Agrici Daniel
87872da7d3
Verify every open pull request and issue against current code and primary sources. Refresh Google guidance and promote the bundled Brain only after deterministic and independent audits pass. - Add live and offline Google currentness enforcement. - Add complete Brain source-review records and public projection gates. - Fix analyzer, installer, dependency, and security regressions. - Record the evidence-led PR and issue disposition in release notes. This does not merge or close external pull requests or issues. Antivirus vendor reclassification remains external. Verified: - Root tests: 343 passed, 1 skipped. - Brain tests: 26 passed. - Brain audit: market-ready, score 100, no warnings. - Brainstein strict audit: SSS+, score 100, no warnings. - Google live and offline currentness checks passed. - Secret scan passed with 217 adjudicated findings and none unexpected. - Public release, consistency, plugin, lock, prose, and actionlint gates passed. Co-Authored-By: GPT-5 <noreply@openai.com>
11 KiB
Contributors
Claude Blog is built by @AgriciDaniel with contributions from the AI Marketing Hub community.
v1.8.1 through v1.8.6: Hostile-audit hardening (2026-05-17)
Seven rounds of hostile re-audit (cybersecurity + GitHub + documentation + code-quality + test-coverage tracks) caught defects each round that prior rounds missed. Each round was executed by parallel review passes with file:line evidence requirements. The audit pattern itself is documented across CHANGELOG.md v1.8.1 through v1.8.6 entries.
- v1.8.1: closed 27 findings from a three-track audit (catastrophic
parse_engagementregex bug, indirect prompt injection on project-root auto-load, path-traversal hardening, NOTICE attribution). - v1.8.2: per-load nonce contract + project-wide ASCII em-dash cleanup (script-driven, missed unicode em-dashes).
- v1.8.3: code-CAPABLE nonce defense via
scripts/load_untrusted_root.py+ 6 HIGH prose breakages + O(n^2) DoS close. - v1.8.4: CI prose-hygiene linter (
scripts/lint_prose.py) + version-coherence check + 30 unicode em-dashes cleaned (the v1.8.2/v1.8.3 cleanup missed unicode). - v1.8.5: CLAUDE.md / ARCHITECTURE.md updates +
tests/test_lint_prose.py+ OUTERMOST nonce-authority instruction + command-coherence regression test. - v1.8.6: installer-sync fix (the v1.8.0+ helpers were never copied by install.sh) + 10 stale sub-skill SKILL.md versions resolved + sub-skill coherence test + 4-backtick fence handling + YAML-quote-tolerant version regex.
Calibrated score arc: 68/100 (v1.8.0) -> ~91/100 plateau (v1.8.5) -> ~96/100 (v1.8.6 ceiling per /best-practices kernel; 100/100 is structurally unreachable per the asymptote analysis in CHANGELOG v1.8.5).
v1.8.0: Methodology adaptation from impeccable (2026-05-16)
Four editorial methodologies in v1.8.0 are adapted from the impeccable frontend-design plugin (v3.1.1, Apache 2.0, by Paul Bakaus).
| Methodology | Source in impeccable | Adapted in claude-blog |
|---|---|---|
| Two-tier AI slop detection (first-order + second-order reflex) | skills/impeccable/SKILL.md (category-reflex check) |
skills/blog/references/ai-slop-detection.md |
| Ordinal 0-4 heuristic rubric with P0-P3 severity | skills/impeccable/reference/heuristics-scoring.md |
skills/blog/references/editorial-heuristics.md |
| Cognitive-load assessment (intrinsic / extraneous / germane, 4-item working-memory ceiling) | skills/impeccable/reference/cognitive-load.md |
skills/blog/references/cognitive-load.md + scripts/cognitive_load.py |
| Durable context-loading pattern (PRODUCT.md / DESIGN.md auto-loaded by every command) | skills/impeccable/scripts/load-context.mjs + reference/teach.md |
skills/blog-brand/SKILL.md (BRAND.md + VOICE.md) |
Impeccable polishes user interfaces; this release applies the same mental models to prose. No code is copied verbatim; the adaptation is at the methodology level. Each adapted reference file links back to its impeccable source in its Attribution section.
License of the source: Apache 2.0. claude-blog remains MIT-licensed; the Apache 2.0 attribution requirement is satisfied via the credit lines in each adapted file plus this section.
v1.8.0 (continued): Methodology adaptation from last30days-skill (2026-05-16)
Three research-discipline methodologies in v1.8.0 are adapted from the last30days-skill plugin (v3.2.1, MIT, by Matt Van Horn).
| Methodology | Source in last30days-skill | Adapted in claude-blog |
|---|---|---|
| Multi-platform discourse research (Reddit / HN / X / YouTube / etc.) | skills/last30days/SKILL.md + scripts/last30days.py (API-driven) |
skills/blog-discourse/SKILL.md + scripts/discourse_research.py (API-free, WebSearch + site operators) |
| 5-dimension research quality rubric (groundedness, specificity, coverage, actionability, format) | docs/search-quality-eval.md + SKILL.md scoring |
skills/blog/references/research-quality.md |
Synthesis voice contract: 6 portable LAWs of 8 upstream (no trailing Sources block, no invented titles, no em-dashes, no raw cluster dumps, inline [name](url) citations, discrete claims) |
skills/last30days/SKILL.md "VOICE CONTRACT LAW" section |
skills/blog/references/synthesis-contract.md. Upstream LAW 5 (engine-footer pass-through) and LAW 7 (--plan flag mandatory) are last30days runtime-specific and intentionally not ported. |
| Pre-flight keyword-trap classes (demographic shopping, numeric trap, overly-literal, generic single-noun) | skills/last30days/SKILL.md "Step 0.45" |
embedded in research-quality.md |
| Named-entity topic decomposition pattern (Step 0.55) | skills/last30days/SKILL.md "Step 0.55" |
embedded in research-quality.md, referenced by agents/blog-researcher.md |
| Freshness-first ranking concept | skills/last30days/SKILL.md ranking-and-scoring section |
freshness-floor table in research-quality.md (30-day / 90-day) |
The upstream is a sophisticated multi-platform research engine that calls Reddit, X, YouTube, TikTok, Hacker News, Polymarket, GitHub, Bluesky, and other platform APIs and scores results by live engagement (upvotes, likes, prediction-market money). claude-blog ports the editorial methodology without the API plumbing: blog-discourse runs against WebSearch results with platform-targeted site operators (e.g. site:reddit.com, site:news.ycombinator.com, site:x.com), so it works in any environment without keys.
License of the source: MIT. claude-blog remains MIT-licensed. Attribution is a courtesy under MIT (not a strict requirement); credit is included in each adapted file plus this section.
v1.7.0: Pro Hub Challenge Community Release (2026-04-27)
In March 2026, the AI Marketing Hub Pro community ran the first Pro Hub Challenge: members built skills and extensions for the claude-blog and claude-seo ecosystems. Six submissions were independently audited (security, functionality, code quality, documentation, dependencies, SKILL.md discoverability, innovation). Five scored Proficient or above. After security review and clean-room re-implementation in the claude-blog voice and security posture, two submissions were integrated as core skills in v1.7.0.
Integrated as core skills
| Contributor | Original submission | Integrated as | Score |
|---|---|---|---|
| Lutfiya Miller (winner) | semantic-cluster-engine | blog-cluster (semantic topic-cluster planning + execution engine) |
95 / 100 Exemplary |
| Chris Mueller | claude-blog-multilingual | blog-multilingual, blog-translate, blog-localize, blog-locale-audit + blog-translator agent |
85 / 100 Proficient |
The cluster engine was the highest-scoring submission of the entire challenge. Lutfiya's design (Plan + Execute architecture with cluster-context injection into per-post writes) is preserved verbatim; we removed brand-specific styling and image prompts, hardened the HTML output against XSS, and routed through claude-blog's existing sub-skills.
Chris's multilingual suite was the most blog-native submission: four user-facing skills explicitly designed for claude-blog. The audit flagged a direct download-to-shell installer and credential handling; both are removed in this port. The shared cultural-adaptation.md reference is referenced (not duplicated) by blog-localize. The blog-translator agent ships without Bash access (per the v1.9.6 lesson from claude-seo: prompt-injection blast radius).
Acknowledged (not integrated in claude-blog v1.7.0)
| Contributor | Original submission | Status |
|---|---|---|
| Florian Schmitz | claude-sxo-skill | 91.7 Exemplary. Integrated into claude-seo v1.9.0 as seo-sxo. Blog adaptation deferred until the analyzer can be cleanly separated from page-builder and DataForSEO dependencies. |
| Dan Colta | seo-drift-monitor | 49 Inadequate. Rejected in audit (hardcoded Google API key). The concept (baseline + diff over time) is interesting; a clean-room blog-side implementation is on the roadmap. |
| Matej Marjanovic | omnichannel-seo | 78.3 Proficient. E-commerce SEO + DataForSEO Merchant. Integrated into claude-seo v1.9.0; not blog-native. |
| Benjamin Samar | seo-dungeon | 78.3 Proficient. SEO gamification. Reviewed; not integrated. |
v1.7.0: FLOW framework integration
Released 2026-04-27.
- Source project: FLOW by Daniel Agrici, v1.0.0 (2026-04-25)
- License: CC BY 4.0 (prompt content) + MIT (skill code)
- What it adds: 30 blog-applicable AI prompts (find: 5, leverage: 1, optimize: 21, win: 3) plus the FLOW framework doc and bibliography
- Skill:
blog-flow - Commands:
/blog flow [find|optimize|win|prompts|sync] - Sync mechanism:
scripts/sync_flow.pypulls from GitHub. Stdlib only. HTTPS only. Host-allowlisted toapi.github.com. 5 MB cap. Atomic writes. Path-traversal guard. Anonymous-first GitHub API. Supports--dry-runand--ref <sha>pinning. SHA-256 lockfile drift detection. - License headers: Every synced markdown file (and the auto-generated index README) carries an HTML comment crediting Daniel Agrici / FLOW / CC BY 4.0.
Local-stage prompts (Google Business Profile, citations, local audits) are intentionally excluded; they target brick-and-mortar work, not blogs. Use claude-seo's seo-flow for the local stage.
v1.7.0: Mechanical security guardrails
Released 2026-04-27.
A new pytest module (tests/test_security_guardrails.py) enforces four invariants on every test run:
- No agent grants the
Bashtool in its frontmatter (prompt-injection blast radius). - No
SKILL.mdincludes the invalidallowed-toolsfield. - Skill names are unique across the entire repository (no duplicate routing).
- The FLOW sync script preserves all six security invariants (host allowlist, size cap, dry-run flag, ref pinning, lockfile, license-header injection, path-traversal guard).
Pre-existing finding closed: agents/blog-reviewer.md had Bash in its tools list (used only for word counts and pattern matches that Grep already covers). Removed.
How to credit a contributor in a blog post
When writing about a contributor, link to:
- Their original submission repo (the GitHub URL in the table above)
- The integrated skill in this repo:
https://github.com/AgriciDaniel/claude-blog/tree/main/skills/<skill-name>/ - This
CONTRIBUTORS.mdfile as the canonical attribution source
Community
- Free community: https://www.skool.com/ai-marketing-hub
- Pro community: https://www.skool.com/ai-marketing-hub-pro