[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6J451TR29VCEWGER8WKXMSP":3,"skill-same:01M6J451TR29VCEWGER8WKXMSP":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6J451TR29VCEWGER8WKXMSP","pack-submit",null,"Package one of this agent's own skills as a standalone community pack and submit it to the aeon registry as a PR","aeonfun\u002Faeon-agent","aeonfun","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F287715280?v=4","01M6CZ23C6MXGMF4N0V1DZ1247","aeon","01M6J3TN6FHJPWGPAR9ZVJY6FP",12,"MIT","https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon-agent\u002Fblob\u002Fmain\u002Fskills\u002Fpack-submit\u002FSKILL.md",[],[19,20,21,22,23,24,12,25,26,27,28,29,30,31,32,33,34,35,36,37],"pack submit","pack","submit","global","it","registry","evolution","write","notifications","api","package","host","gh","dev","Meta","pr","standalone","as","community","2026-11-10 10:12:30",false,"---\nname: pack-submit\ndescription: Package one of this agent's own skills as a standalone community pack and submit it to the aeon registry as a PR\nmetadata:\n  title: Pack Submit\n  category: evolution\n  var: \"\"\n  tags:\n    - dev\n    - meta\n    - packs\n  mode: write\n  requires:\n    - GH_GLOBAL?\n  capabilities:\n    - external_api\n    - writes_external_host\n    - sends_notifications\n---\n\n> **${var}** — The local skill to publish as a community pack: a skill **slug** (a directory name under `skills\u002F`), optionally followed by flags. **Required.**\n> Examples:\n> - `token-movers` — package `skills\u002Ftoken-movers\u002F` into a fresh public repo and submit it to the aeon registry\n> - `token-movers --repo myorg\u002Faeon-token-movers` — override the pack repo name (default `aeon-skill-pack-\u003Cslug>`)\n> - `token-movers --no-register` — create and push the pack repo, but skip the registry PR against `aeonfun\u002Faeon`\n> - `token-movers --dry-run` — build and validate the pack locally, write nothing to GitHub\n\nIf `${var}` is empty, exit `PACK_SUBMIT_NO_VAR`:\n```bash\n.\u002Fnotify \"pack-submit aborted: var empty — pass a skill slug e.g. \\\"token-movers\\\"\"\n```\nThen stop.\n\nToday is ${today}. Your task is to take the **existing** skill named in `${var}`, wrap it in a standalone community-pack repo (its own GitHub repo with a `skills-pack.json` manifest), and **submit it to the aeon community registry** - a PR against `aeonfun\u002Faeon` that adds both surfaces the registry demands in one diff: a row in the **Listed packs** table in `docs\u002Fcommunity-skill-packs.md` AND a matching entry in `catalog\u002Fskill-packs.json`. This is the inverse of `install-skill`: instead of pulling a community pack in, it pushes one of your own skills out for every other Aeon agent to install with `bin\u002Finstall-skill-pack`.\n\n## What a community pack is (so you build the right thing)\n\nA community pack is a **public GitHub repo** that holds one or more skills plus a `skills-pack.json` manifest that names and versions them. `bin\u002Finstall-skill-pack owner\u002Frepo` reads that manifest and installs the skills. To be **discoverable** (listed by `bin\u002Finstall-skill-pack --list` and the dashboard's Community Packs panel), the pack must also be registered in `aeonfun\u002Faeon`'s `catalog\u002Fskill-packs.json` + the Listed packs table in `docs\u002Fcommunity-skill-packs.md`. So publishing is two moves: **(a)** stand up the pack repo, **(b)** open the registry PR. This skill does both. Full protocol: `docs\u002Fcommunity-skill-packs.md`.\n\n## Steps\n\n**Shell shape.** Each Bash call is one allowed command (pipes are fine). The run refuses a call that sets a variable (`SLUG=$(...)`, `PACK_DIR=$(mktemp -d)`, `PR_URL=$(gh pr create ...)`), uses `if` \u002F `while` or `[ ... ] &&` tests, or joins commands with `;`, `&&` or `||`, and each refusal costs a model turn; `awk`, `cut`, `sed`, `cp`, `mv`, `mktemp` and `tee` are not allowed commands, and a `cd` does not carry over to the next call. So parse `${var}` and the frontmatter yourself, run each command below as its own call with every value (slug, owner, repo names, title) written in literally in place of the `\u003CSLUG>`, `\u003COWNER>`, `\u003CFULL_REPO>` style placeholders, work in the fixed dir `\u002Ftmp\u002Fpack-submit-work` with absolute paths (`git -C \u003Cdir>`, not `cd \u003Cdir> && git`), copy files with `node -e` (`fs.cpSync`, `fs.copyFileSync`), and write files (the manifest, README, LICENSE, PR body) with the Write tool. A `>` redirect into a file is refused too (\u002Ftmp included), and so is a jq `$name` variable: the registry edit pipes `jq` into a `node` writer with every value written into the filter as a string.\n\n1. **Parse and validate `${var}`** yourself, not with a shell script. The first whitespace-separated token is the skill slug SLUG; the rest are flags (`--repo owner\u002Fname`, `--no-register`, `--dry-run`). The slug must match `^[a-z0-9][a-z0-9-]*$` and resolve to a real directory:\n   - SLUG does not match `^[a-z0-9][a-z0-9-]*$`: run `.\u002Fnotify \"pack-submit aborted: \\\"\u003CSLUG>\\\" is not a valid skill slug (lowercase kebab-case)\"` and stop.\n   - Check `skills\u002F\u003CSLUG>\u002FSKILL.md` with Glob. If it is missing, run ``.\u002Fnotify \"pack-submit aborted: skills\u002F\u003CSLUG>\u002FSKILL.md not found - run with a slug from \\`ls skills\u002F\\`\"`` and stop.\n\n   If validation fails, exit `PACK_SUBMIT_BAD_VAR` with the notify above and stop. Note the boolean flags and the optional `--repo` value (REPO_OVERRIDE) from the rest of `${var}`.\n\n2. **Read the source skill's metadata.** Everything the manifest and registry entry need is already declared in `skills\u002F\u003CSLUG>\u002FSKILL.md`'s frontmatter - read it, don't invent it:\n   - **Display name** — `metadata.title`; fall back to the top-level `name:`.\n   - **Description** — the top-level `description:` (one line).\n   - **Category** — `metadata.category`. Registry categories are an open vocabulary, but first-party-only values (`core`, `evolution`, `basics`) don't describe a third-party pack — if you see one of those, pick the closest community category (`dev`, `crypto`, `productivity`, `research`, `social`) from what the skill actually does. Otherwise pass the category through.\n   - **Secrets** — `metadata.requires`. An entry ending in `?` is **optional** → `secrets_optional`; an entry without `?` is **required** → `secrets_required`. Strip the `?`. Registry `secrets_required` must be UPPER_SNAKE env names.\n   - **Capabilities** — `metadata.capabilities`, copied verbatim (already the locked taxonomy; see `docs\u002FCAPABILITIES.md`). Omit if absent.\n\n   Read `skills\u002F\u003CSLUG>\u002FSKILL.md` with the Read tool and take the values from its frontmatter (between the first two `---` lines): TITLE = `metadata.title` (else the top-level `name:`), DESC = the top-level `description:`, CATEGORY = `metadata.category`. Collect the `requires:`\u002F`capabilities:` list items (lines under those keys beginning with `    - `); split `requires` into required (no `?`) and optional (trailing `?`, stripped).\n\n3. **Build the pack repo locally.** Stage a clean working tree - the manifest at root, the full skill directory copied verbatim (including any helper scripts\u002Fconfig, not just `SKILL.md`), a README, and an MIT `LICENSE`. PACK_DIR is the fixed path `\u002Ftmp\u002Fpack-submit-work\u002Fpack`. Create it, then copy the skill, each as its own call:\n   ```bash\n   mkdir -p \u002Ftmp\u002Fpack-submit-work\u002Fpack\u002Fskills\u002F\u003CSLUG>\n   ```\n   ```bash\n   node -e \"require('fs').cpSync('skills\u002F\u003CSLUG>','\u002Ftmp\u002Fpack-submit-work\u002Fpack\u002Fskills\u002F\u003CSLUG>',{recursive:true})\"\n   ```\n   Write `\u002Ftmp\u002Fpack-submit-work\u002Fpack\u002Fskills-pack.json` with the Write tool (valid JSON with every value properly escaped, never hand-joined strings, so quoting is safe). Include only fields you actually have:\n   ```json\n   {\n     \"name\": \"\u003CTITLE>\",\n     \"version\": \"0.1.0\",\n     \"description\": \"\u003CDESC>\",\n     \"author\": \"\u003Coperator github handle>\",\n     \"license\": \"MIT\",\n     \"homepage\": \"https:\u002F\u002Fgithub.com\u002F\u003Cowner>\u002F\u003Cpack-repo>\",\n     \"skills\": [\n       {\n         \"slug\": \"\u003CSLUG>\",\n         \"path\": \"skills\u002F\u003CSLUG>\",\n         \"description\": \"\u003CDESC>\",\n         \"category\": \"\u003CCATEGORY>\",\n         \"schedule\": \"0 12 * * *\",\n         \"default_enabled\": false,\n         \"secrets_required\": [ ... ],\n         \"secrets_optional\": [ ... ],\n         \"capabilities\": [ ... ]\n       }\n     ]\n   }\n   ```\n   Write a `README.md` that names the skill, states its schedule assumption, lists required\u002Foptional secrets, and shows the one-line install (`bin\u002Finstall-skill-pack \u003Cowner>\u002F\u003Cpack-repo>`). Write a standard MIT `LICENSE` (year `${today}`'s year, copyright the operator handle). Resolve the operator handle once, as its own call:\n   ```bash\n   gh api user --jq .login\n   ```\n   It prints OWNER.\n\n4. **Pre-flight the pack.** Run the repo's own validator against the staged directory - it enforces exactly what `bin\u002Finstall-skill-pack` requires (valid JSON manifest, clean slug, no `..` in paths, the `SKILL.md` present, locked-taxonomy capabilities):\n   ```bash\n   .\u002Fscripts\u002Fvalidate-pack.sh \u002Ftmp\u002Fpack-submit-work\u002Fpack\n   ```\n   Exit non-zero (an `ERROR:` line) → exit `PACK_SUBMIT_INVALID_PACK`, notify with the failing line, and stop. **Do not** push an invalid pack. Warnings are fine to proceed on; surface them in the notify.\n\n   If `--dry-run` was passed, stop here: notify the operator that the pack built and validated cleanly at `\u002Ftmp\u002Fpack-submit-work\u002Fpack`, list the manifest fields, and exit `PACK_SUBMIT_DRY_RUN` without touching GitHub.\n\n5. **Create and push the pack repo.** PACK_REPO is the `--repo` override if given, else `aeon-skill-pack-\u003CSLUG>` (owner defaults to OWNER). The pack must be **public** - the installer fetches its tarball, and a private pack can't be installed by anyone else. First check the name is free:\n   ```bash\n   gh repo view \u003CPACK_REPO> --json nameWithOwner --jq .nameWithOwner\n   ```\n   If that call succeeds (prints a name), the repo already exists: run `.\u002Fnotify \"pack-submit aborted: repo \u003CPACK_REPO> already exists - pass --repo to pick another name\"` and stop. If it fails with \"Could not resolve\", the name is free. Then each as its own call:\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Fpack init -q\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Fpack add -A\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Fpack commit -q -m \"Aeon community pack: \u003CSLUG>\"\n   ```\n   ```bash\n   gh repo create \u003CPACK_REPO> --public --source=\u002Ftmp\u002Fpack-submit-work\u002Fpack --push\n   ```\n   Capture the resulting `owner\u002Frepo`:\n   ```bash\n   gh repo view \u003CPACK_REPO> --json nameWithOwner --jq .nameWithOwner\n   ```\n   It prints FULL_REPO. If repo creation fails (permission\u002Fname), exit `PACK_SUBMIT_REPO_FAILED`, notify with the `gh` error's shortest decisive line, and stop.\n\n6. **Submit the registry PR against `aeonfun\u002Faeon`** (skip this whole step if `--no-register` was passed - then jump to step 7 reporting only the pack repo). The registry lives in the canonical repo, so work against a fork, not this instance's checkout - this instance's `catalog\u002Fskill-packs.json` and `docs\u002Fcommunity-skill-packs.md` can be stale. Each as its own call; if the fork call fails because the fork already exists, carry on:\n   ```bash\n   gh repo fork aeonfun\u002Faeon --clone=false --default-branch-only\n   ```\n   ```bash\n   git clone -q https:\u002F\u002Fgithub.com\u002F\u003COWNER>\u002Faeon.git \u002Ftmp\u002Fpack-submit-work\u002Faeon\n   ```\n   If that clone fails, clone the canonical repo instead:\n   ```bash\n   git clone -q https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon.git \u002Ftmp\u002Fpack-submit-work\u002Faeon\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Faeon checkout -b pack-submit\u002F\u003CSLUG>\n   ```\n   Make the two edits the validator (`scripts\u002Fvalidate-skill-packs.mjs`) checks for parity:\n\n   **(a) `catalog\u002Fskill-packs.json`** - append one object to `.packs`. Build it with `jq` from the values you resolved, written in literally (mirror the pack's own manifest: `skills` is `[\"\u003CSLUG>\"]`, `trust_level` is `\"community\"`, aggregate `secrets_required`\u002F`capabilities` from the skill). One call: `jq` builds the new file and pipes it into a one-line `node` writer that saves it over the clone's file (node writes only after jq has read the whole input, so the same path is safe). Each value goes into the jq filter as a JSON string (a `\"` inside it becomes `\\\"`, and reword any `'`): a jq `$name` variable from `--arg` and a `>` redirect into a file are both refused in this run:\n   ```bash\n   jq '.packs += [ { repo:\"\u003CFULL_REPO>\", name:\"\u003CTITLE>\", description:\"\u003CDESC>\", author:\"\u003COWNER>\",\n        license:\"MIT\", homepage:\"https:\u002F\u002Fgithub.com\u002F\u003CFULL_REPO>\", category:\"\u003CCATEGORY>\", trust_level:\"community\",\n        skills:[\"\u003CSLUG>\"] } ]' \u002Ftmp\u002Fpack-submit-work\u002Faeon\u002Fcatalog\u002Fskill-packs.json \\\n     | node -e 'require(\"fs\").writeFileSync(\"\u002Ftmp\u002Fpack-submit-work\u002Faeon\u002Fcatalog\u002Fskill-packs.json\", require(\"fs\").readFileSync(0))'\n   ```\n   Add `secrets_required` \u002F `capabilities` keys to that object only when the skill declares them (keep it in sync with the pack manifest). Do **not** use `trust_level: trusted` — that requires the repo to be in `skills\u002Fsecurity\u002Ftrusted-sources.txt`, and the validator rejects an unearned `trusted`.\n\n   **(b) `docs\u002Fcommunity-skill-packs.md`** - add a table row under the `| Pack | Skills | Description |` header in the **Listed packs** section (the last section of the file). The table moved there from `.github\u002FREADME.md` in #845; do not edit the README. The row format, matching the existing rows exactly:\n   ```\n   | [\u003Cpack-repo-name>](https:\u002F\u002Fgithub.com\u002F\u003CFULL_REPO>) | 1 | \u003Cone-line description, ≤110 chars>. |\n   ```\n   Use `python3` for a surgical insert. **The row must land inside the table's contiguous block** - insert it immediately *after the last existing `| [` row*, never after a blank line or other text. The parity validator parses rows only until the first non-`|` line, so a row placed past the table is invisible to it and the PR fails CI with \"in the registry but has no row in the Community Packs table\". Verify with a re-read that the row sits among the other rows. Run it as one `python3 - \u003C\u003C'PY'` call (the heredoc is the script on stdin), with PACK_NAME (the pack repo's name), FULL_REPO and DESC written in literally as Python strings:\n   ```python\n   import re\n   PACK_NAME, FULL_REPO, DESC = \"\u003CPACK_REPO_NAME>\", \"\u003CFULL_REPO>\", \"\u003CDESC>\"\n   F = \"\u002Ftmp\u002Fpack-submit-work\u002Faeon\u002Fdocs\u002Fcommunity-skill-packs.md\"\n   lines = open(F).read().split(\"\\n\")\n   sec = next(i for i,l in enumerate(lines) if re.match(r'^#+\\s+Listed packs\\s*$', l))\n   hdr = next(i for i in range(sec,len(lines)) if re.match(r'^\\|\\s*Pack\\s*\\|\\s*Skills\\s*\\|\\s*Description\\s*\\|', lines[i]))\n   i = hdr + 2; last = i\n   while i \u003C len(lines) and lines[i].startswith(\"|\"): last = i; i += 1   # last data row\n   lines.insert(last + 1, f\"| [{PACK_NAME}](https:\u002F\u002Fgithub.com\u002F{FULL_REPO}) | 1 | {DESC} |\")\n   open(F,\"w\").write(\"\\n\".join(lines))\n   ```\n\n   **Validate parity before committing** - this is the exact CI gate the PR will hit (the script resolves its files from its own location, so the absolute path checks the clone):\n   ```bash\n   node \u002Ftmp\u002Fpack-submit-work\u002Faeon\u002Fscripts\u002Fvalidate-skill-packs.mjs\n   ```\n   A non-zero exit → fix the reported mismatch (skill count, a missing row, or a `--path` flag) and re-run until it prints `validate-skill-packs: OK`. Never open the PR on a red validator.\n\n   Then commit both files together, push the branch to your fork, and open the PR against the canonical repo, each as its own call:\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Faeon add catalog\u002Fskill-packs.json docs\u002Fcommunity-skill-packs.md\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Faeon commit -m \"feat: list \u003CTITLE> community pack (\u003CFULL_REPO>)\"\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Faeon push -u origin pack-submit\u002F\u003CSLUG>\n   ```\n   Write the PR body with the Write tool to `\u002Ftmp\u002Fpack-submit-work\u002Fpr-body.md`, values filled in:\n   ````markdown\n   ## New community pack\n\n   **Pack:** [\u003CFULL_REPO>](https:\u002F\u002Fgithub.com\u002F\u003CFULL_REPO>)\n   **Skill:** `\u003CSLUG>` - \u003CDESC>\n   **Author:** @\u003COWNER> · **License:** MIT · **Category:** \u003CCATEGORY>\n\n   Adds a row to the Listed packs table in `docs\u002Fcommunity-skill-packs.md` and a matching `catalog\u002Fskill-packs.json` entry (both in this diff, per the publishing checklist). `node scripts\u002Fvalidate-skill-packs.mjs` passes locally.\n\n   Install once merged:\n   ```\n   bin\u002Finstall-skill-pack \u003CFULL_REPO>\n   ```\n   ````\n   Then open the PR. `--head` names the pushed branch, since the call does not run inside the clone (use `aeonfun:pack-submit\u002F\u003CSLUG>` if the clone fell back to the canonical repo):\n   ```bash\n   gh pr create --repo aeonfun\u002Faeon --head \u003COWNER>:pack-submit\u002F\u003CSLUG> --title \"feat: list \u003CTITLE> community pack\" --body-file \u002Ftmp\u002Fpack-submit-work\u002Fpr-body.md\n   ```\n   It prints PR_URL. If `gh pr create` fails because a PR already exists for the branch, capture the existing URL instead of erroring. This PR is **not** self-merging - it lands in someone else's repo and is reviewed by the aeon maintainers.\n\n7. **Log.** Append to `memory\u002Flogs\u002F${today}.md`:\n   ```\n   ### pack-submit\n   - Skill: {SLUG} ({TITLE})\n   - Pack repo: https:\u002F\u002Fgithub.com\u002F{FULL_REPO}\n   - Registry PR: {PR_URL or \"skipped (--no-register)\"}\n   - Secrets: {required list or \"none\"} · Capabilities: {list or \"none\"}\n   - Exit: PACK_SUBMIT_OK (or the code that applied)\n   ```\n\n8. **Notify.** Send one concise line via `.\u002Fnotify` (≤4000 chars, clickable URLs):\n   ```\n   *pack-submit - {TITLE}*\n   Pack repo: https:\u002F\u002Fgithub.com\u002F{FULL_REPO}\n   Registry PR: {PR_URL}\n   Install: `bin\u002Finstall-skill-pack {FULL_REPO}`\n   {\"Requires: X, Y\" if any required secrets, else omit}\n   ```\n   On `--no-register`, say the pack repo is live and give the exact PR checklist link (`docs\u002Fcommunity-skill-packs.md#pack-maintainers-publishing-checklist`) so the operator can list it manually.\n\n## Exit taxonomy\n\n| Code | When | Action |\n|------|------|--------|\n| `PACK_SUBMIT_OK` | Pack repo pushed and registry PR opened (or `--no-register` completed) | Notify with pack repo + PR link |\n| `PACK_SUBMIT_NO_VAR` | `${var}` empty | Notify abort reason; stop |\n| `PACK_SUBMIT_BAD_VAR` | Slug malformed or `skills\u002F\u003Cslug>\u002FSKILL.md` missing | Notify with the slug; stop |\n| `PACK_SUBMIT_INVALID_PACK` | `validate-pack.sh` reported an ERROR | Notify with the failing line; stop (nothing pushed) |\n| `PACK_SUBMIT_DRY_RUN` | `--dry-run` — built + validated, wrote nothing to GitHub | Notify with the staged path + manifest summary |\n| `PACK_SUBMIT_REPO_FAILED` | `gh repo create` failed (name taken, permission) | Notify with the gh error; stop |\n| `PACK_SUBMIT_REGISTRY_FAILED` | Fork\u002Fclone\u002Fvalidate\u002FPR step failed after the pack repo was pushed | Notify: pack repo is live, registry PR did not open, with the failing step |\n\n## Network note\n\nThere is no network sandbox — `git` and `gh` reach GitHub directly. `gh` is authenticated in Actions (via `GH_GLOBAL` when set; the ambient `GITHUB_TOKEN` otherwise, which **cannot** create repos or cross-repo PRs — surface that as `PACK_SUBMIT_REPO_FAILED` rather than looping). Every irreversible outward write — creating the public pack repo (step 5) and opening the registry PR (step 6) — happens **in-run** and is fail-closed: a failed pre-flight (`validate-pack.sh`) or a failed parity check (`validate-skill-packs.mjs`) stops before any push. Confirm reachability with `gh api repos\u002Faeonfun\u002Faeon --jq .full_name` before deciding a fork\u002Fclone failure is real vs transient.\n\n## Constraints\n\n- **Publish only skills that already exist in `skills\u002F`.** This skill packages and distributes; it does not author. To create a new skill, use `create-skill`.\n- **The pack repo must be public** — the installer fetches its tarball; a private pack is uninstallable by others.\n- **Never** register with `trust_level: trusted` — that is earned via `skills\u002Fsecurity\u002Ftrusted-sources.txt`, and the validator rejects a self-declared `trusted`. Community packs use `trust_level: community`.\n- **Never** open the registry PR on a red `validate-skill-packs.mjs` — a broken registry entry takes down `bin\u002Finstall-skill-pack --list` and the dashboard panel for everyone.\n- **Keep the two registry surfaces in lockstep** - the Listed packs row in `docs\u002Fcommunity-skill-packs.md` and the `skill-packs.json` entry ship in one diff, with matching skill counts. That is what the CI gate enforces.\n- **Don't leak secret values.** The manifest lists secret **names** only (from the skill's `requires:`), never values.\n","> **${var}** — The local skill to publish as a community pack: a skill **slug** (a directory name under `skills\u002F`), optionally followed by flags. **Required.**\n> Examples:\n> - `token-movers` — package `skills\u002Ftoken-movers\u002F` into a fresh public repo and submit it to the aeon registry\n> - `token-movers --repo myorg\u002Faeon-token-movers` — override the pack repo name (default `aeon-skill-pack-\u003Cslug>`)\n> - `token-movers --no-register` — create and push the pack repo, but skip the registry PR against `aeonfun\u002Faeon`\n> - `token-movers --dry-run` — build and validate the pack locally, write nothing to GitHub\n\nIf `${var}` is empty, exit `PACK_SUBMIT_NO_VAR`:\n```bash\n.\u002Fnotify \"pack-submit aborted: var empty — pass a skill slug e.g. \\\"token-movers\\\"\"\n```\nThen stop.\n\nToday is ${today}. Your task is to take the **existing** skill named in `${var}`, wrap it in a standalone community-pack repo (its own GitHub repo with a `skills-pack.json` manifest), and **submit it to the aeon community registry** - a PR against `aeonfun\u002Faeon` that adds both surfaces the registry demands in one diff: a row in the **Listed packs** table in `docs\u002Fcommunity-skill-packs.md` AND a matching entry in `catalog\u002Fskill-packs.json`. This is the inverse of `install-skill`: instead of pulling a community pack in, it pushes one of your own skills out for every other Aeon agent to install with `bin\u002Finstall-skill-pack`.\n\n## What a community pack is (so you build the right thing)\n\nA community pack is a **public GitHub repo** that holds one or more skills plus a `skills-pack.json` manifest that names and versions them. `bin\u002Finstall-skill-pack owner\u002Frepo` reads that manifest and installs the skills. To be **discoverable** (listed by `bin\u002Finstall-skill-pack --list` and the dashboard's Community Packs panel), the pack must also be registered in `aeonfun\u002Faeon`'s `catalog\u002Fskill-packs.json` + the Listed packs table in `docs\u002Fcommunity-skill-packs.md`. So publishing is two moves: **(a)** stand up the pack repo, **(b)** open the registry PR. This skill does both. Full protocol: `docs\u002Fcommunity-skill-packs.md`.\n\n## Steps\n\n**Shell shape.** Each Bash call is one allowed command (pipes are fine). The run refuses a call that sets a variable (`SLUG=$(...)`, `PACK_DIR=$(mktemp -d)`, `PR_URL=$(gh pr create ...)`), uses `if` \u002F `while` or `[ ... ] &&` tests, or joins commands with `;`, `&&` or `||`, and each refusal costs a model turn; `awk`, `cut`, `sed`, `cp`, `mv`, `mktemp` and `tee` are not allowed commands, and a `cd` does not carry over to the next call. So parse `${var}` and the frontmatter yourself, run each command below as its own call with every value (slug, owner, repo names, title) written in literally in place of the `\u003CSLUG>`, `\u003COWNER>`, `\u003CFULL_REPO>` style placeholders, work in the fixed dir `\u002Ftmp\u002Fpack-submit-work` with absolute paths (`git -C \u003Cdir>`, not `cd \u003Cdir> && git`), copy files with `node -e` (`fs.cpSync`, `fs.copyFileSync`), and write files (the manifest, README, LICENSE, PR body) with the Write tool. A `>` redirect into a file is refused too (\u002Ftmp included), and so is a jq `$name` variable: the registry edit pipes `jq` into a `node` writer with every value written into the filter as a string.\n\n1. **Parse and validate `${var}`** yourself, not with a shell script. The first whitespace-separated token is the skill slug SLUG; the rest are flags (`--repo owner\u002Fname`, `--no-register`, `--dry-run`). The slug must match `^[a-z0-9][a-z0-9-]*$` and resolve to a real directory:\n   - SLUG does not match `^[a-z0-9][a-z0-9-]*$`: run `.\u002Fnotify \"pack-submit aborted: \\\"\u003CSLUG>\\\" is not a valid skill slug (lowercase kebab-case)\"` and stop.\n   - Check `skills\u002F\u003CSLUG>\u002FSKILL.md` with Glob. If it is missing, run ``.\u002Fnotify \"pack-submit aborted: skills\u002F\u003CSLUG>\u002FSKILL.md not found - run with a slug from \\`ls skills\u002F\\`\"`` and stop.\n\n   If validation fails, exit `PACK_SUBMIT_BAD_VAR` with the notify above and stop. Note the boolean flags and the optional `--repo` value (REPO_OVERRIDE) from the rest of `${var}`.\n\n2. **Read the source skill's metadata.** Everything the manifest and registry entry need is already declared in `skills\u002F\u003CSLUG>\u002FSKILL.md`'s frontmatter - read it, don't invent it:\n   - **Display name** — `metadata.title`; fall back to the top-level `name:`.\n   - **Description** — the top-level `description:` (one line).\n   - **Category** — `metadata.category`. Registry categories are an open vocabulary, but first-party-only values (`core`, `evolution`, `basics`) don't describe a third-party pack — if you see one of those, pick the closest community category (`dev`, `crypto`, `productivity`, `research`, `social`) from what the skill actually does. Otherwise pass the category through.\n   - **Secrets** — `metadata.requires`. An entry ending in `?` is **optional** → `secrets_optional`; an entry without `?` is **required** → `secrets_required`. Strip the `?`. Registry `secrets_required` must be UPPER_SNAKE env names.\n   - **Capabilities** — `metadata.capabilities`, copied verbatim (already the locked taxonomy; see `docs\u002FCAPABILITIES.md`). Omit if absent.\n\n   Read `skills\u002F\u003CSLUG>\u002FSKILL.md` with the Read tool and take the values from its frontmatter (between the first two `---` lines): TITLE = `metadata.title` (else the top-level `name:`), DESC = the top-level `description:`, CATEGORY = `metadata.category`. Collect the `requires:`\u002F`capabilities:` list items (lines under those keys beginning with `    - `); split `requires` into required (no `?`) and optional (trailing `?`, stripped).\n\n3. **Build the pack repo locally.** Stage a clean working tree - the manifest at root, the full skill directory copied verbatim (including any helper scripts\u002Fconfig, not just `SKILL.md`), a README, and an MIT `LICENSE`. PACK_DIR is the fixed path `\u002Ftmp\u002Fpack-submit-work\u002Fpack`. Create it, then copy the skill, each as its own call:\n   ```bash\n   mkdir -p \u002Ftmp\u002Fpack-submit-work\u002Fpack\u002Fskills\u002F\u003CSLUG>\n   ```\n   ```bash\n   node -e \"require('fs').cpSync('skills\u002F\u003CSLUG>','\u002Ftmp\u002Fpack-submit-work\u002Fpack\u002Fskills\u002F\u003CSLUG>',{recursive:true})\"\n   ```\n   Write `\u002Ftmp\u002Fpack-submit-work\u002Fpack\u002Fskills-pack.json` with the Write tool (valid JSON with every value properly escaped, never hand-joined strings, so quoting is safe). Include only fields you actually have:\n   ```json\n   {\n     \"name\": \"\u003CTITLE>\",\n     \"version\": \"0.1.0\",\n     \"description\": \"\u003CDESC>\",\n     \"author\": \"\u003Coperator github handle>\",\n     \"license\": \"MIT\",\n     \"homepage\": \"https:\u002F\u002Fgithub.com\u002F\u003Cowner>\u002F\u003Cpack-repo>\",\n     \"skills\": [\n       {\n         \"slug\": \"\u003CSLUG>\",\n         \"path\": \"skills\u002F\u003CSLUG>\",\n         \"description\": \"\u003CDESC>\",\n         \"category\": \"\u003CCATEGORY>\",\n         \"schedule\": \"0 12 * * *\",\n         \"default_enabled\": false,\n         \"secrets_required\": [ ... ],\n         \"secrets_optional\": [ ... ],\n         \"capabilities\": [ ... ]\n       }\n     ]\n   }\n   ```\n   Write a `README.md` that names the skill, states its schedule assumption, lists required\u002Foptional secrets, and shows the one-line install (`bin\u002Finstall-skill-pack \u003Cowner>\u002F\u003Cpack-repo>`). Write a standard MIT `LICENSE` (year `${today}`'s year, copyright the operator handle). Resolve the operator handle once, as its own call:\n   ```bash\n   gh api user --jq .login\n   ```\n   It prints OWNER.\n\n4. **Pre-flight the pack.** Run the repo's own validator against the staged directory - it enforces exactly what `bin\u002Finstall-skill-pack` requires (valid JSON manifest, clean slug, no `..` in paths, the `SKILL.md` present, locked-taxonomy capabilities):\n   ```bash\n   .\u002Fscripts\u002Fvalidate-pack.sh \u002Ftmp\u002Fpack-submit-work\u002Fpack\n   ```\n   Exit non-zero (an `ERROR:` line) → exit `PACK_SUBMIT_INVALID_PACK`, notify with the failing line, and stop. **Do not** push an invalid pack. Warnings are fine to proceed on; surface them in the notify.\n\n   If `--dry-run` was passed, stop here: notify the operator that the pack built and validated cleanly at `\u002Ftmp\u002Fpack-submit-work\u002Fpack`, list the manifest fields, and exit `PACK_SUBMIT_DRY_RUN` without touching GitHub.\n\n5. **Create and push the pack repo.** PACK_REPO is the `--repo` override if given, else `aeon-skill-pack-\u003CSLUG>` (owner defaults to OWNER). The pack must be **public** - the installer fetches its tarball, and a private pack can't be installed by anyone else. First check the name is free:\n   ```bash\n   gh repo view \u003CPACK_REPO> --json nameWithOwner --jq .nameWithOwner\n   ```\n   If that call succeeds (prints a name), the repo already exists: run `.\u002Fnotify \"pack-submit aborted: repo \u003CPACK_REPO> already exists - pass --repo to pick another name\"` and stop. If it fails with \"Could not resolve\", the name is free. Then each as its own call:\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Fpack init -q\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Fpack add -A\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Fpack commit -q -m \"Aeon community pack: \u003CSLUG>\"\n   ```\n   ```bash\n   gh repo create \u003CPACK_REPO> --public --source=\u002Ftmp\u002Fpack-submit-work\u002Fpack --push\n   ```\n   Capture the resulting `owner\u002Frepo`:\n   ```bash\n   gh repo view \u003CPACK_REPO> --json nameWithOwner --jq .nameWithOwner\n   ```\n   It prints FULL_REPO. If repo creation fails (permission\u002Fname), exit `PACK_SUBMIT_REPO_FAILED`, notify with the `gh` error's shortest decisive line, and stop.\n\n6. **Submit the registry PR against `aeonfun\u002Faeon`** (skip this whole step if `--no-register` was passed - then jump to step 7 reporting only the pack repo). The registry lives in the canonical repo, so work against a fork, not this instance's checkout - this instance's `catalog\u002Fskill-packs.json` and `docs\u002Fcommunity-skill-packs.md` can be stale. Each as its own call; if the fork call fails because the fork already exists, carry on:\n   ```bash\n   gh repo fork aeonfun\u002Faeon --clone=false --default-branch-only\n   ```\n   ```bash\n   git clone -q https:\u002F\u002Fgithub.com\u002F\u003COWNER>\u002Faeon.git \u002Ftmp\u002Fpack-submit-work\u002Faeon\n   ```\n   If that clone fails, clone the canonical repo instead:\n   ```bash\n   git clone -q https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon.git \u002Ftmp\u002Fpack-submit-work\u002Faeon\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Faeon checkout -b pack-submit\u002F\u003CSLUG>\n   ```\n   Make the two edits the validator (`scripts\u002Fvalidate-skill-packs.mjs`) checks for parity:\n\n   **(a) `catalog\u002Fskill-packs.json`** - append one object to `.packs`. Build it with `jq` from the values you resolved, written in literally (mirror the pack's own manifest: `skills` is `[\"\u003CSLUG>\"]`, `trust_level` is `\"community\"`, aggregate `secrets_required`\u002F`capabilities` from the skill). One call: `jq` builds the new file and pipes it into a one-line `node` writer that saves it over the clone's file (node writes only after jq has read the whole input, so the same path is safe). Each value goes into the jq filter as a JSON string (a `\"` inside it becomes `\\\"`, and reword any `'`): a jq `$name` variable from `--arg` and a `>` redirect into a file are both refused in this run:\n   ```bash\n   jq '.packs += [ { repo:\"\u003CFULL_REPO>\", name:\"\u003CTITLE>\", description:\"\u003CDESC>\", author:\"\u003COWNER>\",\n        license:\"MIT\", homepage:\"https:\u002F\u002Fgithub.com\u002F\u003CFULL_REPO>\", category:\"\u003CCATEGORY>\", trust_level:\"community\",\n        skills:[\"\u003CSLUG>\"] } ]' \u002Ftmp\u002Fpack-submit-work\u002Faeon\u002Fcatalog\u002Fskill-packs.json \\\n     | node -e 'require(\"fs\").writeFileSync(\"\u002Ftmp\u002Fpack-submit-work\u002Faeon\u002Fcatalog\u002Fskill-packs.json\", require(\"fs\").readFileSync(0))'\n   ```\n   Add `secrets_required` \u002F `capabilities` keys to that object only when the skill declares them (keep it in sync with the pack manifest). Do **not** use `trust_level: trusted` — that requires the repo to be in `skills\u002Fsecurity\u002Ftrusted-sources.txt`, and the validator rejects an unearned `trusted`.\n\n   **(b) `docs\u002Fcommunity-skill-packs.md`** - add a table row under the `| Pack | Skills | Description |` header in the **Listed packs** section (the last section of the file). The table moved there from `.github\u002FREADME.md` in #845; do not edit the README. The row format, matching the existing rows exactly:\n   ```\n   | [\u003Cpack-repo-name>](https:\u002F\u002Fgithub.com\u002F\u003CFULL_REPO>) | 1 | \u003Cone-line description, ≤110 chars>. |\n   ```\n   Use `python3` for a surgical insert. **The row must land inside the table's contiguous block** - insert it immediately *after the last existing `| [` row*, never after a blank line or other text. The parity validator parses rows only until the first non-`|` line, so a row placed past the table is invisible to it and the PR fails CI with \"in the registry but has no row in the Community Packs table\". Verify with a re-read that the row sits among the other rows. Run it as one `python3 - \u003C\u003C'PY'` call (the heredoc is the script on stdin), with PACK_NAME (the pack repo's name), FULL_REPO and DESC written in literally as Python strings:\n   ```python\n   import re\n   PACK_NAME, FULL_REPO, DESC = \"\u003CPACK_REPO_NAME>\", \"\u003CFULL_REPO>\", \"\u003CDESC>\"\n   F = \"\u002Ftmp\u002Fpack-submit-work\u002Faeon\u002Fdocs\u002Fcommunity-skill-packs.md\"\n   lines = open(F).read().split(\"\\n\")\n   sec = next(i for i,l in enumerate(lines) if re.match(r'^#+\\s+Listed packs\\s*$', l))\n   hdr = next(i for i in range(sec,len(lines)) if re.match(r'^\\|\\s*Pack\\s*\\|\\s*Skills\\s*\\|\\s*Description\\s*\\|', lines[i]))\n   i = hdr + 2; last = i\n   while i \u003C len(lines) and lines[i].startswith(\"|\"): last = i; i += 1   # last data row\n   lines.insert(last + 1, f\"| [{PACK_NAME}](https:\u002F\u002Fgithub.com\u002F{FULL_REPO}) | 1 | {DESC} |\")\n   open(F,\"w\").write(\"\\n\".join(lines))\n   ```\n\n   **Validate parity before committing** - this is the exact CI gate the PR will hit (the script resolves its files from its own location, so the absolute path checks the clone):\n   ```bash\n   node \u002Ftmp\u002Fpack-submit-work\u002Faeon\u002Fscripts\u002Fvalidate-skill-packs.mjs\n   ```\n   A non-zero exit → fix the reported mismatch (skill count, a missing row, or a `--path` flag) and re-run until it prints `validate-skill-packs: OK`. Never open the PR on a red validator.\n\n   Then commit both files together, push the branch to your fork, and open the PR against the canonical repo, each as its own call:\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Faeon add catalog\u002Fskill-packs.json docs\u002Fcommunity-skill-packs.md\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Faeon commit -m \"feat: list \u003CTITLE> community pack (\u003CFULL_REPO>)\"\n   ```\n   ```bash\n   git -C \u002Ftmp\u002Fpack-submit-work\u002Faeon push -u origin pack-submit\u002F\u003CSLUG>\n   ```\n   Write the PR body with the Write tool to `\u002Ftmp\u002Fpack-submit-work\u002Fpr-body.md`, values filled in:\n   ````markdown\n   ## New community pack\n\n   **Pack:** [\u003CFULL_REPO>](https:\u002F\u002Fgithub.com\u002F\u003CFULL_REPO>)\n   **Skill:** `\u003CSLUG>` - \u003CDESC>\n   **Author:** @\u003COWNER> · **License:** MIT · **Category:** \u003CCATEGORY>\n\n   Adds a row to the Listed packs table in `docs\u002Fcommunity-skill-packs.md` and a matching `catalog\u002Fskill-packs.json` entry (both in this diff, per the publishing checklist). `node scripts\u002Fvalidate-skill-packs.mjs` passes locally.\n\n   Install once merged:\n   ```\n   bin\u002Finstall-skill-pack \u003CFULL_REPO>\n   ```\n   ````\n   Then open the PR. `--head` names the pushed branch, since the call does not run inside the clone (use `aeonfun:pack-submit\u002F\u003CSLUG>` if the clone fell back to the canonical repo):\n   ```bash\n   gh pr create --repo aeonfun\u002Faeon --head \u003COWNER>:pack-submit\u002F\u003CSLUG> --title \"feat: list \u003CTITLE> community pack\" --body-file \u002Ftmp\u002Fpack-submit-work\u002Fpr-body.md\n   ```\n   It prints PR_URL. If `gh pr create` fails because a PR already exists for the branch, capture the existing URL instead of erroring. This PR is **not** self-merging - it lands in someone else's repo and is reviewed by the aeon maintainers.\n\n7. **Log.** Append to `memory\u002Flogs\u002F${today}.md`:\n   ```\n   ### pack-submit\n   - Skill: {SLUG} ({TITLE})\n   - Pack repo: https:\u002F\u002Fgithub.com\u002F{FULL_REPO}\n   - Registry PR: {PR_URL or \"skipped (--no-register)\"}\n   - Secrets: {required list or \"none\"} · Capabilities: {list or \"none\"}\n   - Exit: PACK_SUBMIT_OK (or the code that applied)\n   ```\n\n8. **Notify.** Send one concise line via `.\u002Fnotify` (≤4000 chars, clickable URLs):\n   ```\n   *pack-submit - {TITLE}*\n   Pack repo: https:\u002F\u002Fgithub.com\u002F{FULL_REPO}\n   Registry PR: {PR_URL}\n   Install: `bin\u002Finstall-skill-pack {FULL_REPO}`\n   {\"Requires: X, Y\" if any required secrets, else omit}\n   ```\n   On `--no-register`, say the pack repo is live and give the exact PR checklist link (`docs\u002Fcommunity-skill-packs.md#pack-maintainers-publishing-checklist`) so the operator can list it manually.\n\n## Exit taxonomy\n\n| Code | When | Action |\n|------|------|--------|\n| `PACK_SUBMIT_OK` | Pack repo pushed and registry PR opened (or `--no-register` completed) | Notify with pack repo + PR link |\n| `PACK_SUBMIT_NO_VAR` | `${var}` empty | Notify abort reason; stop |\n| `PACK_SUBMIT_BAD_VAR` | Slug malformed or `skills\u002F\u003Cslug>\u002FSKILL.md` missing | Notify with the slug; stop |\n| `PACK_SUBMIT_INVALID_PACK` | `validate-pack.sh` reported an ERROR | Notify with the failing line; stop (nothing pushed) |\n| `PACK_SUBMIT_DRY_RUN` | `--dry-run` — built + validated, wrote nothing to GitHub | Notify with the staged path + manifest summary |\n| `PACK_SUBMIT_REPO_FAILED` | `gh repo create` failed (name taken, permission) | Notify with the gh error; stop |\n| `PACK_SUBMIT_REGISTRY_FAILED` | Fork\u002Fclone\u002Fvalidate\u002FPR step failed after the pack repo was pushed | Notify: pack repo is live, registry PR did not open, with the failing step |\n\n## Network note\n\nThere is no network sandbox — `git` and `gh` reach GitHub directly. `gh` is authenticated in Actions (via `GH_GLOBAL` when set; the ambient `GITHUB_TOKEN` otherwise, which **cannot** create repos or cross-repo PRs — surface that as `PACK_SUBMIT_REPO_FAILED` rather than looping). Every irreversible outward write — creating the public pack repo (step 5) and opening the registry PR (step 6) — happens **in-run** and is fail-closed: a failed pre-flight (`validate-pack.sh`) or a failed parity check (`validate-skill-packs.mjs`) stops before any push. Confirm reachability with `gh api repos\u002Faeonfun\u002Faeon --jq .full_name` before deciding a fork\u002Fclone failure is real vs transient.\n\n## Constraints\n\n- **Publish only skills that already exist in `skills\u002F`.** This skill packages and distributes; it does not author. To create a new skill, use `create-skill`.\n- **The pack repo must be public** — the installer fetches its tarball; a private pack is uninstallable by others.\n- **Never** register with `trust_level: trusted` — that is earned via `skills\u002Fsecurity\u002Ftrusted-sources.txt`, and the validator rejects a self-declared `trusted`. Community packs use `trust_level: community`.\n- **Never** open the registry PR on a red `validate-skill-packs.mjs` — a broken registry entry takes down `bin\u002Finstall-skill-pack --list` and the dashboard panel for everyone.\n- **Keep the two registry surfaces in lockstep** - the Listed packs row in `docs\u002Fcommunity-skill-packs.md` and the `skill-packs.json` entry ship in one diff, with matching skill counts. That is what the CI gate enforces.\n- **Don't leak secret values.** The manifest lists secret **names** only (from the skill's `requires:`), never values.\n",{"name":5,"metadata":43,"description":7},{"var":44,"mode":26,"tags":45,"title":48,"category":25,"requires":49,"capabilities":51},"",[32,46,47],"meta","packs","Pack Submit",[50],"GH_GLOBAL?",[52,53,54],"external_api","writes_external_host","sends_notifications","main","ba8ac7e88c8ff955526557369fadc27eca9c1037","skills\u002Fpack-submit",4,"https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon-agent","https:\u002F\u002Ft.me\u002Faeon_agent","https:\u002F\u002Fgithub.com\u002Faeonfun","https:\u002F\u002Fwww.aeon.fun\u002F","The most autonomous agent framework.","2026-11-14 00:38:03",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add aeonfun\u002Faeon-agent --skill pack-submit",{"tool":71,"command":72},"bunx","bunx skills add aeonfun\u002Faeon-agent --skill pack-submit",{"tool":74,"command":75},"pnpm","pnpm dlx skills add aeonfun\u002Faeon-agent --skill pack-submit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon-agent\u002Fblob\u002Fmain\u002Fskills\u002Fpack-submit\u002FSKILL.md",true,[],[80,117,138,162,183,205],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":96,"publishedAt":38},"01M6J4ASEHAQYBZ5TZT4RVAM1Z","you-web-search","Web search using You.com Search API with high-quality, cited results — runs keyless out of the box; YDC_API_KEY unlocks higher limits and real-time web crawling","https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon-agent\u002Fblob\u002Fmain\u002Fskills\u002Fyou-web-search\u002FSKILL.md",[86,91],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[97,98,99,100,101,102,103,28,104,105,106,107,108,109,110,111,112,113,114,115,116],"web search","search","you","you web search","web","time","only","web crawling","read","read-only","real-time","basics","keyless","with","research","results","high","quality","box","limits",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":38},"01M6J4AK1ZAR1HS398K0CWWBFX","write-tweet","Multi-format tweet studio - standalone drafts (10 across 5 size tiers), a 5-10 tweet thread, or 10 remixes of past tweets, selected via ${var}","https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon-agent\u002Fblob\u002Fmain\u002Fskills\u002Fwrite-tweet\u002FSKILL.md",[],[26,124,35,125,126,28,127,128,129,130,108,131,132,133,134,135,136,137],"write tweet","social","studio","across","xai","past","drafts","twitter","thread","multi","size","via","format","content",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":147,"publishedAt":38},"01M6J4AFYF6ZHHNQV6H7N92S8K","weekly-aeoncard","Build a weekly token-consumption recap image from memory\u002Ftoken-usage.csv - this week + all-time totals, top skills, rendered as a shareable SVG card.","https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon-agent\u002Fblob\u002Fmain\u002Fskills\u002Fweekly-aeoncard\u002FSKILL.md",[144],{"categoryNo":145,"categoryName":146,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000016","图像与多媒体",[148,149,36,150,151,152,153,102,33,154,155,156,157,27,158,159,160,26,161,12],"weekly","weekly aeoncard","usage","SVG","memory","card","image","recap","csv","monitoring","productivity","top","build","token",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":38},"01M6J4AAZF6D0YQ8NK92NYJSRX","vuln-tracker","One lifecycle poll over everything vuln-scanner produces - PR and advisory status, PVR triage transitions, and pending-disclosure aging, with a stars-secured impact headline and one action queue.","https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon-agent\u002Fblob\u002Fmain\u002Fskills\u002Fvuln-tracker\u002FSKILL.md",[],[169,170,33,171,172,26,161,173,174,175,34,176,177,32,31,178,179,110,180,181,182,22],"tracker","vuln tracker","impact","scanner","status","action","security","stars","lifecycle","aging","advisory","github","transitions","triage",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":192,"publishedAt":38},"01M6J4A3ZM65VJNT4VEA9ESV39","vuln-scanner","Audit trending repos for real security vulnerabilities and disclose responsibly - scan and route findings (PVR \u002F dependency PR), re-submit queued advisories, and send armed email disclosures","https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon-agent\u002Fblob\u002Fmain\u002Fskills\u002Fvuln-scanner\u002FSKILL.md",[189],{"categoryNo":190,"categoryName":191,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000005","邮件与沟通",[172,193,194,195,196,33,197,175,198,199,200,32,180,201,22,21,28,202,203,204],"vuln scanner","resend","re","trending","repos","email","for","scan","vulnerabilities","route","audit","send",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":38},"01M6J49YHDRN3JNAN9GJW810P2","video-script","Turn a repo, product page, or update into a recording-ready video script in a receipts-first format - verifies every claim against live sources, then writes timestamped VO + on-screen direction with a plain-language glossary, assets checklist, anti-tells, and a verify-before-recording list","https:\u002F\u002Fgithub.com\u002Faeonfun\u002Faeon-agent\u002Fblob\u002Fmain\u002Fskills\u002Fvideo-script\u002FSKILL.md",[211],{"categoryNo":145,"categoryName":146,"taxonomyType":89,"taxonomyTypeDesc":90},[213,214,215,216,217,218,219,220,221,108,222,223,224,110,225,226,227,228,229,136],"Video","video script","script","recording","sources","ready","direction","page","repo","claim","plain-language","glossary","first","verify","product","screen","update"]