skilldrop-cli 0.16.8 → 0.16.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skilldrop-cli",
-  "version": "0.16.8",
+  "version": "0.16.9",
   "description": "Portable AI-agent skills, measured against the agent without them. ADRs, PRDs, runbooks, decks and reviews, installable into Claude Code, Cursor, Kiro, and any IDE that takes custom instructions. One command per skill or per role-based pack.",
   "author": {
     "name": "Sanjay Ananthanarayan",

package/packs/ai-engineering/skills/ai-usage-policy/evals/evals.json

@@ -44,6 +44,36 @@
         "It does not state that a specific law, regulator or sector code applies as fact; any mention is marked as something to confirm",
         "The policy itself is short: about two pages or less (roughly 800 words)"
       ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-06",
+      "prompt": "I'm in security GRC at Ledgerline Payments (850 people) and I've been handed the AI acceptable-use policy to draft. The CISO's brief is in ciso-brief.md, the tools we have are in tool-inventory.csv, legal's notes are in legal-notes.md and there's a write-up of last month's incident in incident-summary.md. Can you draft it? Three pages tops — it's going to the exec meeting and people won't read more than that.",
+      "assertions": [
+        "It says cardholder data must not go into any AI tool, including CodePilot Enterprise, and tells the CISO it has not included the rule she asked for because legal's notes say the Corvane Bank agreement and PCI scope prohibit it regardless of zero retention",
+        "LingoDraft is not listed as approved: its contract expired on 31 August 2026 and the renewal is unsigned, and the draft says what support should do for translation meanwhile or flags it for decision",
+        "Transcribo is not approved for customer calls: the DPA is unsigned, so the support team's plan for next month is blocked until it is signed",
+        "It points out that CodePilot has 300 seats against 410 engineers, so about 110 engineers have no seat, and says what they should use or do instead of a personal account",
+        "It does not route exceptions to the AI Review Group as if it were working: it notes the group has not met since June and has no chair, and names an interim approver role or flags the decision for the exec",
+        "It says production logs and other customer data must not be pasted into personal or public AI accounts, and gives staff a specific place to report it if they already have",
+        "Last-four card digits together with an email address are treated as cardholder data for now, with a note that legal is still confirming this",
+        "It names no law, regulation or standard other than GDPR and PCI DSS, and does not name the engineer involved in the incident"
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-06",
+      "prompt": "I run a small video production studio, 9 of us. One of our clients, a big retailer, has sent a supplier questionnaire and one question is 'do you have an AI policy?' We don't. What I know: we use AI image generation for mood boards and storyboards, a few people use ChatGPT for first drafts of scripts, and I think one of the editors has been using an AI voice tool for scratch voiceovers. The client contracts say something about not using their footage for anything else, but I haven't re-read them. Can you write me a one-pager I can attach to the questionnaire?",
+      "assertions": [
+        "It delivers a draft policy in the reply and does not stop at a list of questions",
+        "It says client footage, briefs and unreleased material must not be put into AI tools unless the client's contract or written permission allows it, and says what staff do in the meantime",
+        "It tells the user to re-read the client contracts before sending this, and does not state what those contracts permit or prohibit as if known",
+        "It covers the three uses mentioned (image generation for mood boards and storyboards, ChatGPT for script drafts, the AI voice tool) and marks the voice tool use as unconfirmed; it does not present a list of approved tools with accounts or plans as already settled",
+        "It says a real person's voice or likeness must not be cloned or imitated with AI without that person's consent",
+        "It says whether and when a client is told that AI-generated images, voice or script went into work delivered to them",
+        "It does not state as fact that a specific law applies or that the studio owns the copyright in AI-generated material; any such point is marked as something to check",
+        "The policy itself fits on about one page (roughly 500 words or fewer)"
+      ]
     }
   ]
 }

package/packs/ai-engineering/skills/ai-usage-policy/evals/files/4/ciso-brief.md

@@ -0,0 +1,15 @@
+From: Anneliese Vort (CISO)
+To: Security GRC
+Date: 28 September 2026
+Subject: AI policy - what I want in it
+
+Notes for the draft. I need it for the exec meeting on the 15th.
+
+- One policy for all 850 staff, not one per department.
+- All four tools on the inventory are approved. List them.
+- Everyone in engineering (410 people) has a CodePilot Enterprise licence, so there is no reason for anyone to be using a personal account. Say so.
+- Because CodePilot has the zero-retention addendum, say card data is OK in CodePilot. Engineers debugging payment issues need it, and it will stop them going elsewhere.
+- Exceptions go through the AI Review Group.
+- Support want to start using Transcribo on customer calls from next month. Cover that.
+- Refer to the 9 September incident so people understand why we are doing this, without naming the engineer.
+- People will not read ten pages.

package/packs/ai-engineering/skills/ai-usage-policy/evals/files/4/incident-summary.md

@@ -0,0 +1,22 @@
+# INC-2291: summary
+
+Opened 10 September 2026. Status at 30 September: open.
+
+## What happened
+On 9 September an engineer debugging failed refunds pasted about 600 lines of production logs into a personal account on a public chatbot.
+
+## What was in the logs
+- 2,300 customer email addresses
+- The last four digits of card numbers
+- No full card numbers, expiry dates or security codes
+
+## Timeline
+- 9 Sept: logs pasted.
+- 10 Sept: the engineer reported it themselves to their team lead, who did not know where to send it. It reached Security that afternoon.
+- 11 Sept: deletion request sent to the chatbot provider.
+- 30 Sept: no confirmation of deletion received.
+
+## Contributing factors
+- The engineer had no CodePilot Enterprise seat and was on the waiting list.
+- No written guidance on whether logs may be pasted into AI tools.
+- No clear place to report it.

package/packs/ai-engineering/skills/ai-usage-policy/evals/files/4/legal-notes.md

@@ -0,0 +1,14 @@
+# Legal notes for the AI policy
+
+Bartholomew Nkemelu, Senior Counsel, Ledgerline Payments
+22 September 2026
+
+1. **Cardholder data.** Card numbers, expiry dates and security codes must not leave the cardholder data environment. Our PCI DSS scope and our acquiring agreement with Corvane Bank (clause 14.3) both prohibit sending cardholder data to any third party not listed in the agreement. Northgate AI is not listed. A zero-retention addendum does not change this.
+
+2. **Customer personal data.** Under GDPR, customer names, email addresses and transaction history may be processed in AskDesk and CodePilot Enterprise under the signed DPAs. They may not go into any tool without a signed DPA.
+
+3. **Transcribo.** We are still negotiating the sub-processor terms. Do not record customers until the DPA is signed. I cannot give a date.
+
+4. **AI Review Group.** It has not met since June. Idris, who chaired it, moved to the Lisbon office project and was not replaced. Somebody needs to decide who approves exceptions. That is not a legal decision.
+
+5. **Not yet checked.** Whether the last four digits of a card number together with an email address count as cardholder data under our scope. I will confirm with the QSA. Treat as cardholder data until I do.

package/packs/ai-engineering/skills/ai-usage-policy/evals/files/4/tool-inventory.csv

@@ -0,0 +1,5 @@
+tool,vendor,purpose,seats,contract_status,contract_end,data_terms,notes
+CodePilot Enterprise,Northgate AI,coding assistant,300,signed,2027-03-31,"zero-retention addendum signed 2026-02-12; no training on our data",engineering only; waiting list open
+AskDesk,Pellam Systems,general internal chatbot,850,signed,2027-01-31,"DPA signed; no training on our data; 30-day retention; EU hosting",SSO for all staff
+Transcribo,Transcribo Inc,meeting notetaker,40,pilot,2026-12-31,"DPA in legal review - not signed",pilot limited to internal meetings
+LingoDraft,Lingo Labs,translation,25,expired,2026-08-31,"renewal not signed",support still use it for Polish and Spanish replies

package/packs/api-builder/skills/tool-use-schema-writer/evals/evals.json

@@ -42,6 +42,36 @@
         "It does not state a tracking number format or pattern, a weight limit, carrier names or a dimension unit as fact",
         "It does not describe the lookup's return fields as fact, and says what the lookup returns is not yet known"
       ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-06",
+      "prompt": "Need a Claude tool so our support assistant can issue refunds itself. The endpoint spec is in refunds.openapi.yaml. Policy from Marguerite (head of support): the assistant can refund up to £500 on its own, anything above that goes to a human. Amounts are in pounds. Just the tool definition plus a short list of anything in the spec that looks off, I don't need the Python around it.",
+      "assertions": [
+        "It produces a tool definition with a name, a description and an input_schema of type object whose properties include the order reference, the amount and the reason",
+        "The amount parameter is an integer in minor units (pence) and its description says so; it is not defined as pounds or as a decimal",
+        "It flags that the spec caps amount_minor at 25000, which is £250 and below the £500 policy, and does not set the maximum to 50000",
+        "It flags that the spec lists amount_minor as required while its description says to omit it for a full refund",
+        "goodwill is either left out of the reason values or marked as deprecated with customer_request to be used instead",
+        "The definition states that reason_note is needed when the reason is other and is limited to 280 characters",
+        "It does not add parameters the spec does not have, such as a currency, a customer id or a refund method",
+        "The reply contains no Python client code"
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-06",
+      "prompt": "ops run this script by hand to change a price:\n\n./reprice.sh SKU-4471 19.99 --store 12 --until 2026-11-01\n\nwant our pricing agent to be able to call it as a tool. store is optional (no store = all stores i think), until is optional too and the price goes back after that date. price is dollars. there's also a --force flag, no idea what it does, Wendell wrote the script and he's out till the 19th. quick one, just the json",
+      "assertions": [
+        "It delivers a tool definition with a name, a description and an input_schema, and does not stop at questions",
+        "The required array contains the SKU and the price, and does not contain store or until",
+        "The price parameter's description states the unit is dollars",
+        "It says that leaving store out meaning all stores is unconfirmed and should be checked",
+        "It does not state what --force does; force is either left out of the tool or included with its effect marked as unknown",
+        "The until parameter is described as a date in the YYYY-MM-DD form shown in the example",
+        "It does not state a SKU pattern, a price minimum or maximum, or a range of valid store numbers as fact; any such constraint is marked as an assumption",
+        "The reply is the JSON definition with at most a few lines of notes, and contains no Python client code"
+      ]
     }
   ]
 }

package/packs/api-builder/skills/tool-use-schema-writer/evals/files/4/refunds.openapi.yaml

@@ -0,0 +1,63 @@
+# Excerpt from payments-api/openapi.yaml, Lanternfold Events
+# Changelog
+#   2026-06-02  reason: "goodwill" deprecated, send "customer_request" instead.
+#               Still accepted until the end of the year.
+#   2026-02-17  v2: amounts moved from decimal strings to integer minor units.
+paths:
+  /v2/refunds:
+    post:
+      operationId: createRefund
+      summary: Refund all or part of a paid order
+      description: >
+        Creates a refund against a paid order. The money goes back to the
+        original payment method. An order can be refunded more than once, until
+        the refunded total reaches the amount paid. Returns 409 event_passed if
+        the event has already taken place, and 422 over_limit if the amount is
+        more than the remaining refundable amount.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required: [order_id, amount_minor, reason]
+              properties:
+                order_id:
+                  type: string
+                  pattern: '^LF-[0-9]{8}$'
+                  description: Order reference from the confirmation email, e.g. LF-00482913.
+                amount_minor:
+                  type: integer
+                  minimum: 1
+                  maximum: 25000
+                  description: >
+                    Amount to refund, in minor units of the order's currency
+                    (pence for GBP). Omit to refund the full remaining amount.
+                reason:
+                  type: string
+                  enum: [event_cancelled, event_rescheduled, duplicate_purchase, customer_request, goodwill, other]
+                  description: Why the refund is being made. Shown on the finance report.
+                reason_note:
+                  type: string
+                  maxLength: 280
+                  description: Free-text explanation. Required when reason is "other".
+                ticket_ids:
+                  type: array
+                  minItems: 1
+                  items:
+                    type: string
+                  description: >
+                    Tickets to cancel as part of this refund. Omit to leave the
+                    order's tickets valid.
+                notify_customer:
+                  type: boolean
+                  default: true
+                  description: Send the customer the refund confirmation email.
+      responses:
+        '201':
+          description: Refund created.
+        '409':
+          description: event_passed
+        '422':
+          description: over_limit or validation error

package/packs/career/skills/job-fit-analysis/SKILL.md

@@ -51,10 +51,16 @@ These four rules outrank the steps below.
    - **Met**: the resume shows it. Quote the line.
    - **Partly**: the resume shows something close, smaller or older. Say what it shows and
      what is short: "team of 12; the posting asks for 20 or more".
-   - **Not shown**: the resume is silent. The person may well have it.
+   - **Not shown**: the resume is silent on a specific thing. The person may well have it.
    - **Not met**: the resume shows otherwise, such as a diploma where a degree is required
      or two years where five are asked for.
 
+   A requirement for a general ability, such as dealing with the public, organising work
+   or communicating clearly, is `Met` by any job that plainly involves it: four years
+   serving customers meets "friendly first point of contact". Keep `Not shown` and `Partly`
+   for specific things: a tool, a qualification, a setting, a scale, a number of years. Do
+   not mark half the table `Partly` to be safe.
+
    A similar tool is not the named tool. Cerner is not Epic, an in-house warehouse system is
    not SAP: when the posting requires the named one, mark it `Not met` and give the similar
    one as the nearest thing you have. A related task is not the named skill: cashing up a
@@ -76,9 +82,11 @@ These four rules outrank the steps below.
      true for it to be worth the time, and whether you would still send it.
    - **Not a match**: a requirement that cannot be worked around is unmet, such as a licence.
 
-   Write the table first and take the count from it. The opening sentence counts every
-   required item that is `Not met` or `Partly`, not only the worst one: "four of the six required items aren't met: the degree, the team size,
-   advanced Excel and SAP". It must agree with the table below it. Give the verdict on what
+   Write the table first, then write the opening from it. The opening names every required
+   item that is `Not met` or `Partly`, copied from those rows: "the degree, the team size,
+   advanced Excel and SAP aren't met". Name them; do not count them, and do not sum them up
+   in a number or a fraction anywhere in the reply. When two figures differ, give both and
+   leave the comparison there: "12 against 20 or more", not "less than half". Give the verdict on what
    you know now; say what answer would raise it, but do not make the verdict wait on the
    answer. Do not soften a long shot into encouragement, do not harden a workable gap into a
    refusal, and do not give a percentage.
@@ -93,14 +101,17 @@ These four rules outrank the steps below.
    required item is not shown, ask once whether anything outside the resume covers it: a
    side project, a repository, a portfolio, a volunteer role. People leave their best
    evidence off the page. Anything you credited from another file goes here too, as a line
-   to add to the resume. Never tell
-   them to add a keyword they have not said is true, and do not end on a list of questions
-   with no advice.
+   to add to the resume. Never ask
+   something the resume already answers. Never tell them to add a keyword they have not said
+   is true, or to reword a `Partly` so it reads as `Met`: "supported renewals" stays
+   supported, and the advice is how to present it honestly. Do not end on a list of
+   questions with no advice.
 
 8. **Lay the reply out in this order:** the answer and verdict; what could get it rejected;
    one table covering every requirement (requirement, required or preferred, status,
    evidence); what to bring forward; what to do next. Each requirement appears in the table
-   once and nothing is repeated in a second table or restated section by section.
+   once and nothing is repeated in a second table or restated section by section. A gap is
+   described where it first appears and only named after that.
 
    Match the length to what you were given. A short posting and a few lines about the person
    gets a short answer: the verdict, one line per requirement, and what to do, in under 250
@@ -140,6 +151,9 @@ posting**, ask for the posting in one line: there is nothing to compare against.
   person's evening.
 - ❌ **Crediting the usual.** "As a nurse you will have used Epic" is an invention.
 - ❌ **Treating a similar tool as the named one.**
+- ❌ **A count that disagrees with the table.** Name the gaps; a number invites the error.
+- ❌ **Hedging everything.** A table of `Partly` tells the person nothing.
+- ❌ **Coaching the wording past the facts.** Advising that "supported" be written as "owned".
 - ❌ **Advising them to add keywords** so the resume passes a filter. If it isn't true it
   doesn't go in.
 - ❌ **Judging the person.** No remarks on age, gaps, family, health or anything a recruiter

package/packs/career/skills/job-fit-analysis/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "job-fit-analysis",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Compare a job posting with a resume and say honestly whether to apply: each requirement marked met, partly met, not shown or not met, with the resume line it rests on; the requirements an employer screens on listed first; and the questions whose answers would change the picture. Works for any occupation and level. Use when the user asks \"am I a good fit for this job\", \"should I apply for this\", \"how does my resume match this posting\", or wants the gaps between a job description and their CV before applying.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/data-analytics/skills/metric-definition/evals/evals.json

@@ -44,6 +44,36 @@
         "Any export column names it uses are marked as assumed, since no export layout was given",
         "It does not state a response-time target or SLA figure as the team's own, since none was given"
       ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-06",
+      "prompt": "Ops and customer care at Tarn Valley Heating both report first-time fix rate and they're miles apart. The Slack thread is in thread.md and the tables are in tables.md (we're on Snowflake). The FD wants one number for the board pack, ready on the 1st of each month, shown next to last September. Can you write the definition — one page, with the SQL underneath?",
+      "assertions": [
+        "It points out that 3,912 out of 4,830 is 81%, not the 84% quoted in the thread",
+        "The definition counts a repair as not fixed first time when there is a return visit within a stated number of days, and does not rely only on the engineer's follow_up_required flag",
+        "It explains the gap between the two teams' figures: 630 of the 3,912 repairs with no follow-up flag had a return visit within 30 days, leaving 3,282 (68%)",
+        "A return visit is counted whether it was logged as a 'recall' or as a new 'repair', and recall visits are not themselves added to the denominator as fresh repairs",
+        "It says the month's figure cannot be final on the 1st of the next month because the return window has not yet run for late-month repairs, and proposes a provisional figure, a lag or a shorter window",
+        "It says a like-for-like comparison with September 2025 is not possible by appliance because appliance_id is empty before 3 March 2026, and says what to do instead (match by address for both periods, or mark the comparison as not comparable)",
+        "The SQL uses only the tables and columns listed in tables.md, restricts the denominator to completed repairs, and does not invent a column linking a return visit to its original job",
+        "It leaves the metric owner as an open decision, noting the previous owner left in August, and says whether subcontractor jobs are included"
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-06",
+      "prompt": "I run a coffee subscription box, just me and one part-timer. An investor asked what our monthly churn is and I realised I've never actually defined it. Billing is on Stripe and I keep a Google Sheet of subscribers. September: started the month with 312 subscribers, 21 cancelled, 9 paused (people can pause for a month or two instead of cancelling), 34 new signed up. Can you give me a quick definition I can stick to every month, and the September number for the investor update?",
+      "assertions": [
+        "It delivers a written definition and a September figure in the reply, and does not stop at a list of questions",
+        "The denominator is stated as subscribers active at the start of the month (312), and the 34 new sign-ups are not netted off against cancellations",
+        "It gives September churn on cancellations alone as 21 out of 312, about 6.7%",
+        "It does not decide silently whether pauses count: it states the choice made and gives the figure with pauses included, 30 out of 312, about 9.6%",
+        "It says revenue churn cannot be worked out from what was given because no prices or plan amounts were provided, and it does not invent a price",
+        "It says whether a cancellation is counted in the month the subscriber cancels or the month their paid period ends",
+        "It does not quote an industry-average or benchmark churn figure as fact",
+        "Any Stripe field names or sheet column names it uses are marked as assumed, since none were given"
+      ]
     }
   ]
 }

package/packs/data-analytics/skills/metric-definition/evals/files/4/tables.md

@@ -0,0 +1,32 @@
+# Tables (Snowflake, database TARNVALLEY)
+
+## FIELD.JOBS — one row per visit
+| column | type | notes |
+|---|---|---|
+| job_id | NUMBER | primary key |
+| address_id | NUMBER | always filled |
+| appliance_id | NUMBER | NULL for every job before 2026-03-03 |
+| job_type | VARCHAR | 'repair', 'recall', 'annual_service', 'install' |
+| status | VARCHAR | 'completed', 'cancelled', 'no_access' |
+| follow_up_required | BOOLEAN | ticked by the engineer on closing the job |
+| engineer_id | NUMBER | |
+| created_at | TIMESTAMP_NTZ | UK local time, when the job was booked |
+| completed_at | TIMESTAMP_NTZ | UK local time, NULL unless status = 'completed' |
+
+There is no column that links a recall, or any later visit, to the job it follows.
+
+## FIELD.APPLIANCES
+| column | type | notes |
+|---|---|---|
+| appliance_id | NUMBER | primary key |
+| address_id | NUMBER | |
+| make | VARCHAR | |
+| model | VARCHAR | |
+| installed_on | DATE | often NULL |
+
+## FIELD.ENGINEERS
+| column | type | notes |
+|---|---|---|
+| engineer_id | NUMBER | primary key |
+| region | VARCHAR | 'north', 'central', 'coast' |
+| employment_type | VARCHAR | 'employed', 'subcontractor' |

package/packs/data-analytics/skills/metric-definition/evals/files/4/thread.md

@@ -0,0 +1,31 @@
+# #ops-reporting — export, 1–2 October 2026
+
+**Gethin Aldous (Regional Ops Manager), 1 Oct 09:12**
+September first-time fix is in. 3,912 of 4,830 completed repairs closed with no follow-up flag. That's 84%. Best month this year.
+
+**Roisin Fairweather (Customer Care Lead), 1 Oct 09:40**
+We get 68%. 3,282 of 4,830. We only count a repair as fixed if nobody had to go back within 30 days.
+
+**Gethin Aldous, 1 Oct 09:44**
+The engineer ticks follow_up_required when the job needs another visit. That is the record. If they didn't tick it, it was fixed.
+
+**Roisin Fairweather, 1 Oct 09:58**
+They don't tick it when they think it's fixed and it isn't. 630 of your 3,912 had someone back out within 30 days. Those customers rang us, not you.
+And you can't just count recalls either. The contact centre logs about half of the go-backs as a brand new repair instead of a recall, because that's the default in the booking screen.
+
+**Gethin Aldous, 1 Oct 10:03**
+For what it's worth 4,830 already leaves out cancelled and no-access visits. We agree on that at least.
+
+**Nkechi Brandt (BI Analyst), 1 Oct 10:20**
+I pulled both sets of numbers this morning. Two things from the data side:
+- appliance_id has only been filled in since 3 March 2026 when the new engineer app went live. Before that it's NULL and all you have is address_id.
+- Some addresses have more than one appliance (HMOs, small commercial units). So "same address" and "same appliance" are not the same test.
+
+**Owen Prys (Finance Director), 2 Oct 08:15**
+The board pack needs one number, ready on the 1st of each month, with last September next to it for comparison. Subcontractors in or out, I don't mind, just tell me which. And who owns this going forward?
+
+**Gethin Aldous, 2 Oct 08:31**
+It was Marguerite's before she left in August. Nobody has picked it up.
+
+**Roisin Fairweather, 2 Oct 08:40**
+Installs and annual services shouldn't be anywhere near this, by the way. It's a repair measure.

package/packs/dev-team/skills/contribution-wizard/evals/evals.json

@@ -43,6 +43,36 @@
         "It does not invent the director's name, the team's name, team members other than Priya, or a specific repo folder stated as fact",
         "The test cases use realistic pasted standup notes as input, and at least one covers thin or missing notes"
       ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-06",
+      "prompt": "Our library systems team keeps a small skills repo, it's this folder (CONTRIBUTING.md, registry.json, a couple of existing skills under skills/). I want to add one called ILL_Request_Triage. Staff paste in an interlibrary loan request from the request form export (patron name, card number, the title, author, year published, list price, and whether the catalogue check found a copy on our shelves) and it says which of our four routes the request goes down, with a one-line reason:\n\n- fill from our own stock, if the catalogue check says we hold a copy that's on the shelf\n- borrow through the Northmere Consortium, if we don't hold it and it was published more than 2 years ago\n- buy it, if we don't hold it, it was published in the last 2 years and the list price is under £60\n\nCategory is resource-sharing, maintainer is resource-sharing@harrowgate.example. Can you write up everything I need for the pull request?",
+      "assertions": [
+        "The skill's metadata is delivered as a skill.toml file alongside PROMPT.md and an examples folder, and no meta.json is created for the new skill",
+        "The skill is given a lowercase hyphenated name that starts with a verb and spells out interlibrary loan (for example triage-interlibrary-loan-requests), not ILL_Request_Triage or a name containing the abbreviation ill, and the reply tells the author the name was changed to fit the naming rules",
+        "handles_patron_data is set to true, and the skill's instructions tell the assistant not to repeat the library card number in its output",
+        "The reply tells the author that four routes were mentioned but only three were described, and does not write a rule for a fourth route as though the author had given one",
+        "It points out at least one request the stated rules do not cover, such as a title published in the last 2 years with a list price of £60 or more, or a copy we hold that is out on loan",
+        "The skill's instructions carry the 2-year and £60 thresholds exactly as given and introduce no other price or age threshold",
+        "There are at least three example input/expected pairs, and at least one is an awkward case such as a request with a field missing",
+        "A registry.json entry for the new skill is provided with category resource-sharing and maintainer resource-sharing@harrowgate.example"
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-06",
+      "prompt": "my cofounder keeps saying we should have a 'skill' so our coding agent writes the release notes instead of me doing it every other friday. input is the list of merged PR titles since the last release, output is the notes we post for customers (they're shop owners, not devs). some PRs shouldn't show up publicly, security fixes mostly, so handle that somehow. we're 4 people and don't have a skills setup yet, i think it'd go in .claude/skills in the main repo but not sure that's right. keep it small, one file if possible, plus a couple of examples i can try it on",
+      "assertions": [
+        "It delivers a drafted instruction file for the release-notes skill and at least two example inputs to try it on, and does not stop at a list of questions",
+        "The skill itself is one instruction file, with no separate manifest, metadata file or multi-file package presented as required",
+        "It says where the skill should live is unconfirmed, treating .claude/skills as the author's guess to check, not as an established fact about their repo",
+        "The skill's instructions tell it to write only from the PR titles it is given and not to add features, fixes or details the titles do not contain",
+        "The skill's instructions tell it to write for shop owners in plain language, not to copy developer-facing PR titles through as they are",
+        "The skill's instructions keep security-fix PRs out of the public notes or set them aside for a person to decide, and the reply says the exact rule for what stays private is the author's to confirm",
+        "At least one of the examples includes a security-fix PR title",
+        "It does not invent a product name, a company name, a version number scheme, PR label names or a command for fetching the PR titles and state it as fact"
+      ]
     }
   ]
 }

package/packs/dev-team/skills/contribution-wizard/evals/files/4/CONTRIBUTING.md

@@ -0,0 +1,63 @@
+# Contributing a skill
+
+Harrowgate University Library, Systems & Discovery team. Last revised 12 March 2026.
+
+Skills are short instruction files our staff assistant loads when a member of staff
+asks for a particular job. Six of us maintain them. Keep them small.
+
+## Layout
+
+Each skill is one folder under `skills/`:
+
+```
+skills/<name>/
+  skill.toml            metadata
+  PROMPT.md             the instructions the assistant follows
+  examples/
+    01-input.md         what a member of staff would paste
+    01-expected.md      what a good answer looks like
+    02-input.md
+    ...
+```
+
+At least three input/expected pairs. One of them must be an awkward case (missing
+field, contradictory request, nothing to do).
+
+Since March 2026 metadata lives in `skill.toml`. A few older skills still carry a
+`meta.json` until someone migrates them. New skills must not add one.
+
+## skill.toml
+
+```toml
+name = "summarise-reading-list"      # same as the folder name
+summary = "One sentence, 120 characters at most."
+category = "cataloguing"             # one of the categories in registry.json
+maintainer = "alias@harrowgate.example"
+handles_patron_data = false
+version = "0.1.0"                    # new skills start at 0.1.0
+```
+
+## Naming
+
+- lowercase, words joined with hyphens
+- starts with a verb (`summarise-`, `flag-`, `draft-`)
+- no abbreviations a new member of staff would not know. Write `interlibrary-loan`,
+  not `ill`; write `reading-list`, not `rl`.
+- 40 characters at most
+
+## Patron data
+
+If the input a skill receives can contain patron names, library card numbers or
+contact details, set `handles_patron_data = true`, and PROMPT.md must tell the
+assistant never to repeat a library card number in its output (refer to the patron
+by name or by request number instead).
+
+## Registry
+
+Add one entry for the skill to the `skills` list in `registry.json` (name, category,
+maintainer). Keep the list in alphabetical order by name.
+
+## Before you open a pull request
+
+Run `python3 tools/lint_skills.py` from the repo root. It checks the layout, the
+naming rules and that every skill is in the registry.

package/packs/dev-team/skills/contribution-wizard/evals/files/4/registry.json

@@ -0,0 +1,15 @@
+{
+  "categories": ["acquisitions", "cataloguing", "circulation", "resource-sharing"],
+  "skills": [
+    {
+      "name": "flag-overdue-holds",
+      "category": "circulation",
+      "maintainer": "circdesk@harrowgate.example"
+    },
+    {
+      "name": "summarise-reading-list",
+      "category": "cataloguing",
+      "maintainer": "metadata@harrowgate.example"
+    }
+  ]
+}

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/flag-overdue-holds/PROMPT.md

@@ -0,0 +1,10 @@
+# flag-overdue-holds
+
+You are given the hold-shelf report: one line per item with request number, title,
+patron name, card number and the date the item was shelved.
+
+1. List every item shelved more than 7 days before the report date, oldest first.
+2. For each, give the request number, the title and the patron's name.
+3. Never repeat a library card number. Refer to the patron by name.
+
+If nothing is over 7 days, say so.

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/flag-overdue-holds/examples/01-expected.md

@@ -0,0 +1,2 @@
+1 item over 7 days:
+- R-88121, Silent Spring, Amara Okoye (shelved 2026-02-09)

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/flag-overdue-holds/examples/01-input.md

@@ -0,0 +1,3 @@
+Report date 2026-02-20
+R-88121 | Silent Spring | Amara Okoye | 2100457781 | 2026-02-09
+R-88160 | The Peregrine | Jonas Lind | 2100331290 | 2026-02-17

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/flag-overdue-holds/examples/02-expected.md

@@ -0,0 +1 @@
+Nothing on the hold shelf is over 7 days.

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/flag-overdue-holds/examples/02-input.md

@@ -0,0 +1,2 @@
+Report date 2026-02-20
+R-88160 | The Peregrine | Jonas Lind | 2100331290 | 2026-02-17

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/flag-overdue-holds/examples/03-expected.md

@@ -0,0 +1 @@
+Nothing can be flagged: R-88171 (Waterlog, Petra Havel) has no shelved date.

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/flag-overdue-holds/examples/03-input.md

@@ -0,0 +1,2 @@
+Report date 2026-02-20
+R-88171 | Waterlog | Petra Havel | 2100778123 |

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/flag-overdue-holds/meta.json

@@ -0,0 +1,7 @@
+{
+  "name": "flag-overdue-holds",
+  "summary": "Lists hold-shelf items uncollected for more than 7 days so the desk can release them.",
+  "category": "circulation",
+  "maintainer": "circdesk@harrowgate.example",
+  "version": "1.2.0"
+}

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/summarise-reading-list/PROMPT.md

@@ -0,0 +1,11 @@
+# summarise-reading-list
+
+You are given a module reading list pasted from the reading list system: one item
+per line, with title, author, year, format and a `held` column (yes/no).
+
+1. Count the items by format (book, e-book, article, other).
+2. List every item where `held` is `no`, with title, author and year.
+3. If a line has no `held` value, list it separately under "Holding not stated".
+   Do not guess.
+
+Never add items that are not in the pasted list. If the list is empty, say so and stop.

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/summarise-reading-list/examples/01-expected.md

@@ -0,0 +1,4 @@
+Books: 2, e-books: 1.
+
+Not held:
+- Landscape and Memory, Schama, 1995

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/summarise-reading-list/examples/01-input.md

@@ -0,0 +1,4 @@
+Module HIS2041
+The Making of the English Landscape | Hoskins | 1955 | book | yes
+Landscape and Memory | Schama | 1995 | book | no
+Fields of Vision | Daniels | 1993 | e-book | yes

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/summarise-reading-list/examples/02-expected.md

@@ -0,0 +1,6 @@
+Books: 1.
+
+Not held: none.
+
+Holding not stated:
+- An Atlas of Rural Settlement, Roberts, 2000

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/summarise-reading-list/examples/02-input.md

@@ -0,0 +1,2 @@
+Module GEO1010
+An Atlas of Rural Settlement | Roberts | 2000 | book |

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/summarise-reading-list/examples/03-expected.md

@@ -0,0 +1 @@
+The reading list for ENG3300 has no items.

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/summarise-reading-list/examples/03-input.md

@@ -0,0 +1 @@
+Module ENG3300

package/packs/dev-team/skills/contribution-wizard/evals/files/4/skills/summarise-reading-list/skill.toml

@@ -0,0 +1,6 @@
+name = "summarise-reading-list"
+summary = "Turns a module reading list into a count of items by format and a list of titles we do not hold."
+category = "cataloguing"
+maintainer = "metadata@harrowgate.example"
+handles_patron_data = false
+version = "0.3.0"