实，不得整库继承。知识点已有深知晓/深知晓（深度溯源）本次回答所附的官方材料，或其他平台本次回答所附的 `gov.cn` 材料，且原文确实支持当前事实主张时，直接复用为官方证据，不调用可信搜索。纯操作建议同样不调用可信搜索；除此之外，已有材料不足以裁决的事实知识点才是非免查知识点。
 
-若存在非免查知识点但本机尚无可信搜索配置，`prepare-authority` 和 `search-authority` 会返回 `status=configuration_required`、`userPrompt` 与 `configuration.command` 并以非零状态退出。调用方先展示登录提示，再前台执行该命令。用户只需在自动打开的深知 MaaS 页面完成登录；组件会自动复用已有完整 Key，没有时创建 `Fact-Check-X` 专用 Key，验证后保存到 `~/.fact-check-x/credentials/trusted-search-key`。Codex、Claude Code、WorkBuddy 等载体共享该配置，检测到已有 Key 时直接跳过登录。配置成功后调用方自动重跑 `prepare-authority`，不得要求用户复制 Key、编辑 shell 配置、回复“已配置”，也不得改用深知晓来源或普通搜索绕过。
+若存在非免查知识点但本机尚无可信搜索配置，`prepare-authority` 和 `search-authority` 会返回 `status=configuration_required`、`userPrompt` 与 `configuration.command` 并以非零状态退出。调用方先展示登录提示和外部提供方、账户/Key 创建、可能费用、发送数据范围及本机保存位置，获得授权后再前台执行该命令。不得把“配置缺失”当成自动创建账户凭据或联网的授权。用户只需在自动打开的深知 MaaS 页面完成登录；组件会自动复用已有完整 Key，没有时创建 `Fact-Check-X` 专用 Key，验证后保存到 `~/.fact-check-x/credentials/trusted-search-key`。Codex、Claude Code、WorkBuddy 等载体共享该配置，检测到已有 Key 时直接跳过登录。配置成功后调用方自动重跑 `prepare-authority`，不得要求用户复制 Key、编辑 shell 配置、回复“已配置”，也不得改用深知晓来源或普通搜索绕过。
 
 只有可信搜索返回 401/403 时才把现有 Key 视为失效并进入自动配置。超时、断网或服务异常保留现有配置并自动重试；重试后仍失败则停留在搜索阶段返回技术错误，不要求用户重新登录，也不转成人工事实复核。
 
@@ -158,21 +162,27 @@ python3 scripts/fact_check_x.py deliver --results <results.json> --run-dir <run>
 ## 交付门禁
 
 ```bash
+# 本地边界检查可离线执行；完整冒烟测试需要上面的三个已审查依赖与夹具。
 python3 tests/smoke_test.py
-python3 "${CODEX_HOME:-$HOME/.codex}/skills/.system/skill-creator/scripts/quick_validate.py" .
+# quick_validate.py 属于可选宿主工具，未随 AAS 分发；仅在当前宿主确实存在且已审查时使用。
 ```
 
-完整标准见 [验收标准]。
+完整标准见 [验收标准](references/acceptance-criteria.md) 和 [编排契约](references/contracts.md)。
 
 
 ## Examples
 
 ```text
-User: Apply this skill to my current task.
-Assistant: Follow the workflow in this skill, cite limitations, and ask before risky steps.
+用户：比较两份已有回答，区分来源支持、事实核验和证据不足，先生成未核验草案。
+助手：确认输入/私有输出目录，检查依赖，准备第一阶段报告；不自动登录云服务、创建 Key 或把证据不足标为误导。
 ```
 
 ## Limitations
 
-- Imported upstream skill; verify credentials, permissions, and safety boundaries before execution.
-- Does not replace environment-specific validation, testing, or maintainer review.
+- 本技能会写入/清理运行目录，调用外部子技能，配置流程可能创建和保存账户 Key；仅使用专用私有运行目录和已授权账户。`risk: critical` 描述这些能力，不是对内容质量或服务安全的评分。
+- 不自动安装所有依赖；安装前审查固定来源、锁文件和生命周期脚本，`prepare-runtime` 默认禁用 npm 生命周期脚本。
+- 外部搜索验证会发送请求并可能消耗配额；仅在获授权后执行，禁止向未知地址或重定向传送 Key。
+- JSON 摘要门禁防止意外或后续改动，不构成抗恶意本机攻击的签名；运行目录、输入和子技能必须可信。不得在收到第三方产物后直接执行子技能。
+- 官方域名不是自动正确性的证明；已获得原文必须支持当前原子主张，技术采集失败保留证据不足。
+- 完整 smoke、多平台、阶段门禁测试依赖完整上游分发包；AAS 未包含这些外部夹具，缺失时应说明先决条件，不伪造通过。
+- 本地测试/夹具不能证明实际登录、提供方调用或真实平台端到端行为。

package/bundled-skills/fact-check-x-unified/UPSTREAM-NOTICE.md

@@ -0,0 +1,9 @@
+# Fact-Check-X attribution and AAS changes
+
+This catalog skill originates from [asi2030/fact-check-x](https://github.com/asi2030/fact-check-x) (repository ID `1315957467`), licensed Apache-2.0. The original AAS import is commit `1bf639b0d18d73a764cb12c5eb5e10ef02b1c04e`. Original upstream notices and authorship remain applicable.
+
+For dependency recovery, this revision inspected the immutable upstream reference [0984307468e58113220215a2639392d6627eb8da](https://github.com/asi2030/fact-check-x/tree/0984307468e58113220215a2639392d6627eb8da) and its [installation documentation](https://github.com/asi2030/fact-check-x/blob/0984307468e58113220215a2639392d6627eb8da/README.en.md). This is a recovery reference, not a claim that the older imported files equal that revision or that its full runtime was imported/tested. The three sibling engines and their fixtures remain external prerequisites; no automatic installation, cloud login or credential creation occurred during review.
+
+AAS modifications: concrete Chinese-language triggers and examples; factual dependency/runtime boundaries; account/data/cost authorization guidance; declared critical risk based on executable sibling dispatch, local write/cleanup and account credential operations; request-ID/path boundaries; capture digest preservation; npm lifecycle scripts disabled during preparation; bounded credential reads and response sizes; HTTPS/redirect boundaries; onboarding locator honors the explicit reviewed dependency directory; technical failure remains insufficient evidence. Relevant existing assertions were updated to the corrected behavior, and new synthetic local negative regressions exercise actual reviewed functions.
+
+The bounded credential reader rejects final-component links and protects Unix permissions. It assumes a trusted private configuration directory and does not claim resistance to malicious concurrent parent-directory mutation or equivalent Windows ACL verification. HTTP transport exists only for literal loopback test fixtures. JSON digest gates are integrity checks, not signatures against a malicious local user.

package/bundled-skills/fact-check-x-unified/scripts/fact_check_x.py

@@ -241,7 +241,7 @@ def locate_skills() -> dict[str, Path]:
     for key, directory in DEPENDENCIES.items():
         for parent in skill_candidates():
             candidate = parent / directory
-            if (candidate / "SKILL.md").exists() or (candidate / DEPENDENCY_ENTRYPOINTS[key]).exists():
+            if (candidate / DEPENDENCY_ENTRYPOINTS[key]).is_file():
                 found[key] = candidate
                 break
         if key not in found:
@@ -319,7 +319,7 @@ def prepare_runtime(skills: dict[str, Path]) -> dict:
     environment["PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD"] = "1"
     try:
         install = subprocess.run(
-            [npm, "ci", "--omit=dev", "--no-audit", "--no-fund"],
+            [npm, "ci", "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund"],
             cwd=tool_root,
             text=True,
             capture_output=True,
@@ -383,6 +383,7 @@ def trusted_search_configuration() -> dict:
         "interaction": "browser_login_only",
         "requiresChatSecret": False,
         "autoResume": True,
+        "requiresAccountAndDataApproval": True,
         "sharedAcrossCarriers": True,
     }
 
@@ -550,7 +551,8 @@ def require_comparison_provenance(run_dir: Path) -> dict:
 
 def expected_request_ids(manifest: dict) -> list[str]:
     ids = [str(entry.get("requestId") or "") for entry in manifest.get("requests") or []]
-    if not ids or any(not value for value in ids) or len(ids) != len(set(ids)):
+    if (not ids or len(ids) != len(set(ids))
+        or any(not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_-]{0,63}", value) for value in ids)):
         raise PipelineError("权威核验请求清单包含空 ID 或重复 ID")
     return ids
 
@@ -641,7 +643,7 @@ def render_run_notices(notices) -> str:
         "<strong>本次运行存在未完成的技术动作</strong>"
         f"<ul>{items}</ul>"
         '<span class="fcx-run-notice-tail">判定口径不因此改变；'
-        "以上项目可能影响相关结论的证据完整性，受影响且无法核验的主张按“疑似误导”呈现。</span></div>"
+        "以上项目可能影响相关结论的证据完整性，受影响且无法核验的主张保持“证据不足”，不得从技术失败推定误导。</span></div>"
     )
 
 
@@ -897,7 +899,8 @@ def complete_comparison(args: argparse.Namespace, skills: dict[str, Path]) -> di
     run_dir = require_run(args.run_dir)
     require_stage_acknowledged(run_dir, "capture")
     results_path = Path(args.results).resolve()
-    results = validate_and_gate_capture(run_dir, results_path)
+    require_capture_gate(run_dir, results_path)
+    results = validate_capture_results(results_path)
     sync_capture_evidence(run_dir, results_path, results)
     analysis_source = (
         Path(args.analysis).resolve()
@@ -998,6 +1001,7 @@ def build_requests(comparison: dict, requests_dir: Path) -> dict:
     points = comparison.get("knowledgePoints") or []
     if not points:
         raise PipelineError("comparison.json 没有知识点")
+    expected_request_ids({"requests": [{"requestId": point.get("id")} for point in points]})
     requests_dir.mkdir(parents=True, exist_ok=True)
     expected = {f"{point['id']}.json" for point in points}
     stale = [path.name for path in requests_dir.glob("*.json") if path.name not in expected and path.name != "manifest.json"]
@@ -1428,6 +1432,7 @@ def merge_verification(comparison: dict, results_dir: Path) -> dict:
     gov_exempt_count = 0
     downgraded_anchor_ids: list[str] = []
     authority_verdicts: dict[tuple[str, str], str] = {}
+    expected_request_ids({"requests": [{"requestId": point.get("id")} for point in comparison.get("knowledgePoints") or []]})
     for point in comparison.get("knowledgePoints") or []:
         path = results_dir / f"{point['id']}.json"
         if not path.exists():

package/bundled-skills/fact-check-x-unified/scripts/trusted_search_config.py

@@ -5,10 +5,12 @@ import argparse
 import json
 import os
 import ssl
+import stat
 import subprocess
 import sys
 import urllib.error
 import urllib.request
+from urllib.parse import urlsplit
 from pathlib import Path
 
 
@@ -64,6 +66,7 @@ def _validate_key_shape(key: str) -> str:
     normalized = key.strip()
     if (
         len(normalized) < 16
+        or len(normalized) > 1024
         or any(character.isspace() for character in normalized)
         or "*" in normalized
     ):
@@ -73,11 +76,24 @@ def _validate_key_shape(key: str) -> str:
 
 def _shared_trusted_search_key() -> str:
     path = credential_path()
-    if not path.is_file():
+    if not path.exists() and not path.is_symlink():
         return ""
-    if os.name != "nt" and path.stat().st_mode & 0o077:
-        raise ConfigurationError("本机可信搜索配置权限不安全，请重新执行自动配置。")
-    return _validate_key_shape(path.read_text(encoding="utf-8"))
+    if path.is_symlink():
+        raise ConfigurationError("本机可信搜索配置必须是普通文件，不能是链接。")
+    descriptor = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0))
+    try:
+        information = os.fstat(descriptor)
+        if not stat.S_ISREG(information.st_mode):
+            raise ConfigurationError("本机可信搜索配置必须是普通文件。")
+        if os.name != "nt" and information.st_mode & 0o077:
+            raise ConfigurationError("本机可信搜索配置权限不安全，请重新执行自动配置。")
+        with os.fdopen(descriptor, "rb", closefd=False) as handle:
+            data = handle.read(4097)
+        if len(data) > 4096:
+            raise ConfigurationError("本机可信搜索配置超过大小限制。")
+        return _validate_key_shape(data.decode("utf-8"))
+    finally:
+        os.close(descriptor)
 
 
 def trusted_search_key_candidates() -> list[tuple[str, str]]:
@@ -164,9 +180,25 @@ def clear_trusted_search_key() -> bool:
     return existed
 
 
+class RejectCredentialRedirects(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, request, response, code, message, headers, new_url):
+        raise ServiceUnavailableError("可信搜索重定向已拒绝，Key 不会发送到其他地址。")
+
+
+def open_trusted_search(request, *, timeout, context):
+    opener = urllib.request.build_opener(
+        urllib.request.HTTPSHandler(context=context), RejectCredentialRedirects()
+    )
+    return opener.open(request, timeout=timeout)
+
+
 def validate_trusted_search_key(key: str) -> None:
     normalized = _validate_key_shape(key)
     endpoint = os.getenv("FACTCHECK_TRUSTED_SEARCH_URL", DEFAULT_ENDPOINT).strip()
+    parsed = urlsplit(endpoint)
+    loopback_fixture = parsed.scheme == "http" and parsed.hostname in {"127.0.0.1", "::1"}
+    if (parsed.scheme != "https" and not loopback_fixture) or not parsed.hostname or parsed.username or parsed.password or parsed.fragment:
+        raise ConfigurationError("可信搜索地址必须是无用户凭据的 HTTPS 地址；HTTP 仅供本机测试。")
     payload = {
         "query": "住房公积金管理条例",
         "segmentCount": 1,
@@ -180,18 +212,21 @@ def validate_trusted_search_key(key: str) -> None:
         headers={"Content-Type": "application/json", "api-key": normalized},
     )
     try:
-        with urllib.request.urlopen(
+        with open_trusted_search(
             request,
             timeout=20,
             context=trusted_search_ssl_context(),
         ) as response:
-            raw = response.read().decode("utf-8")
+            raw_bytes = response.read(1024 * 1024 + 1)
+            if len(raw_bytes) > 1024 * 1024:
+                raise ServiceUnavailableError("可信搜索响应超过大小限制。")
+            raw = raw_bytes.decode("utf-8")
             status = response.status
     except urllib.error.HTTPError as exc:
         if exc.code in {401, 403}:
             raise InvalidCredentialError("MaaS 返回的 Key 无效或无可信搜索权限。") from None
         raise ServiceUnavailableError(f"可信搜索服务暂时不可用（HTTP {exc.code}）。") from None
-    except (urllib.error.URLError, TimeoutError, OSError):
+    except (urllib.error.URLError, TimeoutError, OSError, UnicodeError):
         raise ServiceUnavailableError("暂时无法连接可信搜索服务，请检查网络后重试。") from None
     try:
         data = json.loads(raw)
@@ -252,6 +287,9 @@ def onboarding_script_candidates() -> list[Path]:
         / "dist"
         / "trusted-search-onboarding.js",
     ]
+    selected_root = os.getenv("FACTCHECK_SKILLS_DIR", "").strip()
+    if selected_root:
+        candidates.insert(0, Path(selected_root).expanduser() / "llm-answer-reference-compare" / "assets" / "tool" / "dist" / "trusted-search-onboarding.js")
     output = []
     for candidate in candidates:
         resolved = candidate.resolve()
@@ -302,7 +340,10 @@ def run_onboarding(*, force: bool = False) -> dict:
         if not message:
             message = "可信搜索自动配置未完成，请保持浏览器打开并完成登录。"
         raise ConfigurationError(message)
-    load_trusted_search_key()
+    key = load_trusted_search_key()
+    if not key:
+        raise ConfigurationError("自动配置未保存有效 Key。")
+    validate_trusted_search_key(key)
     return {
         "status": result["status"],
         "providerUrl": PROVIDER_URL,

package/bundled-skills/fact-check-x-unified/tests/smoke_test.py

@@ -102,7 +102,7 @@ def main() -> int:
             notices,
         ).decode("utf-8")
         assert 'data-fcx-run-notice="1"' in notice_html
-        assert "受影响且无法核验的主张按“疑似误导”呈现" in notice_html
+        assert "受影响且无法核验的主张保持“证据不足”，不得从技术失败推定误导" in notice_html
 
         merge_results = Path(temp) / "merge-results"
         merge_results.mkdir()

package/bundled-skills/fact-check-x-unified/tests/trusted_search_config_test.py

@@ -78,10 +78,16 @@ def main() -> int:
             assert existing["source"] == "shared_local_credential"
             assert existing["created"] is False
             assert existing["validated"] is True
-            assert locate_onboarding_script().name == "trusted-search-onboarding.js"
+            # AAS does not bundle the external collector; exercise locator against an inert fixture.
+            dependency_root = Path(temp) / "reviewed-skills"
+            onboarding = dependency_root / "llm-answer-reference-compare/assets/tool/dist/trusted-search-onboarding.js"
+            onboarding.parent.mkdir(parents=True)
+            onboarding.write_text("// inert locator fixture; never executed\n", encoding="utf-8")
+            os.environ["FACTCHECK_SKILLS_DIR"] = str(dependency_root)
+            assert locate_onboarding_script() == onboarding.resolve()
 
             with patch(
-                "trusted_search_config.urllib.request.urlopen",
+                "trusted_search_config.open_trusted_search",
                 side_effect=OSError("The read operation timed out"),
             ):
                 executable, executable_source, validation = (

package/bundled-skills/fal-audio/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fal-audio
 description: "Text-to-speech and speech-to-text using fal.ai audio models"
-risk: safe
+risk: critical
 source: "https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-audio/SKILL.md"
 date_added: "2026-02-27"
 ---
@@ -12,15 +12,25 @@ date_added: "2026-02-27"
 
 Text-to-speech and speech-to-text using fal.ai audio models
 
-## When to Use This Skill
+## When to Use
 
-Use this skill when you need to work with text-to-speech and speech-to-text using fal.ai audio models.
+Prepare an authorized speech transcription or synthesis job through an available fal.ai integration when the user requests that media operation.
 
-## Instructions
+## Procedure and Inputs
 
-This skill provides guidance and patterns for text-to-speech and speech-to-text using fal.ai audio models.
+Resolve audio file or script, language, speaker/voice permissions, output format and budget. This AAS entrypoint does not bundle a fal client, model catalog,
+credentials or executable examples. The historical upstream file is currently
+unavailable; preserve its attribution and do not invent an endpoint or model ID.
+Use only an already configured integration with a verified current schema, or
+report execution unavailable and return the requested job specification.
 
-For more information, see the [source repository](https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-audio/SKILL.md).
+For transcription, confirm the recording may be uploaded and retain timestamps if required. For synthesis, use an authorized voice and preserve the supplied script. Review returned duration, empty output and failure status.
+
+Confirm upload/privacy and paid-call scope before submitting. Use bounded status
+polling appropriate to the actual tool; do not retry an ambiguous submission until
+its job identity/account state is reconciled. Deliver the actual returned artifact
+and state which requested properties were checked; a draft or queued job is not a
+finished output.
 
 ## Example
 

package/bundled-skills/fal-generate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fal-generate
 description: "Generate images and videos using fal.ai AI models"
-risk: safe
+risk: critical
 source: "https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-generate/SKILL.md"
 date_added: "2026-02-27"
 ---
@@ -12,15 +12,25 @@ date_added: "2026-02-27"
 
 Generate images and videos using fal.ai AI models
 
-## When to Use This Skill
+## When to Use
 
-Use this skill when you need to work with generate images and videos using fal.ai ai models.
+Prepare image or video generation through an available fal.ai integration when the user requests that media operation.
 
-## Instructions
+## Procedure and Inputs
 
-This skill provides guidance and patterns for generate images and videos using fal.ai ai models.
+Resolve prompt, intended use, aspect ratio, duration, reference permissions and budget. This AAS entrypoint does not bundle a fal client, model catalog,
+credentials or executable examples. The historical upstream file is currently
+unavailable; preserve its attribution and do not invent an endpoint or model ID.
+Use only an already configured integration with a verified current schema, or
+report execution unavailable and return the requested job specification.
 
-For more information, see the [source repository](https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-generate/SKILL.md).
+Choose a currently available model from the actual integration, inspect its input schema, and submit the smallest requested job. Preserve returned job identity and distinguish queued, failed and completed status.
+
+Confirm upload/privacy and paid-call scope before submitting. Use bounded status
+polling appropriate to the actual tool; do not retry an ambiguous submission until
+its job identity/account state is reconciled. Deliver the actual returned artifact
+and state which requested properties were checked; a draft or queued job is not a
+finished output.
 
 ## Example
 

package/bundled-skills/fal-image-edit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fal-image-edit
 description: "AI-powered image editing with style transfer and object removal"
-risk: safe
+risk: critical
 source: "https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-image-edit/SKILL.md"
 date_added: "2026-02-27"
 ---
@@ -12,15 +12,25 @@ date_added: "2026-02-27"
 
 AI-powered image editing with style transfer and object removal
 
-## When to Use This Skill
+## When to Use
 
-Use this skill when you need to work with ai-powered image editing with style transfer and object removal.
+Edit a supplied image through an available fal.ai integration when the user requests that media operation.
 
-## Instructions
+## Procedure and Inputs
 
-This skill provides guidance and patterns for ai-powered image editing with style transfer and object removal.
+Resolve actual source image, requested edits, preservation constraints, output format and budget. This AAS entrypoint does not bundle a fal client, model catalog,
+credentials or executable examples. The historical upstream file is currently
+unavailable; preserve its attribution and do not invent an endpoint or model ID.
+Use only an already configured integration with a verified current schema, or
+report execution unavailable and return the requested job specification.
 
-For more information, see the [source repository](https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-image-edit/SKILL.md).
+Inspect the actual image first, bind it to the edit request, and choose an available model that supports the requested operation. Review the returned image against preservation constraints and keep the original unchanged.
+
+Confirm upload/privacy and paid-call scope before submitting. Use bounded status
+polling appropriate to the actual tool; do not retry an ambiguous submission until
+its job identity/account state is reconciled. Deliver the actual returned artifact
+and state which requested properties were checked; a draft or queued job is not a
+finished output.
 
 ## Example
 

package/bundled-skills/fal-platform/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fal-platform
 description: "Platform APIs for model management, pricing, and usage tracking"
-risk: safe
+risk: critical
 source: "https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-platform/SKILL.md"
 date_added: "2026-02-27"
 ---
@@ -16,11 +16,19 @@ Platform APIs for model management, pricing, and usage tracking
 
 Use this skill when you need to work with platform apis for model management, pricing, and usage tracking.
 
-## Instructions
+## Procedure
 
-This skill provides guidance and patterns for platform apis for model management, pricing, and usage tracking.
+Use a configured integration to inspect the requested account/model information.
+Confirm account identity, region, model endpoint and time window; select only the
+fields needed. Read pricing and usage from actual returned records with timestamps,
+currency, unit and period. A model's advertised unit price is not the total job cost.
+Do not invent management endpoints: no API client is bundled and the historical
+upstream path is absent from the current source tree.
 
-For more information, see the [source repository](https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-platform/SKILL.md).
+Keep read-only inspection separate from model changes, key rotation or billing
+operations, which need explicit authorization. Protect account identifiers and keys.
+If the tool or permissions are absent, report the missing evidence rather than zero
+usage or an available balance. Return source-linked observations and remaining gaps.
 
 ## Example
 

package/bundled-skills/fal-upscale/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fal-upscale
 description: "Upscale and enhance image and video resolution using AI"
-risk: safe
+risk: critical
 source: "https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-upscale/SKILL.md"
 date_added: "2026-02-27"
 ---
@@ -16,11 +16,19 @@ Upscale and enhance image and video resolution using AI
 
 Use this skill when you need to work with upscale and enhance image and video resolution using ai.
 
-## Instructions
+## Procedure
 
-This skill provides guidance and patterns for upscale and enhance image and video resolution using ai.
+Inspect the actual source image/video and resolve desired dimensions, scaling factor,
+output format, preservation constraints and budget. Use an available integration's
+verified input schema; no upscaler/runtime is bundled and the historical upstream
+path is absent from the current source tree. Confirm upload authorization and avoid
+exposing private media or inventing a supported model.
 
-For more information, see the [source repository](https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-upscale/SKILL.md).
+Submit only the requested operation; record job identity and actual status. Compare
+returned dimensions, artifacts and subject/detail preservation against the source.
+Keep the original unchanged and deliver the actual returned file. Increased pixel
+count does not prove recovered real detail; generated enhancement can alter content.
+If execution is unavailable, return the job specification with that limitation.
 
 ## Example
 

package/bundled-skills/fal-workflow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fal-workflow
 description: "Generate workflow JSON files for chaining AI models"
-risk: safe
+risk: critical
 source: "https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-workflow/SKILL.md"
 date_added: "2026-02-27"
 ---
@@ -12,15 +12,33 @@ date_added: "2026-02-27"
 
 Generate workflow JSON files for chaining AI models
 
-## When to Use This Skill
+## When to Use
 
-Use this skill when you need to work with generate workflow json files for chaining ai models.
+Create a reviewable graph for a multi-step fal.ai media workflow, or plan an
+explicitly authorized run through an already available integration.
 
-## Instructions
+## Workflow Authoring
 
-This skill provides guidance and patterns for generate workflow json files for chaining ai models.
+Resolve inputs, outputs, dependencies, model schemas, privacy and cost limits.
+Distinguish a portable JSON deliverable from local CLI orchestration; AAS does not
+bundle the upstream CLI or references. Inspect current endpoint schemas before
+choosing models. Keep node IDs consistent with keys and include every referenced
+node in dependencies. Use `run` or `display` nodes for the documented JSON runtime;
+input fields belong in its input schema. Whole-value references are distinct from
+unsupported string interpolation.
 
-For more information, see the [source repository](https://github.com/fal-ai-community/skills/blob/main/skills/claude.ai/fal-workflow/SKILL.md).
+This illustrative node fragment requires a matching real producer and surrounding
+workflow schema; it is not a standalone runnable file:
+
+```json
+{"id":"output","type":"display","depends":["image"],"fields":{"image":"$image.images.0.url"}}
+```
+
+Validate graph references and real model contracts before delivery. Drafting does
+not authorize upload, execution or publication. Report schema validation and actual
+job execution separately; no “production-ready” guarantee.
+
+Current richer source: [fal workflow](https://github.com/fal-ai-community/skills/blob/main/skills/fal-workflow/SKILL.md).
 
 ## Example
 

package/bundled-skills/family-health-analyzer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: family-health-analyzer
-description: 分析家族病史、评估遗传风险、识别家庭健康模式、提供个性化预防建议
+description: 整理家族病史和已知健康记录，识别需要医生或遗传咨询师评估的线索，不计算未经验证的个体发病概率
 allowed-tools: Read, Write, Grep, Glob
 risk: critical
 source: community
@@ -64,20 +64,18 @@ date_added: "2026-09-04"
 **识别算法:**
 1. 家族聚集性分析
 2. 遗传模式识别
-3. 早发病例识别(通常<50岁)
+3. 记录发病年龄；“早发”阈值依具体疾病和已验证指南，不统一设为50岁
 
-### 步骤5: 风险计算算法
+### 步骤5: 描述性汇总，不计算临床风险
 
-**加权计算:**
-```python
-遗传风险评分 = (一级亲属患病数 × 0.4) +
-              (早发病例数 × 0.3) +
-              (家族聚集度 × 0.3)
+**禁止使用未经验证的加权公式生成百分比。** 亲属人数、早发病例数和聚集度不是同量纲且未归一化的数据；原先0.4/0.3/0.3权重和70%阈值没有临床校准依据。只记录实际已知关系、诊断来源、发病年龄和缺失项，由专业人员判断是否需要进一步评估。
 
-风险等级:
-- 高风险: ≥70%
-- 中风险: 40%-69%
-- 低风险: <40%
+**记录示例（不是可执行计算算法）:**
+```text
+已知一级亲属病史：按疾病、关系和发病年龄逐条列出
+来源：本人确认／医疗记录／待核实
+缺失信息：明确列出，不推定为阴性
+后续：向医生或遗传咨询师提出待评估问题，不输出发病概率
 ```
 
 ### 步骤6: 生成预防建议
@@ -92,8 +90,8 @@ date_added: "2026-09-04"
 {
   "category": "screening",
   "action": "定期血压监测",
-  "frequency": "每周3次",
-  "start_age": 35,
+  "frequency": "由医生依据实际情况确定",
+  "start_age": null,
   "priority": "high"
 }
 ```
@@ -102,7 +100,7 @@ date_added: "2026-09-04"
 
 **HTML报告组件:**
 1. 家谱树(ECharts树图)
-2. 遗传风险热力图
+2. 已知病史分布图（不得标成个人遗传风险概率）
 3. 疾病分布饼图
 4. 预防建议时间线
 
@@ -145,6 +143,9 @@ date_added: "2026-09-04"
 **维护者**: WellAlly Tech
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
+- 中文是原始受众语言，不是缺陷；按用户指定语言交互。原文已包含明确医学免责声明，必须保留。
+- data/*.json 和 /family 命令属于外部应用约定，AAS未分发这些数据、运行时或算法；先定位用户明确授权的真实数据源，不伪造成功命令。
+- 家庭/遗传信息高度敏感，仅收集获得同意的最小字段，匿名化亲属记录并私有保存；不得因亲属关联推定某人诊断。
+- [CDC家族健康史说明](https://www.cdc.gov/family-health-history/about/index.html)强调与医疗专业人员讨论；此技能不提供医学诊断、治疗或自行更改筛查方案。
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.