Specialized Plugins: scope and review

The repository currently defines 21 specialized plugins, each with 5–10 skills. These are curated instruction bundles for concrete jobs. They do not install service accounts, browsers, cloud infrastructure or authenticated connectors, and they do not require every included framework to be used on every task.

Canonical definitions

• data/specialized-plugin-candidates.json selects specialized plugin membership and records the editorial shortlist.
• data/editorial-bundles.json owns installable skill lists, descriptions, audience, limitations and starter prompts.
• Canonical skill IDs and compatibility are checked against skills_index.json.
• npm run bundles:sync generates plugin folders, both host marketplaces, portable manifests and bundle documentation. Generated changes belong to the protected canonical-sync PR.
• The web page reads these source definitions. Its count, prerendered metadata and live verifier must agree; do not keep a separate handwritten web list.

The source definitions, generated plugin manifests and published release are separate states. Updating this shortlist does not publish a release or update installed copies. See the plugin installation guide.

Reviewed product scope — 2026-09-05

This pass checked the 21 compositions against the current 2,113-entry catalog and sharpened their descriptions, starter briefs and adjacent-product boundaries. It is an editorial and packaging review, not proof that every included procedure has been executed successfully in every environment. The internal tier labels are historical prioritization, not reliability grades.

Composition changes

• Web App Builder: replace nextjs-best-practices with browser-automation. React performance and App Router guidance remain; the bundle now includes verification of the implemented user journey.
• Data Analytics: replace database-architect with data-quality-frameworks. Database platform architecture remains in Data Engineering Platform; analytical users get checks for data assumptions, contracts and transformations.
• Privacy & Compliance Engineering: remove the broad security-audit testing workflow. The five remaining skills cover privacy-by-design, data handling, scoped compliance and defensive review. Formal certification and legal advice remain outside its scope.
• Secure App Builder: removed security-and-hardening during the composition review because its checklist was missing at that time. The remaining nine skills retain API, backend/frontend, auth, SAST, secrets and access-review coverage. The follow-up repaired the canonical checklist; the nine-skill curated composition remains unchanged.
• All 21 plugin IDs stay stable. Removed bundle members remain canonical skills and can still be selected separately.

Choosing between related plugins

Use and verification

Open the complete included-skill list before installation. The first starter prompt specifies an input and deliverable; adapt it to the actual project and available tools. For multi-framework plugins, use the existing project stack rather than installing all alternatives. For Google Workspace, Composio-backed automations, cloud tooling and model providers, configure the separately required access before live operations.

Review scope, actual checks and omissions in the result. Browser checks do not prove all accessibility requirements, an evaluation plan is not a completed evaluation, and a control checklist is not legal certification. Publishing, sending messages, active security testing and production changes need the authorization applicable to the task.

Maintainer verification

Run skill validation, reference validation, docs security, the specialized-plugin source/packaging regression, bundle generation/checks, and the web tests/build. Verify complete web membership, expanded skill links, scope/brief visibility, filtering and release-bound links. Reject stale counts in the live-verifier fixture and inspect the built /plugins/ title and JSON-LD before any separately approved deployment.

Resolved skill-content findings — follow-up

A scan of explicit local references/ and resources/ links in the selected skill entrypoints found 30 distinct missing targets across 23 skills. These were existing content defects, not missing files introduced by bundle generation. The follow-up supplies all 30 targets and the formerly selected hardening checklist. It also replaces unsupported template/script promises with actual inline procedures or available-integration workflows. The regression now checks prose-declared resources, references, assets and scripts across every selected entrypoint and verifies resource bytes in specialized distributions. Fenced application paths are excluded because they may belong to the target project; this is not a claim that every example has been run against live services.

Follow-up verification scope

Expanding the same scan to prose-declared assets and scripts found 51 missing targets across 28 skill entrypoints, including the original 30. All are now supplied or replaced with an actual inline/available-tool workflow. Added companion documents are locally authored procedures, not claimed recoveries of upstream files.

• Added 21 task-specific implementation playbooks, ten checklists/reference guides and executable normalized KPI query examples.
• Replaced non-existent Google Docs/Sheets/Slides clients and OAuth claims with workflows using actual available integrations and read-back checks.
• Corrected nonterminating/oversized chunking, implicit embedding-prefix failure, cohort denominators, acquisition-spend multiplication and missing SLO recording rules; covered pure behavior with offline regression tests.
• Reworked secret handling and payment-control guidance to remove secret logging and unsupported compliance/utility claims. Updated tracing and CI patterns to avoid obsolete or imaginary runnable setup.
• Repaired the previously removed hardening skill's checklist without changing the curated plugin composition again.
• No release, live service operation, account configuration or deployment is part of this repair.