Workflow & Core Tools · vibeshotclub/vsc-skills

vsc

Name: vsc
Author: vibeshotclub/vsc-skills

Unified entry point for VSC creative skills. Use when the user invokes /vsc, $vsc, asks what VSC can do, does not know which VSC skill to pick, or wants to automatically select a VSC skill based on current creative requirements. Selects an available skill based on goals, deliverables, and existing materials, and executes it directly; does not re-take control if the user has already explicitly called a specific skill.

L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandDual-pass Audit

Author vibeshotclubGitHub vibeshotclub/vsc-skills ↗Stars 832License 仓库未提供 LICENSE 文件（find 全仓无 LICENSE*；GitHub API license 字段为 null）Commit fcee81beb6

Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

The mechanism is 'unified entry point + local discovery script + catalog snapshot': first locate real local installations via script, select a skill according to SKILL.md criteria, then fully read its SKILL.md and execute it directly within the same conversation.

vsc/SKILL.md

把用户的创作需求交给一个匹配且可用的 VSC 技能，在当前对话中直接完成工作。

SKILL.md consists of five sections: restore requirements / discover candidates / select a skill / load and execute directly.

The catalog snapshot restricts routable members; the script only performs filesystem discovery without semantic scoring or loading body content.

vsc/SKILL.md

脚本使用 [VSC 目录快照](references/catalog.json) 限定成员，返回能力简介、交付类型、区分信息、状态及真实 `SKILL.md` 路径。它不负责语义评分，也不会加载全部技能正文或执行创作。

catalog.json is a build artifact (generated by tools/build_vsc_catalog.py from frontmatter of various SKILL.md files) with sha256 checksums.

Availability determination is completed via sha256 comparison: multiple installations with the same name but different content under the same directory are flagged as conflict, rather than picking one arbitrarily.

vsc/scripts/discover_skills.py

item.update(status="conflict", paths=[hit["path"] for hit in found])

Corresponding clause in SKILL.md: '`conflict`: Multiple installations with the same name but different content found; do not select arbitrarily.'

When the installed content mismatches the catalog snapshot, it is marked as needs_review, prompting the entry point to read the actual frontmatter first to calibrate capabilities and avoid routing with stale catalog info.

vsc/scripts/discover_skills.py

needs_review=found[0]["sha256"] != entry["sha256"]

SKILL.md response rule: 'During filtering, first read the actual frontmatter of the candidate; if boundaries remain ambiguous, read the body text, taking the actual content as authoritative.'

Selection criteria compare 'deliverables / target subjects / existing inputs / exclusions'; keywords are used only for discovery to prevent keyword-based routing misjudgments.

vsc/SKILL.md

2. 比较交付物、处理对象、已有输入和明确排除范围。关键词只用于发现，不能独自决定。

Criterion 3 further mandates that concrete creative scenarios take precedence over generalized topics, citing pool/swimwear counterexamples.

Selects only one primary skill at a time; explicitly avoids general multi-skill orchestration and does not automatically append image generation, video generation, or archiving.

vsc/SKILL.md

4. 一次只选一个主技能。已有完整工作流由该技能负责，不拆成多个技能，也不自动追加生图、视频或归档。

SKILL.md also states: 'V1 does not perform general cross-skill orchestration'; for multi-phase compound needs, ask the user which to do first.

Must load and execute once selected: read the selected skill's SKILL.md completely, dereference and resolve script paths per its guidelines, explain the direction in one sentence, and start working without making the user resend tasks.

vsc/SKILL.md

完整读取入选技能的 `SKILL.md`，随后按其指引读取所需引用，使用实际技能目录解析资源和脚本路径。

The same section strictly prohibits 'ending after merely outputting recommendations'.

Permissions do not expand due to routing, nor are downstream authorization checkpoints redundantly prompted at the entry point.

vsc/SKILL.md

用户授权和宿主权限继续适用，路由不增加付款、发布、删除或对外沟通权限。

Matches: 'When the selected skill requires inputs or authorization checkpoints, handle them at the corresponding step without redundant prompting at the entry point.'

Hardcoded fallback path: if Python is unavailable or the script fails, fall back to reading the catalog snapshot and verifying host paths one by one; installing dependencies or fetching skills over the network is strictly forbidden.

vsc/SKILL.md

Python 不可用或脚本失败时，读取目录快照，并用当前宿主提供的技能路径或本技能同级目录逐一确认相关候选。

Directly followed by: 'Do not install dependencies or fetch skills over the network to complete routing.'

Default search scope is limited and does not recursively scan the entire disk: sibling directory of the entry point, skill directories of the nearest project, ~/.agents/skills, Codex skills (respecting CODEX_HOME), and ~/.claude/skills.

vsc/scripts/discover_skills.py

roots.extend([home / ".agents" / "skills", codex_home / "skills", home / ".claude" / "skills"])

CODEX_HOME branch: codex_home = Path(env["CODEX_HOME"]) if env.get("CODEX_HOME") else home / ".codex".

2Core Capabilities

01Candidate discovery: outputs available / missing / invalid / conflict four-state status with real absolute paths to SKILL.md

02Content verification: compares installed content with catalog snapshot via sha256, generating needs_review prompts

03Custom search root: --root can be specified repeatedly to replace the entire default search scope

04Catalog format self-check: validates schema_version, skill naming conventions, complete capability fields, and allowed delivery types whitelist

05Routing precision: keywords are used only for discovery; evaluates deliverables / target subjects / inputs / exclusions; selects only one skill at a time

06Delivery boundary guard: does not invoke image gen if only prompts are requested, does not trigger video workflows if only Vlog plans are requested, does not supplement images for existing photo archives

07Honest capability gap reporting: explicitly reports the name and gap when the best matching skill is uninstalled without forcing a replacement

08Zero-context navigation mode: introduces capability categories and two to three input examples without executing creative generation

3External Dependencies

Kind	Dependency / Endpoint
cli	python3（3.10+，仅标准库；缺失时入口降级为读目录快照）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation

For Agent Runtime

Graded/per-use authorization, sandbox recommended

For Administrators

Approval workflow, rollback support, full audit

Evidence & Triggers (File Paths & Excerpts)

scripts/: Execute local scripts or commands: python3 "<vsc skill directory>/scripts/discover_skills.py" (the only script specified by SKILL.md; uses standard library only, read-only on filesystem)

Audit Notes: Bundles a local Python script but only performs filesystem discovery and hash verification: no outbound network traffic, no credential access, no local disk writes, and no child processes; classified under the blue tier per the 'local CLI only / local read-write only' guideline. Points of attention: ① Scans project and user directories such as ~/.agents/skills, ~/.codex/skills, ~/.claude/skills, which constitutes enumeration of local skill attack surfaces (read-only, but exposes directory paths); ② Routing relies on SKILL.md text; if local installations are tampered with (poisoned content matching the snapshot beyond needs_review/conflict), the entry point will load untrusted instructions into context—hash verification only alerts on snapshot mismatch and cannot self-verify an already-compromised catalog snapshot.

5Second-Pass Verification

[ok] 脚本行为 vs SKILL.md 描述的一致性 — 四态判定 available/missing/invalid/conflict 与 needs_review 在 discover() 中逐一可实现：found 空则 missing、errors 非空则 invalid、哈希多于一个则 conflict、否则 available 并比对 sha256。
[ok] catalog.json 成员面与「vsc 不入册」验证 — 实读 catalog.json：schema_version=1，skills 数组含 7 个叶子技能（character-candid-photography / codex-image-to-eagle / rare-style-explorer / shan-ze-school / summer-boyfriend-pov / vibeshot-candid-photography / virtual-couple-travel-vlog），无 vsc；load_catalog() 亦显式拒绝 name == "vsc"。
[ok] 搜索范围是否真如文档所述（不递归全盘） — default_roots() 只加入入口同级目录、最近项目的 .agents/.codex/.claude 下 skills、~/.agents/skills、CODEX_HOME/skills、~/.claude/skills；无 os.walk/rglob 全盘扫描。
[ok] 外部依赖条目反查 — 脚本 import 仅标准库；无 requirements、无网络库；README 亦说明『运行技能发现脚本需要 Python 3.10+，无需额外 Python 包』。
[ok] 安全结论反例搜索（写盘/子进程/网络） — 该目录 4 个文件逐 token 扫描：无 open(...,'w')/write_text/mkdir、无 subprocess/os.system、无 socket/urllib/requests；唯一 env 读取是 CODEX_HOME。
[ok] 路由边界说法与其他技能是否闭环 — vsc/SKILL.md 的路由示例（泳池边喝咖啡走生活抓拍、角色 COS n=10 走角色抓拍、泳装朋友视角单图走夏季 POV）与三个被指向技能各自的 vsc-distinction 描述一致，双向闭环。
[ok] 『不联网安装技能』承诺是否与仓库其它脚本冲突 — vsc 目录内无安装类代码；tools/build_vsc_catalog.py 是维护者工具（需 PyYAML），README 明确『维护工具需要 PyYAML，用户运行入口不需要安装它』，不构成入口运行期依赖。

6Verdict & Scenarios

Resolves the most common pain point of multi-skill repositories: users do not need to memorize skill names; the entry point selects one based on deliverables and executes directly, without fobbing off with a 'recommendation list'.

Routing criteria are verifiable (deliverables / target subjects / existing inputs / exclusions) and explicitly state that keywords alone cannot decide, reducing misrouting.

Engineering solution for installation ambiguity: sha256 comparison flags conflict / needs_review instead of naively taking the first match by name.

Permission invariants are explicitly defined in instructions; routing does not introduce new privileges such as payment, publication, or deletion.

Pure standard library, offline, write-free; includes a fallback path to read snapshots if Python is missing.

Best for: Suitable for users who have multiple VSC creative skills installed but do not want to memorize skill names: describe the project in one sentence for the entry point to select and execute directly; also suitable for skill authors/maintainers using discover_skills.py to diagnose install locations and active versions (available/conflict/needs_review).

Not for: Not suitable for users expecting the entry point to automatically chain multi-skill pipelines (orchestration is explicitly not supported); not suitable for environments where only the vsc directory is installed without creative skills (copying vsc does not automatically install other skills, as stated in the README); not suitable as a 'security gateway'—it performs no content filtering, only filesystem discovery and hash comparisons.

Install Agent-Ready

① Verified Mirror 2026-09-15

Option A · Direct DownloadDownload vsc.tar.gz

sha256: b9f7fae71ecb9783…

Option B · Copy Guide for Agent

install.json

Agents automatically download and verify mirrors from this JSON guide.

② Upstream GitHub

GitHub Repo ↗

Pinned to commit fcee81beb6.