skilldrop-cli 0.16.34 → 0.16.36

package/packs/ai-engineering/skills/agent-incident-response/scripts/find_secret_exposure.py

@@ -0,0 +1,239 @@
+#!/usr/bin/env python3
+"""Find where a leaked key appears in a repository's git history and in log files.
+
+Read-only. Never prints the key: every match is shown masked (first 8 characters,
+an ellipsis, the last 4, and the length). Identify the key by a prefix you already
+know (--prefix, optionally with --suffix for the last characters) or by piping the
+full key on stdin (--key-stdin) so it never lands in shell history.
+
+    python3 find_secret_exposure.py --prefix sk-live-AbCdEf12 --repo . --log ci.txt
+    printf '%s' "$LEAKED" | python3 find_secret_exposure.py --key-stdin --repo .
+
+Reports: commits that added or removed it (author and commit time, UTC), whether the
+current tree and working copy still hold it, which branches and tags still reach the
+adding commits, commits reachable only from the local reflog, and every log line that
+holds it with the line's own timestamp. Writes only the -o path when given.
+"""
+import argparse
+import datetime as dt
+import os
+import re
+import subprocess
+import sys
+
+TOKEN_CHARS = r"[A-Za-z0-9_\-+/=.]"
+STAMP = re.compile(
+    r"(\d{4}-\d{2}-\d{2})[T ](\d{2}:\d{2}:\d{2})(?:\.\d+)?(Z|[+-]\d{2}:?\d{2})?"
+)
+MIN_PREFIX = 10
+
+
+def mask(token):
+    if len(token) <= 12:
+        return token[:4] + "…" + " (len %d)" % len(token)
+    return "%s…%s (len %d)" % (token[:8], token[-4:], len(token))
+
+
+class Needle:
+    def __init__(self, prefix=None, suffix=None, full=None):
+        self.full = full
+        self.prefix = full[:12] if full else prefix
+        self.suffix = suffix
+        self.rx = re.compile(re.escape(self.prefix) + TOKEN_CHARS + "*")
+        self.seen = set()
+
+    def tokens(self, text):
+        """Masked tokens in text that match the key."""
+        out = []
+        for m in self.rx.finditer(text):
+            tok = m.group(0).rstrip(".=")  # trailing punctuation from prose or logs
+            if self.full and self.full not in m.group(0):
+                continue
+            if self.suffix and not tok.endswith(self.suffix):
+                continue
+            out.append(mask(self.full if self.full else tok))
+        self.seen.update(out)
+        return out
+
+
+def utc(epoch):
+    return dt.datetime.fromtimestamp(int(epoch), dt.timezone.utc).strftime("%Y-%m-%d %H:%M:%SZ")
+
+
+def line_stamp(line):
+    m = STAMP.search(line)
+    if not m:
+        return "no timestamp on the line"
+    day, clock, tz = m.groups()
+    if not tz:
+        return "%s %s (no timezone on the line)" % (day, clock)
+    tz = "+00:00" if tz == "Z" else (tz if ":" in tz else tz[:3] + ":" + tz[3:])
+    try:
+        when = dt.datetime.fromisoformat("%sT%s%s" % (day, clock, tz))
+    except ValueError:
+        return "%s %s%s (unparsed)" % (day, clock, tz)
+    return when.astimezone(dt.timezone.utc).strftime("%Y-%m-%d %H:%M:%SZ")
+
+
+def git(repo, *args):
+    r = subprocess.run(["git", "-C", repo] + list(args), capture_output=True)
+    return r.returncode, r.stdout.decode("utf-8", "replace"), r.stderr.decode("utf-8", "replace")
+
+
+def scan_repo(repo, needle):
+    rc, _, err = git(repo, "rev-parse", "--git-dir")
+    if rc != 0:
+        return None, "not a git repository: %s (%s)" % (repo, err.strip())
+    rc, out, err = git(
+        repo, "log", "--all", "--reflog", "--no-color", "--no-ext-diff", "-p",
+        "-S" + needle.prefix, "--format=%x00COMMIT %H %at %ct",
+    )
+    if rc != 0:
+        return None, "git log failed: %s" % err.strip()
+    commits, cur, path = [], None, None
+    for line in out.splitlines():
+        if line.startswith("\x00COMMIT "):
+            sha, at, ct = line.split()[1:4]
+            cur = {"sha": sha, "authored": utc(at), "committed": utc(ct), "added": [], "removed": []}
+            commits.append(cur)
+        elif cur is None:
+            continue
+        elif line.startswith("diff --git "):
+            path = line.split(" b/", 1)[-1]
+        elif line.startswith("+") and not line.startswith("+++"):
+            if needle.tokens(line):
+                cur["added"].append(path)
+        elif line.startswith("-") and not line.startswith("---"):
+            if needle.tokens(line):
+                cur["removed"].append(path)
+    commits = [c for c in commits if c["added"] or c["removed"]]
+    for c in commits:
+        c["added"], c["removed"] = sorted(set(c["added"])), sorted(set(c["removed"]))
+        if c["added"]:
+            _, b, _ = git(repo, "branch", "-a", "--contains", c["sha"])
+            _, t, _ = git(repo, "tag", "--contains", c["sha"])
+            c["refs"] = [x.strip("* ").strip() for x in b.splitlines() if x.strip()]
+            c["refs"] += ["tag " + x.strip() for x in t.splitlines() if x.strip()]
+    present = {}
+    for label, args in (("HEAD", ["grep", "-n", "-I", "-F", "-e", needle.prefix, "HEAD", "--"]),
+                        ("working copy", ["grep", "-n", "-I", "-F", "--untracked", "-e", needle.prefix])):
+        _, g, _ = git(repo, *args)
+        hits = []
+        for gl in g.splitlines():
+            parts = gl.split(":", 3 if label == "HEAD" else 2)
+            loc = ":".join(parts[1:3]) if label == "HEAD" else ":".join(parts[0:2])
+            if needle.tokens(gl):
+                hits.append(loc)
+        present[label] = hits
+    return {"commits": commits, "present": present}, None
+
+
+def scan_log(path, needle):
+    hits = []
+    with open(path, "r", encoding="utf-8", errors="replace") as fh:
+        for n, line in enumerate(fh, 1):
+            toks = needle.tokens(line)
+            if toks:
+                hits.append((n, line_stamp(line), toks[0]))
+    return hits
+
+
+def report(args, needle, repo_res, repo_err, logs):
+    o = ["# Where the key appears", ""]
+    if len(needle.seen) > 1:
+        o += ["%d different keys match this prefix: %s. Pass --suffix with the leaked key's last "
+              "characters to keep only that one." % (len(needle.seen), ", ".join(sorted(needle.seen))), ""]
+    if args.repo:
+        o.append("## Git history: %s" % args.repo)
+        if repo_err:
+            o += ["", "Not scanned: " + repo_err]
+        else:
+            cs = repo_res["commits"]
+            adds = [c for c in cs if c["added"]]
+            if not cs:
+                o += ["", "No commit adds or removes it (searched every branch, tag, stash and the local reflog)."]
+            if adds:
+                first = min(adds, key=lambda c: c["authored"])
+                o += ["", "First commit that adds it: `%s`, authored %s, committed %s. Commit time is "
+                      "when it was committed locally; when it reached a remote is in the host's audit or push log."
+                      % (first["sha"][:12], first["authored"], first["committed"])]
+            for c in cs:
+                o.append("")
+                o.append("- `%s` authored %s, committed %s" % (c["sha"][:12], c["authored"], c["committed"]))
+                if c["added"]:
+                    o.append("  - adds it in: %s" % ", ".join(c["added"]))
+                    o.append("  - still reachable from: %s" % (", ".join(c["refs"]) if c["refs"]
+                             else "no branch or tag; only the local reflog keeps it"))
+                if c["removed"]:
+                    o.append("  - removes it from: %s (the earlier commits still hold it)" % ", ".join(c["removed"]))
+            for label, hits in repo_res["present"].items():
+                o.append("")
+                o.append("In %s now: %s" % (label, ", ".join(hits) if hits else "not present"))
+        o.append("")
+    for path, hits, err in logs:
+        o.append("## Log: %s" % path)
+        o.append("")
+        if err:
+            o.append("Not scanned: " + err)
+        elif not hits:
+            o.append("Not found.")
+        else:
+            for n, stamp, tok in hits:
+                o.append("- line %d, %s, %s" % (n, stamp, tok))
+        o.append("")
+    o += ["## Not searched", "",
+          "Forks, other clones, pull-request refs that were never fetched, CI caches and artifacts, "
+          "the hosting provider's own copies, chat and ticket systems. A clean result here does not "
+          "mean the key is safe: revoke it regardless.", ""]
+    return "\n".join(o)
+
+
+def main(argv=None):
+    p = argparse.ArgumentParser(description=__doc__.split("\n\n")[0])
+    who = p.add_mutually_exclusive_group(required=True)
+    who.add_argument("--prefix", help="the first characters of the key (at least %d)" % MIN_PREFIX)
+    who.add_argument("--key-stdin", action="store_true", help="read the full key from stdin")
+    p.add_argument("--suffix", help="the last characters of the key, to tell it apart from keys with the same prefix")
+    p.add_argument("--repo", help="path to a git repository to search")
+    p.add_argument("--log", action="append", default=[], help="a log file to search (repeatable)")
+    p.add_argument("-o", "--out", help="write the report here instead of stdout")
+    a = p.parse_args(argv)
+    if a.key_stdin:
+        full = sys.stdin.read().strip()
+        if len(full) < MIN_PREFIX:
+            p.error("the key on stdin is shorter than %d characters" % MIN_PREFIX)
+        needle = Needle(full=full)
+    else:
+        if len(a.prefix) < MIN_PREFIX:
+            p.error("--prefix needs at least %d characters: a short prefix such as a provider's "
+                    "key-type marker matches every key of that type" % MIN_PREFIX)
+        needle = Needle(prefix=a.prefix, suffix=a.suffix)
+    if not a.repo and not a.log:
+        p.error("give --repo, --log, or both")
+    repo_res, repo_err = (None, None)
+    if a.repo:
+        if not os.path.isdir(a.repo):
+            repo_err = "no such directory: %s" % a.repo
+        else:
+            repo_res, repo_err = scan_repo(a.repo, needle)
+    logs = []
+    for path in a.log:
+        if not os.path.isfile(path):
+            logs.append((path, [], "no such file"))
+            continue
+        try:
+            logs.append((path, scan_log(path, needle), None))
+        except OSError as e:
+            logs.append((path, [], str(e)))
+    text = report(a, needle, repo_res, repo_err, logs)
+    if a.out:
+        with open(a.out, "w", encoding="utf-8") as fh:
+            fh.write(text)
+        print("wrote %s" % a.out)
+    else:
+        print(text)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/packs/ai-engineering/skills/agent-incident-response/scripts/usage_split.py

@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+"""Split a provider usage or billing export (CSV) by who spent it.
+
+Read-only. Sums cost exactly (decimal, not float) per group of columns, so a bill
+is split from the export rather than estimated. Groups by the key, model and
+user-agent columns it finds (override with --by). Each group shows its total,
+its share of the whole, its row and request counts, and the time of its first and
+last row as written in the export.
+
+    python3 usage_split.py usage.csv
+    python3 usage_split.py usage.csv --since 2026-10-19T20:00 --expect model=model-medium
+    python3 usage_split.py usage.csv --by api_key_name,user_agent -o split.txt
+    cat usage.csv | python3 usage_split.py -
+
+--expect col=value (repeatable) marks every group whose value in that column
+differs as UNEXPECTED: traffic the known job does not explain. --since/--until
+compare the time column as text, so give them in the export's own format.
+Writes only the -o path when given.
+"""
+import argparse
+import csv
+import io
+import sys
+from decimal import Decimal, InvalidOperation
+
+COST_HINTS = ("cost_usd", "cost", "amount_usd", "amount", "spend", "usd", "price")
+TIME_HINTS = ("date_hour_utc", "timestamp", "time", "hour", "date", "start_time", "period")
+REQ_HINTS = ("requests", "request_count", "num_requests", "calls")
+GROUP_HINTS = (
+    ("api_key_name", "api_key", "key_name", "key_id", "key"),
+    ("model", "model_name", "model_id"),
+    ("user_agent", "useragent", "ua", "client"),
+)
+
+
+def find_col(headers, hints, contains=False):
+    low = {h.lower().strip(): h for h in headers}
+    for hint in hints:
+        if hint in low:
+            return low[hint]
+    if contains:
+        for hint in hints:
+            for key, orig in low.items():
+                if hint in key:
+                    return orig
+    return None
+
+
+def to_decimal(text):
+    cleaned = (text or "").strip().replace("$", "").replace(",", "")
+    if cleaned == "":
+        return Decimal("0")
+    return Decimal(cleaned)
+
+
+def money(value):
+    return "${:,.2f}".format(value)
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    ap.add_argument("export", help="CSV usage export path, or - for stdin")
+    ap.add_argument("--by", help="comma-separated columns to group by (default: key, model, user agent)")
+    ap.add_argument("--cost", help="cost column name (default: auto-detect)")
+    ap.add_argument("--time", help="time column name (default: auto-detect)")
+    ap.add_argument("--since", help="keep rows whose time is >= this text")
+    ap.add_argument("--until", help="keep rows whose time is < this text")
+    ap.add_argument("--expect", action="append", default=[], metavar="COL=VALUE",
+                    help="mark groups whose COL differs from VALUE as UNEXPECTED")
+    ap.add_argument("-o", "--output", help="write the report to this path instead of stdout")
+    args = ap.parse_args(argv)
+
+    if args.export == "-":
+        text = sys.stdin.read()
+    else:
+        try:
+            with open(args.export, encoding="utf-8", newline="") as fh:
+                text = fh.read()
+        except OSError as exc:
+            print("error: cannot read {}: {}".format(args.export, exc), file=sys.stderr)
+            return 2
+    text = text.lstrip("")
+    reader = csv.DictReader(io.StringIO(text))
+    headers = reader.fieldnames or []
+    if not headers:
+        print("error: the export has no header row", file=sys.stderr)
+        return 2
+
+    cost_col = args.cost or find_col(headers, COST_HINTS, contains=True)
+    time_col = args.time or find_col(headers, TIME_HINTS, contains=True)
+    req_col = find_col(headers, REQ_HINTS)
+    if not cost_col or cost_col not in headers:
+        print("error: no cost column found; columns are: {}; pass --cost".format(", ".join(headers)),
+              file=sys.stderr)
+        return 2
+    if args.by:
+        group_cols = [c.strip() for c in args.by.split(",") if c.strip()]
+    else:
+        group_cols = [c for c in (find_col(headers, h) for h in GROUP_HINTS) if c]
+    missing = [c for c in group_cols if c not in headers]
+    if missing or not group_cols:
+        print("error: group columns not in the export: {}; columns are: {}".format(
+            ", ".join(missing) or "(none found)", ", ".join(headers)), file=sys.stderr)
+        return 2
+    if (args.since or args.until) and not time_col:
+        print("error: --since/--until need a time column; pass --time", file=sys.stderr)
+        return 2
+
+    expects = []
+    for item in args.expect:
+        if "=" not in item:
+            print("error: --expect takes COL=VALUE, got {!r}".format(item), file=sys.stderr)
+            return 2
+        col, val = item.split("=", 1)
+        if col not in group_cols:
+            print("error: --expect column {!r} must be one of the group columns: {}".format(
+                col, ", ".join(group_cols)), file=sys.stderr)
+            return 2
+        expects.append((col, val))
+
+    groups = {}
+    total = Decimal("0")
+    kept = 0
+    bad = []
+    for line_no, row in enumerate(reader, start=2):
+        when = (row.get(time_col) or "").strip() if time_col else ""
+        if args.since and when < args.since:
+            continue
+        if args.until and when >= args.until:
+            continue
+        try:
+            cost = to_decimal(row.get(cost_col))
+        except InvalidOperation:
+            bad.append(line_no)
+            continue
+        key = tuple((row.get(c) or "").strip() for c in group_cols)
+        g = groups.setdefault(key, {"cost": Decimal("0"), "rows": 0, "requests": 0,
+                                    "first": None, "last": None, "times": []})
+        g["cost"] += cost
+        g["rows"] += 1
+        if req_col:
+            try:
+                g["requests"] += int(float((row.get(req_col) or "0").replace(",", "")))
+            except ValueError:
+                pass
+        if when:
+            g["times"].append(when)
+            g["first"] = when if g["first"] is None or when < g["first"] else g["first"]
+            g["last"] = when if g["last"] is None or when > g["last"] else g["last"]
+        total += cost
+        kept += 1
+
+    out = []
+    window = ""
+    if args.since or args.until:
+        window = " ({} to {})".format(args.since or "start", args.until or "end")
+    out.append("Rows: {}{}   Total: {}".format(kept, window, money(total)))
+    out.append("Grouped by: {}   Cost column: {}{}".format(
+        ", ".join(group_cols), cost_col, "   Time column: " + time_col if time_col else ""))
+    out.append("")
+    for key, g in sorted(groups.items(), key=lambda kv: kv[1]["cost"], reverse=True):
+        share = (g["cost"] / total * 100) if total else Decimal("0")
+        label = " | ".join("{}={}".format(c, v) for c, v in zip(group_cols, key))
+        flag = ""
+        if expects:
+            off = [c for c, v in expects if key[group_cols.index(c)] != v]
+            if off:
+                flag = "  UNEXPECTED ({} differs)".format(", ".join(off))
+        out.append("{}  {}  ({:.1f}%){}".format(money(g["cost"]), label, share, flag))
+        detail = "    rows={}".format(g["rows"])
+        if req_col:
+            detail += " requests={:,}".format(g["requests"])
+        if g["first"]:
+            detail += " first={} last={}".format(g["first"], g["last"])
+        out.append(detail)
+        if g["times"] and len(g["times"]) <= 12:
+            out.append("    times: " + ", ".join(sorted(g["times"])))
+    if bad:
+        out.append("")
+        out.append("Skipped rows with an unreadable cost (CSV line numbers): " +
+                   ", ".join(str(n) for n in bad))
+    report = "\n".join(out) + "\n"
+
+    if args.output:
+        with open(args.output, "w", encoding="utf-8") as fh:
+            fh.write(report)
+        print("wrote {}".format(args.output))
+    else:
+        sys.stdout.write(report)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/packs/converters/skills/file-to-markdown/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: file-to-markdown
-description: Convert a Word document, PowerPoint deck, Excel workbook, web page, CSV, JSON, text file or PDF into clean Markdown that keeps headings, lists, tables, links, bold and italic, slide titles and speaker notes, and reports everything it dropped (images, charts, comments, formulas, tracked changes), so the content can be read, reviewed or fed to another skill. Use when the user hands over a .docx, .pptx, .xlsx, .html, .csv, .json or .pdf and says "read this", "turn this into markdown", "extract the text", or wants it critiqued or briefed.
+description: Convert a Word document, PowerPoint deck, Excel workbook, web page, CSV, JSON, text file, email (.eml or Outlook .msg) or PDF into clean Markdown that keeps headings, lists, tables, links, bold and italic, slide titles and speaker notes, and reports everything it dropped (images, charts, comments, formulas, tracked changes), so the content can be read, reviewed or fed to another skill. Use when the user hands over a .docx, .pptx, .xlsx, .html, .csv, .json, .eml, .msg or .pdf and says "read this", "turn this into markdown", "extract the text", or wants it critiqued or briefed.
 ---
 
 # file-to-markdown
@@ -46,8 +46,9 @@ or a rewrite that goes back out through `md-to-docx` or `md-to-html`.
    | `.html` | Headings, lists, tables, links, code blocks, quotes; scripts, styles and nav menus dropped |
    | `.csv` / `.tsv` | One table, delimiter detected |
    | `.json` | An array of objects becomes a table; an object becomes a key/value table plus a table per array |
+   | `.eml` / `.msg` | Subject as the title; From, To, Cc and the sent time as a table; the plain-text body (the HTML body only when there is no text one); attachments listed by name and size, not converted. Outlook `.msg` is read directly, with nothing to install |
    | `.txt` / `.md` | Passed through |
-   | `.pdf` | Through `pdftotext`. Tables from aligned columns, lists from indentation, short standalone lines as `###` headings (guessed, and said so); a table that runs onto the next page is joined into one, without the header the PDF repeats; pages with side-by-side columns are read in column order with nothing inferred. Scanned pages are read by OCR when `tesseract` is installed. No images |
+   | `.pdf` | Through `pdftotext`. Tables from aligned columns (told apart by where each word sits on the page, so two columns set close together don't merge), lists from indentation, short standalone lines as `###` headings (guessed, and said so); a table that runs onto the next page is joined into one, without the header the PDF repeats; pages with side-by-side columns are read in column order with nothing inferred. Scanned pages are read by OCR when `tesseract` is installed. No images |
 
 3. **PDF without `pdftotext`.** The script stops with install steps (`brew install poppler`
    on macOS, `sudo apt install poppler-utils` on Debian/Ubuntu). Pass those on; don't try to

package/packs/converters/skills/file-to-markdown/evals/eval_queries.json

@@ -1,4 +1,8 @@
 [
+  {
+    "query": "turn this Outlook .msg email into markdown so I can paste it into the ticket",
+    "should_trigger": true
+  },
   {
     "query": "Convert this Word doc to markdown",
     "should_trigger": true

package/packs/converters/skills/file-to-markdown/manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "file-to-markdown",
-  "version": "0.2.0",
-  "description": "Convert a Word document, PowerPoint deck, Excel workbook, web page, CSV, JSON, text file or PDF into clean Markdown that keeps headings, lists, tables, links, bold and italic, slide titles and speaker notes, and reports everything it dropped (images, charts, comments, formulas, tracked changes), so the content can be read, reviewed or fed to another skill. Use when the user hands over a .docx, .pptx, .xlsx, .html, .csv, .json or .pdf and says \"read this\", \"turn this into markdown\", \"extract the text\", or wants it critiqued or briefed.",
+  "version": "0.3.0",
+  "description": "Convert a Word document, PowerPoint deck, Excel workbook, web page, CSV, JSON, text file, email (.eml or Outlook .msg) or PDF into clean Markdown that keeps headings, lists, tables, links, bold and italic, slide titles and speaker notes, and reports everything it dropped (images, charts, comments, formulas, tracked changes), so the content can be read, reviewed or fed to another skill. Use when the user hands over a .docx, .pptx, .xlsx, .html, .csv, .json, .eml, .msg or .pdf and says \"read this\", \"turn this into markdown\", \"extract the text\", or wants it critiqued or briefed.",
   "entrypoint": "SKILL.md",
   "deps": {
     "npm": [],