{
  "name": "valtown — 11 skills",
  "slug": "source-skills-037a44e3e10656a94b0d9455",
  "type": "skills",
  "category": "developer-tools",
  "example": false,
  "evidence_state": "pinned_source_listing",
  "stamp": "Pinned source listing — machine-checked",
  "summary": "Pinned source declarations and file hashes were listed.",
  "outcome": "Listed 11 skill declarations. Ran 23 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
  "rule_results": [
    "The retained source tree matches its acquisition manifest.",
    "Declared skill names (listing.json): blob-storage; client-side-js; create-skill; cron-and-intervals; email; http-endpoints; oauth; react-ui; restricted-access; sqlite-storage; third-party-integrations"
  ],
  "task": "What declarations and files are present in this pinned source?",
  "setup": "Git blob acquisition followed by static source inspection.",
  "limitations": "Scope: acquisition and static inspection. Command results: commands.json.",
  "source_url": "https://github.com/val-town/plugins.git",
  "documentation_url": "https://github.com/val-town/plugins.git",
  "commit": "555ff7492c9c70ada2c4e9b66d7dea9367d7ce71",
  "tree_sha256": "3fdf0998652921db79c20fc72951b4560c3d3ada3d96d47c74db7ffdf9e07c57",
  "file_sha256": {
    "plugin/.claude-plugin/plugin.json": "82a5830745641727307dd62bf1e23e1e2a1e065d83ccff729de00f5238eabda5",
    "plugin/.codex-plugin/plugin.json": "cbe50911d99d8d4f9785ba45795f531aef86a6a8e6684a116336d0348150ca96",
    "plugin/.cursor-plugin/plugin.json": "baa4b4af0cf6ac6988ae5c2a634f2320c1c8c542965833481e5b7d5d11a6e8bd",
    "plugin/.mcp.json": "b9faff1d7ee4e6887cceede3bfa550502f789656324c7f45ca91bc18a81e4943",
    "plugin/assets/icon.svg": "c19c82a56aa25377058150f7037ee5d7f4ec82914a25fc22bf8482b3447fc052",
    "plugin/mcp.json": "d88a5e1ad0550d1b2ab0dec15f63879e5d0201fb72ab042dd7351a73319bf306",
    "plugin/skills/blob-storage/SKILL.md": "28d19fe232b86d7ff177e77c5250ac94ea8ec93615b0324f61ca9325aabf4dd6",
    "plugin/skills/client-side-js/SKILL.md": "ad8a52fb99fe31b9cbc365ab5313f4a44641750b2e856c531483fe57460f82d9",
    "plugin/skills/create-skill/SKILL.md": "faaa88bfddd22999675c0de84feea25b35020797f73a2a589a30042365c119dd",
    "plugin/skills/cron-and-intervals/SKILL.md": "77f8bb7e694784ce6bb67183e5e79b4690c76041c93b82e6b36fe8cb6f53d14d",
    "plugin/skills/email/SKILL.md": "198a78c43bf487575450738143714917a20316e168c829c6a914026e8a4f89cf",
    "plugin/skills/http-endpoints/SKILL.md": "c98955e6bced467a52ba7c9fb80b9f28e93ae0ecdc9defad6ac2fa5b892725fd",
    "plugin/skills/oauth/SKILL.md": "9fd4aa50769b3eb71eb58cbc8ad04f1b38e0be080e4990ca5f15280f7c5c401d",
    "plugin/skills/react-ui/SKILL.md": "6aa3e7fd43125b93d3deddca24e14a981cb7459ba4ce522c13767dfcc48da446",
    "plugin/skills/restricted-access/SKILL.md": "9f51352d63518bf8668e0d2dd65824651d5c4e5e445d42d6b1153888517c794f",
    "plugin/skills/serve-html": "ecda6aee6ed23d4b2f4914d97b289eb2967507e8de442626442620308309b31b",
    "plugin/skills/sqlite-storage/SKILL.md": "6ab49326b577185bfed9c6ce3d7615d780f6078f2b2824294ef60d393932f8fe",
    "plugin/skills/third-party-integrations/SKILL.md": "1ce88c22c056f3404fc18fec500bbefd801ddf87afefaae7c989ceed810fc2c2"
  },
  "lockfiles": [
    "LOCK.json"
  ],
  "utc_date": "2026-10-20T00:19:02Z",
  "source_date": "2026-10-16",
  "discovered_date": "2026-10-16",
  "retested_date": "2026-10-20",
  "reviewed_date": "2026-10-20",
  "published_date": "2026-10-20",
  "modified_date": "2026-10-20",
  "reviewer": "machine pipeline",
  "harness_version": "toolwitness harness at commit 80347ac5c68b1268b011b015a8797984151a16e7",
  "claude_code_version": "Not applicable: static source inspection (commands.json).",
  "model_id": "Not applicable: static source inspection (commands.json).",
  "scanner_version": "Not applicable: static source inspection.",
  "rulepack_version": "Not applicable: static source inspection.",
  "agents": [],
  "disclaimer": "This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.",
  "commands": [
    "Ran 23 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."
  ],
  "prompt_list": [
    "Not applicable: static source inspection (commands.json)."
  ],
  "history": [
    "2026-10-20T00:19:02Z: pinned source inspection"
  ],
  "application": {
    "name": "valtown — 11 skills",
    "softwareVersion": "555ff7492c9c70ada2c4e9b66d7dea9367d7ce71",
    "applicationCategory": "DeveloperApplication",
    "operatingSystem": "Not exercised"
  },
  "artifacts": {
    "transcript": "Ran 23 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
    "sinkhole_log": "Not applicable: static source inspection (commands.json).",
    "canary_log": "Not applicable: static source inspection (commands.json).",
    "scanner_output": "Not applicable: static source inspection (commands.json).",
    "normalized_text": "{\n  \"listing\": {\n    \"skills\": [\n      {\n        \"path\": \"plugin/skills/blob-storage/SKILL.md\",\n        \"name\": \"blob-storage\",\n        \"description\": \"Use when a val needs simple key/value persistence — JSON documents, cached responses, uploaded files, or binary assets. Covers the std/blob API, listing and deleting keys, account-global or val scoping, and storage limits.\",\n        \"files\": {\n          \"plugin/skills/blob-storage/SKILL.md\": \"28d19fe232b86d7ff177e77c5250ac94ea8ec93615b0324f61ca9325aabf4dd6\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/client-side-js/SKILL.md\",\n        \"name\": \"client-side-js\",\n        \"description\": \"Use when a val needs to ship JavaScript that runs in the browser — React apps, vanilla DOM scripts, canvas/games, htmx/Alpine, or any client-side module beyond a single inline snippet. Explains how Val Town serves transpiled .ts/.tsx/.jsx modules with no build step, how the browser resolves their imports, and how to load third-party deps.\",\n        \"files\": {\n          \"plugin/skills/client-side-js/SKILL.md\": \"ad8a52fb99fe31b9cbc365ab5313f4a44641750b2e856c531483fe57460f82d9\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/create-skill/SKILL.md\",\n        \"name\": \"create-skill\",\n        \"description\": \"Use when the user wants to persist a preference, skill, or knowledge. Use when it would aid future val development to store a memory of how best to build something.\",\n        \"files\": {\n          \"plugin/skills/create-skill/SKILL.md\": \"faaa88bfddd22999675c0de84feea25b35020797f73a2a589a30042365c119dd\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/cron-and-intervals/SKILL.md\",\n        \"name\": \"cron-and-intervals\",\n        \"description\": \"Use when building a val that runs on a schedule — periodic jobs, recurring tasks, polling, cron jobs, monitoring, alerting. Covers the interval handler signature, cron expressions, the UTC timezone constraint, and the `lastRunAt` pattern for detecting new items since the previous run.\",\n        \"files\": {\n          \"plugin/skills/cron-and-intervals/SKILL.md\": \"77f8bb7e694784ce6bb67183e5e79b4690c76041c93b82e6b36fe8cb6f53d14d\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/email/SKILL.md\",\n        \"name\": \"email\",\n        \"description\": \"Use when a val sends email, receives email, or is triggered by an incoming email. Covers email-type vals (the Email handler shape, attachment limits, the assigned val email address) and sending mail via std/email.\",\n        \"files\": {\n          \"plugin/skills/email/SKILL.md\": \"198a78c43bf487575450738143714917a20316e168c829c6a914026e8a4f89cf\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/http-endpoints/SKILL.md\",\n        \"name\": \"http-endpoints\",\n        \"description\": \"Use when building an HTTP val — a web endpoint, API route, webhook receiver, or any val that responds to HTTP requests. Covers the handler signature, Hono usage, the endpoint URL, CORS behavior, redirects, and Val Town-specific limitations.\",\n        \"files\": {\n          \"plugin/skills/http-endpoints/SKILL.md\": \"c98955e6bced467a52ba7c9fb80b9f28e93ae0ecdc9defad6ac2fa5b892725fd\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/oauth/SKILL.md\",\n        \"name\": \"oauth\",\n        \"description\": \"Use when a val needs to require login with a Val Town account — gating routes behind authentication, identifying the current user, building user-specific dashboards. Covers std/oauth's `oauthMiddleware` and `getOAuthUserData`, the auto-managed `/auth/*` routes, and session behavior. For third-party OAuth providers (Google, GitHub, etc.) see the `third-party-integrations` skill instead.\",\n        \"files\": {\n          \"plugin/skills/oauth/SKILL.md\": \"9fd4aa50769b3eb71eb58cbc8ad04f1b38e0be080e4990ca5f15280f7c5c401d\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/react-ui/SKILL.md\",\n        \"name\": \"react-ui\",\n        \"description\": \"Use when building any val with a user interface — dashboards, web apps, landing pages, forms, admin tools, anything users see in a browser. Covers JSX/React conventions, Twind/Tailwind styling, React version pinning, the view-source link requirement, and what to avoid (template-string HTML, external assets).\",\n        \"files\": {\n          \"plugin/skills/react-ui/SKILL.md\": \"6aa3e7fd43125b93d3deddca24e14a981cb7459ba4ce522c13767dfcc48da446\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/restricted-access/SKILL.md\",\n        \"name\": \"restricted-access\",\n        \"description\": \"Use when a val's HTTP endpoints should not be open to the whole internet — limiting an app to a team, understanding why an endpoint redirects to a login page, letting a webhook through, or identifying which Val Town user is viewing an app. Covers app access (`httpPrivacy`), org grants, bypass tokens for automation, and the `X-Val-Town-User` identity header. For building your own login flow inside a val, see the `oauth` skill instead.\",\n        \"files\": {\n          \"plugin/skills/restricted-access/SKILL.md\": \"9f51352d63518bf8668e0d2dd65824651d5c4e5e445d42d6b1153888517c794f\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/sqlite-storage/SKILL.md\",\n        \"name\": \"sqlite-storage\",\n        \"description\": \"Use when a val needs to store structured or relational data. Covers the std/sqlite API, parameterized queries, transactions, and the val-scoped vs organization-scoped database distinction.\",\n        \"files\": {\n          \"plugin/skills/sqlite-storage/SKILL.md\": \"6ab49326b577185bfed9c6ce3d7615d780f6078f2b2824294ef60d393932f8fe\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/third-party-integrations/SKILL.md\",\n        \"name\": \"third-party-integrations\",\n        \"description\": \"Use when a val talks to an external service — Slack, Discord, Telegram, Stripe, GitHub, Gmail, Google Sheets, Postgres/Supabase/Upstash/Neon, browser automation (Playwright, Browserbase, Kernel, Steel), web scraping, PDF generation, push notifications, RSS, or any other third-party API. Covers the required workflow (fetch the Val Town guide, get credentials, test, store secrets) and the catalog of available guides.\",\n        \"files\": {\n          \"plugin/skills/third-party-integrations/SKILL.md\": \"1ce88c22c056f3404fc18fec500bbefd801ddf87afefaae7c989ceed810fc2c2\"\n        }\n      }\n    ],\n    \"hooks\": [],\n    \"executions\": []\n  }\n}"
  },
  "review_input": {
    "identity_artifact": "identity.json",
    "evidence_sha256": {
      "LOCK.json": "cb5f9582645342e1b30f501f976cd220e264ecf86436fbddedfed4ae4ba9c0c0",
      "commands.json": "581881d36ef04e3b9c44775a334388230fa7ff48c8a6e367aa627557aa7a95e8",
      "complete.json": "91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f",
      "identity.json": "755c77d897aecdeb3254bf4e22dbc60f37985a0f87e40b8f06fdb2e7d8fa37be",
      "listing.json": "6c052267821a6c2b3e65e6766f8efc65e3aef2d0b359e36c78d4f6766ed74769",
      "selection.json": "0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"
    },
    "claims": [
      {
        "id": "acquired",
        "field": "summary",
        "text": "Pinned source declarations and file hashes were listed.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "listed",
        "field": "outcome",
        "text": "Listed 11 skill declarations. Ran 23 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "tree",
        "field": "rule_results.0",
        "text": "The retained source tree matches its acquisition manifest.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "declared",
        "field": "rule_results.1",
        "text": "Declared skill names (listing.json): blob-storage; client-side-js; create-skill; cron-and-intervals; email; http-endpoints; oauth; react-ui; restricted-access; sqlite-storage; third-party-integrations",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      }
    ]
  },
  "review": {
    "kind": "machine-checked",
    "date": "2026-10-20",
    "reviewed_sha256": "c7030196ea5f5f6317e159e29162b22367a4bd2e4fb74a709503a98c3086028a",
    "gates": "59d099aea290ca5c9d588bd895984de32db37364292367f8672d034e66f685bc",
    "codex": "9e27108e99e4f7dc29039a878e5eac6fc6948fca546df7ec9d8a82e8a5ce65cc",
    "grok": "f5ae01004486ba35e6a88130458dc7101ff05fdde2f104dcb5dcdc5ba4a36f16",
    "summary": "Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."
  }
}