292c93845e
feat(humanize-writing): add skill plugin, lockstep 3.9.0
...
- Rewrites AI-sounding text to read human; 8 editing passes + review-only mode
- Adapted from jpeggdev/humanize-writing (MIT); npm installer scaffolding dropped
- Frontmatter condensed to 238 chars (sync enforces 250 max for single-skill plugins)
- Lockstep bump 3.8.0 -> 3.9.0: all 145 plugins, both marketplaces, package.json
- CHANGELOG entry for 3.9.0
2026-09-09 17:02:38 +02:00
ad16332a30
feat(zod): fidelity audit vs zod@4.4.3 + best-practices rulebook; lockstep 3.8.0 ( #89 )
...
Skill v2.1.0 — all documented APIs verified by typecheck + 22 runtime
tests against zod@4.4.3 (probe artifacts in .audit/zod-probe):
Fidelity fixes:
- Install block (bun/npm/pnpm/yarn — was 'bun add zod' ×3)
- z.string().uuid() → z.uuid() everywhere (11+ sites)
- v3 .merge() → .extend(other.shape) in all examples
- v3 z.function().args().returns() chain → v4 {input, output} factory
- .deepPartial() documented as removed (does not exist in 4.4.3)
- single-arg z.record → two-arg (required in v4)
- toJSONSchema 'metadata: true' → registry param (boolean was invalid)
- migration guide: format methods are deprecated, not removed;
rollback pin 3.25.76; v4 error-code renames
- v3 error codes (invalid_string/invalid_enum_value/invalid_date) →
v4 (invalid_format/invalid_value/unrecognized_keys); issue.received →
expected/input; superRefine ctx.addIssue → ctx.issues.push
- codec decodeSafe/encodeSafe removed (never existed); real surface is
decode/encode/decodeAsync/encodeAsync
- bundle claim corrected (~5kb core / ~1.9kb mini, was '2kb')
New coverage (both prior skills lacked):
- zod/mini (incl. the .check() pattern — piping bare checks crashes)
- .check() + check factories, z.preprocess, z.custom, z.templateLiteral,
catchall, z.xor, z.file, z.json, z.stringbool, z.exactOptional,
.safeExtend, z.fromJSONSchema, import-path guide, new format
validators (guid/httpUrl/e164/hash/hostname/mac/uuidv4/uuidv7)
New references/best-practices.md: 12-rule Incorrect/Correct/
When-NOT-to-use rulebook with impact ratings (structure ported from
pproenca/dot-skills, examples rewritten against verified v4 APIs).
Verification: common-patterns.ts now typechecks strict against
zod@4.4.3 and passes a runtime smoke suite (codecs compose through
.extend, formatZodError, lazy recursion).
Lockstep bump 3.7.0 → 3.8.0 across all 144 plugins via sync-plugins.sh.
2026-08-20 10:18:21 +02:00
2b93f5ac24
Add tech-debt + unknowns-discovery plugins; bump version to 3.7.0 ( #84 )
...
* Add tech-debt skill; bump version to 3.7.0
- New two-mode routed skill (prevent during change / triage backlog)
- Bundles jnsahaj/zero-tech-debt + anthropics/tech-debt stances
- sync-plugins.sh propagated 3.7.0 to all 143 manifests
* Add unknowns-discovery plugin (Claude port from suedzucker-codex-plugins)
Port the unknowns-discovery skill from the suedzucker-codex-plugins Codex
plugin into the Claude Code plugin format. Claude manifest is source of
truth; Codex manifest and both marketplace entries are derived via the
repo's existing generate-marketplace.sh / sync-plugins.sh tooling.
Adaptations:
- SKILL.md frontmatter description trimmed 341 -> 150 chars (sync-plugins.sh
skips single-skill plugins whose description exceeds 250 chars).
- 3 slash commands get name: unknowns-discovery:<cmd> frontmatter and drop
the Codex $unknowns-discovery token; $ARGUMENTS and allowed-tools kept.
- README rewritten for Claude/Codex install; auto-trigger keywords preserved.
- 7 references, 12 templates, 4 examples, 2 scripts copied verbatim.
- Codex-only files dropped (.codex-plugin/plugin.json regenerated,
agents/openai.yaml x2, assets/*.svg) — no icon support on the Claude side.
Also sync package.json 3.6.3 -> 3.7.0 to match marketplace + plugins
(the bump scripts don't touch package.json; resolves a pre-existing drift).
Plugin count: 143 -> 144. All versions held at 3.7.0.
2026-08-06 23:41:26 +02:00
9e1ca6496b
feat(codex): add Codex CLI native marketplace support for all 142 plugins ( #83 )
...
Add .codex-plugin/plugin.json manifests for every plugin (derived from
.claude-plugin/ manifests) and .agents/plugins/marketplace.json (Codex's
standard marketplace location). Codex CLI users can now install plugins
natively via Added marketplace `claude-skills` from https://github.com/secondsky/claude-skills.git .
Installed marketplace root: /Users/eddie/.codex/.tmp/marketplaces/claude-skills.
New files:
- scripts/generate-codex-manifests.sh — derives Codex manifests from Claude
manifests (Claude remains source of truth)
- schemas/codex-plugin.schema.json + codex-marketplace.schema.json — AJV
validation for generated Codex artifacts
- 142 × .codex-plugin/plugin.json — one per plugin
- .agents/plugins/marketplace.json — Codex marketplace catalog
Changed:
- scripts/sync-plugins.sh — syncs .codex-plugin/ version in lockstep pass
- scripts/generate-marketplace.sh — calls generate-codex-manifests.sh after
regenerating the Claude marketplace
- scripts/validate-json-schemas.sh — validates Codex schemas alongside Claude
- package.json — added validate:codex + generate:codex scripts
- README/CHANGELOG/CLAUDE.md/PROJECT_STRUCTURE.md — Codex CLI now ✅ Native
- Version bump 3.6.2 → 3.6.3 (all 142 plugins + both marketplaces + package.json)
Not carried into Codex: commands/ and agents/ arrays (no Codex equivalent;
use Codex /import for that). mcpServers carried through where present (3 nuxt
plugins).
Fixes stale delegate-my-work/.codex-plugin/plugin.json (was 3.4.0).
2026-08-06 17:30:58 +02:00
acc7a83f64
feat(cloudflare-nextjs): rebuild as the OpenNext Cloudflare adapter skill (v3.6.2)
...
Rebuild the cloudflare-nextjs plugin in place as the comprehensive OpenNext
Cloudflare adapter skill, expanded with all 20 official doc URLs + the live
GitHub issues tracker. Bump repo to v3.6.2 (lockstep).
cloudflare-nextjs plugin:
- SKILL.md: full rewrite (321 lines). Critical requirements table, quick
start (C3 + migrate), four scripts (dev/preview/deploy/upload),
getCloudflareContext() bindings (replaces the old process.env guidance),
three-tier caching matrix, condensed integrations, top 8 errors, live
GitHub open-bugs table (12 issues), refreshed feature matrix, sources
block with all 20 doc URLs.
- plugin.json: broadened description (OpenNext-led), curated 20 keywords.
- References: rewrote/expanded 12 files.
- open-next.config.ts: 3 tiers (SSG / small / large) + skew protection.
- wrangler.jsonc: full small-site + large-site configs, reserved bindings.
- caching.md (NEW): components, tiers, regional cache, purge, PPR caveat.
- bindings-and-services.md (rebuilt from service-integration-patterns.md):
getCloudflareContext, D1/R2/KV/AI/Hyperdrive, Drizzle/Prisma/Stripe.
- dev-deploy-and-env.md (NEW): dual dev workflow, Workers Builds CI, env vars.
- advanced.md (NEW): custom worker, multi-worker, skew protection, assets,
keep_names, workerd packages, image optimization.
- known-issues.md (NEW): DO warnings + 0.6->1.0.0-beta migration.
- error-catalog-extended.md: 13 errors + GitHub issues cross-reference.
- troubleshooting.md, feature-support.md, database-client-example.ts,
package.json: aligned to getCloudflareContext + current versions.
- Scripts: setup-new-project.sh uses --platform=workers; setup-existing
runs npx @opennextjs/cloudflare migrate.
- README: rewritten with expanded keywords + full doc URL list.
nextjs plugin (cross-references, both directions):
- SKILL.md L97/L498 + README.md L50/L195-211/L442 now name the OpenNext
adapter explicitly and flag the proxy.ts caveat (keep middleware.ts on
Cloudflare; issue #1277 ).
Repo-level (lockstep v3.6.2):
- marketplace.json metadata.version + cloudflare-nextjs entry.
- package.json.
- 140 plugin.json files stamped via scripts/sync-plugins.sh.
Compatibility: standard repo convention (.claude-plugin/plugin.json only).
Codex/Cursor/etc. install via 'npx skills add secondsky/claude-skills
--skill cloudflare-nextjs --agent codex'.
Sources: https://opennext.js.org/cloudflare (+ 19 subpages) and
https://github.com/opennextjs/opennextjs-cloudflare/issues
2026-08-05 18:05:25 +02:00
6d7ec06212
chore(release): bump to v3.6.1 — marketplace/skills.sh docs + installer cleanup
...
Lockstep version bump (repo convention): package.json, all 142 plugin.json, and all 142 marketplace.json entries -> 3.6.1.
- README: accurate per-harness marketplace support table (Claude Code + ZCode native; Codex CLI + Cursor adaptation needed; opencode + Gemini CLI no marketplace); new 'Installing with skills.sh' section with verified npx skills examples and a security-scanning caveat.
- Removed dead scripts scripts/install-skill.sh and scripts/install-all.sh (targeted non-existent skills/ dir); updated 30 docs/plugins referencing them to use /plugin install (Claude Code) or npx skills add (cross-harness).
- Fixed skill-count inconsistency (139 -> 142 standardized; categories table updated).
- Fixed generate-marketplace.sh bug: hardcoded metadata.version=3.5.0 in heredoc reset the marketplace version on every regen; now syncs from plugin entries.
- Security-audit findings D-001, D-002, D-016, D-019, D-020 marked resolved (install scripts removed).
2026-08-05 16:51:17 +02:00
8e73f2c312
chore(release): bump to v3.6.0 — dependency audit + stale-instruction modernization
...
Lockstep version bump (repo convention): package.json, all 142 plugin.json,
and all 142 marketplace.json entries 3.5.0 -> 3.6.0. Documents the exhaustive
dependency-version audit and stale-instruction fixes from this branch in
CHANGELOG.md, and updates the README version line.
See CHANGELOG.md [3.6.0] entry for the full breakdown: 67/142 plugins
updated, version alignment across Cloudflare/Bun/Next.js/TanStack/Nuxt/
hono/drizzle/better-auth/Hugo/WP/UI skills, Zod 3->4 and Tailwind v3->v4
instruction fixes, Cloudflare node_compat->nodejs_compat, Next 16
middleware->proxy (with OpenNext caveat), CI hardening, and the broken
gitleaks hook / audit-script repairs.
2026-08-05 00:22:26 +02:00
efee8ac6e9
feat(cybersecurity): add OSS-only unified cybersecurity skill (#3.5.0)
...
Unified OSS-only cybersecurity skill with progressive disclosure. Fills the
repo's offensive-security gap — the 5 existing security plugins are all
defensive; this adds find / analyze / threat-model coverage.
Plugin layout under plugins/cybersecurity/:
- SKILL.md: thin router + dispatcher (241 lines, sub-agent model per decision #5 )
- 15 references/*.md docs, each a dispatchable sub-agent briefing
- .claude-plugin/plugin.json: registered in security category
Fuses 7 community skills ported to fully open-source tooling:
- mukul975: business-logic, XSS (DOM Invader gap acknowledged), host-header,
open-redirect, forced-browsing
- rysweet/amplihack: cybersecurity-analyst 11-step reasoning framework
- Aradotso: security-detections-mcp (Sigma + MITRE ATT&CK, local OSS path
recommended; hosted API documented as optional)
Integrates 20 Aradotso dev-security skills across 5 grouped docs:
- aradotso-code-audit (A1,A3,A4,A5,A6,A7,A8,A10)
- aradotso-agent-safety (F2,G3)
- aradotso-compliance (C1)
- aradotso-web-vuln-testing (D1-D4)
- aradotso-ai-security (E1-E4)
Authorization gate (ORCHESTRATION decision #3 ):
- Track A (always-on): static analysis, SAST, threat modeling, code review,
detection authoring
- Track B (gated): live-target testing requires ack of authorization
disclaimer, which runs in main context before any sub-agent dispatch
- Red-flags list refuses DoS, cred-stuffing, gov/critical-infra, SE
Cross-references (not duplicates) the 5 existing defensive plugins:
- csrf-protection, xss-prevention, vulnerability-scanning,
security-headers-configuration, defense-in-depth-validation
Includes centralized oss-tool-map.md (Burp/Collaborator/Nessus/SonarQube/
Splunk/CrowdStrike/DOM Invader/Hackvertor/XSS Hunter -> OSS alternatives).
Other changes:
- scripts/lib/categorize.sh: add cybersecurity to security category whitelist
- scripts/generate-marketplace.sh: bump hardcoded version to 3.5.0
- Bump marketplace.json + all 142 plugin.json versions to 3.5.0
- Update README.md, MARKETPLACE.md, CHANGELOG.md, package.json
2026-07-18 18:13:42 +02:00
224ca4f57b
chore: remove 14 deprecated plugins (v3.4.0)
...
Removed plugins (170 → 156):
- ai: openai-api, openai-agents, openai-assistants, openai-responses,
google-gemini-api, google-gemini-embeddings, google-gemini-file-search
- mobile: swift-best-practices, swift-settingskit
- database: supabase-postgres-best-practices, neon-vercel-postgres,
vercel-kv, vercel-blob
- cms: sveltia-cms
Changes:
- Removed 14 plugin directories from plugins/
- Regenerated .claude-plugin/marketplace.json (170 → 156 plugins)
- Bumped marketplace version 3.3.0 → 3.4.0 (scripts/generate-marketplace.sh)
- Synced version 3.4.0 to all 156 plugin.json files via sync-plugins.sh
- Updated counts/lists in CLAUDE.md, README.md, MARKETPLACE.md,
PROJECT_STRUCTURE.md, docs/reference/SKILL_CATEGORIZATION.md
- Updated illustrative examples in docs/guides/MARKETPLACE_MANAGEMENT.md
and docs/guides/PLUGIN_DEV_BEST_PRACTICES.md
- Added CHANGELOG.md entry for v3.4.0
Migration: users of openai-* should switch to claude-api or ai-sdk-core.
Users of google-gemini-* should switch to gemini-cli.
2026-06-21 22:37:57 +02:00
120edd6064
chore: standardize plugin configurations and add Socket CI/CD templates to dependency-upgrade skill
2026-05-14 15:06:23 +02:00
8b4c60d78b
chore: bump all plugins and marketplace to v3.3.0
...
- Bump marketplace metadata version 3.0.0 → 3.3.0
- Bump all 170 plugin.json versions 3.2.2 → 3.3.0
- Update generate-marketplace.sh hardcoded version
- Regenerate marketplace.json with updated descriptions
2026-04-29 10:18:05 +02:00
2b535309b8
Dependency audit: update 75+ packages across 28 files
...
- Fix 3 broken version pins (non-existent versions)
- Minor bumps: ~40 updates (openai, hono, wrangler, drizzle, tanstack, etc.)
- Major bumps: React 18->19, Next.js 15->16, Vite 6->7, Zod 3->4,
Wrangler 3->4, OpenAI v5->v6, ESLint 8/9->10
- TypeScript pinned to ^5.9.3 consistently across all 28 files
- AI SDK kept at v5 latest (^5.0.170)
- All 170 plugins bumped to v3.2.2
- Marketplace regenerated
- Root package.json: 3.0.0 -> 3.2.3
- CHANGELOG.md: added v3.2.3 entry
- README.md: updated version
- Full audit report: PACKAGE_VERSION_AUDIT.md
2026-04-08 18:54:41 +02:00
135e2ca4a6
chore(plugins): Sync all plugin manifests and regenerate marketplace
...
Applied sync-plugins.sh to update all plugin.json files with:
- Extracted descriptions from SKILL.md frontmatter
- Generated keywords from skill names, categories, and descriptions
- Applied consistent version (3.0.0)
- Updated category fields using shared categorization logic
Updated 31 standalone plugin manifests:
- aceternity-ui, ai-sdk-core, ai-sdk-ui, api-authentication
- app-store-deployment, auto-animate, base-ui-react, chrome-devtools
- frontend-design, mobile-first-design, firecrawl-scraper
- github-project-automation, graphql-implementation
- health-check-endpoints, hono-routing, idempotency-handling
- inspira-ui, logging-best-practices, motion, nano-banana-prompts
- nextjs, open-source-contributions, react-hook-form-zod
- react-native-app, session-management, shadcn-vue, skill-review
- turborepo, ultracite, websocket-implementation, wordpress-plugin-core
Regenerated marketplace.json:
- 169 plugin entries with updated descriptions
- Correct source paths for all plugins
- Updated categories from shared categorization logic
All changes result from running ./scripts/sync-plugins.sh with the
newly fixed multi-skill plugin support.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2025-12-22 22:35:21 +01:00
9be102693c
feat: Restructure repository to official Claude Code plugin architecture
...
Migrate from 169 individual skills to 58 properly structured plugins organizing all skills.
## Problem
Skills were invisible in Claude's system prompt because they didn't follow the official plugin structure. Claude Code expects:
```
plugin-name/
├── .claude-plugin/plugin.json
└── skills/
└── skill-name/SKILL.md
```
We had:
```
skill-name/
├── .claude-plugin/plugin.json
└── SKILL.md
```
## Solution
- Created 58 plugins (30 grouped + 28 standalone)
- Migrated all 169 skills into correct structure
- Updated marketplace.json to list plugins instead of individual skills
## Changes
- NEW: plugins/ directory with 58 plugin structures
- NEW: Plugin-level manifests for all 58 plugins
- NEW: MIGRATION_SUMMARY.md documenting changes
- NEW: skills.backup/ preserving original structure
- UPDATED: marketplace.json (58 plugins vs 169 skills)
## Plugin Organization
**Vendor/Tech (10)**: cloudflare(23), nuxt(4), tanstack(5), openai(4), google(4), claude(4), vercel(3), woocommerce(4), pinia(2), swift(2)
**Feature/Purpose (20)**: ai-tools(5), chatbot(3), machine-learning(3), recommendations(2), api(13), database(4), auth(5), security(7), testing(6), code-quality(5), mobile(4), seo(2), web-performance(3), content-management(3), mcp(4), architecture(3), design(7), project-management(5), internationalization(1), payments(1)
**Standalone (28)**: react-hook-form-zod, react-native-app, nextjs, zustand-state-management, zod, tailwind-v4-shadcn, shadcn-vue, aceternity-ui, inspira-ui, base-ui-react, ultracite, motion, auto-animate, nano-banana-prompts, logging-best-practices, wordpress-plugin-core, firecrawl-scraper, turborepo, hono-routing, github-project-automation, open-source-contributions, chrome-devtools, skill-review, app-store-deployment, graphql-implementation, websocket-implementation, idempotency-handling, health-check-endpoints
## Benefits
- ✅ Matches official Anthropic plugin structure
- ✅ Skills now discoverable by Claude Code
- ✅ Logical grouping (e.g., all Nuxt skills together)
- ✅ Reduced system prompt usage (58 vs 169 descriptions)
- ✅ Better maintenance (fewer manifests to update)
## Testing
Validated:
- 58 plugin directories created
- 169 skills migrated successfully
- 58 plugin-level manifests generated
- marketplace.json updated correctly
- Backup preserved at skills.backup/
Next: Test plugin installation and verify visibility in Claude's system prompt
## Documentation
See MIGRATION_SUMMARY.md for complete details, rollback plan, and TODO list.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2025-12-22 12:07:20 +01:00
secondsky