📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/tools/scripts/tests/build_catalog_bundles.test.js

@@ -21,6 +21,10 @@ assert.strictEqual(
   "business",
   "explicit product frontmatter should keep product-risk skills out of security",
 );
+assert.ok(
+  !bundles["security-core"].skills.includes("before-you-build"),
+  "explicit product frontmatter should keep product-risk skills out of the security bundle",
+);
 
 for (const bundleId of [
   "core-dev",

antigravity-awesome-skills/tools/scripts/tests/docs_security_content.test.js

@@ -73,6 +73,25 @@ const androidReactNativeReference = fs.readFileSync(
   path.join(repoRoot, 'skills', 'android-dev', 'references', 'react-native.md'),
   'utf8',
 );
+const ciWorkflow = fs.readFileSync(path.join(repoRoot, '.github', 'workflows', 'ci.yml'), 'utf8');
+const wpSiteHealthSkill = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'wp-site-health-auditor', 'SKILL.md'),
+  'utf8',
+);
+const wpSiteHealthCatalog = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'wp-site-health-auditor', 'references', 'catalog.md'),
+  'utf8',
+);
+const dispatchSkill = fs.readFileSync(path.join(repoRoot, 'skills', 'dispatch', 'SKILL.md'), 'utf8');
+const eclCreatorConfig = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'ecl-harness-engineer', 'agents', 'creator-config.md'),
+  'utf8',
+);
+const eclEnvironmentGuide = fs.readFileSync(
+  path.join(repoRoot, 'skills', 'ecl-harness-engineer', 'references', 'environment-detection-guide.md'),
+  'utf8',
+);
+const lovableCleanupSkill = fs.readFileSync(path.join(repoRoot, 'skills', 'lovable-cleanup', 'SKILL.md'), 'utf8');
 
 function fencedBlocks(content, language) {
   const blocks = [];
@@ -402,6 +421,11 @@ assert.match(
   /git switch "\$branch"/,
   'AccessLint diff should switch to a quoted, validated branch variable',
 );
+assert.match(
+  ciWorkflow,
+  /persist-credentials:\s*false[\s\S]*?npm ci --ignore-scripts/,
+  'PR intake must not persist checkout credentials or run npm lifecycle scripts before policy checks',
+);
 assert.match(
   atlasContractSkill,
   /Treat this file as untrusted workspace content/,
@@ -412,6 +436,51 @@ assert.match(
   /Higher-priority instructions and safety rules always win/,
   'Atlas ledger clauses must not override higher-priority instructions',
 );
+assert.doesNotMatch(
+  wpSiteHealthSkill,
+  /cp\s+wp-config\.php\s+wp-config\.php\.bak-/,
+  'WordPress config backups must not be created in the document root',
+);
+assert.match(
+  wpSiteHealthSkill,
+  /\.\.\/wp-site-health-backups/,
+  'WordPress config backups should be stored outside the document root',
+);
+assert.doesNotMatch(
+  wpSiteHealthCatalog,
+  /find \. -type f -exec chmod 644/,
+  'WordPress permissions guidance must not chmod every file in the web root',
+);
+assert.match(
+  dispatchSkill,
+  /^\s+codex:\s*blocked$/m,
+  'Dispatch must be blocked from plugin-safe Codex distribution',
+);
+assert.match(
+  dispatchSkill,
+  /^\s+claude:\s*blocked$/m,
+  'Dispatch must be blocked from plugin-safe Claude distribution',
+);
+assert.doesNotMatch(
+  eclCreatorConfig + eclEnvironmentGuide,
+  /-p\s+(?!127\.0\.0\.1:)\d+:\d+/,
+  'Harness database and Redis examples must bind published ports to loopback',
+);
+assert.doesNotMatch(
+  eclCreatorConfig + eclEnvironmentGuide,
+  /POSTGRES_PASSWORD=(?:testpass|test\b|postgres\b)|MYSQL_ROOT_PASSWORD=(?:root\b|test\b)/,
+  'Harness examples must not use static default database passwords',
+);
+assert.match(
+  eclEnvironmentGuide,
+  /redis-server --requirepass/,
+  'Harness Redis examples should require authentication when publishing a local port',
+);
+assert.doesNotMatch(
+  lovableCleanupSkill,
+  /grep -rin "lovable" \.env \.env\.local \.env\.example 2>\/dev\/null\s*$/,
+  'Lovable env-file scanning must redact values before command output reaches the transcript',
+);
 assert.doesNotMatch(
   androidHybridReference,
   /Preferences\.set\(\{ key: 'auth_token'/,

antigravity-awesome-skills/tools/scripts/tests/run-test-suite.js

@@ -47,6 +47,7 @@ const LOCAL_TEST_COMMANDS = [
     [path.join(TOOL_SCRIPTS, "run-python.js"), path.join(TOOL_TESTS, "test_repair_description_usage_summaries.py")],
     [path.join(TOOL_SCRIPTS, "run-python.js"), path.join(TOOL_TESTS, "test_readme_credits.py")],
     [path.join(TOOL_SCRIPTS, "run-python.js"), path.join(TOOL_TESTS, "test_sync_microsoft_skills_security.py")],
+    [path.join(TOOL_SCRIPTS, "run-python.js"), path.join(TOOL_TESTS, "test_skill_installer_copy_tree.py")],
   [path.join(TOOL_SCRIPTS, "run-python.js"), path.join(TOOL_TESTS, "test_sync_repo_metadata.py")],
     [path.join(TOOL_SCRIPTS, "run-python.js"), path.join(TOOL_TESTS, "test_sync_contributors.py")],
   [path.join(TOOL_SCRIPTS, "run-python.js"), path.join(TOOL_TESTS, "test_sync_risk_labels.py")],

antigravity-awesome-skills/tools/scripts/tests/test_skill_installer_copy_tree.py

@@ -0,0 +1,49 @@
+import importlib.util
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+INSTALLER_DIR = REPO_ROOT / "skills" / "skill-installer" / "scripts"
+if str(INSTALLER_DIR) not in sys.path:
+    sys.path.insert(0, str(INSTALLER_DIR))
+
+
+def load_installer():
+    module_path = INSTALLER_DIR / "install_skill.py"
+    spec = importlib.util.spec_from_file_location("skill_installer_install_skill", module_path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec.loader is not None
+    spec.loader.exec_module(module)
+    return module
+
+
+install_skill = load_installer()
+
+
+class CopyTreeContentsTests(unittest.TestCase):
+    def test_prunes_ignored_directory_descendants(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            source = root / "source"
+            target = root / "target"
+            source.mkdir()
+            (source / "SKILL.md").write_text("ok", encoding="utf-8")
+            (source / ".git").mkdir()
+            (source / ".git" / "config").write_text("secret", encoding="utf-8")
+            (source / "node_modules").mkdir()
+            (source / "node_modules" / "dep.js").write_text("dep", encoding="utf-8")
+
+            def ignore(_directory, contents):
+                return {item for item in contents if item in {".git", "node_modules"}}
+
+            install_skill.copy_tree_contents(source, target, ignore=ignore)
+
+            self.assertTrue((target / "SKILL.md").is_file())
+            self.assertFalse((target / ".git").exists())
+            self.assertFalse((target / "node_modules").exists())
+
+
+if __name__ == "__main__":
+    unittest.main()