Update version numbers and enhance skill documentation

- Bumped version in plugin.json and pyproject.toml to 2.66.0.
- Updated skill metadata versions across multiple skills, reflecting improvements and new features.
- Added citation guidelines to various skill documentation to ensure proper referencing of the "Scientific Agent Skills" paper.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,95 @@
+name: Bug report
+description: A skill or repository tool behaves incorrectly — wrong output, broken script, failing install, or instructions an agent cannot follow.
+title: "[Bug]: "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting this. Please do **not** use this form for security
+        vulnerabilities — use [private vulnerability reporting](https://github.com/K-Dense-AI/scientific-agent-skills/security/advisories/new)
+        instead, as described in [SECURITY.md](https://github.com/K-Dense-AI/scientific-agent-skills/blob/main/SECURITY.md).
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      description: Which part of the repository is affected?
+      options:
+        - A skill under skills/
+        - Repository tooling (scan_skills.py, tests, CI workflows)
+        - Documentation (README, CONTRIBUTING, AGENTS)
+        - Not sure
+    validations:
+      required: true
+
+  - type: input
+    id: skill
+    attributes:
+      label: Skill name
+      description: The skill directory name, exactly as it appears under `skills/`. Leave blank if this is not skill-specific.
+      placeholder: scanpy
+    validations:
+      required: false
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What did the skill or tool actually do?
+      placeholder: The skill's example call to sc.pp.neighbors() fails with a TypeError.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected instead
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: The smallest sequence that triggers it. Include the prompt you gave the agent, if relevant.
+      placeholder: |
+        1. Load the `scanpy` skill in Claude Code
+        2. Ask: "cluster my AnnData object"
+        3. Run the code the agent produces
+        4. See the error below
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Error output
+      description: Paste the traceback or scanner output. This is rendered as a code block, so no backticks are needed.
+      render: shell
+    validations:
+      required: false
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Skill behavior varies by agent host and model, so please tell us where you saw this.
+      value: |
+        - Agent host (Claude Code, Cursor, Codex, other):
+        - Model:
+        - Repository version or commit:
+        - Python version:
+        - Operating system:
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched existing issues and this is not a duplicate.
+          required: true
+        - label: This is not a security vulnerability. (Those go through private reporting.)
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/K-Dense-AI/scientific-agent-skills/security/advisories/new
+    about: Do not open a public issue. Use private vulnerability reporting so the report stays confidential until a fix ships. See SECURITY.md.
+  - name: Contributing guide
+    url: https://github.com/K-Dense-AI/scientific-agent-skills/blob/main/CONTRIBUTING.md
+    about: Read this before proposing a skill change — skill format, validation, tests, and the pull request checklist.
+  - name: Agent Skills specification
+    url: https://agentskills.io/specification
+    about: The open specification every skill in this repository follows.
+  - name: K-Dense documentation
+    url: https://k-dense.ai
+    about: Product documentation and general questions about K-Dense.

.github/ISSUE_TEMPLATE/new_skill_request.yml

@@ -0,0 +1,90 @@
+name: New skill request
+description: Propose a skill for a scientific package, database, platform, workflow, or research method that the library does not cover yet.
+title: "[New skill]: "
+labels: ["enhancement", "skill-request", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Check the [skill list in the README](https://github.com/K-Dense-AI/scientific-agent-skills#readme)
+        first — the library already ships a large number of skills. If you plan to
+        write this skill yourself, [CONTRIBUTING.md](https://github.com/K-Dense-AI/scientific-agent-skills/blob/main/CONTRIBUTING.md)
+        has the required format and validation steps.
+
+  - type: input
+    id: name
+    attributes:
+      label: Proposed skill name
+      description: Lowercase letters, numbers, and single hyphens only — this becomes the directory name under `skills/`.
+      placeholder: alphafold-db
+    validations:
+      required: true
+
+  - type: dropdown
+    id: category
+    attributes:
+      label: Category
+      options:
+        - Scientific package or library
+        - Database or public data resource
+        - Platform, service, or API
+        - Analysis workflow or research method
+        - Laboratory instrument or hardware
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: what
+    attributes:
+      label: What the skill would do
+      description: What should an agent be able to accomplish with it that it cannot do reliably today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: when
+    attributes:
+      label: When an agent should use it
+      description: The situations that should trigger this skill. This becomes the "when to use" half of the skill description.
+    validations:
+      required: true
+
+  - type: textarea
+    id: docs
+    attributes:
+      label: Official documentation and sources
+      description: Links to the package docs, API reference, publication, or database homepage a skill author would need.
+      placeholder: |
+        - Docs: https://...
+        - API reference: https://...
+        - Paper: https://doi.org/...
+    validations:
+      required: true
+
+  - type: textarea
+    id: credentials
+    attributes:
+      label: Credentials or access requirements
+      description: Does it need an API key, licence, registration, or institutional access? Name the environment variables if you know them.
+    validations:
+      required: false
+
+  - type: dropdown
+    id: contribute
+    attributes:
+      label: Would you like to write this skill?
+      options:
+        - "Yes — I plan to open a pull request"
+        - "Maybe, with some guidance"
+        - "No, I am requesting it"
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I checked the README skill list and this skill does not already exist.
+          required: true

.github/ISSUE_TEMPLATE/skill_improvement.yml

@@ -0,0 +1,68 @@
+name: Improve an existing skill
+description: An existing skill is outdated, unclear, or incomplete — stale API, missing workflow, weak examples, or a description that triggers at the wrong time.
+title: "[Improve]: "
+labels: ["enhancement", "needs-triage"]
+body:
+  - type: input
+    id: skill
+    attributes:
+      label: Skill name
+      description: The skill directory name, exactly as it appears under `skills/`.
+      placeholder: transformers
+    validations:
+      required: true
+
+  - type: dropdown
+    id: kind
+    attributes:
+      label: What needs improving
+      multiple: true
+      options:
+        - Outdated API or deprecated calls
+        - Missing workflow or capability
+        - Examples are wrong, untested, or too thin
+        - Instructions are ambiguous for an agent
+        - Description triggers too often or not often enough
+        - Missing or broken references
+        - Missing tests
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: current
+    attributes:
+      label: Current behavior
+      description: What does the skill say or do today? Quote the relevant part of `SKILL.md` or a reference file, with the file path.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed
+    attributes:
+      label: Proposed change
+      description: What should it say or do instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Supporting sources
+      description: Upstream release notes, migration guides, or docs that show the current content is out of date.
+      placeholder: |
+        - Changelog: https://...
+        - Migration guide: https://...
+    validations:
+      required: false
+
+  - type: dropdown
+    id: contribute
+    attributes:
+      label: Would you like to make this change?
+      options:
+        - "Yes — I plan to open a pull request"
+        - "Maybe, with some guidance"
+        - "No, I am reporting it"
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,68 @@
+# Summary
+
+<!-- What changed, and why it matters. One or two sentences is fine. -->
+
+## Type of change
+
+<!-- Keep the lines that apply, delete the rest. -->
+
+- [ ] New skill
+- [ ] Update to an existing skill
+- [ ] Tests
+- [ ] Repository tooling or CI
+- [ ] Documentation
+- [ ] Other:
+
+## Skills touched
+
+<!-- Directory names under skills/, one per line. Write "none" if this PR does not touch skills/. -->
+
+-
+
+## How this was tested
+
+<!-- The commands you ran and what they reported. -->
+
+```
+uv run skills-ref validate ./skills/<name>
+uv run --with pytest python -m pytest tests/<name> -q
+```
+
+## Related issues and references
+
+<!-- Closes #123. Link upstream docs, release notes, or security findings that justify the change. -->
+
+---
+
+## Checklist
+
+Drawn from the [Pull Request Checklist](https://github.com/K-Dense-AI/scientific-agent-skills/blob/main/CONTRIBUTING.md#pull-request-checklist) in CONTRIBUTING.md. Items that do not apply to this PR can be left unchecked with a short note.
+
+**Skill format**
+
+- [ ] The skill directory name and the `name` frontmatter match exactly.
+- [ ] The skill directory contains only `SKILL.md`, `references/`, `scripts/`, and `assets/` — no `tests/` directory and no `test_*.py` files.
+- [ ] `SKILL.md` has valid YAML frontmatter and a Markdown body.
+- [ ] Only the six spec-defined top-level fields are present; everything else lives under `metadata`.
+- [ ] `metadata` is a block mapping, not single-line JSON, and scalar values are quoted where needed.
+- [ ] Any `metadata.openclaw` or `metadata.hermes` block is a nested mapping, not a JSON string.
+- [ ] `metadata.version` exists, is quoted, and is bumped if an existing skill changed.
+- [ ] The `description` says both what the skill does and when an agent should use it.
+
+**Validation and tests**
+
+- [ ] `uv run skills-ref validate ./skills/<name>` passes.
+- [ ] Tests live in `tests/<skill-name>/`, and any new `scripts/` skill has a `[skills.<name>]` entry in `tests/skill-requirements.toml`.
+- [ ] Relevant test suites pass, or the failures are explained below.
+- [ ] Security scanner results are clean or explained in this PR.
+
+**Content and safety**
+
+- [ ] Examples and scripts were tested, or are clearly marked as illustrative.
+- [ ] No secrets, credentials, private data, or unsafe instructions are included.
+- [ ] Credentials the skill needs are named in `compatibility` and declared in `metadata.openclaw.envVars`.
+- [ ] Relevant official documentation is linked where useful.
+
+## Notes for reviewers
+
+<!-- Anything unresolved, deliberately out of scope, or worth a closer look. -->

.github/workflows/pr-skill-scan.yml

@@ -73,12 +73,14 @@ jobs:
         if: steps.changed.outputs.skill_dirs != ''
         run: uv sync --python 3.13
 
+      # Fork PRs do not receive SKILL_SCANNER_LLM_API_KEY. scan_pr_skills.py
+      # detects the missing key, writes an explanatory sticky comment, and exits 0.
       - name: Run scanner on changed skills
         if: steps.changed.outputs.skill_dirs != ''
         id: scan
         env:
           SKILL_SCANNER_LLM_API_KEY: ${{ secrets.SKILL_SCANNER_LLM_API_KEY }}
-          SKILL_SCANNER_LLM_MODEL: ${{ vars.SKILL_SCANNER_LLM_MODEL || 'claude-sonnet-4-6' }}
+          SKILL_SCANNER_LLM_MODEL: ${{ vars.SKILL_SCANNER_LLM_MODEL || 'claude-opus-5' }}
         run: |
           uv run python scan_pr_skills.py \
             --output pr_scan_comment.md \

.github/workflows/security-scan.yml

@@ -4,6 +4,11 @@ on:
   schedule:
     - cron: "0 9 * * 1" # Every Monday at 09:00 UTC
   workflow_dispatch: # Allow manual trigger
+    inputs:
+      full_scan:
+        description: "Rescan every skill, ignoring cached findings"
+        type: boolean
+        default: false
 
 permissions:
   contents: write
@@ -11,7 +16,11 @@ permissions:
 jobs:
   scan:
     runs-on: ubuntu-latest
-    timeout-minutes: 120
+    # Scans run concurrently and reuse findings for unchanged skills, so a
+    # typical incremental run is minutes. The headroom is for a full rescan
+    # (triggered by a scanner/model change or the 30-day backstop) plus the
+    # scanner's own rate-limit retries.
+    timeout-minutes: 60
 
     steps:
       - uses: actions/checkout@v6
@@ -28,17 +37,35 @@ jobs:
       - name: Run security scan
         env:
           SKILL_SCANNER_LLM_API_KEY: ${{ secrets.SKILL_SCANNER_LLM_API_KEY }}
-          SKILL_SCANNER_LLM_MODEL: ${{ vars.SKILL_SCANNER_LLM_MODEL || 'claude-sonnet-4-6' }}
+          SKILL_SCANNER_LLM_MODEL: ${{ vars.SKILL_SCANNER_LLM_MODEL || 'claude-opus-5' }}
+          # Each skill scan is blocked on LLM network I/O, so concurrency is
+          # bounded by API rate limits rather than by the runner. Lower this if
+          # runs start hitting sustained 429s.
+          SKILL_SCAN_WORKERS: ${{ vars.SKILL_SCAN_WORKERS || '8' }}
+          SKILL_SCAN_FULL: ${{ inputs.full_scan && '1' || '' }}
         run: uv run python scan_skills.py
 
-      - name: Commit updated SECURITY.md
+      - name: Upload report artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: security-report
+          path: |
+            docs/security-report.md
+            docs/security-report.json
+          if-no-files-found: warn
+
+      - name: Commit updated security report
         run: |
-          git diff --quiet SECURITY.md && exit 0
+          if [ -z "$(git status --porcelain docs/security-report.md docs/security-report.json)" ]; then
+            echo "Report unchanged; nothing to commit."
+            exit 0
+          fi
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git stash --include-untracked
           git pull --rebase
           git stash pop || true
-          git add SECURITY.md
+          git add docs/security-report.md docs/security-report.json
           git commit -m "chore: update security scan report [skip ci]"
           git push

.github/workflows/skill-spec-validation.yml

@@ -0,0 +1,150 @@
+name: Skill Spec Validation
+
+on:
+  pull_request:
+    paths:
+      - "skills/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/skill-spec-validation.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "skills/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: skill-spec-validation-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Validate skills against the Agent Skills spec
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v8.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync --python 3.13
+
+      # The reference validator from https://agentskills.io/specification. It checks the
+      # closed set of allowed frontmatter fields, name rules (incl. directory match),
+      # description/compatibility length limits, and parses frontmatter with strictyaml
+      # -- which rejects JSON-style flow mappings such as `metadata: {"version": "1.0"}`.
+      - name: skills-ref validate
+        run: |
+          set -uo pipefail
+          fail=0
+          for d in skills/*/; do
+            if ! out=$(uv run skills-ref validate "$d" 2>&1); then
+              fail=1
+              echo "::error file=${d}SKILL.md::$(echo "$out" | tail -n +2 | tr '\n' ' ')"
+              echo "FAIL $d"
+              echo "$out" | sed 's/^/    /'
+            fi
+          done
+          echo "Validated $(ls -d skills/*/ | wc -l) skills."
+          exit $fail
+
+      # Rules the reference validator does not enforce: this repo's metadata.version
+      # requirement (see AGENTS.md), plus spec constraints skills-ref accepts but the
+      # spec text requires -- allowed-tools must be a space-separated string, and
+      # metadata values must be strings apart from the host-manifest blocks that have
+      # to stay nested objects (see NESTED_OK below).
+      - name: Repo and spec rules skills-ref does not check
+        run: |
+          uv run --with pyyaml python - <<'PY'
+          import re
+          import sys
+          from pathlib import Path
+          import yaml
+
+          # Host manifest blocks that must stay nested mappings. OpenClaw's
+          # resolveOpenClawManifestBlock() requires `typeof candidate === "object"`, so
+          # encoding these as JSON strings silently disables its gating and credential
+          # injection. Nested mappings still pass `skills-ref validate`.
+          NESTED_OK = {"openclaw", "hermes"}
+
+          # Requires the closing delimiter on its own line. A naive split("---") would
+          # happily re-split at a `---` accidentally glued to the last frontmatter value.
+          FM_RE = re.compile(r"\A---\n(.*?)\n---\n", re.S)
+
+          errors, warnings = [], []
+          for d in sorted(Path("skills").iterdir()):
+              if not d.is_dir():
+                  continue
+              md = d / "SKILL.md"
+              if not md.exists():
+                  errors.append(f"{d}: missing SKILL.md")
+                  continue
+              text = md.read_text()
+              m_fm = FM_RE.match(text)
+              if not m_fm:
+                  errors.append(
+                      f"{md}: frontmatter must open with `---` and close with `---` "
+                      f"on its own line"
+                  )
+                  continue
+              fm = yaml.safe_load(m_fm.group(1))
+
+              at = fm.get("allowed-tools")
+              if at is not None:
+                  if not isinstance(at, str):
+                      errors.append(
+                          f"{md}: allowed-tools must be a space-separated string, "
+                          f"got {type(at).__name__}"
+                      )
+                  elif "," in at:
+                      errors.append(
+                          f"{md}: allowed-tools must be space-separated, not "
+                          f"comma-separated: {at!r}"
+                      )
+
+              m = fm.get("metadata")
+              if not isinstance(m, dict):
+                  errors.append(f"{md}: missing a `metadata` mapping (see AGENTS.md)")
+              else:
+                  if "version" not in m:
+                      errors.append(f"{md}: metadata.version is required (see AGENTS.md)")
+                  for k, v in m.items():
+                      if k in NESTED_OK:
+                          if not isinstance(v, dict):
+                              errors.append(
+                                  f"{md}: metadata.{k} must stay a nested mapping, got "
+                                  f"{type(v).__name__} -- a JSON string silently disables "
+                                  f"host gating and credential injection"
+                              )
+                          continue
+                      if isinstance(v, str):
+                          continue
+                      errors.append(
+                          f"{md}: metadata.{k} must be a string, got {type(v).__name__} "
+                          f"-- quote it (versions and dates especially)"
+                      )
+
+              lines = text.count("\n") + 1
+              if lines > 500:
+                  warnings.append(f"{md}: {lines} lines; the spec recommends under 500")
+
+          for w in warnings:
+              print(f"::warning file={w.split(':')[0]}::{w}")
+          for e in errors:
+              print(f"::error file={e.split(':')[0]}::{e}")
+              print(f"FAIL {e}")
+          print(f"\n{len(errors)} error(s), {len(warnings)} warning(s).")
+          sys.exit(1 if errors else 0)
+          PY

.github/workflows/skill-tests.yml

@@ -0,0 +1,103 @@
+name: Skill Tests
+
+on:
+  pull_request:
+    paths:
+      - "skills/**"
+      - "tests/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/skill-tests.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "skills/**"
+      - "tests/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: skill-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  contract:
+    name: Repo-wide contract and coverage guard
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v8.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync --python 3.13
+
+      # tests/_meta checks every skill against the shared structural contract
+      # (frontmatter, SKILL.md length, local links, scripts parse, no shipped
+      # bytecode, no hardcoded local paths, ...) and enforces the repo rule that
+      # a skill shipping scripts/ has a suite under tests/ and an entry in
+      # tests/skill-requirements.toml. It imports no skill code and needs no
+      # scientific packages, so it runs in seconds on every pull request.
+      - name: Structural contract and coverage
+        run: uv run --python 3.13 python -m pytest tests/_meta -q
+
+  suites:
+    name: Standard-library-only skill suites
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs: contract
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v8.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+          python-version: "3.13"
+
+      # The skills whose bundled tooling is standard-library only -- read from
+      # `packages = []` in tests/skill-requirements.toml, so the list needs no
+      # separate maintenance. Each still gets a clean throwaway environment.
+      #
+      # The full `--isolated` sweep across every skill is deliberately NOT run
+      # here: it builds ~100 environments including torch, qiskit, and scanpy,
+      # and several skills need CUDA, a JDK, or a MATLAB install that CI does
+      # not have. Run it locally or on a schedule:
+      #     python tests/run_all.py --isolated
+      - name: Select standard-library-only skills
+        id: select
+        run: |
+          set -euo pipefail
+          SKILLS=$(python3 - <<'PY'
+          import pathlib, tomllib
+          manifest = tomllib.loads(
+              pathlib.Path("tests/skill-requirements.toml").read_text()
+          )
+          names = sorted(
+              name
+              for name, entry in manifest["skills"].items()
+              if not entry.get("packages") and "python" not in entry
+              and (pathlib.Path("tests") / name).is_dir()
+          )
+          print(" ".join(names))
+          PY
+          )
+          echo "Selected: $SKILLS"
+          echo "skills=$SKILLS" >> "$GITHUB_OUTPUT"
+
+      - name: Run suites, one environment each
+        run: uv run --python 3.13 python tests/run_all.py --isolated ${{ steps.select.outputs.skills }}

.gitignore

@@ -5,6 +5,7 @@
 .venv/
 .python-version
 __pycache__/
+.pytest_cache/
 
 # Secrets
 .env
@@ -13,7 +14,13 @@ __pycache__/
 temp/
 research/
 
+# Local agent tooling
+.claude/
 .agents/
-AGENTS.md
+# Anchored: an unanchored "scripts/" also matches skills/<name>/scripts/,
+# which silently drops every new skill's bundled tooling from git.
+/scripts/
 
-skills-lock.json
+skills-lock.json
+
+uv.lock

AGENTS.md

@@ -0,0 +1,372 @@
+# Repository Guidance
+
+This repository is a collection of Agent Skills for science and research. Every skill lives in its
+own directory under `skills/` and must conform to the open
+[Agent Skills specification](https://agentskills.io/specification).
+
+Read this file before creating or changing a skill. `CONTRIBUTING.md` covers the same ground at
+more length, plus the pull-request process.
+
+## What belongs here
+
+**In scope:** a narrow skill for one scientific package, database, platform, or research workflow —
+`scanpy`, `depmap`, `benchling-integration`, `experimental-design`.
+
+**Out of scope**, and routinely declined:
+
+- General software-engineering or coding-judgment skills — they compete for selection on every task.
+- General infrastructure with a scientific example bolted on (a vector database, a cloud SDK) —
+  accepting one implies carrying every competitor.
+- Broad "orchestrator" skills that route to other skills — they overlap every specialist by design.
+- A second provider for a service an existing skill already reaches.
+
+The general-purpose skills that do exist are narrow output-format helpers (`docx`, `pdf`, `pptx`,
+`generate-image`, `markdown-mermaid-writing`). They are not precedent for broadening scope.
+
+## Layout
+
+The repository root is an [Agent Plugins](https://agent-plugins.org/) 1.0.0 package: `plugin.json`
+plus the portable `skills/` tree. Keep `plugin.json` valid against the Agent Plugins manifest
+schema, and keep its `version` identical to `pyproject.toml` `[project].version`. Do not add
+non-portable top-level fields to `plugin.json` (no inline MCP, hooks, or client-only keys — use
+`mcp.json` or a reverse-domain `extensions` namespace if those are ever needed).
+
+```text
+plugin.json                 # Agent Plugins manifest (repo root)
+skills/<skill-name>/
+├── SKILL.md        # required
+├── references/     # optional: long documentation, loaded only when needed
+├── scripts/        # optional: executable helpers
+└── assets/         # optional: templates and static resources
+```
+
+Only `SKILL.md` is required inside each skill. Reference other files with relative paths from the
+skill root, kept one level deep.
+
+**Tests never live under `skills/`.** A skill directory ships only what an agent loads. Checks for a
+skill's scripts and structure go in the repository-level suite instead:
+
+```text
+tests/<skill-name>/          # same name as the skill directory
+├── test_scripts.py
+└── fixtures/                # optional test data
+```
+
+**Diagrams never live under `skills/` either.** A skill may have a generated workflow diagram at
+`docs/images/<skill-name>.png`, produced by `scripts/generate_skill_image.py`. Diagrams are optional
+— see [Skill diagrams](#skill-diagrams).
+
+Tests reach their skill through an explicit anchor, never a relative walk:
+
+```python
+SKILL_ROOT = Path(__file__).resolve().parents[2] / "skills" / "<skill-name>"
+```
+
+## Creating a skill
+
+1. Create `skills/<name>/` — **the directory name is the skill name** and must equal frontmatter
+   `name`.
+2. Write `SKILL.md` from the template below. Start at `metadata.version: "1.0"`.
+3. Add `references/`, `scripts/`, or `assets/` only when they earn their place.
+4. Run the commands and code you document. Scope claims to the release you actually tested
+   ("targets stable GeoPandas 1.1.4"), and mark anything untested as illustrative.
+5. If the skill ships `scripts/`, put their tests in **`tests/<name>/`** — never in the skill
+   directory. Fixtures go in `tests/<name>/fixtures/`.
+6. Validate and scan (below).
+
+```markdown
+---
+name: skill-name
+description: What the skill does and when an agent should use it, including the terms that should trigger it.
+license: MIT
+compatibility: Requires Python 3.12+ with <package> installed. Needs network access.
+metadata:
+  version: "1.0"
+  skill-author: Your Name
+---
+
+# Skill Title
+
+## When to use
+
+Use this skill when...
+
+## Workflow
+
+1. ...
+
+## Examples
+
+...
+```
+
+## Updating a skill
+
+1. Read the current `SKILL.md` and its supporting files first.
+2. Check upstream docs — APIs move, and the skill may be pinned to an older release.
+3. Make the smallest useful change.
+4. **Bump `metadata.version` in the same change**: minor for normal improvements (`"1.2"` →
+   `"1.3"`), major only for a breaking change or substantial redesign (`"1.9"` → `"2.0"`).
+5. Re-run any example, command, or script you touched, plus `tests/<name>/` if that suite exists.
+   Suites check that `metadata.version` is present and quoted, not what it equals, so a version bump
+   never needs a matching test edit.
+## Frontmatter
+
+`SKILL.md` starts with YAML frontmatter. **Only these six fields are allowed** — the spec defines a
+closed set, and any other top-level key is a validation error:
+
+| Field | Required | Constraints |
+| --- | --- | --- |
+| `name` | Yes | 1–64 chars, lowercase letters/digits/hyphens only, no leading, trailing, or consecutive hyphens, and **must equal the directory name**. |
+| `description` | Yes | 1–1024 chars. Say what the skill does *and* when to use it, with the keywords that should trigger it. Write it in third person. |
+| `license` | No | License name, or a reference to a bundled license file. |
+| `compatibility` | No | Max 500 chars. Environment requirements only — omit it if the skill has none. |
+| `allowed-tools` | No | A **space-separated string**, e.g. `Read Write Edit Bash`. Not a YAML list, not comma-separated. |
+| `metadata` | No | Mapping of string keys to **string** values, except the host manifest blocks below. Required here: `metadata.version`. |
+
+Put anything else — authorship, upstream versions, review dates, client-specific config — inside
+`metadata`, never at the top level. In particular, Hermes' top-level
+`required_environment_variables` cannot be used here: it fails the validator and, because
+`strictyaml` rejects the whole document, takes `name` and `description` down with it. Declare
+credentials in `compatibility` and `metadata.openclaw.envVars` instead.
+
+### Write block-style YAML, not JSON flow style
+
+The reference validator parses frontmatter with `strictyaml`, which **rejects JSON-style flow
+mappings and sequences**. A flow mapping does not merely fail one check: the whole frontmatter
+fails to parse, so `name` and `description` become unreadable and the skill will not register.
+
+```yaml
+# Wrong -- breaks the validator
+metadata: {"version": "1.1", "skill-author": "K-Dense Inc."}
+
+# Right
+metadata:
+  version: "1.1"
+  skill-author: K-Dense Inc.
+```
+
+### Quote `metadata` scalars
+
+Quote values that would otherwise be parsed as a number, boolean, or date — `version: "1.0"`,
+`last-reviewed: "2026-07-23"` — so they stay strings as the spec requires.
+
+### Host manifest blocks stay nested mappings
+
+`metadata.openclaw` and `metadata.hermes` are the documented exception: keep them as **nested
+mappings**, not JSON strings. OpenClaw's `resolveOpenClawManifestBlock()` requires
+`typeof candidate === "object"`, so a JSON string silently disables its dependency gating and
+credential injection. Nested mappings still pass `skills-ref validate`.
+
+```yaml
+metadata:
+  version: "1.1"
+  skill-author: Exa
+  openclaw:
+    primaryEnv: EXA_API_KEY
+    envVars:
+      - name: EXA_API_KEY
+        required: true
+        description: Exa search API key.
+  hermes:
+    category: research
+```
+
+Only skills with external requirements need these blocks; most omit them. A failed `requires` /
+`requires_toolsets` gate *hides* the skill from the agent, so gate only on something the skill
+genuinely cannot run without.
+
+## Body and layout
+
+- Keep `SKILL.md` under 500 lines. CI warns above that. Move long reference material into
+  `references/` so agents load it only when needed.
+- A skill directory ships only what an agent loads. Tests, fixtures, scratch data, and generated
+  artifacts stay out of it; tests go in `tests/<name>/`.
+- Give concrete workflows, commands, and worked examples rather than background explanation.
+- Name the required packages, system dependencies, credentials, and network access.
+- Include the scientific caveats and validation checks that matter.
+- Put fragile or repetitive logic in `scripts/` instead of asking the agent to recreate it.
+- Never include secrets, API keys, private URLs, or unpublished data.
+
+## Validate and scan
+
+```bash
+uv sync
+
+# spec conformance for one skill
+uv run skills-ref validate skills/<name>
+
+# every skill, the way CI does
+for d in skills/*/; do uv run skills-ref validate "$d"; done
+```
+
+`.github/workflows/skill-spec-validation.yml` runs that on every PR touching `skills/`, plus the
+repo rules `skills-ref` does not check: `metadata.version` present, `allowed-tools` a
+space-separated string, `metadata` scalars quoted, and a warning past 500 lines.
+
+Security-scan new or substantially changed skills. Scanning uses
+[Cisco AI Defense Skill Scanner](https://github.com/cisco-ai-defense/skill-scanner) — the
+`cisco-ai-skill-scanner` package pinned in `pyproject.toml`, which detects prompt injection, data
+exfiltration, and malicious code patterns in Agent Skills. Its README documents the rule IDs and
+CLI flags; consult it when a finding's rule is unfamiliar.
+
+`.github/workflows/pr-skill-scan.yml` runs the repo wrapper for changed skills on every PR and
+posts a sticky comment, failing on HIGH or above:
+
+```bash
+# needs SKILL_SCANNER_LLM_API_KEY (see .env)
+uv run python scan_pr_skills.py skills/<name>
+
+# or the upstream CLI directly, without the repo wrapper
+uv run skill-scanner scan skills/<name> --use-behavioral
+```
+
+**Verify a finding against the code before "fixing" it.** Known systematic false positives:
+`BEHAVIOR_*_EXFILTRATION` and `BEHAVIOR_ENV_VAR_HARVESTING` on any skill that reads its own API key
+and calls its own service; `MDBLOCK_PYTHON_SUBPROCESS` on any `subprocess` snippet, including the
+safe argument-list form; and `*_EVAL_EXEC` on substrings inside ordinary identifiers (`retrieval`,
+`executor`) or on `model.eval()`. Findings sometimes cite files a skill does not contain — check
+against `find skills/<name> -type f` before acting.
+
+If the skill has tests in `tests/<name>/`, run them:
+
+```bash
+uv run --with pytest python -m pytest tests/<name> -q
+
+# every skill's suite, one process each, after the repo-wide guard
+uv run --with pytest python tests/run_all.py
+```
+
+**One skill per pytest process.** Skills' `scripts/` directories own plain top-level module names —
+32 of them ship a `scripts/_common.py` — so collecting two skills into one interpreter resolves
+`_common` to whichever skill imported first and silently tests the wrong files. `tests/conftest.py`
+refuses such a session; `tests/run_all.py` forks per skill.
+
+### The repo-wide guard
+
+```bash
+uv run --with pytest python -m pytest tests/_meta -q
+```
+
+`tests/_meta` is the fastest useful signal in the repo: pure standard library, no scientific
+packages, a couple of seconds. It runs the shared structural contract against **every** skill and
+fails if a skill ships `scripts/` without a suite under `tests/<name>/` or an entry in
+`tests/skill-requirements.toml`. `.github/workflows/skill-tests.yml` runs it on every pull request,
+so a skill with untested scripts cannot land. A full run of `tests/run_all.py` starts with it.
+
+It is not one of the per-skill processes because it deliberately spans all of them at once — safe
+because it never imports skill code, only parses it.
+
+### The shared contract
+
+`tests/_contract/` holds the assertions every skill shares, so a per-skill suite contains only what
+is actually specific to that skill. `tests/conftest.py` registers it as the importable module
+`skill_contract`:
+
+```python
+import skill_contract
+
+# every argparse script answers --help; skips when its packages are absent,
+# runs for real under --isolated
+CliHelpTests = skill_contract.cli.help_test_case(SKILL_ROOT)
+
+# for library-style scripts with an `if __name__ == "__main__"` worked example
+DemoBlockTests = skill_contract.cli.demo_test_case(SKILL_ROOT, ("doe_designs.py",))
+```
+
+- `structure` — frontmatter conformance, the 500-line limit, no tests or bytecode under `skills/`,
+  local links resolve, scripts parse, no `eval`/`exec`/`os.system`, no standard-library shadowing,
+  no hardcoded local paths, shell scripts valid. Run repo-wide by `tests/_meta`; do not duplicate
+  these in a per-skill suite.
+- `cli` — the `--help` and demo-block cases above.
+- `office` / `schematic` — behaviour for files several skills ship byte-identical copies of (the
+  OOXML tree under docx/pptx/xlsx; the AI schematic generator under five skills). `tests/_meta`
+  separately fails if those copies drift apart, so fix them together.
+
+### One environment per skill
+
+The project environment deliberately does not carry the skills' scientific packages. Their upstream
+pins are mutually exclusive — `opentrons` needs `numpy<2`, `esm` caps `transformers` below the
+version the `transformers` skill targets, `geniml` and `spikeinterface` pin `zarr<3` against the
+`zarr-python` skill's 3.x, `bioservices` caps `lxml<6` against `matchms`, and `pytdc`, `molfeat`,
+`deepchem`, `histolab`, `vaex`, and `ete3` each need an interpreter older than 3.13. Installing them
+together forces every one of those skills to the losing side of a version fight.
+
+So `--isolated` builds a throwaway `uv` environment per skill instead, from
+[`tests/skill-requirements.toml`](tests/skill-requirements.toml):
+
+```bash
+python tests/run_all.py --isolated                 # every suite, one env each
+python tests/run_all.py --isolated scanpy qiskit   # just these
+```
+
+Each entry lists the packages that skill documents, plus an optional `python` when the skill cannot
+run on the default interpreter; uv downloads that interpreter on demand. Packages that cannot be
+installed at all — a GitHub-only SDK, a conda-forge-only library, a CUDA build — are recorded under
+`[unavailable]` with the reason, and the runner prints them so the gap shows up in test output.
+
+Adding a skill with `scripts/` means adding its `[skills.<name>]` entry — `tests/_meta` fails
+without one. Use `packages = []` for skills whose bundled tooling is standard-library only; they
+still get a clean environment, and CI runs exactly that set on every pull request. uv caches wheels
+globally, so repeat runs create each environment in milliseconds.
+
+The full `--isolated` sweep is not run in CI: it builds one environment per skill, several of which
+need a CUDA toolchain, a JDK, or a local MATLAB install. Run it before a release, or whenever you
+touch the shared contract.
+
+## Skill diagrams
+
+A skill may carry a generated workflow diagram at `docs/images/<skill-name>.png`. Diagrams are
+optional: neither a new skill nor a change to an existing one is blocked on having or refreshing an
+image, and no CI check enforces them. If you do ship one, note that it is derived from the
+documentation, so regenerate it when the skill's workflow changes rather than leaving a picture that
+misrepresents the skill.
+
+`scripts/generate_skill_image.py` is local repository tooling, standard library only, and runs in
+two stages on one `OPENROUTER_API_KEY` (environment variable, repository `.env`, or `--api-key`):
+a text model reads `SKILL.md` plus everything under `references/` and a manifest of `scripts/` and
+`assets/`, distils it into a description of one diagram, then an image model draws it. Because it
+reads the whole skill, run it **after** the documentation is final, not before.
+
+```bash
+# one skill -> docs/images/<name>.png, replacing any existing image
+uv run python scripts/generate_skill_image.py --skill <name>
+
+# see which files feed the reader, and where the image lands — no API calls, nothing billed
+uv run python scripts/generate_skill_image.py --skill <name> --dry-run
+
+# read the skill and print the diagram prompt without drawing it
+uv run python scripts/generate_skill_image.py --skill <name> --prompt-only
+
+# several skills in one batch
+uv run python scripts/generate_skill_image.py --skill <name-a> <name-b>
+
+# backfill everything missing an image, six at a time
+uv run python scripts/generate_skill_image.py --all --skip-existing -j 6
+```
+
+Look at the result before committing it. Image models misspell labels and occasionally point an
+arrow at the wrong card; regenerate rather than ship a diagram whose text is wrong. `--quality low`
+makes iteration cheap while checking composition, but commit a `high` render. Both the art direction
+and the reader's instructions live at the top of the script — change them there rather than
+hand-tuning one skill's prompt, so the set stays visually consistent.
+
+## Before opening a PR
+
+- Directory name and frontmatter `name` match exactly.
+- No `tests/` directory and no `test_*.py` anywhere under `skills/<name>/` — tests belong in
+  `tests/<name>/`.
+- Only the six spec-defined top-level fields; everything else under `metadata`.
+- `metadata.version` exists, is quoted, and is bumped if you changed an existing skill.
+- `metadata` is a block mapping; `openclaw` / `hermes` blocks are nested mappings.
+- `uv run skills-ref validate skills/<name>` passes.
+- If the collection version changes, `plugin.json` `version` matches `pyproject.toml`.
+- `uv run --with pytest python -m pytest tests/_meta -q` passes — this is what CI blocks on, and it
+  catches a missing suite, a missing `skill-requirements.toml` entry, a broken local link, a
+  leaked local path, and a drifted Agent Plugins manifest.
+- If the skill ships `scripts/`: a suite exists at `tests/<name>/`, a `[skills.<name>]` entry exists
+  in `tests/skill-requirements.toml`, and `python tests/run_all.py --isolated <name>` passes.
+- If the skill ships `docs/images/<name>.png`, its labels are spelled correctly and its arrows point
+  where they should. The image itself is optional.
+- Examples and scripts are tested, or clearly marked illustrative.
+- No secrets or private data; scan results clean or explained in the PR.

CITATION.cff

@@ -0,0 +1,52 @@
+cff-version: 1.2.0
+message: >-
+  If you use Scientific Agent Skills in your research or project, please cite
+  the paper listed under preferred-citation. To pin the exact skill set an
+  analysis ran against, also cite this repository and record the release tag
+  or commit you used.
+type: software
+title: Scientific Agent Skills
+abstract: >-
+  An open library of 163 ready-to-use Agent Skills for science and research,
+  covering genomics, cheminformatics, medical imaging, study design, scientific
+  communication, and more, for any AI agent that supports the open Agent Skills
+  standard.
+authors:
+  - name: K-Dense Inc.
+    website: https://www.k-dense.ai
+repository-code: https://github.com/K-Dense-AI/scientific-agent-skills
+url: https://github.com/K-Dense-AI/scientific-agent-skills
+license: MIT
+keywords:
+  - agent-skills
+  - science
+  - research
+  - bioinformatics
+  - cheminformatics
+  - biology
+  - chemistry
+  - medicine
+preferred-citation:
+  type: generic
+  title: "Scientific Agent Skills: A Library of Procedural Knowledge for Research Agents"
+  authors:
+    - family-names: Kassis
+      given-names: Timothy
+    - family-names: Agarwal
+      given-names: Vinayak
+    - family-names: He
+      given-names: Yuhuan
+    - family-names: Patel
+      given-names: Darshil
+    - family-names: Brueckner
+      given-names: Aubrey M.
+  year: 2026
+  month: 8
+  date-published: 2026-08-30
+  doi: 10.48550/arXiv.2609.00065
+  url: https://arxiv.org/abs/2609.00065
+  identifiers:
+    - type: other
+      value: "arXiv:2609.00065"
+      description: arXiv preprint identifier
+  notes: arXiv preprint, primary class cs.CL

CLAUDE.md

@@ -0,0 +1,3 @@
+# CLAUDE.md
+
+Repository guidance for this project lives in [AGENTS.md](AGENTS.md). Read it and follow it.

CODE_OF_CONDUCT.md

@@ -0,0 +1,135 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+[contact@k-dense.ai](mailto:contact@k-dense.ai).
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+Note that this address is for conduct reports. Security vulnerabilities follow a
+separate, confidential process — see [SECURITY.md](SECURITY.md).
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][mozilla coc].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][faq]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[mozilla coc]: https://github.com/mozilla/inclusion
+[faq]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -2,18 +2,25 @@
 
 Thanks for helping improve Scientific Agent Skills. This guide explains how to add or update a skill in this repository while following the open [Agent Skills specification](https://agentskills.io/specification).
 
+Participation in this project is governed by our [Code of Conduct](CODE_OF_CONDUCT.md).
+
 ## Ways to Contribute
 
 - Add a new scientific package, database, platform, workflow, or research method skill.
 - Improve an existing skill with clearer instructions, current APIs, better examples, references, or scripts.
 - Fix outdated examples, broken install steps, security issues, or documentation gaps.
+- Add or extend a skill's tests under `tests/<skill-name>/` (see [Tests](#tests)).
 - Report bugs or request new skills through GitHub Issues.
 
 ## Skill Location
 
-All repository skills live under `skills/`:
+All repository skills live under `skills/`. The repository root is also an
+[Agent Plugins](https://agent-plugins.org/) package: keep root `plugin.json` schema-valid, do not
+add non-portable top-level fields, and keep its `version` in sync with `pyproject.toml` whenever
+you bump the collection version.
 
 ```text
+plugin.json
 skills/
 └── skill-name/
     ├── SKILL.md
@@ -28,8 +35,12 @@ Only `SKILL.md` is required. Use optional directories when they make the skill e
 - `scripts/` for executable helpers, validators, or reusable workflow code.
 - `assets/` for templates, static resources, or example data.
 
+Those four are the only directories a skill may contain. Anything else — tests, fixtures, scratch data, generated output — belongs outside `skills/`.
+
 Keep references one level deep from `SKILL.md` where possible, and keep the main `SKILL.md` concise. The Agent Skills specification recommends keeping `SKILL.md` under 500 lines and using progressive disclosure for longer material.
 
+A skill directory holds only what an agent loads, so tests do not belong there. They live in the repository-level suite under `tests/<skill-name>/`, mirroring the skill directory name, with any fixtures in `tests/<skill-name>/fixtures/`. See [Tests](#tests).
+
 ## Required Skill Format
 
 Every skill must be a directory containing a `SKILL.md` file with YAML frontmatter followed by Markdown instructions.
@@ -42,6 +53,7 @@ name: skill-name
 description: Clear description of what the skill does and when an agent should use it.
 metadata:
   version: "1.0"
+  skill-author: Your Name
 ---
 
 # Skill Title
@@ -71,17 +83,90 @@ Follow the [Agent Skills specification](https://agentskills.io/specification) an
 - `description` should explain both what the skill does and when an agent should use it.
 - `metadata.version` is required in this repository, even though `metadata` is optional in the upstream spec.
 - Version values must be quoted numeric strings, such as `"1.0"` or `"1.1"`.
+- **Only the six fields defined by the specification are allowed** at the top level: `name`, `description`, `license`, `compatibility`, `allowed-tools`, and `metadata`. The spec defines a closed set and the reference validator rejects any other top-level key, so everything else belongs under `metadata`.
+- **Write `metadata` as a block mapping, not single-line JSON.** The reference validator parses frontmatter with `strictyaml`, which rejects JSON-style flow mappings. A flow mapping does not merely fail one check — the entire frontmatter fails to parse, so `name` and `description` become unreadable and the skill does not register.
+
+  ```yaml
+  # Wrong -- breaks the reference validator
+  metadata: {"version": "1.0", "skill-author": "K-Dense Inc."}
+
+  # Right
+  metadata:
+    version: "1.0"
+    skill-author: K-Dense Inc.
+  ```
 
 Optional frontmatter fields from the specification may be used when relevant:
 
 - `license`: the license for the individual skill, if different or worth stating explicitly.
-- `compatibility`: environment requirements such as Python version, system packages, agent host, or network access.
-- `metadata`: additional string key-value metadata.
-- `allowed-tools`: space-separated tool permissions for hosts that support this experimental field.
+- `compatibility`: environment requirements such as Python version, system packages, agent host, or network access. Maximum 500 characters.
+- `metadata`: additional metadata, as a block mapping of string keys to string values. Quote any value that would otherwise parse as a number, boolean, or date (`version: "1.0"`, `last-reviewed: "2026-07-23"`). Common keys: `version` (required), `skill-author`, and an optional nested `openclaw` or `hermes` block (see below).
+- `allowed-tools`: a **space-separated string** of tool permissions for hosts that support this experimental field, for example `allowed-tools: Read Write Edit Bash`. Not a YAML list.
+
+### OpenClaw gating (`metadata.openclaw`)
+
+OpenClaw reads an optional `openclaw` object nested inside `metadata` for dependency gating, credential injection, and display. Because it lives under `metadata`, the Agent Skills spec permits it and other hosts ignore it. It is only needed for skills with external requirements (credentials, daemons, specific binaries) — most skills omit it entirely.
+
+**Keep this block a nested mapping — never a JSON string.** OpenClaw's `resolveOpenClawManifestBlock()` requires `typeof candidate === "object"`, so a stringified block silently disables gating and credential injection with no error. This is the one documented exception to the string-values rule for `metadata`, and it still passes `skills-ref validate`.
+
+Supported keys:
+
+- `requires`: hard eligibility gates — `{"bins": [...]}` (all must be on `PATH`), `{"anyBins": [...]}` (at least one), `{"env": [...]}` (vars that must be set), `{"config": [...]}`. A failed gate hides the skill from the agent, so only gate on things the skill genuinely cannot run without.
+- `primaryEnv`: the main credential variable; OpenClaw injects it from its config (`skills.entries.<name>.apiKey`).
+- `envVars`: descriptive (non-gating) declarations — `[{"name": "X_API_KEY", "required": true, "description": "..."}]`. Declare every env var your scripts reference so ClawHub's security analysis does not flag a metadata mismatch.
+- `os`: platform filter, e.g. `["darwin", "linux"]`.
+- `emoji`, `homepage`: display only.
+
+Example (an API-key skill that stays available even without the key set, so it gates nothing and only declares the credential):
+
+```yaml
+metadata:
+  version: "1.0"
+  skill-author: K-Dense Inc.
+  openclaw:
+    primaryEnv: EXA_API_KEY
+    envVars:
+      - name: EXA_API_KEY
+        required: true
+        description: Exa search API key.
+```
+
+### Hermes compatibility (`required_environment_variables` and `metadata.hermes`)
+
+[Hermes](https://hermes-agent.nousresearch.com/docs) is Agent Skills-compatible, so every skill in this repository already loads and runs there with no changes. Two optional fields make credentialed skills first-class on Hermes:
+
+- **`metadata.hermes`** (nested, spec-safe like `openclaw`): optional classification and gating — `tags`, `category`, `requires_toolsets`, `fallback_for_toolsets`. A failed `requires_toolsets` gate *hides* the skill, so only gate on a tool the skill genuinely cannot run without; prefer leaving it unset so the skill stays available. Keep it a nested mapping, not a JSON string.
+
+Example (an API-key skill, declaring its credential for OpenClaw and classifying itself for Hermes):
+
+```yaml
+metadata:
+  version: "1.0"
+  skill-author: Exa
+  openclaw:
+    primaryEnv: EXA_API_KEY
+    envVars:
+      - name: EXA_API_KEY
+        required: true
+        description: Exa search API key.
+  hermes:
+    category: research
+```
+
+### `required_environment_variables` is not used in this repository
+
+Hermes also reads a **top-level** `required_environment_variables` array to prompt for credentials. That field cannot coexist with spec conformance: the specification defines a closed set of six top-level fields, so the reference validator rejects it outright — and because `strictyaml` fails the whole frontmatter block on an unknown-shaped document, the failure is not confined to that one key.
+
+This repository therefore does not use it. Declare credentials in two spec-legal places instead:
+
+- `compatibility` — a human- and agent-readable sentence naming the variables the skill needs.
+- `metadata.openclaw.envVars` — the machine-readable declaration, which ClawHub's security analysis also checks against the variables your scripts actually reference.
+
+Skills still load and run on Hermes; only its automatic credential prompt is unavailable, and the required variables remain discoverable from the two fields above.
 
 ## Versioning
 
-Every `SKILL.md` must include:
+Every `SKILL.md` must include a quoted `version` inside the `metadata` mapping:
 
 ```yaml
 metadata:
@@ -128,9 +213,17 @@ Good skills are specific, practical, and easy for an agent to apply.
 
 5. Test any commands, code examples, and scripts included in the skill.
 
-6. Update related documentation if the new skill changes repository-level lists, examples, or setup guidance.
+6. If the skill ships `scripts/`, add their tests in the repository-level suite, not in the skill directory:
 
-7. Run validation and security checks before opening a pull request.
+   ```text
+   tests/skill-name/
+   ```
+
+   See [Tests](#tests) for the layout, the path anchor to use, and how to run them.
+
+7. Update related documentation if the new skill changes repository-level lists, examples, or setup guidance.
+
+8. Run validation and security checks before opening a pull request.
 
 ## Updating an Existing Skill
 
@@ -139,17 +232,22 @@ Good skills are specific, practical, and easy for an agent to apply.
 3. Make the smallest useful change that fixes or improves the skill.
 4. Increment `metadata.version`.
 5. Test changed examples, commands, and scripts.
-6. Note any behavior changes in the pull request description.
+6. Run the skill's suite if it has one: `uv run --with pytest python -m pytest tests/skill-name -q`. Suites check that `metadata.version` is present and quoted, not what it equals, so a version bump never needs a matching test edit.
+7. Note any behavior changes in the pull request description.
 
 ## Validation
 
-Validate Agent Skills format with the reference validator:
+Validate Agent Skills format with the reference validator, which is already a dev dependency:
 
 ```bash
-skills-ref validate ./skills/skill-name
+uv sync
+uv run skills-ref validate ./skills/skill-name
+
+# or check every skill at once, the same way CI does
+for d in skills/*/; do uv run skills-ref validate "$d"; done
 ```
 
-If `skills-ref` is not installed, follow the installation instructions from the [skills-ref reference library](https://github.com/agentskills/agentskills/tree/main/skills-ref).
+CI runs this on every pull request that touches `skills/`, along with the repo-specific checks in `.github/workflows/skill-spec-validation.yml` (a required `metadata.version`, `allowed-tools` as a string, quoted `metadata` scalars, and a warning above 500 lines).
 
 Security-scan new or substantially changed skills:
 
@@ -160,15 +258,101 @@ skill-scanner scan ./skills/skill-name --use-behavioral
 
 A clean scan reduces review noise but does not replace manual review.
 
+## Tests
+
+**Tests never live under `skills/`.** A skill directory ships only what an agent loads, so tests go in the repository-level suite instead — one directory per skill, named exactly after the skill directory:
+
+```text
+tests/
+└── skill-name/          # matches skills/skill-name/
+    ├── test_scripts.py
+    └── fixtures/        # optional test data
+```
+
+A test reaches the skill it covers through an explicit anchor rather than a relative walk:
+
+```python
+SKILL_ROOT = Path(__file__).resolve().parents[2] / "skills" / "skill-name"
+```
+
+Anything the CLIs under test resolve relative to the working directory should be repo-root relative, since the suite runs from the repository root — `tests/skill-name/fixtures/manifest.json`, not `fixtures/manifest.json`.
+
+Run one skill's suite, or the whole tree:
+
+```bash
+uv run --with pytest python -m pytest tests/skill-name -q
+
+# every skill, in a separate process each, after the repo-wide guard
+uv run --with pytest python tests/run_all.py
+```
+
+Each skill's suite must run in its own process. Skills' `scripts/` directories own plain top-level module names — 32 skills ship a `scripts/_common.py`, and names like `cluster.py` and `validate_manifest.py` recur — so collecting two skills into one interpreter would resolve those imports to whichever skill was imported first and silently test the wrong files. `tests/conftest.py` rejects a multi-skill session, and `tests/run_all.py` forks per skill.
+
+### The repo-wide guard, and what you no longer have to write
+
+```bash
+uv run --with pytest python -m pytest tests/_meta -q
+```
+
+`tests/_meta` is the check to run first and the one CI blocks on. It needs no scientific packages and finishes in seconds. It spans every skill at once — safe, because it parses scripts with `ast` and never imports them — and it enforces the rule this whole layout exists for: **a skill that ships `scripts/` must have a suite at `tests/<name>/` and a `[skills.<name>]` entry in `skill-requirements.toml`.** It also runs the shared structural contract over every skill: frontmatter conformance, the 500-line `SKILL.md` limit, no tests or compiled bytecode under `skills/`, every local link resolving, every script parsing, no `eval`/`exec`/`os.system`, no script shadowing a standard-library module, no hardcoded local path, and valid shell scripts.
+
+Because `tests/_meta` already covers all of that repo-wide, a per-skill suite should not repeat it. Write only what is specific to the skill, and pull the shared pieces from `tests/_contract/`, which `tests/conftest.py` registers as the importable module `skill_contract`:
+
+```python
+import skill_contract
+
+# every argparse script answers --help; skips when the skill's packages are
+# absent, and runs for real under --isolated
+CliHelpTests = skill_contract.cli.help_test_case(SKILL_ROOT)
+
+# for scripts that are importable libraries with a worked example under
+# `if __name__ == "__main__":` rather than argparse CLIs
+DemoBlockTests = skill_contract.cli.demo_test_case(SKILL_ROOT, ("doe_designs.py",))
+```
+
+`skill_contract.office` and `skill_contract.schematic` cover files that several skills ship byte-identical copies of — the OOXML `office/` tree under `docx`/`pptx`/`xlsx`, and the AI schematic generator under five skills. Instantiate them against your skill root rather than writing the tests again; `tests/_meta` separately fails if the copies drift apart, so those files have to be changed together.
+
+Guard heavy imports at module scope so a suite degrades to skips rather than a collection error when a package is missing:
+
+```python
+np = pytest.importorskip("numpy", reason="skill-name needs numpy")
+```
+
+### One environment per skill
+
+Four suites fail on this repository's default environment because their scientific dependencies are not installed (`exa-search`, `qutip`, `scikit-survival`, `simpy`), and installing them all into one environment is not possible: the skills' upstream pins contradict each other. `opentrons` requires `numpy<2`; `esm` caps `transformers` below the release the `transformers` skill targets; `geniml` and `spikeinterface` pin `zarr<3` while the `zarr-python` skill targets 3.x; `bioservices` caps `lxml<6` while `matchms` requires 6.0.2+; and `pytdc`, `molfeat`, `deepchem`, `histolab`, `vaex`, and `ete3` each need an interpreter older than 3.13.
+
+`--isolated` therefore gives each skill its own throwaway `uv` environment, built from [`tests/skill-requirements.toml`](tests/skill-requirements.toml):
+
+```bash
+python tests/run_all.py --isolated                    # every suite, one env each
+python tests/run_all.py --isolated qutip exa-search   # just these
+```
+
+Nothing is installed into the project environment, so `uv sync` is unaffected. Each `[skills.<name>]` entry lists the packages that skill documents and, where needed, a `python` version for that skill alone — uv downloads the interpreter on demand. Packages that cannot be installed at all (a GitHub-only SDK, a conda-forge-only library, a CUDA build) are listed under `[unavailable]` with the reason, and the runner prints them so the gap appears in the test output.
+
+A new skill that ships `scripts/` needs a `[skills.<name>]` entry — `tests/_meta` fails without one. Use `packages = []` when its bundled tooling is standard-library only — the skill still gets a clean environment with just pytest. uv caches wheels globally, so repeat runs create each environment in milliseconds.
+
+`.github/workflows/skill-tests.yml` runs `tests/_meta` plus every `packages = []` suite on each pull request, which is fast and needs no wheels beyond pytest. The full `--isolated` sweep is not run in CI: it builds an environment per skill, and several of them need a CUDA toolchain, a JDK, or a local MATLAB install that a runner does not have. Run it locally before a release, and whenever you change anything under `tests/_contract/`.
+
 ## Pull Request Checklist
 
 Before submitting a pull request, confirm:
 
 - The skill directory name and `name` frontmatter match exactly.
+- The skill directory contains only `SKILL.md`, `references/`, `scripts/`, and `assets/` — no `tests/` directory and no `test_*.py` files. Tests live in `tests/<skill-name>/`.
 - `SKILL.md` has valid YAML frontmatter and Markdown body content.
+- `uv run skills-ref validate ./skills/<name>` passes.
+- Only the six spec-defined top-level fields are present; anything else lives under `metadata`.
+- `metadata` is a block mapping, not single-line JSON, and its scalar values are quoted where needed.
+- Any `metadata.openclaw` or `metadata.hermes` block is a nested mapping, not a JSON string.
+- If the skill needs credentials, they are named in `compatibility` and declared in `metadata.openclaw.envVars`.
 - `metadata.version` exists and is quoted.
 - Existing skills have a version bump when changed.
+- If the collection version changes, `plugin.json` `version` matches `pyproject.toml`.
 - The `description` clearly says what the skill does and when to use it.
+- `uv run --with pytest python -m pytest tests/_meta -q` passes. This is what CI blocks on, and it catches a missing suite, a missing `skill-requirements.toml` entry, a broken local link, a leaked local path, and a `SKILL.md` over 500 lines.
+- If the skill ships `scripts/`: a suite exists at `tests/<skill-name>/`, a `[skills.<skill-name>]` entry exists in `tests/skill-requirements.toml`, and `python tests/run_all.py --isolated <skill-name>` passes.
 - Examples and scripts have been tested or clearly marked as illustrative.
 - No secrets, credentials, private data, or unsafe instructions are included.
 - Relevant official documentation is linked where useful.

README.md

@@ -1,27 +1,32 @@
 # Scientific Agent Skills
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE.md)
-[![Version](https://img.shields.io/badge/Version-2.43.0-blue.svg)](pyproject.toml)
-[![Skills](https://img.shields.io/badge/Skills-140-brightgreen.svg)](#-whats-included)
+[![arXiv](https://img.shields.io/badge/arXiv-2609.00065-b31b1b.svg)](https://arxiv.org/abs/2609.00065)
+[![Version](https://img.shields.io/badge/Version-2.65.0-blue.svg)](pyproject.toml)
+[![Skills](https://img.shields.io/badge/Skills-163-brightgreen.svg)](#-whats-included)
 [![Databases](https://img.shields.io/badge/Databases-100%2B-orange.svg)](#-whats-included)
 [![Agent Skills](https://img.shields.io/badge/Standard-Agent_Skills-blueviolet.svg)](https://agentskills.io/)
+[![Agent Plugins](https://img.shields.io/badge/Standard-Agent_Plugins-0A7A72.svg)](https://agent-plugins.org/)
 [![Security Scan](https://github.com/K-Dense-AI/scientific-agent-skills/actions/workflows/security-scan.yml/badge.svg)](https://github.com/K-Dense-AI/scientific-agent-skills/actions/workflows/security-scan.yml)
+[![Skill Tests](https://github.com/K-Dense-AI/scientific-agent-skills/actions/workflows/skill-tests.yml/badge.svg)](https://github.com/K-Dense-AI/scientific-agent-skills/actions/workflows/skill-tests.yml)
 [![Works with](https://img.shields.io/badge/Works_with-Cursor_|_Claude_Code_|_Codex_|_Google_Antigravity-blue.svg)](#-getting-started)
 [![X](https://img.shields.io/badge/Follow_on_X-%40k__dense__ai-000000?logo=x)](https://x.com/k_dense_ai)
 [![LinkedIn](https://img.shields.io/badge/LinkedIn-K--Dense_Inc.-0A66C2?logo=linkedin)](https://www.linkedin.com/company/k-dense-inc)
 [![YouTube](https://img.shields.io/badge/YouTube-K--Dense_Inc.-FF0000?logo=youtube)](https://www.youtube.com/@K-Dense-Inc)
-
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=K-Dense-AI/scientific-agent-skills&type=date&legend=top-left)](https://www.star-history.com/#K-Dense-AI/scientific-agent-skills&type=date&legend=top-left)
+[![Reddit](https://img.shields.io/badge/Reddit-u%2F--k--dense---FF4500?logo=reddit&logoColor=white)](https://www.reddit.com/user/-k-dense-/)
 
 > **🔔 Claude Scientific Skills is now Scientific Agent Skills.** Same skills, broader compatibility — now works with any AI agent that supports the open [Agent Skills](https://agentskills.io/) standard, not just Claude.
 
-> **New: [K-Dense BYOK](https://github.com/K-Dense-AI/k-dense-byok)** — A free, open-source AI co-scientist that runs on your desktop, powered by Scientific Agent Skills. Bring your own API keys, pick from 40+ models, and get a full research workspace with web search, file handling, 100+ scientific databases, and access to all 140 skills in this repo. Your data stays on your computer, and you can optionally scale to cloud compute via [Modal](https://modal.com/) for heavy workloads. [Get started here.](https://github.com/K-Dense-AI/k-dense-byok)
+> **New: [K-Dense BYOK](https://github.com/K-Dense-AI/k-dense-byok)** — A free, open-source AI co-scientist that runs on your desktop, powered by Scientific Agent Skills. Bring your own API keys, pick from 40+ models, and get a full research workspace with web search, file handling, 100+ scientific databases, and access to all 163 skills in this repo. Your data stays on your computer, and you can optionally scale to cloud compute via [Modal](https://modal.com/) for heavy workloads. [Get started here.](https://github.com/K-Dense-AI/k-dense-byok)
 
-> **Stay up to date:** Follow K-Dense on [X](https://x.com/k_dense_ai), [LinkedIn](https://www.linkedin.com/company/k-dense-inc), and [YouTube](https://www.youtube.com/@K-Dense-Inc) for new skills, release announcements, walkthroughs, research workflow demos, and examples you can use with your own AI agent.
+> **🎥 Webinar recording — [Getting Started with K-Dense BYOK](https://youtu.be/Du3BIE48DKc?si=9dPpETKSc2PeQbvU)**
+> A hands-on walkthrough of [K-Dense BYOK](https://github.com/K-Dense-AI/k-dense-byok), our free, open-source AI co-scientist that runs locally on your own machine and is powered by Scientific Agent Skills. We cover how to set it up, bring your own API keys, and run real research workflows with these skills. No prior technical experience needed. **[Watch the recording →](https://youtu.be/Du3BIE48DKc?si=9dPpETKSc2PeQbvU)**
 
-A comprehensive collection of **140 ready-to-use scientific and research skills** (covering cancer genomics, drug-target binding, molecular dynamics, RNA velocity, geospatial science, time series forecasting, scientific ML resource discovery via Hugging Science, 78+ scientific databases, and more) for any AI agent that supports the open [Agent Skills](https://agentskills.io/) standard, created by [K-Dense](https://k-dense.ai). Works with **Cursor, Claude Code, Codex, Google Antigravity, and more**. Transform your AI agent into a research assistant capable of executing complex multi-step scientific workflows across biology, chemistry, medicine, and beyond.
+> **Stay up to date:** Follow K-Dense on [X](https://x.com/k_dense_ai), [LinkedIn](https://www.linkedin.com/company/k-dense-inc), [YouTube](https://www.youtube.com/@K-Dense-Inc), and [Reddit](https://www.reddit.com/user/-k-dense-/) for new skills, release announcements, walkthroughs, research workflow demos, and examples you can use with your own AI agent.
+
+> **📄 Paper:** Scientific Agent Skills is described in [*Scientific Agent Skills: A Library of Procedural Knowledge for Research Agents*](https://arxiv.org/abs/2609.00065) (arXiv:2609.00065). If you use these skills in your research, please [cite the paper](#-citation).
+
+A comprehensive collection of **163 ready-to-use scientific and research skills** (covering cancer genomics, individual-level 1000 Genomes queries, hosted regulatory-sequence prediction, live pathogen-variant surveillance, analytical method validation, PK/PD modelling and dose selection, full-text biomedical and regulatory literature retrieval, drug-target binding, bounded biomedical knowledge graph search, molecular dynamics, RNA velocity, microbiome foundation models, geospatial science, time series forecasting, scientific ML resource discovery via Hugging Science, 78+ scientific databases, and more) for any AI agent that supports the open [Agent Skills](https://agentskills.io/) standard, created by [K-Dense](https://k-dense.ai). The repository is also a portable [Agent Plugins](https://agent-plugins.org/) package (`plugin.json` + `skills/`), so plugin-capable clients can load the whole collection as one plugin. Works with **Cursor, Claude Code, Codex, Google Antigravity, and more**. Transform your AI agent into a research assistant capable of executing complex multi-step scientific workflows across biology, chemistry, medicine, and beyond.
 
 > ⭐ **Help make AI for science easier to discover:** If Scientific Agent Skills saves you time, teaches your agent a workflow, or helps your lab move faster, please [star this repository](https://github.com/K-Dense-AI/scientific-agent-skills). A star is a public signal that these open, reusable research skills are worth maintaining: it helps scientists, engineers, and open-source contributors find the project, shows which agent-skill standards are gaining real adoption, and gives us a clear reason to keep expanding the collection for the community.
 
@@ -31,9 +36,10 @@ These skills enable your AI agent to seamlessly work with specialized scientific
 - 🧬 Bioinformatics & Genomics - Sequence analysis, single-cell RNA-seq, gene regulatory networks, variant annotation, phylogenetic analysis
 - 🧪 Cheminformatics & Drug Discovery - Molecular property prediction, virtual screening, ADMET analysis, molecular docking, lead optimization
 - 🔬 Proteomics & Mass Spectrometry - LC-MS/MS processing, peptide identification, spectral matching, protein quantification
-- 🏥 Clinical Research & Precision Medicine - Clinical trials, pharmacogenomics, variant interpretation, drug safety, clinical decision support, treatment planning
-- 🧠 Healthcare AI & Clinical ML - EHR analysis, physiological signal processing, medical imaging, clinical prediction models
-- 🖼️ Medical Imaging & Digital Pathology - DICOM processing, whole slide image analysis, computational pathology, radiology workflows
+- 🏥 Clinical Research & Evidence Workflows - Clinical trials, pharmacogenomics, variant evidence review, pharmacokinetic/pharmacodynamic modelling and dose-regimen evaluation, aggregate decision-support evaluation, source-bound draft report structures, and formatting of clinician-authored treatment decisions
+- 🧠 Healthcare AI & Biosignal Research - EHR and model research, physiological signal analysis, and retrospective validation—not patient-specific diagnosis, treatment, alarms, or deployment decisions
+- 🐭 Preclinical Research & Animal Welfare - Multivariate severity scoring and humane-endpoint forecasting for laboratory animal studies, for 3Rs/refinement analysis and EU Directive 2010/63/EU reporting—an aid to severity assessment, never a decision rule
+- 🖼️ Medical Imaging & Digital Pathology - Privacy-aware DICOM processing and research-only whole-slide image analysis, computational pathology, and radiology data workflows
 - 🤖 Machine Learning & AI - Deep learning, reinforcement learning, time series analysis, model interpretability, Bayesian methods
 - 🔮 Materials Science & Chemistry - Crystal structure analysis, phase diagrams, metabolic modeling, computational chemistry
 - 🌌 Physics & Astronomy - Astronomical data analysis, coordinate transformations, cosmological calculations, symbolic mathematics, physics computations
@@ -41,26 +47,40 @@ These skills enable your AI agent to seamlessly work with specialized scientific
 - 📊 Data Analysis & Visualization - Statistical analysis, network analysis, time series, publication-quality figures, large-scale data processing, EDA
 - 🌍 Geospatial Science & Remote Sensing - Satellite imagery processing, GIS analysis, spatial statistics, terrain analysis, machine learning for Earth observation
 - 🧪 Laboratory Automation - Liquid handling protocols, lab equipment control, workflow automation, LIMS integration
-- 📚 Scientific Communication - Literature review, peer review, scientific writing, document processing, posters, slides, schematics, citation management
+- 📚 Scientific Communication - Evidence-traceable writing, confidential authorized peer review, literature synthesis, document processing, macro-free PPTX posters, slides, schematics, and citation management
 - 🔬 Multi-omics & Systems Biology - Multi-modal data integration, pathway analysis, network biology, systems-level insights
 - 🧬 Protein Engineering & Design - Protein language models, structure prediction, sequence design, function annotation
-- 🎓 Research Methodology - Hypothesis generation, scientific brainstorming, critical thinking, grant writing, scholar evaluation
+- 🧰 Agent Platforms & Infrastructure - Build on Pi with SDK, RPC, extensions, custom providers/models, packages, TUI components, and session tooling
+- 🎓 Research Methodology - Evidence-bounded candidate hypotheses, scientific brainstorming, critical thinking, grant writing, and qualitative low-stakes evaluation of scholarly works
+- ⚖️ Regulatory & Standards - Draft evidence-preparation artifacts for ISO management-system and laboratory standards, plus analytical method validation, verification, and transfer under ICH/USP/CLSI frameworks—prepared for qualified review, never a certification, accreditation, or method-release decision
 
 **Transform your AI coding agent into an 'AI Scientist' on your desktop!**
 
 > 🎬 **New to Scientific Agent Skills?** Watch our [Getting Started with Scientific Agent Skills](https://youtu.be/ZxbnDaD_FVg) video for a quick walkthrough.
 
+### 🎥 More tutorials
+
+Recorded walkthroughs of these skills on real research tasks, from the [K-Dense YouTube channel](https://www.youtube.com/@K-Dense-Inc):
+
+| Video | What it covers |
+|-------|----------------|
+| [Skills 101: Build Your Own Scientific Agent Skill](https://youtu.be/lVZbHiwzMEg) | Writing, testing, and packaging a new skill from scratch |
+| [Literature Review and Hypothesis Generation](https://youtu.be/wKJp8y4ZyiM) | Searching the literature and generating grounded hypotheses |
+| [Draft and Budget an Experimental Protocol](https://youtu.be/Yz2L5s_M_34) | Turning a planned experiment into a costed, written protocol |
+| [Draft Responses to Reviewer Comments](https://youtu.be/0MmU-Pmtg1o) | Building a point-by-point rebuttal from reviewer feedback |
+| [Can AI Reproduce a Nature Medicine Paper?](https://youtu.be/4WTCK9kSfdk) | An end-to-end reproduction attempt on a published analysis |
+
 ---
 
 ## 📦 What's Included
 
-This repository provides **140 scientific and research skills** organized into the following categories:
+This repository provides **163 scientific and research skills** organized into the following categories:
 
-- **100+ Scientific & Financial Databases** - A unified database-lookup skill provides direct access to 78 public databases (PubChem, ChEMBL, UniProt, COSMIC, ClinicalTrials.gov, FRED, USPTO, and more), plus dedicated skills for DepMap, Imaging Data Commons, PrimeKG, U.S. Treasury Fiscal Data, and Hugging Science (curated catalog of scientific datasets, models, and demos across 17 scientific domains on Hugging Face). Multi-database packages like BioServices (~40 bioinformatics services), BioPython (38 NCBI sub-databases via Entrez), and gget (20+ genomics databases) add further coverage
-- **70+ Optimized Python Package Skills** - Explicitly defined skills for RDKit, Scanpy, PyTorch Lightning, scikit-learn, BioPython, pyzotero, BioServices, PennyLane, Qiskit, Molecular Dynamics (OpenMM/MDAnalysis), scVelo, TimesFM, and others — with curated documentation, examples, and best practices. Note: the agent can write code using *any* Python package, not just these; these skills simply provide stronger, more reliable performance for the packages listed
+- **100+ Scientific & Financial Databases** - A unified database-lookup skill provides deterministic, provenance-rich access to 78 public databases (PubChem, ChEMBL, UniProt, COSMIC, ClinicalTrials.gov, FRED, USPTO, and more), plus dedicated skills for DepMap, Imaging Data Commons, PrimeKG, NCATS ARAX, U.S. Treasury Fiscal Data, Hugging Science, OneKGPd, and Genomic Intelligence. Multi-database packages like BioServices (~40 bioinformatics services), BioPython (39 NCBI sub-databases via Entrez), and gget (20+ genomics databases) add further coverage
+- **70+ Optimized Python Package Skills** - Explicitly defined, version-aware workflows for RDKit, Scanpy, PyTorch Lightning, scikit-learn, PyTDC, PathML, pydicom, NeuroKit2, PufferLib, QuTiP, GeoPandas, pymatgen, BioPython, Qiskit, Molecular Dynamics (OpenMM/MDAnalysis), and others. The agent can still use *any* Python package; these skills provide stronger, safer guidance for the packages listed
 - **9 Scientific Integration Skills** - Explicitly defined skills for Benchling, DNAnexus, LatchBio, OMERO, Protocols.io, Open Notebook, Ginkgo Cloud Lab, LabArchives, and Opentrons. Again, the agent is not limited to these — any API or platform reachable from Python is fair game; these skills are the optimized, pre-documented paths
-- **30+ Analysis & Communication Tools** - Literature review, scientific writing, peer review, document processing, Paperzilla, PACSOMATIC, Exa Search, posters, slides, schematics, infographics, Mermaid diagrams, and more
-- **10+ Research & Clinical Tools** - Hypothesis generation, grant writing, clinical decision support, treatment plans, BIDS, regulatory compliance, scenario analysis, and workflow-derived skill drafting with Autoskill
+- **30+ Analysis & Communication Tools** - Literature review, evidence-traceable scientific writing, confidential peer review, document processing, Paperclip (full-text papers, FDA/PMDA/EMA filings, and trial registries with line-pinned citations), Paperzilla, Exa Search, macro-free PPTX posters, slides, schematics, infographics, Mermaid diagrams, and more
+- **10+ Research & Clinical Tools** - Evidence-bounded hypothesis generation, grant writing, aggregate clinical decision-support research, clinician-authored treatment-plan formatting, PK/PD modelling and simulation (NCA, population PK, exposure-response, bioequivalence, first-in-human dose), BIDS, ISO standards-readiness evidence preparation (ISO 13485, ISO 14971, ISO/IEC 17025, ISO 15189), analytical method validation and transfer (ICH Q2(R2)/Q14, ICH M10, USP, CLSI EP), scenario analysis, and workflow-derived skill drafting with Autoskill
 
 Each skill includes:
 - ✅ Comprehensive documentation (`SKILL.md`)
@@ -68,6 +88,7 @@ Each skill includes:
 - ✅ Use cases and best practices
 - ✅ Integration guides
 - ✅ Reference materials
+- ✅ A test suite for every skill that ships `scripts/` — CI blocks a pull request that adds bundled tooling without one
 
 ---
 
@@ -82,6 +103,7 @@ Each skill includes:
 - [Quick Examples](#-quick-examples)
 - [Use Cases](#-use-cases)
 - [Available Skills](#-available-skills)
+- [From the Blog](#-from-the-blog)
 - [Contributing](#-contributing)
 - [Troubleshooting](#-troubleshooting)
 - [FAQ](#-faq)
@@ -95,21 +117,22 @@ Each skill includes:
 
 ### ⚡ **Accelerate Your Research**
 - **Save Days of Work** - Skip API documentation research and integration setup
-- **Production-Ready Code** - Tested, validated examples following scientific best practices
+- **Reviewed Starting Points** - Tested examples with explicit validation, provenance, and safety boundaries; verify them in the target environment
 - **Multi-Step Workflows** - Execute complex pipelines with a single prompt
 
 ### 🎯 **Comprehensive Coverage**
-- **140 Skills** - Extensive coverage across all major scientific domains
+- **163 Skills** - Extensive coverage across all major scientific domains
 - **100+ Databases** - Unified access to 78+ databases via database-lookup, plus dedicated data access skills and multi-database packages like BioServices, BioPython, and gget
-- **70+ Optimized Python Package Skills** - RDKit, Scanpy, PyTorch Lightning, scikit-learn, BioServices, PennyLane, Qiskit, Molecular Dynamics (OpenMM/MDAnalysis), scVelo, TimesFM, and others (the agent can use any Python package; these are the pre-documented, higher-performing paths)
+- **70+ Optimized Python Package Skills** - Current, version-scoped guidance for packages including RDKit, Scanpy, PyTorch Lightning, scikit-learn, PyTDC, pydicom, PufferLib, QuTiP, GeoPandas, pymatgen, Qiskit, Molecular Dynamics (OpenMM/MDAnalysis), scVelo, and TimesFM (the agent can use any Python package; these are the pre-documented paths)
 
 ### 🔧 **Easy Integration**
 - **Simple Setup** - Copy skills to your skills directory and start working
-- **Automatic Discovery** - Your agent automatically finds and uses relevant skills
+- **Configured Discovery** - Compatible hosts can find and use relevant skills from their configured skill paths
 - **Well Documented** - Each skill includes examples, use cases, and best practices
 
 ### 🌟 **Maintained & Supported**
 - **Regular Updates** - Continuously maintained and expanded by K-Dense team
+- **Tested in CI** - Every skill that ships `scripts/` has a suite under `tests/`, plus a repo-wide structural contract (frontmatter, link resolution, script parsing, `--help` behavior) that runs on every pull request
 - **Community Driven** - Open source with active community contributions
 - **Enterprise Ready** - Commercial support available for advanced needs
 
@@ -117,7 +140,7 @@ Each skill includes:
 
 ## 🎯 Getting Started
 
-### Option 1: npx (all platforms)
+### Option 1: npx (supported hosts)
 
 Install Scientific Agent Skills with a single command:
 
@@ -125,7 +148,7 @@ Install Scientific Agent Skills with a single command:
 npx skills add K-Dense-AI/scientific-agent-skills
 ```
 
-This is the official standard approach for installing Agent Skills across **all platforms**, including **Claude Code**, **Claude Cowork**, **Codex**, **Gemini CLI**, **Google Antigravity**, **Cursor**, and any other agent that supports the open [Agent Skills](https://agentskills.io/) standard.
+This is a common standards-based installer for supported Agent Skills hosts, including current versions of **Claude Code**, **Claude Cowork**, **Codex**, **Gemini CLI**, **Google Antigravity**, and **Cursor**. Confirm installation paths and optional metadata behavior in your host's current documentation.
 
 ### Option 2: GitHub CLI (`gh skill`)
 
@@ -153,7 +176,7 @@ Pin to a specific release tag or commit SHA for reproducible installs:
 
 ```bash
 # Pin to a release tag
-gh skill install K-Dense-AI/scientific-agent-skills --pin v1.0.0
+gh skill install K-Dense-AI/scientific-agent-skills --pin v2.65.0
 
 # Pin to a commit SHA
 gh skill install K-Dense-AI/scientific-agent-skills --pin abc123def
@@ -169,7 +192,47 @@ gh skill update
 gh skill update --all
 ```
 
-**That's it!** Your AI agent will automatically discover the skills and use them when relevant to your scientific tasks. You can also invoke any skill manually by mentioning the skill name in your prompt.
+### Option 3: Agent Plugins (Cursor, Codex, and other plugin clients)
+
+This repository is a valid [Agent Plugins](https://agent-plugins.org/) 1.0.0 package: root [`plugin.json`](plugin.json) plus Agent Skills under `skills/`. Clients that support the standard discover every immediate child of `skills/` that contains a `SKILL.md`.
+
+**Cursor** — symlink or copy the repo into the local plugins directory, then reload:
+
+```bash
+mkdir -p ~/.cursor/plugins/local
+ln -s "$(pwd)" ~/.cursor/plugins/local/scientific-agent-skills
+```
+
+Restart Cursor or run **Developer: Reload Window**, then confirm the plugin and its skills appear under **Customize**. See [Cursor plugins](https://cursor.com/docs/plugins).
+
+**Codex** — install from a local checkout (confirm the current CLI flag names in Codex docs):
+
+```bash
+codex plugins install .
+```
+
+Compatible clients (Cursor, Codex, GitHub Copilot, VS Code, Kiro, and others listed at [agent-plugins.org](https://agent-plugins.org/compatible-clients)) share the same package layout; installation UX stays client-specific.
+
+### Other Agent Skills hosts (OpenClaw, NemoClaw, Pi, Hermes, …)
+
+Agent hosts differ in install paths, discovery settings, and support for optional frontmatter fields. `npx skills add` (Option 1) commonly installs into the `~/.agents/skills/` convention, with project-scoped installs under `.agents/skills/`; confirm both paths against your host's current documentation. To install manually on a host configured to scan one of those locations:
+
+```bash
+git clone https://github.com/K-Dense-AI/scientific-agent-skills.git ~/.agents/skills/scientific-agent-skills   # user-level
+git clone https://github.com/K-Dense-AI/scientific-agent-skills.git .agents/skills/scientific-agent-skills      # project-level
+```
+
+For Hermes versions that support skill taps, add the repository as a tap:
+
+```bash
+hermes skills tap add K-Dense-AI/scientific-agent-skills
+```
+
+Every `SKILL.md` has YAML frontmatter, but legacy and community skills vary in `metadata` formatting (block or flow style) and optional extension fields. Repository updates must keep `metadata.version` as a quoted numeric string and pass canonical `skills-ref validate ./skills/<skill-name>` checks. Hosts may interpret optional metadata and credential prompts differently, so verify behavior on the target host. Because 163 skills add up to a lot of standing context, consider installing a topical subset rather than the whole collection.
+
+> **NemoClaw note:** NemoClaw runs agents inside NVIDIA OpenShell with default-deny outbound networking. Skills are discovered and loaded normally, but any skill that needs the network — package installs via `uv`, or API calls (Exa, Parallel, Benchling, NCBI, Materials Project, …) — only works once the operator pre-approves the relevant domains in the OpenShell TUI.
+
+**That's it!** A compatible host can discover the skills from its configured paths and use them when relevant. You can also invoke any skill manually by mentioning the skill name in your prompt.
 
 ---
 
@@ -195,7 +258,7 @@ We recommend the following:
   ```
 - **Report anything suspicious.** If you find a skill that looks malicious or behaves unexpectedly, please [open an issue](https://github.com/K-Dense-AI/scientific-agent-skills/issues) immediately so we can investigate.
 
-All skills are scanned on an approximately weekly basis, and [SECURITY.md](SECURITY.md) is updated with the latest results. We try to address security gaps as they arise.
+Skills are scanned weekly — incrementally, so unchanged skills carry their previous findings forward, with a full rescan of everything at least every 30 days and whenever the scanner or model changes — and the results are published to [docs/security-report.md](docs/security-report.md). See [SECURITY.md](SECURITY.md) for our security policy, what is in scope, how to report a vulnerability privately, and how to contest a scan finding. We try to address security gaps as they arise.
 
 ---
 
@@ -214,6 +277,12 @@ Scientific Agent Skills is powered by **50+ incredible open source projects** ma
 
 ---
 
+## 🙏 Skill Credits
+
+The **[docx](skills/docx/)**, **[pdf](skills/pdf/)**, **[pptx](skills/pptx/)**, and **[xlsx](skills/xlsx/)** document skills are created and maintained by **Anthropic** and vendored here from [anthropics/skills](https://github.com/anthropics/skills/tree/main/skills). They are used under Anthropic's terms — see each skill's `LICENSE.txt` — and we track upstream so you get their latest improvements. All credit for those four skills goes to Anthropic.
+
+---
+
 ## ⚙️ Prerequisites
 
 - **Python**: 3.13+ for repository tooling; individual skill dependencies may support broader Python ranges
@@ -255,7 +324,7 @@ For more installation options and details, visit the [official uv documentation]
 Once you've installed the skills, you can ask your AI agent to execute complex multi-step scientific workflows. Here are some example prompts:
 
 ### 🧪 Drug Discovery Pipeline
-**Goal**: Find novel EGFR inhibitors for lung cancer treatment
+**Goal**: Prioritize EGFR inhibitor candidates for preclinical lung-cancer research
 
 **Prompt**:
 ```
@@ -314,18 +383,20 @@ MedChem/molfeat.
 
 ---
 
-### 🏥 Clinical Variant Interpretation
-**Goal**: Analyze VCF file for hereditary cancer risk assessment
+### 🏥 Research Variant Evidence Review
+**Goal**: Annotate a synthetic or properly de-identified VCF for hereditary-cancer research and qualified review
 
 **Prompt**:
 ```
-Use available skills you have access to whenever possible. Parse VCF with pysam, annotate variants with Ensembl VEP, query ClinVar for pathogenicity, 
-check COSMIC for cancer mutations, retrieve gene info from NCBI Gene, analyze protein impact 
-with UniProt, search PubMed for case reports, check ClinPGx for pharmacogenomics, generate 
-clinical report with document processing tools, and find matching trials on ClinicalTrials.gov.
+Use available skills you have access to whenever possible. Work only with authorized synthetic
+or de-identified data. Parse the VCF with pysam, annotate variants with Ensembl VEP, retrieve
+ClinVar/COSMIC/NCBI Gene/UniProt evidence, and verify literature sources. Build an evidence-
+traceable research summary with scientific-writing. If clinical-reports is used, create only a
+visibly marked draft structure from a verified source-fact manifest for qualified review; do not
+diagnose, assess individual risk, recommend treatment, or determine trial eligibility.
 ```
 
-**Skills Used**: pysam, database-lookup, paper-lookup, clinical-reports, docx, pdf
+**Skills Used**: pysam, database-lookup, paper-lookup, scientific-writing, clinical-reports
 
 ---
 
@@ -352,22 +423,28 @@ networks, and search GEO for similar patterns.
 - **Virtual Screening**: Screen millions of compounds from PubChem/ZINC against protein targets
 - **Lead Optimization**: Analyze structure-activity relationships with RDKit, generate analogs with datamol
 - **ADMET Prediction**: Predict absorption, distribution, metabolism, excretion, and toxicity with DeepChem
-- **Molecular Docking**: Predict binding poses and affinities with DiffDock
+- **Molecular Docking**: Predict binding poses with DiffDock and rescore poses with affinity-oriented tools
 - **Bioactivity Mining**: Query ChEMBL for known inhibitors and analyze SAR patterns
 
 ### 🧬 Bioinformatics & Genomics
 - **Sequence Analysis**: Process DNA/RNA/protein sequences with BioPython and pysam
 - **Single-Cell Analysis**: Analyze 10X Genomics data with Scanpy, identify cell types, infer GRNs with Arboreto
-- **Variant Annotation**: Annotate VCF files with Ensembl VEP, query ClinVar for pathogenicity
+- **Variant Annotation**: Annotate research VCF files with Ensembl VEP and retrieve ClinVar evidence for qualified interpretation
 - **Variant Database Management**: Build scalable VCF databases with TileDB-VCF for incremental sample addition, efficient population-scale queries, and compressed storage of genomic variant data
+- **Population Genomics**: Query variants, cohort sample IDs, and relatedness in the 3,202-person GRCh38 1000 Genomes cohort with OneKGPd
+- **Regulatory Sequence Models**: Run hosted Genomic Intelligence promoter, splice, enhancer, chromatin, expression, and gene-annotation predictions for research—not clinical or diagnostic decisions
+- **Pathogen Surveillance**: Track which viral lineages are circulating now and how fast they are growing (SARS-CoV-2, influenza including H5N1, RSV, mpox, measles, dengue) through the GenSpectrum LAPIS API, with reporting lag measured rather than assumed
 - **Gene Discovery**: Query NCBI Gene, UniProt, and Ensembl for comprehensive gene information
 - **Network Analysis**: Identify protein-protein interactions via STRING, map to pathways (KEGG, Reactome)
 
-### 🏥 Clinical Research & Precision Medicine
-- **Clinical Trials**: Search ClinicalTrials.gov for relevant studies, analyze eligibility criteria
-- **Variant Interpretation**: Annotate variants with ClinVar, COSMIC, and ClinPGx for pharmacogenomics
-- **Drug Safety**: Query FDA databases for adverse events, drug interactions, and recalls
-- **Precision Therapeutics**: Match patient variants to targeted therapies and clinical trials
+### 🏥 Clinical Research & Evidence Workflows
+- **Clinical Trials**: Analyze aggregate trial landscapes and protocol criteria without deciding individual eligibility
+- **Variant Evidence Review**: Annotate authorized research data with ClinVar, COSMIC, and ClinPGx; qualified professionals retain interpretation responsibility
+- **Drug Safety Research**: Query FDA databases for aggregate adverse-event, interaction, and recall evidence
+- **Clinical Pharmacology**: Derive exposure metrics from concentration-time data, fit compartmental and population PK models, relate exposure to effect, and evaluate dosing regimens, bioequivalence, and first-in-human dose
+- **Full-Text Evidence Retrieval**: Search and read papers, regulatory filings, and trial records end to end with Paperclip, returning citations pinned to line numbers rather than to abstracts
+- **Decision-Support Evaluation**: Prepare synthetic or aggregate evaluation, evidence-profile, privacy, and governance artifacts—not live clinical decisions
+- **Clinician-Authored Documentation**: Structure verified source-bound report drafts and format treatment decisions already made by authorized licensed professionals
 
 ### 🔬 Multi-Omics & Systems Biology
 - **Multi-Omics Integration**: Combine RNA-seq, proteomics, and metabolomics data
@@ -379,29 +456,34 @@ networks, and search GEO for similar patterns.
 - **Statistical Analysis**: Perform hypothesis testing, power analysis, and experimental design
 - **Publication Figures**: Create publication-quality visualizations with matplotlib and seaborn
 - **Network Visualization**: Visualize biological networks with NetworkX
-- **Report Generation**: Generate comprehensive reports with the PDF, DOCX, PPTX, XLSX, MarkItDown, LiteParse, and clinical-reporting skills
+- **Report Generation**: Produce evidence-traceable research reports with Scientific Writing and document tools; Clinical Reports outputs remain visibly marked drafts built only from verified synthetic, de-identified, or aggregate source facts
 
 ### 🧪 Laboratory Automation
-- **Protocol Design**: Create Opentrons protocols for automated liquid handling
-- **LIMS Integration**: Integrate with Benchling and LabArchives for data management
-- **Workflow Automation**: Automate multi-step laboratory workflows
+- **Protocol Design**: Author and simulate Opentrons or PyLabRobot protocols before trained-operator review
+- **LIMS/ELN Integration**: Prepare scoped Benchling and LabArchives operations with explicit authorization for remote writes
+- **Workflow Automation**: Validate and simulate multi-step laboratory workflows offline; physical execution stays behind equipment-specific operator safety gates
 
 ---
 
 ## 📚 Available Skills
 
-This repository contains **140 scientific and research skills** organized across multiple domains. Each skill provides comprehensive documentation, code examples, and best practices for working with scientific libraries, databases, and tools.
+This repository contains **163 scientific and research skills** organized across multiple domains. Each skill provides comprehensive documentation, code examples, and best practices for working with scientific libraries, databases, and tools.
 
 ### Skill Categories
 
 > **Note:** The Python package and integration skills listed below are *explicitly defined* skills — curated with documentation, examples, and best practices for stronger, more reliable performance. They are not a ceiling: the agent can install and use *any* Python package or call *any* API, even without a dedicated skill. The skills listed simply make common workflows faster and more dependable.
 
-#### 🧬 **Bioinformatics & Genomics** (21 skills)
+#### 🧬 **Bioinformatics & Genomics** (27 skills)
+- RNA-seq pipelines: Bulk RNA-seq (end-to-end FASTQ -> counts -> DE -> enrichment orchestrator)
 - Sequence analysis: BioPython, pysam, scikit-bio, BioServices
 - Single-cell analysis: Scanpy, AnnData, scvi-tools, scVelo (RNA velocity), Arboreto, Cellxgene Census
-- Genomic tools: gget, geniml, gtars, deepTools, FlowIO, Polars-Bio, Zarr, TileDB-VCF
+- Genomic tools: gget, current geniml/Gtars interval workflows, deepTools, FlowIO, Polars-Bio, Zarr, TileDB-VCF
+- Coordinate hygiene: Genomic Coordinates (convert intervals across BED/GFF/GTF/VCF/SAM/WIG conventions, normalise variant representations, and catch 0-based vs 1-based and assembly/contig-naming mismatches before they corrupt an analysis)
+- Population and sequence intelligence: OneKGPd (individual-level 1000 Genomes cohort queries) and Genomic Intelligence (hosted regulatory/gene-expression predictions; research only)
 - Differential expression: PyDESeq2
+- Functional enrichment: Pathway Enrichment (ORA, GSEA/preranked, ssGSEA via gseapy + g:Profiler; GO, KEGG, Reactome, WikiPathways, MSigDB)
 - Phylogenetics: ETE Toolkit, Phylogenetics (MAFFT, IQ-TREE 2, FastTree)
+- Microbiome foundation models: Waypoint (Outpost Bio's open Waypoint-6m/45m/170m checkpoints, the Atlas 539k-sample MGnify pretraining corpus, and the eight-task Compass benchmark — embedding, fine-tuning, benchmarking, and pretraining on taxonomic abundance profiles, with MetaPhlAn/Kraken2/QIIME 2 conversion)
 
 #### 🧪 **Cheminformatics & Drug Discovery** (10 skills)
 - Molecular manipulation: RDKit, Datamol, Molfeat
@@ -410,29 +492,36 @@ This repository contains **140 scientific and research skills** organized across
 - Molecular dynamics: OpenMM + MDAnalysis (MD simulation & trajectory analysis)
 - Cloud quantum chemistry: Rowan (pKa, docking, cofolding)
 - Drug-likeness: MedChem
-- Benchmarks: PyTDC
+- Benchmarks: PyTDC 1.1.15 on its verified CPython 3.11 compatibility stack
 
 #### 🔬 **Proteomics & Mass Spectrometry** (2 skills)
 - Spectral processing: matchms, pyOpenMS
 
-#### 🏥 **Clinical Research & Precision Medicine** (8 skills)
+#### 🏥 **Clinical Research & Evidence Workflows** (8 skills)
 - Clinical databases: via Database Lookup (ClinicalTrials.gov, ClinVar, ClinPGx, COSMIC, FDA, cBioPortal, Monarch, and more)
+- Clinical pharmacology: PK/PD Modeling (non-compartmental analysis, compartmental and population PK, exposure-response and Emax, TMDD, PBPK orientation, bioequivalence including RSABE/ABEL, allometric scaling and first-in-human dose, DDI prediction under ICH M12, concentration-QTc, and Bayesian therapeutic drug monitoring — stdlib + numpy/scipy, no proprietary estimation software invoked)
 - Cancer genomics: DepMap (cancer dependency scores, drug sensitivity)
 - Cancer imaging: Imaging Data Commons (NCI radiology & pathology datasets via idc-index)
-- Healthcare AI: PyHealth, NeuroKit2, Clinical Decision Support
-- Clinical documentation: Clinical Reports, Treatment Plans
+- Healthcare AI research: PyHealth
+- Decision-support research: local, aggregate or synthetic Clinical Decision Support evaluation and governance artifacts only
+- Clinical documentation: source-bound Clinical Reports drafts and formatting of verified clinician-authored decisions with Treatment Plans; neither skill diagnoses or recommends care
 
-#### 🖼️ **Medical Imaging & Digital Pathology** (3 skills)
-- DICOM processing: pydicom
-- Whole slide imaging: histolab, PathML
+#### 🐭 **Preclinical Research & Animal Welfare** (1 skill)
+- Severity assessment: RELSA Severity Assessment (multivariate RELSA scores from body weight, temperature, clinical/nesting scores, biomarkers, activity, heart rate, burrowing and wheel running; ARIMA humane-endpoint forecasting with 95% prediction intervals; KDE-derived attention and danger zones for 3Rs/refinement and EU Directive 2010/63/EU severity reporting) — an aid to severity assessment, never a decision rule
 
-#### 🧠 **Neuroscience & Electrophysiology** (2 skills)
+#### 🖼️ **Medical Imaging & Digital Pathology** (4 skills)
+- DICOM processing: pydicom 3.0.2 with privacy-first local preflight and no diagnostic or de-identification-compliance claims
+- Whole slide imaging: histolab and research-only PathML 3.0.5
+- Virtual spatial transcriptomics: noncommercial DeepSpot-M for transcriptome-wide spatial gene expression from 224x224 H&E tiles
+
+#### 🧠 **Neuroscience & Electrophysiology** (3 skills)
 - Data standards: BIDS (Brain Imaging Data Structure for neuroscience and biomedical datasets)
 - Neural recordings: Neuropixels-Analysis (extracellular spikes, silicon probes, spike sorting)
+- Physiological signals: NeuroKit2 0.2.13 for reproducible research workflows—not diagnosis, monitoring decisions, or medical-device validation
 
 #### 🤖 **Machine Learning & AI** (14 core skills)
-- Deep learning: PyTorch Lightning, Transformers, Stable Baselines3, PufferLib
-- Classical ML: scikit-learn, scikit-survival, SHAP
+- Deep learning: PyTorch Lightning, Transformers, Stable Baselines3, and version-separated PufferLib 3.0/4.0 workflows
+- Classical ML: scikit-learn, scikit-survival 0.28, and SHAP
 - Time series: aeon, TimesFM (Google's zero-shot foundation model for univariate forecasting)
 - Bayesian methods: PyMC
 - Optimization: PyMOO
@@ -441,88 +530,106 @@ This repository contains **140 scientific and research skills** organized across
 - Statistical modeling: statsmodels
 
 #### 🔮 **Materials Science, Chemistry & Physics** (7 skills)
-- Materials: Pymatgen
+- Materials: current split pymatgen wrapper/core plus explicitly bounded Materials Project queries
 - Metabolic modeling: COBRApy
 - Astronomy: Astropy
-- Quantum computing: Cirq, PennyLane, Qiskit, QuTiP
+- Quantum computing: Cirq, PennyLane, Qiskit, QuTiP 5.3
 
-#### ⚙️ **Engineering & Simulation** (4 skills)
-- Numerical computing: MATLAB/Octave
-- Computational fluid dynamics: FluidSim
-- Discrete-event simulation: SimPy
+#### ⚙️ **Engineering & Simulation** (6 skills)
+- Lab hardware CAD: parametric build123d 0.11.1 models for microfluidic chips and molds, optomechanical mounts, microplate and cuvette adapters, and behavior rigs, checked against ANSI/SLAS and optical-table dimensional standards and reviewed with mandatory multi-view renders
+- Numerical computing: proprietary MATLAB R2026a and distinct GNU Octave 11.3 planning/review workflows
+- Computational fluid dynamics: bounded FluidSim 0.9 simulations with numerical-validity and HPC checks
+- Experimental flow measurement: OpenPIV (velocity fields from PIV image pairs, interrogation-window cross-correlation, spurious-vector validation, vorticity/strain-rate/turbulence statistics)
+- Discrete-event simulation: SimPy 4.1.2 with replication, warm-up, and output-analysis guidance
 - Symbolic math: SymPy
 
-#### 📊 **Data Analysis & Visualization** (19 skills)
+#### 📊 **Data Analysis & Visualization** (22 skills)
 - Visualization: Matplotlib, Seaborn, Scientific Visualization
-- Geospatial analysis: GeoPandas, GeoMaster (remote sensing, GIS, satellite imagery, spatial ML, 500+ examples)
+- Geospatial analysis: GeoPandas 1.1.4 and GeoMaster (remote sensing, GIS, satellite imagery, spatial ML, 500+ examples)
 - Data processing: Dask, Polars, Vaex
 - Network analysis: NetworkX
 - Document processing: LiteParse (local PDF/document parsing with bounding boxes and OCR), MarkItDown, PDF, DOCX, PPTX, and XLSX
 - Infographics: Infographics (AI-powered professional infographic creation)
 - Diagrams: Markdown & Mermaid Writing (text-based diagrams as default documentation standard)
-- Exploratory data analysis: EDA workflows
+- Exploratory data analysis: bounded local EDA for explicitly supported formats, with unknown formats failing closed
 - Statistical analysis: Statistical Analysis workflows
+- Units and measurement uncertainty: Uncertainty & Units (pint dimensional checking, GUM uncertainty budgets, Type A/B evaluation, coverage factors and expanded uncertainty, Monte Carlo propagation, CODATA constants)
+- Experimental design: Experimental Design (randomization, blocking, factorial/fractional-factorial DOE, crossover, cluster, sequential designs; pyDOE3)
+- Statistical power: Statistical Power (sample-size & power for t-tests, ANOVA, proportions, correlation, regression — closed-form plus simulation-based for GLMs, mixed models, and cluster designs)
 
 #### 🧪 **Laboratory Automation** (6 skills)
-- Liquid handling: PyLabRobot and Opentrons
-- Cloud lab: Ginkgo Cloud Lab (cell-free protein expression, fluorescent pixel art via autonomous RAC infrastructure)
-- Protocol management: Protocols.io
-- LIMS integration: Benchling, LabArchives
+- Liquid handling: offline-first PyLabRobot planning/simulation and Opentrons authoring, with physical execution behind explicit operator safety gates
+- Cloud lab: Ginkgo Cloud Lab (protein expression & purification across cell-free/E. coli/Pichia, IVT RNA synthesis, thermal shift and Echo-MS assays, SPR onboarding, fluorescent pixel art via autonomous RAC infrastructure)
+- Protocol management: bounded protocols.io reads across documented v3/v4 endpoints and non-executing write plans
+- LIMS/ELN integration: Benchling and the separate LabArchives legacy ELN and Inventory v1 APIs
 
-#### 🔬 **Multi-omics & Systems Biology** (4 skills)
+#### 🔬 **Multi-omics & Systems Biology** (3 skills)
 - Pathway analysis: via Database Lookup (KEGG, Reactome, STRING) and PrimeKG
-- Multi-omics: HypoGeniC
 - Data management: LaminDB
 
-#### 🧬 **Protein Engineering & Design** (3 skills)
+#### 🧬 **Protein Engineering & Design** (4 skills)
 - Protein language models: ESM
 - Glycoengineering: Glycoengineering (N/O-glycosylation prediction, therapeutic antibody optimization)
 - Cloud laboratory platform: Adaptyv (automated protein testing and validation)
+- Cloud structure & design platform: Tamarind (managed-GPU access to AlphaFold, Boltz, Chai, ESMFold, RFdiffusion, ProteinMPNN, BoltzGen, antibody/nanobody design, DiffDock/Vina docking, binding affinity, and MSA generation via REST API or MCP)
 
 #### 📚 **Scientific Communication** (27 skills)
 - Literature: Paper Lookup (PubMed, PMC, bioRxiv, medRxiv, arXiv, OpenAlex, Crossref, Semantic Scholar, CORE, Unpaywall), Literature Review, Paperzilla
+- Full-text corpus access: Paperclip (read-only virtual filesystem over ~11M full-text papers, 217K+ FDA/PMDA/EMA regulatory documents, clinical trial registries, and UniProt/PDB/ChEMBL entries — source-scoped semantic search, corpus-wide grep, SQL metadata queries, map/reduce reading across many papers, figure vision analysis, and line-pinned citations)
 - Advanced paper search: BGPT Paper Search (25+ structured fields per paper — methods, results, sample sizes, quality scores — from full text, not just abstracts)
-- Web search: Parallel Web, Exa Search, and Research Lookup
+- Web intelligence: Parallel Web (web search, URL/PDF extraction, deep research, structured enrichment, entity discovery, and recurring monitoring), Exa Search, and Research Lookup
 - Research notebooks: Open Notebook (self-hosted NotebookLM alternative — PDFs, videos, audio, web pages; 16+ AI providers; multi-speaker podcast generation)
-- Writing: Scientific Writing, Peer Review
+- Writing: evidence-traceable Scientific Writing and local, confidential, authorized Peer Review
 - Document processing: LiteParse, PDF, DOCX, PPTX, XLSX, and MarkItDown
-- Publishing and paper workflows: Venue Templates, PACSOMATIC
-- Presentations: Scientific Slides, LaTeX Posters, PPTX Posters
+- Publishing and paper workflows: Venue Templates
+- Presentations: Scientific Slides, LaTeX Posters, and macro-free PPTX Posters generated from author-approved local manifests
 - Diagrams: Scientific Schematics, Markdown & Mermaid Writing
 - Infographics: Infographics (10 types, 8 styles, colorblind-safe palettes)
 - Citations: Citation Management, pyzotero
-- Illustration: Generate Image (AI image generation with FLUX.2 Pro and Gemini 3 Pro (Nano Banana Pro))
+- Illustration: Generate Image (AI image generation with FLUX.2 Pro and Gemini 3.1 Flash Image / Nano Banana 2)
 
-#### 🔬 **Scientific Databases & Data Access** (6 skills → 100+ databases total)
-> A unified database-lookup skill provides direct REST API access to 78 public databases across all domains. Dedicated skills cover specialized data platforms. Multi-database packages like BioServices (~40 bioinformatics services), BioPython (38 NCBI sub-databases via Entrez), and gget (20+ genomics databases) add further coverage.
-- Unified access: Database Lookup (78 databases spanning chemistry, genomics, clinical, pathways, patents, economics, and more — PubChem, ChEMBL, UniProt, PDB, AlphaFold, KEGG, Reactome, STRING, ClinVar, COSMIC, ClinicalTrials.gov, FDA, FRED, USPTO, SEC EDGAR, and dozens more)
+#### 🔬 **Scientific Databases & Data Access** (11 skills → 100+ databases total)
+> A unified database-lookup skill provides deterministic REST API access to 78 public databases across all domains, with retrieval contracts, pagination/count reconciliation, and endpoint provenance. Dedicated skills cover specialized data platforms. Multi-database packages like BioServices (~40 bioinformatics services), BioPython (39 NCBI sub-databases via Entrez), and gget (20+ genomics databases) add further coverage.
+- Unified access: Database Lookup (78 databases spanning chemistry, genomics, clinical, pathways, patents, economics, and more — PubChem, ChEMBL, UniProt, PDB, AlphaFold, KEGG, Reactome, STRING, ClinVar, COSMIC, ClinicalTrials.gov, FDA, FRED, USPTO, SEC EDGAR, and dozens more — with auditable filters and provenance)
 - Cancer genomics: DepMap (cancer cell line dependencies, drug sensitivity, gene effect profiles)
 - Cancer imaging: Imaging Data Commons (NCI radiology & pathology datasets via idc-index)
 - Knowledge graph: PrimeKG (precision medicine knowledge graph — genes, drugs, diseases, phenotypes)
+- Biomedical knowledge graph search: [NCATS ARAX](skills/ncats-arax/) (bounded, Biolink-constrained one-hop and endpoint-pinned two-hop queries over knowledge graphs with up to five explicitly selected NCATS Translator providers, with provenance preservation)
 - Fiscal data: U.S. Treasury Fiscal Data (national debt, Treasury statements, auctions, exchange rates)
 - Scientific ML resource catalog: Hugging Science (curated index of datasets, models, blog posts, and interactive Spaces across 17 scientific domains — astronomy, biology, chemistry, climate, genomics, materials science, medicine, physics, scientific reasoning, and more — with usage patterns for `datasets`, `transformers`, and `gradio_client`)
+- Individual-level population genomics: OneKGPd (3,202-person high-coverage 1000 Genomes cohort queries)
+- Hosted regulatory genomics: Genomic Intelligence (promoter, splice, enhancer, chromatin, expression, and gene-annotation predictions for research use)
+- Ontology identifiers: Ontology Term Resolution (resolve free-text tissue, cell-type, disease, phenotype, assay, chemical, organism, and developmental-stage labels to term IDs and validate CURIEs against EBI OLS4, for GEO/ENA/BioSamples/CELLxGENE/HCA/ISA-Tab metadata)
+- Live pathogen surveillance: Pathogen Variant Surveillance (which viral lineages are circulating now, how fast they are growing, and what mutations they carry — SARS-CoV-2, influenza including H5N1, RSV, mpox, measles, dengue and more through the GenSpectrum LAPIS API, with lineage names resolved against the live pango-designation nomenclature and reporting lag measured rather than assumed)
 
-#### 🔧 **Infrastructure & Platforms** (8 skills)
+#### 🔧 **Infrastructure & Platforms** (11 skills)
 - Cloud compute: Modal
 - GPU acceleration: Optimize for GPU (CuPy, Numba CUDA, Warp, cuDF, cuML, cuGraph, KvikIO, cuCIM, cuxfilter, cuVS, cuSpatial, RAFT)
 - Genomics platforms: DNAnexus, LatchBio
+- Workflow engines: Nextflow (build/run/debug Nextflow & nf-core pipelines — DSL2 modules, executors/containers, HPC/cloud scaling) and pacsomatic (operator toolkit for the nf-core/pacsomatic tumor-normal somatic variant-calling workflow)
 - Microscopy: OMERO
 - Automation: Opentrons
-- Resource detection: Get Available Resources
+- Resource detection: Get Available Resources on request or before a clearly resource-sensitive local workload; redacted and without stress tests
 - Workflow mining: Autoskill (local screenpipe-based repeated workflow detection and skill drafting)
+- Agent platform development: Pi Agent (using Pi as a terminal coding harness and building on it with SDK, RPC/JSONL, extensions, custom providers/models, packages, TUI components, and session tooling)
 
-#### 🎓 **Research Methodology & Planning** (11 skills)
-- Ideation: Scientific Brainstorming, Hypothesis Generation
-- Critical analysis: Scientific Critical Thinking, Scholar Evaluation
+#### 🎓 **Research Methodology & Planning** (13 skills)
+- Ideation: evidence-aware Scientific Brainstorming and non-scoring Hypothesis Generation that keeps hypotheses labeled as candidates
+- Text-dataset hypothesis software: HypoGeniC/HypoRefine produces candidate textual patterns and task-prediction statistics, not validated scientific hypotheses
+- Autonomous optimization: Arbor (Hypothesis Tree Refinement — iteratively improve a code/model/agent-harness/data artifact against a dev evaluator while a held-out test gate guards against overfitting)
+- Critical analysis: Scientific Critical Thinking and qualitative, low-stakes Scholar Evaluation of works—never ranking people or supporting consequential decisions
 - Scenario analysis: What-If Oracle (4–6 branch possibility exploration, contingency planning, decision stress-testing)
 - Multi-perspective deliberation: Consciousness Council (diverse expert viewpoints, devil's advocate analysis)
 - Cognitive profiling: DHDNA Profiler (extract thinking patterns and cognitive signatures from any text)
 - Funding: Research Grants
 - Discovery: Research Lookup, Paper Lookup (10 academic databases)
-- Market analysis: Market Research Reports
+- Market analysis: evidence-traceable Market Research Reports with assumption-led sizing and forecast sensitivity
 
-#### ⚖️ **Regulatory & Standards** (1 skill)
-- Medical device standards: ISO 13485 Certification
+#### ⚖️ **Regulatory & Standards** (2 skills)
+- Standards readiness: draft evidence-preparation artifacts for ISO 13485 (medical device QMS), ISO 14971 (device risk management), ISO/IEC 17025 (testing and calibration laboratories), and ISO 15189 (medical laboratories), with per-standard process domains selected by a `--standard` profile
+- Analytical method validation: plan, evaluate, and document validation, verification, and transfer of analytical procedures (HPLC, LC-MS/MS, GC, CE, ICP-MS, dissolution, qNMR, qPCR, NIR, ligand-binding and cell-based assays) under whichever framework governs — ICH Q2(R2)/Q14 and ICH M10 encoded from their openly licensed text, with USP `<1220>`/`<1225>`/`<1226>`, the CLSI EP series, and ISO/IEC 17025 cited by designation and scope only; stdlib-only statistics, no network access
+- Assurance-lane separation: keeps ISO certification, laboratory accreditation, FDA QMSR inspection, CLIA certification, MDSAP, and EU MDR/IVDR evidence boundaries distinct—laboratories are accredited rather than certified, and ISO 15189 accreditation does not satisfy CLIA
+- Never a compliance, audit, assessment, certification, accreditation, or method-release decision; qualified RA/QA, legal, laboratory-director, assessor, and certification-body review is required
 
 > 📖 **For complete details on all skills**, see [docs/skills.md](docs/skills.md)
 
@@ -530,6 +637,51 @@ This repository contains **140 scientific and research skills** organized across
 
 ---
 
+## 📝 From the Blog
+
+Deep dives, benchmarks, and guides from the [K-Dense blog](https://www.k-dense.ai/blog) that are directly relevant to using the skills in this repository.
+
+### Start here
+
+- **[Agent Skills: The Final Piece for AI-Powered Scientific Research](https://www.k-dense.ai/blog/agent-skills-final-piece-for-ai-powered-research)** — What Agent Skills are, why curated domain guidance beats raw model capability, and an introduction to this repository.
+- **[K-Dense Web vs Scientific Agent Skills: Why We Built Both (And Which One You Should Use)](https://www.k-dense.ai/blog/k-dense-web-vs-scientific-agent-skills)** — When the open-source skills are the right tool, and when a hosted platform with managed compute makes more sense.
+- **[AI Co-Scientists, Answered: 20 Questions from a Live Session with a University Research Center](https://www.k-dense.ai/blog/ai-co-scientists-answered-20-questions)** — Practical questions from a research center evaluating AI co-scientists: what stays open source and MIT-licensed, how local and desktop deployments work, how data is handled, and how to choose between the hosted platform and the BYOK setup that runs these skills.
+- **[How to Use Multica for Scientific Research](https://www.k-dense.ai/blog/multica-scientific-research)** — A self-hosted Multica workspace plus a curated subset of these skills: clinical-trial and variant analyses, literature review, weekly autopilots, and a second-model audit, with each skill imported from `skills/<name>/`.
+
+### Skill benchmarks and deep dives
+
+- **[The Silent 97%: Introducing the waypoint-bio Agent Skill](https://www.k-dense.ai/blog/introducing-waypoint-agent-skill)** — [waypoint-bio](skills/waypoint-bio/) against silent data loss: an unconverted MetaPhlAn table keeps 3% of abundance mass and still returns a valid embedding; skill-equipped agents won 16 to 0 on matched pairs.
+- **[The Millimetre Problem: Introducing the lab-hardware-cad Agent Skill](https://www.k-dense.ai/blog/lab-hardware-cad-skill)** — [lab-hardware-cad](skills/lab-hardware-cad/) over 98 geometry-scored runs: the skill arm produced parametric, regenerable models in 49 of 49 cases (baseline 0 of 49) and named the missing Y-maze standard instead of inventing one.
+- **[One Skill, 78 Databases: Why We Didn't Build 78 Skills](https://www.k-dense.ai/blog/database-lookup-one-skill-78-databases)** — The design rationale behind [database-lookup](skills/database-lookup/): consolidation cut always-on context cost by 13.9x while holding routing accuracy across five models.
+- **[Can an AI Agent Run Your Mass Spec Pipeline? Benchmarking the PyOpenMS Skill](https://www.k-dense.ai/blog/benchmarking-pyopenms-skill-mass-spectrometry)** — A 250-run study of [pyopenms](skills/pyopenms/): 100% task success with the skill versus 96% without, 92% fewer pyOpenMS API errors, and 10% lower cost.
+- **[Beyond RDKit: Benchmarking the Rowan Agent Skill Against Experiment](https://www.k-dense.ai/blog/benchmarking-rowan-skill-chemistry)** — [rowan](skills/rowan/) compared against RDKit and experimental data: pKa MAE 0.23 (R² 0.986), logD₇.₄ MAE 1.15, and 0.19 Å RMSD docking pose recovery for roughly $0.52 of compute.
+- **[GPU-Accelerate Your Science: 58x Average Speedup with a Single Skill](https://www.k-dense.ai/blog/optimize-for-gpu-skill)** — [optimize-for-gpu](skills/optimize-for-gpu/) rewriting CPU-bound Python across 12 libraries, with speedups ranging from 1.7x to 492x.
+- **[Towards Smarter Scientific Search: Exa Joins the Scientific Agent Skills Library](https://www.k-dense.ai/blog/towards-smarter-scientific-search-exa-scientific-agent-skills)** — What [exa-search](skills/exa-search/) adds: neural semantic search and URL extraction tuned for scholarly discovery instead of keyword matching.
+- **[Benchmarking Nano Banana 2 Lite for Scientific Image Generation](https://www.k-dense.ai/blog/benchmarking-nano-banana-2-lite-scientific-image-model)** — A 240-image comparison of scientific-diagram models, useful when choosing a backend for [generate-image](skills/generate-image/): 3.8 s median latency for Nano Banana 2 Lite against 49 s for GPT Image 2, with a quality tradeoff.
+- **[Benchmarking NVIDIA BioNeMo Agent Toolkit Skills for NIM microservices](https://www.k-dense.ai/blog/benchmarking-nvidia-bionemo-nim-skill)** — A separate NVIDIA skill set rather than one of these, but the findings generalize: skills help most with routing to non-obvious endpoints and with weak-model reliability, and do not improve the underlying scientific model's accuracy.
+
+### Why the workflow layer matters
+
+- **[The Model Is No Longer the Bottleneck](https://www.k-dense.ai/blog/the-model-is-no-longer-the-bottleneck)** — The case for why a repository like this one exists: frontier models now match specialized scientific software on raw capability (±0.079 ppm on NMR hydrogen shift prediction), so the limiting factor has moved to the workflow around the model — data access, code execution, verification, and auditable output.
+- **[The AI Co-Scientist Is Here. The Bottleneck Is Verification.](https://www.k-dense.ai/blog/ai-co-scientist-verification-bottleneck)** — A 10-point checklist for evaluating a research agent, built around exposing sources, code, data provenance, and intermediate work rather than a polished final answer — the same reasoning behind the provenance and retrieval-contract requirements in skills like [database-lookup](skills/database-lookup/) and [scientific-writing](skills/scientific-writing/).
+- **[Reproduction, Not Generation, Is AI's Killer App for Science](https://www.k-dense.ai/blog/reproduction-not-generation-ai-for-science)** — Why re-running published analyses is the highest-value use of an agent: 78% of papers and 93% of individual analysis tasks reproduced across a 221-study benchmark, because a reproduction can be checked against known numbers while a generated claim cannot.
+- **[Introducing K-Bench 01: Nine Frontier Models, 178 Real Scientific Tasks, and a Lot of Confident Wrong Answers](https://www.k-dense.ai/blog/introducing-k-bench-01-internal-benchmark)** — Nine frontier models on 178 real user tasks, with overclaiming in 40% of runs. Useful calibration for what to check when an agent reports success, and context for the verification boundaries written into the clinical, regulatory, and research-methodology skills above.
+
+### Security and safe deployment
+
+- **[Security in the Science Agent Era: What Every Lab Needs to Know Before Installing Skills](https://www.k-dense.ai/blog/skill-security-before-you-install)** — The practical review checklist behind this repo's [Security Disclaimer](#%EF%B8%8F-security-disclaimer): read the full `SKILL.md` and `scripts/`, scan before installing, and pin versions instead of tracking a branch.
+- **[The Sandboxed AI Scientist: Pairing NVIDIA OpenShell with Scientific Agent Skills](https://www.k-dense.ai/blog/sandboxed-ai-scientist-openshell-skills)** — Running these skills inside a policy-governed sandbox; see also the NemoClaw note in [Getting Started](#-getting-started).
+
+### Complementary open-source projects
+
+- **[Introducing Science Superpowers: Scientific Discipline for Your Research Agent](https://www.k-dense.ai/blog/introducing-science-superpowers)** — Hypothesis pre-registration, reproducible workflows, and verification-before-claims that wrap around these skills to guard against p-hacking and HARKing.
+- **[Your AI Assistant Reasons Like a Generalist. Science Needs a Specialist.](https://www.k-dense.ai/blog/introducing-scientific-agents)** — 503 open-source `AGENTS.md` profiles supplying the "how to think" layer alongside the "what to do" procedures in these skills.
+- **[Introducing mimeo and 80+ Mimeographs](https://www.k-dense.ai/blog/introducing-mimeo-and-mimeographs)** — Generate your own `SKILL.md` / `AGENTS.md` expert profiles by distilling how a given practitioner reasons.
+- **[Agentic Data Scientist: An Open Source AI That Actually Does the Analysis](https://www.k-dense.ai/blog/agentic-data-scientist-open-source)** — A multi-agent planning, execution, and validation harness that loads these skills for end-to-end data-science workflows.
+- **[Karpathy: An Open Source Agentic Machine Learning Engineer](https://www.k-dense.ai/blog/karpathy-agentic-ml-engineer)** — An autonomous ML-training agent built to consume Scientific Agent Skills for preprocessing through hyperparameter search.
+
+---
+
 ## 🤝 Contributing
 
 We welcome contributions to expand and improve this scientific skills repository!
@@ -558,7 +710,7 @@ For detailed instructions on adding or updating a skill, see [CONTRIBUTING.md](C
 2. **Create** a feature branch (`git checkout -b feature/amazing-skill`)
 3. **Follow** [CONTRIBUTING.md](CONTRIBUTING.md) and the existing directory structure
 4. **Ensure** all new skills include valid `SKILL.md` files with required frontmatter and `metadata.version`
-5. **Test** your examples and workflows thoroughly
+5. **Test** your examples and workflows thoroughly, and add a suite under `tests/<skill-name>/` if your skill ships `scripts/`
 6. **Commit** your changes (`git commit -m 'Add amazing skill'`)
 7. **Push** to your branch (`git push origin feature/amazing-skill`)
 8. **Submit** a pull request with a clear description of your changes
@@ -575,6 +727,23 @@ For detailed instructions on adding or updating a skill, see [CONTRIBUTING.md](C
 ✅ Provide clear comments and docstrings in code  
 ✅ Include references to official documentation
 
+### Testing
+
+Every skill that ships `scripts/` must have a test suite under `tests/<skill-name>/` and an entry in `tests/skill-requirements.toml`. This is enforced — `tests/_meta` fails a pull request that adds bundled tooling without one, and it also runs a repo-wide structural contract over all skills (frontmatter conformance, `SKILL.md` length, local links resolving, scripts parsing, no shipped bytecode, no hardcoded local paths, `--help` behavior).
+
+```bash
+# Structural contract and coverage guard — seconds, no scientific packages needed
+uv run python -m pytest tests/_meta -q
+
+# One skill's suite
+uv run --with pytest python -m pytest tests/<skill-name> -q
+
+# Every suite, each in its own throwaway environment
+uv run python tests/run_all.py --isolated
+```
+
+The [Skill Tests](https://github.com/K-Dense-AI/scientific-agent-skills/actions/workflows/skill-tests.yml) workflow runs the contract plus the standard-library-only suites on every pull request; the full `--isolated` sweep builds ~100 environments and is run locally or on a schedule.
+
 ### Security Scanning
 
 All skills in this repository are security-scanned using [Cisco AI Defense Skill Scanner](https://github.com/cisco-ai-defense/skill-scanner), an open-source tool that detects prompt injection, data exfiltration, and malicious code patterns in Agent Skills.
@@ -656,7 +825,7 @@ A: No. Each skill has its own license specified in the `license` metadata field
 A: We regularly update skills to reflect the latest versions of packages and APIs. Major updates are announced in release notes.
 
 **Q: Can I use this with other AI models?**  
-A: The skills follow the open [Agent Skills](https://agentskills.io/) standard and work with any compatible agent, including Cursor, Claude Code, Codex, and Google Antigravity.
+A: The core `SKILL.md` format follows the open [Agent Skills](https://agentskills.io/) standard. Installation paths, discovery, and optional metadata support vary by host and version, so confirm your target host's current documentation.
 
 ### Installation & Setup
 
@@ -686,51 +855,72 @@ Need help? Here's how to get support:
 - 📖 **Documentation**: Check the relevant `SKILL.md` and `references/` folders
 - 🐛 **Bug Reports**: [Open an issue](https://github.com/K-Dense-AI/scientific-agent-skills/issues)
 - 💡 **Feature Requests**: [Submit a feature request](https://github.com/K-Dense-AI/scientific-agent-skills/issues/new)
-- 📣 **Updates and demos**: Follow [X](https://x.com/k_dense_ai), [LinkedIn](https://www.linkedin.com/company/k-dense-inc), and [YouTube](https://www.youtube.com/@K-Dense-Inc) to keep up with new skills, tutorials, and Scientific Agent Skills releases
+- 📣 **Updates and demos**: Follow [X](https://x.com/k_dense_ai), [LinkedIn](https://www.linkedin.com/company/k-dense-inc), [YouTube](https://www.youtube.com/@K-Dense-Inc), and [Reddit](https://www.reddit.com/user/-k-dense-/) to keep up with new skills, tutorials, and Scientific Agent Skills releases
 - 💼 **Enterprise Support**: Contact [K-Dense](https://k-dense.ai/) for commercial support
 
 ---
 
 ## 📖 Citation
 
-If you use Scientific Agent Skills in your research or project, please cite the overall collection and, when relevant, the individual skill or skills that materially supported your work.
+If you use Scientific Agent Skills in your research or project, please cite our paper:
 
-The collection citation helps others find the repository, understand the broader skill ecosystem used in your workflow, and credit the maintenance effort behind Scientific Agent Skills. Individual skill citations give more precise credit for the specific package, database, or workflow guidance your agent used.
+> Timothy Kassis, Vinayak Agarwal, Yuhuan He, Darshil Patel, and Aubrey M. Brueckner. **Scientific Agent Skills: A Library of Procedural Knowledge for Research Agents.** arXiv:2609.00065, 2026. [https://arxiv.org/abs/2609.00065](https://arxiv.org/abs/2609.00065)
+
+When relevant, also cite the individual skill or skills that materially supported your work.
+
+GitHub's **Cite this repository** button, backed by [`CITATION.cff`](CITATION.cff), produces the same paper citation in APA or BibTeX.
+
+The paper citation helps others find the repository, understand the broader skill ecosystem used in your workflow, and credit the maintenance effort behind Scientific Agent Skills. Individual skill citations give more precise credit for the specific package, database, or workflow guidance your agent used.
 
 Recommended practice:
-- Always cite **Scientific Agent Skills** using one of the formats below.
+- Always cite the **Scientific Agent Skills paper** using one of the formats below.
 - Also cite each individual skill that directly contributed to your analysis, code, figures, reports, or research workflow.
 - If a skill wraps or documents an external package, database, or platform, cite that upstream project too when your field's norms require it.
 
-### Collection Citation
+### Paper Citation
 
 #### BibTeX
+```bibtex
+@misc{kassis2026scientificagentskills,
+  title         = {Scientific Agent Skills: A Library of Procedural Knowledge for Research Agents},
+  author        = {Kassis, Timothy and Agarwal, Vinayak and He, Yuhuan and Patel, Darshil and Brueckner, Aubrey M.},
+  year          = {2026},
+  eprint        = {2609.00065},
+  archivePrefix = {arXiv},
+  primaryClass  = {cs.CL},
+  url           = {https://arxiv.org/abs/2609.00065}
+}
+```
+
+#### APA
+```
+Kassis, T., Agarwal, V., He, Y., Patel, D., & Brueckner, A. M. (2026). Scientific Agent Skills: A library of procedural knowledge for research agents. arXiv. https://arxiv.org/abs/2609.00065
+```
+
+#### MLA
+```
+Kassis, Timothy, et al. "Scientific Agent Skills: A Library of Procedural Knowledge for Research Agents." arXiv, 2026, arxiv.org/abs/2609.00065.
+```
+
+#### Plain Text
+```
+Kassis, T., Agarwal, V., He, Y., Patel, D., & Brueckner, A. M. (2026). Scientific Agent Skills: A Library of Procedural Knowledge for Research Agents. arXiv:2609.00065. https://arxiv.org/abs/2609.00065
+```
+
+### Software Citation
+
+If you also need to cite a specific version of the repository itself (for example, to pin the exact skill set an analysis ran against), add a software citation alongside the paper and record the release tag or commit you used:
+
 ```bibtex
 @software{scientific_agent_skills_2026,
   author = {{K-Dense Inc.}},
   title = {Scientific Agent Skills: A Comprehensive Collection of Scientific Tools for AI Agents},
   year = {2026},
   url = {https://github.com/K-Dense-AI/scientific-agent-skills},
-  note = {140 skills covering databases, packages, integrations, and analysis tools}
+  note = {163 skills covering databases, packages, integrations, and analysis tools}
 }
 ```
 
-#### APA
-```
-K-Dense Inc. (2026). Scientific Agent Skills: A comprehensive collection of scientific tools for AI agents [Computer software]. https://github.com/K-Dense-AI/scientific-agent-skills
-```
-
-#### MLA
-```
-K-Dense Inc. Scientific Agent Skills: A Comprehensive Collection of Scientific Tools for AI Agents. 2026, github.com/K-Dense-AI/scientific-agent-skills.
-```
-
-#### Plain Text
-```
-Scientific Agent Skills by K-Dense Inc. (2026)
-Available at: https://github.com/K-Dense-AI/scientific-agent-skills
-```
-
 ### Individual Skill Citation
 
 When citing a specific skill, include the skill name, version from `metadata.version` in that skill's `SKILL.md`, and the direct skill URL. For example: