📦 deps(thirdparty): update snapshots

2026-07-30 01:23:25 +00:00
parent 0c634043e3
commit a2904b069a
3368 changed files with 12954 additions and 9475 deletions
@@ -30,7 +30,7 @@ AAS MCP does not scan the repository and does not decide which skills are best.
 > **Release boundary:** AAS Core landed after release 14.6.0. Use an exact Core-capable release rather than an unreviewed moving tag.

 ```bash
-npm exec --yes --ignore-scripts --package=agentic-awesome-skills@15.6.0 -- aas mcp configure \
+npm exec --yes --ignore-scripts --package=agentic-awesome-skills@15.7.0 -- aas mcp configure \
  --host codex \
  --scope user \
  --config /absolute/path/to/codex/config.toml \
@@ -1062,4 +1062,4 @@ Found a skill that should be in a bundle? Or want to create a new bundle? [Open

 ---

-_Last updated: June 2026 | Total Skills: 1,993+ | Total Bundles: 58_
+_Last updated: June 2026 | Total Skills: 1,994+ | Total Bundles: 58_
@@ -17,7 +17,7 @@ Configure AAS Core for Claude Code, describe the task and constraints, let Claud
 - It lets Claude search the verified local catalog without loading the full library into context.
 - It preserves Claude's exact selection without using metadata as an eligibility gate.
 - It keeps MCP discovery read-only and CLI changes approval-gated.
- It includes 1,993+ skills instead of a narrow single-domain starter pack.
+- It includes 1,994+ skills instead of a narrow single-domain starter pack.
 - It supports the standard `.claude/skills/` path and the Claude Code plugin marketplace flow.
 - It also ships generated bundle plugins so teams can install focused packs like `Essentials` or `Security Developer` from the marketplace metadata.
 - It includes onboarding docs, bundles, and workflows so new users do not need to guess where to begin.
@@ -31,6 +31,11 @@ Skills are specialized instruction files that teach AI assistants how to handle

 **No.** With AAS Core, ask the agent to inspect the project and choose the exact skills from the complete catalog. On a broad direct install, all skills may be present locally while the host loads only the skills it invokes.

+The direct installer keeps its historical full-catalog default for compatibility,
+but now shows the risk distribution before writing. Use `audit --skills <ids>` to
+read an exact selection and its bundled files without executing them, then use
+the same `--skills` selection with `--dry-run` before installation.
+
 Use [Starter Packs](bundles.md) as human-curated presets when you want a fixed starting point.

 If you want a narrower install surface for **Claude Code** or **Codex**, use the new plugin distributions documented in [plugins.md](plugins.md) instead of the full library install.
@@ -128,8 +133,13 @@ We classify skills so you know what you're running. These values map directly to

 ### Can these skills hack my computer?

-**No.** Skills are text files. However, they _instruct_ the AI to run commands. If a skill says "delete all files", a compliant AI might try to do it.
-_Always check the Risk label and review the code._
+A Markdown file is not a running process, but calling it “just text” is not a
+sufficient security model. A loaded skill can instruct an agent to run commands,
+use credentials, access the network, or modify files. Installation alone is not
+evidence that any of that happened; execution logs and resulting system changes
+are. Review the exact skill and every bundled file before use, keep agent
+permissions narrow, and require confirmation for consequential actions. See
+[Security, trust, and antivirus alerts](security-and-antivirus.md).

 ---

@@ -12,7 +12,7 @@ Install into the Gemini skills path, then ask Gemini to apply one skill at a tim

 - It installs directly into the expected Gemini skills path.
 - It includes both core software engineering skills and deeper agent/LLM-oriented skills.
- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,993+ files.
+- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,994+ files.
 - It is useful whether you want a broad internal skill library or a single repo to test many workflows quickly.

 ## Install Gemini CLI Skills
@@ -48,6 +48,20 @@ npx agentic-awesome-skills
 This clones to `~/.agents/skills` by default. Use `--cursor`, `--claude`, `--gemini`, `--codex`, `--kiro`, or `--agy` to install for a specific tool, or `--path <dir>` for a custom location. Run `npx agentic-awesome-skills --help` for details.
 The installer uses a shallow clone by default so you get the current library without paying for the full git history on first install.

+With no selector, the legacy-compatible default installs the complete catalog
+and prints a risk summary before writing. That includes `unknown`, `critical`,
+and authorized-use-only `offensive` skills. Installed text is not automatically
+executed, but it can influence an agent when loaded, so review an exact set first:
+
+```bash
+npx agentic-awesome-skills audit --skills brainstorming,backend-dev-guidelines
+npx agentic-awesome-skills --skills brainstorming,backend-dev-guidelines --dry-run
+```
+
+You can also ask your agent to read the selected `SKILL.md` and every bundled
+file before installation. The static audit reports risky capabilities; it does
+not prove that a skill is safe. See [Security, trust, and antivirus alerts](security-and-antivirus.md).
+
 If you see a 404 error, use: `npx github:sickn33/agentic-awesome-skills`

 **Option B — git clone:**
@@ -18,7 +18,7 @@ Kiro is AWS's agentic AI IDE that combines:

 Kiro's agentic capabilities are enhanced by skills that provide:

- **Domain expertise** across 1,993+ specialized areas
+- **Domain expertise** across 1,994+ specialized areas
 - **Best practices** from Anthropic, OpenAI, Google, Microsoft, and AWS
 - **Workflow automation** for common development tasks
 - **AWS-specific patterns** for serverless, infrastructure, and cloud architecture
@@ -0,0 +1,63 @@
+# Security, Trust, and Antivirus Alerts
+
+## The trust boundary
+
+A skill is instruction content, not an executable process. Copying a `SKILL.md`
+does not itself run the commands it contains. The security boundary changes when
+an agent loads those instructions and receives permission to use a shell,
+network, credentials, filesystem, browser, MCP server, or other tool.
+
+Treat every community skill and every bundled file as untrusted input until you
+have reviewed the exact installed revision. A risk label describes intended
+capability; it is not a malware verdict or safety certificate. Repository stars,
+contributors, Markdown-only packaging, and a commit pin are not substitutes for
+review.
+
+## Review before installation
+
+Use an exact selection and inspect it without execution:
+
+```bash
+npx agentic-awesome-skills audit --skills <skill-id,skill-id>
+npx agentic-awesome-skills --skills <skill-id,skill-id> --dry-run
+```
+
+The audit recursively reads the selected skill directories and reports command,
+network, credential, filesystem, privileged, destructive, symlink, and binary
+signals. Read the files behind every finding and ask your agent to explain them.
+Static pattern matching can miss dangerous logic and can flag legitimate
+security examples, so a clean report does not prove safety.
+
+For external sources, require a full commit pin or immutable release, download
+to a temporary review directory, inspect package scripts and every bundled file,
+and approve the final copy separately. Do not pipe remote content into a shell or
+clone a moving branch directly into an active agent directory.
+
+## If antivirus flags a skill
+
+Security documentation often contains exploit names, commands, or payload
+fragments that signature scanners recognize. A detection in Markdown can be a
+correct content detection without showing that a Trojan executed. Do not dismiss
+it, but distinguish content from activity:
+
+1. Stop the agent and quarantine or move the flagged skill out of active paths.
+2. Record the exact file, detector name, package version, and file hash.
+3. Review the file and adjacent bundled content without executing anything.
+4. Check agent transcripts, shell history, process logs, downloads, persistence
+   locations, credential access, and unexpected filesystem or network changes.
+5. Run your operating system's trusted security scan. Rotate credentials only
+   when exposure or suspicious activity is plausible; reinstall the system when
+   forensic evidence or incident-response guidance justifies it, not solely
+   because a text signature matched.
+6. Report reproducible findings privately through the process in
+   [`SECURITY.md`](../../SECURITY.md). Include evidence of execution or impact
+   separately from the flagged text.
+
+## Safer operating defaults
+
+- Install only the skills needed for the task when practical.
+- Keep agent permissions least-privileged and avoid administrator access.
+- Require current-conversation approval for destructive, privileged, financial,
+  account-write, credential, publishing, and offensive-security actions.
+- Use disposable environments for offensive or untrusted workflows.
+- Preserve logs and backups so actions can be audited and reversed where possible.
@@ -39,7 +39,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of AAS Core

 When you ran `npx agentic-awesome-skills` or cloned the repository, you:

-✅ **Downloaded 1,993+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
+✅ **Downloaded 1,994+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
 ✅ **Made them available** to your AI assistant
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)

@@ -231,7 +231,7 @@ Let's actually use a skill right now. Follow these steps:

 ## Direct-install Step 5: Pick Skills Manually

-Don't try to use all 1,993+ skills at once. Here's a sensible approach:
+Don't try to use all 1,994+ skills at once. Here's a sensible approach:

 If you want a tool-specific starting point before choosing skills, use:

@@ -362,7 +362,7 @@ Usually no, but if your AI doesn't recognize a skill:

 ### "Can I load all skills into the model at once?"

-No. Even though you have 1,993+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 1,994+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.

 The intended pattern is:

@@ -40,7 +40,7 @@ agentic-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 1,993+ skills live here
+├── 📁 skills/                          ← 1,994+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -53,7 +53,7 @@ agentic-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (1,993+ total)
+│   └── ... (1,994+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -106,7 +106,7 @@ agentic-awesome-skills/

 ```
                    ┌─────────────────────────┐
-                    │  1,993+ SKILLS          │
+                    │  1,994+ SKILLS          │
                    └────────────┬────────────┘
                                 │
        ┌────────────────────────┼────────────────────────┐
@@ -207,7 +207,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (1,993+ total)                │
+│   └── ... (1,994+ total)                │
 └─────────────────────────────────────────┘
 ```