docs: list new skills and add external-skill vetting note

README.md

@@ -71,6 +71,27 @@ than assuming the delegate can fetch it itself.
   actual (profane) tone -- deliberately not installed here; see
   [Mte90/linus-torvalds-skill](https://github.com/Mte90/linus-torvalds-skill)
   directly if that's ever wanted instead.
+- `code-review` -- two-axis review (Standards + Spec) of a diff against a
+  fixed point, run as parallel sub-agents so neither axis masks the other.
+- `codebase-design` -- shared vocabulary for designing deep modules
+  (interface, seam, depth, adapter, leverage, locality) and applying the
+  deletion test.
+- `diagnosing-bugs` -- disciplined loop for hard bugs and regressions:
+  build a tight feedback loop, reproduce, minimise, hypothesise,
+  instrument, fix, then post-mortem.
+- `full-output-enforcement` -- override default LLM truncation; ban
+  placeholder comments and partial outputs, and handle long outputs
+  cleanly.
+- `handoff` -- compact the current conversation into a portable document
+  so another agent can continue the work.
+- `redesign-existing-projects` -- audit an existing UI for generic AI
+  patterns, then upgrade it piece by piece without rewriting the stack.
+- `research` -- delegate reading legwork to a background agent against
+  primary sources, and capture cited findings as a Markdown file.
+- `resolving-merge-conflicts` -- resolve an in-progress git merge or
+  rebase conflict by tracing each side's intent; never `--abort`.
+- `tdd` -- red-green-refactor test-driven development, one vertical slice
+  at a time, at pre-agreed seams.
 
 ## Provenance
 
@@ -82,6 +103,21 @@ each skill's frontmatter:
 - [SuperClaude-Org/SuperClaude](https://github.com/SuperClaude-Org/SuperClaude_Framework) (MIT)
 - andrej-karpathy-skills (MIT)
 - [Mte90/linus-torvalds-skill](https://github.com/Mte90/linus-torvalds-skill) (CC0-1.0)
+- [mattpocock/skills](https://github.com/mattpocock/skills) (MIT)
+- [Leonxlnx/taste-skill](https://github.com/Leonxlnx/taste-skill) (MIT)
+
+## Vetting external skills
+
+Before installing a skill from an external repo, run NVIDIA
+[SkillSpector](https://github.com/NVIDIA/SkillSpector) against it with
+`--no-llm` (static analysis is enough for text-only skills) and review the
+report. A score of `SAFE` with no plausible issues is the default bar; if
+it reports `CAUTION`, inspect each finding manually -- most are false
+positives for skill content, but treat any that touch executable scripts,
+credential handling, or hidden instruction leakage seriously. Re-run the
+scanner on the adapted `SKILL.md` after trimming upstream-only files
+(templates, plugin metadata, sibling docs) so the result reflects what
+will actually live in this repo.
 
 ## Adding a new skill