typo update

PLUGINS/ClaudeCode/skills/asp-alert-en/SKILL.md

@@ -31,6 +31,8 @@ An alert is secondary data in ASP. Each alert belongs to a case, and each alert
 - If the user is working on a specific alert, prefer `list_alerts(alert_id=<id>, limit=1)` because the current MCP surface does not expose a separate `get_alert` tool.
 - If the user wants to save structured analysis back onto the alert, use the `asp-enrichment-en` skill.
 
+Note: alerts only support `severity_ai`, `confidence_ai`, and `comment_ai` updates; verdict and summary fields belong to case updates.
+
 ## Additional Information
 
 - `rowid` is the UUID for each alert record and is used for data association.

PLUGINS/ClaudeCode/skills/asp-artifact-en/SKILL.md

@@ -15,7 +15,7 @@ metadata:
 # ASP Artifact
 
 Use this skill when the user needs to investigate artifacts on ASP.
-An artifact is the third-level data in ASP. Each artifact is attached under one alert and is the smallest data unit that still needs investigation.
+Artifacts are created automatically by system processes. You can list and analyze existing artifacts, and save analysis back through enrichment.
 
 ## When to Use
 

PLUGINS/ClaudeCode/skills/asp-artifact-zh/SKILL.md

@@ -15,7 +15,7 @@ metadata:
 # ASP Artifact
 
 当用户要围绕 artifact 进行调查分析时，使用这个 skill。
-artifact 是 ASP 中的三级数据,每个 artifact 都挂载在一个 alert 下,是最小的需要调查的数据单元。
+artifact 由系统自动创建，用户只能查询和分析已有 artifact，并通过 enrichment 保存分析结果。
 
 ## 适用场景
 

PLUGINS/ClaudeCode/skills/asp-enrichment-zh/SKILL.md

@@ -44,6 +44,8 @@ metadata:
 3. 如果用户已经有现成的 enrichment rowid，跳过创建，直接附加。
 4. 如果用户还处于对象探索阶段而不是保存结果，先使用对应对象 skill。
 
+当你已经有明确的分析结论，例如 verdict、TTP 集合、风险评级或缓解建议，并且这些内容需要保存在目标对象上时，就切换到这个 skill。
+
 ## SOP
 
 ### 创建并附加新的 Enrichment

PLUGINS/ClaudeCode/skills/asp-knowledge-en/SKILL.md

@@ -48,6 +48,8 @@ ASP internal Knowledge is stored as individual database records. The main fields
 - When the user says to "add to the knowledge base" or "make it retrievable", interpret that as setting `action` to `Store`, not editing `using` directly.
 - When the user says to "remove from the knowledge base" or "stop using it for retrieval", interpret that as setting `action` to `Remove`.
 
+Note: `action=Store` and `action=Remove` are handled asynchronously by the backend, so the retrievability state may lag behind the update.
+
 ## Decision Flow
 
 1. If the user wants to search vectorized knowledge content for relevant conclusions, experience, or historical knowledge, use `search_knowledge`.

PLUGINS/ClaudeCode/skills/asp-knowledge-zh/SKILL.md

@@ -48,6 +48,8 @@ ASP 的内部 Knowledge 本质上是一条一条数据库记录，核心字段
 - 当用户说“加入知识库”或“让它可被检索”时，通常应理解为把 `action` 设为 `Store`，而不是直接改 `using`。
 - 当用户说“移出知识库”或“不要再参与检索”时，通常应理解为把 `action` 设为 `Remove`。
 
+注意：`action=Store` 和 `action=Remove` 由后端异步处理，所以可检索状态可能会滞后于更新。
+
 ## 决策流程
 
 1. 如果用户要在“已向量化的知识内容”里查找相关结论、经验或历史知识，使用 `search_knowledge`。

PLUGINS/ClaudeCode/skills/asp-ticket-en/SKILL.md

@@ -95,6 +95,8 @@ Preferred response structure:
 - Prefer workflow wording over storage wording.
 - When many tickets match, show the best subset and explain the pattern briefly.
 
+Tip: there is no direct `case_id` filter for `list_tickets`; use `list_cases(case_id=..., lazy_load=false)` to inspect attached tickets when needed.
+
 ## Failure Handling
 
 - If no tickets match, say that directly and suggest the most useful refinement.

PLUGINS/MCP/llmfunc.py

@@ -439,7 +439,6 @@ def update_knowledge(
         title=title,
         body=body,
         action=action,
-        source=source,
         tags=tags
     )