Repository navigation
收录 AWS Agent 工具包技能合集 / Add AWS Agent Toolkit skills - #226
Merged
Merged
Conversation
Merge origin/main (1b9e82d) into the AWS Agent Toolkit listing. Resolve the manifest conflict by keeping main's 1.5.16 changes, bumping the market version to 1.5.17 for the new listing and counting 145 top-level skills.
Merge origin/main (ef978c2) to bring the branch up to date with the upstream-health checker change in desirecore#222. No conflicts; the manifest keeps version 1.5.17 and 145 top-level skills.
yi-ge
added a commit
that referenced
this pull request
Oct 28, 2026
## Summary This PR remediates the #213 upstream-health findings in two reviewed rounds. Each installed-scope diff was reviewed: the source path or the declared child paths, together with the root LICENSE/NOTICE/COPYING files. Each entry was then repinned or put on a reviewed hold. Per-entry decisions and compare links are in `docs/upstream-health-213-remediation.md`, which covers the first review and then the "Follow-up review (2026-10-27)" section. - **Round 1 (2026-10-19):** 28 reported entries. - **Round 2 (2026-10-27, squash-merged from #228):** the upstream changes that landed after round 1. #222 is now on `main`, and this branch has been updated with `main`. ## Changes - **Repins.** Round 1 repinned 24 pointers. Round 2 repinned 16, some of them again: - Round 1: agent-reach, anatomy, archify, blog-chart, blog-repurpose, brainstorming, dingtalk-cli, follow-builders, humanizer, humanlayer-skills, impeccable, larksuite-cli, last30days, mattpocock-skills, planning-with-files(-zh), redbookskills, reverse-engineer-anything, systematic-debugging, taste-skill, translate-book, video-use, wechatpay-skills, wecom-cli. - Round 2: archify, banana, brainstorming, dingtalk-cli, follow-builders, frontend-slides, himalaya, impeccable, larksuite-cli, last30days, mattpocock-skills, planning-with-files(-zh), redbookskills, reverse-engineer-anything, taste-skill. - For each repin, `entry.json` and the catalog sidecar stay in sync: refs, compliance, review timestamps, observed versions, license evidence and compatibility requirements. - **Three new collection children** with reviewed zh-CN/en-US summaries: - `rpi` (humanlayer-skills): explicit invocation only. A real summary replaces the upstream text, which only said to invoke it by name. - `chief-of-staff` (mattpocock-skills): from upstream's in-progress folder, manual invocation only. - `wecomcli-pptx` (wecom-cli): needs the separately installed wecom-cli. - **License.** - archify: upstream relicensed from MIT to Apache-2.0. The earlier MIT grants remain upstream in LICENSE-MIT and NOTICE. - humanlayer-skills: MIT license evidence and review dates recorded. - **External-dependency disclosures**, following the repository policy: - brainstorming: visual-companion logo telemetry. - planning-with-files: automatic hooks and their Python 3 requirement. - archify: an opt-in global-rules edit. - taste-skill: public image APIs and CDN resources. - wechatpay-skills: knowledge-base sync. - banana: Python 3.11+, Gemini billing and data retention. - himalaya: the separate CLI and mail credentials, and sending without built-in confirmation. - frontend-slides: the Playwright/Chromium download. - impeccable: the optional OpenAI image fallback and SHA-256-pinned downloads. - last30days: Bright Data and the other optional providers. - reverse-engineer-anything: tooling and the authorization gates. - Updated summaries for the dingtalk-cli and mattpocock-skills children. - Unsupported domain and tool counts are removed from the dingtalk-cli summary. - **Reviewed holds** (`upstream-health-hold.json`): - `geo-optimizer`: upstream moved the workflow outside the installed subtree, so the new layout would install broken. - `nuwa-skill`: SKILL.md recommends the author's other projects whenever a request goes beyond the skill's scope. - `agent-reach`: 1.6.0 defaults to an anti-detection browser that copies site cookies from a connected Chrome. - `wecom-cli`: new wecomcli-sheet content is adapted without attribution from the source-available xlsx skill in anthropics/skills, while the repository declares MIT. - `marketingskills`: a referral promotion and paid "Verified Partner" placements in agent-facing content. This hold went stale again on 2026-10-28; see below. - **Manifest** goes to 1.5.18; #226 took 1.5.17 on `main`, and inventory counts follow `main`. watch is left alone because #221 already pins it on `main`. ## Review decisions worth a second look - **archify proactive mode.** It edits the agent's global rules file only after explicit user consent, and the edit is reversible. Disclosed rather than held. - **wechatpay-skills knowledge-base sync.** The sync can overwrite installed files from the official CDN. This behavior predates this PR; disclosed rather than held. - **agent-reach and wecom-cli holds.** Both are judgment calls. The review notes list what a later bump would need to disclose. - **reverse-engineer-anything version.** Its upstream `metadata.version` revision is recorded as an opaque version. ## Validation Run on 2026-10-28 on this branch after merging `main` (`7a3ea30`, which includes #226): - Unit tests: 122 pass. By suite: i18n 19, catalog-metadata 51, collection generator 10, upstream health 42. - Validators: `validate_catalog_metadata.py --require-complete`, `validate-i18n.py` and `translate.py --check` pass with 0 errors. Warnings go from 105 on `main` to 103, and none are new. - Collections: `gen-collection-children.py --check` reproduces all ten pinned collections, including aws-agent-toolkit from #226. - `git diff --check` is clean. - Sensitive-token scan: passed for both rounds (run privately by the maintainer). The `main` merge and the manifest bump add only generic text. Each round was also checked online against its reviewed heads; see the remediation record. Third-party programs and live account services were not executed. ## Not clean as of 2026-10-28 The online check on this branch covered 113 entries, and nothing is broken. One transient TLS failure passed when rechecked individually. Five `held` findings cover four holds: geo-optimizer counts twice, nuwa-skill, agent-reach and wecom-cli once each. Still actionable: - **marketingskills:** upstream moved again (`0cd9b3a`), so its hold is `stale-hold`. The two undeclared children are still reported as `new-skill`. - **reverse-engineer-anything:** `outdated` against a newer head (`40b9c03`). - **agent/video-director:** `outdated` against a newer head (`4652b1d`). It was added on `main` by #225. - **aws-agent-toolkit:** `outdated` against a newer head (`655a323`). It was added on `main` by #226. These newer heads are not reviewed here. #213 stays open for the next round. Refs #213.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
中文
将 AWS 官方维护的 Agent Toolkit for AWS 中的技能注册为一个可按需选择子技能的市场合集。它是包含 Skills、MCP 与宿主插件的工具包；本 PR 只收录规范
skills/目录的 118 个技能，不重复收录plugins/中的副本，也不自动接入 AWS MCP。entry.json、catalog-metadata.v1.json、collection-child-overrides.json三份元数据；更新 manifest 的顶层技能数 144 → 145。没有复制上游 SKILL.md、参考资料、脚本、引擎或二进制。e8c630949189f03b3dd77388c86b06a7f2f911a9；子技能路径相对于仓库根目录，合集不设置互斥的source.path。ID、路径与可识别版本由现有生成器提取；未发布/不可识别的版本保持 unknown。LICENSE为 Apache-2.0，保留NOTICE证据路径；community / allowed，维护者未验证、upstreamEndorsed=false，使用通用图标。审核版本与来源版本完全一致，审核仅涵盖来源、清单、元数据、许可及依赖披露，不是软件安全认证。English
Register the 118 canonical skills from the AWS-maintained Agent Toolkit for AWS as one selectable collection. The upstream toolkit also contains MCP integrations and host plugins; this contribution lists only
skills/, excludes duplicate plugin copies and does not configure AWS MCP.This is a metadata-only addition: one pointer, one catalog sidecar, reproducible bilingual child-summary overrides and a one-entry manifest count change. Source is pinned to
e8c630949189f03b3dd77388c86b06a7f2f911a9. Preserve upstream IDs, repository-relative paths and generator-recognized versions; do not invent releases. English upstream bodies remain unchanged.The pinned root LICENSE is Apache-2.0, with NOTICE recorded. This independent community listing uses unverified maintainer identity, nominative naming and a generic icon;
upstreamEndorsed=false. The ref-bound review covers source, inventory, metadata, licensing and prerequisite disclosure, not software safety or runtime certification. Bilingual discovery, execution guidance and compatibility disclose separately configured tools, MCP, credentials, permissions, terms and charges, explicit authorization for external changes, and stopping on missing prerequisites rather than fabricating success.验证 / Validation
uv run scripts/i18n/validate-i18n.pyuv run scripts/catalog/validate_catalog_metadata.py --require-completeuv run scripts/i18n/translate.py --checkuv run scripts/gen-collection-children.py aws-agent-toolkit --check— PASS, 118 children. The first HTTP/1.1 clone exceeded the local five-minute limit; a per-invocation HTTP/2 retry passed without changing global Git configuration. The same generator plus presentation overrides also matched all 118 independently API-fetched blobs verified against the pinned Git tree.mainbaseline, with none for this new listing.macOS 补测 / Follow-up acceptance (2026-10-25)
在独立的 DesireCore 10.0.187 macOS 实例接入本 PR 精确来源，GUI 正确展示 118 项及中文摘要；按需实际安装
aws-cloudformation、aws-compute、aws-sdk-python-usage，详情显示 3/118，资源页可发现并启用。三项安装锁正确记录 provider / collection / 固定 ref / digest，全部 31 个文件与上游固定 Git blob 匹配。更新描述只补充验收边界，来源 pin 与上游内容不变。An isolated macOS DesireCore 10.0.187 instance displayed all 118 children with Chinese summaries and installed three representative children through the normal GUI. All three installation locks were present and all 31 files matched pinned upstream blobs. The evidence update changes no source pin or upstream content.
未执行技能配套脚本、全部 118 项业务流程或 AWS 账户操作；未读取 AWS 凭据或登录，Windows/Linux 未实测，正文仍以上游英文为主。未运行本地全量测试或全量 typecheck。相关 MCP 的验收和兼容性修正单独记录于 registry PR14，不能把公开文档查询当成账户业务可用。
Supporting scripts, all 118 business workflows, AWS account operations and Windows/Linux were not tested. No AWS credentials or sign-in were used, no full suite/typecheck ran, and upstream bodies remain primarily English. Public MCP documentation access is separately recorded in registry PR14 and does not establish account readiness.