skilldrop-cli 0.16.42 → 0.16.44

package/packs/design/skills/marketing-flyer/scripts/build_flyer.py

@@ -79,9 +79,14 @@ def data_uri(path, label):
 
 def load_json(path):
     try:
-        return json.loads(Path(path).read_text(encoding="utf-8"))
+        data = json.loads(Path(path).read_text(encoding="utf-8-sig"))
     except (OSError, json.JSONDecodeError) as e:
         die(f"cannot read {path}: {e}")
+    except UnicodeDecodeError:
+        die(f"cannot read {path}: it is not UTF-8 text; save it as UTF-8")
+    if not isinstance(data, dict):
+        die(f"cannot read {path}: expected a JSON object {{...}}, got a {type(data).__name__}")
+    return data
 
 
 def resolve(base, ref):
@@ -164,9 +169,13 @@ def build(spec_path, out_path, brand_ref=None):
     if isinstance(cta, list):
         warn("more than one call to action; a flyer gets one — using the first")
         cta = cta[0] if cta else None
+    if isinstance(cta, str):
+        cta = {"text": cta}
     if not cta:
         warn("no call to action — what should a reader do next?")
     img = spec.get("image") or {}
+    if isinstance(img, str):
+        img = {"path": img}
     hero = data_uri(resolve(base, img.get("path")), "image") if isinstance(img, dict) else data_uri(resolve(base, img), "image")
     if hero and isinstance(img, dict) and not img.get("alt"):
         warn("image has no alt text")

package/packs/dev-team/skills/behaviour-equivalence/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "behaviour-equivalence",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Prove that a rewritten, migrated or refactored component behaves the same as the old one with a golden-master comparison — record inputs and outputs at a boundary (HTTP, function calls, batch files, DB writes, events) from production-shaped traffic and edge cases, run the old system twice to find its nondeterminism, normalise narrowly field by field, replay against the new one, triage every difference as defect, intended change (with a named approver) or missing normalisation, and give a verdict of EQUIVALENT, EQUIVALENT EXCEPT LISTED CHANGES, NOT EQUIVALENT or NOT PROVEN. Use when the user asks \"does the new one behave the same as the old one\", \"can we sign off the rewrite\", \"are these diffs just noise\", wants a golden-master, approval or shadow-traffic comparison, a parity check between old and new outputs, or says \"prove behaviour equivalence\".",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/behaviour-equivalence/scripts/golden_diff.py

@@ -143,7 +143,9 @@ def load_rules(path):
         items = raw["rules"]
     elif isinstance(raw, dict):
         items = []
-        for p, spec in raw.items():
+        for i, (p, spec) in enumerate(raw.items(), 1):
+            if not isinstance(spec, (str, dict)):
+                raise BadInput("rule {} ({}): spec must be a rule name or an object, got {!r}".format(i, p, spec))
             spec = {"rule": spec} if isinstance(spec, str) else dict(spec)
             spec["path"] = p
             items.append(spec)

package/packs/dev-team/skills/codebase-tour/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-tour",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Get a newcomer (a new engineer, or the agent itself) oriented in an unfamiliar repository before they make one specific change, with a short tour scoped to that change. It gives the install, run and test commands taken from CI, package scripts and the Makefile; the path the change touches, traced through the code with file:line citations; where the change goes; the conventions the code actually follows; the traps (generated files, a second copy of the logic, untested code, env vars, flags); and a first step that can be checked. Use when someone says \"I'm new to this repo\", \"get me oriented\", \"where would I make this change\", \"walk me through the code for X\", \"onboard me before I start this ticket\", or \"how do I run and test this\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/dev-team/skills/codebase-tour/scripts/repo_facts.py

@@ -164,7 +164,12 @@ def tox_nox(rel, name, lines, out, targets):
                 if sec.group(2):
                     targets["tox"].add(sec.group(2))
             elif env and re.match(r"^\s*commands\s*=", line):
-                cmd = line.split("=", 1)[1].strip()
+                cmds = [line.split("=", 1)[1].strip()]
+                for nxt in lines[i + 1:]:
+                    if not nxt.strip() or not nxt[0].isspace():
+                        break
+                    cmds.append(nxt.strip())
+                cmd = "; ".join(c for c in cmds if c and not c.startswith("#"))
                 out.append({"command": "tox -e %s" % env, "runs": cmd, "where": "%s:%d" % (rel, i + 1)})
     else:
         for i, line in enumerate(lines):

package/packs/dev-team/skills/dependency-upgrade-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-upgrade-review",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Give a merge verdict on a dependency-upgrade pull request (Dependabot, Renovate or a hand-made bump) across npm, pip, Go, Cargo and Maven lockfiles and GitHub Actions pins. Reads the release notes for every skipped version, lists what the lockfile changes beyond the PR title (transitive bumps, new and removed packages, install scripts, registry changes), checks each SHA pin against its release tag and against the PR's other pins, checks raised runtime floors against the images and runners that install it, says whether CI ran the changed code, traces what each caller of a changed API now does and writes the rollback. The reply leads with MERGE, MERGE AFTER CHECKS or DO NOT MERGE and the reasons that decide it. Use when the user says \"review this Dependabot PR\", \"is this Renovate bump safe to merge\", \"can I merge this dependency upgrade\", \"check this lockfile diff\", or \"is this action SHA pin right\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/dev-team/skills/dependency-upgrade-review/scripts/upgrade_diff.py

@@ -333,7 +333,7 @@ def h_package_lock(rep, path, hunks):
 
 def h_yarn_lock(rep, path, hunks):
     def key(text):
-        m = re.match(r'^"?((?:@[^@/\s"]+/)?[^@\s",]+)@[^:]*"?:\s*$', text)
+        m = re.match(r'^"?((?:@[^@/\s"]+/)?[^@\s",]+)@[^"]*"?:\s*$', text)
         return m.group(1) if m and not text.startswith((" ", "#")) else None
     fields = {"version": re.compile(r'^\s+version:?\s+"?([^"\s]+)"?'),
               "resolved": re.compile(r'^\s+resolved:?\s+"?([^"\s#]+)'),
@@ -599,7 +599,7 @@ def analyse(files, title):
         t = title.lower()
         for r in rep.changes:
             short = r["name"].split("/")[-1].lower()
-            r["in_title"] = r["name"].lower() in t or (len(short) > 3 and re.search(rf"\b{re.escape(short)}\b", t) is not None)
+            r["in_title"] = re.search(rf"(?<![\w@/.-]){re.escape(r['name'].lower())}(?![\w-])", t) is not None or (len(short) > 3 and re.search(rf"\b{re.escape(short)}\b", t) is not None)
     for (repo, tag_), shas in rep.sha_pins.items():
         if len(shas) > 1:
             where = "; ".join(f"{s} in {', '.join(dict.fromkeys(ps))}" for s, ps in shas.items())

package/packs/dev-team/skills/pre-merge-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pre-merge-review",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Gate an existing change for merge — run one skill that fires the whole production-readiness pass. First a deterministic mechanical gate (lint + typecheck + tests, via a script whose exit code decides), then the three-reviewer panel dispatched in parallel — devils-advocate (correctness), security-reviewer (exploitability), code-quality (craft) — then a single READY / NOT READY verdict. Use before opening a PR or merging, when you want the full review fleet run on a diff you already have. Do NOT use to implement a feature from a spec (that's feature-implement-loop) or to review a document (that's doc-critique).",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/pre-merge-review/scripts/gate.py

@@ -64,7 +64,13 @@ def detect(root):
 
 
 def load_config(path):
-    data = json.load(open(path, encoding="utf-8"))
+    try:
+        with open(path, encoding="utf-8-sig") as f:
+            data = json.load(f)
+    except UnicodeDecodeError:
+        raise SystemExit(f"gate: --config {path} is not UTF-8 — save it as UTF-8 and retry")
+    except (OSError, ValueError) as exc:
+        raise SystemExit(f"gate: cannot read --config {path}: {exc}")
     cmds = data.get("commands") if isinstance(data, dict) else data
     if not isinstance(cmds, list) or not all(isinstance(c, str) for c in cmds):
         raise SystemExit("gate: --config must hold a list of command strings (or {\"commands\": [...]})")

package/packs/dev-team/skills/rollout-plan/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "rollout-plan",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Plan the progressive release of a code change behind a feature flag or canary — the exposure ladder (internal, beta cohort, 1%, 5%, 25%, 50%, 100%, or what the traffic supports), and for each step who is exposed, decision and guardrail metrics with a baseline and a threshold against a control cohort, the minimum traffic and time before the numbers mean anything, a promote / hold / roll back rule set in advance, who watches and what aborts automatically; then what turning the flag off does not undo, and who removes the flag by when. Use when the user asks for a rollout plan, canary plan, ramp schedule, progressive delivery or percentage rollout, \"how long should the canary run\", \"when do we go from 5% to 25%\", or how to turn on a flagged feature safely.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/rollout-plan/scripts/canary_math.py

@@ -161,8 +161,8 @@ def main():
     p2 = p1 + d if args.direction == "up" else p1 - d
     if not 0 < p2 < 1:
         fail("baseline plus the regression falls outside 0-100%")
-    if args.traffic <= 0:
-        fail("--traffic must be greater than zero")
+    if not math.isfinite(args.traffic) or args.traffic <= 0:
+        fail("--traffic must be a finite number greater than zero")
     if not 0 < args.alpha < 1 or not 0 < args.power < 1:
         fail("--alpha and --power must be between 0 and 1")
     if args.max_hours <= 0:

package/packs/frontend/skills/bundle-size-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "bundle-size-review",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Find what makes a JavaScript bundle heavy and what can safely come out, from the bundler's stats file (webpack stats.json, an esbuild metafile, or the rollup-plugin-visualizer raw-data JSON that Vite builds use) read together with the repo around it (package.json, .browserslistrc, the lockfile, the bundler config and the source files that import the heavy modules). Gives each entry's first-load JavaScript in the exact bytes the stats record, kept apart from lazy chunks; finds whole-library imports, CommonJS packages that can't be tree-shaken, packages bundled twice and polyfills the browser targets don't need; names the import chain that pulls each module in before suggesting a removal; and, given before and after stats, says what grew, why, whether it lands in the first load and which per-entry budget would have caught it. Use when the user says \"why is our bundle so big\", \"what can we cut from the bundle\", \"review this stats.json\", \"why is lodash or moment in our bundle\", \"the bundle grew in this PR\", or \"set a bundle size budget\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/frontend/skills/bundle-size-review/scripts/bundle_stats.py

@@ -1023,7 +1023,7 @@ def parse_browserslist(queries):
         if len(m.groups()) == 3:
             v = ver_tuple(m.group(3))
             if m.group(2) == ">":
-                v = (v[0] + 1,)
+                v = v[:-1] + (v[-1] + 1,)
         else:
             v = ver_tuple(m.group(2))
         b = BROWSER_ALIAS[m.group(1)]

package/packs/frontend/skills/web-performance-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "web-performance-review",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Read a Lighthouse report or PageSpeed Insights result, with field data when there is any (CrUX, PSI loadingExperience or RUM p75), and say what makes the page slow for real users and what to fix first, ranked by how much each fix moves LCP, INP and CLS at the 75th percentile. Names the LCP element and which LCP phase dominates, the elements that shift and why, the long tasks and third parties by main-thread time, and treats estimated savings as lab estimates that overlap. Use when the user shares a Lighthouse JSON or PSI result and asks \"why is this page slow\", \"what should we fix first\", \"we score 92 but Search Console says LCP is poor\", \"did our change fix INP\", \"review this Lighthouse report\", or \"how do we pass Core Web Vitals\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/frontend/skills/web-performance-review/scripts/lh_summary.py

@@ -107,9 +107,11 @@ def die(msg):
 
 def load(path):
     try:
-        raw = sys.stdin.read() if path == "-" else open(path, encoding="utf-8").read()
+        raw = sys.stdin.read() if path == "-" else open(path, encoding="utf-8-sig").read()
     except OSError as exc:
         die(f"cannot read {path}: {exc.strerror}")
+    except UnicodeDecodeError:
+        die(f"{path} is not UTF-8 text; save it as UTF-8 and retry")
     try:
         return json.loads(raw)
     except json.JSONDecodeError as exc:
@@ -131,6 +133,9 @@ def classify(doc, path):
         lhr = doc.get("lighthouseResult")
         if lhr is not None and not isinstance(lhr, dict):
             die(f"{path}: lighthouseResult is not an object")
+        if lhr and lhr.get("runtimeError"):
+            err = lhr["runtimeError"]
+            die(f"{path}: Lighthouse run failed ({err.get('code')}: {err.get('message')})")
         return lhr, fields
     if "record" in doc and isinstance(doc["record"], dict):
         f = crux_field(doc["record"])

package/packs/grc/skills/risk-register/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "risk-register",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Build or update an enterprise or project risk register — each risk written as cause, event and consequence, scored for likelihood and impact on a defined scale, inherent and residual ratings, a named owner, a treatment (avoid, reduce, transfer, accept), controls, a due date and a review trigger — with a heat map, the top risks that need a decision, and a stdlib script that validates the register CSV and flags overdue reviews. Use when the user wants a risk register, a risk log, a RAID log's risk section, a heat map, or says \"what are our top risks\", \"update the risk register\", \"score these risks\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/grc/skills/risk-register/scripts/check_register.py

@@ -144,6 +144,8 @@ def main(argv=None):
     try:
         if args.csv == "-":
             text = sys.stdin.read()
+            if text.startswith("\ufeff"):  # Excel's "CSV UTF-8" BOM, as the file path strips it
+                text = text[1:]
         else:
             with io.open(args.csv, "r", encoding="utf-8-sig", newline="") as fh:
                 text = fh.read()
@@ -169,7 +171,10 @@ def main(argv=None):
     seen_ids = {}
     total_rows = 0
 
-    for line_no, raw in enumerate(reader, start=2):
+    for raw in reader:
+        # reader.line_num counts blank lines and ends on this record's last line; step back over
+        # newlines inside quoted cells to the line the record starts on.
+        line_no = reader.line_num - sum(v.count("\n") for v in raw.values() if isinstance(v, str))
         row = dict((k.strip(), (v or "").strip()) for k, v in raw.items() if k is not None)
         if not any(row.values()):
             continue

package/packs/infra-as-code/skills/terraform-plan-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform-plan-review",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Review a terraform plan before apply, from the plan text or terraform show -json output. Flags every destroy and replace with the attribute forcing it, changes to stateful resources such as databases, buckets and volumes, IAM and security-group widening, drift nobody made in code, and changes outside the intended scope, then gives a SAFE TO APPLY, APPLY WITH CARE or DO NOT APPLY verdict with reasons. Use when the user pastes a plan, says \"review this terraform plan\", \"is this plan safe to apply\", \"why is terraform replacing my database\", or \"check the plan before I apply\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/infra-as-code/skills/terraform-plan-review/scripts/plan_summary.py

@@ -66,9 +66,11 @@ def die(msg):
 
 def load_plan(path):
     try:
-        raw = sys.stdin.read() if path == "-" else open(path, encoding="utf-8").read()
+        raw = sys.stdin.read() if path == "-" else open(path, encoding="utf-8-sig").read()
     except OSError as e:
         die(f"cannot read {path}: {e.strerror}")
+    except UnicodeDecodeError:
+        die(f"{path} is not UTF-8 text; save it as UTF-8 (e.g. terraform show -json tfplan | Out-File -Encoding utf8 plan.json) and retry")
     stripped = raw.lstrip()
     if not stripped:
         die("input is empty")

package/packs/product-manager/skills/lean-canvas/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "lean-canvas",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Turn a startup or internal-product idea into a lean canvas that finds what could kill it — the nine boxes filled only from what the user said, each entry tagged evidence-backed (with its source) or assumption, the assumptions ranked by how likely each is wrong times how badly the idea fails if it is, the cheapest test with a pass/fail line set in advance for the top ones, a computed unit-economics check when price and costs are given, and a plain call when the idea should change before anything is built. Use when the user says \"lean canvas\", \"help me think through my startup idea\", \"what are the riskiest assumptions\", \"how do I validate this idea\", \"is this idea worth building\", or \"poke holes in my business model\".",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/product-manager/skills/lean-canvas/scripts/unit_economics.py

@@ -155,7 +155,7 @@ def compute(inp: dict) -> tuple[list[str], list[str]]:
                         f"Break-even needs {be_whole:,} active customers but the stated market holds {int(market):,}."
                     )
                 else:
-                    share = be_whole / market * 100
+                    share = be_whole / market * 100 if market else 0.0  # 0 needed of a 0 market
                     lines.append(f"Break-even share of the stated market: {share:.1f}%")
                     if share >= 25:
                         flags.append(

package/packs/research/skills/hypothesis-comparison/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "hypothesis-comparison",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Compare rival explanations for an observation with analysis of competing hypotheses (ACH) — list the hypotheses and the evidence, build a consistency matrix (consistent / inconsistent / neutral), rank hypotheses by how little evidence contradicts them rather than how much supports them, name the diagnostic evidence and the linchpins, and say which next observation would tell the leaders apart. Use when the user asks \"why did X happen\", \"which explanation fits the evidence\", \"what's really causing this\", wants to stop arguing over a favourite theory, or says \"compare these hypotheses\", \"competing explanations\", \"ACH\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/research/skills/hypothesis-comparison/scripts/ach_matrix.py

@@ -66,6 +66,9 @@ def load(path):
             fail("the CSV needs at least two hypothesis columns; ACH compares rivals")
         rows = []
         for i, raw in enumerate(reader, start=1):
+            if None in raw:
+                fail("row {}: more cells than the header has columns; put double quotes around any "
+                     "cell that contains a comma".format(i + 1))
             row = {(k or "").strip(): (v or "").strip() for k, v in raw.items()}
             lrow = {k.lower(): v for k, v in row.items()}
             ev = lrow.get("evidence", "")

package/packs/research/skills/source-synthesis/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "source-synthesis",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Answer a question from a set of sources the user supplied — papers, reports, articles, interview notes, emails — saying only what the material supports, labelling anything that comes from elsewhere where it appears, counting a source that repeats another once, and giving a labelled estimate when the user needs a figure the sources don't settle. Written in the length and format the user asked for; a full cited literature review only when that is the ask. Use when the user hands over several sources and asks to \"synthesise these\", \"what do these papers say\", \"pull together what we know\", \"literature review\", or \"where do the sources agree and disagree\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/research/skills/source-synthesis/scripts/citations.py

@@ -44,6 +44,7 @@ SOURCE_LINE = re.compile(r"^\s*(?:[-*+]\s+)?\[?(S\d+)\]?\s*[:.)\]\-—–]\s*(\S
 BRACKET = re.compile(r"\[([^\[\]]+)\](?!\()")
 CITE_PART = re.compile(r"^\s*(S\d+)\s*(?::\s*(.*?))?\s*$")
 LOOKS_LIKE_CITE = re.compile(r"^\s*S\d+\b")
+COMMA_CITE = re.compile(r",\s*S\d+\s*(?::|,|$)")  # [S1:p4, S2:p7]: parts joined by a comma, not ";"
 OUTSIDE = re.compile(r"\[outside\]", re.IGNORECASE)
 NO_CITE = "<!-- no-cite -->"
 HEADING = re.compile(r"^\s{0,3}(#{1,6})\s+(.*?)\s*#*\s*$")
@@ -218,7 +219,7 @@ def main():
                     continue
                 for part in inner.split(";"):
                     pm = CITE_PART.match(part)
-                    if not pm:
+                    if not pm or COMMA_CITE.search(pm.group(2) or ""):
                         malformed.append((n, "[" + inner + "]"))
                         continue
                     sid, loc = pm.group(1), (pm.group(2) or "").strip()

package/packs/skill-engineering/skills/skill-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "skill-review",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Audit an existing Agent Skill folder (SKILL.md plus its scripts, references and evals) for Claude Code, Codex, Copilot, Cursor, Kiro or Antigravity, and return a READY / FIX FIRST / REWRITE verdict with severity-tagged findings across five areas — whether a router would pick it and whether it collides with a sibling, portability, safety (mapped to the OWASP Agentic Skills Top 10), structure, and eval coverage — backed by a stdlib lint script for the mechanical checks. Use when the user says \"review this skill\", \"is my SKILL.md any good\", \"why doesn't my skill trigger\", \"is this skill safe to install\", or wants a skill checked before sharing or publishing it.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/skill-engineering/skills/skill-review/scripts/lint_skill.py

@@ -263,7 +263,7 @@ def read_lines(path):
 
 
 def check_structure(rep, skill_dir, text):
-    n = text.count("\n") + 1
+    n = text.count("\n") + (1 if text and not text.endswith("\n") else 0)
     rep.facts["skill_md_lines"] = n
     if n > MAX_LINES:
         rep.add("WARN", "structure", "SKILL.md is %d lines; past %d, split material into reference files" % (n, MAX_LINES), "SKILL.md")
@@ -322,6 +322,9 @@ def check_evals(rep, skill_dir, name):
                     if not isinstance(e, dict) or not e.get("prompt"):
                         rep.add("ERROR", "evals", "eval #%d has no prompt" % i, "evals/evals.json")
                         continue
+                    if not isinstance(e["prompt"], str):
+                        rep.add("ERROR", "evals", "eval #%d prompt is not a string; write it as the text a user would type" % i, "evals/evals.json")
+                        continue
                     if not isinstance(e.get("assertions"), list) or not e["assertions"]:
                         rep.add("ERROR", "evals", "eval #%d has no assertions; nothing says what a passing output looks like" % i, "evals/evals.json")
                         continue

package/packs/solution-architect/skills/event-contract-draft/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "event-contract-draft",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Draft the contract for an event or message interface (Kafka topics, SNS/SQS, EventBridge, Pub/Sub, RabbitMQ, webhooks) as an AsyncAPI 3.0 document plus a short decisions page — past-tense event names, a required envelope with event id for deduplication, the partition key and the ordering it does and doesn't give, at-least-once delivery and how consumers stay idempotent, data minimisation with PII marked, additive-only versioning with dated deprecation, and retention, replay and dead-letter handling. Use when the user wants to define events, design a Kafka topic or message schema, write an AsyncAPI spec, agree what a producer publishes and what consumers must do, or version an event safely.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/solution-architect/skills/event-contract-draft/scripts/check_asyncapi.py

@@ -376,7 +376,8 @@ def collect_messages(doc):
         if id(m) not in seen:
             seen[id(m)] = key
             out.append((m.get("name") or key, f"message {key}", m))
-    for cname, channel in (doc.get("channels") or {}).items():
+    channels = doc.get("channels") or {}
+    for cname, channel in (channels.items() if isinstance(channels, dict) else ()):
         ch = deref(doc, channel)
         for key, msg in (ch.get("messages") or {}).items():
             m = deref(doc, msg)
@@ -429,6 +430,9 @@ def check(doc):
     if not version.startswith("3."):
         rep.fail("asyncapi", f"version is '{version or 'missing'}'; this checks AsyncAPI 3.x")
     info = doc.get("info") or {}
+    if not isinstance(info, dict):
+        rep.fail("info", "must be an object with title and version")
+        info = {}
     for field in ("title", "version"):
         if not info.get(field):
             rep.fail("info", f"missing info.{field}")
@@ -437,7 +441,10 @@ def check(doc):
     check_refs(doc, doc, rep)
 
     channels = doc.get("channels") or {}
-    if not channels:
+    if not isinstance(channels, dict):
+        rep.fail("channels", "must be an object keyed by channel name, not a list")
+        channels = {}
+    elif not channels:
         rep.fail("channels", "no channels")
     for name, channel in channels.items():
         check_channel(doc, name, deref(doc, channel), rep)

package/packs/solution-architect/skills/figma-diagrams/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "figma-diagrams",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Work with Figma and FigJam files via the Figma REST API — read existing file structure, list frames/pages, post comments, and produce FigJam-importable diagram specs. Use when the user mentions a Figma URL, asks to inspect/audit a Figma file, wants to comment on a design programmatically, or wants their architecture diagram in Figma.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/solution-architect/skills/figma-diagrams/scripts/frame_to_mermaid.py

@@ -82,7 +82,7 @@ def main(argv: list[str]) -> int:
     node_id = argv[1]
 
     data = get(f"/v1/files/{file_key}/nodes", params={"ids": node_id})
-    node = data.get("nodes", {}).get(node_id, {}).get("document")
+    node = (data.get("nodes", {}).get(node_id) or {}).get("document")
     if not node:
         sys.stderr.write(f"error: node {node_id} not found in {file_key}\n")
         return 1

package/packs/solution-architect/skills/figma-diagrams/scripts/post_comment.py

@@ -28,7 +28,7 @@ def main(argv: list[str]) -> int:
 
     if args.node_id:
         nodes = get(f"/v1/files/{file_key}/nodes", params={"ids": args.node_id})
-        node = nodes.get("nodes", {}).get(args.node_id, {}).get("document", {})
+        node = (nodes.get("nodes", {}).get(args.node_id) or {}).get("document") or {}
         box = node.get("absoluteBoundingBox")
         if not box:
             sys.stderr.write(

package/packs/solution-architect/skills/interactive-diagram/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "interactive-diagram",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Turn a codebase, a system description, a process or a database schema into one self-contained interactive HTML diagram (architecture, workflow, data flow, lifecycle, ERD, sequence, class, tree, timeline or waterfall) where every box and arrow cites the file and line or the words it came from, anything inferred is drawn dashed as an assumption, and each cited line is checked against the repository before the page is written. Laid out automatically, opens offline with no CDN, and exports SVG, PNG and Mermaid. Use when the user asks to \"visualize\", \"map\" or \"make an interactive diagram of\" a repo, a request path, a pipeline, an approval process, a set of tables, an incident's events or a slow trace, or wants a diagram they can click through and share as one file.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/solution-architect/skills/interactive-diagram/scripts/build_diagram.py

@@ -1287,7 +1287,7 @@ def timeline_findings(spec, evs, kind):
     out = []
     order = sorted(evs, key=lambda e: e["_t"][0])
     if len(order) >= 2:
-        first = order[0]["when"]
+        first = order[0]["when"].split(" to ")[0]
         if kind.startswith("abs") and ":" in first and not re.match(r"^~?\d{2} [A-Z][a-z]{2} ", first):
             first = fmt_when(order[0]["_t"][0], kind, 86400) + " " + first  # one day: give its date once
         out.append("From %s to %s: %s." % (first, order[-1]["when"].split(" to ")[0], fmt_span(order[-1]["_t"][0] - order[0]["_t"][0], kind)))
@@ -2495,8 +2495,22 @@ def build_html(spec, svg, mermaid, issues, theme):
 
 def load(path):
     with open(path, encoding="utf-8") as fh:
-        return json.load(fh)
+        spec = json.load(fh)
+    if not isinstance(spec, dict):
+        raise ValueError("the spec must be a JSON object at the top level, not a %s" % type(spec).__name__)
+    return spec
+
+
 
+def shown(path):
+    """The output path for the reply's first line: relative when it is under the current folder,
+    absolute otherwise. On Windows a path on another drive has no relative form at all."""
+    full = os.path.abspath(path)
+    try:
+        rel = os.path.relpath(full)
+    except ValueError:
+        return full
+    return full if rel.startswith("..") else rel
 
 def main(argv=None):
     ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
@@ -2569,7 +2583,7 @@ def main(argv=None):
         receipt["output"] = os.path.abspath(a.out)
         receipt["bytes"] = len(out.encode("utf-8"))
         receipt["edges"] = len([e for e in spec["edges"] if not e.get("tree")]) or len(spec["edges"])
-        shown_path = os.path.relpath(os.path.abspath(a.out)) if not os.path.relpath(os.path.abspath(a.out)).startswith("..") else os.path.abspath(a.out)
+        shown_path = shown(a.out)
         receipt["reply_first_line"] = "[%s](%s)" % (spec["title"].replace("]", ")"), shown_path)
         receipt["findings"] = spec.get("_findings", [])
         if a.mermaid:

package/packs/sre-oncall/skills/cloud-cost-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "cloud-cost-review",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Review actual cloud spend from a cost export (AWS CUR or Data Exports, GCP billing export, Azure cost details) and produce a ranked savings report — idle and unattached resources, oversized instances backed by utilisation evidence, storage tiering, data transfer hot spots, commitment coverage and untagged spend — each finding with a monthly saving computed from the bill, a confidence level and an ease rating. Use when the user shares a cost CSV and says \"where are we wasting money\", \"review our AWS bill\", \"why did the cloud bill jump this month\", \"find savings in our GCP/Azure spend\", or \"should we buy savings plans\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/sre-oncall/skills/cloud-cost-review/scripts/cost_summary.py

@@ -110,7 +110,7 @@ FORMATS = {
     },
 }
 
-COMPUTE_RE = re.compile(r"BoxUsage|DedicatedUsage|HostUsage|Fargate-(vCPU|GB)-Hours|Lambda-GB-Second|InstanceUsage|NodeUsage|"
+COMPUTE_RE = re.compile(r"BoxUsage|SpotUsage|DedicatedUsage|HostUsage|Fargate-(vCPU|GB)-Hours|Lambda-GB-Second|InstanceUsage|NodeUsage|"
                         r"Instance Core|Instance Ram|vCPU", re.I)
 GENERIC_COMPUTE_SERVICE_RE = re.compile(r"compute|virtual machine|\bvm\b|ec2|fargate|lambda|functions", re.I)
 HOTSPOTS = [
@@ -603,7 +603,10 @@ def main(argv=None):
             raise InputError("--month must be YYYY-MM, got %r" % args.month)
         if args.top < 1:
             raise InputError("--top must be at least 1")
-        fmt, used, rows = load(Path(args.csv), args.format)
+        try:
+            fmt, used, rows = load(Path(args.csv), args.format)
+        except UnicodeDecodeError:
+            raise InputError("%s is not UTF-8 text; save it as UTF-8 (CSV UTF-8) and retry" % args.csv)
         a = analyse(rows, args.tag, args.month, args.top, fmt)
     except InputError as e:
         print("error: %s" % e, file=sys.stderr)

package/packs/sre-oncall/skills/delivery-metrics-report/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "delivery-metrics-report",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Produce a delivery metrics report for one service from deployment, incident and pull-request exports — the DORA metrics (deployment frequency, change lead time, change fail rate, failed deployment recovery time) plus flow metrics (WIP, cycle time p50/p85, throughput), computed by a script with per-week trends and explicit data gaps, then interpreted for what changed and why. Use when the user wants DORA metrics, says \"how are we doing on the four keys\", \"what's our change failure rate\", \"compute lead time and deploy frequency from this CSV\", or \"build our delivery metrics report\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/sre-oncall/skills/delivery-metrics-report/scripts/delivery_metrics.py

@@ -50,6 +50,8 @@ def parse_offset(text: str) -> timezone:
         return timezone.utc
     if not m:
         raise InputError("--assume-tz must look like +00:00, -05:00 or Z, got %r" % text)
+    if int(m.group(2)) > 23 or int(m.group(3)) > 59:
+        raise InputError("--assume-tz offset out of range (hours 00-23, minutes 00-59), got %r" % text)
     sign = 1 if m.group(1) == "+" else -1
     return timezone(sign * timedelta(hours=int(m.group(2)), minutes=int(m.group(3))))
 
@@ -179,6 +181,8 @@ def compute(args) -> dict:
     dep_rows = read_csv(Path(args.deployments), ["deploy_id", "service", "deployed_at", "status"], "deployments")
     inc_rows = read_csv(Path(args.incidents), ["incident_id", "service", "started_at", "resolved_at"], "incidents") if args.incidents else None
     pr_rows = read_csv(Path(args.prs), ["pr_id", "opened_at", "merged_at"], "prs") if args.prs else None
+    if pr_rows is not None and not pr_rows:
+        raise InputError("prs file %s has a header but no rows; add PR rows or drop --prs" % args.prs)
 
     services_seen = sorted({r["service"] for r in dep_rows if r["service"]})
     svc = args.service

package/packs/trackers/skills/backlog-triage/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "backlog-triage",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Triage a whole backlog export from Jira, Linear or GitHub Projects (CSV, JSON or an MCP tool) — duplicate and near-duplicate pairs with the reason, items missing acceptance criteria or an owner, stale items, oversized items to split, priority conflicts, and a proposed ordering with a reason per item — ending in a change list the user can apply. A stdlib script computes the mechanical checks. Use when the user wants to clean up, groom or refine a backlog, find duplicate tickets, or says \"triage our backlog\", \"what should we pull next?\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/trackers/skills/backlog-triage/scripts/triage_backlog.py

@@ -102,6 +102,8 @@ def load_rows(path: Path) -> list:
         text = path.read_text(encoding="utf-8-sig")
     except OSError as e:
         die("cannot read {}: {}".format(path, e))
+    except UnicodeDecodeError:
+        die("{} is not UTF-8 text; save it as UTF-8 and retry".format(path))
     if suffix in (".csv", ".tsv"):
         delim = "\t" if suffix == ".tsv" else ","
         reader = csv.reader(io.StringIO(text, newline=""), delimiter=delim)
@@ -175,6 +177,8 @@ def parse_date(s: str):
     if not s:
         return None
     s2 = s[:-1] + "+00:00" if s.endswith("Z") else s
+    # Python < 3.11 needs a colon in the offset (Jira REST writes +0000).
+    s2 = re.sub(r"(\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?[+-]\d{2})(\d{2})$", r"\1:\2", s2)
     try:
         return datetime.fromisoformat(s2).date()
     except ValueError:
@@ -283,8 +287,9 @@ def main(argv=None) -> int:
         })
     open_items = [it for it in items if not it["done"]]
 
-    no_owner = [it for it in open_items if not it["owner"] or it["owner"].lower() in ("unassigned", "none")]
-    no_ac = [it for it in open_items if not it["has_ac"]]
+    no_owner = [it for it in open_items if not it["owner"] or it["owner"].lower() in ("unassigned", "none")] \
+        if "owner" in mp else []
+    no_ac = [it for it in open_items if not it["has_ac"]] if ("description" in mp or "acceptance" in mp) else []
     no_date = [it for it in open_items if it["updated"] is None]
     stale = []
     for it in open_items:

package/packs/trackers/skills/team-status-report/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "team-status-report",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Write a weekly team status report from tracker data (Jira, Linear or GitHub Projects, via CSV, JSON or an MCP tool) — shipped, in progress, blocked with the blocker and owner, slipped against plan, risks and asks — with every number computed from the data by a stdlib script, never estimated, and a RAG status that states the rule that set it. Use when the user wants a weekly status update, sprint report or stakeholder update from the tracker, or says \"write this week's status report\", \"are we on track?\".",
   "entrypoint": "SKILL.md",
   "deps": {