sshlg-skills 0.28.0 → 0.28.2

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## v0.28.2 — 2026-08-10
+
+### Changed
+
+- **`seo-aeo-audit` pinned to 0.13.0.** A fresh-eyes audit of that skill — every
+  command, every bundled script, all twenty-two references — found 43 defects, nine
+  of which made it emit or suppress findings in ordinary use. The four-command gate
+  was green against all of them.
+
+  The ones that change what a user of the skill gets: `max-image-preview:none` was
+  reported as a `noindex` blocker, which is a stop condition, so an audit ended there
+  on a fabrication; jQuery's `$` or a correct `Offer.priceCurrency` produced a
+  finding claiming the page hides its price from answer engines; a response truncated
+  by `--max-bytes` was analyzed as if it were the page (10,001 words at the default
+  cap, 475 at 3000, no warning either time); a Search Console run of 403s ended by
+  declaring its own output `CONFIRMED`; and `gsc_pull.py` computed cannibalization,
+  the CTR curve and the branded split and printed none of them in its default format.
+
+  Thirteen reconciliation guards were added, each watched failing on the real
+  repository before the fact was corrected. The pattern they close: a guard written
+  against the one home a fact had drifted in, while the fact lived in four — the myth
+  count was green with three of its four homes wrong.
+
+  Two output contracts change, which is why this is a minor and not a patch: the
+  `thin` finding code is now `low-extractable-text`, and `onpage-checks.md`'s
+  sections are `O1`–`O5` where they were `D1`–`E2`.
+
+## v0.28.1 — 2026-08-10
+
+### Changed
+
+- **`make-skill` pinned to 0.11.0.** A file-by-file audit of that repo, run with
+  its own evidence rules, found two defects that manufacture wrong answers: a
+  path variable used as prose (the skill body is substituted at load time, so
+  agents read a filesystem path where a host capability was named), and an audit
+  procedure whose very first command was built from that same variable — which is
+  empty in the Bash tool, so the one step the canon forbids reasoning through was
+  the one step that could not run. Both are fixed at the root: the auditor now
+  ships as `bin/make-skill-audit`, which Claude Code puts on the Bash PATH.
+
+  The release also adds NOT-RUN as a third audit verdict, and makes claims about
+  a repo machine-checkable — counted claims against their artifacts, the skill
+  card's version against the manifest, every shipped reference against the
+  README.
+
+  This pin is the step that release owed the family: until it moves, `list`
+  advertises the previous version and `update` installs it.
+
 ## v0.28.0 — 2026-08-10
 
 ### Changed

package/README.md

@@ -35,9 +35,9 @@ No services, no telemetry, no API keys.
 | **[super-ux](https://github.com/ssheleg/super-ux)** | 0.32.0 | Scenario-driven UI development. A versioned design chain in `docs/ux/` — the product vision → personas and jobs → user flows → a screens-and-states map with Figma frames → traced scenarios → evidence-backed audits → fix plans, plus `docs/brand/` for how the product speaks. One `/ux` entry point that reaches every skill, two doc-drift linters and a contract doctor. |
 | **[task-pipeline](https://github.com/ssheleg/task-pipeline)** | 1.18.0 | Full-cycle delivery orchestrator. An intake grill interrogates the request into a complete brief, then **ten gated stages** carry it — docs, brainstorm and decompose, spec, plan, build, tests, deploy, post-deploy, wiki, acceptance — refusing to advance until each gate passes. Documentation is a deliverable with its own portable gate, and the retrospective it leaves behind is traceable to the commit that earned each lesson. |
 | **[agent-sync](https://github.com/ssheleg/agent-sync)** | 1.4.3 | Several agents, one repository, no collisions. Leases with a TTL so two agents cannot claim the same work, race-free id reservation, a run journal and a generated board — over a pluggable knowledge cloud. The answer to "two sessions just committed over each other". |
-| **[make-skill](https://github.com/ssheleg/make-skill)** | 0.10.0 | A skill that builds skills. Create, retrofit, audit and publish agent skills and Claude Code plugins: conformance to the [Agent Skills](https://agentskills.io/specification) open standard, [Anthropic's platform rules](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) (per-surface runtime limits, the Skills API, evals) and the [Claude Code plugin reference](https://code.claude.com/docs/en/plugins-reference), marketplace layout, version sync, validator + CI, every distribution channel, the review checklist for third-party skills, MCP and A2A rules. |
+| **[make-skill](https://github.com/ssheleg/make-skill)** | 0.11.0 | A skill that builds skills. Create, retrofit, audit and publish agent skills and Claude Code plugins: conformance to the [Agent Skills](https://agentskills.io/specification) open standard, [Anthropic's platform rules](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) (per-surface runtime limits, the Skills API, evals) and the [Claude Code plugin reference](https://code.claude.com/docs/en/plugins-reference), marketplace layout, version sync, validator + CI, every distribution channel, the review checklist for third-party skills, MCP and A2A rules. |
 | **[sheleg-design](https://github.com/ssheleg/sheleg-design-skill)** | 1.7.0 | The taste layer. Cinematic scroll-driven landing pages — one scroll clock, motion that degrades to calm, WebGL particle formations — plus product-UI style packs each shipping a ready token layer, and the Figma border: tokens as variables, design to code without hand-copied values. |
-| **[seo-aeo-audit](https://github.com/ssheleg/seo-aeo-audit)** | 0.12.0 | Evidence-first website audit for search **and** answer engines. Ten tracks from crawl access to AI citation mechanics; every finding carries an observation, every recommendation an evidence tier, and the output is a prioritized change plan plus a link-building brief — not a score. |
+| **[seo-aeo-audit](https://github.com/ssheleg/seo-aeo-audit)** | 0.13.0 | Evidence-first website audit for search **and** answer engines. Ten tracks from crawl access to AI citation mechanics; every finding carries an observation, every recommendation an evidence tier, and the output is a prioritized change plan plus a link-building brief — not a score. |
 | **[sheleg-dev](https://github.com/ssheleg/sheleg-dev)** | 0.1.0 | The integration layer a product reaches once it has users: **money in, tracking, sign-in, speed**. Crypto payments that survive under-payment, duplicate webhooks and rate drift; GA4, Google Ads, Meta and LinkedIn under Consent Mode v2; Google sign-in with the account pre-hijacking guard, and the server-side auth surface behind it; Core Web Vitals work that moves the score rather than the report. |
 | **[agent-stack](https://github.com/ssheleg/agent-stack)** | 0.1.0 | Production patterns for agent orchestrators — tool-calling loops that survive their own context pressure, pipelines with human checkpoints and resume, provider routing with fallback and health checks, four memory layers with confidence decay and conflict resolution — plus the wallet side of reselling LLM access: tiered balances, one markup boundary, two-phase commit against a provider API. |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sshlg-skills",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "description": "One launcher/updater for the ssheleg skill family (super-ux, task-pipeline, agent-sync, make-skill, sheleg-design, seo-aeo-audit) across every agent — Claude Code, Cursor, OpenCode, Kilo, Kimi, Hermes, OpenClaw, Codex, and more.",
   "bin": {
     "sshlg-skills": "bin/sshlg-skills.js"

package/skills.json

@@ -66,7 +66,7 @@
       "skillNames": [
         "make-skill"
       ],
-      "version": "0.10.0"
+      "version": "0.11.0"
     },
     {
       "name": "sheleg-design",
@@ -90,7 +90,7 @@
       "skillNames": [
         "seo-aeo-audit"
       ],
-      "version": "0.12.0"
+      "version": "0.13.0"
     },
     {
       "name": "sheleg-dev",