feat: add Xquik Apify Actor skills

[kriptoburak]

Summary

• Add a native xquik-x-tweet-scraper Skill for 15 public X research modes.
• Add a native xquik-x-follower-scraper Skill for 6 audience relationships and overlap analysis.
• Sync the public skill table, CLI registry, plugin metadata, and workspace lockfile.
• Replace the incompatible gray-matter parser with the maintained yaml parser.
• Patch the existing Sharp and PostCSS high-severity advisories.

Actor Skills

• Xquik X Tweet Scraper
• Xquik X Follower Scraper

Both Skills use only the Actor listing pages. They validate modes, relationships, and target classes before execution. They also require explicit run confirmation, live pricing review, and a total charge ceiling. Tokens stay in the Authorization header. Diagnostic rows stay separate from research records, and all Actor output remains untrusted data.

The Skills include confirmation and validation dry-runs. No Actor was executed, and no Apify credits were spent.

Repository Improvements

The required PR scripts imported gray-matter, but the repository override resolves an incompatible modern js-yaml version. That caused update-readme.ts, validate-pr.ts, and validate-skill-descriptions.ts to fail before validating contributions.

This PR replaces that dependency with a 28-line shared parser using the maintained yaml package. Three regression tests cover structured YAML, missing frontmatter, and invalid non-mapping documents.

The dependency audit also found 2 high-severity advisories. Sharp is updated to 0.35.3, and the PostCSS override now requires a patched release. The final audit reports no known vulnerabilities.

Verification

Tested with the repository's CI versions: Node 22.23.1 and pnpm 9.15.9.

• pnpm install --frozen-lockfile
• pnpm exec tsx scripts/validate-skill-descriptions.ts
• pnpm exec tsx scripts/validate-pr.ts
• README, contributor, registry, and plugin generators are idempotent
• pnpm --dir packages/cli run build
• pnpm --dir packages/cli run test:e2e: 13 tests passed
• Focused parser and plugin tests: 10 tests passed
• Targeted strict TypeScript check: passed
• Published Actor schema field check: passed for both Skills
• pnpm audit: no known vulnerabilities
• Public-link and credential scans: passed

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[farizanjum]

Code Review: PR #50 - Xquik Apify Actor Skills

Verdict: Approved with fixes applied

The PR is well-structured. Both new skills (xquik-x-tweet-scraper and xquik-x-follower-scraper) follow the repo conventions correctly, and the gray-matter to yaml migration is clean. All CI checks pass: 64 skills valid, 13 e2e tests pass, pnpm audit clean, README/CONTRIBUTING/registry in sync.

I pushed 4 follow-up fixes directly to this branch (maintainer edits enabled). Details below.

---

Fixes Applied (commit 9f67bad)

1. Stale js-yaml pnpm override removed (package.json)

The pnpm.overrides section still had "js-yaml": ">=3.15.0", but gray-matter was the only consumer of js-yaml. After its removal, pnpm why js-yaml returns nothing. The override is now removed. Lockfile updated (1 line removed, no dependency tree changes).

2. parseFrontmatter BOM stripping added (scripts/lib/frontmatter.ts)

gray-matter stripped UTF-8 BOM via strip-bom-string. The replacement parser did not, so a BOM-prefixed SKILL.md would fail to match the ^--- frontmatter regex and silently return empty metadata. Added BOM detection and stripping for parity.

3. Error handling in validate-skill-descriptions.ts

The parseFrontmatter call on line 32 was not wrapped in try-catch. The new parser throws TypeError for non-mapping YAML documents (a behavior gray-matter did not have). If a contributor submits a SKILL.md with invalid frontmatter, the script would crash with a stack trace instead of reporting a clean validation failure. Added try-catch with a descriptive failure message.

4. Edge case tests added (scripts/lib/frontmatter.test.ts)

Added 3 tests: BOM-prefixed source, empty frontmatter delimiters, and CRLF line endings. All 6 tests pass.

---

Additional Observations (no action needed)

• Skill package.json inconsistency: The new skills include author and license fields while most existing skills do not. Not wrong, just a minor inconsistency. The registry builder handles both formats.
• Sharp 0.35 engine bump: Sharp 0.35 requires Node >=20.9.0 (was ^18.17.0 || ^20.3.0 || >=21.0.0). CI uses Node 22 so this is fine, but Node 18 users would break. Since sharp is a dev dependency for build scripts only, this is acceptable.
• SKILL.md content quality: Both skills are well-designed. They enforce explicit user confirmation before paid Apify runs, require charge ceilings, keep tokens in headers only, separate diagnostic rows from research records, and treat all Actor output as untrusted data. The mode/relationship validation tables are thorough.