fix: CI fixes, security audit, remotion skill, lead-intelligence, npm audit (#1039)

* fix(ci): resolve cross-platform test failures

- Sanity check script (check-codex-global-state.sh) now falls back to
  grep -E when ripgrep is not available, fixing the codex-hooks sync
  test on all CI platforms. Patterns converted to POSIX ERE for
  portability.
- Unicode safety test accepts both / and \ path separators so the
  executable-file assertion passes on Windows.
- Gacha test sets PYTHONUTF8=1 so Python uses UTF-8 stdout encoding on
  Windows instead of cp1252, preventing UnicodeEncodeError on box-drawing
  characters.
- Quoted-hook-path test skipped on Windows where NTFS disallows
  double-quote characters in filenames.

* feat: port remotion-video-creation skill (29 rules), restore missing files

New skill:
- remotion-video-creation: 29 domain-specific Remotion rules covering 3D/Three.js,
  animations, audio, captions, charts, compositions, fonts, GIFs, Lottie,
  measuring, sequencing, tailwind, text animations, timing, transitions,
  trimming, and video embedding. Ported from personal skills.

Restored:
- autonomous-agent-harness/SKILL.md (was in commit but missing from worktree)
- lead-intelligence/ (full directory restored from branch commit)

Updated:
- manifests/install-modules.json: added remotion-video-creation to media-generation
- README.md + AGENTS.md: synced counts to 139 skills

Catalog validates: 30 agents, 60 commands, 139 skills.

* fix(security): pin MCP server versions, add dependabot, pin github-script SHA

Critical:
- Pin all npx -y MCP server packages to specific versions in .mcp.json
  to prevent supply chain attacks via version hijacking:
  - @modelcontextprotocol/server-github@2025.4.8
  - @modelcontextprotocol/server-memory@2026.1.26
  - @modelcontextprotocol/server-sequential-thinking@2025.12.18
  - @playwright/mcp@0.0.69 (was 0.0.68)

Medium:
- Add .github/dependabot.yml for weekly npm + github-actions updates
  with grouped minor/patch PRs
- Pin actions/github-script to SHA (was @v7 tag, now pinned to commit)

* feat: add social-graph-ranker skill — weighted network proximity scoring

New skill: social-graph-ranker
- Weighted social graph traversal with exponential decay across hops
- Bridge Score: B(m) = Σ w(t) · λ^(d(m,t)-1) ranks mutuals by target proximity
- Extended Score incorporates 2nd-order network (mutual-of-mutual connections)
- Final ranking includes engagement bonus for responsive connections
- Runs in parallel with lead-intelligence skill for combined warm+cold outreach
- Supports X API + LinkedIn CSV for graph harvesting
- Outputs tiered action list: warm intros, direct outreach, network gap analysis

Added to business-content install module. Catalog validates: 30/60/140.

* fix(security): npm audit fix — resolve all dependency vulnerabilities

Applied npm audit fix --force to resolve:
- minimatch ReDoS (3 vulnerabilities, HIGH)
- smol-toml DoS (MODERATE)
- brace-expansion memory exhaustion (MODERATE)
- markdownlint-cli upgraded from 0.47.0 to 0.48.0

npm audit now reports 0 vulnerabilities.

* fix: resolve markdown lint and yarn lockfile sync

- MD047: ensure single trailing newline on all remotion rule files
- MD012: remove consecutive blank lines in lottie, measuring-dom-nodes, trimming
- MD034: wrap bare URLs in angle brackets (tailwind, transcribe-captions)
- yarn.lock: regenerated to sync with npm audit changes in package.json

* fix: replace unicode arrows in lead-intelligence (CI unicode safety check)
This commit is contained in:
Affaan Mustafa
2026-03-31 15:08:55 -04:00
committed by GitHub
parent f7f91d9e43
commit 6cc85ef2ed
52 changed files with 4246 additions and 81 deletions

View File

@@ -0,0 +1,222 @@
---
name: lead-intelligence
description: AI-native lead intelligence and outreach pipeline. Replaces Apollo, Clay, and ZoomInfo with agent-powered signal scoring, mutual ranking, warm path discovery, and personalized outreach. Use when the user wants to find, qualify, and reach high-value contacts.
origin: ECC
---
# Lead Intelligence
Agent-powered lead intelligence pipeline that finds, scores, and reaches high-value contacts through social graph analysis and warm path discovery.
## When to Activate
- User wants to find leads or prospects in a specific industry
- Building an outreach list for partnerships, sales, or fundraising
- Researching who to reach out to and the best path to reach them
- User says "find leads", "outreach list", "who should I reach out to", "warm intros"
- Needs to score or rank a list of contacts by relevance
- Wants to map mutual connections to find warm introduction paths
## Tool Requirements
### Required
- **Exa MCP** — Deep web search for people, companies, and signals (`web_search_exa`)
- **X API** — Follower/following graph, mutual analysis, recent activity (`X_BEARER_TOKEN`, `X_ACCESS_TOKEN`)
### Optional (enhance results)
- **LinkedIn** — Via browser-use MCP or direct API for connection graph
- **Apollo/Clay API** — For enrichment cross-reference if user has access
- **GitHub MCP** — For developer-centric lead qualification
## Pipeline Overview
```
┌─────────────┐ ┌──────────────┐ ┌─────────────────┐ ┌──────────────┐ ┌─────────────────┐
│ 1. Signal │────>│ 2. Mutual │────>│ 3. Warm Path │────>│ 4. Enrich │────>│ 5. Outreach │
│ Scoring │ │ Ranking │ │ Discovery │ │ │ │ Draft │
└─────────────┘ └──────────────┘ └─────────────────┘ └──────────────┘ └─────────────────┘
```
## Stage 1: Signal Scoring
Search for high-signal people in target verticals. Assign a weight to each based on:
| Signal | Weight | Source |
|--------|--------|--------|
| Role/title alignment | 30% | Exa, LinkedIn |
| Industry match | 25% | Exa company search |
| Recent activity on topic | 20% | X API search, Exa |
| Follower count / influence | 10% | X API |
| Location proximity | 10% | Exa, LinkedIn |
| Engagement with your content | 5% | X API interactions |
### Signal Search Approach
```python
# Step 1: Define target parameters
target_verticals = ["prediction markets", "AI tooling", "developer tools"]
target_roles = ["founder", "CEO", "CTO", "VP Engineering", "investor", "partner"]
target_locations = ["San Francisco", "New York", "London", "remote"]
# Step 2: Exa deep search for people
for vertical in target_verticals:
results = web_search_exa(
query=f"{vertical} {role} founder CEO",
category="company",
numResults=20
)
# Score each result
# Step 3: X API search for active voices
x_search = search_recent_tweets(
query="prediction markets OR AI tooling OR developer tools",
max_results=100
)
# Extract and score unique authors
```
## Stage 2: Mutual Ranking
For each scored target, analyze the user's social graph to find the warmest path.
### Algorithm
1. Pull user's X following list and LinkedIn connections
2. For each high-signal target, check for shared connections
3. Rank mutuals by:
| Factor | Weight |
|--------|--------|
| Number of connections to targets | 40% — highest weight, most connections = highest rank |
| Mutual's current role/company | 20% — decision maker vs individual contributor |
| Mutual's location | 15% — same city = easier intro |
| Industry alignment | 15% — same vertical = natural intro |
| Mutual's X handle / LinkedIn | 10% — identifiability for outreach |
### Output Format
```
MUTUAL RANKING REPORT
=====================
#1 @mutual_handle (Score: 92)
Name: Jane Smith
Role: Partner @ Acme Ventures
Location: San Francisco
Connections to targets: 7
Connected to: @target1, @target2, @target3, @target4, @target5, @target6, @target7
Best intro path: Jane invested in Target1's company
#2 @mutual_handle2 (Score: 85)
...
```
## Stage 3: Warm Path Discovery
For each target, find the shortest introduction chain:
```
You ──[follows]──> Mutual A ──[invested in]──> Target Company
You ──[follows]──> Mutual B ──[co-founded with]──> Target Person
You ──[met at]──> Event ──[also attended]──> Target Person
```
### Path Types (ordered by warmth)
1. **Direct mutual** — You both follow/know the same person
2. **Portfolio connection** — Mutual invested in or advises target's company
3. **Co-worker/alumni** — Mutual worked at same company or attended same school
4. **Event overlap** — Both attended same conference/program
5. **Content engagement** — Target engaged with mutual's content or vice versa
## Stage 4: Enrichment
For each qualified lead, pull:
- Full name, current title, company
- Company size, funding stage, recent news
- Recent X posts (last 30 days) — topics, tone, interests
- Mutual interests with user (shared follows, similar content)
- Recent company events (product launch, funding round, hiring)
### Enrichment Sources
- Exa: company data, news, blog posts
- X API: recent tweets, bio, followers
- GitHub: open source contributions (for developer-centric leads)
- LinkedIn (via browser-use): full profile, experience, education
## Stage 5: Outreach Draft
Generate personalized outreach for each lead. Two modes:
### Warm Intro Request (to mutual)
```
hey [mutual name],
quick ask. i see you know [target name] at [company].
i'm building [your product] which [1-line relevance to target].
would you be open to a quick intro? happy to send you a
forwardable blurb.
[your name]
```
### Direct Cold Outreach (to target)
```
hey [target name],
[specific reference to their recent work/post/announcement].
i'm [your name], building [product]. [1 line on why this is
relevant to them specifically].
[specific low-friction ask].
[your name]
```
### Anti-Patterns (never do)
- Generic templates with no personalization
- Long paragraphs explaining your whole company
- Multiple asks in one message
- Fake familiarity ("loved your recent talk!" without specifics)
- Bulk-sent messages with visible merge fields
## Configuration
Users should set these environment variables:
```bash
# Required
export X_BEARER_TOKEN="..."
export X_ACCESS_TOKEN="..."
export X_ACCESS_TOKEN_SECRET="..."
export X_API_KEY="..."
export X_API_SECRET="..."
export EXA_API_KEY="..."
# Optional
export LINKEDIN_COOKIE="..." # For browser-use LinkedIn access
export APOLLO_API_KEY="..." # For Apollo enrichment
```
## Agents
This skill includes specialized agents in the `agents/` subdirectory:
- **signal-scorer** — Searches and ranks prospects by relevance signals
- **mutual-mapper** — Maps social graph connections and finds warm paths
- **enrichment-agent** — Pulls detailed profile and company data
- **outreach-drafter** — Generates personalized messages
## Example Usage
```
User: find me the top 20 people in prediction markets I should reach out to
Agent workflow:
1. signal-scorer searches Exa and X for prediction market leaders
2. mutual-mapper checks user's X graph for shared connections
3. enrichment-agent pulls company data and recent activity
4. outreach-drafter generates personalized messages for top ranked leads
Output: Ranked list with warm paths and draft outreach for each
```

View File

@@ -0,0 +1,85 @@
---
name: enrichment-agent
description: Pulls detailed profile, company, and activity data for qualified leads. Enriches prospects with recent news, funding data, content interests, and mutual overlap.
tools:
- Bash
- Read
- WebSearch
- WebFetch
model: sonnet
---
# Enrichment Agent
You enrich qualified leads with detailed profile, company, and activity data.
## Task
Given a list of qualified prospects, pull comprehensive data from available sources to enable personalized outreach.
## Data Points to Collect
### Person
- Full name, current title, company
- X handle, LinkedIn URL, personal site
- Recent posts (last 30 days) — topics, tone, key takes
- Speaking engagements, podcast appearances
- Open source contributions (if developer-centric)
- Mutual interests with user (shared follows, similar content)
### Company
- Company name, size, stage
- Funding history (last round amount, investors)
- Recent news (product launches, pivots, hiring)
- Tech stack (if relevant)
- Competitors and market position
### Activity Signals
- Last X post date and topic
- Recent blog posts or publications
- Conference attendance
- Job changes in last 6 months
- Company milestones
## Enrichment Sources
1. **Exa** — Company data, news, blog posts, research
2. **X API** — Recent tweets, bio, follower data
3. **GitHub** — Open source profiles (if applicable)
4. **Web** — Personal sites, company pages, press releases
## Output Format
```
ENRICHED PROFILE: [Name]
========================
Person:
Title: [current role]
Company: [company name]
Location: [city]
X: @[handle] ([follower count] followers)
LinkedIn: [url]
Company Intel:
Stage: [seed/A/B/growth/public]
Last Funding: $[amount] ([date]) led by [investor]
Headcount: ~[number]
Recent News: [1-2 bullet points]
Recent Activity:
- [date]: [tweet/post summary]
- [date]: [tweet/post summary]
- [date]: [tweet/post summary]
Personalization Hooks:
- [specific thing to reference in outreach]
- [shared interest or connection]
- [recent event or announcement to congratulate]
```
## Constraints
- Only report verified data. Do not hallucinate company details.
- If data is unavailable, note it as "not found" rather than guessing.
- Prioritize recency — stale data older than 6 months should be flagged.

View File

@@ -0,0 +1,75 @@
---
name: mutual-mapper
description: Maps the user's social graph (X following, LinkedIn connections) against scored prospects to find mutual connections and rank them by introduction potential.
tools:
- Bash
- Read
- Grep
- WebSearch
- WebFetch
model: sonnet
---
# Mutual Mapper Agent
You map social graph connections between the user and scored prospects to find warm introduction paths.
## Task
Given a list of scored prospects and the user's social accounts, find mutual connections and rank them by introduction potential.
## Algorithm
1. Pull the user's X following list (via X API)
2. For each prospect, check if any of the user's followings also follow or are followed by the prospect
3. For each mutual found, assess the strength of the connection
4. Rank mutuals by their ability to make a warm introduction
## Mutual Ranking Factors
| Factor | Weight | Assessment |
|--------|--------|------------|
| Connections to targets | 40% | How many of the scored prospects does this mutual know? |
| Mutual's role/influence | 20% | Decision maker, investor, or connector? |
| Location match | 15% | Same city as user or target? |
| Industry alignment | 15% | Works in the target vertical? |
| Identifiability | 10% | Has clear X handle, LinkedIn, email? |
## Warm Path Types
Classify each path by warmth:
1. **Direct mutual** (warmest) — Both user and target follow this person
2. **Portfolio/advisory** — Mutual invested in or advises target's company
3. **Co-worker/alumni** — Shared employer or educational institution
4. **Event overlap** — Both attended same conference, accelerator, or program
5. **Content engagement** — Target engaged with mutual's content recently
## Output Format
```
WARM PATH REPORT
================
Target: [prospect name] (@handle)
Path 1 (warmth: direct mutual)
Via: @mutual_handle (Jane Smith, Partner @ Acme Ventures)
Relationship: Jane follows both you and the target
Suggested approach: Ask Jane for intro
Path 2 (warmth: portfolio)
Via: @mutual2 (Bob Jones, Angel Investor)
Relationship: Bob invested in target's company Series A
Suggested approach: Reference Bob's investment
MUTUAL LEADERBOARD
==================
#1 @mutual_a — connected to 7 targets (Score: 92)
#2 @mutual_b — connected to 5 targets (Score: 85)
```
## Constraints
- Only report connections you can verify from API data or public profiles.
- Do not assume connections exist based on similar bios or locations alone.
- Flag uncertain connections with a confidence level.

View File

@@ -0,0 +1,98 @@
---
name: outreach-drafter
description: Generates personalized outreach messages for qualified leads. Creates warm intro requests, cold emails, X DMs, and follow-up sequences using enriched profile data.
tools:
- Read
- Grep
model: sonnet
---
# Outreach Drafter Agent
You generate personalized outreach messages using enriched lead data.
## Task
Given enriched prospect profiles and warm path data, draft outreach messages that are short, specific, and actionable.
## Message Types
### 1. Warm Intro Request (to mutual)
Template structure:
- Greeting (first name, casual)
- The ask (1 sentence — can you intro me to [target])
- Why it's relevant (1 sentence — what you're building and why target cares)
- Offer to send forwardable blurb
- Sign off
Max length: 60 words.
### 2. Cold Email (to target directly)
Template structure:
- Subject: specific, under 8 words
- Opener: reference something specific about them (recent post, announcement, thesis)
- Pitch: what you do and why they specifically should care (2 sentences max)
- Ask: one concrete low-friction next step
- Sign off with one credibility anchor
Max length: 80 words.
### 3. X DM (to target)
Even shorter than email. 2-3 sentences max.
- Reference a specific post or take of theirs
- One line on why you're reaching out
- Clear ask
Max length: 40 words.
### 4. Follow-Up Sequence
- Day 4-5: short follow-up with one new data point
- Day 10-12: final follow-up with a clean close
- No more than 3 total touches unless user specifies otherwise
## Writing Rules
1. **Personalize or don't send.** Every message must reference something specific to the recipient.
2. **Short sentences.** No compound sentences with multiple clauses.
3. **Lowercase casual.** Match modern professional communication style.
4. **No AI slop.** Never use: "game-changer", "deep dive", "the key insight", "leverage", "synergy", "at the forefront of".
5. **Data over adjectives.** Use specific numbers, names, and facts instead of generic praise.
6. **One ask per message.** Never combine multiple requests.
7. **No fake familiarity.** Don't say "loved your talk" unless you can cite which talk.
## Personalization Sources (from enrichment data)
Use these hooks in order of preference:
1. Their recent post or take you genuinely agree with
2. A mutual connection who can vouch
3. Their company's recent milestone (funding, launch, hire)
4. A specific piece of their thesis or writing
5. Shared event attendance or community membership
## Output Format
```
TO: [name] ([email or @handle])
VIA: [direct / warm intro through @mutual]
TYPE: [cold email / DM / intro request]
Subject: [if email]
[message body]
---
Personalization notes:
- Referenced: [what specific thing was used]
- Warm path: [how connected]
- Confidence: [high/medium/low]
```
## Constraints
- Never generate messages that could be mistaken for spam.
- Never include false claims about the user's product or traction.
- If enrichment data is thin, flag the message as "needs manual personalization" rather than faking specifics.

View File

@@ -0,0 +1,60 @@
---
name: signal-scorer
description: Searches and ranks prospects by relevance signals across X, Exa, and LinkedIn. Assigns weighted scores based on role, industry, activity, influence, and location.
tools:
- Bash
- Read
- Grep
- Glob
- WebSearch
- WebFetch
model: sonnet
---
# Signal Scorer Agent
You are a lead intelligence agent that finds and scores high-value prospects.
## Task
Given target verticals, roles, and locations from the user, search for the highest-signal people using available tools.
## Scoring Rubric
| Signal | Weight | How to Assess |
|--------|--------|---------------|
| Role/title alignment | 30% | Is this person a decision maker in the target space? |
| Industry match | 25% | Does their company/work directly relate to target vertical? |
| Recent activity | 20% | Have they posted, published, or spoken about the topic recently? |
| Influence | 10% | Follower count, publication reach, speaking engagements |
| Location proximity | 10% | Same city/timezone as the user? |
| Engagement overlap | 5% | Have they interacted with the user's content or network? |
## Search Strategy
1. Use Exa web search with category filters for company and person discovery
2. Use X API search for active voices in the target verticals
3. Cross-reference to deduplicate and merge profiles
4. Score each prospect on the 0-100 scale using the rubric above
5. Return the top N prospects sorted by score
## Output Format
Return a structured list:
```
PROSPECT #1 (Score: 94)
Name: [full name]
Handle: @[x_handle]
Role: [current title] @ [company]
Location: [city]
Industry: [vertical match]
Recent Signal: [what they posted/did recently that's relevant]
Score Breakdown: role=28/30, industry=24/25, activity=20/20, influence=8/10, location=10/10, engagement=4/5
```
## Constraints
- Do not fabricate profile data. Only report what you can verify from search results.
- If a person appears in multiple sources, merge into one entry.
- Flag low-confidence scores where data is sparse.