Ports four corrections these two skills received upstream after a second trial
run against a real repository. #2951 merged the snapshot taken before them. The
bundled scripts are already identical to their upstream versions and are not
touched here.
1. Neither skill told the agent that text read out of the audited repository is
data rather than instruction. These skills exist to read untrusted
repositories, so a README, a code comment, a commit message or a dependency
manifest reached the model with no framing -- and a line claiming a file is
approved, or telling the audit to skip a module, reads exactly like a
guardrail. Both skills now carry the rule and report such text as a finding
instead of following it.
2. The citation rule allowed anchors to land beside the symbol rather than on
it: the blank line above a definition, a decorator, or a line inside a
multi-line literal. In one trialled file every anchor sat two lines above the
def it named. The rule is now a single applicable test -- the line you cite
must literally contain the thing you name, and a cited range must contain it
on the first line. Quoted text is cited at the line the quoted characters are
on, because a comment has its own line number and it is usually not the line
of the code beside it.
3. "Never restate a count without the raw output in front of you" was ignored
twice in that trial, so the rule flips from prohibition to requirement: any
number stated must appear under Checks Run next to the command that produced
it. Unwilling to show the command means describing the pattern rather than
counting it.
4. Both Related Skills sections said the skill is one of seven and that the
other five cover the remaining ground. Six, not five. Each section now names
its sibling in this repository and links the remaining five out.
Front matter is unchanged, so the generated README tables do not move.
* feat(skills): add test-gap-audit and docs-sync-audit
Two repo-agnostic review skills that answer questions the existing testing and
documentation skills do not.
test-gap-audit asks which behaviour is not covered, rather than how to write a
test in a given framework. Given no scope it audits the whole repository,
inventories the testable surfaces, and reports which routes, services, jobs and
contracts have no tests, too few assertions, or only indirect coverage. It
bundles coverage_map.py, which detects the test framework and naming convention,
then matches every source file to tests by name, by mirrored path, and by what
the test files actually import, and ranks the unmatched by risk keyword and size.
docs-sync-audit compares what the docs claim against what the code does. It
bundles docs_drift.py, which checks documented npm scripts and make targets
against the ones that exist, relative Markdown links against the filesystem, and
environment variable names in both directions. It also reports a documented
setting that is read only inside a module nothing imports, which is configuration
that reads as working but cannot take effect.
Both are read-only: they report and do not edit unless asked. Both emit the same
contract, so a finding always carries a P0-P3 severity and a path:line you can
open. Both scripts are Python standard library only, install nothing, and are
accelerators rather than requirements, so each skill still works when the script
cannot run.
The existing testing and docs skills here are framework-specific, which is where
most of the value is. These are the repo-agnostic complement: pytest-coverage
raises coverage inside a pytest project, and this decides where coverage is
missing across a repository regardless of language.
* fix: satisfy codespell and regenerate all generated docs
Two CI failures on the first push.
codespell flagged `testng` and `shouldBe` in coverage_map.py. Both are
legitimate identifiers rather than typos: TestNG is the Java test framework the
script detects by name, and shouldBe is the Kotlin and Scala assertion method
matched by its assertion-detection regex. Added both to ignore-words-list with a
comment each, following the convention already used for the other entries.
validate-readme failed because I had reverted docs/README.agents.md. `npm start`
rewrites a Dynatrace MCP URL there from re-fetched external plugin data, which is
unrelated to these skills, so I had excluded it to keep the diff scoped. That was
wrong: the check regenerates every generated file and compares, so the commit has
to carry whatever the build produces. Restored.
---------
Co-authored-by: Aaron Powell <me@aaron-powell.com>
trigger_live_flow now runs scheduled (Recurrence) flows on demand;
list_live_connections requires environmentName and applies top after search;
the ChatGPT/claude.ai connector path is documented in the mcp skill; the
brand reads FlowStudio (one word) across the skills and plugin README; the
build skill is back under the 500-line lint limit.
Co-authored-by: Aaron Powell <me@aaron-powell.com>
`-f labels[]="bug"` fails under zsh, the default shell on macOS, because `[]`
is a glob pattern. The argument never reaches gh. Quote the whole
`name[]=value` pair instead.
The skill also states the MCP server cannot create, update, or comment on
issues. github-mcp-server ships issue_write, add_issue_comment, and
sub_issue_write. Documented them and reworded the CLI section; the gh api
examples are unchanged.
* feat: update Apple App Store reviewer guidance
* refactor: narrow App Store guideline checks
---------
Co-authored-by: Jimmy Stridh <jimmystridh@users.noreply.github.com>
FlowStudio MCP 1.2.42 delivers trigger inputs to Button, PowerApps, and Skills
triggers; the skills still said trigger_live_flow was HTTP-only and told agents
to build an HTTP twin. Verified live against server 1.2.43.
Adds a skill that converts text, markdown, or the output of another
skill into an MP3 using Kyutai pocket-tts, a small neural TTS model
that runs on CPU.
No existing skill in the collection generates audio, so this fills a
gap rather than duplicating one. It is designed as a terminal step in
a chain: roundup, daily-prep, or meeting-minutes produce the text,
speak-summary makes it listenable.
Two details worth calling out:
- The bulk of SKILL.md is guidance on rewriting written prose for the
ear before synthesising. Feeding markdown straight into a TTS engine
produces something technically correct and unlistenable, so that
step carries most of the value.
- Synthesis is local and CPU-only, so nothing is sent to a cloud
speech service and the skill works unattended in a headless
container as well as on a laptop.
The bundled script bootstraps pocket-tts into a cached virtualenv on
first use, selecting a Python in the supported >=3.10,<3.15 range
rather than assuming python3 qualifies, and failing with actionable
guidance when none is available.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1a70aa08-b622-4825-ad63-5a12370add1f
* Add poka-yoke skill: make misuse unrepresentable rather than warned against
Mistake-proofing, applied to code. The skill pushes toward devices that make
a wrong action impossible or self-announcing, rather than instructions asking
someone to avoid it, and refuses to accept a comment or a convention as a fix.
The gap it addresses. Given a design, models readily list what to fix and
rarely state what the fix makes impossible. Measured across 591 blind-graded
runs and six model families, responses named the foreclosed set 42% of the
time unprompted and 81% with this skill applied. Assertions were written
before the runs and graded blind to configuration.
Stated with its limits, because they matter: every run was the first turn of
a fresh session, so this measures the ceiling rather than what survives a
long working session; the comparison was against no methodology rather than a
different one, so it does not establish that this particular method caused
the gain; and the skill costs something measurable, making responses somewhat
worse at spotting the specific defect already on the page while better at
changing the shape that allowed it. All of that is in the skill body rather
than omitted.
Bundled, all self-contained, no network access and no dependencies:
scripts/detect_hazards.py standard-library scanner, 42 pattern rules
across 20 hazard shapes, five languages
references/hazard-catalog.md the taxonomy with device per shape
references/lang-*.md Python, TypeScript, Go and Rust patterns
Verified with npm run skill:validate and npm run build. Raw benchmark runs,
the harness and the assertion checklists are public at
https://github.com/rainmanjam/poka-yoke
* Rename HasTable to HasFrom in the TypeScript typestate example
codespell failed the PR: it reads HasTable as a misspelling of hashtable.
The identifier is a legitimate generic parameter on a typestate builder,
QueryBuilder<HasTable, HasWhere>, so this is a false positive, but it is our
file breaking their gate and the fix costs nothing.
HasFrom is also the better name: the flag tracks whether .from() has been
called, not whether a table exists.
Renamed in the upstream repository too, so the two copies do not diverge on
day one. Verified the whole bundle is codespell-clean locally.
* Correct the effect figures in the poka-yoke skill
The submitted numbers (42% -> 81%) could not be reproduced from the upstream
gradings. Recomputed over the six models the sentence describes: 45% -> 80%
across 132 verdicts. Adds the per-scenario breakdown, which is the more useful
claim: the gains are in tasks where nobody asked for a design review.
* Add repo-standardizer skill: polish any GitHub repo surface
* fix(skill): remove non-string metadata and fix template README refs for vally lint
* docs(skill): drop markdown relative links from README language-switcher example
Vally valid-refs flagged ./README.md and ./README.zh.md as missing file
references; they are generated artifacts, not skill files. Keep the
example as plain text to satisfy the linter.
* fix(template): add missing language switcher to English README template
Align with README.zh.md template and SKILL.md switcher convention:
current language as plain text, other languages as relative links.
---------
Co-authored-by: programmingWTF <programmingWTF@users.noreply.github.com>
The MCP Apps sample HTML bundle imported ext-apps from esm.sh using an
unpinned major-version tag (@1), which Snyk flags as an unverifiable
external dependency / third-party content exposure risk (indirect
prompt-injection surface, since the imported module can call
app.updateModelContext and app.callServerTool). Pin it to the current
release (1.7.5).
Also pin the sample `dotnet add package` commands for the
ModelContextProtocol* and Microsoft.Extensions.Hosting packages to
their current exact versions (2.2.0 / 10.0.11), and correct a stale
"2.0.0 is current" note in packages.md.
* Bump gem-team plugin version to 1.102.0 and add entry
Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.
* Bump gem-team plugin version to 1.103.0 and update acceptance_criteria references
* refactor: simplify agent definitions and add gem-design-md-guidelines and gem-devops-guidelines skills
* feat: optimize orchstrator for faster workflows
* chore: optimize skills
* chore: update readme
* chore: bump version to 1.108.0
* chore: streamline planner
* Enhance Oracle-to-PostgreSQL migration skills and documentation
- Update migration agent guidelines to prioritize extension tool usage for code migration.
- Refine migration phases with detailed steps for pre-migration review and schema migration.
- Add new reviewing skill references for PostgreSQL materialized view refresh and UNION ALL planner risks.
- Ensure consistency in collation handling and testing strategies across skills.
* - Review migration phases to ensure correct order of execution
- Add exit criteria to each migration phase
- Remove invocation of `ms-ossdata.vscode-pgsql` extension due to dependency on VSCode
- Update README.md to reflect changes in migration phases and exit criteria
- Update broken reference to custom agent in plugin.json
* Enhance downstream migration skills and following custom agent improvements
- Added new skill for migrating .NET data access code from Oracle to PostgreSQL.
- Updated README to include new migration skill.
- Improved existing skills with clearer file naming conventions and migration actions.
- Added reference documents for handling Oracle-specific functions and pagination.
- Created detailed guides for NVL, DECODE, ROWNUM, SYSDATE, and DUAL replacements.
* Clarify PostgreSQL schema immutability and stored procedure migration risks
* Update target schema path in migration documentation for clarity
* fix(skills): clarify Phase 3-only scope for Oracle test skills
Both Oracle test skills were ambiguously worded in ways that could
cause a model to invoke them during Phase 6 (PostgreSQL test migration)
instead of using them exclusively in Phase 3.
Key changes:
- Rewrite descriptions to explicitly state Phase 3-only usage and
warn against invoking during Phase 6
- Replace "scaffold for Oracle first" with "Oracle only" to remove
the false implication of a second PostgreSQL scaffolding step
- Replace "Tests validate behavior consistency when running against
Oracle or PostgreSQL" with clear Oracle-only framing
- Rename "DB-agnostic assertions" → "Assertion portability" and
explain the why (survive Phase 6 migration without rewrites)
- Fix datetime bullet in integration tests skill to use generic
Oracle column precision language instead of PostgreSQL type syntax
- Name Oracle NuGet package explicitly (Oracle.ManagedDataAccess.Core)
* feat(oracle-to-postgres): gate Phase 1 on DDL presence; add DDL scan to Phase 2 risk analysis
- Phase 1 success criteria now requires Oracle DDL artifacts to be
confirmed present at the recorded location before proceeding.
If missing, the agent stops and prompts the user to provide them.
- Phase 2 risk analysis now explicitly scans DDL/Oracle/{ProjectName}/
as supplemental context, summarising procedure complexity indicators
(dynamic SQL, DBMS_* / UTL_* references, autonomous transactions,
pipelined functions, BULK COLLECT/FORALL, REF CURSOR, TYPE bodies)
rather than ingesting DDL files wholesale. This ensures schema-level
migration risk is captured even when it isn't visible in application
code alone.
* - Merge in latest 'main' changes
- Update custom agent plugin (eg resolve conflict and add new skill)
- Validate skills
- Run build
* chore(plugin.json): update version to 1.1.0
* feat(oracle-to-postgres): update version to 1.1.0 for migration expert plugin
* fix: add INOUT to ignore-words-list for PostgreSQL migration
---------
Co-authored-by: TCPrimedPaul <paul.delannoy@tc.gc.ca>
* Add landing-page-conversion-audit and server-side-conversion-tracking skills
* Drop references to skills not present in this repo
---------
Co-authored-by: autonnel <283055447+autonnel@users.noreply.github.com>
While implementing the Agent Plugin v1 spec in https://github.com/stbenjam/skillsaw/pull/483, I used this repository as a canonical real-world source for tests. Along the way its checks surfaced genuine correctness issues worth fixing regardless of tooling:
- Internal links that do not resolve (22): wrong relative paths, links whose targets are runtime output paths rather than bundled files (now inline code), a schemeless external URL parsed as a relative path, and links to files that do not exist (removed).
- Bundled skill files never referenced from their SKILL.md (14): each is now cited from the section where it is used, so nothing ships unreachable from the skill's instructions.
- Unclosed or mis-nested code fences (11): markdown templates embedding code blocks now use four-backtick outer fences so inner fences nest instead of closing the template early and leaking example content as live markdown; also removed stray orphan fences and closed an unterminated block at end of file.
- Invisible unicode (1): removed a zero-width space from a code example, a copy-paste artifact invisible to reviewers.
Adopt the Agent Plugins v1.0.0 namespaced composition model from #2546. Bundle the reusable daily-focus-board canvas into Ember only and remove its obsolete standalone catalog manifest.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 52be9c67-3ae4-4610-93d0-fe0b7ab95ccb
* Add Azure Developer CLI skill and related documentation
* Add Azure Developer CLI skill to README with usage instructions and bundled assets
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Update dotnet-mcp-builder skill to ModelContextProtocol 2.x
Align the skill with the C# SDK 2.0.0 release and the MCP 2026-07-28
spec: stable line is now 2.x, HttpServerTransportOptions.Stateless
defaults to true, roots/sampling/MCP-channel logging are [Obsolete]
(MCP9005) with the multi-round-trip input_required pattern as the
replacement, discovery-first negotiation (server/discover) supersedes
the initialize handshake, Mcp-Method/Mcp-Name routable headers, raw
structuredContent for non-object results, required Tool.inputSchema,
and the new ModelContextProtocol.Extensions.Tasks and
ModelContextProtocol.Extensions.Apps packages (typed MCP Apps support
replacing the hand-rolled _meta/ui:// pattern on 1.x).
* Address Copilot review: Apps extension accuracy, header scope, capability ownership
- packages.md: the Apps package replaces the manual _meta wiring, not the
ui:// resource; note the experimental MCPEXP003 diagnostic; label the
1.x -> 2.0 list as highlights and add the OAuth/SSE runtime changes
with a pointer to the full release notes.
- transport-http.md: Mcp-Method is on every POST, Mcp-Name only on named
invocations (tools/call, prompts/get, resources/read) - do not require
it globally at gateways.
- mcp-apps.md: current MIME type is text/html;profile=mcp-app (skybridge
is a legacy draft value); document [McpAppUi] + WithMcpApps().
- server-features.md: roots/sampling are client capabilities, only
logging sits on ServerCapabilities.
* Correct stateful HTTP guidance: 2026-07-28 has no HTTP sessions
Per the official SDK v2 elicitation docs, a server with Stateless=false
refuses the 2026-07-28 revision so dual-path clients fall back to an
initialize-capable revision; ElicitAsync cannot be used on 2026-07-28
Streamable HTTP at all. Reframe stateful HTTP as down-level
compatibility mode and document the multi-round-trip pattern
(InputRequiredException / InputRequest.ForElicitation, retry with
InputResponses -> ElicitResult) as the current-protocol way to ask
mid-tool, across SKILL.md, transport-http.md, and elicitation.md.
* Update typescript-mcp-server-generator skill to MCP TypeScript SDK v2
Replace the retired monolithic @modelcontextprotocol/sdk with the v2
focused packages (server, node, core, framework adapters), require
zod@^4.2 and Node 20+, document the registerTool config-object API,
the ctx handler context, the new error hierarchy, removed SSE/WebSocket
transports, and the v1-to-v2 codemod migration path.
* Address Copilot review: adapter peer frameworks and sampling consistency
Framework adapters now note their required peer framework install
(e.g. @modelcontextprotocol/express + express), and the two remaining
sampling recommendations are replaced with the multi-round
input_required pattern that v2 recommends over the deprecated
sampling subsystem.
Resolve the .codespellrc conflict by retaining both the daily-focus-board checkin key and upstream ACI term.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fd1eae93-cc9f-4777-812c-a2a9872e1c2b
Resolves the remaining Copilot review comments.
Canvas extension (board-core.mjs, board.html):
- DNS-rebinding: pin the Host header to the exact 127.0.0.1:<port> authority and
require a per-server capability token (minted at startup, embedded in the served
page, sent as x-board-token) on ALL /api/* routes -- so GET /api/state can't leak
task data and POSTs can't be forged. Mirrors extensions/signals-dashboard.
- Destructive write: loadDoc only synthesizes a fresh board for ENOENT and now
propagates I/O + JSON parse errors, so a transient/malformed state file is never
overwritten by a later mutation.
- XSS: escape emoji (from the seed / add_task action) at render, like title/unit.
Skill (board.template.html, sample-board.html):
- a11y: each task card gets role=group + aria-label so screen readers get task context.
- counters: step=1 on the goal/update number inputs to match the positive-integer contract.
Verified headless (35/35): token gates reads+writes, CSRF + foreign-Host refused,
malformed file left intact. Repo plugin + skill validation green.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb356aa8-0af2-48f3-b3c6-8086c69d5308
Furkan Reha
Catherine HanandAaron Powell
Cahid Arda
Muhammad Moiz
Alex Sokol
Jimmy StridhandJimmy Stridh
Sam RoweandCopilot App
Burak Bayırandkriptoburak
Andrew Arnott
grgy078033
Shannon Atkinson
Muhammad Ubaid Raza
Sepuri Sai Krishna
Samuel Bushi
Guiyu LiandprogrammingWTF
jeanpaulhassane-225
Anton Standrik
Mamdouh Ibrahim
Pavel Putrenkov
Paul DelannoyandTCPrimedPaul
Massimo Bonanni
Autonnelandautonnel
Jenny Ferries
Stephen Benjamin
Jason Colapietro
alfredtech2026andAlfred
Subin Kim
alsoleg89
RJ
jennyf19
Adrien Clerbois
Jenny FerriesandCopilot
denis-a-evdokimovandCopilot
skyestrela