skilldrop-cli 0.16.46 → 1.0.1

package/README.md

@@ -31,7 +31,7 @@ Every skill runs as a real agent session twice: once with the skill, once withou
 - **Two blind judges preferred the skill's answer in 61% of pairs** (95% interval 55–68%). Each judge saw only the request and both answers, in shuffled order.
 - **4 skills that didn't beat the plain agent were [retired](https://sananthanarayan.github.io/skilldrop/evals/#retired)**, and they're listed. Each new skill has to win on held-out evals before it ships.
 
-[Get started](https://sananthanarayan.github.io/skilldrop/start/) · [Browse the packs](https://sananthanarayan.github.io/skilldrop/packs/) · [Search all skills](https://sananthanarayan.github.io/skilldrop/catalogue/) · [Docs](https://sananthanarayan.github.io/skilldrop/docs/) · [Contribute](CONTRIBUTING.md)
+[Get started](https://sananthanarayan.github.io/skilldrop/start/) · [Browse the packs](https://sananthanarayan.github.io/skilldrop/packs/) · [Search all skills](https://sananthanarayan.github.io/skilldrop/catalogue/) · [Docs](https://sananthanarayan.github.io/skilldrop/docs/) · [What stays stable in 1.x](guides/reference/versioning-and-stability.md) · [Contribute](CONTRIBUTING.md)
 
 ## Start in one command
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skilldrop-cli",
-  "version": "0.16.46",
+  "version": "1.0.1",
   "description": "Portable AI-agent skills, measured against the agent without them. ADRs, PRDs, runbooks, decks and reviews, installable into Claude Code, Cursor, Kiro, and any IDE that takes custom instructions. One command per skill or per role-based pack.",
   "author": {
     "name": "Sanjay Ananthanarayan",

package/packs/ai-engineering/skills/ai-usage-report/examples/weekly-engineering-team.md

@@ -6,22 +6,22 @@ A small synthetic event log demonstrating the three views — including graceful
 
 ```csv
 timestamp,user,tool,session_id,output_consumed,consumed_at,outcome
-2026-05-19T09:14:23Z,alice@acme.com,claude-code,sess-001,1,2026-05-19T11:02:00Z,success
-2026-05-19T09:14:55Z,alice@acme.com,claude-code,sess-001,1,2026-05-19T11:02:00Z,success
-2026-05-19T09:18:02Z,alice@acme.com,deck-builder,sess-001,1,2026-05-19T14:30:00Z,success
-2026-05-19T10:01:11Z,bob@acme.com,cursor,sess-014,0,,success
-2026-05-19T10:01:30Z,bob@acme.com,cursor,sess-015,0,,success
-2026-05-19T10:02:11Z,bob@acme.com,cursor,sess-016,0,,success
-2026-05-19T10:03:11Z,bob@acme.com,cursor,sess-017,0,,success
-2026-05-19T10:04:11Z,bob@acme.com,cursor,sess-018,0,,success
-2026-05-20T14:22:08Z,carol@acme.com,claude-code,sess-029,1,2026-05-22T08:11:00Z,success
-2026-05-20T15:22:08Z,carol@acme.com,adr-generator,sess-029,1,2026-05-22T08:11:00Z,success
-2026-05-20T16:22:08Z,carol@acme.com,design-doc,sess-030,1,2026-05-22T08:11:00Z,success
-2026-05-19T11:14:23Z,dan@acme.com,claude-code,sess-101,1,2026-05-19T13:00:00Z,success
-2026-05-19T11:15:23Z,dan@acme.com,claude-code,sess-101,0,,success
-2026-05-20T08:14:23Z,eve@acme.com,claude-code,sess-201,1,2026-05-20T09:00:00Z,success
-2026-05-20T08:15:23Z,eve@acme.com,claude-code,sess-201,1,2026-05-20T09:00:00Z,success
-2026-05-20T08:16:23Z,eve@acme.com,cursor,sess-202,1,2026-05-20T10:00:00Z,success
+2026-05-19T09:14:23Z,alice@acme.example,claude-code,sess-001,1,2026-05-19T11:02:00Z,success
+2026-05-19T09:14:55Z,alice@acme.example,claude-code,sess-001,1,2026-05-19T11:02:00Z,success
+2026-05-19T09:18:02Z,alice@acme.example,deck-builder,sess-001,1,2026-05-19T14:30:00Z,success
+2026-05-19T10:01:11Z,bob@acme.example,cursor,sess-014,0,,success
+2026-05-19T10:01:30Z,bob@acme.example,cursor,sess-015,0,,success
+2026-05-19T10:02:11Z,bob@acme.example,cursor,sess-016,0,,success
+2026-05-19T10:03:11Z,bob@acme.example,cursor,sess-017,0,,success
+2026-05-19T10:04:11Z,bob@acme.example,cursor,sess-018,0,,success
+2026-05-20T14:22:08Z,carol@acme.example,claude-code,sess-029,1,2026-05-22T08:11:00Z,success
+2026-05-20T15:22:08Z,carol@acme.example,adr-generator,sess-029,1,2026-05-22T08:11:00Z,success
+2026-05-20T16:22:08Z,carol@acme.example,design-doc,sess-030,1,2026-05-22T08:11:00Z,success
+2026-05-19T11:14:23Z,dan@acme.example,claude-code,sess-101,1,2026-05-19T13:00:00Z,success
+2026-05-19T11:15:23Z,dan@acme.example,claude-code,sess-101,0,,success
+2026-05-20T08:14:23Z,eve@acme.example,claude-code,sess-201,1,2026-05-20T09:00:00Z,success
+2026-05-20T08:15:23Z,eve@acme.example,claude-code,sess-201,1,2026-05-20T09:00:00Z,success
+2026-05-20T08:16:23Z,eve@acme.example,cursor,sess-202,1,2026-05-20T10:00:00Z,success
 ```
 
 16 events, 5 users, 5 tools, period 2026-05-19 → 2026-05-20.
@@ -56,11 +56,11 @@ python3 scripts/build_report.py events.csv \
 
 | User | Invocations | Sessions | Avg / session | Distinct tools | Effectiveness rate | Single-shot rate |
 |---|---:|---:|---:|---:|---:|---:|
-| alice@acme.com | 3 | 1 | 3.0 | 2 | 100% | 0% |
-| bob@acme.com | 5 | 5 | 1.0 | 1 | 0% | 100% |
-| carol@acme.com | 3 | 2 | 1.5 | 3 | 100% | 50% |
-| dan@acme.com | 2 | 1 | 2.0 | 1 | 50% | 0% |
-| eve@acme.com | 3 | 2 | 1.5 | 2 | 100% | 50% |
+| alice@acme.example | 3 | 1 | 3.0 | 2 | 100% | 0% |
+| bob@acme.example | 5 | 5 | 1.0 | 1 | 0% | 100% |
+| carol@acme.example | 3 | 2 | 1.5 | 3 | 100% | 50% |
+| dan@acme.example | 2 | 1 | 2.0 | 1 | 50% | 0% |
+| eve@acme.example | 3 | 2 | 1.5 | 2 | 100% | 50% |
 ```
 
 **Reading the data:**
@@ -99,13 +99,13 @@ If the input is missing optional fields, columns drop silently to `—`:
 
 ```csv
 timestamp,user,tool
-2026-05-19T09:14:23Z,alice@acme.com,claude-code
-2026-05-19T09:14:55Z,alice@acme.com,claude-code
+2026-05-19T09:14:23Z,alice@acme.example,claude-code
+2026-05-19T09:14:55Z,alice@acme.example,claude-code
 ```
 
 ```markdown
 | User | Invocations | Sessions | Avg / session | Distinct tools | Effectiveness rate | Single-shot rate |
-| alice@acme.com | 2 | — | — | 1 | — | — |
+| alice@acme.example | 2 | — | — | 1 | — | — |
 ```
 
 The "Where signals are missing" section then explains *what* couldn't be computed and *why*.

package/packs/ai-engineering/skills/ai-usage-report/templates/usage-event-schema.md

@@ -49,20 +49,20 @@ When a column is omitted, the report includes a *"Where signals are missing"* se
 
 ```csv
 timestamp,user,tool,session_id,output_consumed,consumed_at,outcome
-2026-05-21T09:14:23Z,alice@acme.com,claude-code,sess-001,1,2026-05-21T11:02:00Z,success
-2026-05-21T09:14:55Z,alice@acme.com,claude-code,sess-001,1,2026-05-21T11:02:00Z,success
-2026-05-21T09:18:02Z,alice@acme.com,deck-builder,sess-001,1,2026-05-21T14:30:00Z,success
-2026-05-21T10:01:11Z,bob@acme.com,cursor,sess-014,0,,success
-2026-05-21T10:01:30Z,bob@acme.com,cursor,sess-014,0,,success
-2026-05-21T14:22:08Z,carol@acme.com,claude-code,sess-029,1,2026-05-22T08:11:00Z,success
+2026-05-21T09:14:23Z,alice@acme.example,claude-code,sess-001,1,2026-05-21T11:02:00Z,success
+2026-05-21T09:14:55Z,alice@acme.example,claude-code,sess-001,1,2026-05-21T11:02:00Z,success
+2026-05-21T09:18:02Z,alice@acme.example,deck-builder,sess-001,1,2026-05-21T14:30:00Z,success
+2026-05-21T10:01:11Z,bob@acme.example,cursor,sess-014,0,,success
+2026-05-21T10:01:30Z,bob@acme.example,cursor,sess-014,0,,success
+2026-05-21T14:22:08Z,carol@acme.example,claude-code,sess-029,1,2026-05-22T08:11:00Z,success
 ```
 
 ## Example: JSONL
 
 ```jsonl
-{"timestamp": "2026-05-21T09:14:23Z", "user": "alice@acme.com", "tool": "claude-code", "session_id": "sess-001", "output_consumed": true, "outcome": "success"}
-{"timestamp": "2026-05-21T09:14:55Z", "user": "alice@acme.com", "tool": "claude-code", "session_id": "sess-001", "output_consumed": true, "outcome": "success"}
-{"timestamp": "2026-05-21T10:01:11Z", "user": "bob@acme.com", "tool": "cursor", "session_id": "sess-014", "output_consumed": false, "outcome": "success"}
+{"timestamp": "2026-05-21T09:14:23Z", "user": "alice@acme.example", "tool": "claude-code", "session_id": "sess-001", "output_consumed": true, "outcome": "success"}
+{"timestamp": "2026-05-21T09:14:55Z", "user": "alice@acme.example", "tool": "claude-code", "session_id": "sess-001", "output_consumed": true, "outcome": "success"}
+{"timestamp": "2026-05-21T10:01:11Z", "user": "bob@acme.example", "tool": "cursor", "session_id": "sess-014", "output_consumed": false, "outcome": "success"}
 ```
 
 ## A note on the `output_consumed` signal

package/packs/converters/skills/file-to-markdown/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "file-to-markdown",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Convert a Word document, PowerPoint deck, Excel workbook, web page, CSV, JSON, text file, email (.eml or Outlook .msg) or PDF into clean Markdown that keeps headings, lists, tables, links, bold and italic, slide titles and speaker notes, and reports everything it dropped (images, charts, comments, formulas, tracked changes), so the content can be read, reviewed or fed to another skill. Use when the user hands over a .docx, .pptx, .xlsx, .html, .csv, .json, .eml, .msg or .pdf and says \"read this\", \"turn this into markdown\", \"extract the text\", or wants it critiqued or briefed.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/converters/skills/file-to-markdown/scripts/to_markdown.py

@@ -26,6 +26,7 @@ import subprocess
 import sys
 import tempfile
 import zipfile
+import zlib
 from collections import OrderedDict
 from datetime import datetime, timedelta
 from html.parser import HTMLParser
@@ -148,12 +149,29 @@ def truthy(el, attr=W + "val"):
     return v is None or v not in ("0", "false", "off", "none")
 
 
+def span_of(value, cap):
+    """A cell's column span, from 1 to the format's own limit (Word: 63 columns; HTML: colspan
+    1000), so a damaged or hostile value can't make a row of a billion cells."""
+    v = (value or "1").strip()
+    return min(int(v), cap) if v.isascii() and v.isdigit() and int(v) > 0 else 1
+
+
 def open_zip(path, kind):
     try:
-        return zipfile.ZipFile(str(path))
+        z = zipfile.ZipFile(str(path))
     except zipfile.BadZipFile:
+        with open(str(path), "rb") as fh:
+            if fh.read(8) == b"\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1":
+                # Office saves a password-protected .docx/.pptx/.xlsx as a compound file holding
+                # the encrypted package, not as a zip
+                sys.exit("error: %s is password-protected (or an old binary Office file). Open it, remove "
+                         "the password or save it as %s, and rerun." % (path, kind))
         sys.exit("error: %s is not a valid %s file (not a zip package). If it is an old binary "
                  "Office file, save it as %s first." % (path, kind, kind))
+    if any(info.flag_bits & 0x1 for info in z.infolist()):
+        sys.exit("error: %s has encrypted parts, which Office never writes; it is damaged, or was "
+                 "zipped with a password by another tool" % path)
+    return z
 
 
 # ---------------------------------------------------------------- docx
@@ -210,6 +228,9 @@ def docx_to_md(path, rep):
                 break
 
     body = ET.fromstring(z.read("word/document.xml")).find(W + "body")
+    if body is None:
+        sys.exit("error: %s has no document body (word/document.xml has no w:body in the WordprocessingML "
+                 "namespace); it is not a Word document, or it is damaged" % path)
 
     def para_segments(p, in_table=False):
         segs = []
@@ -312,7 +333,7 @@ def docx_to_md(path, rep):
                 return ("decimal", 0)
             return None
         fmt = num_fmt.get(num_id, {}).get(ilvl, "bullet")
-        return (fmt, int(ilvl))
+        return (fmt, min(max(int(ilvl), 0), 8))  # Word's list levels are 0 to 8
 
     def table_md(tbl):
         rows = []
@@ -332,7 +353,7 @@ def docx_to_md(path, rep):
                         text = ""
                 row.append(text)
                 if tcpr is not None and tcpr.find(W + "gridSpan") is not None:
-                    row.extend([""] * (int(tcpr.find(W + "gridSpan").get(W + "val", "1")) - 1))
+                    row.extend([""] * (span_of(tcpr.find(W + "gridSpan").get(W + "val"), 63) - 1))
             rows.append(row)
         if len(list(tbl.iter(W + "tbl"))) > 1:
             rep.notes.append("a nested table was flattened into its parent cell")
@@ -523,7 +544,7 @@ def pptx_to_md(path, rep):
             if not text:
                 continue
             ppr = p.find(A + "pPr")
-            lvl = int(ppr.get("lvl", "0")) if ppr is not None else 0
+            lvl = min(max(int(ppr.get("lvl", "0")), 0), 8) if ppr is not None else 0  # PowerPoint's are 0 to 8
             bullet = is_body
             if ppr is not None:
                 if ppr.find(A + "buNone") is not None:
@@ -618,12 +639,16 @@ def pptx_to_md(path, rep):
 BUILTIN_DATE_FMTS = set(range(14, 23)) | {45, 46, 47}
 
 
-def col_index(ref):
-    letters = re.match(r"([A-Z]+)", ref).group(1)
+def cell_ref(ref):
+    """(row, column) from a cell reference such as B7 or $B$7, counting from 0; None for anything
+    else, so a damaged reference skips that cell rather than the sheet."""
+    m = re.fullmatch(r"\$?([A-Za-z]{1,3})\$?(\d{1,7})", ref.strip())
+    if not m or int(m.group(2)) < 1:
+        return None
     n = 0
-    for ch in letters:
+    for ch in m.group(1).upper():
         n = n * 26 + (ord(ch) - 64)
-    return n - 1
+    return int(m.group(2)) - 1, n - 1
 
 
 def xlsx_to_md(path, rep, max_rows=0):
@@ -678,8 +703,10 @@ def xlsx_to_md(path, rep, max_rows=0):
             ref = c.get("r")
             if not ref:
                 continue
-            row = int(re.search(r"(\d+)$", ref).group(1)) - 1
-            col = col_index(ref)
+            rc = cell_ref(ref)
+            if rc is None:
+                continue
+            row, col = rc
             t = c.get("t", "n")
             v = c.find(S + "v")
             if c.find(S + "f") is not None:
@@ -717,13 +744,14 @@ def xlsx_to_md(path, rep, max_rows=0):
             out.append("*(empty sheet)*")
             out.append("")
             continue
+        # Only the rows and columns that hold a value: one stray cell at ZZZ999999 must not
+        # build a grid of a million empty rows.
         rows_used = sorted({r for r, _ in grid})
         cols_used = sorted({c for _, c in grid})
-        c0, c1 = cols_used[0], cols_used[-1]
-        table = []
-        for r in range(rows_used[0], rows_used[-1] + 1):
-            table.append([grid.get((r, c), "") for c in range(c0, c1 + 1)])
-        table = [r for r in table if any(r)]
+        gaps = cols_used[-1] - cols_used[0] + 1 - len(cols_used)
+        if gaps:
+            rep.notes.append("sheet '%s': %d empty column(s) left out" % (name, gaps))
+        table = [[grid.get((r, c), "") for c in cols_used] for r in rows_used]
         if max_rows and len(table) > max_rows + 1:
             rep.notes.append("sheet '%s' cut to %d of %d data rows (--max-rows)"
                              % (name, max_rows, len(table) - 1))
@@ -860,8 +888,7 @@ class HTMLToMD(HTMLParser):
             if not self.table:
                 self.table.append([])
             self.cell = []
-            span = int(a.get("colspan") or "1") if (a.get("colspan") or "1").isdigit() else 1
-            self._span = span
+            self._span = span_of(a.get("colspan"), 1000)
 
     def handle_endtag(self, tag):
         if tag in self.SKIP:
@@ -1028,29 +1055,60 @@ def _human_size(n):
         n /= 1024.0
 
 
+def _part_text(part):
+    """A text part's content. A charset Python doesn't know (a typo, or a vendor's own label) is
+    read as UTF-8 with replacement characters, as html_to_md does, rather than lost."""
+    try:
+        return part.get_content()
+    except LookupError:
+        return (part.get_payload(decode=True) or b"").decode("utf-8", "replace")
+
+
+def _unescape(text):
+    """The email package keeps undecodable header bytes as surrogates, which can't be written as
+    UTF-8. Read them as UTF-8, with a replacement character for any that aren't."""
+    return text.encode("utf-8", "surrogateescape").decode("utf-8", "replace")
+
+
+def _header(msg, name):
+    """A header's decoded value, or its raw text when it won't parse: Python 3.9's email package
+    raises on a malformed date or address that later versions keep."""
+    try:
+        return _unescape(str(msg.get(name, "")))
+    except (TypeError, ValueError, IndexError, AttributeError, OverflowError):
+        return _unescape(next((" ".join(str(v).split()) for k, v in msg.raw_items() if k.lower() == name.lower()), ""))
+
+
 def eml_to_md(path, rep):
     """An RFC 5322 message (.eml): the plain-text part when there is one, else the HTML part."""
     import email
     from email import policy
     msg = email.message_from_bytes(path.read_bytes(), policy=policy.default)
-    rows = [("From", str(msg.get("From", ""))), ("To", str(msg.get("To", ""))), ("Cc", str(msg.get("Cc", ""))),
-            ("Date", str(msg.get("Date", "")))]
-    plain = msg.get_body(preferencelist=("plain",))
-    html = msg.get_body(preferencelist=("html",))
+    rows = [(h, _header(msg, h)) for h in ("From", "To", "Cc", "Date")]
+    try:
+        plain = msg.get_body(preferencelist=("plain",))
+        html = msg.get_body(preferencelist=("html",))
+        parts = list(msg.iter_attachments())
+    except (AttributeError, TypeError, KeyError):
+        # Python 3.9 fails inside get_body on a multipart message whose boundary never appears.
+        # Read it as one text body, which is what the raw message holds.
+        raw = msg.get_payload()
+        rep.notes.append("the message's MIME parts could not be separated, so its body is the raw text")
+        return _email_md(_header(msg, "Subject"), rows, _email_text(_unescape(raw) if isinstance(raw, str) else ""), [], rep)
     if plain is not None:
-        body = _email_text(plain.get_content())
+        body = _email_text(_part_text(plain))
         if html is not None:
             rep.drop("HTML alternative (the plain-text part was used)", 1)
     elif html is not None:
-        body = _html_text_to_md(html.get_content(), rep)
+        body = _html_text_to_md(_part_text(html), rep)
     else:
         body = ""
     attachments = []
-    for part in msg.iter_attachments():
+    for part in parts:
         payload = part.get_payload(decode=True)
         name = part.get_filename() or ("forwarded message" if part.get_content_type() == "message/rfc822" else None)
         attachments.append((name, len(payload) if payload is not None else None))
-    return _email_md(str(msg.get("Subject", "")), rows, body, attachments, rep)
+    return _email_md(_header(msg, "Subject"), rows, body, attachments, rep)
 
 
 class _CFB:
@@ -1073,14 +1131,20 @@ class _CFB:
         minifat_start, nminifat, difat_start, ndifat = struct.unpack_from("<IIII", data, 60)
         difat = list(struct.unpack_from("<109I", data, 76))
         per = self.ss // 4
-        s, guard = difat_start, 0
-        while ndifat and s < 0xFFFFFFFA and guard < 10000:
+        # A FAT never needs more sectors than it takes to map the file, and lists each one once:
+        # a repeated or looping list would otherwise build a table far larger than the file.
+        nsect = len(data) // self.ss - 1
+        need = -(-nsect // per)
+        s, seen = difat_start, set()
+        while ndifat and s < 0xFFFFFFFA and s not in seen and len(seen) < need:
+            seen.add(s)
             vals = struct.unpack("<%dI" % per, self._sector(s))
             difat += vals[:-1]
-            s, guard, ndifat = vals[-1], guard + 1, ndifat - 1
-        self.fat = []
-        for fs in difat[:nfat]:
-            if fs < 0xFFFFFFFA:
+            s, ndifat = vals[-1], ndifat - 1
+        self.fat, used = [], set()
+        for fs in difat[:min(nfat, need)]:
+            if fs < 0xFFFFFFFA and fs not in used:
+                used.add(fs)
                 self.fat += struct.unpack("<%dI" % per, self._sector(fs))
         raw = self._chain(dir_start)
         self.entries = []
@@ -1108,16 +1172,17 @@ class _CFB:
         return self.d[off:off + self.ss]
 
     def _chain(self, start, mini=False):
-        fat, out, n, seen = (self.minifat if mini else self.fat), [], start, 0
+        fat, out, n, seen = (self.minifat if mini else self.fat), [], start, set()
         while n < 0xFFFFFFFA:
-            if n >= len(fat) or seen > 1000000:
+            if n >= len(fat) or n in seen:  # off the table, or a loop: each sector is read once
                 raise ValueError("compound file has a broken sector chain")
+            seen.add(n)
             if mini:
                 off = n * self.mss
                 out.append(self.ministream[off:off + self.mss])
             else:
                 out.append(self._sector(n))
-            n, seen = fat[n], seen + 1
+            n = fat[n]
         return b"".join(out)
 
     def children(self, idx):
@@ -1171,8 +1236,11 @@ def _msg_fixed(cfb, idx, header):
         ptype, pid = tag & 0xFFFF, "%04X" % (tag >> 16)
         if ptype == 0x0040:
             ft, = struct.unpack_from("<Q", data, off + 8)
-            if ft:
-                out[pid] = _dt(1601, 1, 1) + timedelta(microseconds=ft // 10)
+            try:
+                if ft:
+                    out[pid] = _dt(1601, 1, 1) + timedelta(microseconds=ft // 10)
+            except OverflowError:
+                pass  # a time past the year 9999 is a placeholder or damage; the message has no date
         elif ptype == 0x0003:
             out[pid] = struct.unpack_from("<i", data, off + 8)[0]
     return out
@@ -1679,6 +1747,9 @@ HANDLERS = {
     ".html": html_to_md, ".htm": html_to_md, ".csv": csv_to_md, ".tsv": csv_to_md,
     ".json": json_to_md, ".pdf": pdf_to_md, ".eml": eml_to_md, ".msg": msg_to_md,
 }
+# What a damaged or truncated file raises from the zip, XML, compound-file and email layers.
+DAMAGED = (zipfile.BadZipFile, zipfile.LargeZipFile, zlib.error, EOFError, ET.ParseError, ValueError, LookupError,
+           KeyError, IndexError, NotImplementedError, OSError)
 LEGACY = {".doc": ".docx", ".ppt": ".pptx", ".xls": ".xlsx", ".rtf": ".docx", ".odt": ".docx",
           ".pages": ".docx", ".key": ".pptx", ".numbers": ".xlsx"}
 
@@ -1711,8 +1782,15 @@ def main(argv=None):
             md += "\n"
     elif ext in HANDLERS:
         fn = HANDLERS[ext]
-        md = (fn(path, rep, a.max_rows) if fn is xlsx_to_md else
-              fn(path, rep, ocr=not a.no_ocr, ocr_lang=a.ocr_lang) if fn is pdf_to_md else fn(path, rep))
+        try:
+            md = (fn(path, rep, a.max_rows) if fn is xlsx_to_md else
+                  fn(path, rep, ocr=not a.no_ocr, ocr_lang=a.ocr_lang) if fn is pdf_to_md else fn(path, rep))
+        except DAMAGED as e:
+            if ext not in (".docx", ".pptx", ".xlsx", ".xlsm", ".msg", ".eml"):
+                raise
+            # A file that opens in its own app is a bug here; one that doesn't is damaged.
+            sys.exit("error: %s looks damaged or truncated, so it could not be read as %s (%s: %s). If it "
+                     "opens normally in its own app, please report it." % (path, ext, type(e).__name__, e))
     else:
         sys.exit("error: unsupported file type %r. Supported: %s, .txt, .md"
                  % (ext, ", ".join(sorted(HANDLERS))))

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.9-slim
+FROM python:3.9-slim@sha256:2d97f6910b16bd338d3060f261f53f144965f755599aab1acda1e13cf1731b1b
 
 WORKDIR /app
 COPY requirements.txt .

package/packs/dev-team/skills/rollout-plan/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "rollout-plan",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Plan the progressive release of a code change behind a feature flag or canary — the exposure ladder (internal, beta cohort, 1%, 5%, 25%, 50%, 100%, or what the traffic supports), and for each step who is exposed, decision and guardrail metrics with a baseline and a threshold against a control cohort, the minimum traffic and time before the numbers mean anything, a promote / hold / roll back rule set in advance, who watches and what aborts automatically; then what turning the flag off does not undo, and who removes the flag by when. Use when the user asks for a rollout plan, canary plan, ramp schedule, progressive delivery or percentage rollout, \"how long should the canary run\", \"when do we go from 5% to 25%\", or how to turn on a flagged feature safely.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/dev-team/skills/rollout-plan/scripts/canary_math.py

@@ -165,8 +165,8 @@ def main():
         fail("--traffic must be a finite number greater than zero")
     if not 0 < args.alpha < 1 or not 0 < args.power < 1:
         fail("--alpha and --power must be between 0 and 1")
-    if args.max_hours <= 0:
-        fail("--max-hours must be greater than zero")
+    if not math.isfinite(args.max_hours) or args.max_hours <= 0:
+        fail("--max-hours must be a finite number greater than zero")
     control = None
     if args.control_pct is not None:
         control = parse_rate(args.control_pct.rstrip("%") + "%", "--control-pct")

package/packs/research/skills/hypothesis-comparison/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "hypothesis-comparison",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Compare rival explanations for an observation with analysis of competing hypotheses (ACH) — list the hypotheses and the evidence, build a consistency matrix (consistent / inconsistent / neutral), rank hypotheses by how little evidence contradicts them rather than how much supports them, name the diagnostic evidence and the linchpins, and say which next observation would tell the leaders apart. Use when the user asks \"why did X happen\", \"which explanation fits the evidence\", \"what's really causing this\", wants to stop arguing over a favourite theory, or says \"compare these hypotheses\", \"competing explanations\", \"ACH\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/research/skills/hypothesis-comparison/scripts/ach_matrix.py

@@ -34,6 +34,7 @@ Exit codes: 0 report written, 2 bad input.
 import argparse
 import csv
 import io
+import math
 import sys
 from pathlib import Path
 
@@ -71,28 +72,31 @@ def load(path):
             fail("the CSV needs at least two hypothesis columns; ACH compares rivals")
         rows = []
         for i, raw in enumerate(reader, start=1):
+            line = reader.line_num  # the file's line, which counts the blank lines csv skips
             if None in raw:
                 fail("row {}: more cells than the header has columns; put double quotes around any "
-                     "cell that contains a comma".format(i + 1))
+                     "cell that contains a comma".format(line))
             row = {(k or "").strip(): (v or "").strip() for k, v in raw.items()}
             lrow = {k.lower(): v for k, v in row.items()}
             ev = lrow.get("evidence", "")
             if not ev:
-                fail("row {}: the evidence cell is empty".format(i + 1))
+                fail("row {}: the evidence cell is empty".format(line))
             rid = lrow.get("id") or "E{}".format(i)
             w_raw = lrow.get("weight") or "1"
             try:
                 w = float(w_raw)
             except ValueError:
-                fail("row {} ({}): weight {!r} is not a number".format(i + 1, rid, w_raw))
+                fail("row {} ({}): weight {!r} is not a number".format(line, rid, w_raw))
+            if not math.isfinite(w):
+                fail("row {} ({}): weight {!r} is not a finite number".format(line, rid, w_raw))
             if w <= 0:
-                fail("row {} ({}): weight must be greater than 0".format(i + 1, rid))
+                fail("row {} ({}): weight must be greater than 0".format(line, rid))
             ratings = {}
             for h in hyps:
                 r = row.get(h, "").upper()
                 if r not in RATINGS:
                     fail("row {} ({}), column {!r}: rating {!r} is not one of CC, C, N, NA, I, II".format(
-                        i + 1, rid, h, row.get(h, "")))
+                        line, rid, h, row.get(h, "")))
                 ratings[h] = r
             rows.append({"id": rid, "evidence": ev, "weight": w, "ratings": ratings})
     if not rows:

package/packs/sre-oncall/skills/delivery-metrics-report/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "delivery-metrics-report",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Produce a delivery metrics report for one service from deployment, incident and pull-request exports — the DORA metrics (deployment frequency, change lead time, change fail rate, failed deployment recovery time) plus flow metrics (WIP, cycle time p50/p85, throughput), computed by a script with per-week trends and explicit data gaps, then interpreted for what changed and why. Use when the user wants DORA metrics, says \"how are we doing on the four keys\", \"what's our change failure rate\", \"compute lead time and deploy frequency from this CSV\", or \"build our delivery metrics report\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/sre-oncall/skills/delivery-metrics-report/scripts/delivery_metrics.py

@@ -25,6 +25,7 @@ from __future__ import annotations
 
 import argparse
 import csv
+import io
 import json
 import math
 import re
@@ -96,7 +97,12 @@ def parse_bool(raw, where: str):
 def read_csv(path: Path, required: list, label: str) -> list:
     if not path.exists():
         raise InputError("%s file not found: %s" % (label, path))
-    with path.open(newline="", encoding="utf-8-sig") as f:
+    try:
+        text = path.read_text(encoding="utf-8-sig")
+    except UnicodeDecodeError:
+        raise InputError("%s file %s is not UTF-8 text; save it as UTF-8 (in Excel: CSV UTF-8) and retry"
+                         % (label, path))
+    with io.StringIO(text, newline="") as f:
         reader = csv.DictReader(f)
         if not reader.fieldnames:
             raise InputError("%s file %s is empty or has no header row" % (label, path))

package/packs/trackers/skills/team-status-report/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "team-status-report",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Write a weekly team status report from tracker data (Jira, Linear or GitHub Projects, via CSV, JSON or an MCP tool) — shipped, in progress, blocked with the blocker and owner, slipped against plan, risks and asks — with every number computed from the data by a stdlib script, never estimated, and a RAG status that states the rule that set it. Use when the user wants a weekly status update, sprint report or stakeholder update from the tracker, or says \"write this week's status report\", \"are we on track?\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/trackers/skills/team-status-report/scripts/status_counts.py

@@ -305,8 +305,11 @@ def main(argv=None) -> int:
     if args.plan_file:
         if not args.plan_file.exists():
             die("--plan-file {} does not exist".format(args.plan_file))
-        keys = [ln.strip() for ln in args.plan_file.read_text(encoding="utf-8").splitlines()
-                if ln.strip() and not ln.startswith("#")]
+        try:
+            plan_text = args.plan_file.read_text(encoding="utf-8-sig")
+        except UnicodeDecodeError:
+            die("--plan-file {} is not UTF-8 text; save it as UTF-8 and retry".format(args.plan_file))
+        keys = [ln.strip() for ln in plan_text.splitlines() if ln.strip() and not ln.startswith("#")]
         by_key = {it["key"]: it for it in items}
         missing = [k for k in keys if k not in by_key]
         if missing: