skilldrop-cli 0.16.44 → 0.16.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skilldrop-cli",
-  "version": "0.16.44",
+  "version": "0.16.45",
   "description": "Portable AI-agent skills, measured against the agent without them. ADRs, PRDs, runbooks, decks and reviews, installable into Claude Code, Cursor, Kiro, and any IDE that takes custom instructions. One command per skill or per role-based pack.",
   "author": {
     "name": "Sanjay Ananthanarayan",

package/packs/converters/skills/md-to-html/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "md-to-html",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Turn a Markdown draft into one self-contained, print-friendly HTML file that survives being emailed or attached, with headings that have anchor links, tables, code, quotes, an optional table of contents, local images embedded, brand colours and fonts from a brand.json, Mermaid diagrams kept as text or drawn from a pinned CDN, and raw HTML escaped so nothing in the source runs. Use when the user wants Markdown \"as a web page\", \"as an HTML file I can send\", \"something people can open in a browser and print\", or says \"convert this to HTML\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/converters/skills/md-to-html/scripts/md_to_html.py

@@ -552,6 +552,9 @@ def build_toc(headings):
 
 
 def convert(src_text, base_dir, brand_path=None, toc=False, mermaid="none", allow_html=False):
+    # \x00 and \x01 mark the converter's own placeholders (code spans, line breaks); a source
+    # that contains them would collide with those markers, and neither belongs in a document.
+    src_text = src_text.replace("\x00", "").replace("\x01", "")
     ctx = Ctx(base_dir, allow_html, mermaid)
     brand = load_brand(brand_path, ctx)
     lines = src_text.replace("\r\n", "\n").replace("\r", "\n").split("\n")

package/packs/design/skills/brand-kit/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "brand-kit",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Capture a brand once as a reusable brand.json — logo files (and an on-dark version), colour roles as hex codes, heading and body fonts, voice, imagery rules, a PowerPoint template, contact details and the legal footer — plus a one-page BRAND.md, with text contrast checked and every value traced to where it came from. Use when the user wants decks, flyers or documents in their branding, says \"use our brand\", \"here's our logo and colours\", \"set up our brand kit\", or hands over brand guidelines.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/design/skills/brand-kit/scripts/check_brand.py

@@ -35,7 +35,7 @@ def contrast(a, b):
     return (la + 0.05) / (lb + 0.05)
 
 
-def main(argv):
+def _main(argv):
     if len(argv) != 1:
         print(__doc__)
         return 2
@@ -116,5 +116,15 @@ def main(argv):
     return 1 if fails else 0
 
 
+
+def main(argv):
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main(argv)
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as a brand file (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
     sys.exit(main(sys.argv[1:]))

package/packs/dev-team/skills/behaviour-equivalence/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "behaviour-equivalence",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Prove that a rewritten, migrated or refactored component behaves the same as the old one with a golden-master comparison — record inputs and outputs at a boundary (HTTP, function calls, batch files, DB writes, events) from production-shaped traffic and edge cases, run the old system twice to find its nondeterminism, normalise narrowly field by field, replay against the new one, triage every difference as defect, intended change (with a named approver) or missing normalisation, and give a verdict of EQUIVALENT, EQUIVALENT EXCEPT LISTED CHANGES, NOT EQUIVALENT or NOT PROVEN. Use when the user asks \"does the new one behave the same as the old one\", \"can we sign off the rewrite\", \"are these diffs just noise\", wants a golden-master, approval or shadow-traffic comparison, a parity check between old and new outputs, or says \"prove behaviour equivalence\".",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/behaviour-equivalence/scripts/golden_diff.py

@@ -495,7 +495,7 @@ def render(rep, max_diffs):
     return "\n".join(out) + "\n"
 
 
-def main(argv=None):
+def _main(argv=None):
     ap = argparse.ArgumentParser(description="Golden-master diff of old vs new recorded outputs.")
     ap.add_argument("old", help="directory or JSONL file of the old system's outputs")
     ap.add_argument("new", help="directory or JSONL file of the new system's outputs")
@@ -522,5 +522,15 @@ def main(argv=None):
     return 0 if rep["verdict"] != "NOT EQUIVALENT" else 1
 
 
+
+def main(argv=None):
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main(argv)
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as recordings and rules (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
     sys.exit(main())

package/packs/frontend/skills/bundle-size-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "bundle-size-review",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Find what makes a JavaScript bundle heavy and what can safely come out, from the bundler's stats file (webpack stats.json, an esbuild metafile, or the rollup-plugin-visualizer raw-data JSON that Vite builds use) read together with the repo around it (package.json, .browserslistrc, the lockfile, the bundler config and the source files that import the heavy modules). Gives each entry's first-load JavaScript in the exact bytes the stats record, kept apart from lazy chunks; finds whole-library imports, CommonJS packages that can't be tree-shaken, packages bundled twice and polyfills the browser targets don't need; names the import chain that pulls each module in before suggesting a removal; and, given before and after stats, says what grew, why, whether it lands in the first load and which per-entry budget would have caught it. Use when the user says \"why is our bundle so big\", \"what can we cut from the bundle\", \"review this stats.json\", \"why is lodash or moment in our bundle\", \"the bundle grew in this PR\", or \"set a bundle size budget\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/frontend/skills/bundle-size-review/scripts/bundle_stats.py

@@ -500,6 +500,8 @@ def load(path):
                 text = fh.read()
     except OSError as e:
         raise InputError("cannot read %s: %s" % (path, e))
+    except UnicodeDecodeError:
+        raise InputError("%s is not UTF-8 text; save it as UTF-8" % path)
     if not text.strip():
         raise InputError("%s is empty" % path)
     try:
@@ -1574,7 +1576,7 @@ def to_jsonable(o):
     raise TypeError(type(o))
 
 
-def main(argv=None):
+def _main(argv=None):
     ap = argparse.ArgumentParser(description="Size a JS bundle from webpack stats, an esbuild metafile or rollup-plugin-visualizer raw data, and read the project files around it.")
     ap.add_argument("stats", nargs="?", help="stats file, or - for stdin")
     ap.add_argument("--compare", nargs=2, metavar=("BEFORE", "AFTER"), help="diff two stats files")
@@ -1629,5 +1631,15 @@ def main(argv=None):
     return 1 if over else 0
 
 
+
+def main(argv=None):
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main(argv)
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as webpack, esbuild or Vite stats (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
     sys.exit(main())

package/packs/frontend/skills/web-performance-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "web-performance-review",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Read a Lighthouse report or PageSpeed Insights result, with field data when there is any (CrUX, PSI loadingExperience or RUM p75), and say what makes the page slow for real users and what to fix first, ranked by how much each fix moves LCP, INP and CLS at the 75th percentile. Names the LCP element and which LCP phase dominates, the elements that shift and why, the long tasks and third parties by main-thread time, and treats estimated savings as lab estimates that overlap. Use when the user shares a Lighthouse JSON or PSI result and asks \"why is this page slow\", \"what should we fix first\", \"we score 92 but Search Console says LCP is poor\", \"did our change fix INP\", \"review this Lighthouse report\", or \"how do we pass Core Web Vitals\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/frontend/skills/web-performance-review/scripts/lh_summary.py

@@ -702,7 +702,7 @@ def cmp_md(c):
     return "\n".join(L)
 
 
-def main():
+def _main():
     ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
     ap.add_argument("reports", nargs="+", help="Lighthouse JSON, PSI JSON or CrUX JSON path, or - for stdin (max 2)")
     ap.add_argument("--field", help="extra field data: a PSI response or CrUX API record JSON")
@@ -744,5 +744,15 @@ def main():
         print(text)
 
 
+
+def main():
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main()
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as a Lighthouse, PageSpeed Insights or CrUX report (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
-    main()
+    sys.exit(main())

package/packs/grc/skills/risk-register/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "risk-register",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Build or update an enterprise or project risk register — each risk written as cause, event and consequence, scored for likelihood and impact on a defined scale, inherent and residual ratings, a named owner, a treatment (avoid, reduce, transfer, accept), controls, a due date and a review trigger — with a heat map, the top risks that need a decision, and a stdlib script that validates the register CSV and flags overdue reviews. Use when the user wants a risk register, a risk log, a RAID log's risk section, a heat map, or says \"what are our top risks\", \"update the risk register\", \"score these risks\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/grc/skills/risk-register/scripts/check_register.py

@@ -152,8 +152,16 @@ def main(argv=None):
     except (IOError, OSError) as exc:
         print("error: cannot read %s: %s" % (args.csv, exc), file=sys.stderr)
         return 2
+    except UnicodeDecodeError:
+        print("error: %s is not UTF-8 text; save it as UTF-8 (in Excel: CSV UTF-8)" % args.csv, file=sys.stderr)
+        return 2
 
-    reader = csv.DictReader(io.StringIO(text))
+    try:  # parse once up front, so a malformed file is one clear error, not a traceback mid-loop
+        list(csv.reader(io.StringIO(text, newline="")))
+    except csv.Error as exc:
+        print("error: %s is not a readable CSV: %s" % (args.csv, exc), file=sys.stderr)
+        return 2
+    reader = csv.DictReader(io.StringIO(text, newline=""))
     if not reader.fieldnames:
         print("error: %s has no header row" % args.csv, file=sys.stderr)
         return 2

package/packs/infra-as-code/skills/terraform-plan-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform-plan-review",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Review a terraform plan before apply, from the plan text or terraform show -json output. Flags every destroy and replace with the attribute forcing it, changes to stateful resources such as databases, buckets and volumes, IAM and security-group widening, drift nobody made in code, and changes outside the intended scope, then gives a SAFE TO APPLY, APPLY WITH CARE or DO NOT APPLY verdict with reasons. Use when the user pastes a plan, says \"review this terraform plan\", \"is this plan safe to apply\", \"why is terraform replacing my database\", or \"check the plan before I apply\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/infra-as-code/skills/terraform-plan-review/scripts/plan_summary.py

@@ -338,7 +338,7 @@ def to_markdown(r):
     return "\n".join(lines) + "\n"
 
 
-def main():
+def _main():
     ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
     ap.add_argument("plan", help="path to `terraform show -json` output, or - for stdin")
     ap.add_argument("--scope", action="append", default=[],
@@ -359,5 +359,15 @@ def main():
         sys.stdout.write(text)
 
 
+
+def main():
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main()
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as a Terraform JSON plan (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
-    main()
+    sys.exit(main())

package/packs/product-manager/skills/feedback-synthesis/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "feedback-synthesis",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Turn raw customer feedback — interview notes, support tickets, NPS or CSAT verbatims, app-store reviews, sales-call notes — into ranked themes a product decision can rest on, each a problem statement rather than a feature request, counted by distinct people or accounts not mentions, with segments, severity kept separate from frequency, verbatim quotes with source IDs, what people value, where sources disagree, what the sample cannot tell, and the questions for the next interviews. A stdlib script computes the counts. Use when the user says \"what are customers telling us\", \"synthesise this feedback\", \"find the themes in these tickets / reviews / NPS comments\", \"affinity map these interview notes\", or \"what should we fix first based on feedback\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/product-manager/skills/feedback-synthesis/scripts/theme_counts.py

@@ -75,6 +75,8 @@ def load(path: Path, person_col: str, ignore: set, segments_wanted: list):
         text = path.read_text(encoding="utf-8-sig")
     except OSError as e:
         die(f"cannot read {path}: {e}")
+    except UnicodeDecodeError:
+        die(f"{path} is not UTF-8 text; save it as UTF-8 (in Excel: CSV UTF-8)")
     reader = csv.DictReader(text.splitlines())
     if not reader.fieldnames:
         die(f"{path} has no header row")
@@ -334,7 +336,10 @@ def main(argv=None) -> int:
     a = ap.parse_args(argv)
 
     ignore = DEFAULT_IGNORE | {c.lower() for c in a.ignore}
-    rows, segs, warnings = load(a.csv, a.person_col, ignore, a.segment)
+    try:
+        rows, segs, warnings = load(a.csv, a.person_col, ignore, a.segment)
+    except csv.Error as e:  # e.g. a NUL byte, which Python before 3.11 rejects
+        die(f"{a.csv} is not a readable CSV: {e}")
     if not rows:
         die(f"{a.csv} has no feedback rows")
     label = a.person_label or ("person" if a.person_col == "person_id" else a.person_col.replace("_id", "").replace("_", " "))

package/packs/research/skills/hypothesis-comparison/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "hypothesis-comparison",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Compare rival explanations for an observation with analysis of competing hypotheses (ACH) — list the hypotheses and the evidence, build a consistency matrix (consistent / inconsistent / neutral), rank hypotheses by how little evidence contradicts them rather than how much supports them, name the diagnostic evidence and the linchpins, and say which next observation would tell the leaders apart. Use when the user asks \"why did X happen\", \"which explanation fits the evidence\", \"what's really causing this\", wants to stop arguing over a favourite theory, or says \"compare these hypotheses\", \"competing explanations\", \"ACH\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/research/skills/hypothesis-comparison/scripts/ach_matrix.py

@@ -33,6 +33,7 @@ Exit codes: 0 report written, 2 bad input.
 
 import argparse
 import csv
+import io
 import sys
 from pathlib import Path
 
@@ -53,7 +54,11 @@ def load(path):
     p = Path(path)
     if not p.is_file():
         fail("file not found: " + str(path))
-    with p.open(newline="", encoding="utf-8-sig") as f:
+    try:
+        text = p.read_text(encoding="utf-8-sig")
+    except UnicodeDecodeError:
+        fail("{} is not UTF-8 text; save it as UTF-8 (in Excel: CSV UTF-8)".format(path))
+    with io.StringIO(text, newline="") as f:
         reader = csv.DictReader(f)
         if not reader.fieldnames:
             fail("the CSV is empty")
@@ -123,7 +128,10 @@ def main():
     ap.add_argument("-o", "--output", help="write the report here instead of stdout")
     args = ap.parse_args()
 
-    hyps, rows = load(args.matrix)
+    try:
+        hyps, rows = load(args.matrix)
+    except csv.Error as e:  # e.g. a NUL byte, which Python before 3.11 rejects
+        fail("{} is not a readable CSV: {}".format(args.matrix, e))
     s = scores(hyps, rows)
     order = ranking(hyps, s)
     top = leaders(hyps, s)

package/packs/solution-architect/skills/event-contract-draft/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "event-contract-draft",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Draft the contract for an event or message interface (Kafka topics, SNS/SQS, EventBridge, Pub/Sub, RabbitMQ, webhooks) as an AsyncAPI 3.0 document plus a short decisions page — past-tense event names, a required envelope with event id for deduplication, the partition key and the ordering it does and doesn't give, at-least-once delivery and how consumers stay idempotent, data minimisation with PII marked, additive-only versioning with dated deprecation, and retention, replay and dead-letter handling. Use when the user wants to define events, design a Kafka topic or message schema, write an AsyncAPI spec, agree what a producer publishes and what consumers must do, or version an event safely.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/solution-architect/skills/event-contract-draft/scripts/check_asyncapi.py

@@ -113,9 +113,11 @@ class Report:
 
 def load(path):
     try:
-        text = sys.stdin.read() if path == "-" else Path(path).read_text(encoding="utf-8")
+        text = sys.stdin.read() if path == "-" else Path(path).read_text(encoding="utf-8-sig")
     except OSError as exc:
         raise SystemExit(f"error: cannot read {path}: {exc.strerror}")
+    except UnicodeDecodeError:
+        raise SystemExit(f"error: {path} is not UTF-8 text; save it as UTF-8")
     stripped = text.lstrip()
     if not stripped:
         raise SystemExit(f"error: {path} is empty")
@@ -484,7 +486,7 @@ def check(doc):
     return rep, counts
 
 
-def main(argv=None):
+def _main(argv=None):
     parser = argparse.ArgumentParser(description=__doc__.split("\n\n")[0])
     parser.add_argument("path", help="AsyncAPI 3.0 document as JSON, or - for stdin")
     parser.add_argument("-o", "--output", help="write the report to this path as well as stdout")
@@ -505,5 +507,15 @@ def main(argv=None):
     return 1 if rep.fails else 0
 
 
+
+def main(argv=None):
+    """Run, and turn an input that parses but has the wrong shape into one clear error."""
+    try:
+        return _main(argv)
+    except (KeyError, TypeError, AttributeError, IndexError, ValueError) as e:
+        print("error: couldn't read the input as an AsyncAPI document (%s: %s). If it is one, this is a bug: "
+              "please report it with the file." % (type(e).__name__, e), file=sys.stderr)
+        return 2
+
 if __name__ == "__main__":
     sys.exit(main())

package/packs/sre-oncall/skills/cloud-cost-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "cloud-cost-review",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Review actual cloud spend from a cost export (AWS CUR or Data Exports, GCP billing export, Azure cost details) and produce a ranked savings report — idle and unattached resources, oversized instances backed by utilisation evidence, storage tiering, data transfer hot spots, commitment coverage and untagged spend — each finding with a monthly saving computed from the bill, a confidence level and an ease rating. Use when the user shares a cost CSV and says \"where are we wasting money\", \"review our AWS bill\", \"why did the cloud bill jump this month\", \"find savings in our GCP/Azure spend\", or \"should we buy savings plans\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/sre-oncall/skills/cloud-cost-review/scripts/cost_summary.py

@@ -607,6 +607,8 @@ def main(argv=None):
             fmt, used, rows = load(Path(args.csv), args.format)
         except UnicodeDecodeError:
             raise InputError("%s is not UTF-8 text; save it as UTF-8 (CSV UTF-8) and retry" % args.csv)
+        except csv.Error as e:  # e.g. a NUL byte, which Python before 3.11 rejects
+            raise InputError("%s is not a readable CSV: %s" % (args.csv, e))
         a = analyse(rows, args.tag, args.month, args.top, fmt)
     except InputError as e:
         print("error: %s" % e, file=sys.stderr)

package/packs/trackers/skills/backlog-triage/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "backlog-triage",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Triage a whole backlog export from Jira, Linear or GitHub Projects (CSV, JSON or an MCP tool) — duplicate and near-duplicate pairs with the reason, items missing acceptance criteria or an owner, stale items, oversized items to split, priority conflicts, and a proposed ordering with a reason per item — ending in a change list the user can apply. A stdlib script computes the mechanical checks. Use when the user wants to clean up, groom or refine a backlog, find duplicate tickets, or says \"triage our backlog\", \"what should we pull next?\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/trackers/skills/backlog-triage/scripts/triage_backlog.py

@@ -254,7 +254,10 @@ def main(argv=None) -> int:
 
     if not args.export.exists():
         die("{} does not exist".format(args.export))
-    rows = load_rows(args.export)
+    try:
+        rows = load_rows(args.export)
+    except csv.Error as e:  # e.g. a NUL byte, which Python before 3.11 rejects
+        die("{} is not a readable export: {}".format(args.export, e))
     if not rows:
         die("{} has no issues in it".format(args.export))
     headers = []

package/packs/trackers/skills/team-status-report/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "team-status-report",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Write a weekly team status report from tracker data (Jira, Linear or GitHub Projects, via CSV, JSON or an MCP tool) — shipped, in progress, blocked with the blocker and owner, slipped against plan, risks and asks — with every number computed from the data by a stdlib script, never estimated, and a RAG status that states the rule that set it. Use when the user wants a weekly status update, sprint report or stakeholder update from the tracker, or says \"write this week's status report\", \"are we on track?\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/trackers/skills/team-status-report/scripts/status_counts.py

@@ -234,7 +234,10 @@ def main(argv=None) -> int:
 
     if not args.export.exists():
         die("{} does not exist".format(args.export))
-    rows = load_rows(args.export)
+    try:
+        rows = load_rows(args.export)
+    except csv.Error as e:  # e.g. a NUL byte, which Python before 3.11 rejects
+        die("{} is not a readable export: {}".format(args.export, e))
     if not rows:
         die("{} has no issues in it".format(args.export))
     headers = []