feat(autoskills): detect Xquik SDK projects

[kriptoburak]

What changed

• Detect the exact x-twitter-scraper dependency as Xquik.
• Add the 71-file public Xquik Skill from source commit e1ccbd1709a6cc290307b7815ddf26d929ab31a1.
• Store the license, file hashes, bundle hash, and explicit skipped-review state.
• Mark completed OpenAI audits so skipped and legacy records cannot masquerade as reviewed.
• Warn when a Skill installs without a registry review.
• Validate registry metadata, paths, cache keys, hashes, and declared files.
• Refresh installed copies that contain undeclared files.
• Treat registry traversal errors as failed verification so fallbacks can continue.
• Re-review unchanged bundles when the cached review lacks an audit marker.
• Test detection, installation, review states, migration behavior, and registry integrity.

Why

Projects using the published Xquik package had no AutoSkills match. Exact package detection avoids unrelated Twitter packages.

The explicit audit marker separates OpenAI-reviewed records from skipped and ambiguous historical records. Audited syncs now re-review old approvals that lack this marker. No-review syncs retain their cache until an audit can run.

The whole-registry validator also replaces the existing Elysia placeholder bundle hash with its computed SHA-256 value. Without this correction, the validator rejects the upstream registry before any Skill can install.

Fixes #181.

Review changes

• Addressed every current CodeRabbit inline finding.
• Merged the public Skill corrections through fix(skill): harden bounded delivery examples Xquik-dev/x-twitter-scraper#62 through feat(autoskills): add React Hook Form support #87.
• Resynced the exact final public source bundle.
• Added an audit-marker migration test using a historical manifest.
• Preserved reviewed registry records and their security results.
• Removed unrelated FastMCP changes.
• Kept automatic retries limited to safe reads.
• Added exact approval scopes for metered reads, private data, exports, and webhooks.
• Made webhook admission and draw attempts atomic and concurrency-safe.
• Hardened cursor serialization, page validation, UTF-8 handling, event deduplication, and Retry-After behavior.
• Made traversal-failure coverage platform-independent with an injected file lister.
• Protected webhook secrets, direct metered searches, subscription event types, and extraction pagination.

Verification

• pnpm --dir packages/autoskills test: 378 passed
• pnpm --dir packages/autoskills build
• pnpm fmt:check
• pnpm lint: passed with 11 existing warnings outside this change
• pnpm build
• Direct Node 22.6.0 test run: 376 passed before the added migration test
• Exact 71-file registry and public-source comparison: no differences
• Public diff confidentiality scan: clean

pnpm --dir packages/autoskills validate:registry reports 1 defect already present on main: the FastMCP map entry has no registry entry. This pull request does not change FastMCP.

SkillSpector scanned all 71 public components. It reports 1 MIT-license heuristic, 0 confirmed issues, and a safe 3/100 risk score.

Checklist

• Manual testing completed
• Automated tests pass locally
• Edge cases considered and tested
• Documentation updated
• No secrets or private material published

Summary by CodeRabbit

• Nuevas funciones

  • Añadida compatibilidad con Xquik para consultar y gestionar datos de X/Twitter mediante REST, MCP, SDKs, webhooks y exportaciones.
  • Incorporados flujos para búsquedas, extracciones, tendencias, monitores, sorteos, medios, soporte y operaciones aprobadas.
  • Xquik aparece entre las tecnologías compatibles y destacadas.

• Seguridad

  • Añadidos controles de autenticación, privacidad, aprobaciones explícitas, validación de archivos y verificación de integridad.

• Documentación

  • Incluidas guías, ejemplos y referencias de API, tipos, webhooks, seguridad y alternativas.

• Mejoras

  • Mejorada la gestión de revisiones omitidas y la información mostrada durante la instalación.