v1.1.0 - Clean Ports of Blocked Skills

🧊 CubeCloud Skills Bundle v1.1.0 — Clean Ports of Blocked Skills

This release adds clean, security-audited ports of two skills that were previously blocked by SkillSpector for unsafe implementations. The methodologies are preserved; the dangerous code is gone.

What's new

• idea-to-design (64 skills total, up from 62) — clean port of obra/superpowers brainstorming. The upstream was blocked by SkillSpector for tool parameter abuse in stop-server.sh (the visual companion browser server). This port removes the browser server entirely and preserves the core methodology: collaborative design dialogue, hard gate before implementation, spec self-review, user review gate, transition to writing-plans. Passes SkillSpector with exit 0.
• webapp-testing (clean port) — the JZKK720/oz-skills version was blocked for HIGH TM1 (shell=True in scripts/with_server.py:69). This port removes all bundled scripts and preserves the reconnaissance-then-action pattern, static-vs-dynamic decision tree, and common pitfalls. The agent writes native Playwright code or uses browser MCP tools. Passes SkillSpector with exit 0 ("No security issues detected").

Philosophy

When a skill is blocked by SkillSpector, the right response isn't to disable the security gate — it's to extract the methodology and re-ship it as a clean SKILL.md with no dangerous code. Skills should be pure instruction packs, not executable attack surface.

Full install

git clone https://github.com/JZKK720/cubecloud-skillsboundle-setup.git ~/dev/setup
powershell -NoProfile -ExecutionPolicy Bypass -File ~/dev/setup/setup-global-skills.ps1

Skills still blocked (by design, no clean port possible)

Skill	Reason	Alternative
last30days	Info stealer (reads browser cookies)	use agent-reach
ui-ux-pro-max	Prompt extraction + unsafe defaults	use hallmark + taste-skill
anysearch	Vulnerable requests==2.20 (8 CVEs)	none

Full inventory

See the README for the complete skill list, CLI table, and MCP server details.