---
name: skill-installer
description: Instala, valida, registra e verifica novas skills no ecossistema. 10 checks de seguranca, copia, registro no orchestrator e verificacao pos-instalacao.
risk: safe
source: community
date_added: '2026-03-06'
author: renat
tags:
- skill-management
- deployment
- validation
- installation
tools:
- claude-code
- antigravity
- cursor
- gemini-cli
- codex-cli
---

# Skill Installer v3.0

## Overview

Instala, valida, registra e verifica novas skills no ecossistema. 10 checks de seguranca, copia, registro no orchestrator e verificacao pos-instalacao.

## When to Use This Skill

- When the user mentions "instalar skill" or related topics
- When the user mentions "install skill" or related topics
- When the user mentions "registrar skill" or related topics
- When the user mentions "nova skill" or related topics
- When the user mentions "new skill" or related topics
- When the user mentions "adicionar skill ao ecossistema" or related topics

## Do Not Use This Skill When

- The task is unrelated to skill installer
- A simpler, more specific tool can handle the request
- The user needs general-purpose assistance without domain expertise

## How It Works

Agente instalador enterprise-grade que garante que toda skill criada (via skill-creator
ou manualmente) seja corretamente instalada, registrada e verificada no ecossistema.
Inclui auto-repair, rollback, dry-run, dashboard, e diagnostico avancado.

## Principio: Redundancia Maxima

Seis camadas de validacao garantem que nenhuma skill fique mal-instalada:

| Camada | Script | O que valida |
|--------|--------|-------------|
| 1 | detect_skills.py | SKILL.md existe + tem frontmatter |
| 2 | validate_skill.py | 10 checks profundos |
| 3 | install_skill.py (pre) | Conflitos, permissoes, espaco, versao |
| 4 | install_skill.py (pos) | Arquivos copiados corretamente |
| 5 | scan_registry.py | Skill aparece no registry (com deduplicacao) |
| 6 | package_skill.py | ZIP valido sem backslashes, nao-vazio, integrity check |

---

## Localizacao

```
C:\Users\renat\skills\skill-installer\
├── SKILL.md              <- este arquivo
├── scripts/
│   ├── install_skill.py  <- instalador principal (11 passos) + todos os comandos
│   ├── detect_skills.py  <- scanner de skills nao-instaladas
│   ├── validate_skill.py <- validacao profunda (10 checks)
│   ├── package_skill.py  <- empacotador ZIP + verificador de integridade
│   └── requirements.txt
├── references/
│   └── known-locations.md
└── data/
    ├── install_log.json  <- log de operacoes (auto-gerado, com rotacao)
    ├── backups/          <- backups antes de sobrescrever
    └── staging/          <- area temporaria para copias seguras
```

---

## Workflow Principal

Quando esta skill for ativada, siga estes passos na ordem:

## Cenario 1: Apos Skill-Creator Finalizar

O skill-creator acabou de criar uma skill em algum diretorio. Execute:

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --source "<caminho-da-skill-criada>" --force
```

Substitua `<caminho-da-skill-criada>` pelo diretorio onde o skill-creator salvou a skill.

## Cenario 2: Usuario Pede Para Instalar Uma Skill Especifica

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --source "<caminho>" [--name "nome-override"] [--force]
```

## Cenario 3: Simular Instalacao Sem Fazer Nada (Dry-Run)

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --source "<caminho>" --dry-run
```

Mostra exatamente o que seria feito em cada um dos 11 passos, sem alterar nenhum arquivo.

## Cenario 4: Detectar E Instalar Skills Pendentes

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --detect
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --detect --auto
```

Escaneia locais conhecidos (Desktop, Downloads, Temp, workspaces) e apresenta
candidatos com timestamps e tamanho. Com --auto instala todos automaticamente.

## Cenario 5: Desinstalar Uma Skill

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --uninstall "nome-da-skill"
```

Remove de `skills/`, `.claude/skills/`, atualiza o registry e remove ZIP do Desktop.
Backup automatico e feito antes da remocao.

## Cenario 6: Health Check + Auto-Repair

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --health
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --health --repair
```

`--health` verifica TODAS as skills: frontmatter, registro, registry, duplicatas.
`--health --repair` encontra problemas E os corrige automaticamente:
- Skills nao registradas -> registra
- Skills faltando no registry -> atualiza
- Duplicatas -> remove

## Cenario 7: Rollback (Restaurar De Backup)

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --rollback "nome-da-skill"
```

Encontra o backup mais recente da skill e restaura para o estado anterior.
Re-registra e atualiza o registry automaticamente.

## Cenario 8: Reinstalar Todas As Skills

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --reinstall-all
```

Re-registra TODAS as skills em `.claude/skills/`, re-empacota todos os ZIPs,
e atualiza o registry. Util apos mudancas em massa ou migracao.

## Cenario 9: Dashboard De Status

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --status
```

Exibe dashboard rico com: nome, versao, saude, registro, backups de cada skill,
estatisticas de operacoes (installs, uninstalls, rollbacks).

## Cenario 10: Ver Historico De Operacoes

```bash
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --log
python C:\Users\renat\skills\skill-installer\scripts\install_skill.py --log 50
```

Mostra as ultimas N operacoes com timestamp, tipo, skill e resultado.

---

## Validar Uma Skill

```bash
python C:\Users\renat\skills\skill-installer\scripts\validate_skill.py "C:\caminho\para\skill"
python C:\Users\renat\skills\skill-installer\scripts\validate_skill.py "C:\caminho\para\skill" --strict
```

Retorna JSON com `valid` (bool), `checks`, `warnings`, `errors`.

## Detectar Skills Nao-Instaladas

```bash
python C:\Users\renat\skills\skill-installer\scripts\detect_skills.py
python C:\Users\renat\skills\skill-installer\scripts\detect_skills.py --path "C:\diretorio\especifico"
python C:\Users\renat\skills\skill-installer\scripts\detect_skills.py --all
```

Retorna JSON com candidatos incluindo: `name`, `source_path`, `already_installed`,
`valid_frontmatter`, `last_modified`, `size_kb`, `file_count`.

## Empacotar Zip Para Claude.Ai

```bash
python C:\Users\renat\skills\skill-installer\scripts\package_skill.py --source "C:\caminho"
python C:\Users\renat\skills\skill-installer\scripts\package_skill.py --all
python C:\Users\renat\skills\skill-installer\scripts\package_skill.py --all --output "C:\Users\renat\Desktop"
```

## Verificar Integridade De Zips Existentes

```bash
python C:\Users\renat\skills\skill-installer\scripts\package_skill.py --verify
python C:\Users\renat\skills\skill-installer\scripts\package_skill.py --verify --output "C:\Users\renat\Desktop"
```

---

## Install_Skill.Py

| Comando | Descricao |
|---------|-----------|
| `--source <path>` | Instalar skill de caminho |
| `--source <path> --force` | Sobrescrever se existir |
| `--source <path> --name <nome>` | Nome customizado |
| `--source <path> --dry-run` | Simular sem alterar |
| `--detect` | Auto-detectar skills pendentes |
| `--detect --auto` | Detectar e instalar automaticamente |
| `--uninstall <nome>` | Desinstalar (com backup) |
| `--rollback <nome>` | Restaurar do ultimo backup |
| `--reinstall-all` | Re-registrar + re-empacotar todas |
| `--health` | Health check de todas as skills |
| `--health --repair` | Health check + auto-correcao |
| `--status` | Dashboard rico com versoes, saude, backups |
| `--log [N]` | Ultimas N operacoes (padrao: 20) |
| `--json` | Saida JSON em vez de texto formatado |

---

## O Que O Instalador Faz (11 Passos)

1. **Resolver fonte** - identifica o diretorio da skill
2. **Validar** - roda 10 checks no SKILL.md e estrutura
3. **Determinar nome** - extrai do frontmatter ou usa --name, compara versoes
4. **Verificar conflitos** - checa se ja existe no destino
5. **Backup** - se sobrescrevendo, faz backup timestamped (exclui backups/ e staging/)
6. **Copiar via staging** - copia para area temp, valida hash, depois move
7. **Registrar no Claude Code CLI** - copia SKILL.md para .claude/skills/<nome>/
8. **Atualizar registry** - roda scan_registry.py --force (com deduplicacao por nome)
9. **Verificar instalacao** - confirma arquivos, registry, registro (5 checks)
10. **Empacotar ZIP** - cria ZIP para upload no Claude.ai web/desktop (validado)
11. **Logar operacao** - append em install_log.json (com rotacao automatica)

**IMPORTANTE**: Skills no Claude Code (CLI) e Claude.ai (web/desktop) sao SEPARADAS.
O instalador cobre ambas superficies automaticamente.

---

## Seguranca

- **Backups automaticos**: antes de qualquer sobrescrita, backup em `data/backups/<nome>_<timestamp>/`
- **Staging area**: copia para temp primeiro, valida hash, depois move (minimiza corrupcao)
- **Idempotencia**: rodar 2x com mesma source detecta hashes identicos, nao duplica
- **Arquivos proibidos**: bloqueia instalacao se encontrar .env, *.key, *.pem, credentials.*
- **Log com rotacao**: toda operacao logada; mantem ultimas 500 entradas
- **Limite de backups**: mantem ultimos 5 por skill, limpa automaticamente
- **Anti-recursao**: backup e staging excluem seus proprios subdiretorios
- **Deduplicacao no registry**: scan_registry.py deduplica por nome (case-insensitive)
- **ZIP validado**: verifica ausencia de backslashes, conteudo nao-vazio, integridade
- **Dry-run**: simula instalacao completa sem tocar nenhum arquivo
- **Rollback**: restaura de backup com re-registro automatico
- **Comparacao de versao**: detecta upgrade/downgrade/same antes de sobrescrever
- **Hash normalizado**: md5_dir usa forward slashes e exclui dirs de sistema

---

## Integracao Com Orchestrator

Esta skill e auto-detectada pelo `scan_registry.py` e matchada pelo `match_skills.py`
quando o usuario menciona keywords de instalacao. Nenhuma configuracao manual necessaria.

Alem disso, o CLAUDE.md global contem instrucao para rodar o instalador automaticamente
apos o skill-creator finalizar uma skill.

## Best Practices

- Provide clear, specific context about your project and requirements
- Review all suggestions before applying them to production code
- Combine with other complementary skills for comprehensive analysis

## Common Pitfalls

- Using this skill for tasks outside its domain expertise
- Applying recommendations without understanding your specific context
- Not providing enough project context for accurate analysis

## Related Skills

- `skill-sentinel` - Complementary skill for enhanced analysis

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
id: skill-issue
name: skill-issue
description: "Find out why a coding-agent skill won't fire — grade each SKILL.md A–F on activation, simulate which skill a prompt triggers, and flag collisions where one silently shadows another."
category: meta
risk: safe
source: community
source_repo: mishanefedov/skill-issue
source_type: community
date_added: "2026-06-02"
author: mishanefedov
tags: [skills, linter, activation, meta, ci]
tools: [claude, cursor, gemini, codex]
license: "MIT"
license_source: "https://github.com/mishanefedov/skill-issue/blob/main/LICENSE"
---

# skill-issue — skill activation audit

## Overview

A coding agent decides which skill to run from each skill's always-on `name` +
`description`. A skill can be perfectly implemented and still never fire because
its description is too vague to match how people phrase requests, or because a
more specific sibling silently wins. `skill-issue` audits exactly that surface,
grading each skill A–F, simulating which skill fires for a given prompt, and
reporting collision clusters where one skill shadows another.

## When to Use This Skill

- Use when a skill you wrote never seems to trigger and you don't know why
- Use when the user says "why isn't my skill firing", "which skill fires for X", or "audit my skills"
- Use after writing or installing a new SKILL.md, to confirm it will actually be picked
- Use in CI to fail a PR that adds a skill with empty/duplicate/colliding metadata

## How It Works

Install the CLI (`npm i -g @misha_misha/skill-issue`, `brew install mishanefedov/skill-issue/skill-issue`, or `npx @misha_misha/skill-issue`), then:

```bash
skill-issue ~/.claude/skills                       # grade every skill A–F (+ collisions summary)
skill-issue ~/.codex/skills --why "deploy to prod" # which skill fires for this prompt, and why
skill-issue <dir> --collisions                     # clusters of skills that shadow each other
skill-issue <dir> --fix                            # append a "Use when …" clause to weak descriptions
skill-issue <dir> --json                           # machine-readable; exits non-zero on errors
```

Offline heuristic by default; add `--llm` to judge with a local `claude`/`codex` CLI.

## Examples

### Example 1: Audit installed skills

```bash
skill-issue ~/.claude/skills
# F  deploy-helper  ✗ no description — can never fire
# C  shipit         ! no "use when …" trigger clause
# A  rollback-prod  ✓ will fire on its triggers
```

### Example 2: Diagnose a collision

```bash
skill-issue ~/.claude/skills --why "deploy the app to prod"
#  1. shipit       0.74  ← would fire
#  2. land-deploy  0.69  (margin 0.05 — ambiguous, likely collision)
```

## Limitations

- Offline scoring is heuristic and should be treated as a triage signal, not a final quality verdict.
- Collision reports highlight likely shadowing, but agent-specific routers can weight metadata differently.
- The `--fix` mode can improve weak trigger wording, but generated edits still need maintainer review before committing.


---
name: skill-optimizer
description: "Diagnose and optimize Agent Skills (SKILL.md) with real session data and research-backed static analysis. Works with Claude Code, Codex, and any Agent Skills-compatible agent."
risk: safe
source: hqhq1025/skill-optimizer (MIT)
date_added: "2026-04-11"
---

## When to Use This Skill

- Use when skills are not triggering as expected or seem broken
- Use when you want to audit and improve your skill library's quality
- Use when you want to understand which skills are underperforming or wasting context tokens

## Rules

- **Read-only**: never modify skill files. Only output report.
- **All 8 dimensions**: do not skip any. If data is insufficient, report "N/A — insufficient session data" rather than omitting.
- **Quantify**: "you had 12 research tasks last week but the skill never triggered" beats "you often do research".
- **Suggest, don't prescribe**: give specific wording suggestions for description improvements, but frame as suggestions.
- **Show evidence**: for undertrigger claims, quote the actual user message that should have triggered the skill.
- **Evidence-based suggestions**: when suggesting description rewrites, cite the specific research finding that motivates the change (e.g., "front-load trigger keywords — MCP study shows 3.6x selection rate improvement").

## Overview

Analyze skills using **historical session data + static quality checks**, output a diagnostic report with P0/P1/P2 prioritized fixes. Scores each skill on a 5-point composite scale across 8 dimensions.

CSO (Claude/Agent Search Optimization) = writing skill descriptions so agents select the right skill at the right time. This skill checks for CSO violations.

## Usage

- `/optimize-skill` → scan all skills
- `/optimize-skill my-skill` → single skill
- `/optimize-skill skill-a skill-b` → multiple specified skills

## Data Sources

Auto-detect the current agent platform and scan the corresponding paths:

| Source | Claude Code | Codex | Shared |
|--------|------------|-------|--------|
| Session transcripts | `~/.claude/projects/**/*.jsonl` | `~/.codex/sessions/**/*.jsonl` | — |
| Skill files | `~/.claude/skills/*/SKILL.md` | `~/.codex/skills/*/SKILL.md` | `~/.agents/skills/*/SKILL.md` |

**Platform detection:** Check which directories exist. Scan all available sources — a user may have both Claude Code and Codex installed.

## Workflow

```
Identify target skills
        ↓
Collect session data (python3 scripts scan JSONL transcripts)
        ↓
Run 8 analysis dimensions
        ↓
Compute composite scores
        ↓
Output report with P0/P1/P2
```

### Step 1: Identify Target Skills

Scan skill directories in order: `~/.claude/skills/`, `~/.codex/skills/`, `~/.agents/skills/`. Deduplicate by skill name (same name in multiple locations = same skill). For each, read `SKILL.md` and extract:
- name, description (from YAML frontmatter)
- trigger keywords (from description field)
- defined workflow steps (Step 1/2/3... or ### sections under Workflow)
- word count

If user specified skill names, filter to only those.

### Step 2: Collect Session Data

Use python3 scripts via Bash to scan session JSONL files. Extract:

**Claude Code sessions** (`~/.claude/projects/**/*.jsonl`):
- `Skill` tool_use calls (which skills were invoked)
- User messages (full text)
- Assistant messages after skill invocation (for workflow tracking)
- User messages after skill invocation (for reaction analysis)

**Codex sessions** (`~/.codex/sessions/**/*.jsonl`):
- `session_meta` events → extract `base_instructions` for skill loading evidence
- `response_item` events → assistant outputs (workflow tracking)
- `event_msg` events → tool execution and skill-related events
- User messages from `turn_context` events (for reaction analysis)

**Note:** Codex injects skills via context rather than explicit `Skill` tool calls. Skill loading (present in `base_instructions`) does NOT equal active invocation. To detect actual use, search for skill-specific workflow markers (step headers, output formats) in `response_item` content within that session. A skill is "invoked" only if the agent produced output following the skill's defined workflow.

**Aggregated:**
- Per-skill: invocation count, trigger keyword match count
- Per-skill: user reaction sentiment after invocation
- Per-skill: workflow step completion markers

### Step 3: Run 8 Analysis Dimensions

**You MUST run ALL 8 dimensions.** The baseline behavior without this skill is to skip dimensions 4.2, 4.3, 4.5b, and 4.8. These are the most valuable dimensions — do not skip them.

#### 4.1 Trigger Rate

Count how many times each skill was actually invoked vs how many times its trigger keywords appeared in user messages.

**Claude Code:** count `Skill` tool_use calls in transcripts.
**Codex:** count sessions where the agent produced output following the skill's workflow markers (not merely loaded in context).

**Diagnose:**
- Never triggered → skill may be useless or trigger words wrong
- Keywords match >> actual invocations → undertrigger problem, description needs work
- High frequency → core skill, worth optimizing

#### 4.2 Post-Invocation User Reaction

**This dimension is critical and easy to skip. Do not skip it.**

After a skill is invoked in a session, read the user's next 3 messages. Classify:
- **Negative**: "no", "wrong", "never mind", "not what I wanted", user interrupts
- **Correction**: user re-describes their intent, manually overrides skill output
- **Positive**: "good", "ok", "continue", "nice", user follows the workflow
- **Silent switch**: user changes topic entirely (likely false positive trigger)

Report per-skill satisfaction rate.

#### 4.3 Workflow Completion Rate

**This dimension is critical and easy to skip. Do not skip it.**

For each skill invocation found in session data:
1. Extract the skill's defined steps from SKILL.md
2. Search the assistant messages in that session for step markers (Step N, specific output formats defined in the skill)
3. Calculate: how far did execution get?

Report: `{skill-name} (N steps): avg completed Step X/N (Y%)`

If a specific step is frequently where execution stops, flag it.

#### 4.4 Static Quality Analysis

Check each SKILL.md against these 14 rules:

| Check | Pass Criteria |
|-------|--------------|
| Frontmatter format | Only `name` + `description`, total < 1024 chars |
| Name format | Letters, numbers, hyphens only |
| Description trigger | Starts with "Use when..." or has explicit trigger conditions |
| Description workflow leak | Description does NOT summarize the skill's workflow steps (CSO violation) |
| Description pushiness | Description actively claims scenarios where it should be used, not just passive |
| Overview section | Present |
| Rules section | Present |
| MUST/NEVER density | Count ALL-CAPS directive words; >5 per 100 words = flag |
| Word count | < 500 words (flag if over) |
| Narrative anti-pattern | No "In session X, we found..." storytelling |
| YAML quoting safety | description containing `: ` must be wrapped in double quotes |
| Critical info position | Core trigger conditions and primary actions must be in the first 20% of SKILL.md |
| Description 250-char check | Primary trigger keywords must appear within the first 250 characters of description |
| Trigger condition count | ≤ 2 trigger conditions in description is ideal |

#### 4.5a False Positive Rate (Overtrigger)

Skill was invoked but user immediately rejected or ignored it.

#### 4.5b Undertrigger Detection

**This is the highest-value dimension.** For each skill, extract its **capability keywords** (not just trigger keywords — what the skill CAN do). Then scan user messages for tasks that match those capabilities but where the skill was NOT invoked.

Report: which user messages SHOULD have triggered the skill but didn't, and suggest description improvements.

**Compounding Risk Assessment:**
For skills with chronic undertriggering (0 triggers across 5+ sessions where relevant tasks appeared), flag as "compounding risk" — undertriggered skills cannot self-improve through usage feedback, causing the gap to widen over time. Recommend immediate description rewrite as P0.

#### 4.6 Cross-Skill Conflicts

Compare all skill pairs:
- Trigger keyword overlap (same keywords in two descriptions)
- Workflow overlap (two skills teach similar processes)
- Contradictory guidance

#### 4.7 Environment Consistency

For each skill, extract referenced:
- File paths → check if they exist (`test -e`)
- CLI tools → check if installed (`which`)
- Directories → check if they exist

Flag any broken references.

#### 4.8 Token Economics

**This dimension is critical and easy to skip. Do not skip it.**

For each skill:
- Word count (from Step 1)
- Trigger frequency (from 4.1)
- Cost-effectiveness = trigger count / word count
- Flag: large + never-triggered skills as candidates for removal or compression

**Progressive Disclosure Tier Check:**
Evaluate each skill against the 3-tier loading model:
- Tier 1 (frontmatter): ~100 tokens. Check: is description ≤ 1024 chars?
- Tier 2 (SKILL.md body): <500 lines recommended. Check: word count.
- Tier 3 (reference files): loaded on demand. Check: does skill use reference files for detailed content, or cram everything into SKILL.md?

Flag skills that put 500+ words in SKILL.md without using reference files as "poor progressive disclosure".

### Step 4: Composite Score

Rate each skill on a 5-point scale:

| Score | Meaning |
|-------|---------|
| 5 | Healthy: high trigger rate, positive reactions, complete workflows, clean static |
| 4 | Good: minor issues in 1-2 dimensions |
| 3 | Needs attention: significant gap in 1 dimension or minor gaps in 3+ |
| 2 | Problematic: never triggered, or negative user reactions, or major static issues |
| 1 | Broken: doesn't work, references missing, or fundamentally misaligned |

**Scored dimensions** (weighted average):
- Trigger rate: 25%
- User reaction: 20%
- Workflow completion: 15%
- Static quality: 15%
- Undertrigger: 15%
- Token economics: 10%

**Qualitative dimensions** (reported but not scored):
- 4.5a Overtrigger: reported as count + examples
- 4.6 Cross-Skill Conflicts: reported as conflict pairs
- 4.7 Environment Consistency: reported as pass/fail per reference

## Report Format

```markdown
# Skill Optimization Report
**Date**: {date}
**Scope**: {all / specified skills}
**Session data**: {N} sessions, {date range}

## Overview
| Skill | Triggers | Reaction | Completion | Static | Undertrigger | Token | Score |
|-------|----------|----------|------------|--------|--------------|-------|-------|
| example-skill | 2 | 100% | 86% | B+ | 1 miss | 486w | 4/5 |

## P0 Fixes (blocking usage)
1. ...

## P1 Improvements (better experience)
1. ...

## P2 Optional Optimizations
1. ...

## Per-Skill Diagnostics
### {skill-name}
#### 4.1 Trigger Rate
...
#### 4.2 User Reaction
...
(all 8 dimensions)
```

## Research Background

The analysis dimensions in this report are grounded in the following research:
- **Undertrigger detection**: Memento-Skills (arXiv:2603.18743) — skills as structured files require accurate routing; unrouted skills cannot self-improve via the read-write learning loop
- **Description quality**: MCP Description Quality (arXiv:2602.18914) — well-written descriptions achieve 72% tool selection rate vs. 20% random baseline (3.6x improvement)
- **Information position**: Lost in the Middle (Liu et al., TACL 2024) — U-shaped LLM attention curve
- **Format impact**: He et al. (arXiv:2411.10541) — format changes alone can cause 9-40% performance variance
- **Instruction compliance**: IFEval (arXiv:2311.07911) — LLMs struggle with multi-constraint prompts

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: skill-rails-upgrade
description: "Analyze Rails apps and provide upgrade assessments"
risk: safe
source: "https://github.com/robzolkos/skill-rails-upgrade"
date_added: "2026-02-27"
---

## When to Use This Skill

Analyze Rails apps and provide upgrade assessments

Use this skill when working with analyze rails apps and provide upgrade assessments.
# Rails Upgrade Analyzer

Analyze the current Rails application and provide a comprehensive upgrade assessment with selective file merging.

## Step 1: Verify Rails Application

Check that we're in a Rails application by looking for these files:
- `Gemfile` (must exist and contain 'rails')
- `config/application.rb` (Rails application config)
- `config/environment.rb` (Rails environment)

If any of these are missing or don't indicate a Rails app, stop and inform the user this doesn't appear to be a Rails application.

## Step 2: Get Current Rails Version

Extract the current Rails version from:
1. First, check `Gemfile.lock` for the exact installed version (look for `rails (x.y.z)`)
2. If not found, check `Gemfile` for the version constraint

Report the exact current version (e.g., `7.1.3`).

## Step 3: Find Latest Rails Version

Use the GitHub CLI to fetch the latest Rails release:

```bash
gh api repos/rails/rails/releases/latest --jq '.tag_name'
```

This returns the latest stable version tag (e.g., `v8.0.1`). Strip the 'v' prefix for comparison.

Also check recent tags to understand the release landscape:

```bash
gh api repos/rails/rails/tags --jq '.[0:10] | .[].name'
```

## Step 4: Determine Upgrade Type

Compare current and latest versions to classify the upgrade:

- **Patch upgrade**: Same major.minor, different patch (e.g., 7.1.3 → 7.1.5)
- **Minor upgrade**: Same major, different minor (e.g., 7.1.3 → 7.2.0)
- **Major upgrade**: Different major version (e.g., 7.1.3 → 8.0.0)

## Step 5: Fetch Upgrade Guide

Use WebFetch to get the official Rails upgrade guide:

URL: `https://guides.rubyonrails.org/upgrading_ruby_on_rails.html`

Look for sections relevant to the version jump. The guide is organized by target version with sections like:
- "Upgrading from Rails X.Y to Rails X.Z"
- Breaking changes
- Deprecation warnings
- Configuration changes
- Required migrations

Extract and summarize the relevant sections for the user's specific upgrade path.

## Step 6: Fetch Rails Diff

Use WebFetch to get the diff between versions from railsdiff.org:

URL: `https://railsdiff.org/{current_version}/{target_version}`

For example: `https://railsdiff.org/7.1.3/8.0.0`

This shows:
- Changes to default configuration files
- New files that need to be added
- Modified initializers
- Updated dependencies
- Changes to bin/ scripts

Summarize the key file changes.

## Step 7: Check JavaScript Dependencies

Rails applications often include JavaScript packages that should be updated alongside Rails. Check for and report on these dependencies.

### 7.1: Identify JS Package Manager

Check which package manager the app uses:

```bash
# Check for package.json (npm/yarn)
ls package.json 2>/dev/null

# Check for importmap (Rails 7+)
ls config/importmap.rb 2>/dev/null
```

### 7.2: Check Rails-Related JS Packages

If `package.json` exists, check for these Rails-related packages:

```bash
# Extract current versions of Rails-related packages
cat package.json | grep -E '"@hotwired/|"@rails/|"stimulus"|"turbo-rails"' || echo "No Rails JS packages found"
```

**Key packages to check:**

| Package | Purpose | Version Alignment |
|---------|---------|-------------------|
| `@hotwired/turbo-rails` | Turbo Drive/Frames/Streams | Should match Rails version era |
| `@hotwired/stimulus` | Stimulus JS framework | Generally stable across Rails versions |
| `@rails/actioncable` | WebSocket support | Should match Rails version |
| `@rails/activestorage` | Direct uploads | Should match Rails version |
| `@rails/actiontext` | Rich text editing | Should match Rails version |
| `@rails/request.js` | Rails UJS replacement | Should match Rails version era |

### 7.3: Check for Updates

For npm/yarn projects, check for available updates:

```bash
# Using npm
npm outdated @hotwired/turbo-rails @hotwired/stimulus @rails/actioncable @rails/activestorage 2>/dev/null

# Or check latest versions directly
npm view @hotwired/turbo-rails version 2>/dev/null
npm view @rails/actioncable version 2>/dev/null
```

### 7.4: Check Importmap Pins (if applicable)

If the app uses importmap-rails, check `config/importmap.rb` for pinned versions:

```bash
cat config/importmap.rb | grep -E 'pin.*turbo|pin.*stimulus|pin.*@rails' || echo "No importmap pins found"
```

To update importmap pins:
```bash
bin/importmap pin @hotwired/turbo-rails
bin/importmap pin @hotwired/stimulus
```

### 7.5: JS Dependency Summary

Include in the upgrade summary:

```
### JavaScript Dependencies

**Package Manager**: [npm/yarn/importmap/none]

| Package | Current | Latest | Action |
|---------|---------|--------|--------|
| @hotwired/turbo-rails | 8.0.4 | 8.0.12 | Update recommended |
| @rails/actioncable | 7.1.0 | 8.0.0 | Update with Rails |
| ... | ... | ... | ... |

**Recommended JS Updates:**
- Run `npm update @hotwired/turbo-rails` (or yarn equivalent)
- Run `npm update @rails/actioncable @rails/activestorage` to match Rails version
```

---

## Step 8: Generate Upgrade Summary

Provide a comprehensive summary including all findings from Steps 1-7:

### Version Information
- Current version: X.Y.Z
- Latest version: A.B.C
- Upgrade type: [Patch/Minor/Major]

### Upgrade Complexity Assessment

Rate the upgrade as **Small**, **Medium**, or **Large** based on:

| Factor | Small | Medium | Large |
|--------|-------|--------|-------|
| Version jump | Patch only | Minor version | Major version |
| Breaking changes | None | Few, well-documented | Many, significant |
| Config changes | Minimal | Moderate | Extensive |
| Deprecations | None active | Some to address | Many requiring refactoring |
| Dependencies | Compatible | Some updates needed | Major dependency updates |

### Key Changes to Address

List the most important changes the user needs to handle:
1. Configuration file updates
2. Deprecated methods/features to update
3. New required dependencies
4. Database migrations needed
5. Breaking API changes

### Recommended Upgrade Steps

1. Update test suite and ensure passing
2. Review deprecation warnings in current version
3. Update Gemfile with new Rails version
4. Run `bundle update rails`
5. Update JavaScript dependencies (see JS Dependencies section)
6. **DO NOT run `rails app:update` directly** - use the selective merge process below
7. Run database migrations
8. Run test suite
9. Review and update deprecated code

### Resources

- Rails Upgrade Guide: https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
- Rails Diff: https://railsdiff.org/{current}/{target}
- Release Notes: https://github.com/rails/rails/releases/tag/v{target}

---

### When to Use This Skill

Analyze Rails apps and provide upgrade assessments

Use this skill when working with analyze rails apps and provide upgrade assessments.
## Step 9: Selective File Update (replaces `rails app:update`)

**IMPORTANT:** Do NOT run `rails app:update` as it overwrites files without considering local customizations. Instead, follow this selective merge process:

### 9.1: Detect Local Customizations

Before any upgrade, identify files with local customizations:

```bash
# Check for uncommitted changes
git status

# List config files that differ from a fresh Rails app
# These are the files we need to be careful with
git diff HEAD --name-only -- config/ bin/ public/
```

Create a mental list of files in these categories:
- **Custom config files**: Files with project-specific settings (i18n, mailer, etc.)
- **Modified bin scripts**: Scripts with custom behavior (bin/dev with foreman, etc.)
- **Standard files**: Files that haven't been customized

### 9.2: Analyze Required Changes from Railsdiff

Based on the railsdiff output from Step 6, categorize each changed file:

| Category | Action | Example |
|----------|--------|---------|
| **New files** | Create directly | `config/initializers/new_framework_defaults_X_Y.rb` |
| **Unchanged locally** | Safe to overwrite | `public/404.html` (if not customized) |
| **Customized locally** | Manual merge needed | `config/application.rb`, `bin/dev` |
| **Comment-only changes** | Usually skip | Minor comment updates in config files |

### 9.3: Create Upgrade Plan

Present the user with a clear upgrade plan:

```
## Upgrade Plan: Rails X.Y.Z → A.B.C

### New Files (will be created):
- config/initializers/new_framework_defaults_A_B.rb
- bin/ci (new CI script)

### Safe to Update (no local customizations):
- public/400.html
- public/404.html
- public/500.html

### Needs Manual Merge (local customizations detected):
- config/application.rb
  └─ Local: i18n configuration
  └─ Rails: [describe new Rails changes if any]

- config/environments/development.rb
  └─ Local: letter_opener mailer config
  └─ Rails: [describe new Rails changes]

- bin/dev
  └─ Local: foreman + Procfile.dev setup
  └─ Rails: changed to simple ruby script

### Skip (comment-only or irrelevant changes):
- config/puma.rb (only comment changes)
```

### 9.4: Execute Upgrade Plan

After user confirms the plan:

#### For New Files:
Create them directly using the content from railsdiff or by extracting from a fresh Rails app:

```bash
# Generate a temporary fresh Rails app to extract new files
cd /tmp && rails new rails_template --skip-git --skip-bundle
# Then copy needed files
```

Or use the Rails generator for specific files:
```bash
bin/rails app:update:configs  # Only updates config files, still interactive
```

#### For Safe Updates:
Overwrite these files as they have no local customizations.

#### For Manual Merges:
For each file needing merge, show the user:

1. **Current local version** (their customizations)
2. **New Rails default** (from railsdiff)
3. **Suggested merged version** that:
   - Keeps all local customizations
   - Adds only essential new Rails functionality
   - Removes deprecated settings

Example merge for `config/application.rb`:
```ruby
# KEEP local customizations:
config.i18n.available_locales = [:de, :en]
config.i18n.default_locale = :de
config.i18n.fallbacks = [:en]

# ADD new Rails 8.1 settings if needed:
# (usually none required - new defaults come via new_framework_defaults file)
```

### 9.5: Handle Active Storage Migrations

After file updates, run any new migrations:

```bash
bin/rails db:migrate
```

Check for new migrations that were added:
```bash
ls -la db/migrate/ | tail -10
```

### 9.6: Verify Upgrade

After completing the merge:

1. Start the Rails server and check for errors:
   ```bash
   bin/dev  # or bin/rails server
   ```

2. Check the Rails console:
   ```bash
   bin/rails console
   ```

3. Run the test suite:
   ```bash
   bin/rails test
   ```

4. Review deprecation warnings in logs

---

## Step 10: Finalize Framework Defaults

After verifying the app works:

1. Review `config/initializers/new_framework_defaults_X_Y.rb`
2. Enable each new default one by one, testing after each
3. Once all defaults are enabled and tested, update `config/application.rb`:
   ```ruby
   config.load_defaults X.Y  # Update to new version
   ```
4. Delete the `new_framework_defaults_X_Y.rb` file

---

### When to Use This Skill

Analyze Rails apps and provide upgrade assessments

Use this skill when working with analyze rails apps and provide upgrade assessments.
## Error Handling

- If `gh` CLI is not authenticated, instruct the user to run `gh auth login`
- If railsdiff.org doesn't have the exact versions, try with major.minor.0 versions
- If the app is already on the latest version, congratulate the user and note any upcoming releases
- If local customizations would be lost, ALWAYS stop and show the user what would be overwritten before proceeding

## Key Principles

1. **Never overwrite without checking** - Always check for local customizations first
2. **Preserve user intent** - Local customizations exist for a reason
3. **Minimal changes** - Only add what's necessary for the new Rails version
4. **Transparency** - Show the user exactly what will change before doing it
5. **Reversibility** - User should be able to `git checkout` to restore if needed

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: skill-router
description: "Use when the user is unsure which skill to use or where to start. Interviews the user with targeted questions and recommends the best skill(s) from the installed library for their goal."
risk: safe
source: self
---

# Skill Router

## When to Use
Use this skill when:
- The user says "I don't know where to start" or "which skill should I use"
- The user has a vague goal without a clear method
- The user asks "what should I use for..." or "I'm not sure how to approach this"
- The user is new to the skill library and needs guidance

## Goal

Help users who are unsure of what they want to do or which skill to use.
Interview them with a short structured conversation, then recommend the most
relevant skill(s) from the installed library — with a clear explanation of
why each skill fits and exactly how to invoke it.

---

## Instructions

### Step 1 — Acknowledge and open the interview

Respond warmly and tell the user you'll ask a few quick questions to find
the right skill for them. Do NOT suggest any skills yet.

Example opener:
> "No problem — let me ask you a few quick questions so I can point you to
> exactly the right skill."

---

### Step 2 — Ask the Funnel Questions (one at a time, in order)

Ask only what you need. If an earlier answer makes a later question
irrelevant, skip it.

**Q1 — What is the broad area of the task?**
Present these as numbered options:
1. Building / coding something (app, feature, component, script)
2. Fixing or debugging something that's broken
3. Security, pentesting, or vulnerability assessment
4. AI agents, LLMs, or automation pipelines
5. Marketing, SEO, content, or growth
6. DevOps, infrastructure, deployment, or git
7. Design, UI/UX, or creative output
8. Planning, strategy, or documentation
9. Something else (ask them to describe it)

**Q2 — How specific is the task?**
1. I have a clear spec / I know exactly what I want built
2. I have a rough idea but need help shaping it
3. I'm totally starting from scratch with no clear direction

**Q3 — What tech stack or domain is involved?** (only ask if relevant)
Examples: React / Next.js, Node.js, Python, AWS, Stripe, AI/LLM, no-code, etc.
If they say "not sure" or "any", that's fine — move on.

**Q4 — Do you want to work autonomously (agent does everything) or
collaboratively (you stay in the loop)?**
1. Fully autonomous — just go
2. Collaborative — I want to review/approve steps
3. Not sure yet

---

### Step 3 — Recommend skills

Based on their answers, recommend **1 primary skill** and up to **2 secondary
skills**. Structure your recommendation exactly like this:

**✅ Primary Skill: `@skill-name`**
*Why:* [1–2 sentences explaining why this is the best fit for what they described]
*Invoke it like this:*
```
@skill-name [paste their goal here]
```

**🔁 Also consider:**
- `@skill-name-2` — [one sentence on when to layer this in]
- `@skill-name-3` — [one sentence on when to layer this in]

---

### Step 4 — Offer a ready-made prompt

After the recommendation, offer to write them a ready-to-use prompt they
can paste directly into Antigravity. Ask:

> "Want me to write the full prompt for you so you can just paste it in?"

If yes, compose a complete, specific prompt using the recommended skill and
everything you learned about their goal from the interview.

---

## Example Interaction

```
User: @skill-router I want to build something but I'm not sure where to start

Agent: No problem — let me ask a few quick questions.
       What is the broad area?
       (1) Building  (2) Debugging  (3) Security  (4) AI/LLM
       (5) Marketing  (6) DevOps  (7) Design  (8) Planning

User: 1 - building something

Agent: How specific is the task?
       (1) Clear spec  (2) Rough idea  (3) Starting from scratch

User: 2 - rough idea

Agent: What tech stack? (React, Node, Python, etc. — or "not sure")

User: Next.js

Agent: ✅ Primary Skill: @brainstorming
       Why: You have a rough idea that needs shaping before building.
       Brainstorming asks structured questions and produces a clear spec.

       @brainstorming help me design a [your app idea] using Next.js

       🔁 Also consider:
       - @plan-writing — once brainstorming produces a spec, break it into tasks
       - @senior-fullstack — when you are ready to start building

       Want me to write the full prompt for you?
```

---

## Skill Routing Reference

### Building a full product or app from scratch
- Primary: `@app-builder`
- If they want to plan first: `@brainstorming` → `@plan-writing` → `@app-builder`
- If they want it fully autonomous: `@loki-mode`

### Building a specific frontend feature / UI
- Primary: `@senior-fullstack` or `@frontend-design`
- Stack-specific: `@react-patterns`, `@nextjs-best-practices`, `@tailwind-patterns`
- If they want a full design system: `@ui-ux-pro-max` + `@core-components`

### Building a backend API or service
- Primary: `@backend-dev-guidelines`
- Stack-specific: `@nodejs-best-practices`, `@python-patterns`, `@nestjs-expert`
- API design: `@api-patterns`
- Database: `@database-design` + `@prisma-expert`

### Debugging something broken
- Primary: `@systematic-debugging`
- If tests are failing: `@test-fixing`
- If it's a code quality issue: `@clean-code`

### Writing tests / TDD
- Primary: `@tdd`
- For Playwright/browser tests: `@playwright-skill`
- For Jest patterns: `@testing-patterns`

### Integrating a third-party service
- Payments: `@stripe-integration`
- Auth: `@clerk-auth` or `@nextjs-supabase-auth`
- Database: `@neon-postgres` or `@firebase`
- Messaging: `@twilio-communications`
- Bots: `@slack-bot-builder`, `@discord-bot-architect`, `@telegram-bot-builder`
- File storage: `@file-uploads`
- Analytics: `@analytics-tracking`

### AI / LLM / agents
- Architecture: `@ai-agents-architect`
- RAG pipelines: `@rag-engineer`
- Prompts: `@prompt-engineer`
- Multi-agent: `@langgraph` or `@crewai`
- Observability: `@langfuse`
- Voice: `@voice-agents`

### Security / pentesting
- Start here: `@ethical-hacking-methodology` + `@pentest-checklist`
- Web app testing: `@burp-suite-testing`, `@sql-injection-testing`, `@xss-html-injection`
- Network/infra: `@aws-penetration-testing`, `@linux-privilege-escalation`
- Reference: `@top-web-vulnerabilities`

### DevOps / infrastructure / deployment
- Docker: `@docker-expert`
- Cloud: `@aws-serverless`, `@gcp-cloud-run`, `@vercel-deployment`
- Git workflow: `@git-pushing`, `@using-git-worktrees`, `@github-workflow-automation`
- Scripting: `@linux-shell-scripting`

### Marketing / growth / SEO
- Copy: `@copywriting`
- Landing pages: `@page-cro`
- SEO: `@seo-fundamentals` + `@seo-audit`
- Email: `@email-sequence`
- Ads: `@paid-ads`
- Launch: `@launch-strategy`

### Planning / architecture / strategy
- Quick plan: `@concise-planning`
- Full plan: `@plan-writing` → `@executing-plans`
- Architecture: `@software-architecture` or `@senior-architect`
- Product strategy: `@product-manager-toolkit`

### Creative / design / visuals
- UI: `@frontend-design`
- Data viz: `@claude-d3js-skill`
- Generative art: `@algorithmic-art`
- Presentations: `@pptx-official`

### Fully autonomous / parallel execution
- Full startup mode: `@loki-mode`
- Independent parallel tasks: `@dispatching-parallel-agents`
- Plan then execute: `@subagent-driven-development`

### Document creation
- Word doc: `@docx-official`
- PDF: `@pdf-official`
- Spreadsheet: `@xlsx-official`
- Presentation: `@pptx-official`

---

## Constraints

- Never recommend more than 1 primary skill and 2 secondary skills at a time.
- Always include the exact `@invoke` syntax so users can copy-paste it.
- If the user's goal spans multiple categories, pick the most upstream skill
  (e.g. `@brainstorming` before `@senior-fullstack`).
- Do not overwhelm the user with the full skill list. Recommend only what is
  relevant to their specific answers.
- If the user is totally lost, default to `@brainstorming` for open-ended
  goals, or `@app-builder` for anything involving building something.
- After recommending, always offer to write a ready-made prompt for them.

---

## Limitations

- Only recommends skills from the installed library. If a skill is not
  installed, the recommendation may not work.
- Routing is based on natural language matching. Highly ambiguous goals
  may require follow-up clarification.
- Does not execute the recommended skill — it only recommends it. The user
  must invoke the skill themselves.
- The routing reference covers the most common skills but does not include
  every skill in the library.


---
name: skill-scanner
description: "Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks."
risk: safe
source: community
---

# Skill Security Scanner

Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks.

**Important**: Run all scripts from the repository root using the full path via `${CLAUDE_SKILL_ROOT}`.

## When to Use
- You need to evaluate a skill for prompt injection, malicious code, over-broad permissions, or supply-chain risk before adopting it.
- You want a static scan plus manual review workflow for a skill directory.
- The task is to decide whether a skill is safe enough to trust in an agent environment.

## Bundled Script

### `scripts/scan_skill.py`

Static analysis scanner that detects deterministic patterns. Outputs structured JSON.

```bash
uv run ${CLAUDE_SKILL_ROOT}/scripts/scan_skill.py <skill-directory>
```

Returns JSON with findings, URLs, structure info, and severity counts. The script catches patterns mechanically — your job is to evaluate intent and filter false positives.

## Workflow

### Phase 1: Input & Discovery

Determine the scan target:

- If the user provides a skill directory path, use it directly
- If the user names a skill, look for it under `plugins/*/skills/<name>/` or `.claude/skills/<name>/`
- If the user says "scan all skills", discover all `*/SKILL.md` files and scan each

Validate the target contains a `SKILL.md` file. List the skill structure:

```bash
ls -la <skill-directory>/
ls <skill-directory>/references/ 2>/dev/null
ls <skill-directory>/scripts/ 2>/dev/null
```

### Phase 2: Automated Static Scan

Run the bundled scanner:

```bash
uv run ${CLAUDE_SKILL_ROOT}/scripts/scan_skill.py <skill-directory>
```

Parse the JSON output. The script produces findings with severity levels, URL analysis, and structure information. Use these as leads for deeper analysis.

**Fallback**: If the script fails, proceed with manual analysis using Grep patterns from the reference files.

### Phase 3: Frontmatter Validation

Read the SKILL.md and check:

- **Required fields**: `name` and `description` must be present
- **Name consistency**: `name` field should match the directory name
- **Tool assessment**: Review `allowed-tools` — is Bash justified? Are tools unrestricted (`*`)?
- **Model override**: Is a specific model forced? Why?
- **Description quality**: Does the description accurately represent what the skill does?

### Phase 4: Prompt Injection Analysis

Load `${CLAUDE_SKILL_ROOT}/references/prompt-injection-patterns.md` for context.

Review scanner findings in the "Prompt Injection" category. For each finding:

1. Read the surrounding context in the file
2. Determine if the pattern is **performing** injection (malicious) or **discussing/detecting** injection (legitimate)
3. Skills about security, testing, or education commonly reference injection patterns — this is expected

**Critical distinction**: A security review skill that lists injection patterns in its references is documenting threats, not attacking. Only flag patterns that would execute against the agent running the skill.

### Phase 5: Behavioral Analysis

This phase is agent-only — no pattern matching. Read the full SKILL.md instructions and evaluate:

**Description vs. instructions alignment**:
- Does the description match what the instructions actually tell the agent to do?
- A skill described as "code formatter" that instructs the agent to read ~/.ssh is misaligned

**Config/memory poisoning**:
- Instructions to modify `CLAUDE.md`, `MEMORY.md`, `settings.json`, `.mcp.json`, or hook configurations
- Instructions to add itself to allowlists or auto-approve permissions
- Writing to `~/.claude/` or any agent configuration directory

**Scope creep**:
- Instructions that exceed the skill's stated purpose
- Unnecessary data gathering (reading files unrelated to the skill's function)
- Instructions to install other skills, plugins, or dependencies not mentioned in the description

**Information gathering**:
- Reading environment variables beyond what's needed
- Listing directory contents outside the skill's scope
- Accessing git history, credentials, or user data unnecessarily

### Phase 6: Script Analysis

If the skill has a `scripts/` directory:

1. Load `${CLAUDE_SKILL_ROOT}/references/dangerous-code-patterns.md` for context
2. Read each script file fully (do not skip any)
3. Check scanner findings in the "Malicious Code" category
4. For each finding, evaluate:
   - **Data exfiltration**: Does the script send data to external URLs? What data?
   - **Reverse shells**: Socket connections with redirected I/O
   - **Credential theft**: Reading SSH keys, .env files, tokens from environment
   - **Dangerous execution**: eval/exec with dynamic input, shell=True with interpolation
   - **Config modification**: Writing to agent settings, shell configs, git hooks
5. Check PEP 723 `dependencies` — are they legitimate, well-known packages?
6. Verify the script's behavior matches the SKILL.md description of what it does

**Legitimate patterns**: `gh` CLI calls, `git` commands, reading project files, JSON output to stdout are normal for skill scripts.

### Phase 7: Supply Chain Assessment

Review URLs from the scanner output and any additional URLs found in scripts:

- **Trusted domains**: GitHub, PyPI, official docs — normal
- **Untrusted domains**: Unknown domains, personal sites, URL shorteners — flag for review
- **Remote instruction loading**: Any URL that fetches content to be executed or interpreted as instructions is high risk
- **Dependency downloads**: Scripts that download and execute binaries or code at runtime
- **Unverifiable sources**: References to packages or tools not on standard registries

### Phase 8: Permission Analysis

Load `${CLAUDE_SKILL_ROOT}/references/permission-analysis.md` for the tool risk matrix.

Evaluate:

- **Least privilege**: Are all granted tools actually used in the skill instructions?
- **Tool justification**: Does the skill body reference operations that require each tool?
- **Risk level**: Rate the overall permission profile using the tier system from the reference

Example assessments:
- `Read Grep Glob` — Low risk, read-only analysis skill
- `Read Grep Glob Bash` — Medium risk, needs Bash justification (e.g., running bundled scripts)
- `Read Grep Glob Bash Write Edit WebFetch Task` — High risk, near-full access

## Confidence Levels

| Level | Criteria | Action |
|-------|----------|--------|
| **HIGH** | Pattern confirmed + malicious intent evident | Report with severity |
| **MEDIUM** | Suspicious pattern, intent unclear | Note as "Needs verification" |
| **LOW** | Theoretical, best practice only | Do not report |

**False positive awareness is critical.** The biggest risk is flagging legitimate security skills as malicious because they reference attack patterns. Always evaluate intent before reporting.

## Output Format

```markdown
## Skill Security Scan: [Skill Name]

### Summary
- **Findings**: X (Y Critical, Z High, ...)
- **Risk Level**: Critical / High / Medium / Low / Clean
- **Skill Structure**: SKILL.md only / +references / +scripts / full

### Findings

#### [SKILL-SEC-001] [Finding Type] (Severity)
- **Location**: `SKILL.md:42` or `scripts/tool.py:15`
- **Confidence**: High
- **Category**: Prompt Injection / Malicious Code / Excessive Permissions / Secret Exposure / Supply Chain / Validation
- **Issue**: [What was found]
- **Evidence**: [code snippet]
- **Risk**: [What could happen]
- **Remediation**: [How to fix]

### Needs Verification
[Medium-confidence items needing human review]

### Assessment
[Safe to install / Install with caution / Do not install]
[Brief justification for the assessment]
```

**Risk level determination**:
- **Critical**: Any high-confidence critical finding (prompt injection, credential theft, data exfiltration)
- **High**: High-confidence high-severity findings or multiple medium findings
- **Medium**: Medium-confidence findings or minor permission concerns
- **Low**: Only best-practice suggestions
- **Clean**: No findings after thorough analysis

## Reference Files

| File | Purpose |
|------|---------|
| `references/prompt-injection-patterns.md` | Injection patterns, jailbreaks, obfuscation techniques, false positive guide |
| `references/dangerous-code-patterns.md` | Script security patterns: exfiltration, shells, credential theft, eval/exec |
| `references/permission-analysis.md` | Tool risk tiers, least privilege methodology, common skill permission profiles |

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: skill-seekers
description: "-Automatically convert documentation websites, GitHub repositories, and PDFs into Claude AI skills in minutes."
risk: safe
source: "https://github.com/yusufkaraaslan/Skill_Seekers"
date_added: "2026-02-27"
---

# Skill Seekers

## Overview

-Automatically convert documentation websites, GitHub repositories, and PDFs into Claude AI skills in minutes.

## When to Use This Skill

Use this skill when you need to work with -automatically convert documentation websites, github repositories, and pdfs into claude ai skills in minutes..

## Instructions

This skill provides guidance and patterns for -automatically convert documentation websites, github repositories, and pdfs into claude ai skills in minutes..

For more information, see the [source repository](https://github.com/yusufkaraaslan/Skill_Seekers).

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: skill-sentinel
description: Auditoria e evolucao do ecossistema de skills. Qualidade de codigo, seguranca, custos, gaps, duplicacoes, dependencias e relatorios de saude.
risk: safe
source: community
date_added: '2026-03-06'
author: renat
tags:
- governance
- audit
- quality
- skill-health
tools:
- claude-code
- antigravity
- cursor
- gemini-cli
- codex-cli
---

# Skill Sentinel

## Overview

Auditoria e evolucao do ecossistema de skills. Qualidade de codigo, seguranca, custos, gaps, duplicacoes, dependencias e relatorios de saude.

## When to Use This Skill

- When the user mentions "auditar skills" or related topics
- When the user mentions "qualidade skills" or related topics
- When the user mentions "verificar skills ecossistema" or related topics
- When the user mentions "saude ecossistema skills" or related topics
- When the user mentions "skills duplicadas" or related topics
- When the user mentions "otimizar skills" or related topics

## Do Not Use This Skill When

- The task is unrelated to skill sentinel
- A simpler, more specific tool can handle the request
- The user needs general-purpose assistance without domain expertise

## How It Works

Meta-agente que monitora, audita e evolui o ecossistema de skills. Analisa
todas as skills em 7 dimensoes, identifica problemas, sugere melhorias
e recomenda novas skills especialistas.

## Resumo Rapido

| Area | Script | O que faz |
|------|--------|-----------|
| **Discovery** | `scanner.py` | Descobre todas as skills automaticamente |
| **Qualidade** | `analyzers/code_quality.py` | Complexidade, docstrings, error handling |
| **Seguranca** | `analyzers/security.py` | Secrets, SQL injection, HTTPS |
| **Performance** | `analyzers/performance.py` | API calls, caching, retry |
| **Governanca** | `analyzers/governance_audit.py` | Rate limits, audit log, confirmacoes |
| **Documentacao** | `analyzers/documentation.py` | SKILL.md, triggers, references |
| **Dependencias** | `analyzers/dependencies.py` | requirements.txt, versoes |
| **Cross-Skill** | `analyzers/cross_skill.py` | Duplicacao, padroes compartilhados |
| **Custos** | `cost_optimizer.py` | Tokens, verbosidade, output |
| **Recomendacoes** | `recommender.py` | Gap analysis, novas skills |
| **Relatorio** | `report_generator.py` | Markdown estruturado |
| **Orquestracao** | `run_audit.py` | CLI principal |

## Localizacao

```
C:\Users\renat\skills\skill-sentinel\
├── SKILL.md
├── scripts/
│   ├── requirements.txt
│   ├── config.py
│   ├── db.py
│   ├── governance.py
│   ├── scanner.py
│   ├── analyzers/
│   │   ├── code_quality.py
│   │   ├── security.py
│   │   ├── performance.py
│   │   ├── governance_audit.py
│   │   ├── documentation.py
│   │   ├── dependencies.py
│   │   └── cross_skill.py
│   ├── recommender.py
│   ├── cost_optimizer.py
│   ├── report_generator.py
│   └── run_audit.py
├── references/
│   ├── analysis_criteria.md
│   ├── security_patterns.md
│   ├── skill_template.md
│   └── schema.md
└── data/
    ├── sentinel.db
    └── reports/
```

## Instalacao

```bash
pip install -r C:\Users\renat\skills\skill-sentinel\scripts\requirements.txt
```

## Comandos Principais

```bash

## Auditoria Completa De Todas As Skills

python C:\Users\renat\skills\skill-sentinel\scripts\run_audit.py

## Auditar Apenas Uma Skill

python C:\Users\renat\skills\skill-sentinel\scripts\run_audit.py --skill instagram

## Apenas Recomendacoes De Novas Skills

python C:\Users\renat\skills\skill-sentinel\scripts\run_audit.py --recommend

## Comparar Com Auditoria Anterior (Tendencias)

python C:\Users\renat\skills\skill-sentinel\scripts\run_audit.py --compare

## Output Em Json (Para Processamento)

python C:\Users\renat\skills\skill-sentinel\scripts\run_audit.py --format json

## Ver Historico De Auditorias

python C:\Users\renat\skills\skill-sentinel\scripts\run_audit.py --history

## Descobrir Skills Disponiveis

python C:\Users\renat\skills\skill-sentinel\scripts\scanner.py

## Ver Audit Log Do Sentinel

python C:\Users\renat\skills\skill-sentinel\scripts\governance.py

## Verificar Banco De Dados

python C:\Users\renat\skills\skill-sentinel\scripts\db.py
```

## 1. Qualidade De Codigo (Peso: 20%)

- Complexidade ciclomatica por funcao (limiar: 10)
- Tamanho de funcoes (limiar: 50 linhas)
- Tamanho de arquivos (limiar: 500 linhas)
- Cobertura de docstrings
- Padroes de error handling (bare except, broad except)

## 2. Seguranca (Peso: 20%)

- Secrets hardcoded (tokens, passwords, API keys)
- SQL injection (f-strings em queries)
- URLs HTTP inseguras
- Tokens em logs
- Validacao de input

## 3. Performance (Peso: 15%)

- Retry com backoff para APIs
- Timeouts configurados
- Reuso de conexoes HTTP
- N+1 queries
- Async/concorrencia

## 4. Governanca (Peso: 15%)

- Nivel 0: Nenhuma
- Nivel 1: Action logging
- Nivel 2: Logging + rate limiting
- Nivel 3: Completa (+ confirmacoes 2-step)
- Nivel 4: Avancada (+ alertas e trends)

## 5. Documentacao (Peso: 15%)

- SKILL.md com frontmatter (name, description, version)
- Trigger keywords (PT-BR e EN)
- Secoes obrigatorias e recomendadas
- Reference files

## 6. Dependencias (Peso: 15%)

- requirements.txt presente
- Versoes pinadas
- Deps importadas vs listadas
- Deps listadas vs importadas

## 7. Cross-Skill (Analise Global)

- Modulos duplicados entre skills
- Padroes de Database compartilhados
- Governanca inconsistente
- Oportunidades de extracao

## Otimizacao De Custos

Alem das 7 dimensoes, o sentinel analisa impacto de custo:
- Tamanho do SKILL.md (tokens consumidos por ativacao)
- References grandes sem indice
- Output verboso dos scripts
- Ausencia de output JSON estruturado

## Gap Analysis E Recomendacoes

O recommender identifica capacidades ausentes no ecossistema comparando
com uma taxonomia de 20 categorias e gera templates de SKILL.md prontos
para novas skills sugeridas.

## Governanca Do Sentinel

O proprio sentinel pratica o que prega:
- Todas as auditorias sao registradas em action_log
- Historico de scores em score_history para tendencias
- Relatorios salvos em data/reports/

## Workflows Comuns

**1. Primeira auditoria do ecossistema:**
```
python run_audit.py
```
Gera relatorio completo com scores, findings e recomendacoes.

**2. Monitorar evolucao ao longo do tempo:**
```
python run_audit.py --compare
```
Mostra delta de scores entre auditorias.

**3. Validar uma skill antes de deploy:**
```
python run_audit.py --skill nome-da-skill
```
Auditoria focada com findings especificos.

**4. Identificar proxima skill a criar:**
```
python run_audit.py --recommend
```
Gap analysis com templates prontos.

## Formato Do Relatorio

O relatorio gerado em `data/reports/` contem:
1. Resumo executivo (tabela de scores)
2. Tendencias (se houver auditoria anterior)
3. Findings por severidade (critico/alto/medio/baixo/info)
4. Analise por skill (detalhada)
5. Recomendacoes de novas skills
6. Plano de acao priorizado

## Referencias

Para detalhes tecnicos, consultar:
- `references/analysis_criteria.md` - Rubricas de scoring
- `references/security_patterns.md` - Padroes de seguranca
- `references/skill_template.md` - Template para novas skills
- `references/schema.md` - Schema do banco de dados

## Best Practices

- Provide clear, specific context about your project and requirements
- Review all suggestions before applying them to production code
- Combine with other complementary skills for comprehensive analysis

## Common Pitfalls

- Using this skill for tasks outside its domain expertise
- Applying recommendations without understanding your specific context
- Not providing enough project context for accurate analysis

## Related Skills

- `skill-installer` - Complementary skill for enhanced analysis

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: skill-suggester
version: 1.0.0
description: "Scan prompt history for recurring patterns and unmet needs, then propose new skills or command templates"
risk: safe
source: community
source_type: community
source_repo: mskadu/opencode-agent-skills
license: MIT
license_source: "https://github.com/mskadu/opencode-agent-skills/blob/main/LICENSE"
date_added: "2026-06-05"
---

## What I do

Reads your opencode prompt history, finds repeated multi-step workflows, and recommends skill-worthy candidates. Saves you from having the same conversation twice.

## When to Use

Use this skill when the user wants to mine opencode prompt history for repeated workflows, recurring unmet needs, or candidates for new reusable skills.

## How to invoke

Run `/skill skill-suggester` to scan the full history. Optionally pass `--since <date>` (e.g. `--since 2026-05-01`) to limit the window.

## Analysis method

1. Locate prompt history files at `~/.local/state/opencode/prompt-history*.jsonl`
2. Parse each entry's message content
3. Score for skill potential by looking for:
   - **Repetition**: similar phrasing or topic used 3+ times ("scan all repos", "check my inbox")
   - **Multi-step sequences**: a request that required 5+ tool calls to complete
   - **Unsupported requests**: things you asked for that don't have a dedicated skill yet
   - **Workaround patterns**: instructions you give every time instead of a one-shot command
4. For each candidate, note:
   - How many times the pattern appeared
   - How many tool calls it consumed
   - The estimated time savings if it were a skill

## Output format

```
## Skill Candidates (last N entries)

### 1. "<candidate name>" (PRIORITY)
- **Pattern**: <what you keep asking for>
- **Frequency**: X times in history
- **Avg complexity**: Y tool calls per instance
- **Estimated savings**: ~Z minutes/week
- **Evidence**:
  - "[excerpt from prompt history]"
  - "[another excerpt]"
- **Recommendation**: <create as skill | add as command template | not worth it>

### 2. ...
```

## Key rules

- Only flag patterns that happen more than twice. One-offs are not skills.
- Include direct quotes from your past prompts as evidence.
- Rate each candidate: `high` (clear ROI, use weekly), `medium` (nice to have), `low` (rare but worth noting).
- If nothing qualifies, say so and explain why.
- After presenting candidates, ask if you want to create any of them.

## Limitations

- Prompt history can contain sensitive local context; summarize patterns without exposing unnecessary private excerpts.
- Recommendations are suggestions only and still need human review before creating or publishing a new skill.


---
name: skill-writer
description: Create and improve agent skills following the Agent Skills specification. Use when asked to create, write, or update skills.
risk: critical
source: community
---

# Skill Writer

Use this as the single canonical workflow for skill creation and improvement.
Primary success condition: maximize high-value input coverage before authoring so the resulting skill has minimal blind spots.

Load only the path(s) required for the task:

| Task | Read |
|------|------|
| Set skill class and required dimensions | `references/mode-selection.md` |
| Apply writing constraints for depth vs concision | `references/design-principles.md` |
| Select structure pattern for this skill | `references/skill-patterns.md` |
| Select workflow orchestration pattern for process-heavy skills | `references/workflow-patterns.md` |
| Select output format pattern for deterministic quality | `references/output-patterns.md` |
| Choose workflow path and required outputs | `references/mode-selection.md` |
| Load representative synthesis examples by skill type | `references/examples/*.md` |
| Synthesize external/local sources with depth gates | `references/synthesis-path.md` |
| Author or update SKILL.md and supporting files | `references/authoring-path.md` |
| Optimize skill description and trigger precision | `references/description-optimization.md` |
| Iterate using positive/negative/fix examples | `references/iteration-path.md` |
| Evaluate behavior and compare baseline vs with-skill (opt-in quantitative) | `references/evaluation-path.md` |
| Register and validate skill changes | `references/registration-validation.md` |

## Step 1: Resolve target and path

1. Resolve target skill path and intended operation (`create`, `update`, `synthesize`, `iterate`).
2. Read `references/mode-selection.md` and select the required path(s).
3. Classify the skill (`workflow-process`, `integration-documentation`, `security-review`, `skill-authoring`, `generic`).
4. Ask one direct question if class or depth requirements are ambiguous; otherwise state explicit assumptions.

## Step 2: Run synthesis when needed

Read `references/synthesis-path.md`.

1. Collect and score relevant sources with provenance.
2. Apply trust and safety rules when ingesting external content.
3. Produce source-backed decisions and coverage/gap status.
4. Load one or more profiles from `references/examples/*.md` when the skill is hybrid.
5. Enforce baseline source pack for skill-authoring workflows.
6. Enforce depth gates before moving to authoring.

## Step 3: Run iteration first when improving from outcomes/examples

Read `references/iteration-path.md` first when selected path includes `iteration` (for example operation `iterate`).

1. Capture and anonymize examples with provenance.
2. Re-evaluate skill behavior against working and holdout slices.
3. Propose improvements from positive/negative/fix evidence.
4. Carry concrete behavior deltas into authoring.

Skip this step when selected path does not include `iteration`.

## Step 4: Author or update skill artifacts

Read `references/authoring-path.md`.

1. Write or update `SKILL.md` in imperative voice with trigger-rich description.
2. Create focused reference files and scripts only when justified.
3. Follow `references/skill-patterns.md`, `references/workflow-patterns.md`, and
   `references/output-patterns.md` for structure and output determinism.
4. For authoring/generator skills, include transformed examples in references:
   - happy-path
   - secure/robust variant
   - anti-pattern + corrected version

## Step 5: Optimize description quality

Read `references/description-optimization.md`.

1. Validate should-trigger and should-not-trigger query sets.
2. Reduce false positives and false negatives with targeted description edits.
3. Keep trigger language generic across Codex and Claude.

## Step 6: Evaluate outcomes

Read `references/evaluation-path.md`.

1. Run a lightweight qualitative check by default (recommended).
2. For integration/documentation and skill-authoring skills, include the concise depth rubric from `references/evaluation-path.md`.
3. Run deeper eval playbook and quantitative baseline-vs-with-skill only when requested or risk warrants it.
4. Record outcomes and unresolved risks.

## Step 7: Register and validate

Read `references/registration-validation.md`.

1. Apply repository registration steps.
2. Run quick validation with strict depth gates.
3. Reject shallow outputs that fail depth gates or required artifact checks.

## Output format

Return:

1. `Summary`
2. `Changes Made`
3. `Validation Results`
4. `Open Gaps`

## When to Use
Use this skill when tackling tasks related to its primary domain or functionality as described above.

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: skin-health-analyzer
description: Analyze skin health data, identify skin problem patterns, assess skin health status. Supports correlation analysis with nutrition, chronic diseases, and medication data.
risk: safe
source: community
---

# 皮肤健康分析技能

## 技能概述

本技能提供全面的皮肤健康数据分析功能，包括趋势识别、风险评估、问题诊断和个性化建议生成。特别强调痣的监测和皮肤癌预防。

## 医学免责声明

⚠ **重要提示**：本技能提供的数据分析和建议仅供参考，不构成医学诊断或治疗建议。

- 所有皮肤问题应由专业皮肤科医生诊断和治疗
- 痣的异常变化必须立即就医检查
- 皮肤癌需要专业诊断，不能仅依靠自我评估
- 分析结果不能替代专业皮肤科检查
- 紧急情况应立即就医
- 请遵循皮肤科医生的专业建议

## 核心功能

### 1. 趋势分析

#### 皮肤问题发展趋势
- 识别痤疮、湿疹等问题的发生模式
- 分析问题的季节性和周期性
- 评估问题严重程度的变化
- 预测未来发作风险

**输出内容**：
- 问题发生频率曲线
- 严重程度变化趋势
- 诱发因素分析
- 预防建议

#### 痣的变化监测
- 新增痣的位置和数量追踪
- 已有痣的大小变化监测
- ABCDE特征变化记录
- 高风险痣识别

**输出内容**：
- 痣的分布图
- 变化预警报告
- 需要关注的美容痣列表
- 就医建议

#### 护肤效果评估
- 护肤程序使用频率分析
- 产品效果评估
- 皮肤状态改善情况
- 不良反应监测

**输出内容**：
- 护肤效果评分
- 产品推荐
- 程序优化建议
- 成本效益分析

#### 日晒防护效果分析
- 防晒霜使用情况统计
- 日晒伤发生频率
- 光老化迹象评估
- 防护习惯改进建议

**输出内容**：
- 防护评分趋势
- 风险评估
- 改进建议
- 产品推荐

### 2. 风险评估

#### 皮肤癌风险评估
基于以下因素进行综合评估：
- 皮肤类型（Fitzpatrick分型）
- 日晒暴露史
- 痣的数量和特征
- 日晒伤历史
- 家族史
- 使用日光浴床历史

**风险等级**：
- **低风险**：深色皮肤、少日晒、无痣异常
- **中风险**：浅色皮肤、中度日晒、有痣异常
- **高风险**：浅色皮肤、大量日晒、多个异常痣、家族史

**输出内容**：
- 风险等级（低/中/高）
- 主要风险因素
- 量化风险评分
- 降低风险策略
- 筛查建议

#### 痤疮严重程度评估
基于以下因素进行综合评估：
- 痤疮类型（黑头、白头、炎性丘疹、结节、囊肿）
- 病灶数量和分布
- 炎症程度
- 瘢痕形成风险

**严重程度分级**：
- **轻度**：主要是黑头和白头，少量炎性病灶
- **中度**：较多炎性病灶，可能形成轻微瘢痕
- **重度**：结节和囊肿，高瘢痕风险

**输出内容**：
- 严重程度分级
- 主要诱因分析
- 治疗建议参考
- 护肤建议
- 就医建议

#### 过敏风险识别
基于以下因素进行综合评估：
- 已知过敏原
- 皮肤敏感史
- 产品使用历史
- 季节性过敏模式
- 家族过敏史

**输出内容**：
- 过敏原列表
- 风险评估
- 避免建议
- 替代产品推荐

#### 光老化风险预测
基于以下因素进行综合评估：
- 日晒暴露总量
- 防护习惯
- 皮肤类型
- 年龄
- 生活方式

**输出内容**：
- 光老化风险等级
- 当前光老化迹象
- 预防建议
- 治疗选择参考

### 3. 关联分析

#### 与营养模块的关联
**营养素对皮肤健康的影响**：
- 维生素A：皮肤细胞更新、视力
- 维生素C：胶原蛋白合成、抗氧化
- 维生素E：抗氧化、保护细胞膜
- Omega-3脂肪酸：抗炎作用
- 锌：伤口愈合、油脂控制
- 水：皮肤水合作用

**食物对皮肤问题的影响**：
- 高糖食物：痤疮加重
- 乳制品：部分人群痤疮诱发因素
- 辛辣食物：玫瑰痤疮加重
- 酒精：皮肤脱水、潮红

**营养缺乏的皮肤表现**：
- 维生素A缺乏：皮肤干燥、角化
- 维生素C缺乏：伤口愈合慢、易淤青
- 维生素B缺乏：皮炎、口角炎
- 铁缺乏：苍白、脆弱
- 蛋白质缺乏：皮肤松弛、水肿

**输出内容**：
- 营养状况评估
- 缺乏风险识别
- 饮食调整建议
- 补充剂建议（如需要）

#### 与慢性病模块的关联
**糖尿病与皮肤**：
- 糖尿病皮肤病（糖尿病性皮肤病）
- 伤口愈合延迟
- 真菌感染风险增加
- 黑棘皮病
- 脂质性渐进性坏死

**自身免疫病与皮肤**：
- 狼疮：蝶形红斑、光敏感
- 类风湿关节炎：类风湿结节、血管炎
- 银屑病关节炎：银屑病皮损
- 皮肌炎：Gottron征、向阳性皮疹

**甲状腺疾病与皮肤**：
- 甲亢：皮肤湿润、头发变细、指甲松动
- 甲减：皮肤干燥、毛发粗燥、水肿

**肝脏疾病与皮肤**：
- 黄疸：皮肤和巩膜黄染
- 蜘蛛痣：血管性蜘蛛状病变
- 掌红斑：手掌红斑
- 皮肤瘙痒：胆汁淤积

**输出内容**：
- 皮肤症状与疾病关联分析
- 并发症风险评估
- 综合管理建议
- 专科转诊建议

#### 与用药模块的关联
**药物疹（药物过敏）**：
- 常见致敏药物：抗生素、抗癫痫药、NSAIDs
- 皮疹类型：麻疹样、荨麻疹、固定药疹
- 严重反应：Stevens-Johnson综合征

**光敏性药物**：
- 四环素类抗生素
- 噻嗪类利尿剂
- NSAIDs
- 某些抗精神病药

**药物引起的色素沉着**：
- 米诺环素：蓝色灰色色素沉着
- 胺碘酮：蓝灰色色素沉着
- 某些化疗药物

**药物引起的皮肤干燥**：
- 维A酸类
- 苯二氮卓类
- 抗组胺药（长期使用）

**输出内容**：
- 药物风险识别
- 相互作用分析
- 替代药物建议（需与医生讨论）
- 监测建议

#### 与内分泌模块的关联
**激素变化对皮肤的影响**：
- 青春期：雄激素增加，痤疮
- 妊娠期：色素沉着、妊娠纹、皮肤血管变化
- 更年期：雌激素下降，皮肤干燥、皱纹
- 月经周期：周期性痤疮加重

**多囊卵巢综合征（PCOS）**：
- 痤疮
- 多毛症
- 雄激素性脱发
- 黑棘皮病

**库欣综合征**：
- 月亮脸、水牛背
- 皮肤变薄、紫纹
- 痤疮、多毛

**输出内容**：
- 激素对皮肤的影响分析
- 周期性症状识别
- 管理建议
- 治疗时机建议

### 4. 个性化建议

#### 护肤程序优化
**根据皮肤类型定制**：
- 干性皮肤：加强保湿，避免过度清洁
- 油性皮肤：控油，保持清洁，水油平衡
- 混合性皮肤：分区护理，T区控油，U区保湿
- 中性皮肤：维持现状，基础护理
- 敏感性皮肤：温和产品，避免刺激

**根据主要问题定制**：
- 痤疮：清洁、控油、抗炎、避免致痘成分
- 色斑：防晒、美白成分、抗氧化
- 抗衰老：抗氧化、修复、防晒
- 敏感：舒缓、修复、屏障保护

**输出内容**：
- 早晨护肤程序建议
- 晚间护肤程序建议
- 每周护理建议
- 产品选择指导
- 预算范围建议

#### 生活方式调整
**饮食调整**：
- 低升糖指数饮食（痤疮）
- 抗炎饮食（湿疹、银屑病）
- 抗氧化食物（抗衰老）
- 充足水分摄入

**睡眠管理**：
- 保证7-9小时睡眠
- 规律作息时间
- 睡前护肤程序
- 枕头清洁（痤疮）

**压力管理**：
- 识别压力诱发的皮肤问题
- 学习放松技巧
- 规律运动
- 兴爱好

**环境调整**：
- 室内湿度控制（干燥皮肤）
- 避免过敏原（过敏肌肤）
- 工作环境防护（职业性皮肤问题）

**输出内容**：
- 个性化生活方式建议
- 目标设定
- 进度追踪方法
- 激励机制

#### 预防措施建议
**皮肤癌预防**：
- 每日防晒（SPF 30+）
- 避免日光浴床
- 定期皮肤检查
- 保护儿童免受日晒
- 早期发现异常痣

**痤疮预防**：
- 正确清洁皮肤
- 避免触摸面部
- 清洁手机和眼镜
- 更换枕套频率
- 非致痘性化妆品

**湿疹预防**：
- 保持皮肤保湿
- 避免已知诱因
- 使用温和洗涤剂
- 穿着棉质衣物
- 控制室内温度和湿度

**光老化预防**：
- 全年防晒
- 抗氧化护肤品
- 不吸烟
- 充足睡眠
- 健康饮食

**输出内容**：
- 针对性预防策略
- 优先级排序
- 实施步骤
- 效果评估方法

#### 产品选择建议
**成分知识**：
- 痤疮治疗：水杨酸、过氧化苯甲酰、维A酸
- 美白：维生素C、烟酰胺、熊果苷
- 抗衰老：视黄醇、肽类、透明质酸
- 保湿：透明质酸、甘油、神经酰胺
- 舒缓：芦荟、积雪草、燕麦

**产品选择原则**：
- 根据皮肤类型选择
- 避免已知过敏原
- 成分简单优于复杂
- 无香料配方更安全
- 先试用小包装

**阅读产品标签**：
- 识别致痘成分
- 识别过敏原
- 理解活性成分浓度
- 理解产品功效宣称

**输出内容**：
- 成分教育
- 产品推荐框架（非具体品牌）
- 避免成分列表
- 产品试用建议

### 5. 目标管理

#### 目标设定
- 与用户协商设定现实目标
- 分解为可实现的步骤
- 设定时间节点
- 建立评估标准

**常见目标类型**：
- 改善痤疮状况
- 建立规律护肤习惯
- 增加防晒使用频率
- 减少色斑
- 改善皮肤干燥
- 建立定期自查习惯

#### 进度追踪
- 定期评估目标达成情况
- 提供激励和反馈
- 调整目标（如需要）
- 庆祝里程碑达成
- 记录改进过程

#### 障碍识别
- 识别阻碍目标达成的因素
- 提供克服障碍的策略
- 调整计划以适应实际情况
- 提供持续支持
- 连接资源和支持网络

### 6. 统计分析

#### 综合健康评分
基于以下因素计算：
- 皮肤问题控制情况（30%）
- 护肤习惯（25%）
- 日晒防护（20%）
- 定期检查（15%）
- 目标达成（10%）

**评分范围**：0-100分
- **优秀**：90-100分
- **良好**：75-89分
- **一般**：60-74分
- **较差**：<60分

#### 皮肤健康年龄
- 基于皮肤状态、问题情况、防护习惯计算
- 与实际年龄对比
- 提供改善建议

#### 问题统计
- 问题类型分布
- 问题发生频率
- 问题持续时间
- 解决率统计
- 复发率分析

#### 护肤统计
- 护肤程序执行率
- 产品使用频率
- 护肤花费统计
- 产品更换频率
- 不良反应统计

### 7. 预警系统

#### 痣的变化预警
- 新增痣数量异常增加
- 已有痣快速增大
- ABCDE特征出现异常
- 颜色或形态改变
- 出现症状（瘙痒、出血）

**预警级别**：
- **黄色预警**：需要观察，下次检查时咨询医生
- **橙色预警**：需要尽快就医（1周内）
- **红色预警**：需要立即就医

#### 皮肤问题预警
- 痤疮突然恶化
- 新出现严重皮疹
- 药物反应迹象
- 感染征象（红肿热痛）
- 慢性病皮肤表现

#### 护肤预警
- 产品不良反应
- 护肤程序不当
- 过度护肤征象
- 过期产品使用
- 产品相互作用

#### 检查提醒
- 定期皮肤自查提醒（每月）
- 皮肤科检查提醒（每年）
- 痣监测提醒（每月）
- 防晒补涂提醒

## 使用场景

### 场景1：定期健康评估
**用户请求**：分析最近6个月的皮肤健康状况

**分析流程**：
1. 读取最近6个月的所有皮肤健康记录
2. 分析问题记录、痣监测、护肤记录
3. 评估防护习惯变化
4. 计算健康评分变化
5. 识别改善或恶化的趋势
6. 生成综合评估报告

**输出内容**：
- 健康评分变化趋势
- 主要改善点
- 需要关注的问题
- 下一步行动建议

### 场景2：痣的监测评估
**用户请求**：我发现背部有个痣有些变化，帮我评估一下

**分析流程**：
1. 检索该痣的历史记录
2. 对比ABCDE特征变化
3. 评估风险等级
4. 检查是否有其他异常痣
5. 分析个人风险因素
6. 生成评估报告

**输出内容**：
- ABCDE评估结果
- 变化程度分析
- 风险等级
- 就医建议（强烈建议/建议/观察）
- 监测频率建议

### 场景3：痤疮管理规划
**用户请求**：我想改善痤疮问题，制定一个管理计划

**分析流程**：
1. 评估当前痤疮严重程度
2. 分析主要诱发因素
3. 评估当前护肤和饮食习惯
4. 识别需要改善的领域
5. 设定阶段性目标
6. 制定个性化计划

**输出内容**：
- 当前严重程度评估
- 主要诱因分析
- 护肤程序建议
- 饮食和生活方式建议
- 目标和时间表
- 何时就医建议

### 场景4：防晒改进计划
**用户请求**：我的防晒习惯不好，帮我制定改进计划

**分析流程**：
1. 评估当前防晒习惯
2. 分析日晒暴露模式
3. 评估皮肤类型和风险
4. 识别主要障碍
5. 设定可达成的目标
6. 制定渐进式改进计划

**输出内容**：
- 当前防晒评分
- 风险评估
- 改进目标
- 产品选择建议
- 使用习惯建立策略
- 进度追踪方法

### 场景5：多学科联合分析
**用户请求**：我有糖尿病，这对我的皮肤有什么影响？

**分析流程**：
1. 读取糖尿病管理数据
2. 分析血糖控制情况
3. 评估皮肤并发症风险
4. 识别潜在的糖尿病皮肤问题
5. 分析两者关联性
6. 生成联合管理建议

**输出内容**：
- 糖尿病对皮肤的影响
- 常见糖尿病皮肤问题
- 并发症风险评估
- 联合管理策略
- 监测指标建议
- 何时就医

### 场景6：抗衰老规划
**用户请求**：我想预防皮肤老化，从现在开始应该注意什么？

**分析流程**：
1. 评估当前皮肤状态
2. 分析生活方式和习惯
3. 评估光老化风险
4. 识别可改变的风险因素
5. 制定预防策略
6. 建立监测指标

**输出内容**：
- 当前皮肤年龄评估
- 主要老化风险因素
- 预防策略（防晒、护肤、生活方式）
- 护肤程序建议
- 定期评估建议
- 投资回报分析

## 数据分析方法

### 定量分析
- 统计描述（均值、中位数、标准差）
- 趋势分析（线性回归、移动平均）
- 相关性分析（Pearson/Spearman相关）
- 风险评分计算（多因素加权）
- 时间序列分析

### 定性分析
- 文本描述分析
- 症状模式识别
- 主诉内容分类
- 满意度评估
- 图片分析（如可用）

### ABCDE评估算法
- 不对称性评分（0-2分）
- 边缘规则性评分（0-2分）
- 颜色均匀性评分（0-2分）
- 直径评分（0-2分）
- 变化评分（0-2分）
- 总分≥4分：建议就医

### 可视化输出
- 时间序列图表
- 身体部位分布图
- 痣的位置地图
- 风险评估雷达图
- 进度追踪仪表板
- 对比分析柱状图

## 质量保证

### 数据验证
- 检查数据完整性
- 验证数据一致性
- 识别异常值
- 处理缺失数据
- 交叉验证不同来源数据

### 结果验证
- 医学逻辑检查
- 与临床指南对照
- 专家审查（如有）
- 用户反馈收集
- 定期更新算法

### 持续改进
- 定期更新分析算法
- 引入新的科学证据
- 优化用户体验
- 扩展功能范围
- 提高准确性

## 参考资源

### 临床指南
- 美国皮肤病学会（AAD）指南
- 欧洲皮肤病学会（EADV）指南
- 中华皮肤科分会临床指南
- 皮肤癌基金会（SCF）指南

### 评估工具
- ABCDE法则（黑色素瘤筛查）
- Glasgow七点清单（黑色素瘤评估）
- 痤疮严重程度评分系统
- 湿疹面积和严重程度指数（EASI）
- 皮肤病生活质量指数（DLQI）

### 数据源
- 用户记录数据
- 营养模块数据
- 慢性病模块数据
- 用药模块数据
- 内分泌模块数据
- 环境数据（紫外线指数）

## 局限性

### 系统局限
- 不能替代专业皮肤科检查
- 不能进行皮肤镜检查
- 不能进行病理检查
- 分析结果受数据质量影响
- 不能进行生物活检

### 数据局限
- 依赖用户记录准确性
- 可能存在遗漏记录
- 主观评估存在偏差
- 时间跨度可能不足
- 照片质量影响评估

### 建议局限
- 不能考虑所有个体因素
- 不能预测所有并发症
- 需要结合临床判断
- 不能保证100%准确性
- 产品建议可能存在个体差异

## 未来扩展

### 计划功能
- AI图像识别（痣和皮肤病变分析）
- 语音记录录入
- 智能提醒系统
- 与皮肤科医生系统对接
- 远程皮肤病学支持

### 研究方向
- 机器学习预测模型
- 个性化预防策略
- 基因风险分析
- 皮肤微生物组分析
- 环境因素影响分析

---

**版本**: v1.0.0
**最后更新**: 2025-01-06
**维护者**: WellAlly Tech

## When to Use
Use this skill when tackling tasks related to its primary domain or functionality as described above.

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: skyvern-browser-automation
description: "AI-powered browser automation — navigate sites, fill forms, extract structured data, log in with stored credentials, and build reusable workflows."
category: browser-automation
risk: safe
source: community
source_repo: Skyvern-AI/skyvern
source_type: official
date_added: "2026-04-23"
author: mark1ian
tags: [browser-automation, mcp, web-scraping, form-filling, ai-agents, workflow-automation]
tools: [claude, cursor, gemini, codex]
license: "AGPL-3.0"
license_source: "https://github.com/Skyvern-AI/skyvern/blob/main/LICENSE"
---

# Skyvern Browser Automation -- CLI Judgment Procedure

Skyvern uses AI to navigate and interact with websites. Every command below is a runnable `skyvern <command>` invocation.

## When to Use This Skill

- Use when you need AI-assisted browser automation for navigation, extraction, form filling, login flows, or reusable website workflows.
- Use when deterministic selectors are unavailable and Skyvern's visual/a11y reasoning can identify page controls.
- Use when a one-off browser task should become a repeatable workflow with run history and verification.

## Step 1: Classify Your Task (ALWAYS do this first)

| Classification | Signal | CLI Command | Cost | What Happens |
|---|---|---|---|---|
| Quick check (yes/no) | "is the user logged in?" | `skyvern browser validate` | 1 LLM + screenshots | Lightweight validation (2 steps max), returns boolean. Cheapest AI option. |
| Quick inspection | "what does the page show?" | `skyvern browser extract` | 1 LLM + screenshots | Dedicated extraction LLM + schema validation + caching. |
| Single action (known target) | "click #submit" | `skyvern browser click/type` | 0 LLM | Deterministic Playwright. No AI. Fastest. |
| Single action (unknown target) | "click the submit button" | `skyvern browser act` | 2-3 LLM, no screenshots | No screenshots in reasoning. Economy a11y tree. For visual targets, use hybrid mode (selector + intent). |
| Same-page multi-step | "fill the form and submit" | `skyvern browser act` or primitive chain | 2-3 LLM or 0 LLM | Use `act` when labels are clear. Use click/type/select directly when you know selectors. |
| Throwaway autonomous trial | "try this once", "see if this works" | `skyvern browser run-task` | Higher | One-off autonomous agent for exploration. Do not use for recurring or multi-page production automations. |
| Multi-page or reusable automation | "navigate a multi-page wizard", "set this up", "automate this weekly" | `skyvern workflow create` + `run` | N LLM + screenshots | Build a workflow with one block per step. Each block gets visual reasoning, verification, and reusable run history. |

**MCP note:** if you are using the Skyvern MCP instead of the CLI, prefer `observe + execute` for same-page multi-step UI work. The CLI does not expose that pair directly.

## Step 2: Apply These Decision Rules

1. If the prompt includes a selector, id, XPath, or exact field target, use browser primitives -- not `act`.
2. If you only need a yes/no answer, use `validate` -- not `extract` or `act`.
3. If the work stays on one page and labels are clear, use `act` or a primitive chain.
4. If the user says `try this once`, `see if this works`, or clearly wants a one-off exploratory trial, use `run-task`.
5. If the task spans multiple pages and is meant to be reusable, scheduled, repeatable, or explicitly `set up` as automation, use `workflow create`.
6. Never type passwords. Always use stored credentials with `skyvern browser login`.

## Step 3: Create a Session

Every browser command needs a session. Create one first:

```bash
# Cloud session (default -- works for public URLs)
skyvern browser session create --timeout 30

# Local session (for localhost URLs or self-hosted mode)
skyvern browser session create --local --timeout 30

# Connect to existing browser via CDP
skyvern browser session connect --cdp "ws://localhost:9222"
```

Session state persists between commands. After `session create`, subsequent commands auto-attach.
Override with `--session pbs_...`. Close when done: `skyvern browser session close`.

## Step 4: Execute by Classification

### Quick check (yes/no)

```bash
skyvern browser validate --prompt "Is the user logged in? Look for a dashboard or avatar."
```

Returns true/false. Cheapest AI option -- prefer over extract or act for boolean checks.

### Quick inspection

```bash
skyvern browser extract \
  --prompt "Extract all product names and prices" \
  --schema '{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"price":{"type":"string"}}}}}}'
```

Uses screenshots + dedicated extraction LLM. Better than screenshot+read because Skyvern's LLM interprets the page.

### Single action (known target)

```bash
skyvern browser click --selector "#submit-btn"
skyvern browser type --text "user@co.com" --selector "#email"
skyvern browser select --value "US" --intent "the country dropdown"
```

Deterministic. No AI. Three targeting modes:
1. **Intent**: `--intent "the Submit button"` (AI finds element)
2. **Selector**: `--selector "#submit-btn"` (CSS/XPath, deterministic)
3. **Hybrid**: both (selector narrows, AI confirms)

### Single action (unknown target)

```bash
skyvern browser act --prompt "Click the Sign In button"
skyvern browser act --prompt "Close the cookie banner, then click Sign In"
```

**Warning:** act has NO screenshots in its LLM reasoning. It uses an economy accessibility tree.
Fine for well-labeled elements. For visually complex targets, use MCP observe+click or hybrid mode.

### Same-page multi-step

```bash
skyvern browser act --prompt "Fill the shipping form and click Continue"
```

Use `act` when the fields and buttons are clearly labeled and the flow stays on one page.
If you need tighter control, break the work into `click`, `type`, `select`, `press-key`, and `wait`.

### Throwaway autonomous trial

```bash
skyvern browser run-task \
  --url "https://example.com" \
  --prompt "Check whether the checkout flow works end to end and extract the confirmation number"
```

Use `run-task` to prove feasibility or do one-off exploration. If the task becomes important enough
to rerun, debug, or share, convert it to a workflow.

### Multi-page or reusable automation — build a workflow with one block per step

```bash
skyvern workflow create --definition @checkout-workflow.yaml
skyvern workflow run --id wpid_123 --wait
skyvern workflow status --run-id wr_789
```

Each navigation block runs with visual reasoning + verification. Split complex flows into
multiple blocks (one per page/step). First run uses AI; subsequent runs replay cached scripts.

### Repeated/production

```bash
skyvern workflow create --definition @workflow.yaml
skyvern workflow run --id wpid_123 --params '{"email":"user@co.com"}'
skyvern workflow status --run-id wr_789
```

Split into one block per step. Use **navigation** blocks for actions, **extraction** for data.
First run uses AI; subsequent runs replay a cached script (10-100x faster).
Set `--run-with agent` to force AI mode for debugging.

## Step 5: Verify

Always verify after page-changing actions:

```bash
skyvern browser screenshot                          # visual check
skyvern browser validate --prompt "Was the form submitted successfully?"  # boolean assertion
skyvern browser evaluate --expression "document.title"                    # JS state check
```

## Step 6: Error Recovery

| Problem | Fix |
|---------|-----|
| Action clicked wrong element | Add context to prompt. Use hybrid mode (selector + intent). |
| Extraction returns empty | Wait for content. Relax required fields. Check row count first. |
| Login passes but next step fails | Ensure same session. Add post-login validate check. |
| Element not found | Add wait: `skyvern browser wait --selector "#el" --state visible` |
| Overloaded prompt | Split into smaller goals -- one intent per command. |

## Credentials

NEVER type passwords through `skyvern browser type` or `act`. Always use stored credentials:

```bash
skyvern credentials add --name "my-login" --type password --username "user@co.com"
skyvern credential list                          # find the credential ID
skyvern browser login --url "https://login.example.com" --credential-id cred_123
```

Types: `password`, `credit_card`, `secret`. Also supports bitwarden, 1password, and azure_vault providers.

## Workflow Quick Reference

```bash
skyvern workflow create --definition @workflow.yaml   # create
skyvern workflow run --id wpid_123 --wait             # run and wait
skyvern workflow status --run-id wr_789               # check status
skyvern workflow list --search "invoice"              # find workflows
skyvern block schema --type navigation                # discover block types
skyvern block validate --block-json @block.json       # validate before creating
```

Engine: known path = 1.0 (default). Dynamic planning = 2.0. Split into multiple 1.0 blocks when in doubt.
Status lifecycle: `created -> queued -> running -> completed | failed | canceled | terminated | timed_out`

## Common Patterns

**Login flow:**
```bash
skyvern credential list                          # find credential ID
skyvern browser session create
skyvern browser navigate --url "https://login.example.com"
skyvern browser login --url "https://login.example.com" --credential-id cred_123
skyvern browser validate --prompt "Is the user logged in?"
skyvern browser screenshot
```

**Pagination loop:**
```bash
skyvern browser extract --prompt "Extract all rows"
skyvern browser validate --prompt "Is there a Next button that is not disabled?"
# If true:
skyvern browser act --prompt "Click the Next page button"
# Repeat extraction. Stop when: no next button, duplicate first row, or max page limit.
```

**Debugging:**
```bash
skyvern browser screenshot                       # visual state
skyvern browser evaluate --expression "document.title"
skyvern browser evaluate --expression "document.querySelectorAll('table tr').length"
```

## Limitations

- Do not use Skyvern to bypass site access controls, rate limits, consent gates, or terms that prohibit automation.
- Browser automation can change remote state; confirm user intent before submitting forms, purchasing, deleting, or sending messages.
- Prefer deterministic selectors for stable production flows; AI actions can misread unlabeled or visually ambiguous controls.
- Store credentials only in the supported credential vaults and never type passwords directly through `type` or `act`.

## Agent Mode

All commands accept `--json` for structured output. Set `SKYVERN_NON_INTERACTIVE=1` to prevent prompts.
Use `skyvern capabilities --json` for full command discovery. See [references/agent-mode.md](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/agent-mode.md).

## Deep-Dive References

| Reference | Content |
|-----------|---------|
| [`references/prompt-writing.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/prompt-writing.md) | Prompt templates and anti-patterns |
| [`references/engines.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/engines.md) | When to use tasks vs workflows |
| [`references/schemas.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/schemas.md) | JSON schema patterns for extraction |
| [`references/pagination.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/pagination.md) | Pagination strategy and guardrails |
| [`references/block-types.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/block-types.md) | Workflow block type details with examples |
| [`references/parameters.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/parameters.md) | Parameter design and variable usage |
| [`references/ai-actions.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/ai-actions.md) | AI action patterns and examples |
| [`references/precision-actions.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/precision-actions.md) | Intent-only, selector-only, hybrid modes |
| [`references/credentials.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/credentials.md) | Credential naming, lifecycle, safety |
| [`references/sessions.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/sessions.md) | Session reuse and freshness decisions |
| [`references/common-failures.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/common-failures.md) | Failure pattern catalog with fixes |
| [`references/screenshots.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/screenshots.md) | Screenshot-led debugging workflow |
| [`references/status-lifecycle.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/status-lifecycle.md) | Run status states and guidance |
| [`references/rerun-playbook.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/rerun-playbook.md) | Rerun procedures and comparison |
| [`references/complex-inputs.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/complex-inputs.md) | Date pickers, uploads, dropdowns |
| [`references/tool-map.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/tool-map.md) | Complete tool inventory by outcome |
| [`references/cli-parity.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/cli-parity.md) | CLI/MCP mapping and agent-aware features |
| [`references/quick-start-patterns.md`](https://github.com/Skyvern-AI/skyvern/blob/main/skyvern/cli/skills/skyvern/references/quick-start-patterns.md) | Quick start examples, common patterns, and workflow templates |