* improve: enhance legacy-modernizer based on automated review
- Add missing model: sonnet frontmatter field (was required but absent)
- Add explicit ownership/hand-off statement clarifying scope vs
architecture-modernizer, refactoring-specialist, cloud-migration-specialist,
and database-optimizer
- Add concrete "Common legacy stacks & upgrade paths" section (COBOL,
Java EE/WebLogic, .NET Framework, AngularJS, Python 2, PHP 5/7)
- Add "AI-assisted analysis" guidance (dependency mapping, codemods,
auto-generated characterization tests)
- Replace vague filler bullets ("Team trained effectively", "Celebrate wins",
"Business value delivered continuously") with concrete, actionable deliverables
- Diversify description examples: replaced a redundant strangler-fig example
with a distinct mainframe/COBOL + version-upgrade-only scenario
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address greptile review feedback on legacy-modernizer
Align the third description example's context with what it actually
demonstrates (.NET Framework version-upgrade only), and de-duplicate
the implementation-approach bullets that repeated the checklist items
verbatim.
* fix: address cubic review feedback on legacy-modernizer accuracy
Scope the .NET Framework upgrade path (Web Forms/WCF have no direct
Upgrade Assistant port and need separate plans), note 2to3 was removed
in Python 3.13+, and clarify that Grep/Glob only inventories
dependencies rather than producing a validated call graph.
* fix: soften zero-risk claim in legacy-modernizer example commentary
Version-only upgrades can still change runtime/dependency/batch
behavior; describe risk minimization via validation and rollback
instead of guaranteeing zero production risk.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance bettoredge-value-finder based on automated review
- Fix name to kebab-case (bettoredge-value-finder) matching filename
- Add required tools/model frontmatter, scoped to Read + mcp__bettoredge__*
- Add system-prompt persona and "When invoked" workflow
- Add Guardrails section enforcing bankroll limits, no fabricated results,
and legal-age confirmation
- Caveat the bid/ask-midpoint value-detection methodology
- Add credential-handling guidance for live account login env vars
- Bump version to 1.0.1 to match published npm package
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address PR review feedback on bettoredge-value-finder
- Remove unnecessary Read from tools frontmatter (agent only calls
MCP tools, none of which touch the filesystem)
- Fix bootstrap paradox: step 1 no longer unconditionally calls
bettoredge_setup, which only exists once the MCP server is running
- Move credential-handling warning ahead of the first instruction
that has users embed BETTOREDGE_EMAIL/PASSWORD
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: clarify bettoredge_status is read-only in guardrail wording
bettoredge_status only surfaces current bankroll limits; it can't
change them. Point users to the BettorEdge platform for that instead
of implying the agent can modify limits through this tool.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add missing required `model: sonnet` frontmatter field
- Rewrite description with a "Use PROACTIVELY" trigger phrase and three <example> blocks for better delegation matching, dropping the unsupported "research-backed" claim (tools have no WebSearch/WebFetch)
- Fix broken "See Also" references: professional-effective-communication -> professional-communication skill, /compose-email command -> email-composer skill, remove non-existent tech-talks-craft skill and /feedback-composer command, add difficult-workplace-conversations skill for roleplay scenarios
- Add persona-drift resistance guidance to Roleplay Mode so simulated personas stay consistently resistant/motivated across an exchange instead of becoming generically agreeable
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
The ml-research entry from #613 was hand-added to the generated
dashboard/public/plugins.json without registering the repo in the
generator's REPOS list, so #697's regeneration silently dropped it.
- Add krasserm/ml-plugins to REPOS so the listing survives regeneration
- Restore the entry as produced by the generator's own process_repo(),
inserted in stars-descending order
- Generator: prefer plugin.json displayName for the display name
- Generator: for single-plugin repos, fall back to the locally scanned
component counts already collected for plugins_detail
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Fix unauthenticated command injection (RCE) in Studio server
The `--studio` server (cli-tool/src/sandbox-server.js) bound to 0.0.0.0
with wildcard CORS and no authentication, and passed request-body fields
into spawn(..., { shell: true }). Because shell:true makes Node join the
argv array into a single `sh -c` string, the fields were parsed by the
shell, allowing OS command injection (RCE) via POST /api/execute (prompt)
and POST /api/install-agent (agentName), reachable from the LAN or a
malicious web page (wildcard CORS).
- Remove shell:true from all three spawns so arguments stay discrete argv
entries; shell metacharacters can no longer inject commands.
- Validate agentName against ^[A-Za-z0-9._/-]+$ before use.
- Bind the server to 127.0.0.1 only (removes the LAN vector).
- Restrict CORS to the local UI origin and reject cross-origin requests
(removes the drive-by browser vector).
Fixes GHSA-79wm-x847-7cvg.
Co-Authored-By: Claude Opus <noreply@anthropic.com>
* security: Windows-safe spawns + release bump on top of GHSA-79wm-x847-7cvg fix
Builds on @spartan8806's fix (advisory-fix-1). Adds the two pieces that fix
lacked:
- Resolve npx/claude via their .cmd shims on Windows (NPX_CMD/CLAUDE_CMD).
Without shell:true, bare spawn('npx'/'claude') fails with ENOENT on win32,
which would break agent install/local execution. This keeps the security fix
cross-platform.
- Bump version to 1.29.4 (root + cli-tool package.json) and add the 1.29.4
Security entry to CHANGELOG for the patched release.
Refs GHSA-79wm-x847-7cvg.
---------
Co-authored-by: spartan8806 <spartan8806@users.noreply.github.com>
Co-authored-by: Claude Opus <noreply@anthropic.com>
Co-authored-by: Dani <dan.avila7@gmail.com>
* Add mac-storage-cleaner skill (productivity)
* Address cubic-dev-ai review (3x P3): match the App-caches emptiness check to the four scanned dir names; guard unquoted * globs against a literal-* path on empty dirs; surface an unwritable audit log instead of proceeding silently unlogged.
Reviews a PRD/spec/design brief before implementation and surfaces holes by
attacking what the document is silent about — undefined edge cases, missing
states, policy gaps. Rules Approve / Conditional / Reject and turns each hole
into a forwardable question.
Co-authored-by: dhha22 <10957270+dhha22@users.noreply.github.com>
* improve: enhance smart-contract-specialist based on automated review
- Narrow scope to architecture/design-pattern advisory role, resolving overlap with blockchain-developer
- Add model: sonnet and tools: Read, Grep, Glob, WebSearch, WebFetch frontmatter (least-privilege, no Write/Edit/Bash)
- Add "When to Stop and Ask" guardrails section
- Add 2026 EVM/Solidity coverage: EIP-1153 transient storage, EIP-7201 namespaced storage, EIP-7702 (Pectra) EOA delegation, via_ir pipeline
- Add security/verification toolchain advisory section (Slither, Aderyn, Echidna, Medusa, Certora, Halmos, forge snapshot)
- Add anti-hallucination delivery-summary instruction
- Add "Integration with Other Agents" section documenting handoff to blockchain-developer and smart-contract-auditor
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: remove unsourced gas-savings percentage for via_ir pipeline
Addresses cubic review feedback on PR #713 — the "10-30% gas reduction"
figure isn't backed by official Solidity docs, which only describe
via-IR as producing "better gas-optimized code" without a specific
percentage. Replaced with qualitative language consistent with the
file's own anti-hallucination guardrail.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Packages the self-hosted stargazers-chart solution as a reusable skill so any
repo can add a star history chart that never breaks. Includes the generator
script (repo auto-detected from git remote / GITHUB_REPOSITORY) and a weekly
GitHub Actions workflow template.
Also points the README chart link to the skill's page on aitmpl.com.
GitHub now restricts the stargazers endpoint to a repo's own admins/
collaborators, so third-party live-chart services (star-history free tier,
starchart.cc) return 'Requires authentication' for everyone. Generate the
chart in-repo using the Actions GITHUB_TOKEN and commit a static SVG.
- scripts/generate_star_history.py: fetch stargazers, render theme-aware SVG
- .github/workflows/star-history.yml: weekly cron + manual regeneration
- README points to docs/star-history.svg
* Add newsletter worker: weekly community components email via Resend
New Cloudflare Worker (cloudflare-workers/newsletter/) that composes and
sends a weekly email featuring trending components (one Skill, Agent, MCP,
Hook and Setting per send). Selection is weighted-random by recent downloads
and all copy rotates from pools so no two emails read the same. Delivered as
a Resend Broadcast to the segment in RESEND_SEGMENT_ID, with per-recipient
unsubscribe handled by Resend, reply-to routing, and open/click tracking via
track.aitmpl.com. Cron: Sundays 16:00 UTC (slot freed by decommissioning the
claude-docs-monitor worker, documented in CLAUDE.md).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Address review: escape URL in HTML, surface broadcast id, cron dedupe guard
- escapeHtml() on the component URL in the HTML href/text, consistent with
every other dynamic field in the block
- Include the created broadcast id in the error when POST /broadcasts/{id}/send
fails, so an orphaned broadcast can be recovered manually
- Guard the scheduled path against Cloudflare's occasional cron double-fire:
pre-flight check for an existing non-draft "newsletter <today>" broadcast
before sending (fails open; manual /trigger bypasses it so pilots can send
multiple times a day)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Address review: log non-2xx Sentry responses in newsletter sentry.js
reportError and checkIn now check response.ok and console.error rejected
envelopes (invalid DSN, auth failure, rate limiting) so observability
failures leave a signal in worker logs instead of passing silently. The
never-throws guarantee is unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Address review: close cron double-fire race with draft leader election
The read-then-create pre-check left a window where two overlapping cron
invocations could both pass the check and both send. The scheduled path now
runs a stateless leader election on Resend itself: each run creates its
broadcast as a draft, waits a 10s settle so concurrent drafts are visible,
lists today's broadcasts, and only the deterministic winner (smallest draft
id, and only if nobody already sent) calls /send; losers delete their draft
and yield. Chosen over Workers KV because KV has no compare-and-set and
cannot provide an atomic lock; a Durable Object would, but is overkill for
this worker. Manual /trigger sends still bypass dedupe.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Address review: prevent stale drafts from blocking same-day cron retries
Two guards against a transient /send failure leaving an abandoned draft that
would win every later election with nobody to send it:
- On /send failure the run now deletes its own draft before throwing, so a
retry starts clean (if the send actually succeeded despite the error
response, the broadcast is no longer a draft and the DELETE is a no-op).
- The election only yields to drafts created within the 5-minute overlap
window; older drafts belong to runs that died before cleanup and are
ignored as candidates.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Clicking a plugin inside a marketplace (e.g. commit-commands in
claude-plugins-official) now opens a modal listing its actual
commands/agents/skills with names and descriptions, instead of just a
count badge. Also adds a live search box to filter plugins within a
marketplace page.
generate_plugins_json.py now fetches each component file's frontmatter
description (bounded by max_local_scans=50 locally-sourced plugins per
marketplace) and stores it in components_items, consumed by the new
MarketplacePluginsList.tsx island.
- Add required tools and model frontmatter fields (audit-only allowlist: Read, Grep, Glob, Bash, WebSearch, WebFetch)
- Modernize security toolchain with Foundry, Aderyn, Echidna/Medusa, Certora Prover/Halmos
- Reference OWASP Smart Contract Top 10 and add explicit severity classification (Critical/High/Medium/Low/Informational)
- Cover cross-chain bridge exploits and business logic/tokenomics attack categories
- Add Integration with Other Agents section and When to Stop and Ask guardrail
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance shopify-expert based on automated review
- Fix invalid tools frontmatter (was VS Code Copilot Chat tool names, not Claude Code tools)
- Add model/color fields and upgrade description with delegation examples
- Correct REST vs GraphQL Admin API guidance for 2026 (REST legacy since Oct 2024, GraphQL mandatory for new public apps since Apr 2025)
- Replace Remix-specific app guidance with React Router v7 (@shopify/shopify-app-react-router)
- Add checkout.liquid deprecation deadline (Aug 26, 2026)
- Add Polaris Web Components and Hydrogen/headless (Oxygen, Storefront MCP) guidance
- Update Shopify CLI reference for CLI 4.0 flag changes
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: avoid false-positive javascript: XSS flag in shopify-expert
Automated security audit's HTML-injection check does a naive substring
match for "javascript:" and flagged the heading "...in JavaScript:" as
a javascript: protocol XSS pattern. Reword to sidestep the false
positive without changing meaning.
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add model field and rewrite description to state MCP dependencies and trigger phrases
- Add Prerequisites / Required MCP Setup section (Octopus Deploy + GitHub MCP servers, env vars, example config)
- Expand body into a structured workflow with ambiguity handling, missing-build-info fallback, and GitHub error handling
- Add example markdown release-notes output and a Troubleshooting & Limitations section
- Fix "release nots" typo
- Move from api-graphql/ to devops-infrastructure/ (correct category for a deployment/release-management agent)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Daniel Avila