[Knapp-Kevin]

Scope and exact source

Bounded issue-first #566 source vetting of the nine first-class plugins/game-studio/skills/*/SKILL.md packages at registered openai/plugins revision 0722921d5542fc593105c27bd52630babd8b8c2a, plugin tree b20ed7187bf5633b8b18ee9c7780e69eb68686e4, manifest version 0.1.2.

9/9 terminal decisions: 7 REFERENCE-ONLY / 2 REJECT unchanged (game-playtest, sprite-pipeline). No source admission, package vendoring, source pin, scanner, runtime or behavioral validation. Manifest labels MIT, but controlling root/plugin license text is absent; redistribution remains NOASSERTION.

Macro findings

• Coherent 2D Phaser, vanilla Three.js and React Three Fiber routing; simulation/render separation; low-chrome DOM HUD and playfield protection; glTF shipping; screenshot-backed QA.
• Unscoped browser boot/screenshots risk production side effects and sensitive capture. Sprite imagegen sends seed art externally; source-owned Pillow helpers write/overwrite output without a gate.
• Nine distinct exact package trees; 16 shared references, 3 Python helpers and 2 assets are dependencies, not extra skills or repository-owned runtime. All nine SKILL.md paths last changed at d965fdc57d1f872f52bcdb10c9e1cbf922a8a761 on 2026-03-16.

Public accounting and hygiene

Six files changed: one dated nine-skill macro receipt plus all five public accounting surfaces reconciled in a single commit. README and INDEX recent-candidate prose consolidated to reduce duplication; historical details remain in CURATION_QUEUE and dated receipts.

44 first-party / 995 persisted third-party (874 registered/tracked + 121 candidate-only) / 1,039 total matching pairs / 23 registered sources / 12 pinned corpora, all unchanged. Admitted denominator delta 0; semantic pairs delta 0; discovery candidates resolved +9.

Lifecycle

All eight prior open issues and five draft PRs triaged before this tranche. #489/#492/#496 remain held on complete pinned SkillSpector v2.12.0 exact-tree security reports and independent executed adversarial acceptance for 36 distinct first-party repairs, plus shared registry reconciliation. #412/#413 have separate admission gates. No existing PR is merge-ready.

See macro receipt. No CI triggered; commit messages use [skip ci].