Sync vendored skills with skills main (c7bc1bb / #67)

[davidmytton]

Summary

Updates the claimed/vendored skill tip to match current arcjet/skills main at c7bc1bb323780c90ffe0bd6d7f886c8f9c9648d2 (arcjet/skills#67, merged 2026-09-17).

This is a follow-up to #26, which synced 7d0b141f (skills#66) plus review-nit clarifications that later became skills#67.

#25 is closed as superseded. That PR vendored skills tip b7514f09 (older than both #26 and this tip). Did not push onto rei’s branch.

Files were fetched from GitHub (cloned arcjet/skills at that SHA) rather than rewritten by hand. After copy, this repo’s dprint formatter was applied so CI’s format check passes.

What changed

Canonical copy is plugins/arcjet/skills/ (skills/ is the inbound symlink).

Skills#67 touched two files only:

1. arcjet/SKILL.md — Go routing table is four columns: Go framework | Surfaces | Import | Skill (Surfaces hold functool, mcptool, agent.Config.Middlewares; Import is only github.com/arcjet/arcjet-go/agentframework).
2. integrate-arcjet-guard-agent-framework-go/SKILL.md — compatibility and Step 1 clarify that Go >= 1.26 is the agentframework module requirement; root github.com/arcjet/arcjet-go stays Go 1.25+.

Those same clarifications already landed as review nits on #26. After copy + dprint, the skill tree has no remaining file delta versus plugin main. This PR records the new tip in CHANGELOG.md so the next vendor sync does not reintroduce the pre-#67 wording from skills 7d0b141f.

What was left alone

Deprecated alias skill directories are not generated from the canonical skill. They are standalone deprecation stubs (add-request-protection, add-guard-protection, protect-route, add-ai-protection) and were left unchanged.

evals/ is not vendored.

No marketplace catalog or plugin-manifest work.

Formatter note

dprint table alignment treats unescaped || inside backticks as a column break (same issue as prior sync PRs). The Node version-range cells keep the escapes (\\|\\|) so the upstream ranges survive formatting:

• Node >=22.21.0 <23 || >=24.5.0 (requests + guards JS tables)

Test plan

• dprint check
• bash scripts/validate.sh
• Vendored skill dirs match skills main at c7bc1bb after dprint (arcjet/ + the seven integrate-arcjet-guard-* dirs; no JS integrate dirs on skills main; evals/ not copied)
• Confirmed the two #67 files have no remaining delta vs plugin main (already applied via Sync vendored skills with skills main (7d0b141 / #66) #26 review nits)
• Confirmed Node version-range \\|\\| escapes survived dprint
• Confirmed alias skill directories unchanged
• CI lint + validate jobs (green)

  

[arcjet-review]

Arcjet Review — 🟢 Low Risk

Decision: Checked

Rationale: This PR only adds a CHANGELOG entry documenting that the vendored skills tip has been advanced to skills main at c7bc1bb. Per the description (and confirmed by the diff), the skill tree itself has no file delta versus plugin main because the equivalent clarifications already landed as review nits on #26. The change is documentation-only, well-scoped, and carries no security, correctness, or infrastructure risk.

Summary of Changes

Adds a CHANGELOG entry recording that the vendored skill tree tip has been synced to arcjet/skills main at c7bc1bb (skills#67). No skill file contents change in this PR — the equivalent edits already landed via #26 review nits; this entry just claims the new upstream tip so the next sync will not reintroduce older wording.

Notes

The AI assessed this PR as approvable, but the trust level (1) does not allow auto-approval. A human reviewer must approve this PR.

_{Review: 3e23399c | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}