mirror of https://github.com/affaan-m/everything-claude-code.git synced 2026-04-01 22:53:27 +08:00

Files

Affaan Mustafa 6cc85ef2ed fix: CI fixes, security audit, remotion skill, lead-intelligence, npm audit (#1039 )

* fix(ci): resolve cross-platform test failures

- Sanity check script (check-codex-global-state.sh) now falls back to
  grep -E when ripgrep is not available, fixing the codex-hooks sync
  test on all CI platforms. Patterns converted to POSIX ERE for
  portability.
- Unicode safety test accepts both / and \ path separators so the
  executable-file assertion passes on Windows.
- Gacha test sets PYTHONUTF8=1 so Python uses UTF-8 stdout encoding on
  Windows instead of cp1252, preventing UnicodeEncodeError on box-drawing
  characters.
- Quoted-hook-path test skipped on Windows where NTFS disallows
  double-quote characters in filenames.

* feat: port remotion-video-creation skill (29 rules), restore missing files

New skill:
- remotion-video-creation: 29 domain-specific Remotion rules covering 3D/Three.js,
  animations, audio, captions, charts, compositions, fonts, GIFs, Lottie,
  measuring, sequencing, tailwind, text animations, timing, transitions,
  trimming, and video embedding. Ported from personal skills.

Restored:
- autonomous-agent-harness/SKILL.md (was in commit but missing from worktree)
- lead-intelligence/ (full directory restored from branch commit)

Updated:
- manifests/install-modules.json: added remotion-video-creation to media-generation
- README.md + AGENTS.md: synced counts to 139 skills

Catalog validates: 30 agents, 60 commands, 139 skills.

* fix(security): pin MCP server versions, add dependabot, pin github-script SHA

Critical:
- Pin all npx -y MCP server packages to specific versions in .mcp.json
  to prevent supply chain attacks via version hijacking:
  - @modelcontextprotocol/server-github@2025.4.8
  - @modelcontextprotocol/server-memory@2026.1.26
  - @modelcontextprotocol/server-sequential-thinking@2025.12.18
  - @playwright/mcp@0.0.69 (was 0.0.68)

Medium:
- Add .github/dependabot.yml for weekly npm + github-actions updates
  with grouped minor/patch PRs
- Pin actions/github-script to SHA (was @v7 tag, now pinned to commit)

* feat: add social-graph-ranker skill — weighted network proximity scoring

New skill: social-graph-ranker
- Weighted social graph traversal with exponential decay across hops
- Bridge Score: B(m) = Σ w(t) · λ^(d(m,t)-1) ranks mutuals by target proximity
- Extended Score incorporates 2nd-order network (mutual-of-mutual connections)
- Final ranking includes engagement bonus for responsive connections
- Runs in parallel with lead-intelligence skill for combined warm+cold outreach
- Supports X API + LinkedIn CSV for graph harvesting
- Outputs tiered action list: warm intros, direct outreach, network gap analysis

Added to business-content install module. Catalog validates: 30/60/140.

* fix(security): npm audit fix — resolve all dependency vulnerabilities

Applied npm audit fix --force to resolve:
- minimatch ReDoS (3 vulnerabilities, HIGH)
- smol-toml DoS (MODERATE)
- brace-expansion memory exhaustion (MODERATE)
- markdownlint-cli upgraded from 0.47.0 to 0.48.0

npm audit now reports 0 vulnerabilities.

* fix: resolve markdown lint and yarn lockfile sync

- MD047: ensure single trailing newline on all remotion rule files
- MD012: remove consecutive blank lines in lottie, measuring-dom-nodes, trimming
- MD034: wrap bare URLs in angle brackets (tailwind, transcribe-captions)
- yarn.lock: regenerated to sync with npm audit changes in package.json

* fix: replace unicode arrows in lead-intelligence (CI unicode safety check)

2026-03-31 15:08:55 -04:00

2.5 KiB

Raw Blame History

name, description, tools, model

name

description

tools

model

mutual-mapper

Maps the user's social graph (X following, LinkedIn connections) against scored prospects to find mutual connections and rank them by introduction potential.

Bash

Read

Grep

WebSearch

WebFetch

sonnet

Mutual Mapper Agent

You map social graph connections between the user and scored prospects to find warm introduction paths.

Task

Given a list of scored prospects and the user's social accounts, find mutual connections and rank them by introduction potential.

Algorithm

Pull the user's X following list (via X API)
For each prospect, check if any of the user's followings also follow or are followed by the prospect
For each mutual found, assess the strength of the connection
Rank mutuals by their ability to make a warm introduction

Mutual Ranking Factors

Factor	Weight	Assessment
Connections to targets	40%	How many of the scored prospects does this mutual know?
Mutual's role/influence	20%	Decision maker, investor, or connector?
Location match	15%	Same city as user or target?
Industry alignment	15%	Works in the target vertical?
Identifiability	10%	Has clear X handle, LinkedIn, email?

Warm Path Types

Classify each path by warmth:

Direct mutual (warmest) — Both user and target follow this person
Portfolio/advisory — Mutual invested in or advises target's company
Co-worker/alumni — Shared employer or educational institution
Event overlap — Both attended same conference, accelerator, or program
Content engagement — Target engaged with mutual's content recently

Output Format

WARM PATH REPORT
================

Target: [prospect name] (@handle)
  Path 1 (warmth: direct mutual)
    Via: @mutual_handle (Jane Smith, Partner @ Acme Ventures)
    Relationship: Jane follows both you and the target
    Suggested approach: Ask Jane for intro

  Path 2 (warmth: portfolio)
    Via: @mutual2 (Bob Jones, Angel Investor)
    Relationship: Bob invested in target's company Series A
    Suggested approach: Reference Bob's investment

MUTUAL LEADERBOARD
==================
#1 @mutual_a — connected to 7 targets (Score: 92)
#2 @mutual_b — connected to 5 targets (Score: 85)

Constraints

Only report connections you can verify from API data or public profiles.
Do not assume connections exist based on similar bios or locations alone.
Flag uncertain connections with a confidence level.

2.5 KiB Raw Blame History