everything-claude-code

Add frontend slides skill across platforms

Affaan Mustafa · 2026-02-27 05:39:31 -08:00

87fc2d5089

feat: add security guides and sanitize external links across repo

New articles:
- the-security-guide.md: "The Shorthand Guide to Securing Your Agent" (595 lines)
  Attack vectors, sandboxing, sanitization, OWASP Top 10, observability
- the-openclaw-guide.md: "The Hidden Danger of OpenClaw" (470 lines)
  Security analysis of OpenClaw, MiniClaw thesis, industry evidence

External link sanitization (22 files across EN, zh-CN, zh-TW, ja-JP, .cursor):
- Removed third-party GitHub links from skills and guides
- Replaced with inline descriptions to prevent transitive prompt injection
- Kept official org links (Anthropic, Google, Supabase, Mixedbread)

Affaan Mustafa · 2026-02-25 07:20:42 -08:00

a9b104fc23

Merge pull request #273 from bintocher/bintocher/issue-246

LGTM — Origin metadata for distributed skills. Pure metadata addition.

Affaan Mustafa · 2026-02-24 09:24:28 -08:00

4dbc0aa966

fix: add origin metadata to skills for traceability

Add origin field to all skill files to track their source repository.
This enables users to identify where distributed skills originated from.
Fixes affaan-m/everything-claude-code#246

Stanislav Chernov · 2026-02-23 19:00:57 +03:00

48dafdd288

address review: remove .cursor/ duplicate, use is not None checks

Changes based on CodeRabbit review feedback:

1. Remove entire .cursor/ directory — it was an identical copy of the
   main skills/commands/agents/rules, causing maintenance drift.
   Users of Cursor can reference the canonical files directly.

2. Use explicit `is not None` checks instead of truthiness for
   parsed['input'] and parsed['output']. Empty strings or empty
   dicts are valid values that should be preserved.

tsli · 2026-02-21 08:46:13 +08:00

dbe737cc0b

fix: use CLI argument for hook phase detection in observe.sh

The observe.sh script receives "pre" or "post" as $1 from the hook
config, but the Python code was looking for a "hook_type" field in
the stdin JSON. Claude Code does NOT include "hook_type" in the
JSON payload passed to hooks, so it always defaulted to "unknown",
causing all observations to be recorded as "tool_complete" —
PreToolUse events were never distinguished from PostToolUse.

Fix: capture $1 as HOOK_PHASE and pass it to Python via env var.
This also fixes TIMESTAMP export in the .cursor copy where inline
`VAR=val cmd` syntax didn't propagate to the python subprocess.

tsli · 2026-02-21 08:45:54 +08:00

cb4e4ca711

fix: correct TIMESTAMP environment variable syntax in observe.sh

The inline environment variable syntax `TIMESTAMP="$timestamp" echo ...` 
does not work correctly because:
1. The pipe creates a subshell that doesn't inherit the variable
2. The environment variable is set for echo, not for the piped python

Fixed by using `export` and separating the commands:
- export TIMESTAMP="$timestamp"
- echo "$INPUT_JSON" | python3 -c "..."

This ensures the TIMESTAMP variable is available to the python subprocess.

Fixes #227

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

黄飞虹 · 2026-02-14 21:25:50 +08:00

1f74889dbf

fix: include .md files in instinct-cli glob (completes #216 )

The observer agent creates instinct files as .md with YAML frontmatter,
but load_all_instincts() only globbed *.yaml and *.yml. Add *.md to the
glob so instinct-cli status discovers all instinct files.

Affaan Mustafa · 2026-02-13 01:26:37 -08:00

e9343c844b

fix: instinct-cli glob and evolve --generate (fixes #216 , #217 )

- Load both .yaml and .yml files in load_all_instincts() (#216)
  The *.yaml-only glob missed .yml files, causing 'No instincts found'
- Implement evolve --generate to create skill/command/agent files (#217)
  Previously printed a stub message. Now generates SKILL.md, command .md,
  and agent .md files from the clustering analysis into ~/.claude/homunculus/evolved/

Affaan Mustafa · 2026-02-13 01:09:16 -08:00

307ee05b2d

docs: add 'When to Activate' sections to 14 skill definitions

Add activation triggers to skills that were missing them, helping
Claude Code determine when to load each skill contextually.

Affaan Mustafa · 2026-02-12 15:34:25 -08:00

e6e28882db

fix: harden CI validators, shell scripts, and expand test suite

- Add try-catch around readFileSync in validate-agents, validate-commands,
  validate-skills to handle TOCTOU races and file read errors
- Add validate-hooks.js and all test suites to package.json test script
  (was only running 4/5 validators and 0/4 test files)
- Fix shell variable injection in observe.sh: use os.environ instead of
  interpolating $timestamp/$OBSERVATIONS_FILE into Python string literals
- Fix $? always being 0 in start-observer.sh: capture exit code before
  conditional since `if !` inverts the status
- Add OLD_VERSION validation in release.sh and use pipe delimiter in sed
  to avoid issues with slash-containing values
- Add jq dependency check in evaluate-session.sh before parsing config
- Sync .cursor/ copies of all modified shell scripts

Affaan Mustafa · 2026-02-12 14:11:33 -08:00

f3a4b33d41

fix: harden error handling, fix TOCTOU races, and improve test accuracy

Core library fixes:
- session-manager.js: wrap all statSync calls in try-catch to prevent
  TOCTOU crashes when files are deleted between readdir and stat
- session-manager.js: use birthtime||ctime fallback for Linux compat
- session-manager.js: remove redundant existsSync before readFile
- utils.js: fix findFiles TOCTOU race on statSync inside readdir loop

Hook improvements:
- Add 1MB stdin buffer limits to all PostToolUse hooks to prevent
  unbounded memory growth from large payloads
- suggest-compact.js: use fd-based atomic read+write for counter file
  to reduce race window between concurrent invocations
- session-end.js: log when transcript file is missing, check
  replaceInFile return value for failed timestamp updates
- start-observer.sh: log claude CLI failures instead of silently
  swallowing them, check observations file exists before analysis

Test fixes:
- Fix blocking hook tests to send matching input (dev server command)
  and expect correct exit code 2 instead of 1

Affaan Mustafa · 2026-02-12 13:40:14 -08:00

36864ea11a

fix: resolve multiple reported issues (#205 , #182 , #188 , #172 , #173 ) (#207 )

* fix: resolve multiple reported issues (#205, #182, #188, #172, #173)

- fix(observe.sh): replace triple-quote JSON parsing with stdin pipe to
  prevent ~49% parse failures on payloads with quotes/backslashes/unicode
- fix(hooks.json): correct matcher syntax to use simple tool name regexes
  instead of unsupported logical expressions; move command/path filtering
  into hook scripts; use exit code 2 for blocking hooks
- fix(skills): quote YAML descriptions containing colons in 3 skill files
  and add missing frontmatter to 2 skill files for Codex CLI compatibility
- feat(rules): add paths: filters to all 15 language-specific rule files
  so they only load when working on matching file types
- fix(agents): align model fields with CONTRIBUTING.md recommendations
  (opus for planner/architect, sonnet for reviewers/workers, haiku for
  doc-updater)

* ci: use AgentShield GitHub Action instead of npx

Switch from npx ecc-agentshield to uses: affaan-m/agentshield@v1
for proper GitHub Action demo and marketplace visibility.

Affaan Mustafa · 2026-02-11 23:48:45 -08:00

e41ee0c858

fix: preserve content after frontmatter in parse_instinct_file() (#161 )

parse_instinct_file() was appending the instinct and resetting state
when frontmatter ended (second ---), before any content lines could be
collected. This caused all content (Action, Evidence, Examples) to be
lost during import.

Fix: only set in_frontmatter=False when frontmatter ends. The existing
logic at the start of next frontmatter (or EOF) correctly appends the
instinct with its collected content.

Fixes #148

ericcai · 2026-02-06 01:00:48 -08:00

e4e94a7e70

fix: use CLAUDE_PLUGIN_ROOT for continuous-learning-v2 paths

Fixes #113

The instinct commands referenced hardcoded paths that only work with
manual installation (~/.claude/skills/...). When installed as a plugin,
files are at ~/.claude/plugins/cache/.../skills/...

Changes:
- Updated instinct-status, instinct-import, evolve commands to use
  ${CLAUDE_PLUGIN_ROOT} with fallback to manual path
- Updated observe.sh hook documentation with both install methods
- Updated SKILL.md with plugin vs manual installation instructions
- Removed duplicate commands from skills/continuous-learning-v2/commands/
  (already exist in commands/)

Users should use ${CLAUDE_PLUGIN_ROOT} in their hooks config when
installed as a plugin.

Affaan Mustafa · 2026-01-29 12:23:53 -08:00

e9dfcdffd0

feat: v1.1.0 release - session ID tracking, async hooks, new skills

- Add session ID to session filenames (Issue #62)
- Add getSessionIdShort() helper for unique per-session tracking
- Add async hooks documentation with example
- Create iterative-retrieval skill for progressive context refinement
- Add continuous-learning-v2 skill with instinct-based learning
- Add ecc.tools ecosystem section to README
- Update skills list in README

All 67 tests passing.

Affaan Mustafa · 2026-01-25 18:21:27 -08:00

5c63fa9006

16 Commits