Add twitch-vod-clipper, market-validator, and git-workflow skills

[gupsspam-netizen]

Summary

Three community skills for the marketplace:

twitch-vod-clipper

Download Twitch VODs, detect viral moments from audio and transcript energy, render vertical 9:16 clips with animated captions, face tracking, watermarks, and thumbnails.

market-validator

Structured 40-minute business idea validation. Five-phase process: idea scrubbing → competition scan → demand signal check → monetization check → GREEN/YELLOW/RED verdict.

git-workflow

Execute common Git workflows safely — rebase, squash, conflict resolution, commit management, force-push with lease. 21-step methodology with safety rules baked in.

Submission checklist

• Validated SKILL.md frontmatter (8 marketplace-required fields)
• All 7 required body sections present
• Contains trigger phrases for auto-activation
• Sources auto-sync from gupsspam-netizen/clip-farmer-skills

Auto-sync

All three skills live in https://github.com/gupsspam-netizen/clip-farmer-skills and will sync to the marketplace weekly via Path B.

[greptile-apps]

Greptile Summary

Adds three sources.yaml pointer entries — twitch-vod-clipper, market-validator, and git-workflow — all sourced from the same upstream monorepo (gupsspam-netizen/clip-farmer-skills) via different source_path subdirectories. The upstream content will be validated by validate-skills-schema.py at the next weekly sync run, not at PR merge time.

• All required schema fields (name, description, repo, source_path, target_path, author, license, category, verified, include, exclude) are present and correctly formed. The multi-skill-from-one-repo pattern is established in this file (e.g. numman-ali/n-skills).
• The include pattern in each entry uses the unanchored form 'SKILL.md' rather than '/SKILL.md'. The sync engine auto-prefixes this as **/SKILL.md and will emit an advisory warning (blocker 62ye.6) for all three entries; anchoring to '/SKILL.md' is the one-char fix and matches the format of the immediately-preceding quit-sponsor entry.
• Each source gets its own independent sparse clone and lock entry, so there are no lockfile key collisions despite sharing the same upstream repo.

Confidence Score: 4/5

Safe to merge — the PR adds only sources.yaml pointers; actual skill content is gated by the weekly sync validator.

The three new entries are structurally complete and the upstream content will be scanned and validated before it ever lands in plugins/community/. The only actionable finding is the unanchored 'SKILL.md' include pattern, which the sync engine will flag as an advisory warning at run time — it doesn't block the sync, but it could silently admit nested SKILL.md files from within a skill's sparse-checkout subtree if any exist.

sources.yaml — the three new entries' include patterns should use '/SKILL.md' rather than 'SKILL.md'.

Important Files Changed

Filename

Overview

sources.yaml

Adds three new community skill pointer entries (twitch-vod-clipper, market-validator, git-workflow) all sourced from the same upstream monorepo (gupsspam-netizen/clip-farmer-skills). Schema fields are complete and correct, but include patterns are unanchored ('SKILL.md' vs '/SKILL.md'), which will trigger advisory warnings at sync time and could admit deeply-nested SKILL.md files from within each skill's sparse-checkout subtree.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant PR as PR Merge
    participant SY as sources.yaml
    participant SE as sync-external.mjs
    participant GH as gupsspam-netizen/clip-farmer-skills
    participant LF as sources.lock.json
    participant PC as plugins/community/

    PR->>SY: Adds 3 pointer entries
    Note over SY: Validated at sync time, not PR time

    SE->>GH: sparse-clone → twitch-vod-clipper/
    SE->>LF: new-source baseline (twitch-vod-clipper)
    SE->>PC: mirror twitch-vod-clipper/SKILL.md

    SE->>GH: sparse-clone → market-validator/
    SE->>LF: new-source baseline (market-validator)
    SE->>PC: mirror market-validator/SKILL.md

    SE->>GH: sparse-clone → git-workflow/
    SE->>LF: new-source baseline (git-workflow)
    SE->>PC: mirror git-workflow/SKILL.md

    SE->>SE: validate-skills-schema.py on each mirrored SKILL.md

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant PR as PR Merge
    participant SY as sources.yaml
    participant SE as sync-external.mjs
    participant GH as gupsspam-netizen/clip-farmer-skills
    participant LF as sources.lock.json
    participant PC as plugins/community/

    PR->>SY: Adds 3 pointer entries
    Note over SY: Validated at sync time, not PR time

    SE->>GH: sparse-clone → twitch-vod-clipper/
    SE->>LF: new-source baseline (twitch-vod-clipper)
    SE->>PC: mirror twitch-vod-clipper/SKILL.md

    SE->>GH: sparse-clone → market-validator/
    SE->>LF: new-source baseline (market-validator)
    SE->>PC: mirror market-validator/SKILL.md

    SE->>GH: sparse-clone → git-workflow/
    SE->>LF: new-source baseline (git-workflow)
    SE->>PC: mirror git-workflow/SKILL.md

    SE->>SE: validate-skills-schema.py on each mirrored SKILL.md

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
sources.yaml:1713-1759
All three `include` patterns use the unanchored form `'SKILL.md'` (without a leading `/`). The sync engine's `matchesPattern` auto-prefixes these as `**/SKILL.md`, which matches at **any depth** within the sparse-checked-out subtree — not just the root. For a monorepo like `clip-farmer-skills` where multiple skill directories live side by side, this means any nested `SKILL.md` files inside `twitch-vod-clipper/`, `market-validator/`, or `git-workflow/` (e.g. in an `examples/` subdirectory) would be silently pulled in as unvetted content. The sync engine will also emit an advisory warning for each entry at run time (blocker 62ye.6 in `sync-external.mjs`). The entry immediately preceding these — `quit-sponsor` — uses the anchored form `'/SKILL.md'` correctly.

```suggestion
  - name: twitch-vod-clipper
    description: Download Twitch VODs, detect viral moments from audio energy and the transcript, and render vertical 9:16 clips with animated captions, face tracking, watermarks, and thumbnails
    repo: gupsspam-netizen/clip-farmer-skills
    source_path: twitch-vod-clipper
    target_path: plugins/community/twitch-vod-clipper
    author:
      name: Carl Johnson
      github: gupsspam-netizen
    license: MIT
    category: community
    verified: false
    include:
      - '/SKILL.md'
    exclude:
      - '.git/**'

  - name: market-validator
    description: Structured 40-minute process to validate a business idea — competition scan, demand signals, revenue estimate — outputs a GREEN/YELLOW/RED verdict with evidence
    repo: gupsspam-netizen/clip-farmer-skills
    source_path: market-validator
    target_path: plugins/community/market-validator
    author:
      name: Carl Johnson
      github: gupsspam-netizen
    license: MIT
    category: community
    verified: false
    include:
      - '/SKILL.md'
    exclude:
      - '.git/**'

  - name: git-workflow
    description: Execute common Git workflows safely — rebase, squash, conflict resolution, commit management, force-push with lease. 21 safe steps with recovery paths
    repo: gupsspam-netizen/clip-farmer-skills
    source_path: git-workflow
    target_path: plugins/community/git-workflow
    author:
      name: Carl Johnson
      github: gupsspam-netizen
    license: MIT
    category: community
    verified: false
    include:
      - '/SKILL.md'
    exclude:
      - '.git/**'
```

_{Reviews (1): Last reviewed commit: "Add twitch-vod-clipper, market-validator..." | Re-trigger Greptile}

[greptile-apps]

All three include patterns use the unanchored form 'SKILL.md' (without a leading /). The sync engine's matchesPattern auto-prefixes these as **/SKILL.md, which matches at any depth within the sparse-checked-out subtree — not just the root. For a monorepo like clip-farmer-skills where multiple skill directories live side by side, this means any nested SKILL.md files inside twitch-vod-clipper/, market-validator/, or git-workflow/ (e.g. in an examples/ subdirectory) would be silently pulled in as unvetted content. The sync engine will also emit an advisory warning for each entry at run time (blocker 62ye.6 in sync-external.mjs). The entry immediately preceding these — quit-sponsor — uses the anchored form '/SKILL.md' correctly.

Suggested change

	- name: twitch-vod-clipper
	description: Download Twitch VODs, detect viral moments from audio energy and the transcript, and render vertical 9:16 clips with animated captions, face tracking, watermarks, and thumbnails
	repo: gupsspam-netizen/clip-farmer-skills
	source_path: twitch-vod-clipper
	target_path: plugins/community/twitch-vod-clipper
	author:
	name: Carl Johnson
	github: gupsspam-netizen
	license: MIT
	category: community
	verified: false
	include:
	- 'SKILL.md'
	exclude:
	- '.git/**'
	- name: market-validator
	description: Structured 40-minute process to validate a business idea — competition scan, demand signals, revenue estimate — outputs a GREEN/YELLOW/RED verdict with evidence
	repo: gupsspam-netizen/clip-farmer-skills
	source_path: market-validator
	target_path: plugins/community/market-validator
	author:
	name: Carl Johnson
	github: gupsspam-netizen
	license: MIT
	category: community
	verified: false
	include:
	- 'SKILL.md'
	exclude:
	- '.git/**'
	- name: git-workflow
	description: Execute common Git workflows safely — rebase, squash, conflict resolution, commit management, force-push with lease. 21 safe steps with recovery paths
	repo: gupsspam-netizen/clip-farmer-skills
	source_path: git-workflow
	target_path: plugins/community/git-workflow
	author:
	name: Carl Johnson
	github: gupsspam-netizen
	license: MIT
	category: community
	verified: false
	include:
	- 'SKILL.md'
	exclude:
	- '.git/**'
	- name: twitch-vod-clipper
	description: Download Twitch VODs, detect viral moments from audio energy and the transcript, and render vertical 9:16 clips with animated captions, face tracking, watermarks, and thumbnails
	repo: gupsspam-netizen/clip-farmer-skills
	source_path: twitch-vod-clipper
	target_path: plugins/community/twitch-vod-clipper
	author:
	name: Carl Johnson
	github: gupsspam-netizen
	license: MIT
	category: community
	verified: false
	include:
	- '/SKILL.md'
	exclude:
	- '.git/**'
	- name: market-validator
	description: Structured 40-minute process to validate a business idea — competition scan, demand signals, revenue estimate — outputs a GREEN/YELLOW/RED verdict with evidence
	repo: gupsspam-netizen/clip-farmer-skills
	source_path: market-validator
	target_path: plugins/community/market-validator
	author:
	name: Carl Johnson
	github: gupsspam-netizen
	license: MIT
	category: community
	verified: false
	include:
	- '/SKILL.md'
	exclude:
	- '.git/**'
	- name: git-workflow
	description: Execute common Git workflows safely — rebase, squash, conflict resolution, commit management, force-push with lease. 21 safe steps with recovery paths
	repo: gupsspam-netizen/clip-farmer-skills
	source_path: git-workflow
	target_path: plugins/community/git-workflow
	author:
	name: Carl Johnson
	github: gupsspam-netizen
	license: MIT
	category: community
	verified: false
	include:
	- '/SKILL.md'
	exclude:
	- '.git/**'

Prompt To Fix With AI

This is a comment left during a code review.
Path: sources.yaml
Line: 1713-1759

Comment:
All three `include` patterns use the unanchored form `'SKILL.md'` (without a leading `/`). The sync engine's `matchesPattern` auto-prefixes these as `**/SKILL.md`, which matches at **any depth** within the sparse-checked-out subtree — not just the root. For a monorepo like `clip-farmer-skills` where multiple skill directories live side by side, this means any nested `SKILL.md` files inside `twitch-vod-clipper/`, `market-validator/`, or `git-workflow/` (e.g. in an `examples/` subdirectory) would be silently pulled in as unvetted content. The sync engine will also emit an advisory warning for each entry at run time (blocker 62ye.6 in `sync-external.mjs`). The entry immediately preceding these — `quit-sponsor` — uses the anchored form `'/SKILL.md'` correctly.

```suggestion
  - name: twitch-vod-clipper
    description: Download Twitch VODs, detect viral moments from audio energy and the transcript, and render vertical 9:16 clips with animated captions, face tracking, watermarks, and thumbnails
    repo: gupsspam-netizen/clip-farmer-skills
    source_path: twitch-vod-clipper
    target_path: plugins/community/twitch-vod-clipper
    author:
      name: Carl Johnson
      github: gupsspam-netizen
    license: MIT
    category: community
    verified: false
    include:
      - '/SKILL.md'
    exclude:
      - '.git/**'

  - name: market-validator
    description: Structured 40-minute process to validate a business idea — competition scan, demand signals, revenue estimate — outputs a GREEN/YELLOW/RED verdict with evidence
    repo: gupsspam-netizen/clip-farmer-skills
    source_path: market-validator
    target_path: plugins/community/market-validator
    author:
      name: Carl Johnson
      github: gupsspam-netizen
    license: MIT
    category: community
    verified: false
    include:
      - '/SKILL.md'
    exclude:
      - '.git/**'

  - name: git-workflow
    description: Execute common Git workflows safely — rebase, squash, conflict resolution, commit management, force-push with lease. 21 safe steps with recovery paths
    repo: gupsspam-netizen/clip-farmer-skills
    source_path: git-workflow
    target_path: plugins/community/git-workflow
    author:
      name: Carl Johnson
      github: gupsspam-netizen
    license: MIT
    category: community
    verified: false
    include:
      - '/SKILL.md'
    exclude:
      - '.git/**'
```

How can I resolve this? If you propose a fix, please make it concise.

[jeremylongshore]

Thanks for this, @gupsspam-netizen — and for contributing the right way, through sources.yaml rather than dumping files. I read all three skills in full, and they're genuinely good:

• git-workflow — real safety discipline, not just command lists: state inspection (git status + git log) before every destructive op, --force-with-lease always, git revert (not reset) for public history, and reflog/--abort treated as first-class recovery. Complete sections plus three worked examples. This is the kind of skill I'd actually want an agent running.
• market-validator — a genuine 5-phase, time-boxed methodology on free public endpoints (Reddit .json, GitHub/HN APIs), honest about estimate-vs-forecast, with real red-flag detection ("everyone needs X" → nobody is the customer).
• twitch-vod-clipper — a real technical pipeline (yt-dlp → Whisper word-timestamps → energy/transcript scoring → ffmpeg 9:16 with libass captions, mediapipe face-tracking, watermark, thumbnails), with correct commands and honest hardware notes.

Complete frontmatter on all three, verified: false (honest). Nice work.

One thing to fix before we can track the source: your upstream repo gupsspam-netizen/clip-farmer-skills declares license: MIT in each entry, but the repo itself has no LICENSE file (just a README). Because we mirror your content and always preserve the upstream license and credit, the license has to actually exist in the source repo — otherwise the MIT grant we'd be relying on isn't real.

To unblock: add a standard LICENSE file (MIT, with your name/year) to the root of clip-farmer-skills, then drop a comment here. That's the only blocker — the sources.yaml entries themselves are well-formed and correctly pointed.

What happens next, so you know the path: once the license is in place, we pin your source and the weekly external-sync pipeline mirrors the SKILL.md files into plugins/community/ and runs them through our full grading. That grade — not this PR — is the real quality gate (our bar is high; see CONTRIBUTING.md and the rubric at https://tonsofskills.com/grading). Given how these read, I expect them to do well.

Leaving this open pending the LICENSE file. Thanks again — this is a solid contribution.

• Jeremy Longshore
  intentsolutions.io

[opeyemiariyo-netizen]

Hi @gupsspam-netizen — the three skills the PR claims to add are well-structured (Path B pattern is correct, multi-skill-from-one-repo is the established pattern used by numman-ali/n-skills), and pointing at auto-sync from a single monorepo is the right move for low maintenance cost. A few real issues before this can merge:

P0 — docker-deploy is added but undocumented in the PR body and missing from sources.yaml

Counting the diff: 9 files, 1,119 insertions — but the title and description both say "three skills". The fourth skill (plugins/community/docker-deploy/, 426 lines of SKILL.md + README) is silently committed to the marketplace plugin tree without a corresponding sources.yaml entry. Consequences:

• When the weekly sync runs, docker-deploy will be invisible to it — no source pointer means no baseline, no drift detection, no re-sync. The user has to manually vendor any future updates.
• This is a maintenance tax on the repo for the lifetime of the merge.
• It's also a transparency issue: PR reviewers are looking at "three skills" and the diff shows four.

Either:

• Add a fourth sources.yaml entry pointing at gupsspam-netizen/clip-farmer-skills with source_path: docker-deploy (the upstream has it — gh api repos/gupsspam-netizen/clip-farmer-skills/contents confirms docker-deploy/ is a top-level dir there), so all four skills sync uniformly; or
• Remove plugins/community/docker-deploy/ from this PR and submit it standalone.

The first option is consistent with the pattern you've already established.

P1 — Include pattern triggers an advisory warning at sync time

Three entries use:

include:
  - 'SKILL.md'

instead of the anchored form '/SKILL.md'. The sync engine auto-prefixes **/ regardless, but the unanchored form will trigger an advisory warning (blocker 62ye.6) for all three sources at the next weekly sync. One-character fix per entry, matches the format of the immediately preceding quit-sponsor entry. Greptile caught this; it's the canonical fix.

P1 — All four SKILL.md files fail the marketplace validator pre-screen

Ran validate-skills-schema.py --marketplace on each:

twitch-vod-clipper  → B (88/100)  1 ERROR: allowed-tools: unscoped 'Bash' is not allowed
                                1 ERROR: Required section missing: '# '
                                1 ERROR: [tier2:tool-safety] Unscoped Bash + Write/WebFetch without ## Safety Justification
market-validator    → B (89/100)  same Bash + safety-justification errors
git-workflow        → B (83/100)  same Bash + safety-justification errors
docker-deploy       → B (80/100)  same Bash + safety-justification errors

The same pattern in all four: allowed-tools: Bash, Read, Write, Edit, Glob (unscoped Bash) without a ## Safety Justification section. The PR description claims "All 7 required body sections present" — that's true at the per-skill spec level but the marketplace tier adds a Safety Justification requirement when Bash + Write/WebFetch are requested unscoped. The PR's submission checklist pre-dates that requirement.

This isn't unique to this PR — I checked a few other community plugins and several have the same pattern — but it's now a hard ERROR per the validator and would be flagged on the next sync.

Per-skill surgical fixes (each ~5 min):

• twitch-vod-clipper: replace allowed-tools: Bash, Read, Write, Edit, Glob with allowed-tools: Read, Write, Edit, Glob (Bash isn't actually referenced in the body for this skill — the VOD download is yt-dlp from a Bash block, so narrow to Bash(yt-dlp:*)). Add ## Safety Justification with what the bash scope is and why.
• market-validator: same — Bash is rarely used; narrow or remove.
• git-workflow: this is the trickiest one — git operations legitimately need Bash. Use Bash(git:*), Bash(gh:*) etc. and add a Safety Justification covering force-push-with-lease and --no-ff merge handling.
• docker-deploy: same — narrow to Bash(docker:*), Bash(docker-compose:*) and justify.

P2 — git-workflow contains placeholder text

WARN: [content-quality] SKILL.md contains placeholder text: {n}

Search for {n} in git-workflow/skills/git-workflow/SKILL.md and replace with the intended variable name. Easy grep-able fix.

P2 — twitch-vod-clipper magic numbers

WARN: [scripts] Code block 2: Magic number '1080' - add comment explaining why
WARN: [scripts] Code block 3: Magic number '16000' - add comment explaining why

These are reasonable constants (1920×1080 vertical output, 16kHz audio) but the validator wants an inline comment.

P2 — docker-deploy is 390 lines

Validator says "approaching limit" (300-500). Consider extracting the longer example blocks into references/ for progressive disclosure. Optional.

Looks good

• 4-of-4 skills graded B (80-89) — pre-screen-blocking errors are narrow and fixable in <30 min per file.
• The Path B pattern is correctly used (single upstream monorepo, three independent lock entries).
• Upstream provenance is clear (gupsspam-netizen/clip-farmer-skills).
• The SPDX license: MIT and verified: false are appropriately set.

Path to merge

1. Add docker-deploy to sources.yaml (matches the gupsspam-netizen/clip-farmer-skills upstream).
2. Anchor the three include patterns to '/SKILL.md'.
3. Fix the four allowed-tools lines (narrow Bash scope, add Safety Justification).
4. Fix the {n} placeholder in git-workflow.
5. Re-run validate-skills-schema.py --marketplace against all four and confirm pre-screen clean.

Once those land, this is a clean four-skill marketplace addition.