[yi-ge]

Summary

This is the follow-up round for #213. It reviews the upstream changes that landed after the 2026-10-19 review in #227. On the #227 baseline, the online check on 2026-10-27 reported 21 outdated pins, two stale holds (marketingskills and nuwa-skill) and the still-valid geo-optimizer hold. Each installed-scope diff was reviewed: the source path or the declared child paths, together with the root LICENSE/NOTICE/COPYING files. Each entry was then repinned or put on a reviewed hold. The per-entry decisions and compare links are in the new "Follow-up review (2026-10-27)" section of docs/upstream-health-213-remediation.md.

Stacked on #227, which is stacked on #222. Retarget to main once both merge.

Changes

• 16 repins. These cover archify, banana, brainstorming, dingtalk-cli, follow-builders, frontend-slides, himalaya, impeccable, larksuite-cli, last30days, mattpocock-skills, planning-with-files(-zh), redbookskills, reverse-engineer-anything and taste-skill. For each one, entry.json and the catalog sidecar stay in sync: refs, compliance, review timestamps, observed versions, license evidence and compatibility requirements. No children were added or removed.
• License and versions.
  • archify: upstream relicensed from MIT to Apache-2.0. The earlier MIT grants stay in LICENSE-MIT and NOTICE upstream.
  • Upstream versions recorded: banana 3.1.0, impeccable 4.8.0, last30days 3.31.0, planning-with-files 3.25.2 and reverse-engineer-anything revision 50 (opaque).
• New or corrected external-dependency disclosures, following the repository policy:
  • banana: Python 3.11+ (was "Python 3"), Gemini billing including thinking tokens, Search-grounding retention, and local writes outside the workspace.
  • himalaya: the separately installed CLI, the operator's mail account and credentials, and send/delete without a built-in confirmation.
  • frontend-slides: the bundled PDF helper's Playwright and Chromium download, and the web-font hosts.
  • impeccable: the optional OpenAI image-API fallback (operator's key) and the unsandboxed, non-blocking hook. Downloads must now match SHA-256 digests shipped in the pinned skill.
  • last30days: the Bright Data CLI and credits for Amazon, the grok build audit and its cache, and the Arctic Shift archive.
  • reverse-engineer-anything: environment bundles on AgentEnv and Docker, Frida and debugger tooling, and the authorization gates for recording and instrumentation.
  • dingtalk-cli children: placeholder A2UI reply cards, AI-table roles and members, and standalone mind maps. mattpocock-skills' chief-of-staff summary now mentions its dated wiki folder.
• Holds (upstream-health-hold.json):
  • marketingskills (refreshed): the referral promotion and the paid "Verified Partner" placements are unchanged at the new head. The new conversion-tracking child carries the same partner messaging.
  • nuwa-skill (refreshed): only the README banner was removed. SKILL.md still recommends the author's other projects whenever a request goes beyond the skill's scope.
  • agent-reach (new): the 1.6.0 rebuild defaults to an anti-detection browser for logged-in channels and copies site cookies from a connected Chrome. The installed SKILL.md is also an unrendered template.
  • wecom-cli (new): the new wecomcli-sheet scripts and workflow are adapted without attribution from the source-available xlsx skill in anthropics/skills, while the repository declares MIT.
  • geo-optimizer: unchanged and still valid.
• Left out on purpose.
  • watch: outdated here only because this base predates feat: watch 指针更新到 1.1.2 并改为可安装 / pin watch to 1.1.2 and make it installable #221, which already pins the current head on main.
  • Manifest version: not bumped, for the same reason as fix: 同步上游健康巡检 #213 两轮已审查的市场引用 #227.

Review decisions worth a second look

• agent-reach hold. Defaulting to a stealth browser is a judgment call. The review notes list what a bump would need to disclose if the default is accepted.
• wecom-cli hold. The new C shim matches the market's own skills/xlsx except for two dashes in comments, and the recalculation macro matches it exactly. The market ships that content under its own third-party notice. The blocker is the unattributed MIT labeling, not the macro or shim behavior, which a later bump must disclose.
• marketingskills new-skill. Holds cover only upstream-path-change and outdated, so the two new children stay actionable while the pin is held. The finding clears only when the sponsor content is removed or accepted, or when the checker lets a hold cover undeclared children.
• Pre-existing, for the next review. At the current wecom-cli pin, wecomcli-pptx's anti-ai-slop.md names the source-available pptx skill in anthropics/skills as one source of a reworded checklist.

Validation

All run on 2026-10-27 against the reviewed heads:

• Unit tests: 122 pass. By suite: i18n 19, catalog-metadata 51, collection generator 10, upstream health 42.
• Validators: validate_catalog_metadata.py --require-complete, validate-i18n.py and translate.py --check pass with 0 errors. The 104 earlier warnings are unchanged, and none is new.
• Collections: gen-collection-children.py --check reproduces all nine pinned collections.
• Online health check on this branch: covered 111 entries, with nothing broken or unknown. Six held findings cover the five holds. The remaining actionable findings are marketingskills new-skill and the watch pin, which is current on main.
• Online health check on this branch merged with main (aa6a1a6): covered 112 entries, with agent/video-director resolving again. Only the held findings and marketingskills new-skill remain. Two transient TLS failures in that run passed when rechecked individually.
• git diff --check is clean.
• Sensitive-token scan: passed (run privately by the maintainer).

Third-party programs and live account services were not executed.

Refs #213.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.