fix: redact operational skill review sources

skills-review/catalog.js

@@ -18,7 +18,7 @@ export const catalog = [
   { id:'angular-accessibility', author:'Leonardo Uno', path:'../submitted-skills/Leonardo%20Uno/skills/angular-accessibility/SKILL.md', title:'Angular accessibility', status:'Needs consolidation', focus:'Build and review Angular UIs against WCAG 2.2 AA.', wins:['The most complete submitted accessibility guidance.','Clear examples for native controls and labels.'], improve:['Use this as the canonical copy and remove the root duplicate.','Move long component examples into a reference so the active instructions stay task-focused.','Add testing commands only when the repository declares axe, Lighthouse, or Angular test support.'], extras:'Add a test matrix for keyboard, screen reader announcement, error association, and contrast evidence.', improved:skill('angular-accessibility','Build and review Angular interfaces for accessible semantics, keyboard use, focus behavior, and clear status feedback. Use when changing Angular templates, forms, dialogs, navigation, or custom controls.',`## Workflow\n1. Inspect the changed interaction and choose native semantic elements first.\n2. Check keyboard operation, focus order, visible focus, labels, errors, and dynamic announcements.\n3. Use Angular CDK or Material primitives when they provide the expected behavior.\n4. Run available accessibility checks and manually test the changed interaction by keyboard.\n\n## Rules\n- ARIA supplements native semantics; it does not replace them.\n- Do not claim WCAG conformance from one review.\n- Read \`references/patterns.md\` only for dialogs, tables, or custom composite controls.\n\n## Output\nReturn changed issues, evidence, and any remaining manual checks.`)},
   { id:'copy-quote-info-to-payload', author:'Lucas Mantovan', path:'../submitted-skills/Lucas%20Mantovan/skills/copy-quote-info-to-payload/SKILL.md', title:'Copy quote info to payload', status:'Very strong', focus:'Map source quote data into a target command without inventing data.', wins:['Excellent source/skeleton distinction and preservation rule.','Uses a linked, on-demand mapping reference.'], improve:['Add a machine-checkable JSON validation step before returning output.','Define behavior for duplicate IDs, unmatched items, and conflicting values in the source.','Provide a fixture-based transform script if this exact mapping is repeatedly performed.'], extras:'Add an eval for missing values and a different skeleton shape; assert returned JSON parses.', improved:skill('copy-quote-info-to-payload','Populate a quote-command skeleton from quote data without fabricating values. Use when a quote JSON and command skeleton are supplied and the user asks to create a populated command.',`## Inputs\nOne source quote JSON and one target command skeleton.\n\n## Workflow\n1. Identify source and target; ask when the roles are ambiguous.\n2. Parse both documents and start from the target structure.\n3. Apply the mappings in \`reference.md\`; preserve unmatched target fields and item order.\n4. Validate that the resulting document is valid JSON.\n5. Return the payload and a short mapping summary.\n\n## Rules\n- Every populated value must come from the source or an explicit user instruction.\n- Never silently choose between duplicate IDs or conflicting values.\n- Do not alter item content unless the user requests it.\n\n## Output\nReturn one valid JSON document, then unresolved placeholders and mapping warnings.`)},
   { id:'generated-code-explanation', author:'Matheus Rocha', path:'../submitted-skills/Matheus%20Rocha/skills/generated-code-explanation/SKILL.md', title:'Generated code explanation', status:'Good writing guide', focus:'Explain changed code faithfully for the intended reader.', wins:['The what/why/verify structure is clear.','Explicitly prohibits invented rationale.'], improve:['The named demo-project module paths make the skill trigger too broadly outside that project; move them to a project reference.','Ask for the diff or paths before explaining an unprovided change.','Avoid requiring “alternatives considered” unless evidence supports them.'], extras:'Add a reviewer and non-technical audience eval to prove the explanation adapts without speculation.', improved:skill('generated-code-explanation','Explain a code change, its supported rationale, trade-offs, and verification for a named audience. Use when a user asks what changed, why it changed, or how to validate it.',`## Inputs\nA diff, files, or a confirmed description of the change; intended audience.\n\n## Workflow\n1. Read the supplied code or diff before making claims.\n2. Explain behavior first, then the evidence-backed reason and trade-offs.\n3. Adapt vocabulary and depth to the audience.\n4. State verification that was run and checks that remain.\n\n## Rules\n- Mark unknown intent as unknown; do not infer motivation.\n- Do not add comments or documentation only to make an explanation easier.\n- Read project-specific conventions from a reference only in that project.\n\n## Output\nUse: What changed, Why this approach, Trade-offs, How to verify.`)},
-  { id:'ndo-repro', author:'Pedro Aranha', path:'../submitted-skills/Pedro%20Aranha/skills/ndo-repro/SKILL.md', title:'NDO reproduce loop', status:'Security action required', focus:'Build, deploy, and verify a microservice against a dev environment.', wins:['Exceptionally concrete workflow, evidence standard, rollback path, and approval gate.','Bundled scripts and focused operational references are appropriate.'], improve:['A hardcoded password is present in a bundled script. Remove it immediately, rotate it, and read credentials only from an approved secret source.','Use package-relative script paths instead of a host-specific `~/.claude` location.','Separate read-only investigation from shared-environment deploy actions in the header and require explicit per-environment approval.'], extras:'Add `scripts/doctor.sh` for dependency and credential-presence checks, plus a safe dry-run deploy eval. Original preview is safety-redacted.', improved:skill('ndo-repro','Reproduce or validate an NDO issue through approved local build, dev-environment deployment, BOM API calls, and live logs. Use only when the user names the service and target environment.',`## Safety boundary\nRead-only diagnosis is allowed after environment selection. Build, push, deploy, rollback, and credential changes require explicit approval for the named environment and action.\n\n## Workflow\n1. Run \`scripts/doctor.sh\` and resolve the environment using the bundled registry.\n2. Build and test locally; confirm the exact image reference.\n3. Before a shared-environment mutation, restate service, environment, image, and rollback plan; wait for approval.\n4. Drive the smallest API flow that tests the acceptance criterion, then collect image, response, and log evidence.\n\n## Rules\n- Read credentials from approved environment variables or a secret manager; never embed or echo them.\n- Use paths relative to this package.\n- Do not infer a pass from a nearby signal.\n\n## Output\nReport approval, deployed image, criterion-by-criterion evidence, and untested criteria.`)},
+  { id:'ndo-repro', author:'Anonymous operational submission', path:'../submitted-skills/Anonymous%20Operational%20Submission/skills/ndo-repro/SKILL.md', title:'NDO reproduce loop', status:'Security action required', focus:'Build, deploy, and verify a microservice against a dev environment.', wins:['Exceptionally concrete workflow, evidence standard, rollback path, and approval gate.','Bundled scripts and focused operational references are appropriate.'], improve:['A hardcoded password is present in a bundled script. Remove it immediately, rotate it, and read credentials only from an approved secret source.','Use package-relative script paths instead of a host-specific `~/.claude` location.','Separate read-only investigation from shared-environment deploy actions in the header and require explicit per-environment approval.'], extras:'Add `scripts/doctor.sh` for dependency and credential-presence checks, plus a safe dry-run deploy eval. Original preview is safety-redacted.', improved:skill('ndo-repro','Reproduce or validate an NDO issue through approved local build, dev-environment deployment, BOM API calls, and live logs. Use only when the user names the service and target environment.',`## Safety boundary\nRead-only diagnosis is allowed after environment selection. Build, push, deploy, rollback, and credential changes require explicit approval for the named environment and action.\n\n## Workflow\n1. Run \`scripts/doctor.sh\` and resolve the environment using the bundled registry.\n2. Build and test locally; confirm the exact image reference.\n3. Before a shared-environment mutation, restate service, environment, image, and rollback plan; wait for approval.\n4. Drive the smallest API flow that tests the acceptance criterion, then collect image, response, and log evidence.\n\n## Rules\n- Read credentials from approved environment variables or a secret manager; never embed or echo them.\n- Use paths relative to this package.\n- Do not infer a pass from a nearby signal.\n\n## Output\nReport approval, deployed image, criterion-by-criterion evidence, and untested criteria.`)},
   { id:'duplicate-code-check', author:'Tatyana Ardyntceva', path:'../submitted-skills/Tatyana%20Ardyntceva/skills/duplicate-code-check/SKILL.md', title:'Duplicate code check', status:'Needs report contract', focus:'Find duplication newly introduced by a branch or merge-request diff.', wins:['Appropriately non-mutating by default.','Targets the diff rather than all code.'], improve:['“Ask before suggesting removal” is unnecessarily restrictive: suggestions are useful; ask before modifying code instead.','Define the diff base/default when branch details are missing.','Use a report with location pairs, similarity evidence, confidence, and a “do not merge” threshold.'], extras:'Add a script for obtaining the merge-base diff and an eval with intentional repeated test fixture code.', improved:skill('duplicate-code-check','Review a branch or merge-request diff for newly introduced, meaningful code duplication. Use when a user asks about repeated logic or copy-paste code in a diff.',`## Inputs\nSource branch or MR and target branch; use the repository default base only after reporting it.\n\n## Workflow\n1. Obtain the merge-base diff and list files examined.\n2. Compare changed blocks with nearby and existing code; distinguish deliberate repetition, generated code, and test fixtures.\n3. Report evidenced candidates with both locations, similarity, maintenance risk, and a proportionate suggestion.\n\n## Rules\n- Do not modify or remove code without explicit approval.\n- Do not label repeated literals alone as duplication without a maintenance consequence.\n- Report scope limits and skipped generated files.\n\n## Output\nReturn a Markdown table: candidate, locations, evidence, confidence, risk, suggested next step.`)},
   { id:'am-i-free', author:'Vinicius Nascimento', path:'../submitted-skills/Vinicius%20Nascimento/skills/am-i-free/SKILL.md', title:'Am I free?', status:'Good companion set', focus:'Calculate working time after lunch handling.', wins:['Exit-code handling makes the agent’s next action deterministic.','Friendly, human output matches the domain.'], improve:['Replace host-specific `$CLAUDE_SKILL_DIR` fallback paths with package-relative paths.','Document the data schema and timezone/DST assumptions in a reference.','Any `--default-lunch` write must ask for consent immediately before it occurs.'], extras:'Add tests for malformed JSON, overnight shifts, and a lunch end before lunch start.', improved:skill('am-i-free','Calculate elapsed work time from the Long Day Factory shift record. Use when the user asks whether they can leave or how much time remains.',`## Workflow\n1. Run \`python3 scripts/am_i_free.py\`.\n2. Interpret its documented exit code. Ask before any option that writes an assumed lunch break.\n3. Give the result, remaining time or release time, and a concise friendly message.\n\n## Rules\n- Treat malformed or missing state as a recovery question, not a calculation.\n- Read \`references/state.md\` for schema and timezone behavior.\n- Do not expose unrelated content from the local state file.\n\n## Output\nReport calculation status, remaining time or freedom, and any assumption made.`)},
   { id:'back-to-work', author:'Vinicius Nascimento', path:'../submitted-skills/Vinicius%20Nascimento/skills/back-to-work/SKILL.md', title:'Back to work', status:'Good companion set', focus:'Record return time after a lunch break.', wins:['Explains the relationship with the calculation skill.','Surfaces missing lunch/start state.'], improve:['Creating or changing a shift file is a mutation; state that the user’s “back to work” message is the authorization.','Use a package-relative script path.','Share state schema and error behavior with the other four companion skills.'], extras:'Add one script test for missing state and a reference shared by the suite.', improved:skill('back-to-work','Record the return time for a Long Day Factory lunch break. Use when the user says they have returned to work.',`## Workflow\n1. Confirm the message is an instruction to record the current return time.\n2. Run \`bash scripts/back.sh\`.\n3. Surface any missing shift or lunch state and explain the next recovery action.\n\n## Rules\n- This command changes local shift state; do not run it for a hypothetical question.\n- Use the shared state schema in \`references/state.md\`.\n\n## Output\nConfirm the recorded timestamp and any state warning with a light, respectful tone.`)},