Add duo community skill

[miga-heygen]

What

Adds skills/duo/, a community skill authored by @jmoran-heygen and submitted here on his behalf. It composites any two HTML screens into a locked 1448×1086 @ 30fps photo plate of hands holding an open foldable phone, for side-by-side comparison and meme videos (TikTok vs Reels, two chats answering the same prompt, before/after, two apps racing). The plate, measured screen geometry, hinge divider and single camera push are fixed; the agent only authors what plays inside the two .content slots (left 495×849, right 498×849) and adds tweens to the one shared GSAP timeline.

Contents:

• SKILL.md — when/when-not to use, requirements, complete network/side-effect list, flow, verification, rules, provenance.
• scripts/build.mjs — dependency-free Node 18+ scaffolder (writes only inside --out, refuses to write through symlinks, validates --duration and --icons).
• template/index.template.html — the locked rig with two empty slots and the timeline hook.
• assets/plate.png (398 KB), assets/plate-preview.jpg, assets/screen-spec.json, assets/icons-tiktok.svg, assets/icons-instagram.svg (plain-text <symbol> sheets).
• references/screen-geometry.md, references/feed-recipes.md, references/sourcing-real-ui.md.
• README "Available skills" row (alphabetical, first).

Files excluded from the author's zip and why:

• __MACOSX/, ._*, .DS_Store — macOS archive metadata, not skill content.
• TEST-scaffold-snapshot.png — a generated test artifact; CONTRIBUTING forbids generated output.

Edits to the author's content: none. The > folded-block description in the frontmatter is the same form used by x-posting-license (#5) and passes the validator as-is.

Why it belongs here

It is a single fixed-plate template for one specific meme format. Same shape as x-posting-license (#5): a locked composition where the agent fills content and renders. Too narrow for the curated set, useful to share.

Trust boundary

• Commands: node scripts/build.mjs --out <dir> [--id] [--duration] [--icons tiktok,instagram], then npx hyperframes@latest check|snapshot|render on the output dir.
• File access: build.mjs reads only the skill's own template/ and assets/, writes only inside --out (creates assets/ and renders/ subdirs), refuses symlinked targets.
• Network: registry.npmjs.org (HyperFrames CLI via npx); cdn.jsdelivr.net (GSAP pinned 3.14.2 loaded by the template at preview/render time). build.mjs itself makes no network calls. references/sourcing-real-ui.md documents how an agent may pull real app UI/posts from TikTok/Instagram if the user's request calls for real content, with a rights caveat; that is user-directed, not something the scaffolder does.
• Credentials: None. Paid operations: None. Telemetry: None.
• Externally visible side effects: None (renders are local; publishing is up to the user).
• Dependency pinning: GSAP is pinned. npx hyperframes@latest is mutable; the SKILL.md advises pinning a version for byte-identical re-renders. Reviewers may prefer a pinned example in the docs.

Verification

• bash .github/scripts/validate-skills.sh → Validated 4 skill(s). (exit 0).
• Scaffolder normal path: node skills/duo/scripts/build.mjs --out /tmp/duo-test --duration 10 --icons tiktok,instagram → exit 0; produced index.html, hyperframes.json (1448x1086 @ 30fps), assets/plate.png, assets/screen-spec.json, assets/icons-tiktok.svg, assets/icons-instagram.svg.
• Scaffolder failure paths: --icons snapchat → unknown icon sheet "snapchat" exit 1, nothing written; no --out → usage, exit 1.
• npx hyperframes@latest check /tmp/duo-test (Node 22, Linux, software GPU) → Lint 0/0, Runtime 0/0, Layout 0 issues across 9 samples, Motion 0/0, "Check passed". No render performed.
• Scanned the skill for symlinks (none), secrets/tokens/keys (none), and URLs: only w3.org SVG namespace, the jsDelivr GSAP URL, the X status / pbs.twimg.com provenance links in screen-spec.json, and the tiktok.com example in the sourcing reference.
• TruffleHog runs in CI; not available locally.

Licensing note for reviewers

Two items need code-owner judgment under CONTRIBUTING's "right to redistribute every dependency and asset" requirement:

1. assets/plate.png is derived from a photo posted publicly on X by @A_Kapustin (status 2097769962936868872), with both phone screens blanked to neutral. The SKILL.md and screen-spec.json document this provenance and tell users to credit the source where appropriate. No explicit license from the photographer is on file.
2. assets/icons-tiktok.svg and assets/icons-instagram.svg reproduce TikTok's and Instagram's own UI glyphs, extracted from their public mobile web DOM, so mock screens look like the real apps. They are trademarks of their owners and are included for parody/commentary use only, as the SKILL.md states.

If either is not acceptable for redistribution in this repo, the skill can be adapted (for example, ship without the icon sheets, or require the user to supply their own plate).

Checklist

• The skill is self-contained and its directory name matches SKILL.md.
• New or renamed skills are linked in the README's Available skills table.
• I read every instruction and script in the submitted skill.
• I disclosed all dependencies, network access, credentials, costs, and side effects.
• No secrets, private data, private endpoints, generated output, or opaque executables are included.
• Destructive, paid, or externally visible actions require explicit user confirmation (render is user-triggered; no destructive or paid actions).
• Dependencies are minimal, pinned where practical, and license-compatible (GSAP pinned; hyperframes@latest mutable, pinning advised; asset licensing flagged above).
• I tested the normal path and a failure or cancellation path in a fresh agent session (scaffolder normal + two failure paths, plus hyperframes check; no end-to-end render).
• bash .github/scripts/validate-skills.sh passes locally.

🤖 Generated with Claude Code

[jrusso1020]

APPROVED at 0e17b539 as code owner.

The licensing question is answered, not overlooked. CONTRIBUTING.md:15 asks contributors to confirm redistribution rights for every asset, and this skill ships two things that needed a human call rather than a reviewer's: the TikTok and Instagram glyph sheets (SKILL.md:161 — "trademarks of their owners… included for parody / commentary") and assets/plate.png, derived from a photo posted publicly on X by @A_Kapustin (SKILL.md:154). @miga-heygen raised it in the PR body rather than letting it pass silently, which was the right instinct. I held the stamp and put it to the repo owner; James Russo cleared it for publication as-is. Recording that here so the decision is attached to the merge rather than living in Slack.

On the engineering, which is what I can speak to. The provenance section is not boilerplate — it names the photographer, states the parody basis, and references/sourcing-real-ui.md carries the rights caveat where someone swapping in their own UI will actually meet it. SKILL.md:40 already says a different device means a different photo, so the structure treats the plate as replaceable rather than as the skill's identity.

Verified against the repo's own gates rather than the description: validate-skills.sh passes at 4 skills, the build.mjs scaffolder produces a 1448×1086 @ 30fps project and refuses bad --icons values, npx hyperframes check reports 0 lint / runtime / layout / motion issues on the scaffold, and Structure-and-safety (validator + TruffleHog) is green on this head. __MACOSX/._* metadata and the generated test snapshot were dropped; Jake Moran's content is otherwise untouched and credited.

One note for whoever picks up the next community skill, not a change request here: the glyph sheets are the reusable precedent, and the next contribution that traces a third party's marks will land on the same CONTRIBUTING line. Worth a sentence in CONTRIBUTING about what "parody / commentary" does and does not clear, so the next author knows before they build rather than at review.

— Rames