feat: review Gustavo and Marcos submitted skills
This commit is contained in:
Marcos Silva
@@ -5,7 +5,7 @@ const state = { selected: catalog[0], query: '', preview: 'original', file: null
|
||||
const $ = (selector) => document.querySelector(selector);
|
||||
const escape = (value) => value.replace(/[&<>"']/g, (character) => ({ '&':'&', '<':'<', '>':'>', '"':'"', "'":''' })[character]);
|
||||
const redact = (value, entry) => {
|
||||
const safe = value.replace(/(NDO_PASS[^\n=]*[=:]\s*["']?)[^\n"']+/gi, '$1[REDACTED]').replace(/(password["']?\s*[:=]\s*["']?)[^\n"']+/gi, '$1[REDACTED]').replace(/\b[\w.+-]+@[\w.-]+\.[a-z]{2,}\b/gi, '[REDACTED SERVICE ACCOUNT]');
|
||||
const safe = value.replace(/(NDO_PASS[^\n=]*[=:]\s*["']?)[^\n"']+/gi, '$1[REDACTED]').replace(/(password["']?\s*[:=]\s*["']?)[^\n"']+/gi, '$1[REDACTED]').replace(/\b[\w.+-]+@[\w.-]+\.[a-z]{2,}\b/gi, '[REDACTED SERVICE ACCOUNT]').replace(/\/home\/[A-Za-z0-9._-]+(?=\/)/g, '[REDACTED LOCAL USER]').replace(/display\/~[A-Za-z0-9._-]+/gi, 'display/~[REDACTED USER]');
|
||||
return entry.id === 'ndo-repro' ? safe.replace(/https?:\/\/[^\s)>]+/gi, '[REDACTED URL]').replace(/\b(?:[\w-]+\.)*netcracker\.[\w.-]+\b/gi, '[REDACTED HOST]').replace(/\bpedro[._ -]?aranha\b/gi, '[REDACTED CONTRIBUTOR]') : safe;
|
||||
};
|
||||
const download = (name, content) => { const url = URL.createObjectURL(new Blob([content], { type: 'text/markdown' })); const a = document.createElement('a'); a.href = url; a.download = name; a.click(); URL.revokeObjectURL(url); };
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
import { newSubmissions } from './submitted-catalog.js';
|
||||
|
||||
export const sources = {
|
||||
specification: 'https://agentskills.io/specification',
|
||||
practices: 'https://agentskills.io/skill-creation/best-practices',
|
||||
@@ -8,7 +10,7 @@ export const sources = {
|
||||
|
||||
const skill = (name, description, body) => `---\nname: ${name}\ndescription: ${description}\n---\n\n# ${name}\n\n${body.trim()}\n`;
|
||||
|
||||
export const catalog = [
|
||||
const originalCatalog = [
|
||||
{ id:'code-style-review', author:'Andre Oliveira', path:'../submitted-skills/Andre%20Oliveira/skills/code-style-review/SKILL.md', title:'Code style review', status:'Good foundation', focus:'Run the repository’s configured formatter and static checks after a scoped code change.', wins:['Clear timing: after changes and before review.','Includes a final evidence checklist.'], improve:['Do not assume `backend/`, `frontend/`, Maven, ESLint, or Prettier exist; discover scripts from the current repository first.','Separate safe formatting from semantic cleanup and require a diff review before broad auto-fixes.','Add a small command-discovery script only if this project repeats the lookup.'], extras:'Add `references/tooling.md` only for known project commands; add one eval for a repo without either folder.', improved:skill('code-style-review','Run the configured formatter and static checks for a scoped code change. Use after editing code or before a review; discover project commands rather than assuming a stack.',`## Inputs\nChanged files and the repository root.\n\n## Workflow\n1. Inspect package/build configuration for the project’s documented lint, format, and style commands.\n2. Run the narrowest relevant check first. Apply formatting only to the requested files unless the user asks for a wider change.\n3. Review the diff for accidental rewrites, then rerun the same checks.\n\n## Rules\n- Do not invent directories or install tools without approval.\n- Report unavailable checks as not run, not passed.\n- Treat unused-code removal as a separate semantic change.\n\n## Output\nList each command, result, changed files, and any remaining failure.`)},
|
||||
{ id:'sql-injection-audit', author:'Andre Salvo', path:'../submitted-skills/Andre%20Salvo/skills/sql-injection-audit/SKILL.md', title:'SQL injection audit', status:'Fix metadata', focus:'Trace user-controlled data to SQL sinks and verify values are parameterized.', wins:['Strong threat-model coverage, including identifiers and second-order injection.','The report asks for source, sink, and data flow.'], improve:['The frontmatter is invalid because an un-keyed line appears inside it; fix this first so hosts can discover the skill.','Scope the audit to changed code or named paths by default to avoid an unbounded repository scan.','Add language-specific safe/unsafe examples in a reference rather than expanding the main file.'], extras:'Add an eval with a parameterized query and a dynamic `ORDER BY` allowlist.', improved:skill('sql-injection-audit','Audit a changed code path for SQL injection. Use when code constructs or executes SQL, query-builder fragments, or ORM raw queries.',`## Inputs\nChanged files, branch diff, or a named query path.\n\n## Workflow\n1. Find SQL execution sinks and trace request, CLI, external, and stored user input to them.\n2. Confirm values use driver or ORM parameters. For dynamic identifiers, confirm a finite allowlist maps a user choice to a trusted token.\n3. Review raw-query escape hatches and stored procedures.\n4. Report only evidenced findings with source, sink, location, impact, and a safe pattern.\n\n## Rules\n- Escaping is not a substitute for parameterization.\n- Passing tests are supporting evidence, not proof of safety.\n- Do not modify code unless the user asks for a fix.\n\n## Output\nReturn a findings table and the scope reviewed; say explicitly when a path could not be traced.`)},
|
||||
{ id:'confectionary-skill-hub', author:'Diego Moreira', path:'../submitted-skills/Diego%20Moreira/skills/confectionary-skill-hub/SKILL.md', title:'Confectionery skill hub', status:'Split required', focus:'Define recipe and order workflows for a confectionery domain.', wins:['Useful domain vocabulary and input shapes.','Concrete examples make the intent easy to understand.'], improve:['This is a catalog of three capabilities, not one discoverable skill; split recipe creation, recipe search, and order creation into packages.','Add valid frontmatter and state the system of record, validation rules, and mutation approval boundary.','Move JSON schemas to focused references so only the relevant workflow loads.'], extras:'Add `references/recipe-schema.md` and `references/order-schema.md`; test invalid quantities and missing delivery details.', improved:skill('confectionery-orders','Create or prepare a confectionery order from confirmed customer and item details. Use when a user asks to register an order or counter sale; confirm before sending it to an external system.',`## Inputs\nCustomer, pickup or delivery choice, items, quantities, prices, and optional discount.\n\n## Workflow\n1. Validate required fields and positive quantities.\n2. Calculate the proposed total and show a concise order summary.\n3. Ask for confirmation before creating or transmitting an order.\n4. Return the saved identifier or a clearly labeled draft.\n\n## Rules\n- Do not invent recipe availability, prices, addresses, or customer details.\n- Keep payment and personal data out of logs.\n- Read \`references/order-schema.md\` when mapping to the order system.\n\n## Output\nReturn a valid order payload plus validation warnings and confirmation state.`)},
|
||||
@@ -26,3 +28,5 @@ export const catalog = [
|
||||
{ id:'lunch-time', author:'Vinicius Nascimento', path:'../submitted-skills/Vinicius%20Nascimento/skills/lunch-time/SKILL.md', title:'Lunch time', status:'Good companion set', focus:'Record the beginning of a lunch break.', wins:['Narrow purpose and clear relationship to the suite.','Handles missing start state gracefully.'], improve:['Treat “going to lunch” as write authorization but keep queries non-mutating.','Use a package-relative script path.','Prevent overwriting an existing open lunch without confirmation.'], extras:'Share one state schema and add a test for duplicate lunch starts.', improved:skill('lunch-time','Record the start of a Long Day Factory lunch break. Use when the user explicitly says they are starting lunch.',`## Workflow\n1. Confirm the request records a lunch start now.\n2. Check for a started shift and an existing open lunch.\n3. If an open lunch exists, ask before replacing it; otherwise run \`bash scripts/lunch.sh\`.\n\n## Rules\n- This command changes local state; do not run it for a question about lunch time.\n- Use \`references/state.md\` for recovery rules.\n\n## Output\nConfirm the lunch timestamp and any missing or conflicting state.`)},
|
||||
{ id:'backend-code-reviewer', author:'William Lino', path:'../submitted-skills/William%20Lino/skills/backend-code-reviewer/SKILL.md', title:'Backend code reviewer', status:'Restructure required', focus:'Review backend changes for architecture, reliability, performance, and security risks.', wins:['Ambitious and relevant issue categories.','CI reporting intent is useful.'], improve:['Missing frontmatter means it is not a valid, discoverable skill.','The referenced `dsa-reviewer` tool and curl-pipe-shell installation are unverified; never recommend executing them as written.','Split generic principles from language/framework-specific detection and define evidence thresholds to reduce false positives.'], extras:'Create `references/rules.md`, cite the actual scanner or use existing project tools, and add safe test fixtures before any CI integration.', improved:skill('backend-code-reviewer','Review a scoped backend change for evidenced security, reliability, data-access, and API-boundary risks. Use when reviewing a backend diff; do not install tools or modify CI unless the user asks.',`## Inputs\nA branch diff or changed backend paths and the project’s declared tooling.\n\n## Workflow\n1. Identify runtime, framework, and existing checks from the repository.\n2. Review changed data access, async boundaries, error handling, API contracts, secrets, and resource limits.\n3. Report findings only when a concrete path and consequence are visible; label hypotheses separately.\n4. Run existing, approved checks and include their evidence.\n\n## Rules\n- Do not download or pipe remote installers into a shell.\n- Do not claim missing indexes, retries, or architectural violations without repository evidence.\n- Read \`references/rules.md\` for framework-specific checks.\n\n## Output\nReturn severity, location, evidence, impact, recommendation, and checks run.`)}
|
||||
];
|
||||
|
||||
export const catalog = [...originalCatalog, ...newSubmissions];
|
||||
|
||||
@@ -1,4 +1,6 @@
|
||||
export const files = {
|
||||
import { newSubmissionFiles } from './submitted-files.js';
|
||||
|
||||
const originalFiles = {
|
||||
'angular-accessibility-root': [{ name:'SKILL.md', path:'../submitted-skills/Leonardo%20Uno/SKILL.md', kind:'skill' }, { name:'skills/angular-accessibility/SKILL.md', path:'../submitted-skills/Leonardo%20Uno/skills/angular-accessibility/SKILL.md', kind:'skill' }],
|
||||
'copy-quote-info-to-payload': [{ name:'SKILL.md', path:'../submitted-skills/Lucas%20Mantovan/skills/copy-quote-info-to-payload/SKILL.md', kind:'skill' }, { name:'reference.md', path:'../submitted-skills/Lucas%20Mantovan/skills/copy-quote-info-to-payload/reference.md', kind:'reference' }],
|
||||
'ndo-repro': [{ name:'SKILL.md', path:'../submitted-skills/Anonymous%20Operational%20Submission/skills/ndo-repro/SKILL.md', kind:'skill' }, { name:'envs.tsv', path:'../submitted-skills/Anonymous%20Operational%20Submission/skills/ndo-repro/envs.tsv', kind:'data' }, { name:'lib/env.sh', path:'../submitted-skills/Anonymous%20Operational%20Submission/skills/ndo-repro/lib/env.sh', kind:'script' }, { name:'ndo-api.sh', path:'../submitted-skills/Anonymous%20Operational%20Submission/skills/ndo-repro/ndo-api.sh', kind:'script' }, { name:'ndo-ship.sh', path:'../submitted-skills/Anonymous%20Operational%20Submission/skills/ndo-repro/ndo-ship.sh', kind:'script' }, { name:'reference/bom-Dockerfile_local.example', path:'../submitted-skills/Anonymous%20Operational%20Submission/skills/ndo-repro/reference/bom-Dockerfile_local.example', kind:'reference' }, { name:'reference/dockerfile-local.md', path:'../submitted-skills/Anonymous%20Operational%20Submission/skills/ndo-repro/reference/dockerfile-local.md', kind:'reference' }],
|
||||
@@ -7,3 +9,5 @@ export const files = {
|
||||
'long-day-start': [{ name:'SKILL.md', path:'../submitted-skills/Vinicius%20Nascimento/skills/long-day-start/SKILL.md', kind:'skill' }, { name:'start.sh', path:'../submitted-skills/Vinicius%20Nascimento/skills/long-day-start/start.sh', kind:'script' }],
|
||||
'lunch-time': [{ name:'SKILL.md', path:'../submitted-skills/Vinicius%20Nascimento/skills/lunch-time/SKILL.md', kind:'skill' }, { name:'lunch.sh', path:'../submitted-skills/Vinicius%20Nascimento/skills/lunch-time/lunch.sh', kind:'script' }]
|
||||
};
|
||||
|
||||
export const files = { ...originalFiles, ...newSubmissionFiles };
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
const skill = (name, description, body) => `---\nname: ${name}\ndescription: ${description}\n---\n\n# ${name}\n\n${body.trim()}\n`;
|
||||
|
||||
export const newSubmissions = [
|
||||
{ id:'gfiber-logging', author:'Gustavo Ruiz', path:'../submitted-skills/Gustavo%20Ruiz/skills/gfiber-logging/SKILL.md', title:'GFiber logging', status:'Strong policy package', focus:'Choose and audit production log levels while keeping INFO volume bounded.', wins:['Excellent level-selection rules, practical cases, and a volume-audit workflow.','Clear data-minimization and correlation guidance.','Supporting references make the policy easy to apply.'], improve:['Make environment-specific assertions, such as DEBUG availability, configurable facts with evidence from the deployed project.','Package the audit heuristic as a versioned script with fixtures instead of leaving it only in prose.','Add a stable review output contract: location, proposed level, reason, volume risk, and measurement evidence.'], extras:'Add an evaluation fixture for a hot loop, a payload dump, and a correctly bounded per-item result line.', improved:skill('gfiber-logging','Decide and review GFiber service log levels while keeping production INFO output bounded and traceable. Use when adding, changing, or auditing service logs.',`## Inputs\nChanged paths or service root, the request or flow under review, and the project logging configuration.\n\n## Workflow\n1. Read \`references/levels.md\` to classify each event; use \`references/cases.md\` for known service patterns.\n2. Check new lines for correlation, minimized fields, and bounded volume.\n3. Use \`references/audit.md\` for a static audit; measure representative traffic separately when a path is high-volume.\n4. Report each finding with evidence and distinguish measured results from risk estimates.\n\n## Rules\n- Use the approved contextual logger when the project supports one.\n- Never log secrets, PII, or full request/response bodies; cap identifier lists.\n- Treat INFO caps and DEBUG deployment settings as project configuration facts. Report missing evidence rather than assuming them.\n- This skill is read-only. Do not edit code or production configuration.\n\n## Output\nState the scope, each finding (location, level, reason, volume risk, action), audit command/results, and any unmeasured risk.`)},
|
||||
{ id:'confluence-page', author:'Marcos Silva', path:'../submitted-skills/Marcos%20Silva/skills/confluence-page/SKILL.md', title:'Confluence page', status:'Strong publishing workflow', focus:'Prepare and publish reviewed Confluence storage-format pages through an approved connector.', wins:['Detailed storage-format guidance, templates, preflight scripts, and attachment rules.','Safeguards around drafts, title collisions, and server-side diffs are thoughtful.'], improve:['Require explicit user confirmation immediately before every create or update action.','Replace user-specific local paths with a configured draft root or repository-relative paths.','Treat connector availability and approval as runtime checks, not assumptions.'], extras:'Add test fixtures for title collisions, unavailable connectors, unsafe content, and a failed PlantUML check.', improved:skill('confluence-page','Create or update a reviewed Confluence page from a local storage-format draft. Use when the user asks to prepare or publish through an available, approved Confluence connector; require confirmation immediately before publication.',`## Inputs\nDraft file, target space and title, parent or page ID when applicable, and the requested publication intent.\n\n## Workflow\n1. Check that the configured connector is available and approved. If it is not, prepare the draft and report the exact next step.\n2. Create one storage-format draft per page, using a configured draft root or a repository-relative path.\n3. Run the package preflight checks; resolve title collisions and compare updates with the current server body.\n4. Show the destination, operation, and content summary. Request explicit confirmation for this create or update.\n5. Publish only after confirmation, then return the page ID, URL, and version.\n\n## Rules\n- Never include secrets, tokens, PII, or local-machine paths in page content.\n- Do not delete pages or attachments.\n- Keep the local mirror read-only until the user requests a publication.\n\n## Output\nReturn the draft path, validation results, target, confirmation status, and—after publication—the page identifier and URL.`)},
|
||||
{ id:'diagram-plantuml', author:'Marcos Silva', path:'../submitted-skills/Marcos%20Silva/skills/diagram-plantuml/SKILL.md', title:'PlantUML diagram', status:'Useful focused helper', focus:'Produce a valid PlantUML diagram and Confluence storage macro for a reviewed page.', wins:['Focused macro guidance and useful diagram-type and troubleshooting references.','Optional local syntax check is a sensible quality gate.'], improve:['Do not imply that a Confluence macro is installed or renders without checking the target environment.','Allow only approved, bundled includes; do not fetch untrusted includes at render time.','Report syntax validation separately from a confirmed rendered preview.'], extras:'Add fixtures for malformed diagrams, missing macro support, and approved standard-library includes.', improved:skill('diagram-plantuml','Create a PlantUML diagram and a Confluence storage-format macro for a reviewed page. Use when a user needs a diagram embedded in a supported Confluence page.',`## Inputs\nThe relationship to explain, target page context, and any approved diagram conventions.\n\n## Workflow\n1. Choose a diagram type with \`references/diagram-types.md\`.\n2. Build a small local \`.puml\` source with a caption and only approved includes.\n3. Run a local syntax check when the configured renderer is available.\n4. Return the storage macro and state whether syntax and target rendering were independently verified.\n\n## Rules\n- Keep macro markup at the required storage-body level.\n- Never load remote or untrusted \`!include\` sources.\n- Do not claim a rendered result without a target-environment preview.\n\n## Output\nReturn the diagram source, storage macro, validation result, and any target-environment prerequisite.`)},
|
||||
{ id:'page-reviewer', author:'Marcos Silva', path:'../submitted-skills/Marcos%20Silva/skills/page-reviewer/SKILL.md', title:'Page reviewer', status:'Strong non-mutating gate', focus:'Review a Confluence draft before publishing and provide an evidence-backed verdict.', wins:['Clear PASS / REVISE / BLOCK model with anchored findings.','Non-mutating scope and optional PlantUML checks are well defined.'], improve:['Make connector-dependent checks conditional and state the fallback when the connector is unavailable.','Clarify which internal links and hostnames are permitted instead of using a broad suffix exception.','Add deterministic fixtures for secrets, title collisions, and invalid macros.'], extras:'Publish a compact machine-readable finding schema so the dry-run script and human review agree.', improved:skill('page-reviewer','Review a Confluence-ready draft and its posting context before publication. Use when a user wants an evidence-backed PASS, REVISE, or BLOCK verdict; this skill never publishes or edits a page.',`## Inputs\nDraft body, intended space/title/parent, and any available approved connector context.\n\n## Workflow\n1. Run deterministic local checks for content safety, storage structure, links, and diagram markup.\n2. If an approved connector is available, check title and target context; otherwise report that check as unavailable.\n3. Anchor every finding to a line or section and issue PASS, REVISE, or BLOCK.\n\n## Rules\n- Never publish, edit, or treat placeholders as safe secrets.\n- Distinguish allowed internal destinations from unverified hosts using the project policy.\n- A missing required validation is a stated limitation, not a pass.\n\n## Output\nReturn verdict, scope, findings (severity, anchor, evidence, action), checks run, and the next safe step.`)},
|
||||
{ id:'unslop', author:'Marcos Silva', path:'../submitted-skills/Marcos%20Silva/skills/unslop/SKILL.md', title:'Unslop', status:'Thoughtful style review', focus:'Identify generic, overly polished language and suggest precise revisions without changing meaning.', wins:['Useful tell list and a deliberately non-destructive review orientation.','References acknowledge context and audience concerns.'], improve:['Make audience and project style an explicit input rather than a universal house voice.','Treat score thresholds as calibrated defaults supported by evaluation examples, not fixed truth.','Protect quotations, code, structured markup, and technical claims from stylistic rewriting.'], extras:'Add labeled before/after fixtures from several document types and measure reviewer agreement.', improved:skill('unslop','Suggest precise, audience-appropriate revisions for generic or overly polished prose while preserving meaning. Use when a user asks to review a draft’s voice or clarity.',`## Inputs\nDraft text, intended audience, and an applicable project style reference when one exists.\n\n## Workflow\n1. Preserve frontmatter, code, XML/HTML, quotations, and technical claims.\n2. Identify specific tells using \`references/tells.md\`; consult the selected style reference before recommending a change.\n3. Return small, anchored edits and explain the reader benefit.\n\n## Rules\n- Do not call a dialect, disagreement, or concise writing “slop.”\n- Do not rewrite facts, cited wording, or structured content for style.\n- Treat scoring thresholds as review aids, not publication gates, unless the project defines them.\n\n## Output\nReturn the audience assumption, findings, minimal suggested diffs, preserved sections, and any style-policy uncertainty.`)}
|
||||
];
|
||||
@@ -0,0 +1,29 @@
|
||||
const gustavo = '../submitted-skills/Gustavo%20Ruiz/skills/';
|
||||
const marcos = '../submitted-skills/Marcos%20Silva/';
|
||||
|
||||
export const newSubmissionFiles = {
|
||||
'gfiber-logging': [
|
||||
{ name:'SKILL.md', path:`${gustavo}gfiber-logging/SKILL.md`, kind:'skill' },
|
||||
{ name:'confluence-page-source.txt', path:`${gustavo}confluence-page-source.txt`, kind:'reference' },
|
||||
...['anti-patterns.md','audit.md','cases.md','levels.md'].map(name => ({ name:`references/${name}`, path:`${gustavo}gfiber-logging/references/${name}`, kind:'reference' }))
|
||||
],
|
||||
'confluence-page': [
|
||||
{ name:'SKILL.md', path:`${marcos}skills/confluence-page/SKILL.md`, kind:'skill' },
|
||||
...['attachments.md','macros.md','secrets.md','space-keys.md'].map(name => ({ name:`references/${name}`, path:`${marcos}skills/confluence-page/references/${name}`, kind:'reference' })),
|
||||
...['check-mcp-atlassian.sh','dry-run-publish.sh','new-page.sh'].map(name => ({ name:`scripts/${name}`, path:`${marcos}scripts/${name}`, kind:'script' })),
|
||||
...['how-to.md','hub-page.md','postmortem.md','rfc.md'].map(name => ({ name:`templates/${name}`, path:`${marcos}templates/${name}`, kind:'template' })),
|
||||
{ name:'README.md', path:`${marcos}README.md`, kind:'reference' }
|
||||
],
|
||||
'diagram-plantuml': [
|
||||
{ name:'SKILL.md', path:`${marcos}skills/diagram-plantuml/SKILL.md`, kind:'skill' },
|
||||
...['diagram-types.md','troubleshooting.md'].map(name => ({ name:`references/${name}`, path:`${marcos}skills/diagram-plantuml/references/${name}`, kind:'reference' }))
|
||||
],
|
||||
'page-reviewer': [
|
||||
{ name:'SKILL.md', path:`${marcos}skills/page-reviewer/SKILL.md`, kind:'skill' },
|
||||
{ name:'references/checks.md', path:`${marcos}skills/page-reviewer/references/checks.md`, kind:'reference' }
|
||||
],
|
||||
'unslop': [
|
||||
{ name:'SKILL.md', path:`${marcos}skills/unslop/SKILL.md`, kind:'skill' },
|
||||
...['house-style.md','tells.md'].map(name => ({ name:`references/${name}`, path:`${marcos}skills/unslop/references/${name}`, kind:'reference' }))
|
||||
]
|
||||
};
|
||||
Reference in New Issue
Block a user