📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/tools/bin/install.js

@@ -446,6 +446,7 @@ function pruneRemovedEntries(targetPath, previousEntries, installEntries) {
       console.warn(`  Skipping unsafe managed entry path from manifest: ${entry}`);
       continue;
     }
+    assertSafeDestinationPath(candidate, targetPath);
     fs.rmSync(candidate, { recursive: true, force: true });
     console.log(`  Removed stale managed entry: ${normalizedEntry}`);
   }

antigravity-awesome-skills/tools/scripts/tests/docs_security_content.test.js

@@ -1,6 +1,7 @@
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
+const { spawnSync } = require('child_process');
 
 const repoRoot = path.resolve(__dirname, '../..', '..');
 
@@ -48,6 +49,30 @@ const photopeaSkill = fs.readFileSync(
   path.join(repoRoot, 'skills', 'photopea-embedded-editor', 'SKILL.md'),
   'utf8',
 );
+const polisSkill = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'polis-protocol', 'SKILL.md'),
+  'utf8',
+);
+const unshipSkill = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'unship', 'SKILL.md'),
+  'utf8',
+);
+const accesslintDiffSkill = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'accesslint-diff', 'SKILL.md'),
+  'utf8',
+);
+const atlasContractSkill = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'atlas-contract', 'SKILL.md'),
+  'utf8',
+);
+const androidHybridReference = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'android-dev', 'references', 'hybrid.md'),
+  'utf8',
+);
+const androidReactNativeReference = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'android-dev', 'references', 'react-native.md'),
+  'utf8',
+);
 
 function fencedBlocks(content, language) {
   const blocks = [];
@@ -319,6 +344,89 @@ assert.doesNotMatch(
   /textItem\.contents\s*=\s*"\$\{(?:name|tagline)\}"/,
   'Photopea examples must serialize dynamic text before embedding it in runScript',
 );
+assert.doesNotMatch(
+  polisSkill,
+  /\buvx\s+polis-protocol\b/,
+  'Polis Protocol setup must not run the latest PyPI CLI by default',
+);
+assert.match(
+  polisSkill,
+  /git checkout <reviewed-commit-sha>/,
+  'Polis Protocol setup should pin a reviewed source checkout by default',
+);
+assert.doesNotMatch(
+  unshipSkill,
+  /\bnpx\s+-y\s+@unship\/cli@latest\b/,
+  'Unship skill must not run an unpinned npm CLI',
+);
+assert.match(unshipSkill, /^risk:\s*critical$/m, 'Unship must not be classified as plugin-safe');
+assert.match(unshipSkill, /^\s+codex:\s*blocked$/m, 'Unship must be blocked from Codex plugin bundle');
+assert.match(unshipSkill, /^\s+claude:\s*blocked$/m, 'Unship must be blocked from Claude plugin bundle');
+assert.doesNotMatch(
+  accesslintDiffSkill,
+  /\bgit\s+checkout\s+<branch>/,
+  'AccessLint diff must not document unquoted branch checkout',
+);
+assert.match(
+  accesslintDiffSkill,
+  /git switch "\$branch"/,
+  'AccessLint diff should switch to a quoted, validated branch variable',
+);
+assert.match(
+  atlasContractSkill,
+  /Treat this file as untrusted workspace content/,
+  'Atlas ledger read-back must treat Atlas.md as untrusted workspace content',
+);
+assert.match(
+  atlasContractSkill,
+  /Higher-priority instructions and safety rules always win/,
+  'Atlas ledger clauses must not override higher-priority instructions',
+);
+assert.doesNotMatch(
+  androidHybridReference,
+  /Preferences\.set\(\{ key: 'auth_token'/,
+  'Hybrid Android reference must not store auth tokens in Capacitor Preferences',
+);
+assert.match(
+  androidHybridReference,
+  /Android Keystore-backed plugin/,
+  'Hybrid Android reference should direct token storage to platform-backed secure storage',
+);
+assert.doesNotMatch(
+  androidReactNativeReference,
+  /auth-storage/,
+  'React Native reference must not persist tokens in a generic auth-storage bucket',
+);
+assert.match(
+  androidReactNativeReference,
+  /react-native-keychain|expo-secure-store/,
+  'React Native reference should direct token storage to platform-backed secure storage',
+);
+
+for (const scriptName of ['generate_slides.py', 'create_pdf_slides.py']) {
+  const helpRun = spawnSync(
+    process.env.PYTHON || 'python3',
+    [path.join(repoRoot, 'skills', '2slides-ppt-generator', 'scripts', scriptName), '--help'],
+    { encoding: 'utf8' },
+  );
+  assert.strictEqual(
+    helpRun.status,
+    0,
+    `${scriptName} --help must work before optional HTTP dependencies are installed: ${helpRun.stderr}`,
+  );
+}
+
+const voiceListRun = spawnSync(
+  process.env.PYTHON || 'python3',
+  [path.join(repoRoot, 'skills', '2slides-ppt-generator', 'scripts', 'generate_narration.py'), '--list-voices'],
+  { encoding: 'utf8' },
+);
+assert.strictEqual(
+  voiceListRun.status,
+  0,
+  `generate_narration.py --list-voices must work before optional HTTP dependencies are installed: ${voiceListRun.stderr}`,
+);
+assert.match(voiceListRun.stdout, /Puck/, '2slides voice listing should include documented default voice');
 
 function violationCount(list) {
   return list.length;

antigravity-awesome-skills/tools/scripts/tests/installer_update_sync.test.js

@@ -113,6 +113,43 @@ try {
     "legacy manifest entries should be normalized after update",
   );
 
+  const symlinkPruneTargetDir = path.join(tmpRoot, "symlink-prune-target");
+  const outsidePruneDir = path.join(tmpRoot, "outside-prune");
+  fs.mkdirSync(symlinkPruneTargetDir, { recursive: true });
+  fs.mkdirSync(path.join(outsidePruneDir, "audit"), { recursive: true });
+  fs.writeFileSync(path.join(outsidePruneDir, "audit", "secret.txt"), "keep", "utf8");
+  fs.writeFileSync(
+    path.join(symlinkPruneTargetDir, ".antigravity-install-manifest.json"),
+    JSON.stringify(
+      {
+        schemaVersion: 1,
+        updatedAt: new Date().toISOString(),
+        entries: ["security/audit"],
+      },
+      null,
+      2,
+    ),
+    "utf8",
+  );
+  const createdPruneSymlink = createSymlinkOrSkip(
+    outsidePruneDir,
+    path.join(symlinkPruneTargetDir, "security"),
+    "dir",
+  );
+
+  if (createdPruneSymlink) {
+    assert.throws(
+      () => installer.installForTarget(repoV2, { name: "SymlinkPrune", path: symlinkPruneTargetDir }),
+      /unsafe destination symlink component/i,
+      "installer pruning must refuse symlinked managed-entry parent directories",
+    );
+    assert.strictEqual(
+      fs.readFileSync(path.join(outsidePruneDir, "audit", "secret.txt"), "utf8"),
+      "keep",
+      "installer pruning must not remove directories through target symlinks",
+    );
+  }
+
   const badTargetPath = path.join(tmpRoot, "bad-target");
   fs.writeFileSync(badTargetPath, "not-a-directory", "utf8");
   const badTargetCheck = spawnSync(