Sync vendored skills with skills main (b9606c28 / #68)

[davidmytton]

Summary

Updates the vendored skill tree to match current arcjet/skills main at b9606c28cb05ece8d76f0a6bf101c0109669cee9 (arcjet/skills#68, merged 2026-09-17).

This is a follow-up to #27, which synced c7bc1bb (skills#67). There were no open plugin vendor PRs to supersede.

Files were fetched from GitHub (cloned arcjet/skills at that SHA) rather than rewritten by hand. After copy, this repo’s dprint formatter was applied so CI’s format check passes. Formatting-only paths (requests_javascript.md, requests_python.md, and two unchanged Python integrate skills) collapsed to no-ops after dprint, leaving the same 18-file content delta as skills#68.

What changed

Canonical copy is plugins/arcjet/skills/ (skills/ is the inbound symlink). Only that tree and CHANGELOG.md were updated.

Skills#68 is docs-only in skills (18 markdown files):

• Dropped stale 1.12.0 caveats now that @arcjet/guard 1.13.0 and PyPI arcjet 1.2.0 are out. Every listed JS adapter, plus actor / inputs / validateGuardLabel, ships in 1.13.0. validate_guard_label and adapter actor / inputs are in Python 1.2.0.
• Step 3 adds a coding-agent hooks path (Claude Code / GitHub Copilot). There is no SDK and no guard() call. Publishing a policy attached to Execute on (Tool call or Prompt) turns it on. Install HTTP hooks from https://docs.arcjet.com/coding-agents — copy the templates, do not invent URLs. Hook URLs must not name a policy and must omit ?surface= (managed settings reach CLI, IDE, Desktop, and cloud; a hard-coded cli mislabels most traffic). choosing_protections.md and mcp.md agree on the same install rule.
• Label pre-check teaching now names validateGuardLabel / validate_guard_label / ValidateGuardLabel (JS / Python / Go). Prefer dash/dot in new labels. A slug the service will not match reads as ALLOW with hasFailedOpen() / has_failed_open() / HasFailedOpen() false.
• JS adapter refs replace loose “Node.js 22+” with the published engines range >=22.21.0 <23 || >=24.5.0.
• The skill table marks the Guard entry point as core guard({ label }) so it is not read as the wrapper action API. Import policyInput from @arcjet/guard, not an adapter path.
• LangGraph fail-closed line now matches the other JS adapters (optional peers, then Node engines). ExperimentalGuardModerateContent is a deprecated alias (no “until 1.0”).

Existing files updated in place. No new skill dirs. Skills main still has no JS integrate-arcjet-guard-* dirs — JS adapters stay in arcjet/.

No extra remote-policy / actor / inputs / policyInput teaching beyond that SHA.

What was left alone

Deprecated alias skill directories are not generated from the canonical skill. They are standalone deprecation stubs (add-request-protection, add-guard-protection, protect-route, add-ai-protection) and were left unchanged.

evals/ is not vendored.

No marketplace catalog or plugin-manifest work. Hosts discover skills by scanning plugins/arcjet/skills/ (./skills/ in the Codex manifest).

Formatter note

dprint table alignment treats unescaped || inside backticks as a column break (same issue as prior sync PRs). The Node version-range cells keep the escapes (\|\|) so the upstream ranges survive formatting:

• Node >=22.21.0 <23 || >=24.5.0 (requests + guards JS tables)

Adapter-file ranges live in prose, not table cells, so they stay unescaped.

Test plan

• dprint check
• bash scripts/validate.sh
• Vendored skill dirs match skills main at b9606c28 after dprint (arcjet/ + the seven integrate-arcjet-guard-* dirs; no JS integrate dirs on skills main; evals/ not copied)
• Confirmed the 18 files from skills#68 are the only skill-tree delta
• Confirmed Node version-range \|\| escapes survived dprint
• Confirmed alias skill directories unchanged
• CI lint + validate jobs (green)

  

[arcjet-review]

Arcjet Review — 🟢 Low Risk

Decision: Checked

Rationale: Docs-only vendored skills sync. All changes are markdown updates under plugins/arcjet/skills/ plus a corresponding CHANGELOG.md entry. No code, no dependencies, no infrastructure. Diff matches the PR description (18 skill markdown files + CHANGELOG). No secrets, no auth logic, no user-input handling. Formatter (dprint) tweaks to a table are cosmetic column-width adjustments. No security concerns identified.

Summary of Changes

Syncs the vendored arcjet skill tree under plugins/arcjet/skills/ to upstream arcjet/skills main at b9606c28 (skills#68). Docs-only: drops 1.12.0 version caveats now that @arcjet/guard 1.13.0 / PyPI arcjet 1.2.0 are out, adds a coding-agent hooks path (Claude Code / Copilot) with explicit guidance to omit ?surface= from hook URLs, teaches validateGuardLabel/validate_guard_label/ValidateGuardLabel for label pre-checks, replaces loose 'Node.js 22+' with the published engines range >=22.21.0 <23 || >=24.5.0, clarifies the Guard entry point as core guard({ label }), and notes ExperimentalGuardModerateContent is a deprecated alias. CHANGELOG updated with a matching entry.

Notes

Skipped loading the security-review skill: the diff is entirely prose in vendored documentation with no executable code, secrets, or configuration. The 'do not invent URLs' / 'omit ?surface=' guidance in the docs is authored content, not something to validate as behavior.

The AI assessed this PR as approvable, but the trust level (1) does not allow auto-approval. A human reviewer must approve this PR.

_{Review: 9942e3ae | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}