v1.4.0 — 35 ECC Skills (139 Total)

What's New

🧠 ECC Agent Engineering (35 skills)

Curated from 278 ECC skills — framework-specific, ECC-internal, and domain-niche excluded. All pass SkillSpector (LOW/SAFE).

Agent Engineering & Quality (9)
safety-guard · token-budget-advisor · intent-driven-development · verification-loop · eval-harness · agent-self-evaluation · prompt-optimizer · rules-distill · knowledge-ops

Codebase Intelligence (4)
codebase-onboarding · repo-scan · code-tour · search-first

Development Governance (8)
blueprint · strategic-compact · enterprise-agent-ops · production-audit · error-handling · delivery-gate · coding-standards · context-budget

Security (3)
security-review · security-scan · security-bounty-hunter

Design & UI (4)
brand-discovery · brand-voice · frontend-design-direction · make-interfaces-feel-better

Operations & Cost (5)
continuous-agent-loop · cost-tracking · cost-aware-llm-pipeline · automation-audit-ops · connections-optimizer

Engineering Practices (2)
mcp-server-patterns · backend-patterns

📊 104 → 139 skills total

Full details: https://github.com/JZKK720/cubecloud-skilldbundle-setup

v1.3.0 — Architecture Diagram + spec-kit Integration

What's New

🏗️ 5-Layer Architecture Diagram

Mermaid diagram showing all system layers: Design Systems → CLIs/MCP → Skills → Agent Commands → Project Bootstrap.

📐 spec-kit Integration

• \specify\ CLI v0.13.0 fully documented as Layer 4: project bootstrap
• \specify init --integration copilot\ produces 10 Copilot-native .agent.md\ workflow commands
• Full SDD pipeline: specify → plan → tasks → implement → converge
• Pairs with the existing \spec-driven-development\ skill

📊 Skill Growth

• 94 → 104 skills (+30 from agent-skills + ui-skills bundles, +9 from 3-repo evaluation)
• Added: loop-engineering (5), changelog-generator, ARIS ports (3), ui-skills (7), agent-skills (23)

Full details: https://github.com/JZKK720/cubecloud-skilldbundle-setup

v1.2.0 - Headroom Context Compression MCP

🧊 CubeCloud Skills Bundle v1.2.0 — Headroom Context Compression

This release adds headroom-ai as the 12th CLI tool and 7th MCP server. Headroom is a context compression layer for AI agents — it compresses tool outputs, logs, RAG chunks, files, and conversation history before they reach the LLM. 60-95% fewer tokens for JSON, 15-20% for coding agents. Same answers, fraction of the tokens.

What's new

• headroom-ai (CLI + MCP server) — installed via uv tool install "headroom-ai[proxy]". The MCP server exposes three tools to Copilot Chat: headroom_compress (shrink large outputs), headroom_retrieve (fetch original on demand), headroom_stats (compression metrics).

Resolved: Windows Defender false positive

headroom-ai depends on ast-grep-cli, whose Rust-compiled sg.exe binary triggers a Windows Defender false positive ("virus or potentially unwanted software", os error 225). This release ships a scoped Defender exclusion script (bin/add-defender-exclusion-ast-grep.ps1) that excludes only the ast-grep install path and sg.exe process — not Defender globally. The setup script now adds this exclusion automatically before attempting the headroom install (requires admin; if non-admin, it warns and points the user to the manual script).

Updated counts

	v1.1.0	v1.2.0
Skills	64	64
CLIs	11	12 (+ headroom)
MCP servers	6	7 (+ headroom)
Fork mirrors	23	23

Install

git clone https://github.com/JZKK720/cubecloud-skillsboundle-setup.git ~/dev/setup
powershell -NoProfile -ExecutionPolicy Bypass -File ~/dev/setup/setup-global-skills.ps1

If headroom fails to install on a fresh machine, run this in an elevated PowerShell first:

powershell -NoProfile -ExecutionPolicy Bypass -File ~/dev/bin/add-defender-exclusion-ast-grep.ps1

Then re-run the setup script.

Full inventory

See the README for the complete skill list, CLI table, and MCP server details.

v1.1.0 - Clean Ports of Blocked Skills

🧊 CubeCloud Skills Bundle v1.1.0 — Clean Ports of Blocked Skills

This release adds clean, security-audited ports of two skills that were previously blocked by SkillSpector for unsafe implementations. The methodologies are preserved; the dangerous code is gone.

What's new

• idea-to-design (64 skills total, up from 62) — clean port of obra/superpowers brainstorming. The upstream was blocked by SkillSpector for tool parameter abuse in stop-server.sh (the visual companion browser server). This port removes the browser server entirely and preserves the core methodology: collaborative design dialogue, hard gate before implementation, spec self-review, user review gate, transition to writing-plans. Passes SkillSpector with exit 0.
• webapp-testing (clean port) — the JZKK720/oz-skills version was blocked for HIGH TM1 (shell=True in scripts/with_server.py:69). This port removes all bundled scripts and preserves the reconnaissance-then-action pattern, static-vs-dynamic decision tree, and common pitfalls. The agent writes native Playwright code or uses browser MCP tools. Passes SkillSpector with exit 0 ("No security issues detected").

Philosophy

When a skill is blocked by SkillSpector, the right response isn't to disable the security gate — it's to extract the methodology and re-ship it as a clean SKILL.md with no dangerous code. Skills should be pure instruction packs, not executable attack surface.

Full install

git clone https://github.com/JZKK720/cubecloud-skillsboundle-setup.git ~/dev/setup
powershell -NoProfile -ExecutionPolicy Bypass -File ~/dev/setup/setup-global-skills.ps1

Skills still blocked (by design, no clean port possible)

Skill	Reason	Alternative
last30days	Info stealer (reads browser cookies)	use agent-reach
ui-ux-pro-max	Prompt extraction + unsafe defaults	use hallmark + taste-skill
anysearch	Vulnerable requests==2.20 (8 CVEs)	none

Full inventory

See the README for the complete skill list, CLI table, and MCP server details.

v1.0.0 - Initial Release

🧊 CubeCloud Skills Bundle v1.0.0 — Initial Release

The first tagged release of the one-command VS Code Copilot Chat skills stack for Windows.

What's in this release

• 62 skills discovered by Copilot Chat (superpowers methodology, Azure patterns, oz-skills, design systems, code review, debugging, and more)
• 11 CLIs on PATH (skillspector, skills-ref, specify, agent-reach, graphify, markitdown, gbrain, scrapling, uipro, firecrawl, skillopt-eval)
• 6 MCP servers configured in VS Code mcp.json (markitdown, skillspector, firecrawl, scrapling, gbrain, graphify)
• 23 fork mirrors (22 JZKK720 + VoltAgent/awesome-design-md)
• 74 DESIGN.md design-system files indexed by the design-md-library wrapper skill (Apple, Stripe, Linear, Vercel, Notion, Airbnb, Tesla, and 68 more)
• 5 skills blocked by SkillSpector by design (brainstorming, last30days, ui-ux-pro-max, anysearch, webapp-testing)

Security

Every skill is scanned by NVIDIA SkillSpector before install. Vulnerable skills are blocked by a hard gate, not a suggestion. See upstream/SCAN_LOG.md for the full verdict history.

Install

git clone https://github.com/JZKK720/cubecloud-skillsboundle-setup.git ~/dev/setup
powershell -NoProfile -ExecutionPolicy Bypass -File ~/dev/setup/setup-global-skills.ps1

~15 minutes total (~10 min with -SkipForks).

Highlights

• gstack-review — pre-landing PR review with 8 specialist lenses (security, testing, maintainability, performance, data-migration, api-contract, red-team), adapted from garrytan/gstack (MIT)
• design-md-library — indexes 74 real-world design systems so agents can self-serve "make it look like Stripe" requests
• Copilot utility model pins — gemma4:26b + ornith:9b wired up for local utility flows with BYOK fallback
• Reproducible — one script rebuilds the entire stack on a fresh Windows machine

Prerequisites

winget install Python.Python.3.13
winget install OpenJS.NodeJS
winget install Git.Git
winget install Microsoft.VisualStudioCode

Full inventory

See the README for the complete skill list, CLI table, and MCP server details.