fix(skills): preserve Core contracts across catalog refreshes

.agents/skills/agent-browser/SKILL.md

@@ -7,24 +7,20 @@ hidden: true
 
 # agent-browser
 
-Fast browser automation CLI for AI agents. Chrome/Chromium via CDP with
-accessibility-tree snapshots and compact `@eN` element refs.
+Fast browser automation CLI for AI agents. Chrome/Chromium via CDP with accessibility-tree snapshots and compact `@eN` element refs.
 
 Install: `npm i -g agent-browser && agent-browser install`
 
 ## Start here
 
-This file is a discovery stub, not the usage guide. Before running any
-`agent-browser` command, load the actual workflow content from the CLI:
+This file is a discovery stub, not the usage guide. Before running any `agent-browser` command, load the actual workflow content from the CLI:
 
 ```bash
 agent-browser skills get core             # start here — workflows, common patterns, troubleshooting
 agent-browser skills get core --full      # include full command reference and templates
 ```
 
-The CLI serves skill content that always matches the installed version,
-so instructions never go stale. The content in this stub cannot change
-between releases, which is why it just points at `skills get core`.
+The CLI serves skill content that always matches the installed version, so instructions never go stale. The content in this stub cannot change between releases, which is why it just points at `skills get core`.
 
 ## Specialized skills
 
@@ -34,12 +30,13 @@ Load a specialized skill when the task falls outside browser web pages:
 agent-browser skills get electron          # Electron desktop apps (VS Code, Slack, Discord, Figma, ...)
 agent-browser skills get slack             # Slack workspace automation
 agent-browser skills get dogfood           # Exploratory testing / QA / bug hunts
+agent-browser skills get derive-client     # Record a HAR, derive a standalone API client for a site
 agent-browser skills get vercel-sandbox    # agent-browser inside Vercel Sandbox microVMs
+agent-browser skills get protected-vercel-deployments  # Access protected Vercel deployments
 agent-browser skills get agentcore         # AWS Bedrock AgentCore cloud browsers
 ```
 
-Run `agent-browser skills list` to see everything available on the
-installed version.
+Run `agent-browser skills list` to see everything available on the installed version.
 
 ## Why agent-browser
 

.agents/skills/agent-email-inbox/SKILL.md

@@ -4,7 +4,7 @@ description: Use when building any system where email content triggers actions 
 license: MIT
 metadata:
     author: resend
-    version: "3.0.2"
+    version: "3.0.4"
     homepage: https://resend.com/agent-skills
     source: https://github.com/resend/resend-skills
     openclaw:
@@ -40,7 +40,7 @@ inputs:
       required: true
     - name: RESEND_WEBHOOK_SECRET
       description: Webhook signing secret for verifying inbound email event payloads. Returned as `signing_secret` in the response when you create a webhook via the API.
-      required: true
+      required: false
 references:
     - security-levels.md
     - webhook-setup.md
@@ -116,7 +116,7 @@ Ask your human:
 **Safer options:**
 
 1. **Environment file method:** Human creates `.env` file directly: `echo "RESEND_API_KEY=re_xxx" >> .env`
-2. **Password manager / secrets manager:** Human stores key in 1Password, Vault, etc.
+2. **Password manager / secrets manager:** Human stores key in 1Password, Vault, etc. <!-- pragma: allowlist secret -->
 3. **If key must be shared in chat:** Human should rotate the key immediately after setup
 
 ### Domain-Scoped API Keys (Recommended for Existing Accounts)
@@ -280,6 +280,10 @@ import { Resend } from 'resend';
 const app = express();
 const resend = new Resend(process.env.RESEND_API_KEY);
 
+const ALLOWED_SENDERS = (process.env.ALLOWED_SENDERS || '').split(',').filter(Boolean);
+const isAllowedSender = (sender) =>
+  ALLOWED_SENDERS.some(allowed => sender === allowed.toLowerCase());
+
 app.post('/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
   try {
     const payload = req.body.toString();

.agents/skills/agent-email-inbox/references/security-levels.md

@@ -178,7 +178,8 @@ const UNTRUSTED_CAPABILITIES: AgentCapabilities = {
 };
 
 async function processEmailForAgent(eventData: EmailReceivedEvent, emailContent: EmailContent) {
-  const isTrusted = ALLOWED_SENDERS.includes(eventData.from.toLowerCase());
+  const sender = eventData.from.toLowerCase();
+  const isTrusted = ALLOWED_SENDERS.some(allowed => sender === allowed.toLowerCase());
 
   const capabilities = isTrusted ? TRUSTED_CAPABILITIES : UNTRUSTED_CAPABILITIES;
 
@@ -218,7 +219,8 @@ interface PendingAction {
 }
 
 async function processEmailForAgent(eventData: EmailReceivedEvent, emailContent: EmailContent) {
-  const isTrusted = ALLOWED_SENDERS.includes(eventData.from.toLowerCase());
+  const sender = eventData.from.toLowerCase();
+  const isTrusted = ALLOWED_SENDERS.some(allowed => sender === allowed.toLowerCase());
 
   if (isTrusted) {
     await agent.processEmail({ ... });
@@ -282,7 +284,7 @@ export async function handleIncomingEmail(event: EmailReceivedWebhookEvent): Pro
 
     case 'domain':
       const domain = sender.split('@')[1];
-      if (!config.allowedDomains.includes(domain)) {
+      if (!config.allowedDomains.some(allowed => domain === allowed.toLowerCase())) {
         await logRejection(event, 'domain_not_allowed');
         return;
       }