Sync vendored skills with skills main (f8959e14 / #63)

[davidmytton]

Summary

Updates the vendored skill tree to match current arcjet/skills main at f8959e141446b8f021a6b34e00211df9598a8e59 (arcjet/skills#63, merged 2026-09-16).

That SHA is skills main after the published @arcjet/* 1.12.0 / Python arcjet 1.1.0 sync (docs through arcjet-docs#939).

This is a follow-up to #22, which synced d9aadab3. Did not wait for open arcjet/skills#59 (Python ADK + Cloudflare Think) — that PR is still open (mergeable_state dirty) and is not on main.

Files were fetched from GitHub (cloned arcjet/skills at that SHA) rather than rewritten by hand. After copy, this repo’s dprint formatter was applied so CI’s format check passes.

What changed

Canonical copy is plugins/arcjet/skills/ (skills/ is the inbound symlink). Only that tree was updated. No new skill dirs and no new guards_js_* files.

Version stamps and dropped git pins (skills#63)

• @arcjet/* 1.12.0 / Python arcjet 1.1.0 / Go v1.0.0-rc.2
• JS Google ADK, TanStack AI, and Claude Managed Agents now ship on npm 1.12.0 — git SHA pins removed
• Python Claude Agent SDK, Claude Managed Agents, and Strands Agents extras now ship on PyPI 1.1.0 — git SHA pins removed (pip install "arcjet[<extra>]")
• Adapter floor clarifications: LangChain / CrewAI / OpenAI Agents remain 1.0.0+; Claude Agent SDK / Claude Managed Agents / Strands need 1.1.0
• Remote Guard policies are MCP-only (list-guard-policies / describe-guard-policy / validate-guard-policy / put-guard-policy); the CLI has no policy commands

Existing files updated in place:

• arcjet/SKILL.md plus request/guard/MCP references
• Existing guards_js_*.md adapter files (unchanged: guards_js_claude_agent_sdk.md, guards_js_langgraph.md)
• Existing Python integrate-arcjet-guard-* skill dirs (langchain-py, crewai, openai-agents-py, claude-agent-sdk-py, claude-managed-agents-py, strands-agents-py)

Skills main still has no JS integrate-arcjet-guard-* dirs. JS adapters stay in arcjet/. HTTP frameworks stay in the request references.

No extra remote-policy teaching beyond what that SHA already has (actor / inputs / policyInput wording is from upstream).

Follow-up on this branch: the Claude Managed Agents worked-example path is the verified singular https://github.com/arcjet/examples/tree/main/examples/claude-managed-agent (plural and arcjet-js example links 404).

What was left alone

Deprecated alias skill directories are not generated from the canonical skill. They are standalone deprecation stubs (add-request-protection, add-guard-protection, protect-route, add-ai-protection) and were left unchanged.

No marketplace catalog or plugin-manifest work. Hosts discover skills by scanning plugins/arcjet/skills/ (./skills/ in the Codex manifest).

Formatter note

dprint table alignment treats unescaped || inside backticks as a column break (same issue as prior sync PRs). The Node version-range cells keep the escapes (\|\|) so the upstream ranges survive formatting:

• Node >=22.21.0 <23 || >=24.5.0 (requests + guards JS tables)

Test plan

• dprint check
• bash scripts/validate.sh
• Vendored skill dirs match skills main at f8959e14 (arcjet/ + the six integrate-arcjet-guard-* dirs; existing guards_js_*.md files; no JS integrate dirs on skills main)
• Confirmed Node version-range \|\| escapes survived dprint
• Confirmed no extra remote-policy teaching beyond that SHA
• Confirmed alias skill directories unchanged
• CI lint + validate jobs

  

[arcjet-review]

Arcjet Review — 🟢 Low Risk

Decision: Checked

Rationale: Documentation-only sync of the vendored plugins/arcjet/skills/ tree to arcjet/skills main at f8959e14. All changes are to markdown files (SKILL.md, references/*.md) plus a CHANGELOG entry. The edits update version stamps (@arcjet/* 1.11.0 → 1.12.0, Python arcjet 1.0.0 → 1.1.0, Go v1.0.0-rc.1 → v1.0.0-rc.2), drop obsolete git-SHA install pins now that adapters ship on npm/PyPI, and add MCP Guard policy tool descriptions. No code, no config, no secrets, no auth/infra/CI/dependency-manifest changes. Diff is internally consistent and description accurately catalogs the changes.

Summary of Changes

Syncs the vendored plugins/arcjet/skills/ tree with arcjet/skills main at f8959e14: bumps version stamps to @arcjet/* 1.12.0 / Python arcjet 1.1.0 / Go v1.0.0-rc.2, replaces pip install ... @ git+... and @arcjet/guard SHA pins with published-package installs for Google ADK, TanStack AI, Claude Managed Agents, Claude Agent SDK (py), and Strands Agents (py), clarifies that remote actor/inputs support depends on installed adapter types, and documents MCP-only Guard policy tools. Adds a matching CHANGELOG entry. No behavior/code changes.

Notes

The AI assessed this PR as approvable, but the trust level (1) does not allow auto-approval. A human reviewer must approve this PR.

_{Review: cc6f53fe | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}