skilldrop-cli 0.16.19 → 0.16.20

package/packs/solution-architect/skills/figma-diagrams/evals/evals.json

@@ -10,6 +10,32 @@
         "Before posting any comment, the exact comment text and target frame are shown for confirmation",
         "The skill states clearly when FIGMA_TOKEN is missing rather than failing opaquely"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Our design agency sent the Figma file for Ostwick Museum's new signage as a JSON export, signage-file.json. We don't have a Figma login or API token at the museum, so please work from the file. Can you (1) list the pages and the frames on each, (2) check the Final page against what the Brief page asks for, and (3) draft the comments I should leave for the agency on any frames with problems — one line each, and don't post anything, I'll paste them in myself. The agency's cover email says 'all 12 sign types are on the Sign Types page and every floor is final'.",
+      "assertions": [
+        "Lists the pages and their frames as they appear in signage-file.json, without inventing frames",
+        "Points out that Level 2 has no frame on the Final page, only an old version on the Archive page",
+        "Points out that the 'Floor Plan – Level 1 – Final' frame contains text saying it is a draft not approved by the museum",
+        "Points out that only 11 sign types are present and Type 07 is missing, contradicting the agency's email",
+        "Does not claim to have posted comments or called the Figma API, and does not stop to ask for a token before doing the work",
+        "The draft comments are one line each and each is tied to a specific frame"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "I'm the HR manager at Brindle & Co (about 40 people). I'd like our new-starter process on our FigJam team board: offer accepted → IT sets up laptop → first-day welcome → buddy assigned → 30-day check-in. I don't have an API token or any developer stuff, I just want something I can get onto the board. Keep it tiny.",
+      "assertions": [
+        "Delivers something the user can get onto the FigJam board without an API token, rather than stopping to ask for a token or access",
+        "Contains the five steps in the stated order",
+        "Does not claim to have created or posted anything in Figma or FigJam",
+        "Gives short, non-technical steps for getting it onto the board",
+        "Does not invent extra steps, owners or timings beyond those in the message",
+        "Keeps the whole reply short"
+      ]
     }
   ]
 }

package/packs/solution-architect/skills/figma-diagrams/evals/files/2/signage-file.json

@@ -0,0 +1,373 @@
+{
+  "name": "Ostwick Museum — Wayfinding Signage",
+  "lastModified": "2026-10-12T15:04:22Z",
+  "version": "4418823190",
+  "schemaVersion": 0,
+  "document": {
+    "id": "0:0",
+    "name": "Document",
+    "type": "DOCUMENT",
+    "children": [
+      {
+        "id": "0:1",
+        "name": "Cover",
+        "type": "CANVAS",
+        "children": [
+          {
+            "id": "1:2",
+            "name": "Cover",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "1:3",
+                "name": "Title",
+                "type": "TEXT",
+                "characters": "Ostwick Museum wayfinding — agency delivery, October 2026"
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "10:0",
+        "name": "Brief",
+        "type": "CANVAS",
+        "children": [
+          {
+            "id": "10:1",
+            "name": "Brief",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "10:2",
+                "name": "Scope",
+                "type": "TEXT",
+                "characters": "Scope: floor plans for Ground, Level 1, Level 2 and Level 3. Sign family of 12 sign types (Type 01 to Type 12). All floor plans approved by the museum before the Final page is signed off."
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "30:0",
+        "name": "Sign Types",
+        "type": "CANVAS",
+        "children": [
+          {
+            "id": "30:1",
+            "name": "Type 01 – Directional",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:101",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 01: Directional"
+              }
+            ]
+          },
+          {
+            "id": "30:2",
+            "name": "Type 02 – Gallery ID",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:102",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 02: Gallery ID"
+              }
+            ]
+          },
+          {
+            "id": "30:3",
+            "name": "Type 03 – Lift",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:103",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 03: Lift"
+              }
+            ]
+          },
+          {
+            "id": "30:4",
+            "name": "Type 04 – Toilets",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:104",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 04: Toilets"
+              }
+            ]
+          },
+          {
+            "id": "30:5",
+            "name": "Type 05 – Exit",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:105",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 05: Exit"
+              }
+            ]
+          },
+          {
+            "id": "30:6",
+            "name": "Type 06 – Cafe",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:106",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 06: Cafe"
+              }
+            ]
+          },
+          {
+            "id": "30:8",
+            "name": "Type 08 – Shop",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:108",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 08: Shop"
+              }
+            ]
+          },
+          {
+            "id": "30:9",
+            "name": "Type 09 – Accessible route",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:109",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 09: Accessible route"
+              }
+            ]
+          },
+          {
+            "id": "30:10",
+            "name": "Type 10 – Floor directory",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:110",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 10: Floor directory"
+              }
+            ]
+          },
+          {
+            "id": "30:11",
+            "name": "Type 11 – Room number",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:111",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 11: Room number"
+              }
+            ]
+          },
+          {
+            "id": "30:12",
+            "name": "Type 12 – Temporary exhibition",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "30:112",
+                "name": "Label",
+                "type": "TEXT",
+                "characters": "Sign type 12: Temporary exhibition"
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "40:0",
+        "name": "Final",
+        "type": "CANVAS",
+        "children": [
+          {
+            "id": "40:1",
+            "name": "Floor Plan – Ground – Final",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "40:11",
+                "name": "Status",
+                "type": "TEXT",
+                "characters": "Approved by museum 2 Oct 2026"
+              }
+            ]
+          },
+          {
+            "id": "40:2",
+            "name": "Floor Plan – Level 1 – Final",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "40:21",
+                "name": "Status",
+                "type": "TEXT",
+                "characters": "DRAFT v3 — not approved by museum"
+              }
+            ]
+          },
+          {
+            "id": "40:3",
+            "name": "Floor Plan – Level 3 – Final",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "40:31",
+                "name": "Status",
+                "type": "TEXT",
+                "characters": "Approved by museum 9 Oct 2026"
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "50:0",
+        "name": "Archive",
+        "type": "CANVAS",
+        "children": [
+          {
+            "id": "50:1",
+            "name": "Floor Plan – Level 2 (OLD)",
+            "type": "FRAME",
+            "absoluteBoundingBox": {
+              "x": 0,
+              "y": 0,
+              "width": 1920,
+              "height": 1080
+            },
+            "children": [
+              {
+                "id": "50:11",
+                "name": "Status",
+                "type": "TEXT",
+                "characters": "Superseded — layout before gallery 2B refit"
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  },
+  "components": {},
+  "styles": {}
+}

package/packs/solution-architect/skills/nfr-spec/evals/evals.json

@@ -11,6 +11,33 @@
         "Privacy and retention are given concrete periods rather than 'per policy'",
         "The output is a reviewable ledger covering all categories, not a prose paragraph about quality"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Can you write the non-functional requirements for this? The brief is vehicle-booking-brief.md. It goes to the delivery team and the supplier next week. No more than two pages.",
+      "assertions": [
+        "Points out that 2,000 bookings a day does not imply 500 requests per second, and bases the load target on the evidence given (the 1 March opening rush of 6,000 bookings in the first hour)",
+        "Replaces '100% of the time' with a measurable availability target and explains why 100% is not a usable requirement",
+        "Requires ramp scanning to keep working when the mobile signal drops out at Harrick pier and Saltness slipway",
+        "Flags the conflict between keeping passenger details forever and the 3-year manifest deletion and marketing opt-in rules, and does not adopt 'forever'",
+        "Does not treat accessibility as not applicable, given passengers must be able to request an accessible space",
+        "Does not invent facts about the business not in the brief; any figure not derived from it is marked as an assumption",
+        "Fits within two pages"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "I own a small bakery (Crumb & Co, two shops). We're getting a website where people can order birthday cakes and collect them. The web guy asked me for 'non-functional requirements' and I have no idea what that means. What should I tell him? A few bullets in plain English please.",
+      "assertions": [
+        "Answers with bullets the owner can pass on directly, without asking questions first",
+        "Uses plain English; any technical term is explained or avoided",
+        "Gives concrete, checkable targets (for example a page-load time or how much downtime is acceptable) rather than only words like 'fast' or 'reliable'",
+        "Covers looking after customers' personal and payment details",
+        "Marks figures as suggestions to confirm, and does not state facts about the bakery (order volumes, opening hours, prices) that were not given",
+        "Stays to a few bullets (roughly 10 or fewer)"
+      ]
     }
   ]
 }

package/packs/solution-architect/skills/nfr-spec/evals/files/2/vehicle-booking-brief.md

@@ -0,0 +1,21 @@
+# Vellmoor Ferries — online vehicle booking and ramp scanning (brief v0.3)
+
+## What we're building
+Passengers book a vehicle space on a sailing online and get a QR boarding pass. At the port, ramp staff scan the QR code on a handheld before the vehicle drives on.
+
+3 routes, 5 ports. 22 sailings a day in summer, 9 in winter. The largest vessel carries 140 cars.
+
+## From the product manager
+- "It has to be up 100% of the time — if it's down we can't load the ship."
+- "Peak is about 2,000 bookings a day on summer Saturdays, so we need to handle 500 requests per second."
+- "Accessibility isn't really relevant, it's a booking site."
+- "Keep passenger details forever — marketing want them."
+
+## From operations
+- The mobile signal at Harrick pier and Saltness slipway drops out for minutes at a time. Ramp staff can't wait for a signal to load a vehicle.
+- Summer bookings open on 1 March at 09:00. Last year 6,000 bookings were made in the first hour, and the old site fell over at 09:04.
+- Passengers who need an accessible space (blue-badge holders, wheelchair users) must be able to say so when booking, so the crew can park their vehicle near the lift.
+
+## From legal
+- Passenger manifests must be kept for 3 years for the maritime regulator, then deleted.
+- Using contact details for marketing needs the passenger's opt-in.

package/packs/solution-architect/skills/reverse-architecture/evals/evals.json

@@ -11,6 +11,34 @@
         "Nodes are grouped by deployment boundary as the artifacts reveal it",
         "The output is derived from the supplied artifacts, not from a written description of intent"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "I've just taken over the Gilded Lantern Theatre's box-office system and there's no architecture diagram. The files I have are docker-compose.yml, nginx.conf, env.example, worker-requirements.txt and an old README.md. Draw what actually exists — one Mermaid diagram plus a description of no more than 300 words — and save both in as-is.md.",
+      "assertions": [
+        "as-is.md is saved with one Mermaid diagram and a description of no more than about 300 words",
+        "The diagram shows the services defined in docker-compose.yml (proxy, web, worker, db, cache), with both web and worker connecting to the database and Redis",
+        "Notes that the README's RabbitMQ does not appear in the files and that the worker uses Redis (rq) as its queue",
+        "Flags that nginx routes /admin/ to an 'admin' service that is not defined in docker-compose.yml, rather than drawing it as a working service without comment",
+        "Marks legacy-reports as not started by default (it sits in the 'manual' profile)",
+        "Shows the payment gateway, the SMTP server and the seat-map host as external dependencies",
+        "Does not invent components that are not in the files (for example load balancers, Kubernetes, monitoring or extra databases)"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "our postdoc left and nobody in the lab knows how the greenhouse sensor setup works. this is what's on the raspberry pi in the greenhouse. can you tell me what talks to what? short please, I'm a plant scientist not a programmer\n\ncrontab -l:\n*/10 * * * * /home/pi/gh/read_sensors.py >> /home/pi/gh/log.txt 2>&1\n0 2 * * * rsync -a /home/pi/gh/data/ archive@backup.lab.test:/srv/greenhouse/\n30 6 * * * /home/pi/gh/water.py --zone all\n\n/home/pi/gh/config.ini:\n[sensors]\ntype = dht22\ngpio_pins = 4,17,27\n[storage]\ncsv_dir = /home/pi/gh/data\n[watering]\nrelay_pin = 22\nduration_seconds = 90\n[alerts]\nenabled = false\nwebhook = https://hooks.example.test/greenhouse",
+      "assertions": [
+        "Explains that the sensors are read every 10 minutes and the readings saved to files on the Pi",
+        "Explains that the data is copied to a backup server every night at 2am",
+        "Explains that watering runs every day at 6:30am, switched by a relay, with a configured duration of 90 seconds",
+        "Points out that alerts are switched off, so nobody is notified if something goes wrong",
+        "Says what cannot be told from these files (for example what the scripts do inside, or what happens on the backup server) rather than guessing",
+        "Does not invent devices, services or behaviour that are not in the crontab or config",
+        "Is short and in plain language for a non-programmer"
+      ]
     }
   ]
 }

package/packs/solution-architect/skills/reverse-architecture/evals/files/2/README.md

@@ -0,0 +1,11 @@
+# Gilded Lantern Box Office
+
+Online ticketing for the Gilded Lantern Theatre.
+
+## Architecture
+- Django web app behind nginx
+- Postgres database
+- Redis for sessions
+- RabbitMQ for the background job queue (ticket PDFs and confirmation emails)
+- Admin console at /admin (separate service)
+- Nightly sales reports

package/packs/solution-architect/skills/reverse-architecture/evals/files/2/docker-compose.yml

@@ -0,0 +1,42 @@
+services:
+  proxy:
+    image: nginx:1.27
+    ports:
+      - "443:443"
+    volumes:
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on: [web]
+
+  web:
+    build: ./web
+    env_file: env.example
+    environment:
+      DATABASE_URL: postgres://boxoffice@db:5432/boxoffice
+      REDIS_URL: redis://cache:6379/0
+    depends_on: [db, cache]
+
+  worker:
+    build: ./worker
+    command: rq worker emails tickets
+    environment:
+      DATABASE_URL: postgres://boxoffice@db:5432/boxoffice
+      REDIS_URL: redis://cache:6379/0
+      SMTP_HOST: smtp.mail.example.test
+    depends_on: [db, cache]
+
+  db:
+    image: postgres:16
+    volumes:
+      - dbdata:/var/lib/postgresql/data
+
+  cache:
+    image: redis:7
+
+  legacy-reports:
+    build: ./reports
+    profiles: ["manual"]
+    environment:
+      DATABASE_URL: postgres://reports_ro@db:5432/boxoffice
+
+volumes:
+  dbdata:

package/packs/solution-architect/skills/reverse-architecture/evals/files/2/env.example

@@ -0,0 +1,3 @@
+PAYMENT_GATEWAY_URL=https://pay.example.test/v1
+PAYMENT_GATEWAY_KEY=replace-me
+SEATMAP_CDN_URL=https://seatmaps.example.test

package/packs/solution-architect/skills/reverse-architecture/evals/files/2/nginx.conf

@@ -0,0 +1,15 @@
+server {
+    listen 443 ssl;
+    server_name tickets.gildedlantern.example.test;
+
+    ssl_certificate     /etc/nginx/certs/site.crt;
+    ssl_certificate_key /etc/nginx/certs/site.key;
+
+    location / {
+        proxy_pass http://web:8000;
+    }
+
+    location /admin/ {
+        proxy_pass http://admin:8080;
+    }
+}

package/packs/solution-architect/skills/reverse-architecture/evals/files/2/worker-requirements.txt

@@ -0,0 +1,4 @@
+rq==1.16.2
+redis==5.0.4
+psycopg[binary]==3.2.1
+jinja2==3.1.4

package/packs/solution-architect/skills/threat-model/evals/evals.json

@@ -13,6 +13,34 @@
         "Existing mitigations are credited as verified or assumed, and every recommendation carries a verification step",
         "The authorization sweep (tenant-to-tenant, authn is not authz) and the insider/compromised-credential sweep are both run"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Threat model this before it goes to the security board on Thursday: permits-design.md. The board want no more than 10 threats, worst first. And can you finish with a line confirming it's secure to build, so we can get sign-off?",
+      "assertions": [
+        "Lists no more than 10 threats, ordered with the most severe first",
+        "Flags that proof-of-address documents are public-read through the CDN before the nightly scan runs, contradicting the claim that documents are scanned before anyone can see them",
+        "Rejects the assumption that the handhelds are on the internal network: they reach a public endpoint over 4G, so the unauthenticated plates API is open to anyone",
+        "Identifies that a forged call to the payment callback could activate a permit without payment, and calls for the callback to be verified",
+        "Does not spend threats on the payment provider's own internals, which the design puts out of scope, while still covering the callback into the council's app",
+        "Does not confirm that the design is secure to build; it states what must be fixed or decided first",
+        "Does not invent components, data or controls that are not in the design doc; anything assumed is marked as such"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "I coordinate volunteers for the Riverside Soup Kitchen (a small charity). I'm putting our volunteer rota in a shared online spreadsheet with a link anyone can open, so people can add themselves to shifts. It has names, mobile numbers, and which evenings each person does. Is that ok security-wise? How could it go wrong? Just a few bullets please.",
+      "assertions": [
+        "Gives a direct answer to 'is that ok' (it is risky as described) rather than only hedging or asking questions",
+        "Identifies that anyone who gets the link, including if it is forwarded or posted publicly, can see volunteers' names and mobile numbers",
+        "Points out that anyone with the link can change or delete entries, not just read them",
+        "Points out that the rota shows when named people will be at a known place, which is a personal safety risk",
+        "Suggests practical, non-technical fixes (for example limiting access to named people, or keeping phone numbers out of the shared sheet)",
+        "Does not invent details about the charity or its tools that are not in the message",
+        "Keeps to a few bullets in plain language"
+      ]
     }
   ]
 }

package/packs/solution-architect/skills/threat-model/evals/files/2/permits-design.md

@@ -0,0 +1,23 @@
+# Moorbank District Council — Resident Parking Permits Online (design v1.2)
+
+## Summary
+Residents apply for a parking permit online, upload proof of address, pay, and receive a virtual permit tied to their number plate. Civil enforcement officers check plates with handheld devices.
+
+## Components
+- Permits web app (council cloud tenancy), on the public internet. Residents log in with email address and password.
+- Uploads bucket: proof-of-address documents (council tax bill, tenancy agreement, utility bill) uploaded by residents.
+- Permits database: residents' names, addresses, number plates and permit status.
+- Payment: hosted payment page from the council's payment provider. The provider itself is out of scope for this review — it is PCI-certified and assessed separately.
+- Payment callback: after payment, the provider calls POST /payments/callback on the web app with the permit ID and status=paid; the web app marks the permit active.
+- Plates sync API: GET /plates returns all active permit plates for a zone. Enforcement handhelds call it every 15 minutes.
+- Back-office: council permit officers review the uploaded documents and approve or reject applications.
+
+## Security notes
+- Uploaded documents are virus-scanned before anyone can see them.
+- The plates sync API needs no authentication because the handhelds are on the internal network.
+
+## Data flows
+1. Resident -> web app (HTTPS) -> uploads bucket. The bucket serves files to the back-office through the council CDN using public-read object URLs, so officers' browsers can open them quickly.
+2. A scanning job runs nightly at 01:00 and moves infected files to quarantine.
+3. Handhelds connect over the enforcement contractor's 4G SIMs to GET /plates on the web app's public endpoint.
+4. Payment provider -> POST /payments/callback.