Quality: Unsafe subprocess.run with shell-like command construction in fetch_tweet.py

.githooks/pre-commit

@@ -0,0 +1,53 @@
+#!/bin/bash
+# Pre-commit hook: scan staged changes for sensitive data
+# Install: git config core.hooksPath .githooks
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+echo "🔍 Scanning staged changes for sensitive data..."
+
+FAILED=0
+
+# Layer 1: gitleaks (if available)
+if command -v gitleaks &>/dev/null; then
+  if ! gitleaks protect --staged --config .gitleaks.toml --no-banner 2>/dev/null; then
+    echo -e "${RED}❌ gitleaks found secrets in staged changes${NC}"
+    FAILED=1
+  fi
+else
+  echo -e "${YELLOW}⚠ gitleaks not installed (brew install gitleaks), falling back to pattern scan${NC}"
+fi
+
+# Layer 2: fast regex scan (always runs, catches what gitleaks config might miss)
+STAGED_DIFF=$(git diff --cached --diff-filter=ACDMR)
+
+PATTERNS=(
+  '/Users/[a-zA-Z][a-zA-Z0-9_-]+/'
+  '/home/[a-zA-Z][a-zA-Z0-9_-]+/'
+  'C:\\Users\\[a-zA-Z]'
+  'songtiansheng'
+  'tiansheng'
+  '15366[0-9]+'
+)
+
+for pattern in "${PATTERNS[@]}"; do
+  MATCHES=$(echo "$STAGED_DIFF" | grep -nE "^\+" | grep -E "$pattern" | grep -v "^+++\|\.gitleaks\.toml\|\.githooks/\|\.gitignore\|placeholder\|example\|CLAUDE\.md" || true)
+  if [ -n "$MATCHES" ]; then
+    echo -e "${RED}❌ Found sensitive pattern '${pattern}':${NC}"
+    echo "$MATCHES" | head -5
+    FAILED=1
+  fi
+done
+
+if [ $FAILED -eq 1 ]; then
+  echo ""
+  echo -e "${RED}Commit blocked. Fix the issues above, or use --no-verify to bypass (not recommended).${NC}"
+  exit 1
+fi
+
+echo -e "${GREEN}✅ No sensitive data found in staged changes.${NC}"

.github/PULL_REQUEST_TEMPLATE.md

@@ -70,8 +70,8 @@ How has this been tested?
 - [ ] Scripts are executable (chmod +x)
 - [ ] No absolute paths or user-specific information
 - [ ] Tested in actual Claude Code session
-- [ ] Passed validation: `skill-creator/scripts/quick_validate.py`
-- [ ] Successfully packages: `skill-creator/scripts/package_skill.py`
+- [ ] Passed validation: `daymade-skill/skill-creator/scripts/quick_validate.py`
+- [ ] Successfully packages: `daymade-skill/skill-creator/scripts/package_skill.py`
 
 ### For All PRs
 

.github/workflows/benchmark.yml

@@ -0,0 +1,190 @@
+name: Benchmark Tests
+
+on:
+  schedule:
+    # Run weekly on Sundays at 2 AM UTC
+    - cron: '0 2 * * 0'
+  workflow_dispatch:
+    inputs:
+      test_type:
+        description: 'Test type to run'
+        required: true
+        default: 'all'
+        type: choice
+        options:
+          - all
+          - scrape
+          - annotation
+          - full
+
+env:
+  NODE_VERSION: '20'
+
+jobs:
+  scrape-benchmark:
+    name: Scrape Success Rate Benchmark
+    runs-on: ubuntu-latest
+    if: github.event.inputs.test_type == 'all' || github.event.inputs.test_type == 'scrape' || github.event.inputs.test_type == 'full'
+    timeout-minutes: 60
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+          cache-dependency-path: cloud/package-lock.json
+
+      - name: Install dependencies
+        working-directory: cloud
+        run: npm ci
+
+      - name: Install Playwright browsers
+        working-directory: cloud
+        run: npx playwright install --with-deps chromium
+
+      - name: Run scrape benchmark
+        working-directory: cloud
+        env:
+          JINA_AI_API_KEY: ${{ secrets.JINA_AI_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
+          SUPABASE_ANON_KEY: ${{ secrets.SUPABASE_ANON_KEY }}
+        run: |
+          npx vitest run tests/benchmark/scrape-benchmark.ts --reporter=verbose 2>&1 | tee scrape-benchmark.log
+
+      - name: Upload benchmark results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: scrape-benchmark-results
+          path: |
+            cloud/tests/benchmark/scrape-benchmark-report.json
+            cloud/scrape-benchmark.log
+          retention-days: 30
+
+      - name: Check success rate threshold
+        working-directory: cloud
+        run: |
+          if [ -f tests/benchmark/scrape-benchmark-report.json ]; then
+            SUCCESS_RATE=$(jq -r '.summary.successRate' tests/benchmark/scrape-benchmark-report.json | sed 's/%//')
+            echo "Success Rate: ${SUCCESS_RATE}%"
+            if (( $(echo "$SUCCESS_RATE >= 95" | bc -l) )); then
+              echo "✅ SUCCESS: Meet target of 95%"
+              exit 0
+            else
+              echo "❌ FAILURE: Below target of 95%"
+              exit 1
+            fi
+          else
+            echo "Report not generated"
+            exit 1
+          fi
+
+  annotation-benchmark:
+    name: Annotation Accuracy Benchmark
+    runs-on: ubuntu-latest
+    if: github.event.inputs.test_type == 'all' || github.event.inputs.test_type == 'annotation' || github.event.inputs.test_type == 'full'
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+          cache-dependency-path: cloud/package-lock.json
+
+      - name: Install dependencies
+        working-directory: cloud
+        run: npm ci
+
+      - name: Run annotation accuracy test
+        working-directory: cloud
+        run: |
+          npx vitest run tests/benchmark/annotation-accuracy.ts --reporter=verbose 2>&1 | tee annotation-accuracy.log
+
+      - name: Upload benchmark results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: annotation-accuracy-results
+          path: |
+            cloud/tests/benchmark/annotation-accuracy-report.json
+            cloud/annotation-accuracy.log
+          retention-days: 30
+
+      - name: Check accuracy threshold
+        working-directory: cloud
+        run: |
+          if [ -f tests/benchmark/annotation-accuracy-report.json ]; then
+            ACCURACY=$(jq -r '.summary.positionAccuracy' tests/benchmark/annotation-accuracy-report.json | sed 's/%//')
+            echo "Position Accuracy: ${ACCURACY}%"
+            if (( $(echo "$ACCURACY >= 98" | bc -l) )); then
+              echo "✅ SUCCESS: Meet target of 98%"
+              exit 0
+            else
+              echo "❌ FAILURE: Below target of 98%"
+              exit 1
+            fi
+          else
+            echo "Report not generated"
+            exit 1
+          fi
+
+  full-benchmark:
+    name: Full Benchmark Suite
+    runs-on: ubuntu-latest
+    if: github.event.inputs.test_type == 'full'
+    needs: [scrape-benchmark, annotation-benchmark]
+    timeout-minutes: 90
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+
+      - name: Generate combined report
+        run: |
+          echo "# 📊 Full Benchmark Report" > benchmark-report.md
+          echo "" >> benchmark-report.md
+          echo "Generated at: $(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> benchmark-report.md
+          echo "" >> benchmark-report.md
+
+          if [ -f scrape-benchmark-results/scrape-benchmark-report.json ]; then
+            echo "## Scraping Success Rate" >> benchmark-report.md
+            cat scrape-benchmark-results/scrape-benchmark-report.json | jq -r '.summary | to_entries[] | "- \(.key): \(.value)"' >> benchmark-report.md
+            echo "" >> benchmark-report.md
+          fi
+
+          if [ -f annotation-accuracy-results/annotation-accuracy-report.json ]; then
+            echo "## Annotation Accuracy" >> benchmark-report.md
+            cat annotation-accuracy-results/annotation-accuracy-report.json | jq -r '.summary | to_entries[] | "- \(.key): \(.value)"' >> benchmark-report.md
+          fi
+
+      - name: Upload combined report
+        uses: actions/upload-artifact@v4
+        with:
+          name: full-benchmark-report
+          path: benchmark-report.md
+
+      - name: Create GitHub Issue on failure
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `❌ Benchmark Failed - ${new Date().toISOString().split('T')[0]}`,
+              body: `Benchmark tests failed. Check the [Actions run](${context.payload.repository.html_url}/actions/runs/${context.runId}) for details.`,
+              labels: ['benchmark', 'automated']
+            });

.gitignore

@@ -59,6 +59,7 @@ Thumbs.db
 *.tgz
 *.rar
 *.7z
+*.skill
 
 # Build artifacts
 *.o
@@ -90,5 +91,14 @@ recovered_deep_research/
 # OpenCLI cache
 .opencli/
 
-# Eval workspaces (contain test data with personal info)
-douban-skill-workspace/
+# Eval / runtime workspaces (test data, snapshots — never committed)
+*-workspace/
+.gstack/
+
+# Claude Code local settings
+.claude/settings.local.json
+.claude/archive/
+
+# Generated artifacts
+coverage/
+node_modules/

.gitleaks.toml

@@ -0,0 +1,68 @@
+# Gitleaks custom rules for claude-code-skills repo
+# Catches personal info that shouldn't be in an open source repo
+
+title = "claude-code-skills sensitive data rules"
+
+[extend]
+useDefault = true
+
+# Global allowlist: files that are allowed to contain patterns
+# (the config file itself, hooks, and contribution guides)
+[allowlist]
+paths = [
+  '''\.gitleaks\.toml$''',
+  '''\.githooks/''',
+  '''CONTRIBUTING\.md$''',
+  '''CLAUDE\.md$''',
+]
+regexes = [
+  # Douban mobile app's public API key (documented as public, hardcoded for zero-config usage)
+  '''0dad551ec0f84ed02907ff5c42e8ec70''',
+  # Standard example JWT header from jwt.io. Base64URL-decodes to:
+  #   {"alg":"HS256","typ":"JWT"}
+  # It is public metadata, not a secret, and appears in repomix-safe-mixer
+  # documentation as a placeholder (literally written with "..." suffix).
+  '''eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.\.\.''',
+  # Repo owner's public contact email in README/marketplace metadata
+  '''daymadev89@gmail\.com''',
+  # Common placeholder user paths used in documentation examples
+  '''/Users/(?:username|name|you|user)/''',
+  '''/home/username/''',
+  '''C:\\Users\\(?:username|name)\\''',
+]
+
+[[rules]]
+id = "absolute-user-path-macos"
+description = "Hardcoded macOS user home directory path"
+regex = '''/Users/[a-zA-Z][a-zA-Z0-9_-]+/'''
+tags = ["pii", "path"]
+
+[[rules]]
+id = "absolute-user-path-linux"
+description = "Hardcoded Linux home directory path"
+regex = '''/home/[a-zA-Z][a-zA-Z0-9_-]+/'''
+tags = ["pii", "path"]
+
+[[rules]]
+id = "windows-user-path"
+description = "Hardcoded Windows user profile path"
+regex = '''C:\\Users\\[a-zA-Z][a-zA-Z0-9_-]+\\'''
+tags = ["pii", "path"]
+
+[[rules]]
+id = "phone-number-cn"
+description = "Chinese mobile phone number"
+regex = '''\b1[3-9]\d{9}\b'''
+tags = ["pii", "phone"]
+
+[[rules]]
+id = "douban-user-id-literal"
+description = "Hardcoded Douban user ID"
+regex = '''songtiansheng'''
+tags = ["pii", "username"]
+
+[[rules]]
+id = "email-personal"
+description = "Personal email address"
+regex = '''[a-zA-Z0-9._%+-]+@(?:gmail|qq|163|126|outlook|hotmail|yahoo|icloud|foxmail)\.[a-zA-Z]{2,}'''
+tags = ["pii", "email"]

.pii-path-patterns

@@ -0,0 +1,4 @@
+# Repo-specific local/generated artifact paths that must never be committed
+(^|/)coverage(/|$)
+(^|/)node_modules(/|$)
+(^|/).*\.db$

.pre-commit-config.yaml

@@ -0,0 +1,34 @@
+minimum_pre_commit_version: "3.2.0"
+default_install_hook_types:
+  - pre-commit
+  - pre-push
+default_stages:
+  - pre-commit
+  - pre-push
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-merge-conflict
+      - id: check-added-large-files
+        args:
+          - --maxkb=1500
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks
+        stages:
+          - pre-commit
+
+  - repo: local
+    hooks:
+      - id: repo-path-guard
+        name: repo path guard
+        entry: python3 scripts/repo_path_guard.py
+        language: system
+        pass_filenames: true
+        stages:
+          - pre-commit
+          - pre-push