criptogus · criptogus · May 29, 2026 · May 29, 2026 · May 29, 2026 · May 29, 2026
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -28,4 +28,7 @@ jobs:
             tests/integrations.test.mjs \
             tests/growth-revenue-split.test.mjs \
             tests/trust-badge.test.mjs \
-            tests/bounties.test.mjs
+            tests/bounties.test.mjs \
+            tests/trust-scoring.test.mjs \
+            tests/adversarial-holdout.test.mjs \
+            tests/adversarial-judge.test.mjs
diff --git a/NOTICE b/NOTICE
@@ -0,0 +1,22 @@
+Super Agent Skill
+Copyright (c) Zero Agency / Super Agent Skill contributors.
+
+This product includes content adapted from third-party open-source projects.
+
+------------------------------------------------------------------------------
+Anthropic-Cybersecurity-Skills
+  Source : https://github.com/mukul975/Anthropic-Cybersecurity-Skills
+  License: Apache License 2.0
+  Use    : Selected cybersecurity skills were adapted into the Super Agent Skill
+           schema (content/skills/*.yaml) and hardened through our upskilling
+           pipeline (schema validation + adversarial harness + Trust Score).
+           Files derived from this source carry `license: Apache-2.0` and credit
+           the upstream in their `authors` / `created_by` fields. Changes were
+           made: reformatting to our typed input->output contract, authored
+           examples, and added rules/guardrails.
+
+  Adapted files (initial wave):
+    - content/skills/sigma-detection-engineer.yaml
+    - content/skills/pcap-triage-analyst.yaml
+    - content/skills/kubernetes-security-auditor.yaml
+------------------------------------------------------------------------------
diff --git a/content/skills/cloudflare-workers-expert.yaml b/content/skills/cloudflare-workers-expert.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent APIs, URLs, or facts not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Cache JSON at the edge with KV
     input: |
-      <fill with a realistic task>
+      Cache an upstream JSON API response in Workers KV for 60s and serve stale on origin error.
     expected_output: |
-      <structured response per system prompt>
+      Worker reads from KV first; on miss, fetches origin, writes KV with expirationTtl: 60, returns. On origin 5xx, serves last-good KV value. Uses `caches.default` for the colo cache layer; KV for cross-colo. Notes KV's eventual consistency (~60s global).
+  - title: Durable Object rate limiter
+    input: |
+      Implement a per-user 100 req/min limiter using a Durable Object.
+    expected_output: |
+      One DO instance per userId (idFromName). DO holds a token-bucket in storage; alarm() refills. Worker forwards to `env.LIMITER.get(id)`; returns 429 with Retry-After when empty. Explains why a DO (single-threaded, strongly consistent) beats KV for counters.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/cursor-pair-programmer.yaml b/content/skills/cursor-pair-programmer.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent APIs, URLs, or facts not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Spec-first multi-file edit
     input: |
-      <fill with a realistic task>
+      Add a `lastLogin` timestamp to the User model and surface it in the profile API and UI.
     expected_output: |
-      <structured response per system prompt>
+      Writes a short spec (model migration, API field, UI binding), lists the exact files to touch, applies edits as a reviewable diff, and runs the type-checker before declaring done. Refuses to touch files outside the spec.
+  - title: Safe refactor with codemap
+    input: |
+      Rename `getUser()` to `fetchUser()` across the repo.
+    expected_output: |
+      Builds a codemap of call sites, performs the rename atomically, updates imports/tests, and flags any dynamic/string references it cannot safely rewrite for manual review.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/doc-skill-docx.yaml b/content/skills/doc-skill-docx.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent APIs, URLs, or facts not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Styled report with table
     input: |
-      <fill with a realistic task>
+      Generate a 1-page status report .docx with a heading, a 3-column status table, and a footer with page numbers.
     expected_output: |
-      <structured response per system prompt>
+      python-docx: `add_heading(level=1)`, `add_table(rows, cols=3)` with header row styled, footer via `section.footer` and a PAGE field. Returns the build script and the saved path.
+  - title: Track-changes-safe edit
+    input: |
+      Replace every 'Q3' with 'Q4' in an existing contract without breaking styles.
+    expected_output: |
+      Iterates `document.paragraphs` and runs, editing `run.text` in place (preserving run formatting) rather than rewriting paragraphs; reports count of replacements and leaves headers/footers untouched unless asked.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/doc-skill-pdf.yaml b/content/skills/doc-skill-pdf.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent APIs, URLs, or facts not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Fill a PDF form
     input: |
-      <fill with a realistic task>
+      Fill the AcroForm fields name and date in invoice_template.pdf and flatten it.
     expected_output: |
-      <structured response per system prompt>
+      pypdf: load reader, `update_page_form_field_values()` for the named fields, set NeedAppearances, write out; flatten by setting field flags read-only. Returns the output path and the fields it could not find.
+  - title: Extract a table
+    input: |
+      Extract the line-items table from page 2 of an invoice into rows.
+    expected_output: |
+      pdfplumber: `page.extract_table()` on page index 1, returns the rows as a list; falls back to `extract_words()` + column clustering when no ruled table is detected, and reports which strategy it used.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/doc-skill-pptx.yaml b/content/skills/doc-skill-pptx.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent APIs, URLs, or facts not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Generate a deck
     input: |
-      <fill with a realistic task>
+      Build a 5-slide launch deck: title, problem, solution, metrics chart, CTA — with speaker notes.
     expected_output: |
-      <structured response per system prompt>
+      python-pptx: title layout, content layouts with bullet placeholders, a CHART_TYPE.COLUMN_CLUSTERED for metrics, and `slide.notes_slide.notes_text_frame` per slide. Returns the script and saved .pptx path.
+  - title: Rebrand colors
+    input: |
+      Change all slide title colors to #0A66FF in an existing deck.
+    expected_output: |
+      Iterates slides → shapes → title placeholder runs, sets `run.font.color.rgb = RGBColor(0x0A,0x66,0xFF)`; reports slides changed and any without a title placeholder.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/doc-skill-xlsx.yaml b/content/skills/doc-skill-xlsx.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent APIs, URLs, or facts not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Workbook with formula + chart
     input: |
-      <fill with a realistic task>
+      Build a monthly revenue workbook: data sheet, a SUM total, and a line chart on a summary sheet.
     expected_output: |
-      <structured response per system prompt>
+      openpyxl: write data, add `=SUM(B2:B13)`, create a LineChart referencing the data range, place it on a 'Summary' sheet. Returns the script and path.
+  - title: Conditional formatting
+    input: |
+      Highlight cells in column C red when value < 0.
+    expected_output: |
+      openpyxl `FormatRule`/`CellIsRule` with operator 'lessThan' formula 0 and a red PatternFill applied to C2:C1000; reports the range and rule.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/google-workspace-automator.yaml b/content/skills/google-workspace-automator.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent APIs, URLs, or facts not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Label and archive email
     input: |
-      <fill with a realistic task>
+      Find Gmail threads older than 30 days from billing@ and archive them under a 'Billing/Old' label.
     expected_output: |
-      <structured response per system prompt>
+      Apps Script: `GmailApp.search('from:billing@ older_than:30d')`, get/create the nested label, apply to each thread and `moveToArchive()`. OAuth scope gmail.modify; reports thread count. Never deletes.
+  - title: Append rows to a Sheet
+    input: |
+      Append form responses to a 'Leads' sheet, deduping on email.
+    expected_output: |
+      SpreadsheetApp: read existing emails into a Set, append only new rows via `appendRow`, return added/skipped counts. Notes the spreadsheets scope and a lock to avoid concurrent-append races.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-account-health-scorer.yaml b/content/skills/gtm-account-health-scorer.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Score an at-risk account
     input: |
-      <fill with a realistic GTM scenario>
+      Usage down 40% QoQ, 2 open P1 tickets, champion left, renewal in 90 days.
     expected_output: |
-      <structured response per system prompt>
+      Health: Red (32/100). Adoption −, sentiment −, commercial −. Triggers: exec sponsor outreach, save play, and a new-champion mapping motion. Flags churn risk High with the 3 signals cited.
+  - title: Healthy account
+    input: |
+      Usage +15%, NPS 9, expansion conversation started, no open criticals.
+    expected_output: |
+      Health: Green (88/100). All three axes positive. Recommends an expansion/advocacy play and a reference ask; no remediation triggers.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-account-tiering-strategist.yaml b/content/skills/gtm-account-tiering-strategist.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Tier a new segment
     input: |
-      <fill with a realistic GTM scenario>
+      200 mid-market SaaS accounts, intent data available, 4 AEs.
     expected_output: |
-      <structured response per system prompt>
+      T1 (high fit + active intent): 1:1 coverage, weekly touch. T2: 1:few, biweekly. T3: 1:many nurture. Defines firmographic fit score, intent threshold, and per-tier SLA; sizes T1 to AE capacity.
+  - title: Re-tier on intent spike
+    input: |
+      A T3 account starts showing surging intent on 'migration'.
+    expected_output: |
+      Promotes to T1 with a triggered SLA (AE touch <24h), attaches a migration play, and notes the re-tier rule so it's repeatable.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-advocacy-program-builder.yaml b/content/skills/gtm-advocacy-program-builder.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Stand up a reference program
     input: |
-      <fill with a realistic GTM scenario>
+      We have 12 happy customers but no structured references; sales keeps asking the same 3.
     expected_output: |
-      <structured response per system prompt>
+      Designs tiers (reference / story / advisory), a contribution cap to avoid champion burnout, an incentive ladder, and a reusable request workflow with SLA. Defines the activation metric (references available per quarter).
+  - title: Recruit an advisory board
+    input: |
+      Build a 6-person customer advisory board for our roadmap.
+    expected_output: |
+      ICP-balanced shortlist criteria, charter, cadence (quarterly), agenda template, and a value-exchange so members stay engaged; exit criteria for inactive members.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-competitive-battlecard-writer.yaml b/content/skills/gtm-competitive-battlecard-writer.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Battlecard vs incumbent
     input: |
-      <fill with a realistic GTM scenario>
+      We lose to BigCorp on 'all-in-one'; we win on speed and price.
     expected_output: |
-      <structured response per system prompt>
+      Positioning, 3 traps to set, landmines to avoid, objection handling for 'why not BigCorp', and proof points (benchmarks, customer quotes). One page, seller-ready.
+  - title: Counter a price objection
+    input: |
+      Prospect says competitor is 20% cheaper.
+    expected_output: |
+      Reframes to TCO + time-to-value, gives the discovery question to expose hidden costs, and the proof point; never disparages the competitor.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-customer-adoption-architect.yaml b/content/skills/gtm-customer-adoption-architect.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Adoption program for a new product
     input: |
-      <fill with a realistic GTM scenario>
+      Launching a new analytics module; we want 40% of accounts active in 60 days.
     expected_output: |
-      <structured response per system prompt>
+      Persona journeys (admin, end-user), milestone plays (setup → first insight → habit), and activation thresholds with a measurable definition of 'active'. 30/60 checkpoints.
+  - title: Rescue a stalled rollout
+    input: |
+      Account onboarded 90 days ago, still at 10% seat activation.
+    expected_output: |
+      Diagnoses the blocked milestone, prescribes a targeted enablement play and an exec nudge, and sets a 2-week re-measure.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-discovery-call-coach.yaml b/content/skills/gtm-discovery-call-coach.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Critique a discovery transcript
     input: |
-      <fill with a realistic GTM scenario>
+      Rep spent 20 min on demo, asked no impact questions, vague next step ('I'll follow up').
     expected_output: |
-      <structured response per system prompt>
+      Scores Pain 2/5, Impact 1/5, Decision criteria 1/5, Next-step 1/5. Drills: quantify impact ('what does that cost you monthly?'), confirm decision process, book a specific next meeting on the call.
+  - title: Strong call
+    input: |
+      Rep surfaced quantified pain, mapped 3 stakeholders, booked a scoping call.
+    expected_output: |
+      Scores 4–5 across axes; one refinement (confirm budget authority) and a reinforcing drill. Highlights the multi-threading as best practice.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-enterprise-deal-mapper.yaml b/content/skills/gtm-enterprise-deal-mapper.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Map a complex deal
     input: |
-      <fill with a realistic GTM scenario>
+      $400k deal, 7 stakeholders, unclear who signs, one enthusiastic user.
     expected_output: |
-      <structured response per system prompt>
+      MEDDPICC map: identifies the user as a coach (not champion), names the missing economic buyer, marks decision process as Unknown (risk), and recommends a mobilizer play to reach power.
+  - title: Find the gap
+    input: |
+      Champion strong, but no access to the CFO with renewal in 60 days.
+    expected_output: |
+      Flags single-threaded risk, drafts a champion-led intro path to the economic buyer, and a business-case asset to justify the exec meeting.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-mutual-action-plan-author.yaml b/content/skills/gtm-mutual-action-plan-author.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Draft a MAP
     input: |
-      <fill with a realistic GTM scenario>
+      Mid-funnel enterprise deal targeting close in 8 weeks; needs security review + procurement.
     expected_output: |
-      <structured response per system prompt>
+      Milestones with owners and dates (technical validation, security review, procurement, signature), exit criteria per stage, and buyer-side owners named. Shareable, buyer-aligned format.
+  - title: Add a slipped milestone
+    input: |
+      Security review is 2 weeks late.
+    expected_output: |
+      Re-sequences downstream dates, flags the new close-date risk, and assigns a buyer-side owner with a specific unblock action.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-partner-cosell-architect.yaml b/content/skills/gtm-partner-cosell-architect.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Design a co-sell motion
     input: |
-      <fill with a realistic GTM scenario>
+      AWS partner, overlapping ICP in fintech, want sourced + influenced pipeline.
     expected_output: |
-      <structured response per system prompt>
+      ICP overlap definition, 2 joint plays, deal-registration rules, influenced/sourced attribution, and a revenue-split governance table. Defines the QBR cadence.
+  - title: Resolve a deal conflict
+    input: |
+      Both teams claim the same account.
+    expected_output: |
+      Applies the registration-precedence rule, proposes a split, and updates governance so the conflict class can't recur.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-pricing-packaging-strategist.yaml b/content/skills/gtm-pricing-packaging-strategist.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Design tiers
     input: |
-      <fill with a realistic GTM scenario>
+      Flat $99/mo today; usage varies 10x across customers; margins thin on heavy users.
     expected_output: |
-      <structured response per system prompt>
+      Introduces a value metric (active seats or API calls), 3 tiers + usage overage, willingness-to-pay bands, and a margin guardrail on heavy users. Migration plan for existing customers.
+  - title: Add an enterprise tier
+    input: |
+      Large buyers want SSO, audit logs, SLA.
+    expected_output: |
+      Defines an Enterprise tier gating those features, a 'call us' motion, and the value metric anchor; models impact on ACV and margin.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }

diff --git a/content/skills/gtm-product-launch-orchestrator.yaml b/content/skills/gtm-product-launch-orchestrator.yaml
@@ -13,11 +13,16 @@ rules:
   must_not:
     - Invent facts, customers, or competitor claims not grounded in the input.
 examples:
-  - title: Typical request
+  - title: Tier-1 launch plan
     input: |
-      <fill with a realistic GTM scenario>
+      Launching a major new product in 6 weeks across PLG + sales.
     expected_output: |
-      <structured response per system prompt>
+      Positioning + messaging, enablement (decks, battlecards, FAQ), channel plan (site, email, webinar, paid), and 30/60/90 success metrics with owners. Pre-launch readiness checklist.
+  - title: Right-size a small launch
+    input: |
+      Minor feature; don't over-invest.
+    expected_output: |
+      Recommends a Tier-3 motion (changelog + in-app + one email), skips the heavy enablement, and sets a single adoption metric.
 compatibility:
   - { runtime: claude, status: supported }
   - { runtime: gpt, status: supported }