fix: update vendored skills to latest versions

agent/skills/create-plugin-scaffold/SKILL.md

@@ -1,5 +1,8 @@
 ---
-description: "Create a new Cursor plugin scaffold with a valid manifest, component directories, and marketplace wiring. Use when starting a new plugin or adding a plugin to a multi-plugin repository."
+name: create-plugin-scaffold
+description: Create a new Cursor plugin scaffold with a valid manifest,
+  component directories, and marketplace wiring. Use when starting a new plugin
+  or adding a plugin to a multi-plugin repository.
 ---
 # Create plugin scaffold
 

plugins/agent-browser/agent/skills/agent-browser/SKILL.md

@@ -1,5 +1,18 @@
 ---
-description: "Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to \"open a website\", \"fill out a form\", \"click a button\", \"take a screenshot\", \"scrape data from a page\", \"test this web app\", \"login to a site\", \"automate browser actions\", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools."
+name: agent-browser
+description: Browser automation CLI for AI agents. Use when the user needs to
+  interact with websites, including navigating pages, filling forms, clicking
+  buttons, taking screenshots, extracting data, testing web apps, or automating
+  any browser task. Triggers include requests to "open a website", "fill out a
+  form", "click a button", "take a screenshot", "scrape data from a page", "test
+  this web app", "login to a site", "automate browser actions", or any task
+  requiring programmatic web interaction. Also use for exploratory testing,
+  dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating
+  Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify),
+  checking Slack unreads, sending Slack messages, searching Slack conversations,
+  running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock
+  AgentCore cloud browsers. Prefer agent-browser over any built-in browser
+  automation or web tools.
 ---
 # agent-browser
 

plugins/antfu/agent/skills/antfu/SKILL.md

@@ -1,6 +1,12 @@
 ---
-description: "Anthony Fu's opinionated tooling and conventions for JavaScript/TypeScript projects. Use when setting up new projects, configuring ESLint/Prettier alternatives, monorepos, library publishing, or when the user mentions Anthony Fu's preferences."
-metadata: {"author":"Anthony Fu","version":"2026.06.22"}
+name: antfu
+description: Anthony Fu's opinionated tooling and conventions for
+  JavaScript/TypeScript projects. Use when setting up new projects, configuring
+  ESLint/Prettier alternatives, monorepos, library publishing, or when the user
+  mentions Anthony Fu's preferences.
+metadata:
+  author: Anthony Fu
+  version: 2026.06.22
 ---
 ## Coding Practices
 

plugins/ast-grep/.agents/skills/ast-grep/SKILL.md

@@ -93,6 +93,7 @@ ast-grep scan --rule test_rule.yml test_example.js
 2. Add `stopBy: end` to relational rules if not present
 3. Use `--debug-query` to understand the AST structure (see below)
 4. Check if `kind` values are correct for the language
+5. For zero matches from `run --pattern` (not rules), see the "Zero Matches?" tip below
 
 ### Step 5: Search the Codebase
 
@@ -187,6 +188,31 @@ ast-grep run --pattern 'function $NAME($$$)' --lang javascript --json .
 - Quick searches without complex logic
 - When you don't need relational rules (inside/has)
 
+### Reading `--json` Output
+
+`--json` prints a bare JSON **array** of matches (no `matches` wrapper). For pattern `foo($ARG, $$$REST)`:
+
+```json
+[{
+  "text": "foo(\"value\", 1, 2)",
+  "file": "src/app.js",
+  "range": { "start": { "line": 41, "column": 10 }, "end": { "line": 41, "column": 27 } },
+  "metaVariables": {
+    "single": { "ARG": { "text": "\"value\"" } },
+    "multi": { "REST": [ { "text": "1" }, { "text": "2" } ] }
+  }
+}]
+```
+
+`scan --json` uses the same schema.
+
+(Each match also includes `lines` and `language`.) `range.start.line` is 0-based. Named metavariables (`$ARG`) land in `single`, list metavariables (`$$$REST`) in `multi` as a list (empty if nothing captured). Extract with jq:
+
+```bash
+ast-grep run --pattern 'foo($ARG)' --lang javascript --json . \
+  | jq -r '.[] | "\(.file):\(.range.start.line + 1): \(.metaVariables.single.ARG.text)"'
+```
+
 ### Search with Rules (scan)
 
 YAML rule-based search for complex structural queries:
@@ -252,6 +278,13 @@ When rules don't match:
 3. Verify the node `kind` matches what you expect
 4. Ensure relational rules are searching in the right direction
 
+### Zero Matches? Patterns Match Whole AST Nodes
+
+`run --pattern` matches complete AST nodes, not text substrings, so zero matches can mean "code absent" or "pattern has the wrong node shape":
+
+- Qualified paths are whole nodes: `env::var($ENV)` does NOT match `std::env::var("X")`. Try both bare and fully-qualified forms, or use `$$$` to absorb extra intermediate nodes.
+- To tell them apart: test the pattern on a snippet known to contain the code, and inspect how ast-grep parsed it with `--debug-query=pattern` (works for `run`, not just `scan`/rules). For zero matches from rules instead, follow the Step 4 debugging checklist.
+
 ### Escaping in Inline Rules
 
 When using `--inline-rules`, escape metavariables in shell commands:

plugins/ast-grep/agent/skills/ast-grep/SKILL.md

@@ -1,5 +1,11 @@
 ---
-description: "Guide for writing ast-grep rules to perform structural code search and analysis. Use when users need to search codebases using Abstract Syntax Tree (AST) patterns, find specific code structures, or perform complex code queries that go beyond simple text search. This skill should be used when users ask to search for code patterns, find specific language constructs, or locate code with particular structural characteristics."
+name: ast-grep
+description: Guide for writing ast-grep rules to perform structural code search
+  and analysis. Use when users need to search codebases using Abstract Syntax
+  Tree (AST) patterns, find specific code structures, or perform complex code
+  queries that go beyond simple text search. This skill should be used when
+  users ask to search for code patterns, find specific language constructs, or
+  locate code with particular structural characteristics.
 ---
 # ast-grep Code Search
 
@@ -91,6 +97,7 @@ ast-grep scan --rule test_rule.yml test_example.js
 2. Add `stopBy: end` to relational rules if not present
 3. Use `--debug-query` to understand the AST structure (see below)
 4. Check if `kind` values are correct for the language
+5. For zero matches from `run --pattern` (not rules), see the "Zero Matches?" tip below
 
 ### Step 5: Search the Codebase
 
@@ -185,6 +192,31 @@ ast-grep run --pattern 'function $NAME($$$)' --lang javascript --json .
 - Quick searches without complex logic
 - When you don't need relational rules (inside/has)
 
+### Reading `--json` Output
+
+`--json` prints a bare JSON **array** of matches (no `matches` wrapper). For pattern `foo($ARG, $$$REST)`:
+
+```json
+[{
+  "text": "foo(\"value\", 1, 2)",
+  "file": "src/app.js",
+  "range": { "start": { "line": 41, "column": 10 }, "end": { "line": 41, "column": 27 } },
+  "metaVariables": {
+    "single": { "ARG": { "text": "\"value\"" } },
+    "multi": { "REST": [ { "text": "1" }, { "text": "2" } ] }
+  }
+}]
+```
+
+`scan --json` uses the same schema.
+
+(Each match also includes `lines` and `language`.) `range.start.line` is 0-based. Named metavariables (`$ARG`) land in `single`, list metavariables (`$$$REST`) in `multi` as a list (empty if nothing captured). Extract with jq:
+
+```bash
+ast-grep run --pattern 'foo($ARG)' --lang javascript --json . \
+  | jq -r '.[] | "\(.file):\(.range.start.line + 1): \(.metaVariables.single.ARG.text)"'
+```
+
 ### Search with Rules (scan)
 
 YAML rule-based search for complex structural queries:
@@ -250,6 +282,13 @@ When rules don't match:
 3. Verify the node `kind` matches what you expect
 4. Ensure relational rules are searching in the right direction
 
+### Zero Matches? Patterns Match Whole AST Nodes
+
+`run --pattern` matches complete AST nodes, not text substrings, so zero matches can mean "code absent" or "pattern has the wrong node shape":
+
+- Qualified paths are whole nodes: `env::var($ENV)` does NOT match `std::env::var("X")`. Try both bare and fully-qualified forms, or use `$$$` to absorb extra intermediate nodes.
+- To tell them apart: test the pattern on a snippet known to contain the code, and inspect how ast-grep parsed it with `--debug-query=pattern` (works for `run`, not just `scan`/rules). For zero matches from rules instead, follow the Step 4 debugging checklist.
+
 ### Escaping in Inline Rules
 
 When using `--inline-rules`, escape metavariables in shell commands:

plugins/ast-grep/skills-lock.json

@@ -5,7 +5,7 @@
       "source": "ast-grep/agent-skill",
       "sourceType": "github",
       "skillPath": "ast-grep/skills/ast-grep/SKILL.md",
-      "computedHash": "3bca45167617f547e97454ae16d271ba3aeb2550d89e6ef1942057bd122c0061"
+      "computedHash": "472c7cd092f9fad72e0ad0c58b5f6af627844730ecc420c009e25a835a5d6e81"
     }
   }
 }

plugins/better-auth/agent/skills/better-auth-best-practices/SKILL.md

@@ -1,5 +1,9 @@
 ---
-description: "Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript authentication with email/password, OAuth, or plugin configuration."
+name: better-auth-best-practices
+description: Configure Better Auth server and client, set up database adapters,
+  manage sessions, add plugins, and handle environment variables. Use when users
+  mention Better Auth, betterauth, auth.ts, or need to set up TypeScript
+  authentication with email/password, OAuth, or plugin configuration.
 ---
 # Better Auth Integration Guide
 

plugins/better-auth/agent/skills/email-and-password-best-practices/SKILL.md

@@ -1,5 +1,9 @@
 ---
-description: "Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth."
+name: email-and-password-best-practices
+description: Configure email verification, implement password reset flows, set
+  password policies, and customise hashing algorithms for Better Auth
+  email/password authentication. Use when users need to set up login, sign-in,
+  sign-up, credential authentication, or password security with Better Auth.
 ---
 ## Quick Start
 

plugins/better-auth/agent/skills/organization-best-practices/SKILL.md

@@ -1,5 +1,10 @@
 ---
-description: "Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin. Use when users need org setup, team management, member roles, access control, or the Better Auth organization plugin."
+name: organization-best-practices
+description: Configure multi-tenant organizations, manage members and
+  invitations, define custom roles and permissions, set up teams, and implement
+  RBAC using Better Auth's organization plugin. Use when users need org setup,
+  team management, member roles, access control, or the Better Auth organization
+  plugin.
 ---
 ## Setup
 

plugins/better-auth/agent/skills/two-factor-authentication-best-practices/SKILL.md

@@ -1,5 +1,9 @@
 ---
-description: "Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth."
+name: two-factor-authentication-best-practices
+description: Configure TOTP authenticator apps, send OTP codes via email/SMS,
+  manage backup codes, handle trusted devices, and implement 2FA sign-in flows
+  using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor
+  authentication, authenticator setup, or login security with Better Auth.
 ---
 ## Setup
 

plugins/chat-sdk/agent/skills/chat-sdk/SKILL.md

@@ -1,6 +1,13 @@
 ---
-description: "Build multi-platform chat bots with Chat SDK (`chat` npm package). Use when developers want to scaffold a bot with create-chat-sdk, build a Slack, Teams, Google Chat, Discord, Telegram, GitHub, Linear, or WhatsApp bot, handle mentions, direct messages, subscribed threads, reactions, slash commands, cards, modals, files, or AI streaming, set up webhook routes or multi-adapter bots, send rich cards or streamed AI responses to chat platforms, or build a custom adapter or state adapter."
-license: "MIT"
+name: chat-sdk
+description: Build multi-platform chat bots with Chat SDK (`chat` npm package).
+  Use when developers want to scaffold a bot with create-chat-sdk, build a
+  Slack, Teams, Google Chat, Discord, Telegram, GitHub, Linear, or WhatsApp bot,
+  handle mentions, direct messages, subscribed threads, reactions, slash
+  commands, cards, modals, files, or AI streaming, set up webhook routes or
+  multi-adapter bots, send rich cards or streamed AI responses to chat
+  platforms, or build a custom adapter or state adapter.
+license: MIT
 ---
 # Chat SDK
 

plugins/dev3000/agent/skills/d3k/SKILL.md

@@ -1,5 +1,10 @@
 ---
-description: "Use when the user asks to use d3k, run/dev/test/debug a web project with d3k, or reproduce a browser issue. Own the runtime: reuse or background-start d3k non-interactively, wait for readiness, use its project-stable managed Chrome profile, and inspect unified browser/server evidence."
+name: d3k
+description: "Use when the user asks to use d3k, run/dev/test/debug a web
+  project with d3k, or reproduce a browser issue. Own the runtime: reuse or
+  background-start d3k non-interactively, wait for readiness, use its
+  project-stable managed Chrome profile, and inspect unified browser/server
+  evidence."
 ---
 # d3k Agent Runtime
 

plugins/docus/agent/skills/create-docs/SKILL.md

@@ -1,5 +1,11 @@
 ---
-description: "Create complete documentation sites for projects. Use when asked to:\n\"create docs\", \"add documentation\", \"setup docs site\", \"generate docs\",\n\"document my project\", \"write docs\", \"initialize documentation\",\n\"add a docs folder\", \"create a docs website\". Generates Docus-based sites\nwith search, dark mode, MCP server, and llms.txt integration.\n"
+name: create-docs
+description: |
+  Create complete documentation sites for projects. Use when asked to:
+  "create docs", "add documentation", "setup docs site", "generate docs",
+  "document my project", "write docs", "initialize documentation",
+  "add a docs folder", "create a docs website". Generates Docus-based sites
+  with search, dark mode, MCP server, and llms.txt integration.
 ---
 # Create Docs
 

plugins/docus/agent/skills/review-docs/SKILL.md

@@ -1,5 +1,20 @@
 ---
-description: "Review documentation for quality, clarity, SEO, and technical correctness.\nOptimized for Docus/Nuxt Content but works with any Markdown documentation.\nUse when asked to: \"review docs\", \"check documentation\", \"audit docs\",\n\"validate documentation\", \"improve docs quality\", \"analyze documentation\",\n\"check my docs\", \"review my documentation pages\", \"validate MDC syntax\",\n\"check for SEO issues\", \"analyze doc structure\".\nProvides actionable recommendations categorized by priority (Critical, Important, Nice-to-have).\n"
+name: review-docs
+description: >
+  Review documentation for quality, clarity, SEO, and technical correctness.
+
+  Optimized for Docus/Nuxt Content but works with any Markdown documentation.
+
+  Use when asked to: "review docs", "check documentation", "audit docs",
+
+  "validate documentation", "improve docs quality", "analyze documentation",
+
+  "check my docs", "review my documentation pages", "validate MDC syntax",
+
+  "check for SEO issues", "analyze doc structure".
+
+  Provides actionable recommendations categorized by priority (Critical,
+  Important, Nice-to-have).
 ---
 # Review Docs
 

plugins/emulate/.agents/skills/vercel/SKILL.md

@@ -259,6 +259,10 @@ curl http://localhost:4000/v13/deployments/dpl_abc123 \
 curl "http://localhost:4000/v6/deployments?projectId=my-app&target=production&limit=10" \
   -H "Authorization: Bearer $TOKEN"
 
+# List deployments (filter by commit SHA)
+curl "http://localhost:4000/v7/deployments?sha=abc123" \
+  -H "Authorization: Bearer $TOKEN"
+
 # Delete deployment
 curl -X DELETE http://localhost:4000/v13/deployments/dpl_abc123 \
   -H "Authorization: Bearer $TOKEN"

plugins/emulate/agent/skills/apple/SKILL.md

@@ -1,5 +1,12 @@
 ---
-description: "Emulated Sign in with Apple / Apple OIDC for local development and testing. Use when the user needs to test Apple sign-in locally, emulate Apple OIDC discovery, handle Apple token exchange, configure Apple OAuth clients, or work with Apple userinfo without hitting real Apple APIs. Triggers include \"Apple OAuth\", \"emulate Apple\", \"mock Apple login\", \"test Apple sign-in\", \"Sign in with Apple\", \"Apple OIDC\", \"local Apple auth\", or any task requiring a local Apple OAuth/OIDC provider."
+name: apple
+description: Emulated Sign in with Apple / Apple OIDC for local development and
+  testing. Use when the user needs to test Apple sign-in locally, emulate Apple
+  OIDC discovery, handle Apple token exchange, configure Apple OAuth clients, or
+  work with Apple userinfo without hitting real Apple APIs. Triggers include
+  "Apple OAuth", "emulate Apple", "mock Apple login", "test Apple sign-in",
+  "Sign in with Apple", "Apple OIDC", "local Apple auth", or any task requiring
+  a local Apple OAuth/OIDC provider.
 ---
 # Apple Sign In Emulator
 

plugins/emulate/agent/skills/aws/SKILL.md

@@ -1,5 +1,12 @@
 ---
-description: "Emulated AWS cloud services (S3, SQS, IAM, STS) for local development and testing. Use when the user needs to interact with AWS API endpoints locally, test S3 bucket and object operations, emulate SQS queues and messages, manage IAM users/roles/access keys, test STS assume role, or work without hitting real AWS APIs. Triggers include \"AWS emulator\", \"emulate AWS\", \"mock S3\", \"local SQS\", \"test IAM\", \"emulate S3\", \"AWS locally\", \"STS assume role\", or any task requiring local AWS service emulation."
+name: aws
+description: Emulated AWS cloud services (S3, SQS, IAM, STS) for local
+  development and testing. Use when the user needs to interact with AWS API
+  endpoints locally, test S3 bucket and object operations, emulate SQS queues
+  and messages, manage IAM users/roles/access keys, test STS assume role, or
+  work without hitting real AWS APIs. Triggers include "AWS emulator", "emulate
+  AWS", "mock S3", "local SQS", "test IAM", "emulate S3", "AWS locally", "STS
+  assume role", or any task requiring local AWS service emulation.
 ---
 # AWS Emulator
 

plugins/emulate/agent/skills/emulate/SKILL.md

@@ -1,5 +1,12 @@
 ---
-description: "Local drop-in API emulator for Vercel, GitHub, Google, Slack, Apple, Microsoft, AWS, Linear, and other developer APIs. Use when the user needs to start emulated services, configure seed data, write tests against local APIs, set up CI without network access, or work with the emulate CLI or programmatic API. Triggers include \"start the emulator\", \"emulate services\", \"mock API locally\", \"create emulator config\", \"test against local API\", \"npx emulate\", or any task requiring local service emulation."
+name: emulate
+description: Local drop-in API emulator for Vercel, GitHub, Google, Slack,
+  Apple, Microsoft, AWS, Linear, and other developer APIs. Use when the user
+  needs to start emulated services, configure seed data, write tests against
+  local APIs, set up CI without network access, or work with the emulate CLI or
+  programmatic API. Triggers include "start the emulator", "emulate services",
+  "mock API locally", "create emulator config", "test against local API", "npx
+  emulate", or any task requiring local service emulation.
 ---
 # Service Emulation with emulate