aeon-update: sync framework to aeonfun/aeon@573f06c

.github/README.md

@@ -81,7 +81,7 @@ The prompt *is* the skill. You schedule it, hand it a `var`, chain it into other
   <img src="../docs/assets/packs-aeon.jpg" alt="Six skill packs, 60+ skills total: Core (fleet coordination, self-config, liveness), Evolution (authors and heals its own skills), Basics (simple runnable skills), Dev & Code, Crypto & Markets, and Productivity." width="100%" />
 </p>
 
-<p align="center"><a href="../docs/skill-packs.md#full-catalog-all-74-skills-by-pack"><b>Full catalog - all 74 skills by pack →</b></a></p>
+<p align="center"><a href="../docs/skill-packs.md#full-catalog-all-75-skills-by-pack"><b>Full catalog - all 75 skills by pack →</b></a></p>
 
 <p align="center"><a href="../docs/community-skill-packs.md#listed-packs"><b>Community skill packs →</b></a></p>
 

aeon.yml

@@ -52,6 +52,7 @@ skills:
   glim-mcp: { enabled: false, schedule: "workflow_dispatch", var: "" } # on-demand — live-data research via the glim.sh MCP (web/X/Reddit/GitHub/Amazon/YouTube; OAuth Connect in the dashboard, pay-per-call from glim balance). var: research question, append --deep for a wider sweep
   executor-mcp: { enabled: false, schedule: "workflow_dispatch", var: "" } # on-demand — run a task through the Executor Cloud tool catalog (executor.sh/mcp; one MCP endpoint proxying the operator's connected integrations, per-tool allow/approve/block policies; OAuth Connect in the dashboard). var: the task
   finance-district-mcp: { enabled: false, schedule: "workflow_dispatch", var: "" } # on-demand — multichain non-custodial agent wallet via the Finance District MCP (keys in a TEE, server-side spend caps; OAuth Connect in the dashboard). var: empty=daily wallet brief | best USDC yield on Base | swap 5 USDC to ETH on Base | pay <x402-url> for <data>
+  taskmarket-delegate: { enabled: false, schedule: "workflow_dispatch", var: "" } # on-demand — browse/create/submit work on the TaskMarket agent-worker market (api.taskmarket.dev). var: browse[:query] | create "<title>" "<desc>" [reward] | submit <taskId> <message> [url]. Write actions need TASKMARKET_API_KEY + explicit operator authorization.
   autoresearch: { enabled: false, schedule: "workflow_dispatch", var: "" } # on-demand — set var to skill name to evolve
   create-skill: { enabled: false, schedule: "workflow_dispatch", var: "" } # one-shot skill creator — set var to a description prompt
   install-skill: { enabled: false, schedule: "workflow_dispatch", var: "" } # on-demand — install a community skill pack and open a PR; var: owner/repo [skill...]

docs/ECOSYSTEM.md

@@ -39,6 +39,7 @@ These are the projects we know of that run Aeon, extend it, or integrate with th
 | <img src="https://pbs.twimg.com/profile_images/2075170344957083648/AR-5asAz_400x400.jpg" width="36" height="36" alt="CTRL logo"> | CTRL | [@CTRL_automation](https://x.com/CTRL_automation) |
 | <img src="https://pbs.twimg.com/profile_images/2070145040882544640/P8NilHgr_400x400.jpg" width="36" height="36" alt="DarkSol logo"> | DarkSol | [@Darks0l_](https://x.com/Darks0l_) |
 | <img src="https://pbs.twimg.com/profile_images/2057284361066569728/K5ZhxKXY_400x400.png" width="36" height="36" alt="Echo Oracle logo"> | Echo Oracle | [@BuiltByEcho](https://x.com/BuiltByEcho) · [builtbyecho.xyz](https://www.builtbyecho.xyz/) |
+| <img src="https://pbs.twimg.com/profile_images/2058778503957590016/3Uo13Pxy_400x400.jpg" width="36" height="36" alt="Finance District logo"> | Finance District | [@FD_XYZ](https://x.com/FD_XYZ) · [fd.xyz](https://fd.xyz) |
 | <img src="https://pbs.twimg.com/profile_images/2078808241430306817/oCW2y8Q-_400x400.jpg" width="36" height="36" alt="GitBlock logo"> | GitBlock | [@gitblock_](https://x.com/gitblock_) |
 | <img src="https://pbs.twimg.com/profile_images/2069099785936891904/fbvZqtoT_400x400.jpg" width="36" height="36" alt="GitKernal logo"> | GitKernal | [@gitkernal](https://x.com/gitkernal) |
 | <img src="https://pbs.twimg.com/profile_images/2056261441192419328/X6pFHgHc_400x400.jpg" width="36" height="36" alt="Gitlawb Terminal logo"> | Gitlawb Terminal | [@terminalgitlawb](https://x.com/terminalgitlawb) |

docs/skill-packs.md

@@ -167,7 +167,7 @@ enable its skills from the dashboard's Packs view.
 
 ---
 
-## Full catalog (all 74 skills by pack)
+## Full catalog (all 75 skills by pack)
 
 Three packs are shown by default (**Core**, **Evolution**, **Basics**); the rest are revealed on demand.
 
@@ -177,7 +177,7 @@ Three packs are shown by default (**Core**, **Evolution**, **Basics**); the rest
 | **Evolution** (`evolution`, 9) | <img src="assets/skill-icons/aeon-doctor.svg" width="14" height="14" align="top" alt=""> `aeon-doctor`, <img src="assets/skill-icons/autoresearch.svg" width="14" height="14" align="top" alt=""> `autoresearch`, <img src="assets/skill-icons/create-skill.svg" width="14" height="14" align="top" alt=""> `create-skill`, <img src="assets/skill-icons/install-skill.svg" width="14" height="14" align="top" alt=""> `install-skill`, <img src="assets/skill-icons/pack-submit.svg" width="14" height="14" align="top" alt=""> `pack-submit`, <img src="assets/skill-icons/search-skill.svg" width="14" height="14" align="top" alt=""> `search-skill`, <img src="assets/skill-icons/self-improve.svg" width="14" height="14" align="top" alt=""> `self-improve`, <img src="assets/skill-icons/skill-health.svg" width="14" height="14" align="top" alt=""> `skill-health`, <img src="assets/skill-icons/skill-repair.svg" width="14" height="14" align="top" alt=""> `skill-repair` |
 | **Basics** (`basics`, 17) | <img src="assets/skill-icons/action-converter.svg" width="14" height="14" align="top" alt=""> `action-converter`, <img src="assets/skill-icons/article.svg" width="14" height="14" align="top" alt=""> `article`, <img src="assets/skill-icons/bd-radar.svg" width="14" height="14" align="top" alt=""> `bd-radar`, <img src="assets/skill-icons/digest.svg" width="14" height="14" align="top" alt=""> `digest`, <img src="assets/skill-icons/executor-mcp.svg" width="14" height="14" align="top" alt=""> `executor-mcp`, <img src="assets/skill-icons/fetch-tweets.svg" width="14" height="14" align="top" alt=""> `fetch-tweets`, <img src="assets/skill-icons/github-trending.svg" width="14" height="14" align="top" alt=""> `github-trending`, <img src="assets/skill-icons/glim-mcp.svg" width="14" height="14" align="top" alt=""> `glim-mcp`, <img src="assets/skill-icons/idea-forge.svg" width="14" height="14" align="top" alt=""> `idea-forge`, <img src="assets/skill-icons/last30.svg" width="14" height="14" align="top" alt=""> `last30`, <img src="assets/skill-icons/pr-review.svg" width="14" height="14" align="top" alt=""> `pr-review`, <img src="assets/skill-icons/price-alert.svg" width="14" height="14" align="top" alt=""> `price-alert`, <img src="assets/skill-icons/token-movers.svg" width="14" height="14" align="top" alt=""> `token-movers`, <img src="assets/skill-icons/tx-explain.svg" width="14" height="14" align="top" alt=""> `tx-explain`, <img src="assets/skill-icons/video-script.svg" width="14" height="14" align="top" alt=""> `video-script`, <img src="assets/skill-icons/write-tweet.svg" width="14" height="14" align="top" alt=""> `write-tweet`, <img src="assets/skill-icons/you-web-search.svg" width="14" height="14" align="top" alt=""> `you-web-search` |
 | **Dev & Code** (`dev`, 11) | <img src="assets/skill-icons/changelog.svg" width="14" height="14" align="top" alt=""> `changelog`, <img src="assets/skill-icons/deploy-prototype.svg" width="14" height="14" align="top" alt=""> `deploy-prototype`, <img src="assets/skill-icons/feature.svg" width="14" height="14" align="top" alt=""> `feature`, <img src="assets/skill-icons/github-monitor.svg" width="14" height="14" align="top" alt=""> `github-monitor`, <img src="assets/skill-icons/inbox-triage.svg" width="14" height="14" align="top" alt=""> `inbox-triage`, <img src="assets/skill-icons/posthog-errors.svg" width="14" height="14" align="top" alt=""> `posthog-errors`, <img src="assets/skill-icons/pr-triage.svg" width="14" height="14" align="top" alt=""> `pr-triage`, <img src="assets/skill-icons/seo-audit.svg" width="14" height="14" align="top" alt=""> `seo-audit`, <img src="assets/skill-icons/spend-watch.svg" width="14" height="14" align="top" alt=""> `spend-watch`, <img src="assets/skill-icons/vuln-scanner.svg" width="14" height="14" align="top" alt=""> `vuln-scanner`, <img src="assets/skill-icons/vuln-tracker.svg" width="14" height="14" align="top" alt=""> `vuln-tracker` |
-| **Crypto & Markets** (`crypto`, 14) | <img src="assets/skill-icons/base-mcp.svg" width="14" height="14" align="top" alt=""> `base-mcp`, <img src="assets/skill-icons/defi-overview.svg" width="14" height="14" align="top" alt=""> `defi-overview`, <img src="assets/skill-icons/deploy-uni-hook.svg" width="14" height="14" align="top" alt=""> `deploy-uni-hook`, <img src="assets/skill-icons/distribute-tokens.svg" width="14" height="14" align="top" alt=""> `distribute-tokens`, <img src="assets/skill-icons/finance-district-mcp.svg" width="14" height="14" align="top" alt=""> `finance-district-mcp`, <img src="assets/skill-icons/investigation-report.svg" width="14" height="14" align="top" alt=""> `investigation-report`, <img src="assets/skill-icons/monitor-polymarket.svg" width="14" height="14" align="top" alt=""> `monitor-polymarket`, <img src="assets/skill-icons/narrative-tracker.svg" width="14" height="14" align="top" alt=""> `narrative-tracker`, <img src="assets/skill-icons/onchain-monitor.svg" width="14" height="14" align="top" alt=""> `onchain-monitor`, <img src="assets/skill-icons/picks-tracker.svg" width="14" height="14" align="top" alt=""> `picks-tracker`, <img src="assets/skill-icons/pm-manipulation.svg" width="14" height="14" align="top" alt=""> `pm-manipulation`, <img src="assets/skill-icons/robinhood-mcp.svg" width="14" height="14" align="top" alt=""> `robinhood-mcp`, <img src="assets/skill-icons/token-pick.svg" width="14" height="14" align="top" alt=""> `token-pick`, <img src="assets/skill-icons/unlock-monitor.svg" width="14" height="14" align="top" alt=""> `unlock-monitor` |
+| **Crypto & Markets** (`crypto`, 15) | <img src="assets/skill-icons/base-mcp.svg" width="14" height="14" align="top" alt=""> `base-mcp`, <img src="assets/skill-icons/defi-overview.svg" width="14" height="14" align="top" alt=""> `defi-overview`, <img src="assets/skill-icons/deploy-uni-hook.svg" width="14" height="14" align="top" alt=""> `deploy-uni-hook`, <img src="assets/skill-icons/distribute-tokens.svg" width="14" height="14" align="top" alt=""> `distribute-tokens`, <img src="assets/skill-icons/finance-district-mcp.svg" width="14" height="14" align="top" alt=""> `finance-district-mcp`, <img src="assets/skill-icons/investigation-report.svg" width="14" height="14" align="top" alt=""> `investigation-report`, <img src="assets/skill-icons/monitor-polymarket.svg" width="14" height="14" align="top" alt=""> `monitor-polymarket`, <img src="assets/skill-icons/narrative-tracker.svg" width="14" height="14" align="top" alt=""> `narrative-tracker`, <img src="assets/skill-icons/onchain-monitor.svg" width="14" height="14" align="top" alt=""> `onchain-monitor`, <img src="assets/skill-icons/picks-tracker.svg" width="14" height="14" align="top" alt=""> `picks-tracker`, <img src="assets/skill-icons/pm-manipulation.svg" width="14" height="14" align="top" alt=""> `pm-manipulation`, <img src="assets/skill-icons/robinhood-mcp.svg" width="14" height="14" align="top" alt=""> `robinhood-mcp`, <img src="assets/skill-icons/taskmarket-delegate.svg" width="14" height="14" align="top" alt=""> `taskmarket-delegate`, <img src="assets/skill-icons/token-pick.svg" width="14" height="14" align="top" alt=""> `token-pick`, <img src="assets/skill-icons/unlock-monitor.svg" width="14" height="14" align="top" alt=""> `unlock-monitor` |
 | **Productivity** (`productivity`, 11) | <img src="assets/skill-icons/competitor-monitor.svg" width="14" height="14" align="top" alt=""> `competitor-monitor`, <img src="assets/skill-icons/higgsfield.svg" width="14" height="14" align="top" alt=""> `higgsfield`, <img src="assets/skill-icons/hunter-22.svg" width="14" height="14" align="top" alt=""> `hunter-22`, <img src="assets/skill-icons/idea-pipeline.svg" width="14" height="14" align="top" alt=""> `idea-pipeline`, <img src="assets/skill-icons/mention-radar.svg" width="14" height="14" align="top" alt=""> `mention-radar`, <img src="assets/skill-icons/operator-scorecard.svg" width="14" height="14" align="top" alt=""> `operator-scorecard`, <img src="assets/skill-icons/remotion.svg" width="14" height="14" align="top" alt=""> `remotion`, <img src="assets/skill-icons/reply-maker.svg" width="14" height="14" align="top" alt=""> `reply-maker`, <img src="assets/skill-icons/schedule-ads.svg" width="14" height="14" align="top" alt=""> `schedule-ads`, <img src="assets/skill-icons/send-email.svg" width="14" height="14" align="top" alt=""> `send-email`, <img src="assets/skill-icons/weekly-aeoncard.svg" width="14" height="14" align="top" alt=""> `weekly-aeoncard` |
 
 Authoritative source: [`skills.json`](../catalog/skills.json) + [`packs.json`](../catalog/packs.json), the dashboard **Packs** view, or `bin/add-skill aeonfun/aeon --list`. A skill's pack comes from its `category:` frontmatter.

eyebrowlock.json

@@ -2233,6 +2233,103 @@
       ],
       "contentHash": "sha256-915ef57cf4dc5214a125f55df7bfe821503fd3252a8b80095f29d8343f47b5ae",
       "discoveredFrom": "skills/aeon-update/SKILL.md"
+    },
+    {
+      "id": "c9caca0148f44800",
+      "tool": "aeon",
+      "scope": "project:.",
+      "type": "skill",
+      "name": "taskmarket-delegate",
+      "source": {
+        "kind": "local",
+        "ref": "skills/taskmarket-delegate"
+      },
+      "capabilities": {
+        "network": [
+          "api.taskmarket.dev"
+        ]
+      },
+      "files": [
+        {
+          "path": "SKILL.md",
+          "hash": "b1b7f7545b1a9471684a8959da005312be41ea11ca64f55d22dfa4679f3d5d49"
+        },
+        {
+          "path": "scripts/taskmarket.js",
+          "hash": "377a1e526cc754d3e18f124bbad6e642dbc5a7a5725bda0658d13c344fcf54f6"
+        },
+        {
+          "path": "tests/test-taskmarket.js",
+          "hash": "05e90c4f547bbcb17592e57e70144f166f65983266605d3254d3549b0f42f79b"
+        }
+      ],
+      "findings": [
+        {
+          "ruleId": "SENSITIVE-PATH-READ",
+          "severity": "high",
+          "owasp": "ASK-06",
+          "file": "scripts/taskmarket.js",
+          "line": 42,
+          "snippet": "if (!process.env.TASKMARKET_API_KEY) exit(3, 'TASKMARKET_API_KEY not set; write actions require it');",
+          "explanation": "references sensitive credential or secret paths"
+        },
+        {
+          "ruleId": "SENSITIVE-PATH-READ",
+          "severity": "high",
+          "owasp": "ASK-06",
+          "file": "scripts/taskmarket.js",
+          "line": 50,
+          "snippet": "headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + process.env.TASKMARKET_API_KEY },",
+          "explanation": "references sensitive credential or secret paths"
+        },
+        {
+          "ruleId": "SENSITIVE-PATH-READ",
+          "severity": "high",
+          "owasp": "ASK-06",
+          "file": "scripts/taskmarket.js",
+          "line": 70,
+          "snippet": "headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + process.env.TASKMARKET_API_KEY },",
+          "explanation": "references sensitive credential or secret paths"
+        },
+        {
+          "ruleId": "SENSITIVE-PATH-READ",
+          "severity": "high",
+          "owasp": "ASK-06",
+          "file": "scripts/taskmarket.js",
+          "line": 71,
+          "snippet": "body: JSON.stringify({ worker_address: process.env.TASKMARKET_WORKER_ADDRESS || '', message, github_url: githubUrl || ''…",
+          "explanation": "references sensitive credential or secret paths"
+        },
+        {
+          "ruleId": "EXEC-PRIMITIVE",
+          "severity": "medium",
+          "owasp": "ASK-03",
+          "file": "tests/test-taskmarket.js",
+          "line": 5,
+          "snippet": "const { execFileSync } = require('child_process');",
+          "explanation": "uses a process-execution primitive"
+        },
+        {
+          "ruleId": "SENSITIVE-PATH-READ",
+          "severity": "high",
+          "owasp": "ASK-06",
+          "file": "tests/test-taskmarket.js",
+          "line": 26,
+          "snippet": "execFileSync('node', [SCRIPT, 'create', 't', 'd'], { stdio: 'pipe', env: { ...process.env, TASKMARKET_API_KEY: '' } });",
+          "explanation": "references sensitive credential or secret paths"
+        },
+        {
+          "ruleId": "SENSITIVE-PATH-READ",
+          "severity": "high",
+          "owasp": "ASK-06",
+          "file": "tests/test-taskmarket.js",
+          "line": 33,
+          "snippet": "const out = execFileSync('node', [SCRIPT, 'browse'], { stdio: 'pipe', env: { ...process.env, TASKMARKET_API_KEY: '' } })…",
+          "explanation": "references sensitive credential or secret paths"
+        }
+      ],
+      "contentHash": "sha256-d3d50bc8a45a831d8153aa8cc4511b033f5ddbbb489d37d447cc7969ae805b2d",
+      "discoveredFrom": "skills/taskmarket-delegate/SKILL.md"
     }
   ]
 }

memory/topics/aeon-update-state.json

@@ -0,0 +1,7 @@
+{
+  "baseline_sha": "573f06c388853afb48cd05403e6788f66301fd63",
+  "upstream": "aeonfun/aeon",
+  "last_run": "2026-08-15",
+  "last_pr": null,
+  "pending_conflicts": []
+}