CHANGELOG.md

Changelog

All notable changes to this skill are documented here. The format follows Keep a Changelog, and this project adheres to Semantic Versioning.

[1.7.0] — 2026-10-11

Added

• write-paper 1.0.0: plan, draft, revise, and polish scientific papers (ML / CV / graphics conference style). Modes: Plan, Draft, Revise, Final push, Polish. Hard rule: never invent results, numbers, or citations ([TODO] placeholders instead).
  • references/pre-writing-questions.md — pre-writing questions, Goal → Problem → Solution story, the nugget.
  • references/section-guides.md — title, acronym, abstract skeleton, teaser, introduction, method/equations, experiments, related work, figures, conclusion, supplementary/video.
  • references/style-rules.md — line-level lint (concision, voice, tense, consistency, citations).
  • references/latex-and-submission-checklist.md — LaTeX, bibliography, layout, proofreading, supplementary checklist.
  • examples/sample-paper-brief.md — sample Step 1 paper brief.
  • Based on Michael J. Black's essay Writing a good scientific paper (paraphrased).

Fixed

• security-reviewer: JS-CMDI now flags exec(<variable>) / child_process.exec(<variable>) (previously only string concatenation and template literals); RegExp.exec() is not flagged.

Added (tests)

• security-reviewer: scripts/test_scanners.py and examples/fixtures/{fastapi,nextjs} — regression test asserting the expected rules fire.

[1.6.0] — 2026-10-01

Added

• security-reviewer: code-first scanning, stdlib Python only (no external tools required).
  • scripts/plan_scan.py — detects Next.js / FastAPI / generic projects (monorepo-aware, manifest + content sniffing), scopes files by --diff <base-ref> or --files, maps attack-surface hotspots and assigns every vulnerability category a coverage status. Writes scan-plan.json.
  • scripts/run_scan.py — runs the scanners selected by the plan and writes findings.json (stable F-<hash> ids, verdict untriaged). Optional npm audit / pip-audit when installed; --no-deps skips them.
  • scripts/scan_python.py — ast-based FastAPI/Python rules: routes without auth dependency (route / router / include_router / app level), SQLi, shell injection, eval, pickle/yaml, JWT verification, CORS, debug, TLS, weak hash/random, secrets in logs, HTML responses.
  • scripts/scan_js.py — Next.js/JS/TS rules: Server Actions and route handlers without auth, raw SQL, shell, eval, XSS sinks, NEXT_PUBLIC_ secrets, jwt.decode, CORS, TLS, open redirect, SSRF.
  • scripts/scan_secrets.py — known key formats, secret assignments, tracked .env files; values masked in output.
  • references/profiles/{nextjs,fastapi,generic}.json, references/scanners.json, references/scan_profiles.md, references/scan_rules.md. Per-repo overrides via <target>/.security-reviewer.json.
• security-reviewer: finding claims and independent verification (adapted from cloudflare/security-audit-skill), documented in references/verification.md.
  • Every high/medium confirmed / needs_validation finding states Attacker, Entry Point, Boundary, Impact; findings without a concrete attacker and impact are rejected.
  • Step 2c: each high/medium finding to be confirmed goes to a fresh verifier sub-agent that tries to disprove it (upheld → confirmed, disproved → rejected, unresolved → needs_validation). Fallback without delegation: separate pass marked upheld (self).
• notes/security-reviewer-scan-engine.md — research on alibaba/open-code-review and cloudflare/security-audit-skill, and why the engine is built-in Python instead of Opengrep/Semgrep.

Changed

• security-reviewer 1.1.0 → 1.2.0: Step 1 runs plan_scan.py + run_scan.py; Step 2 starts with triage of findings.json (confirmed / rejected / needs_validation), then a manual audit scoped by hotspots and coverage status. Report template adds ## Automated Scan Triage.
• validate_security_review.py fails when a high/medium finding in findings.json has no verdict in the report, a confirmed row lacks Verifier = upheld, a PASS report contains a confirmed high/medium finding, a FAIL report lists no actionable finding, or an actionable finding misses a claim field or an upheld verification.

[1.5.0] — 2026-10-01

Added

• wiki-manager: wiki_tool.py new <slug> (next free NNN- folder), status <id> <draft|in_progress|completed>, log "<Agent>" "<msg>" (append to wiki/log.md). COMPLETE/LOG/NEW_MODULE operations documented in SKILL.md.
• user-designer: scripts/validate_html_mockup.py (skeleton, hardcoded hex, external resources, a11y, required states); validate_design.py --require-approved gate; validate_plan_mockup.py now fails when a TC-* case in design.md is not mapped in plan.md.
• requirement-analyzer: ## Open Questions section (required by validate_requirement.py) and the Success-vs-Acceptance Criteria note.

Changed

• All 6 RAD skills bumped 1.0.0 → 1.1.0.
• requirement.md and design.md templates default to status: draft; they become approved only after the user confirms.
• user-designer: design approval step (status + Approved UI Summary) before PLAN; PLAN and constructor refuse an unapproved design; mockup step must also read requirement.md/design.md of semantically related modules.
• constructor: reads SYSTEM.md (and DESIGN.md for UI tasks); stops after max_review_iterations.
• quality-reviewer / security-reviewer: escalate to the user when max_review_iterations is exhausted; module marked completed after user confirmation; decisions logged.
• Registry description minimum is now 100 characters (was 5 words); lint enforces it.

Fixed

• wiki_tool.py sync no longer overwrites project, max_review_iterations, version or hand-written descriptions.
• wiki_tool.py escapes YAML strings (a " in a description no longer corrupts registry.yaml) and registers .html mockups.
• Goals/Target Users extraction accepts both bold and plain forms; skill template aligned with templates.md.

[1.4.0] — 2026-09-19

Changed

• review-skill — structural linter, Skill Smells, Deployment Readiness, Eval split, description length check, ALL-CAPS rule, license field.
  • Added scripts/validate_skill.py: stdlib-only Python linter for the mechanical checks (frontmatter schema, semver, kebab-case name, description length, body word count, credential assignment detection, absolute path detection, ALL-CAPS rationale check, script docstring presence). Matches repo's hand-rolled YAML parser convention.
  • Added Step 0 "Mechanical Linter" to Review Workflow: agent must run validate_skill.py before manual review.
  • Added "Skill Smells" section with 6 anti-patterns from Agent Skills cheatsheet (Day3).
  • Added "Deployment Readiness" gate section (7 aspirational deployment checks).
  • Split "Testability & Verification" into 4 failure modes: Trigger, Execution, Regression, Token Budget.
  • Added description length constraint (≤1024 chars YAML, ~50 words target) to Metadata dimension.
  • Added ALL-CAPS imperative rationale check to Instruction Clarity dimension.
  • Added license: MIT to frontmatter.
  • Added --json flag to validate_skill.py for machine-readable output.
  • Bumped version: 1.3.0 → 1.4.0.

Fixed

• validate_skill.py: fixed secret detection (was too aggressive, flagged plain-text words like "Token" in prose); fixed --json flag parsing; now skips matches inside backtick code spans for ALL-CAPS check.

[1.4.2] — 2026-09-14

Changed

• read-paper skill — review-skill Medium fixes 2-5 + docling migration.
  • SKILL.md fix (2): replaced vague "Pass 4 is for the parts that earn their reading time" with four agent-checkable completion criteria (one-sentence contribution, 3-sentence framing, 5-minute explanation, answer to specific question).
  • SKILL.md fix (3): split the old combined "user's attention / what they can apply" question into two question-aligned signals that map to MEMORY.md calibration signals B (active focus) and C (applicable methods).
  • SKILL.md fix (4): added explicit hallucination anti-pattern with a concrete Transformer-example failure mode ("drawing a Mermaid block that resembles a Transformer encoder/decoder without naming the paper's actual modules, then claiming it represents Figure 1").
  • SKILL.md fix (5): named the paper in the example file description ("Attention Is All You Need", Vaswani et al., 2017) so it's clear what the example covers.
  • Tool portability: swapped PyMuPDF for docling in the Tool Capability Reference and the Quick-start recipe to match the new primary extraction tool.
• references/paper-sources.md — full rewrite around docling.
  • Replaced the PyMuPDF extraction approach with docling (Python API + CLI) as the primary PDF → Markdown tool. Docling preserves layout, handles scanned PDFs via built-in OCR, and outputs structured Markdown suited for downstream PACES analysis.
  • Updated install instructions (pip install docling, uv add docling, docling[mac_intel]), replaced PyMuPDF-specific pitfalls with docling-relevant ones (first-run ML-model download, sandboxed pip, large paper slicing), and updated the Quick routing table.
  • Reference: docling quickstart.

[1.4.1] — 2026-09-14

Changed

• read-paper skill — slop tightening pass (via Antigravity CLI).
  • Cut 21 instances of filler, repetition, mechanical phrasing, and inverted pitfalls across all 5 files (SKILL.md, references/, examples/).
  • Critical fix: inverted pitfall in memory-cross-reference.md (was listing "Skipping basics" as a pitfall title instead of "Re-explaining basics the user already knows").
  • Stripped verbatim copy-pasted Python script block and duplicated grep slicing recipes from paper-sources.md.
  • Removed scratch-note residue (> MEMORY.md is your knowledge in the domain/fields... quote) from memory-cross-reference.md.
  • Reframed MEMORY.md meaning to match original notes intent: user's domain knowledge profile (existing expertise / active focus / applicable methods), not a generic working-memory notebook.
  • Tightened worked examples and corrected minor grammar (de-facto → de facto).
• File line counts grew in some places (clarification sub-headings, expanded pitfall tables) but prose density improved — the per-sentence tightening is the actual win, not the line count.

[1.4.0] — 2026-09-14

Added

• New read-paper skill for reading and analyzing a single research paper using the PACES framework (Purpose / Approach / Claims / Evaluation / Synthesis).
• 4-pass reading strategy: title+abstract+figures → intro+conclusion → full body → targeted deep dive.
• Output template with frontmatter (title, description, authors, domain, keywords, arxiv_id, memory_links).
• Default output location: docs/paper_summary/<slug>_<YYYYMMDD>.md (Markdown by default, HTML on request).
• Cross-references the user's MEMORY.md (or AGENTS.md / CLAUDE.md) and adds follow-up entries to a reading-list section.
• Supports paper sources: arXiv URL, local PDF, paper title (via Semantic Scholar), screenshot (via OCR).
• 3 reference files: paces-method.md (detailed PACES guide with worked examples), memory-cross-reference.md (MEMORY.md linking patterns), paper-sources.md (arXiv / PDF / OCR recipes). 4-pass reading strategy details (time budget, stop signals) are inlined in SKILL.md to avoid duplication.
• 1 example file: examples/sample-paces-analysis.md (worked PACES analysis of "Attention Is All You Need").
• Anti-trigger clause in description to avoid clashing with research-workflow (use research-workflow for literature surveys or batch reading, not read-paper).

[1.3.2] — 2026-09-02

Added

• Added OpenCode support (~/.config/opencode/skills) to installer (install.ps1, install.sh) and skill registration scripts (register-skills.ps1, register-skills.sh).
• Updated fallback skill lists across installers to include all repository skills (antigravity-cli, init-agents).

[1.3.1] — 2026-08-24

Added

• Added SDLC workflow position flowchart to all 6 RAD skills (wiki-manager, requirement-analyzer, user-designer, constructor, quality-reviewer, security-reviewer) highlighting current node position.

[1.3.0] — 2026-08-12

Added

• New screenshot skill for capturing web page screenshots
• Stealth mode using playwright-extra and puppeteer-extra-plugin-stealth to bypass Cloudflare and anti-bot detection
• Three scripts: screenshot.mjs, validate-url.mjs, check-deps.mjs
• Support for multiple output formats: WebP (default), PNG, JPEG
• Viewport-only capture by default (16:9: 1280x720)
• Random browser fingerprints (Chrome, Firefox) to avoid pattern detection
• Automatic .temp/ folder creation in workspace

Features

• URL validation with security checks (blocks localhost, private IPs)
• Dependency checker with global install vs npx options
• Cloudflare challenge detection and reporting
• 30s default timeout, configurable via --timeout

Dependencies

• playwright
• playwright-extra
• puppeteer-extra-plugin-stealth

1.2.0 — 2026-08-10

Added

• Initial public release of the research-workflow skill
• 12 reference files covering APIs, data-collection patterns, software comparison, single-paper deep-dive, local PDF batch extraction, and elearning reference data
• README with installation instructions for Hermes Agent, Claude Code, Cursor, and generic system-prompt use
• LICENSE (MIT) and this changelog

Changed

• Restructured repo to multi-skill convention: skills/research-workflow/SKILL.md (was SKILL.md at root)
• Updated README with full install instructions for Hermes Agent (with symlink recipe), Claude Code, Cursor, and generic use
• Repo URL changed — now hosted at https://github.com/pxuanbach/the-skills (multi-skill repo), not research-workflow-skill

Changed

• Generalized skill for non-Hermes agents. Removed Hermes-specific paths, variable names, and references from SKILL.md and reference files. The skill now works across any agent with browser, terminal, file, and delegation tools. Specific changes:
  • SKILL.md: pitfall section rewritten to remove Hermes venv paths, sandbox-specific CLI examples, and Hermes-only rendering claims
  • references/api-tools.md: script paths generalized; web_search note rewritten
  • references/data-collection-patterns.md: tool list rephrased as agent-agnostic; hermes_tools mention softened to "sometimes exposes helpers"
  • references/single-paper-deep-dive.md: PyMuPDF install instructions rewritten for any agent venv
  • examples/sample-report.md: footer rephrased
• README rewritten as a skills index. Removed all per-skill install instructions and platform-specific setup. The README is now a short index page listing each skill in this repo (llm-wiki-style).

Notes

• Source: extracted from a working Hermes Agent profile (researcher)
• Hermes references that remain (author: Hermes Agent, metadata.hermes in frontmatter) are credit/metadata only — they do not claim the skill is Hermes-only
• The skill is verified to work in any agentic environment with: browser_navigate, terminal (curl/python3/uv), read_file/write_file, delegate_task, execute_code, skill_view