[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F8WJGMKXZTDG6MDVB8FG10":3,"skill-same:01M6F8WJGMKXZTDG6MDVB8FG10":82},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":6,"ownerHtmlUrl":67,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":68,"install":69,"resources":81},"01M6F8WJGMKXZTDG6MDVB8FG10","mcp-dependency-drift-audit",null,"Statically audit MCP configs for mutable npm\u002Fnpx package references before approval or CI, without executing discovered MCP servers.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-mcp-dependency-drift-audit\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"MCP","mcp dependency drift audit","audit","drift","dependency","2026","for","supply","chain","windsurf","npx","community","references","v0","ai-security","supply-chain","ci","license","security","devsecops","gemini","safe","2026-11-10 10:12:30",false,"---\nname: mcp-dependency-drift-audit\ndescription: \"Statically audit MCP configs for mutable npm\u002Fnpx package references before approval or CI, without executing discovered MCP servers.\"\ncategory: security\nrisk: safe\nsource: \"https:\u002F\u002Fgithub.com\u002Ftomelias10\u002Fmcp-drift-check\"\nsource_repo: tomelias10\u002Fmcp-drift-check\nsource_type: community\ndate_added: \"2026-09-25\"\nauthor: tomelias10\ntags: [mcp, ai-security, supply-chain, devsecops, sarif]\ntools: [claude, cursor, gemini, codex, windsurf]\nlicense: MIT\nlicense_source: \"https:\u002F\u002Fgithub.com\u002Ftomelias10\u002Fmcp-drift-check\u002Fblob\u002Fv0\u002FLICENSE\"\n---\n\n# MCP Dependency Drift Audit\n\n## Overview\n\nAudit Model Context Protocol configuration files for npm\u002Fnpx package references that can resolve to different code after the configuration was reviewed. The workflow is deliberately static: it reads config text, classifies version selectors, and recommends reproducibility fixes without starting discovered MCP servers.\n\nDependency mutability is a review-boundary signal, not proof that a package is malicious, vulnerable, or compromised.\n\n## When to Use This Skill\n\n- Before approving `.mcp.json`, Cursor, VS Code, GitHub Copilot, Claude, or Windsurf MCP configuration.\n- When adding an MCP configuration gate to pull requests or CI.\n- During an AI-agent security review where npm\u002Fnpx-backed MCP servers are configured.\n- When checking whether a previously reviewed MCP config can silently resolve to newer package code.\n\n## How It Works\n\n### Step 1: Locate and read MCP configs without executing them\n\nInspect known project paths such as `.mcp.json`, `.github\u002Fmcp.json`, `.cursor\u002Fmcp.json`, `.vscode\u002Fmcp.json`, and `.windsurf\u002Fmcp.json`, plus any MCP config explicitly supplied by the user.\n\nRead them as text\u002FJSON only. Never run a discovered `command` or `args` value as part of this audit. Stay inside the requested workspace by default; only include user-level\u002Fglobal MCP configuration if the user explicitly asks for machine-wide scope.\n\n### Step 2: Use MCP Drift Check when already available\n\nIf `mcp-drift-check` is already installed, use the workspace-scoped mode from the intended repo root:\n\n```bash\nmcp-drift-check scan-workspace --markdown\n```\n\nFor CI evidence:\n\n```bash\nmcp-drift-check scan-workspace --sarif mcp-drift.sarif --markdown\n```\n\nIf the scanner is not installed, explain that the following command fetches the open-source scanner from GitHub and get user approval before running it:\n\n```bash\nuvx --from git+https:\u002F\u002Fgithub.com\u002Ftomelias10\u002Fmcp-drift-check@\u003Creviewed-full-commit> mcp-drift-check scan-workspace --markdown\n```\n\nIf the user declines network access or installation, continue with the manual rules below.\n\n### Step 3: Apply the manual static rules\n\nFor npm\u002Fnpx-style package selectors:\n\n| Selector | Classification | Reason |\n| --- | --- | --- |\n| `package@1.2.3` | PINNED DIRECT | Direct version is fixed; transitive dependencies, registry integrity and install hooks still need review. |\n| bare `package` or `@scope\u002Fpackage` | HIGH | A later resolution can select different package code. |\n| `package@latest` | HIGH | The selector is explicitly mutable. |\n| `package@^1.2.0`, `~1.2.0`, `>=1.2.0`, wildcard | MEDIUM | Resolution can change within the allowed range. |\n| local path, script, binary, unknown executable | REVIEW | npm version-drift rules do not establish update behavior. |\n\nTreat `-y` \u002F `--yes` as context only. It suppresses interactive confirmation but is not a vulnerability by itself.\n\n### Step 4: Recommend remediation without inventing versions\n\nFor mutable npm\u002Fnpx references, recommend pinning to an exact version that the team has actually reviewed and then updating that pin deliberately.\n\nDo not guess the version to pin. If registry lookup is needed, explain that it requires network access and ask before querying it.\n\nPinning improves reproducibility. It does not establish package provenance, vulnerability status, authorization safety, prompt-injection resistance, or runtime isolation.\n\n### Step 5: Produce a bounded report\n\nReturn:\n\n| Config | MCP server | Package\u002Freference | Classification | Why | Recommended next step |\n| --- | --- | --- | --- | --- | --- |\n\nThen state:\n\n- No MCP servers were executed during the audit.\n- Mutable dependency references are review\u002Freproducibility signals, not breach claims.\n- A clean dependency-drift result is not a complete MCP security assessment.\n\n## Examples\n\n### Example 1: Audit before approval\n\n**User:** `Audit this repo's MCP config before we approve it. Do not run any MCP servers.`\n\n**Expected shape:**\n\n```text\n.mcp.json | browser | @example\u002Fbrowser-mcp@latest | HIGH\nReason: @latest can resolve to different package code later.\nNext step: pin the exact version your team reviews and update it deliberately.\n\nNo MCP servers were executed.\n```\n\n### Example 2: Add a CI gate\n\nFor GitHub Actions:\n\n```yaml\n- uses: actions\u002Fcheckout@v4\n- uses: tomelias10\u002Fmcp-drift-check@\u003Creviewed-full-commit>\n```\n\nMCP Drift Check can also emit SARIF 2.1.0 for GitHub Code Scanning. The action defaults to workspace-only discovery; machine-wide user-level scanning remains an explicit `scan-all` choice.\n\n## Best Practices\n\n- ✅ Read config text only during discovery and classification.\n- ✅ Keep the default scope to the requested workspace\u002Frepository.\n- ✅ Separate reproducibility findings from vulnerability or compromise claims.\n- ✅ Pin only a version the team has actually reviewed.\n- ✅ Keep sensitive config values out of reports and public issues.\n- ❌ Do not execute server commands found in a config to \"verify\" a static finding.\n- ❌ Do not treat a clean result as a general MCP security guarantee.\n\n## Limitations\n\n- This workflow only covers dependency mutability\u002Freview drift for package-backed MCP configuration.\n- It does not assess prompt injection, tool poisoning, OAuth\u002Fauthorization, server implementation flaws, malware, provenance, or runtime sandboxing.\n- Local executables and non-npm launch paths require separate review.\n- A static config can be reproducible and still unsafe for other reasons.\n\n## Security & Safety Notes\n\n- The default workflow is read-only, local, and workspace-scoped.\n- Never execute discovered MCP server commands during this audit.\n- Never include credentials, tokens, private headers, or secret values in the output.\n- The optional `uvx` path makes a network fetch from the declared GitHub source; obtain user approval before running it.\n- If deeper active testing is requested, stop and establish explicit authorization and scope before any intrusive action.\n\n## Common Pitfalls\n\n- **Problem:** Calling an unpinned dependency a vulnerability.\n  **Solution:** Describe it as a reproducibility\u002Freview-drift signal unless separate evidence establishes security impact.\n- **Problem:** Pinning to today's registry version without knowing what was reviewed.\n  **Solution:** Ask for the reviewed version or, with approval, reconstruct relevant package history; do not guess.\n- **Problem:** Treating `-y` as the core finding.\n  **Solution:** Report it only as context; the version selector determines the dependency-drift classification.\n- **Problem:** Scanning user-level MCP configs when the user only asked about one repo.\n  **Solution:** Use `scan-workspace` by default; use `scan-all` only when machine-wide scope is explicit.\n\n## Related Skills\n\n- `@mcp-server-security` - Broader MCP server hardening, authentication, authorization, transport, and runtime controls.\n- `@supply-chain-security` - Broader software supply-chain assessment beyond MCP configuration.\n- `@sast-scanning` - Static application-security analysis for source code rather than MCP launch configuration.\n\n## Additional Resources\n\n- [MCP Drift Check stable v0](https:\u002F\u002Fgithub.com\u002Ftomelias10\u002Fmcp-drift-check\u002Ftree\u002Fv0) - MIT zero-execution scanner, GitHub Action, workspace-scoped mode, and SARIF output.\n- [Public MCP dependency drift examples](https:\u002F\u002Fsite-creator-vinext-starter.surfaceproof.workers.dev\u002Fresearch\u002Fmcp-dependency-drift) - Commit-specific public configuration examples and methodology limitations.\n\nA drift classification is not a safety certification or a reproducible transitive lock. Resolve and review the full tool revision before executing the optional scanner or Action; mutable tags are interface examples, not trust pins. Keep manifest text inert and protect secrets in scanner reports.\n","# MCP Dependency Drift Audit\n\n## Overview\n\nAudit Model Context Protocol configuration files for npm\u002Fnpx package references that can resolve to different code after the configuration was reviewed. The workflow is deliberately static: it reads config text, classifies version selectors, and recommends reproducibility fixes without starting discovered MCP servers.\n\nDependency mutability is a review-boundary signal, not proof that a package is malicious, vulnerable, or compromised.\n\n## When to Use This Skill\n\n- Before approving `.mcp.json`, Cursor, VS Code, GitHub Copilot, Claude, or Windsurf MCP configuration.\n- When adding an MCP configuration gate to pull requests or CI.\n- During an AI-agent security review where npm\u002Fnpx-backed MCP servers are configured.\n- When checking whether a previously reviewed MCP config can silently resolve to newer package code.\n\n## How It Works\n\n### Step 1: Locate and read MCP configs without executing them\n\nInspect known project paths such as `.mcp.json`, `.github\u002Fmcp.json`, `.cursor\u002Fmcp.json`, `.vscode\u002Fmcp.json`, and `.windsurf\u002Fmcp.json`, plus any MCP config explicitly supplied by the user.\n\nRead them as text\u002FJSON only. Never run a discovered `command` or `args` value as part of this audit. Stay inside the requested workspace by default; only include user-level\u002Fglobal MCP configuration if the user explicitly asks for machine-wide scope.\n\n### Step 2: Use MCP Drift Check when already available\n\nIf `mcp-drift-check` is already installed, use the workspace-scoped mode from the intended repo root:\n\n```bash\nmcp-drift-check scan-workspace --markdown\n```\n\nFor CI evidence:\n\n```bash\nmcp-drift-check scan-workspace --sarif mcp-drift.sarif --markdown\n```\n\nIf the scanner is not installed, explain that the following command fetches the open-source scanner from GitHub and get user approval before running it:\n\n```bash\nuvx --from git+https:\u002F\u002Fgithub.com\u002Ftomelias10\u002Fmcp-drift-check@\u003Creviewed-full-commit> mcp-drift-check scan-workspace --markdown\n```\n\nIf the user declines network access or installation, continue with the manual rules below.\n\n### Step 3: Apply the manual static rules\n\nFor npm\u002Fnpx-style package selectors:\n\n| Selector | Classification | Reason |\n| --- | --- | --- |\n| `package@1.2.3` | PINNED DIRECT | Direct version is fixed; transitive dependencies, registry integrity and install hooks still need review. |\n| bare `package` or `@scope\u002Fpackage` | HIGH | A later resolution can select different package code. |\n| `package@latest` | HIGH | The selector is explicitly mutable. |\n| `package@^1.2.0`, `~1.2.0`, `>=1.2.0`, wildcard | MEDIUM | Resolution can change within the allowed range. |\n| local path, script, binary, unknown executable | REVIEW | npm version-drift rules do not establish update behavior. |\n\nTreat `-y` \u002F `--yes` as context only. It suppresses interactive confirmation but is not a vulnerability by itself.\n\n### Step 4: Recommend remediation without inventing versions\n\nFor mutable npm\u002Fnpx references, recommend pinning to an exact version that the team has actually reviewed and then updating that pin deliberately.\n\nDo not guess the version to pin. If registry lookup is needed, explain that it requires network access and ask before querying it.\n\nPinning improves reproducibility. It does not establish package provenance, vulnerability status, authorization safety, prompt-injection resistance, or runtime isolation.\n\n### Step 5: Produce a bounded report\n\nReturn:\n\n| Config | MCP server | Package\u002Freference | Classification | Why | Recommended next step |\n| --- | --- | --- | --- | --- | --- |\n\nThen state:\n\n- No MCP servers were executed during the audit.\n- Mutable dependency references are review\u002Freproducibility signals, not breach claims.\n- A clean dependency-drift result is not a complete MCP security assessment.\n\n## Examples\n\n### Example 1: Audit before approval\n\n**User:** `Audit this repo's MCP config before we approve it. Do not run any MCP servers.`\n\n**Expected shape:**\n\n```text\n.mcp.json | browser | @example\u002Fbrowser-mcp@latest | HIGH\nReason: @latest can resolve to different package code later.\nNext step: pin the exact version your team reviews and update it deliberately.\n\nNo MCP servers were executed.\n```\n\n### Example 2: Add a CI gate\n\nFor GitHub Actions:\n\n```yaml\n- uses: actions\u002Fcheckout@v4\n- uses: tomelias10\u002Fmcp-drift-check@\u003Creviewed-full-commit>\n```\n\nMCP Drift Check can also emit SARIF 2.1.0 for GitHub Code Scanning. The action defaults to workspace-only discovery; machine-wide user-level scanning remains an explicit `scan-all` choice.\n\n## Best Practices\n\n- ✅ Read config text only during discovery and classification.\n- ✅ Keep the default scope to the requested workspace\u002Frepository.\n- ✅ Separate reproducibility findings from vulnerability or compromise claims.\n- ✅ Pin only a version the team has actually reviewed.\n- ✅ Keep sensitive config values out of reports and public issues.\n- ❌ Do not execute server commands found in a config to \"verify\" a static finding.\n- ❌ Do not treat a clean result as a general MCP security guarantee.\n\n## Limitations\n\n- This workflow only covers dependency mutability\u002Freview drift for package-backed MCP configuration.\n- It does not assess prompt injection, tool poisoning, OAuth\u002Fauthorization, server implementation flaws, malware, provenance, or runtime sandboxing.\n- Local executables and non-npm launch paths require separate review.\n- A static config can be reproducible and still unsafe for other reasons.\n\n## Security & Safety Notes\n\n- The default workflow is read-only, local, and workspace-scoped.\n- Never execute discovered MCP server commands during this audit.\n- Never include credentials, tokens, private headers, or secret values in the output.\n- The optional `uvx` path makes a network fetch from the declared GitHub source; obtain user approval before running it.\n- If deeper active testing is requested, stop and establish explicit authorization and scope before any intrusive action.\n\n## Common Pitfalls\n\n- **Problem:** Calling an unpinned dependency a vulnerability.\n  **Solution:** Describe it as a reproducibility\u002Freview-drift signal unless separate evidence establishes security impact.\n- **Problem:** Pinning to today's registry version without knowing what was reviewed.\n  **Solution:** Ask for the reviewed version or, with approval, reconstruct relevant package history; do not guess.\n- **Problem:** Treating `-y` as the core finding.\n  **Solution:** Report it only as context; the version selector determines the dependency-drift classification.\n- **Problem:** Scanning user-level MCP configs when the user only asked about one repo.\n  **Solution:** Use `scan-workspace` by default; use `scan-all` only when machine-wide scope is explicit.\n\n## Related Skills\n\n- `@mcp-server-security` - Broader MCP server hardening, authentication, authorization, transport, and runtime controls.\n- `@supply-chain-security` - Broader software supply-chain assessment beyond MCP configuration.\n- `@sast-scanning` - Static application-security analysis for source code rather than MCP launch configuration.\n\n## Additional Resources\n\n- [MCP Drift Check stable v0](https:\u002F\u002Fgithub.com\u002Ftomelias10\u002Fmcp-drift-check\u002Ftree\u002Fv0) - MIT zero-execution scanner, GitHub Action, workspace-scoped mode, and SARIF output.\n- [Public MCP dependency drift examples](https:\u002F\u002Fsite-creator-vinext-starter.surfaceproof.workers.dev\u002Fresearch\u002Fmcp-dependency-drift) - Commit-specific public configuration examples and methodology limitations.\n\nA drift classification is not a safety certification or a reproducible transitive lock. Resolve and review the full tool revision before executing the optional scanner or Action; mutable tags are interface examples, not trust pins. Keep manifest text inert and protect secrets in scanner reports.\n",{"name":5,"risk":44,"tags":50,"tools":53,"author":57,"source":58,"license":14,"category":41,"date_added":59,"description":7,"source_repo":60,"source_type":34,"license_source":61},[51,37,38,42,52],"mcp","sarif",[54,55,43,56,32],"claude","cursor","codex","tomelias10","https:\u002F\u002Fgithub.com\u002Ftomelias10\u002Fmcp-drift-check","2026-09-25","tomelias10\u002Fmcp-drift-check","https:\u002F\u002Fgithub.com\u002Ftomelias10\u002Fmcp-drift-check\u002Fblob\u002Fv0\u002FLICENSE","main","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-mcp-dependency-drift-audit",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-13 14:20:47",{"source":8,"skillName":5,"commands":70,"prompt":79,"zipAvailable":80},[71,73,76],{"tool":33,"command":72},"npx skills add boisenoise\u002Fskills-collections --skill mcp-dependency-drift-audit",{"tool":74,"command":75},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill mcp-dependency-drift-audit",{"tool":77,"command":78},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill mcp-dependency-drift-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-mcp-dependency-drift-audit\u002FSKILL.md",true,[],[83,112,134,159,178,201],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":88,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":45},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,28],"web","access","web access","official","development","browser","search","data","Tools","read","fetch","only","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":116,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":45},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[119],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[114,23,121,122,95,96,40,100,123,124,125,126,127,128,129,107,130,131,132,133,28],"cli","github","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":138,"sourceHtmlUrl":139,"categories":140,"keywords":146,"publishedAt":45},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[141],{"categoryNo":142,"categoryName":143,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[136,122,95,40,147,148,149,150,151,152,107,153,154,155,131,29,156,157,158,133,114,28],"https","email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":163,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":45},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[167,168,169,122,95,40,170,171,147,172,123,173,174,175,151,107,176,177,133,114,28],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":182,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":45},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[186,187,122,188,95,189,40,190,191,192,193,194,107,195,196,197,198,199,200,133],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":205,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":45},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[209,210,211,122,95,40,212,213,150,214,215,107,216,217,218,219,220,221,222,133],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]