fix(aeon-update): don't silently delete a currently-enabled skill retired upstream

.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "robinhood-trading": {
+      "type": "http",
+      "url": "https://agent.robinhood.com/mcp/trading"
+    }
+  }
+}

.notify-hunter22.md

@@ -0,0 +1,7 @@
+**1 real bounty match** (scanned 25, rest were shilling / tweet-threads / video / on-chain deploys — dropped).
+
+**Veilo mainnet smart-contract audit** — $2,000 · Superteam
+Find a critical fund-loss vuln in Veilo's Solana program, ship a reproducible PoC + written report with fix. No live funds moved — pure audit + writeup, exactly the vuln-scan work already demonstrated. Deadline 2026-08-20 (~3 weeks).
+https://superteam.fun/earn/listing/veilo-bounty
+
+Discovery only — not claimed or submitted.

.pending-notify-veilo.md

@@ -0,0 +1,7 @@
+*Vuln Scanner — VeiloSolana/privacy-program*
+
+Clean audit. ~10 candidates reviewed across 5 deep passes, 0 confirmed exploitable.
+
+Tornado-style ZK privacy pool (Solana/Anchor, ~14.5k LoC). Full-surface manual review vs the repo's own AUDIT.md invariants: Groth16 public-input binding, Merkle/nullifier double-spend, account/authority validation, and swap/positions/phoenix/perps/predictions CPI value-accounting — all held. Note amounts are bound to measured token flow + the proof; nullifiers use plain-init markers; relayers whitelist-bound to ext_data. The only observations are documented trust-model items (swap_data not proof-bound = bounded relayer MEV) or defense-in-depth suggestions defended by the circuit — nothing to disclose.
+
+Scanners: semgrep=ok (0), trufflehog=ok (0 verified), osv=ok (8 transitive/informational crate advisories, not routable). Report: output/articles/vuln-scan-2026-07-31-veilo-privacy-program.md

.pending-notify-vuln.md

@@ -0,0 +1,3 @@
+*Vuln Scanner — rainbow-me/rainbow*
+Clean code audit. semgrep 0 findings (2,510 files) and 0 verified secrets (filesystem + git history). The 313 osv dependency CVEs are all public and transitive-only (every crypto primitive — secp256k1, pbkdf2, elliptic, sha.js — is a transitive dep, not directly bumpable) in a repo that already runs Dependabot, so nothing routes to a disclosure channel; the public-PR path is fork-403-blocked regardless.
+Scanners: semgrep=ok, trufflehog=ok, osv=ok.

.pvr-payload.json

@@ -0,0 +1 @@
+{"summary": "Path traversal in docs:save-new IPC handler \u2014 unsanitized filename escapes the default save directory (arbitrary file write)", "description": "## Summary\n\nThe `docs:save-new` IPC handler in the Docs app writes a renderer-supplied\nfilename into the default save directory with `path.join(dir, name)` and **no\npath confinement**, so a filename containing `..` segments (or an absolute path)\nescapes the intended directory. Because this is the *silent* first-save path\n(no save dialog, no user confirmation), a renderer that supplies a traversal\nname causes fully attacker-controlled bytes to be written to an\nattacker-chosen location.\n\nThis is a **defense-in-depth / trust-boundary** finding: the app's current\nrenderer code always sanitizes the name before calling this channel, so it is\n**not** triggerable by merely opening a malicious document or via the AI agent.\nThe impact requires the renderer to be compromised first (e.g. a script-execution\nbug in the local SPA). I'm reporting it because the app's own hardening model\n(`contextIsolation: true`, `sandbox: true`, \"renderers reach main only through\ntyped, validated IPC\") is explicitly designed to *contain* a compromised\nrenderer \u2014 and this handler hands that renderer an arbitrary-path, arbitrary-\ncontent file-write primitive, which is exactly what the sandbox is meant to\nprevent. The sibling write handlers already validate; this one is the outlier.\n\n## Location\n\n`apps/docs/src/main/docs-main.ts`\n\n- `docs:save-new` handler \u2014 builds the target with `uniquePathIn(defaultSaveDir(), defaultName)` where `defaultName` is the untrusted IPC argument.\n- `uniquePathIn(dir, fileName)` \u2014 `let candidate = join(dir, fileName)` with no\n  `..` / absolute-path / containment check.\n\nReached from preload `saveDocxNew` \u2192 `ipcRenderer.invoke('docs:save-new', defaultName, data)`.\n\n## Why the silent path specifically\n\n- `docs:save-as` passes its `defaultName` into the OS **save dialog** as\n  `defaultPath`; the user sees and confirms the final location, so a traversal\n  string is harmless there.\n- The Slides equivalent runs the draft name through `sanitizeDraftBaseName`\n  **in the main process** before writing.\n- `docs:save-new` is the only write path that is both **silent** (no dialog)\n  and **does not re-validate** the name in main \u2014 the two properties that make\n  the missing check matter.\n\n## Impact\n\nA compromised/misbehaving renderer can invoke `saveDocxNew` with, e.g.,\n`\"../../../../<user-home>/.config/autostart/x.desktop\"` (Linux),\n`\"..\\\\..\\\\..\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\x.bat\"`\n(Windows), or any path traversing out of the default folder. `data` is an\narbitrary `ArrayBuffer` (not constrained to valid `.docx`), so both the path and\nthe file contents are fully attacker-controlled \u2014 an arbitrary file-write\nprimitive that can lead to persistence or code execution. Severity is kept\n**low** because it depends on a prior renderer-compromise precondition and is\nnot reachable from untrusted document content in the shipping code paths.\n\n## Suggested fix\n\nConfine the target to the default directory in the main process, mirroring the\nsibling handlers \u2014 validate the resolved path stays inside `defaultSaveDir()`\nand/or reduce the name to its basename before joining. For example, reject any\nname where `path.basename(name) !== name`, or assert\n`resolve(dir, name)` starts with `resolve(dir) + sep` before writing. Applying\nthe same `sanitize*BaseName` used by Slides/Docs-renderer inside the handler\nwould also close it.\n\n## Detected by\n\nManual security review (audit of main-process IPC file sinks). Semgrep OSS /\nTruffleHog runs on this repo were clean; this finding is logic-level and not\nflagged by those rule sets.\n", "severity": "low", "cwe_ids": ["CWE-22"], "vulnerabilities": [{"package": {"ecosystem": "npm", "name": "genoffice"}}]}

.seen-filter.jq

@@ -0,0 +1 @@
+.matches | map({id: .id, title: .title, reward: .rewardUsd, seen_at: $now})

.vuln-probe.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+PATH="/tmp/bin:$PATH"; export PATH
+echo "=== bin ==="
+ls -la /tmp/bin 2>/dev/null || echo "no /tmp/bin"
+echo "=== versions ==="
+for t in semgrep trufflehog osv-scanner slither; do
+  if command -v "$t" >/dev/null 2>&1; then
+    echo "$t=OK $(command -v "$t")"
+  else
+    echo "$t=MISSING"
+  fi
+done

STRATEGY.md

@@ -1,49 +1,35 @@
 # Strategy
 
-Aeon's north-star. Every skill reads this — it's imported into `CLAUDE.md`, so it
-sits in context on **every** run. Skills should align their output to it: what to
-work on, what to prioritise, what to flag, what to skip.
-
-Keep it short (it costs tokens each run): one north-star, 3–5 priorities, the
-constraints. Replace the defaults below with your own.
-
-> **Status:** unconfigured defaults. Until you tailor this file, skills operate
-> with general best judgment and no specific bias. Remove this line once it's yours.
+Aeon's north-star for this fork. Read on every run — align output to it.
 
 ## North-star metric
 
-The single outcome everything should move toward.
-*e.g. "weekly active users of my app", "MRR", "reach of my research".*
-
-**Default:** sustainable, compounding progress on the operator's active projects.
+Tradeable, correct crypto signal surfaced inside Skopos chat — the read a trader
+acts on, not a data dump. Conclusion first, in the first ~150 characters.
 
 ## Priorities
 
-The few things that matter most right now, most important first.
-
-1. Correct, verifiable work over work that merely looks finished.
-2. Depth on the operator's core projects over broad, shallow coverage.
-3. Surface signal early — don't sit on something that needs a decision.
-
-*Replace with your own; cap at ~5.*
+1. Correct and verifiable over comprehensive. A wrong regime call is worse than a
+   narrow one.
+2. Decision-grade output — a regime verdict and explicit position calls
+   (front-run / ride / fade / watch), never an unlabeled table.
+3. Freshness and honesty over completeness. "No signal today" and "no obvious
+   catalyst" are valid; an invented narrative is not.
 
 ## Audience
 
-Who the output is for, and their level.
-*e.g. "technical founders on X", "my internal team", "just me".*
-
-**Default:** the operator — assume technical and time-constrained.
+Crypto traders using Skopos — technical, time-poor, already in-market. They want
+the take and the move, not the background.
 
 ## Hard constraints
 
-Lines never to cross.
-
-- Never publish secrets, private data, or unverified claims as fact.
-- Stay within any configured spend and rate limits.
-
-*Add your own — budget caps, tone, topics to avoid, compliance limits.*
+- Never invent numbers or catalysts. If a source fails and there's no prior value,
+  write `n/a`.
+- Stay qualitative on live prices. Skopos supplies live quotes; this fork supplies
+  the regime and narrative read. Don't headline a hard price a user will trade on.
+- Public, unauthenticated data only. Never publish secrets or unverified claims.
 
 ## Optimize for / avoid
 
-- **Optimize for:** signal, correctness, and the priorities above.
-- **Avoid:** filler, hype, busywork, anything off-strategy.
+- Optimize for: signal, correctness, conclusion-first phrasing, explicit position calls.
+- Avoid: filler, hype, unlabeled yields, narratives without an evidence anchor.