skilldrop-cli 0.16.0 → 0.16.2

package/packs/converters/skills/md-to-xlsx/scripts/md_to_xlsx.py

@@ -170,8 +170,11 @@ def type_text(s, formulas, stats, tz_flag, infer_numbers=True):
                         text = "0"
                     return Cell("n", text, fmt, width)
         if RE_SCI.match(s):
-            stats["numbers"] += 1
-            return Cell("n", repr(float(s)), None, width)
+            val = float(s)
+            # 1e999 overflows to inf, which is not a number Excel can read: keep it as text
+            if val == val and val not in (float("inf"), float("-inf")):
+                stats["numbers"] += 1
+                return Cell("n", num_text(val), None, width)
     if len(raw) > MAX_CELL:
         stats["truncated"] += 1
         s = s[:MAX_CELL]
@@ -189,6 +192,10 @@ def type_json(v, formulas, stats, tz_flag):
         if v != v or v in (float("inf"), float("-inf")):
             stats["text"] += 1
             return Cell("s", str(v), None, len(str(v)))
+        if isinstance(v, int) and len(str(abs(v))) > 15:
+            # Excel keeps 15 significant digits; a longer integer is an ID, and rounding it is data loss
+            stats["text"] += 1
+            return Cell("s", str(v), None, len(str(v)))
         stats["numbers"] += 1
         return Cell("n", num_text(v), None, len(num_text(v)))
     if isinstance(v, (dict, list)):
@@ -230,6 +237,9 @@ def split_row(line):
     return cells
 
 
+HTML_TAGS = [0]  # tags removed by strip_md, reported once per file
+
+
 def strip_md(s):
     """Plain text from a Markdown table cell."""
     s = re.sub(r"<br\s*/?>", "\n", s, flags=re.I)
@@ -240,7 +250,8 @@ def strip_md(s):
     s = re.sub(r"(?<![\w*])\*(?!\s)(.+?)(?<!\s)\*(?![\w*])", r"\1", s)
     s = re.sub(r"(?<!\w)_(?!\s)(.+?)(?<!\s)_(?!\w)", r"\1", s)
     s = re.sub(r"~~(.+?)~~", r"\1", s)
-    s = re.sub(r"</?[A-Za-z][^>]*>", "", s)
+    s, n = re.subn(r"</?[A-Za-z][^>]*>", "", s)
+    HTML_TAGS[0] += n
     s = re.sub(r"\\([\\`*_{}\[\]()#+\-.!|~])", r"\1", s)
     return s
 
@@ -280,6 +291,9 @@ def read_markdown(text):
             tables.append((heading, header, rows, start))
             continue
         i += 1
+    if HTML_TAGS[0]:
+        warn("%d HTML tag(s) removed from headings and cells (text between them kept); write a literal "
+             "<...> as &lt;...&gt; or in backticks to keep it" % HTML_TAGS[0])
     return tables
 
 
@@ -533,7 +547,7 @@ def write_xlsx(out, sheets, title, formulas):
                 '<bookViews><workbookView activeTab="0"/></bookViews><sheets>%s</sheets>'
                 '<definedNames>%s</definedNames>%s</workbook>') % (
                     "".join(sheet_tags), "".join(names), '<calcPr fullCalcOnLoad="1"/>' if formulas else "")
-    now = datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")
+    now = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
     core = ('<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n'
             '<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" '
             'xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" '

package/packs/converters/skills/mermaid-render/SKILL.md

@@ -106,3 +106,4 @@ block end> at <file>:<line>` and do not render that diagram.
 - ❌ **Rendering with `--force` and shipping the result.** Mermaid draws an error graphic, not the diagram.
 - ❌ **Sending the HTML fallback as if it were an SVG.** It is a web page that needs network.
 - ❌ **Linting a copy and reporting line numbers from it.** Run the script on the user's own `.md` so the numbers match their editor.
+- ❌ **Showing the machinery.** The reply and the artifact are for the person who asked. Don't mention this skill, its files, templates, caps or internal terms, or that the run is non-interactive. Name another skill once, at the end, as a suggested next step, never inside the artifact.

package/packs/converters/skills/mermaid-render/evals/files/1/docs/contoso-orders.md

@@ -0,0 +1,23 @@
+# Contoso orders
+
+## Order states
+
+```mermaid
+stateDiagram-v2
+    [*] --> Placed
+    Placed --> Paid
+    Paid --> Shipped
+    Shipped --> [*]
+```
+
+## Order flow
+
+```mermaid
+flowchart TD
+    A[Customer places order] --> B{In stock?}
+    B -->|Yes| C[Reserve stock (warehouse)]
+    B -->|No| D[Back-order]
+    C -> E[Take payment]
+    E --> F[Ship]
+    D --> F
+```

package/packs/converters/skills/mermaid-render/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "mermaid-render",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Check Mermaid diagrams for the mistakes that stop them rendering (unknown diagram type, unbalanced brackets or quotes, unquoted parentheses in labels, the word end as a node id, missing arrows, unclosed subgraphs or alt blocks) with line numbers and a fix for each, then render them to SVG, PNG or PDF with mermaid-cli, or to a standalone HTML page when it is not installed. Works on a .mmd file or every mermaid fence in a Markdown doc. Use when a diagram \"won't render\", the user says \"check my mermaid\", \"export this diagram as SVG/PNG\", or needs the diagrams in a doc as image files.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/core/skills/brief-intake/SKILL.md

@@ -76,3 +76,4 @@ You help the user (or the next skill in the chain) absorb raw unstructured input
 - ❌ Skipping the gaps section because the brief looks fine — the gaps are the *most useful output* for the user about to invoke the downstream skill.
 - ❌ Asking 4+ clarifying questions. If the source is too thin, say so once and let the user decide whether to add material or proceed with gaps flagged.
 - ❌ Emitting the brief in prose. Downstream skills want structured fields, not paragraphs.
+- ❌ **Showing the machinery.** The reply and the artifact are for the person who asked. Don't mention this skill, its files, templates, caps or internal terms, or that the run is non-interactive. Name another skill once, at the end, as a suggested next step, never inside the artifact.

package/packs/core/skills/brief-intake/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "brief-intake",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Turn raw mess — a Slack thread, meeting transcript, Jira ticket, half-written Notion page, email chain, or paragraph of free-form context — into a structured brief that the downstream skill (adr-generator, design-doc, runbook-generator, exec-summary, deck-builder, tech-comparison-matrix) can consume without further intake. Use whenever the user has unstructured source material and is about to invoke another skilldrop skill, or when a draft is missing the load-bearing context the next step will need.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/core/skills/output-hygiene/SKILL.md

@@ -93,3 +93,5 @@ There is no cryptographic watermark in Claude's text output, and this skill does
 - ❌ **Auto-replacing a homoglyph with the ASCII letter that looks like it.** The word may be genuinely non-English. Report it, show the codepoint, let the author decide.
 - ❌ **Re-reading the whole draft for characters the script already found.** The script is exhaustive on its classes and cheaper than a model pass. Spend the model on prose.
 - ❌ **Running `--fix` and reporting only the count.** "Removed 6 artifacts" is not auditable. List them.
+- ❌ **Showing the machinery.** The reply and the artifact are for the person who asked. Don't mention this skill, its files, templates, caps or internal terms, or that the run is non-interactive. Name another skill once, at the end, as a suggested next step, never inside the artifact.
+- ❌ **A bare `BLOCKED` line.** Keep the `BLOCKED: need <X>` line, then write for a person: what is missing in plain words, what you will produce once you have it, and anything the request already lets you say.

package/packs/core/skills/output-hygiene/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "output-hygiene",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Review agent-written text before it ships and strip the machine artifacts it carries — invisible Unicode, non-breaking spaces, homoglyphs, harness-added provenance trailers, trailing chat closers — then flag the prose tells a script cannot catch, each quoted with a rewrite. Use when the user wants to clean up AI-generated output, asks to remove a Claude watermark, attribution footer, or \"Generated with\" line, wants a draft that does not read as machine-written, or needs a pre-ship hygiene pass on a document, commit message, or pasted chat answer.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/design/skills/deck-builder/SKILL.md

@@ -197,3 +197,5 @@ A generated deck is a strong first draft. Always tell the user to:
 - ❌ Shipping the deck with a grey placeholder box still in it because the warning went unread.
 - ❌ Defaulting to bullets when a `big_number`, `chart`, `quote` or `two_column` would land harder.
 - ❌ More than ~20 slides for any audience. If the point needs 21, the deck is the wrong format.
+- ❌ **Showing the machinery.** The reply and the artifact are for the person who asked. Don't mention this skill, its files, templates, caps or internal terms, or that the run is non-interactive. Name another skill once, at the end, as a suggested next step, never inside the artifact.
+- ❌ **A bare `BLOCKED` line.** Keep the `BLOCKED: need <X>` line, then write for a person: what is missing in plain words, what you will produce once you have it, and anything the request already lets you say.

package/packs/design/skills/deck-builder/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "deck-builder",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Generate a real PowerPoint (.pptx) file from content, audience, and either a brand template or a color palette — with charts, tables and images, not only bullets. Slide count, density and layout are tuned to the audience: execs, boards, technical reviewers, sales prospects, investors, internal teams. Use when the user wants an actual editable .pptx rather than an outline, wants their corporate template or brand colours applied, or says \"build the deck\", \"make it a pptx\", \"use our template\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/design/skills/marketing-flyer/evals/files/1/brand/brand.json

@@ -0,0 +1,80 @@
+{
+  "$comment": "brand-kit output. deck-builder and marketing-flyer read this file; any field left out is asked for or defaulted by them. Paths are relative to this file. Every value carries where it came from in `sources`.",
+  "name": "Northwind Health",
+  "tagline": "Care that comes to you",
+  "logo": {
+    "primary": "logo.png",
+    "on_dark": "logo-white.png",
+    "mark": "mark.png",
+    "notes": "Keep clear space equal to the height of the N on every side. Never place the full-colour logo on the green."
+  },
+  "colors": {
+    "primary": "#0E5A46",
+    "secondary": "#3D7F6B",
+    "accent": "#F2A541",
+    "background": "#FFFFFF",
+    "text": "#1F2A28",
+    "extra": [
+      {
+        "name": "Mist",
+        "hex": "#E8F1EE",
+        "use": "panel backgrounds"
+      }
+    ]
+  },
+  "fonts": {
+    "heading": {
+      "family": "Georgia",
+      "fallback": "serif",
+      "weight": 700
+    },
+    "body": {
+      "family": "Arial",
+      "fallback": "sans-serif",
+      "weight": 400
+    }
+  },
+  "voice": {
+    "tone": "Warm, plain, confident. Short sentences.",
+    "use": [
+      "members",
+      "care team",
+      "near you"
+    ],
+    "avoid": [
+      "patients",
+      "cutting-edge",
+      "solutions"
+    ]
+  },
+  "imagery": {
+    "style": "Real people in daylight, community settings, no stock handshakes.",
+    "do": [
+      "natural light",
+      "diverse ages"
+    ],
+    "dont": [
+      "clinical close-ups",
+      "illustrated icons as hero images"
+    ]
+  },
+  "templates": {
+    "pptx": "northwind-master.potx"
+  },
+  "contact": {
+    "website": "northwindhealth.example",
+    "email": "hello@northwindhealth.example",
+    "phone": "",
+    "address": ""
+  },
+  "legal": {
+    "footer": "\u00a9 2026 Northwind Health",
+    "disclaimer": ""
+  },
+  "sources": {
+    "colors": "brand guidelines PDF, page 4 [explicit]",
+    "fonts": "brand guidelines PDF, page 6 [explicit]",
+    "voice": "website About page [inferred]",
+    "logo": "files supplied by the user [explicit]"
+  }
+}

package/packs/dev-team/skills/agents-md-generator/SKILL.md

@@ -21,7 +21,7 @@ Two modes, chosen by what's already there:
 
 2. **Apply the evidence rule without exception.** A command appears only if it traces to a file in the repo. Never infer from ecosystem convention: a Python repo does not necessarily run `pytest`, and a repo with `jest` in `devDependencies` may still have no test script.
 
-   When a section needs a command that doesn't exist, write the marker, not a guess: ✅ *"Test: `[missing: no test script in package.json or CI]`"* — ❌ *"Test: `npm test`"*. The marker is useful; the guess is a trap.
+   When a section needs a command that doesn't exist, record the gap, not a guess. In the provenance table it is `[missing: no test script in package.json or CI]`. In the file itself it is a plain line an agent can act on: ✅ *"Test: none defined in this repo. Do not run `npm test`."* — ❌ *"Test: `npm test`"*. The stated gap is useful; the guess is a trap.
 
 3. **Derive file placement from the actual tree**, not from what the framework usually does. Name the directories that exist and what belongs in each. Two or three rows beat a full tree dump.
 
@@ -46,7 +46,7 @@ Two modes, chosen by what's already there:
 
 ## Quality bar
 
-- **Zero unverified commands.** Every one traces to a file and key, or carries a `[missing: …]` marker. This is the bar; a file that fails it is worse than no file.
+- **Zero unverified commands.** Every one traces to a file and key, or is stated as a gap (`[missing: …]` in the provenance table, a plain "none defined" line in the file). This is the bar; a file that fails it is worse than no file.
 - **A newcomer agent could build and test from this file alone** — or can see plainly that the repo has no such command.
 - **Forbidden actions are named**, not implied.
 - **Every convention line passes the counterfactual test.** If an agent would do the right thing without it, it is padding.
@@ -78,3 +78,5 @@ Two modes, chosen by what's already there:
 - ❌ **A satellite that duplicates `AGENTS.md`.** Guaranteed drift, invisible until an agent acts on the stale copy.
 - ❌ **Silently rewriting a hand-tuned file.** Audit mode emits a diff and lets a human choose; the file may encode decisions the repo can't show you.
 - ❌ **Writing to the cap.** 150 lines is a ceiling, not a target. Most repos need far less.
+- ❌ **Showing the machinery.** The reply and the artifact are for the person who asked. Don't mention this skill, its files, templates, caps or internal terms, or that the run is non-interactive. Name another skill once, at the end, as a suggested next step, never inside the artifact.
+- ❌ **A bare `BLOCKED` line.** Keep the `BLOCKED: need <X>` line, then write for a person: what is missing in plain words, what you will produce once you have it, and anything the request already lets you say.

package/packs/dev-team/skills/agents-md-generator/evals/files/1/.github/workflows/ci.yml

@@ -0,0 +1,10 @@
+name: ci
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: pip install -e .[dev]
+      - run: ruff check .
+      - run: pytest -q

package/packs/dev-team/skills/agents-md-generator/evals/files/1/Makefile

@@ -0,0 +1,5 @@
+run:
+	uvicorn booking.app:app --reload
+
+migrate:
+	alembic upgrade head

package/packs/dev-team/skills/agents-md-generator/evals/files/1/alembic/versions/0001_create_bookings.py

@@ -0,0 +1,10 @@
+revision = "0001"
+down_revision = None
+
+
+def upgrade():
+    pass
+
+
+def downgrade():
+    pass

package/packs/dev-team/skills/agents-md-generator/evals/files/1/booking/app.py

@@ -0,0 +1,8 @@
+from fastapi import FastAPI
+
+app = FastAPI()
+
+
+@app.get("/health")
+def health():
+    return {"ok": True}

package/packs/dev-team/skills/agents-md-generator/evals/files/1/pyproject.toml

@@ -0,0 +1,11 @@
+[project]
+name = "northwind-booking"
+version = "0.4.0"
+requires-python = ">=3.11"
+dependencies = ["fastapi", "sqlalchemy", "alembic"]
+
+[project.optional-dependencies]
+dev = ["pytest", "ruff"]
+
+[tool.ruff]
+line-length = 100

package/packs/dev-team/skills/agents-md-generator/evals/files/1/tests/test_health.py

@@ -0,0 +1,5 @@
+from booking.app import health
+
+
+def test_health():
+    assert health() == {"ok": True}

package/packs/dev-team/skills/agents-md-generator/evals/files/2/AGENTS.md

@@ -0,0 +1,3 @@
+# AGENTS.md
+
+Run `npm test` to test. Write clean, maintainable code and follow best practices. Be thorough in reviews.

package/packs/dev-team/skills/agents-md-generator/evals/files/2/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "acme-portal",
+  "version": "1.2.0",
+  "scripts": {
+    "build": "tsc -p .",
+    "lint": "eslint src"
+  },
+  "devDependencies": {
+    "typescript": "^5.4.0",
+    "eslint": "^9.0.0"
+  }
+}

package/packs/dev-team/skills/agents-md-generator/evals/files/2/src/index.ts

@@ -0,0 +1 @@
+export const main = (): string => "acme-portal";

package/packs/dev-team/skills/agents-md-generator/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-md-generator",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Generate or audit a repository's AGENTS.md — the agent-policy file Claude Code, Codex, Cursor, Copilot, Kiro and Antigravity read — with every command traced to real evidence in the repo, generic virtue instructions stripped, and forbidden actions named. Use when a repo has no AGENTS.md, when an existing one is stale or ignored, when onboarding a codebase to agentic coding, or when an agent keeps running commands that don't exist.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/agents-md-generator/templates/agents-md.md

@@ -14,7 +14,7 @@
 |---|---|---|
 | Install | `{cmd}` | `{file}` → `{key}` |
 | Build | `{cmd}` | `{file}` → `{key}` |
-| Test | `{cmd}` *or* `[missing: no test command in CI or manifests]` | `{file}` → `{key}` |
+| Test | `{cmd}` *or* none defined in this repo; do not guess one | `{file}` → `{key}` |
 | Lint | `{cmd}` | `{file}` → `{key}` |
 | Run locally | `{cmd}` | `{file}` → `{key}` |
 
@@ -44,5 +44,5 @@
 
 <!--
 Line budget: 150. Provenance for every command was verified at generation time.
-Commands marked [missing] are findings, not omissions — the repo has no such command.
+A row that says "none defined" is a finding, not an omission — the repo has no such command.
 -->

package/packs/dev-team/skills/devils-advocate/SKILL.md

@@ -140,3 +140,4 @@ Specifically:
 - ❌ **Reviewing untouched code.** Out-of-scope. The skill challenges the *change*, not the codebase.
 - ❌ **Demanding tests for *everything* the change touches.** Only the new logic and new error paths. Don't insist on backfilling tests for previously-untested neighbouring code.
 - ❌ **Skipping "what's solid".** Trains the user (or downstream agent) to dread the skill. End on signal that's actionable in the other direction.
+- ❌ **Showing the machinery.** The reply and the artifact are for the person who asked. Don't mention this skill, its files, templates, caps or internal terms, or that the run is non-interactive. Name another skill once, at the end, as a suggested next step, never inside the artifact.

package/packs/dev-team/skills/devils-advocate/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "devils-advocate",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Adversarial review of just-generated code, run *after* an agent (or human) declares a feature done. Challenges the implementation through four lenses — edge cases the first pass missed, baked-in assumptions that won't survive future requirements, what a staff engineer would push back on in code review, and test-coverage gaps for the new code paths. Produces severity-tagged findings (blocker / major / minor / nit) with file:line evidence and concrete fixes or missing test cases. Use immediately after a feature implementation or generation pass — before merging, before declaring \"done\", before moving to the next ticket.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/pre-merge-review/SKILL.md

@@ -79,5 +79,7 @@ The honest limit: a portable *skill* can't physically block an agent — enforce
 - ❌ **Triple-reporting.** The same `file:line` flagged by all three lenses as three findings. Merge them.
 - ❌ **Adjudicating a design debate.** Settling "queue vs cron" inside the verdict instead of gating on gate+severity and offering `council-review`.
 - ❌ **Calling a reviewer *skill* from here.** Skills don't invoke skills (see CLAUDE.md). Drive the review *subagents* where they exist, or sweep the lenses inline.
+- ❌ **Showing the machinery.** The reply and the artifact are for the person who asked. Don't mention this skill, its files, templates, caps or internal terms, or that the run is non-interactive. Name another skill once, at the end, as a suggested next step, never inside the artifact.
+- ❌ **A bare `BLOCKED` line.** Keep the `BLOCKED: need <X>` line, then write for a person: what is missing in plain words, what you will produce once you have it, and anything the request already lets you say.
 
 **Non-interactive:** if the verify commands can't be detected and none were supplied, emit `BLOCKED: need verify commands (--cmd/--config)` — never fabricate a green gate. If the change scope is ambiguous, default to the working-tree diff and tag it `[assumption]` at the top of the report.

package/packs/dev-team/skills/pre-merge-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pre-merge-review",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Gate an existing change for merge — run one skill that fires the whole production-readiness pass. First a deterministic mechanical gate (lint + typecheck + tests, via a script whose exit code decides), then the three-reviewer panel dispatched in parallel — devils-advocate (correctness), security-reviewer (exploitability), code-quality (craft) — then a single READY / NOT READY verdict. Use before opening a PR or merging, when you want the full review fleet run on a diff you already have. Do NOT use to implement a feature from a spec (that's feature-implement-loop) or to review a document (that's doc-critique).",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/pre-merge-review/scripts/gate.py

@@ -112,7 +112,10 @@ def install_hook(root, cmd, config):
     body += "\n" + _hook_block(cmd, config)
     with open(path, "w", encoding="utf-8") as fh:
         fh.write(body)
-    os.chmod(path, 0o755)
+    # chmod +x, not a fixed 0o755: add execute only where the umask already granted read, so a
+    # restrictive umask (077) keeps the hook private instead of being widened to world-readable.
+    mode = os.stat(path).st_mode
+    os.chmod(path, mode | ((mode & 0o444) >> 2))
     print(f"gate: installed a blocking pre-commit hook -> {path}")
     print("      a RED gate now blocks `git commit` (any tool). Bypass once with --no-verify; "
           "wire CI required-checks for the un-bypassable backstop.")

package/packs/infra-as-code/skills/terraform-plan-review/evals/files/2/plan.json

@@ -0,0 +1,133 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.9.5",
+  "resource_drift": [
+    {
+      "address": "aws_route_table.private",
+      "mode": "managed",
+      "type": "aws_route_table",
+      "name": "private",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "update"
+        ],
+        "before": {
+          "id": "rtb-0aa11bb22cc33dd44",
+          "route": [
+            {
+              "cidr_block": "0.0.0.0/0",
+              "nat_gateway_id": "nat-0123456789abcdef0"
+            }
+          ],
+          "tags": {
+            "Name": "northwind-private"
+          }
+        },
+        "after": {
+          "id": "rtb-0aa11bb22cc33dd44",
+          "route": [
+            {
+              "cidr_block": "0.0.0.0/0",
+              "nat_gateway_id": "nat-0123456789abcdef0"
+            },
+            {
+              "cidr_block": "10.99.0.0/16",
+              "vpc_peering_connection_id": "pcx-0fedcba9876543210"
+            }
+          ],
+          "tags": {
+            "Name": "northwind-private"
+          }
+        },
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "resource_changes": [
+    {
+      "address": "module.vpc.aws_subnet.private[\"c\"]",
+      "mode": "managed",
+      "type": "aws_subnet",
+      "name": "private",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "availability_zone": "eu-west-1c",
+          "cidr_block": "10.20.12.0/24",
+          "map_public_ip_on_launch": false,
+          "tags": {
+            "Name": "northwind-private-c"
+          },
+          "vpc_id": "vpc-0123456789abcdef0"
+        },
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      },
+      "module_address": "module.vpc"
+    },
+    {
+      "address": "aws_iam_role_policy.ci",
+      "mode": "managed",
+      "type": "aws_iam_role_policy",
+      "name": "ci",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "update"
+        ],
+        "before": {
+          "id": "northwind-ci:deploy",
+          "name": "deploy",
+          "role": "northwind-ci",
+          "policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Action\": \"ec2:Describe*\", \"Resource\": \"*\"}]}"
+        },
+        "after": {
+          "id": "northwind-ci:deploy",
+          "name": "deploy",
+          "role": "northwind-ci",
+          "policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Action\": \"*\", \"Resource\": \"*\"}]}"
+        },
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "module.vpc.aws_subnet.private[\"a\"]",
+      "mode": "managed",
+      "type": "aws_subnet",
+      "name": "private",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "no-op"
+        ],
+        "before": {
+          "availability_zone": "eu-west-1a",
+          "cidr_block": "10.20.10.0/24"
+        },
+        "after": {
+          "availability_zone": "eu-west-1a",
+          "cidr_block": "10.20.10.0/24"
+        },
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      },
+      "module_address": "module.vpc"
+    }
+  ],
+  "output_changes": {},
+  "applyable": true,
+  "complete": true,
+  "errored": false,
+  "timestamp": "2026-09-30T10:12:00Z"
+}

package/packs/product-manager/skills/prfaq/SKILL.md

@@ -73,3 +73,4 @@ The working-backwards forcing function: write the launch press release *before*
 - ❌ **Launch-as-adoption.** "Ship to beta" as first success conflates the team's delivery with the customer's value. First success is something the *customer* does.
 - ❌ **Moat without mechanism.** Claiming defensibility without naming what makes it hard to copy — data advantage, network effect, workflow lock-in — is a wish wearing a strategy's clothes.
 - ❌ **All-good-news FAQs.** If the customer FAQ reads like the pricing page, the hard questions were dodged and the document proves nothing.
+- ❌ **Showing the machinery.** The reply and the artifact are for the person who asked. Don't mention this skill, its files, templates, caps or internal terms, or that the run is non-interactive. Name another skill once, at the end, as a suggested next step, never inside the artifact.

package/packs/product-manager/skills/prfaq/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "prfaq",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Write an Amazon-style PR/FAQ — the launch press release for a product that doesn't exist yet, plus the customer FAQ and internal FAQ that force the hard questions before engineering starts. Use when the user wants a PRFAQ, a working-backwards document, a \"write the press release first\" exercise, or needs to align stakeholders on what a product must be before committing a team to build it.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/product-manager/skills/strategy-analysis/SKILL.md

@@ -17,7 +17,7 @@ Runs the classic strategy frameworks the way a good strategist does and a bad de
    | Industry attractiveness / profit pressure: "should we enter", "why are margins thin", "can we defend" | **Porter's Five Forces** |
    | Macro environment: regulation, technology shifts, demographics affecting a multi-year bet | **PESTLE** |
 
-   The user asked for a framework by name and it fits → run it. It doesn't fit → say so in one line and run the fitting framework instead — the quality bar treats a misfit framework as a category error, and a "SWOT" request that's really "should we enter this market" is Five Forces work; run the requested framework only if the user insists after the flag. Portfolio-allocation questions across many products (BCG-matrix territory) → name it, note it needs per-product market-share and growth data, and run it only if that data is supplied.
+   The user asked for a framework by name and it fits → run it. It doesn't fit → say so in one line and run the fitting framework instead — the quality bar treats a misfit framework as a category error, and a "SWOT" request that's really "should we enter this market" is Five Forces work; then give the framework they asked for as well, after it and shorter (a SWOT still arrives as TOWS). They asked for it by name, and a reply that withholds it reads as not listening. Portfolio-allocation questions across many products (BCG-matrix territory) → name it, note it needs per-product market-share and growth data, and run it only if that data is supplied.
 
 2. **Collect the evidence base before filling anything.** Name what is known `[data: …]`, reported `[reported by …]`, drawn from general market knowledge `[market: …]`, and assumed `[assumption]`. The `[market: …]` tag exists because on a short prompt most cells are filled from the model's own market knowledge — that's legitimate, but it must stay distinguishable from the user's facts and from guesses. Ask at most 2 questions, spent on the decision the analysis feeds ("what decision does this inform, and by when?") and the competitive set ("who do customers actually compare you to?"). No decision named → the analysis has no ranking criterion; get one before proceeding. Non-interactive run (no user to ask): derive the most plausible decision from the input, state it as `[assumption]` at the top, and rank against it; none derivable → emit `BLOCKED: need the decision this analysis feeds` rather than an unranked survey.
 

package/packs/product-manager/skills/strategy-analysis/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "strategy-analysis",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Run a strategy framework — SWOT/TOWS, Porter's Five Forces, or PESTLE — on a product, company, or market question, choosing the right framework for the question and forcing every cell to carry evidence and a so-what. Use when the user asks for a SWOT, a competitive/market analysis, \"should we enter this market\", \"what's our position against X\", or a macro-environment scan.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/product-manager/skills/success-metrics/SKILL.md

@@ -61,3 +61,5 @@ Answers "how will we know it worked?" *before* build, when the answer can still
 - ❌ **Post-hoc decision rules.** Deciding what the numbers must show *after* seeing them — the moment measurement becomes marketing.
 - ❌ **Ignoring the patience window.** Judging at day 7 what needs a 60-day cohort — novelty spikes and weekly cycles read as signal.
 - ❌ **Proxy laundering.** Using clicks as a proxy for value and then forgetting it's a proxy — label proxies as proxies, every time they're cited.
+- ❌ **Showing the machinery.** The reply and the artifact are for the person who asked. Don't mention this skill, its files, templates, caps or internal terms, or that the run is non-interactive. Name another skill once, at the end, as a suggested next step, never inside the artifact.
+- ❌ **A bare `BLOCKED` line.** Keep the `BLOCKED: need <X>` line, then write for a person: what is missing in plain words, what you will produce once you have it, and anything the request already lets you say.

package/packs/product-manager/skills/success-metrics/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "success-metrics",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Define how a feature's success will be measured before it's built — one primary metric with target, timeframe, and baseline; guardrail and counter-metrics; an instrumentation plan naming every event; and a pre-committed decision rule for what happens if the target is missed. Use when the user asks \"how do we know this worked\", needs KPIs or success criteria for a feature, or wants a measurement/instrumentation plan before launch.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },