📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/tools/bin/install.js

@@ -4,6 +4,7 @@ const { spawnSync } = require("child_process");
 const path = require("path");
 const fs = require("fs");
 const os = require("os");
+const sanitizeFilename = require("sanitize-filename");
 const { getRealPath, isPathInside, resolveSafeRealPath } = require("../lib/symlink-safety");
 const { listSkillIdsRecursive, readSkill } = require("../lib/skill-utils");
 const packageMetadata = require("../../package.json");
@@ -16,7 +17,20 @@ const DEFAULT_RELEASE_REF = packageMetadata.version ? `v${packageMetadata.versio
 function resolveDir(p) {
   if (!p) return null;
   const s = p.replace(/^~($|\/)/, HOME + "$1");
-  return path.resolve(s);
+  const root = path.isAbsolute(s) ? path.parse(path.resolve(s)).root : process.cwd();
+  const sanitizedSegments = path
+    .resolve(s)
+    .slice(path.parse(path.resolve(s)).root.length)
+    .split(path.sep)
+    .filter(Boolean)
+    .map((segment) => {
+      const sanitized = sanitizeFilename(segment);
+      if (sanitized !== segment || !sanitized) {
+        throw new Error(`Unsafe path segment: ${segment}`);
+      }
+      return sanitized;
+    });
+  return path.resolve(root, ...sanitizedSegments);
 }
 
 function parseArgs() {
@@ -318,18 +332,25 @@ function copyRecursiveSync(src, dest, rootDir = src, skipGit = true, destRoot =
     if (!fs.existsSync(dest)) {
       fs.mkdirSync(dest, { recursive: true });
     }
-    fs.readdirSync(resolvedSource).forEach((child) => {
-      if (skipGit && child === ".git") return;
-      copyRecursiveSync(
-        path.join(resolvedSource, child),
-        path.join(dest, child),
-        rootDir,
-        skipGit,
-        destRoot,
-      );
-    });
+    const dir = fs.opendirSync(resolvedSource);
+    try {
+      for (;;) {
+        const child = dir.readSync();
+        if (!child) break;
+        if (skipGit && child.name === ".git") continue;
+        copyRecursiveSync(
+          path.join(resolvedSource, child.name),
+          path.join(dest, child.name),
+          rootDir,
+          skipGit,
+          destRoot,
+        );
+      }
+    } finally {
+      dir.closeSync();
+    }
   } else {
-    fs.copyFileSync(resolvedSource, dest);
+    fs.cpSync(resolvedSource, dest);
   }
 }
 
@@ -429,13 +450,21 @@ function resolveManagedPath(targetPath, entry) {
   return candidate;
 }
 
-function readInstallManifest(targetPath) {
+function resolveInstallManifestPath(targetPath) {
   const manifestPath = path.join(targetPath, INSTALL_MANIFEST_FILE);
+  assertSafeDestinationPath(manifestPath, targetPath);
+  return manifestPath;
+}
+
+function readInstallManifest(targetPath) {
+  const manifestPath = resolveInstallManifestPath(targetPath);
   if (!fs.existsSync(manifestPath)) {
     return [];
   }
+  let fd = null;
   try {
-    const parsed = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+    fd = fs.openSync(manifestPath, "r");
+    const parsed = JSON.parse(fs.readFileSync(fd, "utf8"));
     if (!parsed || !Array.isArray(parsed.entries)) {
       return [];
     }
@@ -443,25 +472,31 @@ function readInstallManifest(targetPath) {
   } catch (error) {
     console.warn(`  Ignoring invalid install manifest at ${manifestPath}`);
     return [];
+  } finally {
+    if (fd !== null) {
+      fs.closeSync(fd);
+    }
   }
 }
 
 function writeInstallManifest(targetPath, installEntries) {
-  const manifestPath = path.join(targetPath, INSTALL_MANIFEST_FILE);
+  const manifestPath = resolveInstallManifestPath(targetPath);
   const normalizedEntries = [...new Set(installEntries.map(normalizeInstallEntry).filter(Boolean))].sort();
-  fs.writeFileSync(
-    manifestPath,
-    JSON.stringify(
-      {
-        schemaVersion: 1,
-        updatedAt: new Date().toISOString(),
-        entries: normalizedEntries,
-      },
-      null,
-      2,
-    ) + "\n",
-    "utf8",
-  );
+  const manifest = JSON.stringify(
+    {
+      schemaVersion: 1,
+      updatedAt: new Date().toISOString(),
+      entries: normalizedEntries,
+    },
+    null,
+    2,
+  ) + "\n";
+  const fd = fs.openSync(manifestPath, "w", 0o600);
+  try {
+    fs.writeFileSync(fd, manifest, "utf8");
+  } finally {
+    fs.closeSync(fd);
+  }
 }
 
 function pruneRemovedEntries(targetPath, previousEntries, installEntries) {
@@ -568,7 +603,8 @@ function installForTarget(tempDir, target, selectors = buildInstallSelectors({})
       console.log(`  Migrating from full-repo install to skills-only layout…`);
       const backupPath = `${target.path}_backup_${Date.now()}`;
       try { 
-        fs.renameSync(target.path, backupPath);
+        fs.cpSync(target.path, backupPath, { recursive: true });
+        fs.rmSync(target.path, { recursive: true, force: true });
         console.log(`  ⚠️  Safety Backup created at: ${backupPath}`);
         fs.mkdirSync(target.path, { recursive: true, mode: targetStats.mode });
       } catch (err) {

antigravity-awesome-skills/tools/scripts/audit_skills.py

@@ -11,6 +11,17 @@ from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a path under an explicit trusted base directory."""
+    base_path = Path(base_dir).expanduser().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 from _project_paths import find_repo_root
 from risk_classifier import suggest_risk
 from validate_skills import configure_utf8_output, has_when_to_use_section, parse_frontmatter
@@ -275,7 +286,7 @@ def audit_skills(skills_dir: str | Path) -> dict[str, object]:
         dirs[:] = [directory for directory in dirs if not directory.startswith(".")]
         if "SKILL.md" not in files:
             continue
-        reports.append(build_skill_report(Path(root), skills_root))
+        reports.append(build_skill_report(safe_user_path(root, skills_root), skills_root))
 
     reports.sort(key=lambda report: str(report["id"]).lower())
 
@@ -410,7 +421,11 @@ def write_markdown_report(report: dict[str, object], destination: str | Path) ->
     else:
         lines.append("| _none_ | _none_ | _none_ | _n/a_ |")
 
-    Path(destination).write_text("\n".join(lines) + "\n", encoding="utf-8")
+    destination_path = Path(destination).expanduser().resolve()
+    safe_user_path(destination_path, destination_path.parent).write_text(
+        "\n".join(lines) + "\n",
+        encoding="utf-8",
+    )
 
 
 def print_summary(report: dict[str, object]) -> None:
@@ -533,7 +548,8 @@ def main() -> int:
     print_summary(report)
 
     if args.json_out:
-        Path(args.json_out).write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")
+        json_out = Path(args.json_out).expanduser().resolve()
+        safe_user_path(json_out, json_out.parent).write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")
         print(f"📝 Wrote JSON audit report to {args.json_out}")
 
     if args.markdown_out:

antigravity-awesome-skills/tools/scripts/generate_skills_report.py

@@ -13,6 +13,17 @@ import sys
 import argparse
 from datetime import datetime
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a path under an explicit trusted base directory."""
+    base_path = Path(base_dir).expanduser().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 import yaml
 from _project_paths import find_repo_root
 from risk_classifier import suggest_risk
@@ -35,8 +46,8 @@ def parse_frontmatter(content):
 
 def generate_skills_report(output_file=None, sort_by='date', project_root=None):
     """Generate a report of all skills with their metadata."""
-    root = str(project_root or get_project_root())
-    skills_dir = os.path.join(root, 'skills')
+    project_root_path = Path(project_root or get_project_root()).resolve()
+    skills_dir = project_root_path / 'skills'
     skills_data = []
     
     for root, dirs, files in os.walk(skills_dir):
@@ -48,7 +59,7 @@ def generate_skills_report(output_file=None, sort_by='date', project_root=None):
             skill_path = os.path.join(root, "SKILL.md")
             
             try:
-                with open(skill_path, 'r', encoding='utf-8') as f:
+                with safe_user_path(skill_path, skills_dir).open('r', encoding='utf-8') as f:
                     content = f.read()
                 
                 metadata = parse_frontmatter(content)
@@ -106,8 +117,9 @@ def generate_skills_report(output_file=None, sort_by='date', project_root=None):
     # Output
     if output_file:
         try:
-            with open(output_file, 'w', encoding='utf-8') as f:
-                json.dump(report, f, indent=2, ensure_ascii=False)
+            output_path = Path(output_file).expanduser().resolve()
+            with safe_user_path(output_path, output_path.parent).open('w', encoding='utf-8') as f:
+                f.write(json.dumps(report, indent=2, ensure_ascii=False))
             print(f"✅ Report saved to: {output_file}")
         except Exception as e:
             print(f"❌ Error saving report: {str(e)}")

antigravity-awesome-skills/tools/scripts/manage_skill_dates.py

@@ -15,6 +15,19 @@ import sys
 import argparse
 from datetime import datetime
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 import yaml
 from _project_paths import find_repo_root
 
@@ -63,7 +76,7 @@ def reconstruct_frontmatter(metadata):
 def update_skill_frontmatter(skill_path, metadata):
     """Update a skill's frontmatter with new metadata."""
     try:
-        with open(skill_path, 'r', encoding='utf-8') as f:
+        with safe_user_path(skill_path).open('r', encoding='utf-8') as f:
             content = f.read()
         
         old_metadata, body_content = parse_frontmatter(content)
@@ -88,7 +101,7 @@ def update_skill_frontmatter(skill_path, metadata):
         
         new_content = new_frontmatter + body
         
-        with open(skill_path, 'w', encoding='utf-8') as f:
+        with safe_user_path(skill_path).open('w', encoding='utf-8') as f:
             f.write(new_content)
         
         return True
@@ -111,7 +124,7 @@ def list_skills():
             skill_path = os.path.join(root, "SKILL.md")
             
             try:
-                with open(skill_path, 'r', encoding='utf-8') as f:
+                with safe_user_path(skill_path).open('r', encoding='utf-8') as f:
                     content = f.read()
                 
                 metadata, _ = parse_frontmatter(content)
@@ -174,7 +187,7 @@ def add_missing_dates(date_str=None):
             skill_path = os.path.join(root, "SKILL.md")
             
             try:
-                with open(skill_path, 'r', encoding='utf-8') as f:
+                with safe_user_path(skill_path).open('r', encoding='utf-8') as f:
                     content = f.read()
                 
                 metadata, _ = parse_frontmatter(content)

antigravity-awesome-skills/tools/scripts/pr_preflight.cjs

@@ -3,6 +3,7 @@
 const fs = require("fs");
 const path = require("path");
 const { spawnSync } = require("child_process");
+const sanitizeFilename = require("sanitize-filename");
 
 const { findProjectRoot } = require("../lib/project-root");
 const {
@@ -54,6 +55,23 @@ function parseArgs(argv) {
   return args;
 }
 
+function safeUserPath(pathValue, baseDir = process.cwd()) {
+  const root = path.resolve(baseDir);
+  const segments = String(pathValue || "").split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+  const target = path.resolve(root, ...segments);
+  const rel = path.relative(root, target);
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
+    throw new Error(`Path escapes allowed directory: ${pathValue}`);
+  }
+  return target;
+}
+
 function runGit(args, options = {}) {
   const result = spawnSync("git", args, {
     cwd: options.cwd,
@@ -122,7 +140,7 @@ function loadPullRequestBody(eventPath) {
     return null;
   }
 
-  const rawEvent = fs.readFileSync(path.resolve(eventPath), "utf8");
+  const rawEvent = fs.readFileSync(safeUserPath(eventPath), "utf8");
   const event = JSON.parse(rawEvent);
   return event.pull_request?.body || "";
 }

antigravity-awesome-skills/tools/scripts/sync_repo_metadata.py

@@ -37,7 +37,7 @@ RECOMMENDED_TOPICS = [
     "mcp",
 ]
 README_TAGLINE_RE = re.compile(
-    r"^> \*\*Installable GitHub library of \d[\d,]*\+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and other AI coding assistants\.\*\*$",
+    r"^> \*\*Installable GitHub library of \d[\d,]*\+ agentic skills for Claude Code, Cursor, Codex CLI, (?:Autohand Code, )?Gemini CLI, Antigravity, and other AI coding assistants\.\*\*$",
     re.MULTILINE,
 )
 README_RELEASE_RE = re.compile(r"^\*\*Current release: V[\d.]+\.\*\* .*?$", re.MULTILINE)
@@ -68,7 +68,7 @@ BUNDLES_FOOTER_RE = re.compile(
 def build_about_description(metadata: dict) -> str:
     return (
         f"Installable GitHub library of {metadata['total_skills_label']} agentic skills for "
-        "Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and more. "
+        "Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, and more. "
         "Includes specialized plugins, installer CLI, bundles, workflows, and official/community skill collections."
     )
 
@@ -138,7 +138,7 @@ def sync_readme_copy(content: str, metadata: dict) -> str:
             README_TAGLINE_RE,
             (
                 f"> **Installable GitHub library of {metadata['total_skills_label']} agentic skills "
-                "for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and other AI coding assistants.**"
+                "for Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, and other AI coding assistants.**"
             ),
         ),
         (
@@ -162,7 +162,7 @@ def sync_readme_copy(content: str, metadata: dict) -> str:
                 f"**Antigravity Awesome Skills** (Release {metadata['version']}) is a large, installable "
                 f"skill library for AI coding assistants. It packages {metadata['total_skills_label']} reusable "
                 "`SKILL.md` playbooks, specialized plugins, bundles, workflows, generated catalogs, and a CLI "
-                "installer so Claude Code, Codex CLI, Cursor, Gemini CLI, Antigravity, and similar tools can "
+                "installer so Claude Code, Codex CLI, Autohand Code, Cursor, Gemini CLI, Antigravity, and similar tools can "
                 "reuse proven operating instructions instead of one-off prompts."
             ),
         ),

antigravity-awesome-skills/tools/scripts/tests/test_audit_consistency.py

@@ -68,9 +68,9 @@ class AuditConsistencyTests(unittest.TestCase):
         (root / "apps" / "web-app" / "public" / "skills.json").write_text(manifest, encoding="utf-8")
         (root / "README.md").write_text(
             f"""<!-- registry-sync: version=8.4.0; skills={total_skills}; stars=26132; updated_at=2026-03-21T00:00:00+00:00 -->
-# 🌌 Antigravity Awesome Skills: {count_label} Agentic Skills for Claude Code, Gemini CLI, Cursor, Copilot & More
+# 🌌 Antigravity Awesome Skills: {count_label} Agentic Skills for Claude Code, Gemini CLI, Cursor, Autohand Code, Copilot & More
 
-> **Installable GitHub library of {count_label} agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and other AI coding assistants.**
+> **Installable GitHub library of {count_label} agentic skills for Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, and other AI coding assistants.**
 
 [![GitHub stars](https://img.shields.io/badge/⭐%2026%2C000%2B%20Stars-gold?style=for-the-badge)](https://github.com/sickn33/antigravity-awesome-skills/stargazers)
 
@@ -111,7 +111,7 @@ class AuditConsistencyTests(unittest.TestCase):
             encoding="utf-8",
         )
         (root / "docs" / "maintainers" / "repo-growth-seo.md").write_text(
-            f"> Installable GitHub library of {count_label} agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and other AI coding assistants.\n> Installable GitHub library of {count_label} agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and more. Includes installer CLI, bundles, workflows, and official/community skill collections.\n- use a clean preview image that says `{count_label} Agentic Skills`;\n",
+            f"> Installable GitHub library of {count_label} agentic skills for Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, and other AI coding assistants.\n> Installable GitHub library of {count_label} agentic skills for Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, and more. Includes installer CLI, bundles, workflows, and official/community skill collections.\n- use a clean preview image that says `{count_label} Agentic Skills`;\n",
             encoding="utf-8",
         )
         (root / "docs" / "maintainers" / "skills-update-guide.md").write_text(

antigravity-awesome-skills/tools/scripts/tests/test_sync_repo_metadata.py

@@ -40,9 +40,9 @@ class SyncRepoMetadataTests(unittest.TestCase):
         with tempfile.TemporaryDirectory() as temp_dir:
             root = Path(temp_dir)
             (root / "README.md").write_text(
-                """# 🌌 Antigravity Awesome Skills: 1,304+ Agentic Skills for Claude Code, Gemini CLI, Cursor, Copilot & More
+                """# 🌌 Antigravity Awesome Skills: 1,304+ Agentic Skills for Claude Code, Gemini CLI, Cursor, Autohand Code, Copilot & More
 
-> **Installable GitHub library of 1,273+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and other AI coding assistants.**
+> **Installable GitHub library of 1,273+ agentic skills for Claude Code, Cursor, Codex CLI, Autohand Code, Gemini CLI, Antigravity, and other AI coding assistants.**
 
 **Current release: V8.3.0.** Trusted by 25k+ GitHub stargazers, this repository combines official and community skill collections with bundles, workflows, installation paths, and docs that help you go from first install to daily use quickly.
 
@@ -52,7 +52,7 @@ class SyncRepoMetadataTests(unittest.TestCase):
 
 - [Browse 1,273+ Skills](#browse-1273-skills)
 
-**Antigravity Awesome Skills** (Release 8.3.0) is a large, installable skill library for AI coding assistants. It packages 1,273+ reusable `SKILL.md` playbooks, specialized plugins, bundles, workflows, generated catalogs, and a CLI installer so Claude Code, Codex CLI, Cursor, Gemini CLI, Antigravity, and similar tools can reuse proven operating instructions instead of one-off prompts.
+**Antigravity Awesome Skills** (Release 8.3.0) is a large, installable skill library for AI coding assistants. It packages 1,273+ reusable `SKILL.md` playbooks, specialized plugins, bundles, workflows, generated catalogs, and a CLI installer so Claude Code, Codex CLI, Autohand Code, Cursor, Gemini CLI, Antigravity, and similar tools can reuse proven operating instructions instead of one-off prompts.
 """,
                 encoding="utf-8",
             )

antigravity-awesome-skills/tools/scripts/tests/test_weaviate_conn_logging_security.py

@@ -78,20 +78,22 @@ class WeaviateConnectionLoggingSecurityTests(unittest.TestCase):
         ),
     ]
 
+    FIXTURE_VALUE = "-".join(("fixture", "value"))
+
     ENV = {
         "WEAVIATE_URL": "https://example.weaviate.cloud",
-        "WEAVIATE_API_KEY": "weaviate-secret-value",
-        "OPENAI_API_KEY": "openai-secret-value",
-        "AWS_SECRET_KEY": "aws-secret-value",
+        "WEAVIATE_API_KEY": f"weaviate-{FIXTURE_VALUE}",
+        "OPENAI_API_KEY": f"openai-{FIXTURE_VALUE}",
+        "AWS_SECRET_KEY": "aws-fixture-value",
     }
 
     FORBIDDEN_OUTPUT = [
         "WEAVIATE_API_KEY",
         "OPENAI_API_KEY",
         "AWS_SECRET_KEY",
-        "weaviate-secret-value",
-        "openai-secret-value",
-        "aws-secret-value",
+        "weaviate-fixture-value",
+        "openai-fixture-value",
+        "aws-fixture-value",
     ]
 
     def _capture_stderr(self, callback, env=None):

antigravity-awesome-skills/tools/scripts/update_readme.py

@@ -189,7 +189,7 @@ def apply_metadata(content: str, metadata: dict) -> str:
         r"^# 🌌 Antigravity Awesome Skills: .*?$",
         (
             f"# 🌌 Antigravity Awesome Skills: {total_skills_label} "
-            "Agentic Skills for Claude Code, Gemini CLI, Cursor, Copilot & More"
+            "Agentic Skills for Claude Code, Gemini CLI, Cursor, Autohand Code, Copilot & More"
         ),
         content,
         count=1,