skilldrop-cli 0.16.43 → 0.16.45

package/packs/design/skills/deck-builder/scripts/build_deck.py

@@ -34,13 +34,17 @@ import zipfile
 from dataclasses import dataclass
 from pathlib import Path
 
-from pptx import Presentation
-from pptx.chart.data import CategoryChartData
-from pptx.dml.color import RGBColor
-from pptx.enum.chart import XL_CHART_TYPE, XL_LEGEND_POSITION
-from pptx.enum.shapes import MSO_SHAPE, PP_PLACEHOLDER
-from pptx.enum.text import MSO_ANCHOR, PP_ALIGN
-from pptx.util import Emu, Inches, Pt
+try:
+    from pptx import Presentation
+    from pptx.chart.data import CategoryChartData
+    from pptx.dml.color import RGBColor
+    from pptx.enum.chart import XL_CHART_TYPE, XL_LEGEND_POSITION
+    from pptx.enum.shapes import MSO_SHAPE, PP_PLACEHOLDER
+    from pptx.enum.text import MSO_ANCHOR, PP_ALIGN
+    from pptx.util import Emu, Inches, Pt
+except ImportError:
+    sys.stderr.write("error: python-pptx is not installed; install it with: pip install python-pptx\n")
+    sys.exit(1)
 
 # The design canvas every hardcoded position below is expressed in. Real slide
 # geometry comes from Canvas, which scales these to the actual deck size.
@@ -960,7 +964,8 @@ def load_brand(ref, base: Path):
         return {}, base
     if isinstance(ref, dict):
         return ref, base
-    path = (base / ref).expanduser() if not Path(ref).is_absolute() else Path(ref)
+    path = Path(ref).expanduser()
+    path = path if path.is_absolute() else base / path
     if not path.exists():
         warn(f"brand file not found: {path}; building without it")
         return {}, base
@@ -1024,7 +1029,12 @@ def place_logo(slide, c: "Canvas", palette: dict, logical: str) -> None:
 
 
 def build(spec_path: Path, out_path: Path, script_dir: Path, *, strict: bool, brand_ref=None) -> None:
-    spec = json.loads(spec_path.read_text(encoding="utf-8"))
+    try:
+        spec = json.loads(spec_path.read_text(encoding="utf-8-sig"))
+    except json.JSONDecodeError as e:
+        die(f"spec {spec_path} is not valid JSON ({e}); fix it and re-run")
+    except UnicodeDecodeError:
+        die(f"spec {spec_path} is not UTF-8 text; save it as UTF-8 and re-run")
     spec_dir = spec_path.parent
     brand, brand_dir = load_brand(brand_ref or spec.get("brand"), spec_dir)
     if brand:

package/packs/design/skills/marketing-flyer/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "marketing-flyer",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Generate a print-ready, on-brand marketing flyer — event, launch, open day, offer, hiring — as one self-contained HTML file (Letter, A4, A5, or square and story sizes for social) that saves to PDF, built from the user's own logo, colours, fonts and content, with one call to action, a short headline, contrast checked, and no invented dates, prices or contact details. Use when the user wants a flyer, poster, one-pager, handout, leaflet or event announcement \"in our branding\", or says \"make a flyer for…\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/design/skills/marketing-flyer/scripts/build_flyer.py

@@ -79,9 +79,14 @@ def data_uri(path, label):
 
 def load_json(path):
     try:
-        return json.loads(Path(path).read_text(encoding="utf-8"))
+        data = json.loads(Path(path).read_text(encoding="utf-8-sig"))
     except (OSError, json.JSONDecodeError) as e:
         die(f"cannot read {path}: {e}")
+    except UnicodeDecodeError:
+        die(f"cannot read {path}: it is not UTF-8 text; save it as UTF-8")
+    if not isinstance(data, dict):
+        die(f"cannot read {path}: expected a JSON object {{...}}, got a {type(data).__name__}")
+    return data
 
 
 def resolve(base, ref):
@@ -164,9 +169,13 @@ def build(spec_path, out_path, brand_ref=None):
     if isinstance(cta, list):
         warn("more than one call to action; a flyer gets one — using the first")
         cta = cta[0] if cta else None
+    if isinstance(cta, str):
+        cta = {"text": cta}
     if not cta:
         warn("no call to action — what should a reader do next?")
     img = spec.get("image") or {}
+    if isinstance(img, str):
+        img = {"path": img}
     hero = data_uri(resolve(base, img.get("path")), "image") if isinstance(img, dict) else data_uri(resolve(base, img), "image")
     if hero and isinstance(img, dict) and not img.get("alt"):
         warn("image has no alt text")

package/packs/dev-team/skills/behaviour-equivalence/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "behaviour-equivalence",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Prove that a rewritten, migrated or refactored component behaves the same as the old one with a golden-master comparison — record inputs and outputs at a boundary (HTTP, function calls, batch files, DB writes, events) from production-shaped traffic and edge cases, run the old system twice to find its nondeterminism, normalise narrowly field by field, replay against the new one, triage every difference as defect, intended change (with a named approver) or missing normalisation, and give a verdict of EQUIVALENT, EQUIVALENT EXCEPT LISTED CHANGES, NOT EQUIVALENT or NOT PROVEN. Use when the user asks \"does the new one behave the same as the old one\", \"can we sign off the rewrite\", \"are these diffs just noise\", wants a golden-master, approval or shadow-traffic comparison, a parity check between old and new outputs, or says \"prove behaviour equivalence\".",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/behaviour-equivalence/scripts/golden_diff.py

@@ -143,7 +143,9 @@ def load_rules(path):
         items = raw["rules"]
     elif isinstance(raw, dict):
         items = []
-        for p, spec in raw.items():
+        for i, (p, spec) in enumerate(raw.items(), 1):
+            if not isinstance(spec, (str, dict)):
+                raise BadInput("rule {} ({}): spec must be a rule name or an object, got {!r}".format(i, p, spec))
             spec = {"rule": spec} if isinstance(spec, str) else dict(spec)
             spec["path"] = p
             items.append(spec)
@@ -493,7 +495,7 @@ def render(rep, max_diffs):
     return "\n".join(out) + "\n"
 
 
-def main(argv=None):
+def _main(argv=None):
     ap = argparse.ArgumentParser(description="Golden-master diff of old vs new recorded outputs.")
     ap.add_argument("old", help="directory or JSONL file of the old system's outputs")
     ap.add_argument("new", help="directory or JSONL file of the new system's outputs")
@@ -520,5 +522,15 @@ def main(argv=None):
     return 0 if rep["verdict"] != "NOT EQUIVALENT" else 1
 
 
+
+def main(argv=None):
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main(argv)
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as recordings and rules (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
     sys.exit(main())

package/packs/dev-team/skills/codebase-tour/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-tour",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Get a newcomer (a new engineer, or the agent itself) oriented in an unfamiliar repository before they make one specific change, with a short tour scoped to that change. It gives the install, run and test commands taken from CI, package scripts and the Makefile; the path the change touches, traced through the code with file:line citations; where the change goes; the conventions the code actually follows; the traps (generated files, a second copy of the logic, untested code, env vars, flags); and a first step that can be checked. Use when someone says \"I'm new to this repo\", \"get me oriented\", \"where would I make this change\", \"walk me through the code for X\", \"onboard me before I start this ticket\", or \"how do I run and test this\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/dev-team/skills/codebase-tour/scripts/repo_facts.py

@@ -164,7 +164,12 @@ def tox_nox(rel, name, lines, out, targets):
                 if sec.group(2):
                     targets["tox"].add(sec.group(2))
             elif env and re.match(r"^\s*commands\s*=", line):
-                cmd = line.split("=", 1)[1].strip()
+                cmds = [line.split("=", 1)[1].strip()]
+                for nxt in lines[i + 1:]:
+                    if not nxt.strip() or not nxt[0].isspace():
+                        break
+                    cmds.append(nxt.strip())
+                cmd = "; ".join(c for c in cmds if c and not c.startswith("#"))
                 out.append({"command": "tox -e %s" % env, "runs": cmd, "where": "%s:%d" % (rel, i + 1)})
     else:
         for i, line in enumerate(lines):

package/packs/dev-team/skills/dependency-upgrade-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-upgrade-review",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Give a merge verdict on a dependency-upgrade pull request (Dependabot, Renovate or a hand-made bump) across npm, pip, Go, Cargo and Maven lockfiles and GitHub Actions pins. Reads the release notes for every skipped version, lists what the lockfile changes beyond the PR title (transitive bumps, new and removed packages, install scripts, registry changes), checks each SHA pin against its release tag and against the PR's other pins, checks raised runtime floors against the images and runners that install it, says whether CI ran the changed code, traces what each caller of a changed API now does and writes the rollback. The reply leads with MERGE, MERGE AFTER CHECKS or DO NOT MERGE and the reasons that decide it. Use when the user says \"review this Dependabot PR\", \"is this Renovate bump safe to merge\", \"can I merge this dependency upgrade\", \"check this lockfile diff\", or \"is this action SHA pin right\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/dev-team/skills/dependency-upgrade-review/scripts/upgrade_diff.py

@@ -333,7 +333,7 @@ def h_package_lock(rep, path, hunks):
 
 def h_yarn_lock(rep, path, hunks):
     def key(text):
-        m = re.match(r'^"?((?:@[^@/\s"]+/)?[^@\s",]+)@[^:]*"?:\s*$', text)
+        m = re.match(r'^"?((?:@[^@/\s"]+/)?[^@\s",]+)@[^"]*"?:\s*$', text)
         return m.group(1) if m and not text.startswith((" ", "#")) else None
     fields = {"version": re.compile(r'^\s+version:?\s+"?([^"\s]+)"?'),
               "resolved": re.compile(r'^\s+resolved:?\s+"?([^"\s#]+)'),
@@ -599,7 +599,7 @@ def analyse(files, title):
         t = title.lower()
         for r in rep.changes:
             short = r["name"].split("/")[-1].lower()
-            r["in_title"] = r["name"].lower() in t or (len(short) > 3 and re.search(rf"\b{re.escape(short)}\b", t) is not None)
+            r["in_title"] = re.search(rf"(?<![\w@/.-]){re.escape(r['name'].lower())}(?![\w-])", t) is not None or (len(short) > 3 and re.search(rf"\b{re.escape(short)}\b", t) is not None)
     for (repo, tag_), shas in rep.sha_pins.items():
         if len(shas) > 1:
             where = "; ".join(f"{s} in {', '.join(dict.fromkeys(ps))}" for s, ps in shas.items())

package/packs/dev-team/skills/pre-merge-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pre-merge-review",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Gate an existing change for merge — run one skill that fires the whole production-readiness pass. First a deterministic mechanical gate (lint + typecheck + tests, via a script whose exit code decides), then the three-reviewer panel dispatched in parallel — devils-advocate (correctness), security-reviewer (exploitability), code-quality (craft) — then a single READY / NOT READY verdict. Use before opening a PR or merging, when you want the full review fleet run on a diff you already have. Do NOT use to implement a feature from a spec (that's feature-implement-loop) or to review a document (that's doc-critique).",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/pre-merge-review/scripts/gate.py

@@ -64,7 +64,13 @@ def detect(root):
 
 
 def load_config(path):
-    data = json.load(open(path, encoding="utf-8"))
+    try:
+        with open(path, encoding="utf-8-sig") as f:
+            data = json.load(f)
+    except UnicodeDecodeError:
+        raise SystemExit(f"gate: --config {path} is not UTF-8 — save it as UTF-8 and retry")
+    except (OSError, ValueError) as exc:
+        raise SystemExit(f"gate: cannot read --config {path}: {exc}")
     cmds = data.get("commands") if isinstance(data, dict) else data
     if not isinstance(cmds, list) or not all(isinstance(c, str) for c in cmds):
         raise SystemExit("gate: --config must hold a list of command strings (or {\"commands\": [...]})")

package/packs/dev-team/skills/rollout-plan/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "rollout-plan",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Plan the progressive release of a code change behind a feature flag or canary — the exposure ladder (internal, beta cohort, 1%, 5%, 25%, 50%, 100%, or what the traffic supports), and for each step who is exposed, decision and guardrail metrics with a baseline and a threshold against a control cohort, the minimum traffic and time before the numbers mean anything, a promote / hold / roll back rule set in advance, who watches and what aborts automatically; then what turning the flag off does not undo, and who removes the flag by when. Use when the user asks for a rollout plan, canary plan, ramp schedule, progressive delivery or percentage rollout, \"how long should the canary run\", \"when do we go from 5% to 25%\", or how to turn on a flagged feature safely.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/rollout-plan/scripts/canary_math.py

@@ -161,8 +161,8 @@ def main():
     p2 = p1 + d if args.direction == "up" else p1 - d
     if not 0 < p2 < 1:
         fail("baseline plus the regression falls outside 0-100%")
-    if args.traffic <= 0:
-        fail("--traffic must be greater than zero")
+    if not math.isfinite(args.traffic) or args.traffic <= 0:
+        fail("--traffic must be a finite number greater than zero")
     if not 0 < args.alpha < 1 or not 0 < args.power < 1:
         fail("--alpha and --power must be between 0 and 1")
     if args.max_hours <= 0:

package/packs/frontend/skills/bundle-size-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "bundle-size-review",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Find what makes a JavaScript bundle heavy and what can safely come out, from the bundler's stats file (webpack stats.json, an esbuild metafile, or the rollup-plugin-visualizer raw-data JSON that Vite builds use) read together with the repo around it (package.json, .browserslistrc, the lockfile, the bundler config and the source files that import the heavy modules). Gives each entry's first-load JavaScript in the exact bytes the stats record, kept apart from lazy chunks; finds whole-library imports, CommonJS packages that can't be tree-shaken, packages bundled twice and polyfills the browser targets don't need; names the import chain that pulls each module in before suggesting a removal; and, given before and after stats, says what grew, why, whether it lands in the first load and which per-entry budget would have caught it. Use when the user says \"why is our bundle so big\", \"what can we cut from the bundle\", \"review this stats.json\", \"why is lodash or moment in our bundle\", \"the bundle grew in this PR\", or \"set a bundle size budget\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/frontend/skills/bundle-size-review/scripts/bundle_stats.py

@@ -500,6 +500,8 @@ def load(path):
                 text = fh.read()
     except OSError as e:
         raise InputError("cannot read %s: %s" % (path, e))
+    except UnicodeDecodeError:
+        raise InputError("%s is not UTF-8 text; save it as UTF-8" % path)
     if not text.strip():
         raise InputError("%s is empty" % path)
     try:
@@ -1023,7 +1025,7 @@ def parse_browserslist(queries):
         if len(m.groups()) == 3:
             v = ver_tuple(m.group(3))
             if m.group(2) == ">":
-                v = (v[0] + 1,)
+                v = v[:-1] + (v[-1] + 1,)
         else:
             v = ver_tuple(m.group(2))
         b = BROWSER_ALIAS[m.group(1)]
@@ -1574,7 +1576,7 @@ def to_jsonable(o):
     raise TypeError(type(o))
 
 
-def main(argv=None):
+def _main(argv=None):
     ap = argparse.ArgumentParser(description="Size a JS bundle from webpack stats, an esbuild metafile or rollup-plugin-visualizer raw data, and read the project files around it.")
     ap.add_argument("stats", nargs="?", help="stats file, or - for stdin")
     ap.add_argument("--compare", nargs=2, metavar=("BEFORE", "AFTER"), help="diff two stats files")
@@ -1629,5 +1631,15 @@ def main(argv=None):
     return 1 if over else 0
 
 
+
+def main(argv=None):
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main(argv)
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as webpack, esbuild or Vite stats (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
     sys.exit(main())

package/packs/frontend/skills/web-performance-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "web-performance-review",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Read a Lighthouse report or PageSpeed Insights result, with field data when there is any (CrUX, PSI loadingExperience or RUM p75), and say what makes the page slow for real users and what to fix first, ranked by how much each fix moves LCP, INP and CLS at the 75th percentile. Names the LCP element and which LCP phase dominates, the elements that shift and why, the long tasks and third parties by main-thread time, and treats estimated savings as lab estimates that overlap. Use when the user shares a Lighthouse JSON or PSI result and asks \"why is this page slow\", \"what should we fix first\", \"we score 92 but Search Console says LCP is poor\", \"did our change fix INP\", \"review this Lighthouse report\", or \"how do we pass Core Web Vitals\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/frontend/skills/web-performance-review/scripts/lh_summary.py

@@ -107,9 +107,11 @@ def die(msg):
 
 def load(path):
     try:
-        raw = sys.stdin.read() if path == "-" else open(path, encoding="utf-8").read()
+        raw = sys.stdin.read() if path == "-" else open(path, encoding="utf-8-sig").read()
     except OSError as exc:
         die(f"cannot read {path}: {exc.strerror}")
+    except UnicodeDecodeError:
+        die(f"{path} is not UTF-8 text; save it as UTF-8 and retry")
     try:
         return json.loads(raw)
     except json.JSONDecodeError as exc:
@@ -131,6 +133,9 @@ def classify(doc, path):
         lhr = doc.get("lighthouseResult")
         if lhr is not None and not isinstance(lhr, dict):
             die(f"{path}: lighthouseResult is not an object")
+        if lhr and lhr.get("runtimeError"):
+            err = lhr["runtimeError"]
+            die(f"{path}: Lighthouse run failed ({err.get('code')}: {err.get('message')})")
         return lhr, fields
     if "record" in doc and isinstance(doc["record"], dict):
         f = crux_field(doc["record"])
@@ -697,7 +702,7 @@ def cmp_md(c):
     return "\n".join(L)
 
 
-def main():
+def _main():
     ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
     ap.add_argument("reports", nargs="+", help="Lighthouse JSON, PSI JSON or CrUX JSON path, or - for stdin (max 2)")
     ap.add_argument("--field", help="extra field data: a PSI response or CrUX API record JSON")
@@ -739,5 +744,15 @@ def main():
         print(text)
 
 
+
+def main():
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main()
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as a Lighthouse, PageSpeed Insights or CrUX report (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
-    main()
+    sys.exit(main())

package/packs/grc/skills/risk-register/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "risk-register",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Build or update an enterprise or project risk register — each risk written as cause, event and consequence, scored for likelihood and impact on a defined scale, inherent and residual ratings, a named owner, a treatment (avoid, reduce, transfer, accept), controls, a due date and a review trigger — with a heat map, the top risks that need a decision, and a stdlib script that validates the register CSV and flags overdue reviews. Use when the user wants a risk register, a risk log, a RAID log's risk section, a heat map, or says \"what are our top risks\", \"update the risk register\", \"score these risks\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/grc/skills/risk-register/scripts/check_register.py

@@ -144,14 +144,24 @@ def main(argv=None):
     try:
         if args.csv == "-":
             text = sys.stdin.read()
+            if text.startswith("\ufeff"):  # Excel's "CSV UTF-8" BOM, as the file path strips it
+                text = text[1:]
         else:
             with io.open(args.csv, "r", encoding="utf-8-sig", newline="") as fh:
                 text = fh.read()
     except (IOError, OSError) as exc:
         print("error: cannot read %s: %s" % (args.csv, exc), file=sys.stderr)
         return 2
+    except UnicodeDecodeError:
+        print("error: %s is not UTF-8 text; save it as UTF-8 (in Excel: CSV UTF-8)" % args.csv, file=sys.stderr)
+        return 2
 
-    reader = csv.DictReader(io.StringIO(text))
+    try:  # parse once up front, so a malformed file is one clear error, not a traceback mid-loop
+        list(csv.reader(io.StringIO(text, newline="")))
+    except csv.Error as exc:
+        print("error: %s is not a readable CSV: %s" % (args.csv, exc), file=sys.stderr)
+        return 2
+    reader = csv.DictReader(io.StringIO(text, newline=""))
     if not reader.fieldnames:
         print("error: %s has no header row" % args.csv, file=sys.stderr)
         return 2
@@ -169,7 +179,10 @@ def main(argv=None):
     seen_ids = {}
     total_rows = 0
 
-    for line_no, raw in enumerate(reader, start=2):
+    for raw in reader:
+        # reader.line_num counts blank lines and ends on this record's last line; step back over
+        # newlines inside quoted cells to the line the record starts on.
+        line_no = reader.line_num - sum(v.count("\n") for v in raw.values() if isinstance(v, str))
         row = dict((k.strip(), (v or "").strip()) for k, v in raw.items() if k is not None)
         if not any(row.values()):
             continue

package/packs/infra-as-code/skills/terraform-plan-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform-plan-review",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Review a terraform plan before apply, from the plan text or terraform show -json output. Flags every destroy and replace with the attribute forcing it, changes to stateful resources such as databases, buckets and volumes, IAM and security-group widening, drift nobody made in code, and changes outside the intended scope, then gives a SAFE TO APPLY, APPLY WITH CARE or DO NOT APPLY verdict with reasons. Use when the user pastes a plan, says \"review this terraform plan\", \"is this plan safe to apply\", \"why is terraform replacing my database\", or \"check the plan before I apply\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/infra-as-code/skills/terraform-plan-review/scripts/plan_summary.py

@@ -66,9 +66,11 @@ def die(msg):
 
 def load_plan(path):
     try:
-        raw = sys.stdin.read() if path == "-" else open(path, encoding="utf-8").read()
+        raw = sys.stdin.read() if path == "-" else open(path, encoding="utf-8-sig").read()
     except OSError as e:
         die(f"cannot read {path}: {e.strerror}")
+    except UnicodeDecodeError:
+        die(f"{path} is not UTF-8 text; save it as UTF-8 (e.g. terraform show -json tfplan | Out-File -Encoding utf8 plan.json) and retry")
     stripped = raw.lstrip()
     if not stripped:
         die("input is empty")
@@ -336,7 +338,7 @@ def to_markdown(r):
     return "\n".join(lines) + "\n"
 
 
-def main():
+def _main():
     ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
     ap.add_argument("plan", help="path to `terraform show -json` output, or - for stdin")
     ap.add_argument("--scope", action="append", default=[],
@@ -357,5 +359,15 @@ def main():
         sys.stdout.write(text)
 
 
+
+def main():
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main()
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as a Terraform JSON plan (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
-    main()
+    sys.exit(main())

package/packs/product-manager/skills/feedback-synthesis/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "feedback-synthesis",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Turn raw customer feedback — interview notes, support tickets, NPS or CSAT verbatims, app-store reviews, sales-call notes — into ranked themes a product decision can rest on, each a problem statement rather than a feature request, counted by distinct people or accounts not mentions, with segments, severity kept separate from frequency, verbatim quotes with source IDs, what people value, where sources disagree, what the sample cannot tell, and the questions for the next interviews. A stdlib script computes the counts. Use when the user says \"what are customers telling us\", \"synthesise this feedback\", \"find the themes in these tickets / reviews / NPS comments\", \"affinity map these interview notes\", or \"what should we fix first based on feedback\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/product-manager/skills/feedback-synthesis/scripts/theme_counts.py

@@ -75,6 +75,8 @@ def load(path: Path, person_col: str, ignore: set, segments_wanted: list):
         text = path.read_text(encoding="utf-8-sig")
     except OSError as e:
         die(f"cannot read {path}: {e}")
+    except UnicodeDecodeError:
+        die(f"{path} is not UTF-8 text; save it as UTF-8 (in Excel: CSV UTF-8)")
     reader = csv.DictReader(text.splitlines())
     if not reader.fieldnames:
         die(f"{path} has no header row")
@@ -334,7 +336,10 @@ def main(argv=None) -> int:
     a = ap.parse_args(argv)
 
     ignore = DEFAULT_IGNORE | {c.lower() for c in a.ignore}
-    rows, segs, warnings = load(a.csv, a.person_col, ignore, a.segment)
+    try:
+        rows, segs, warnings = load(a.csv, a.person_col, ignore, a.segment)
+    except csv.Error as e:  # e.g. a NUL byte, which Python before 3.11 rejects
+        die(f"{a.csv} is not a readable CSV: {e}")
     if not rows:
         die(f"{a.csv} has no feedback rows")
     label = a.person_label or ("person" if a.person_col == "person_id" else a.person_col.replace("_id", "").replace("_", " "))

package/packs/product-manager/skills/lean-canvas/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "lean-canvas",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Turn a startup or internal-product idea into a lean canvas that finds what could kill it — the nine boxes filled only from what the user said, each entry tagged evidence-backed (with its source) or assumption, the assumptions ranked by how likely each is wrong times how badly the idea fails if it is, the cheapest test with a pass/fail line set in advance for the top ones, a computed unit-economics check when price and costs are given, and a plain call when the idea should change before anything is built. Use when the user says \"lean canvas\", \"help me think through my startup idea\", \"what are the riskiest assumptions\", \"how do I validate this idea\", \"is this idea worth building\", or \"poke holes in my business model\".",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/product-manager/skills/lean-canvas/scripts/unit_economics.py

@@ -155,7 +155,7 @@ def compute(inp: dict) -> tuple[list[str], list[str]]:
                         f"Break-even needs {be_whole:,} active customers but the stated market holds {int(market):,}."
                     )
                 else:
-                    share = be_whole / market * 100
+                    share = be_whole / market * 100 if market else 0.0  # 0 needed of a 0 market
                     lines.append(f"Break-even share of the stated market: {share:.1f}%")
                     if share >= 25:
                         flags.append(

package/packs/research/skills/hypothesis-comparison/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "hypothesis-comparison",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Compare rival explanations for an observation with analysis of competing hypotheses (ACH) — list the hypotheses and the evidence, build a consistency matrix (consistent / inconsistent / neutral), rank hypotheses by how little evidence contradicts them rather than how much supports them, name the diagnostic evidence and the linchpins, and say which next observation would tell the leaders apart. Use when the user asks \"why did X happen\", \"which explanation fits the evidence\", \"what's really causing this\", wants to stop arguing over a favourite theory, or says \"compare these hypotheses\", \"competing explanations\", \"ACH\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/research/skills/hypothesis-comparison/scripts/ach_matrix.py

@@ -33,6 +33,7 @@ Exit codes: 0 report written, 2 bad input.
 
 import argparse
 import csv
+import io
 import sys
 from pathlib import Path
 
@@ -53,7 +54,11 @@ def load(path):
     p = Path(path)
     if not p.is_file():
         fail("file not found: " + str(path))
-    with p.open(newline="", encoding="utf-8-sig") as f:
+    try:
+        text = p.read_text(encoding="utf-8-sig")
+    except UnicodeDecodeError:
+        fail("{} is not UTF-8 text; save it as UTF-8 (in Excel: CSV UTF-8)".format(path))
+    with io.StringIO(text, newline="") as f:
         reader = csv.DictReader(f)
         if not reader.fieldnames:
             fail("the CSV is empty")
@@ -66,6 +71,9 @@ def load(path):
             fail("the CSV needs at least two hypothesis columns; ACH compares rivals")
         rows = []
         for i, raw in enumerate(reader, start=1):
+            if None in raw:
+                fail("row {}: more cells than the header has columns; put double quotes around any "
+                     "cell that contains a comma".format(i + 1))
             row = {(k or "").strip(): (v or "").strip() for k, v in raw.items()}
             lrow = {k.lower(): v for k, v in row.items()}
             ev = lrow.get("evidence", "")
@@ -120,7 +128,10 @@ def main():
     ap.add_argument("-o", "--output", help="write the report here instead of stdout")
     args = ap.parse_args()
 
-    hyps, rows = load(args.matrix)
+    try:
+        hyps, rows = load(args.matrix)
+    except csv.Error as e:  # e.g. a NUL byte, which Python before 3.11 rejects
+        fail("{} is not a readable CSV: {}".format(args.matrix, e))
     s = scores(hyps, rows)
     order = ranking(hyps, s)
     top = leaders(hyps, s)

package/packs/research/skills/source-synthesis/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "source-synthesis",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Answer a question from a set of sources the user supplied — papers, reports, articles, interview notes, emails — saying only what the material supports, labelling anything that comes from elsewhere where it appears, counting a source that repeats another once, and giving a labelled estimate when the user needs a figure the sources don't settle. Written in the length and format the user asked for; a full cited literature review only when that is the ask. Use when the user hands over several sources and asks to \"synthesise these\", \"what do these papers say\", \"pull together what we know\", \"literature review\", or \"where do the sources agree and disagree\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/research/skills/source-synthesis/scripts/citations.py

@@ -44,6 +44,7 @@ SOURCE_LINE = re.compile(r"^\s*(?:[-*+]\s+)?\[?(S\d+)\]?\s*[:.)\]\-—–]\s*(\S
 BRACKET = re.compile(r"\[([^\[\]]+)\](?!\()")
 CITE_PART = re.compile(r"^\s*(S\d+)\s*(?::\s*(.*?))?\s*$")
 LOOKS_LIKE_CITE = re.compile(r"^\s*S\d+\b")
+COMMA_CITE = re.compile(r",\s*S\d+\s*(?::|,|$)")  # [S1:p4, S2:p7]: parts joined by a comma, not ";"
 OUTSIDE = re.compile(r"\[outside\]", re.IGNORECASE)
 NO_CITE = "<!-- no-cite -->"
 HEADING = re.compile(r"^\s{0,3}(#{1,6})\s+(.*?)\s*#*\s*$")
@@ -218,7 +219,7 @@ def main():
                     continue
                 for part in inner.split(";"):
                     pm = CITE_PART.match(part)
-                    if not pm:
+                    if not pm or COMMA_CITE.search(pm.group(2) or ""):
                         malformed.append((n, "[" + inner + "]"))
                         continue
                     sid, loc = pm.group(1), (pm.group(2) or "").strip()

package/packs/skill-engineering/skills/skill-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "skill-review",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Audit an existing Agent Skill folder (SKILL.md plus its scripts, references and evals) for Claude Code, Codex, Copilot, Cursor, Kiro or Antigravity, and return a READY / FIX FIRST / REWRITE verdict with severity-tagged findings across five areas — whether a router would pick it and whether it collides with a sibling, portability, safety (mapped to the OWASP Agentic Skills Top 10), structure, and eval coverage — backed by a stdlib lint script for the mechanical checks. Use when the user says \"review this skill\", \"is my SKILL.md any good\", \"why doesn't my skill trigger\", \"is this skill safe to install\", or wants a skill checked before sharing or publishing it.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/skill-engineering/skills/skill-review/scripts/lint_skill.py

@@ -263,7 +263,7 @@ def read_lines(path):
 
 
 def check_structure(rep, skill_dir, text):
-    n = text.count("\n") + 1
+    n = text.count("\n") + (1 if text and not text.endswith("\n") else 0)
     rep.facts["skill_md_lines"] = n
     if n > MAX_LINES:
         rep.add("WARN", "structure", "SKILL.md is %d lines; past %d, split material into reference files" % (n, MAX_LINES), "SKILL.md")
@@ -322,6 +322,9 @@ def check_evals(rep, skill_dir, name):
                     if not isinstance(e, dict) or not e.get("prompt"):
                         rep.add("ERROR", "evals", "eval #%d has no prompt" % i, "evals/evals.json")
                         continue
+                    if not isinstance(e["prompt"], str):
+                        rep.add("ERROR", "evals", "eval #%d prompt is not a string; write it as the text a user would type" % i, "evals/evals.json")
+                        continue
                     if not isinstance(e.get("assertions"), list) or not e["assertions"]:
                         rep.add("ERROR", "evals", "eval #%d has no assertions; nothing says what a passing output looks like" % i, "evals/evals.json")
                         continue

package/packs/solution-architect/skills/event-contract-draft/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "event-contract-draft",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Draft the contract for an event or message interface (Kafka topics, SNS/SQS, EventBridge, Pub/Sub, RabbitMQ, webhooks) as an AsyncAPI 3.0 document plus a short decisions page — past-tense event names, a required envelope with event id for deduplication, the partition key and the ordering it does and doesn't give, at-least-once delivery and how consumers stay idempotent, data minimisation with PII marked, additive-only versioning with dated deprecation, and retention, replay and dead-letter handling. Use when the user wants to define events, design a Kafka topic or message schema, write an AsyncAPI spec, agree what a producer publishes and what consumers must do, or version an event safely.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },