github · Sketchjar · Aug 31, 2026
@@ -430,6 +430,8 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to
 | [vardoger-analyze](../skills/vardoger-analyze/SKILL.md)<br />`gh skills install github/awesome-copilot vardoger-analyze` | Use when the user asks to personalize the GitHub Copilot CLI assistant, adapt Copilot to their style, use vardoger, or analyze their Copilot CLI conversation history. Reads the local session directory at `~/.copilot/session-state/`, extracts recurring preferences and conventions, and writes a fenced personalization block into `~/.copilot/copilot-instructions.md`. Runs entirely on the user's machine via the local `vardoger` CLI (`pipx install vardoger`); no network calls and no uploads. Triggers: 'personalize my copilot', 'analyze my copilot history', 'tailor copilot to me', 'run vardoger', 'update my copilot instructions from history', 'make copilot learn my style'. | None |
 | [vcpkg](../skills/vcpkg/SKILL.md)<br />`gh skills install github/awesome-copilot vcpkg` | Guide for setting up vcpkg in C++ projects, managing dependency versions, and cross-compiling. Covers manifest initialization, CMake and Visual Studio integration, classic-to-manifest migration, version pinning, baselines, overrides, triplets, and cross-compilation. Use when a user is working with vcpkg project setup, installation, version management, or cross-platform builds. For specialized tasks, additional references cover custom registries and overlay ports (references/registries.md), CI/CD and binary caching (references/ci.md), and troubleshooting and dependency lifecycle (references/troubleshooting.md). | `references/ci.md`<br />`references/registries.md`<br />`references/troubleshooting.md` |
 | [verify-agent-action](../skills/verify-agent-action/SKILL.md)<br />`gh skills install github/awesome-copilot verify-agent-action` | Review a proposed AI-agent action or human-approval packet before execution. Use when an agent wants to run a consequential tool, command, deployment, message, purchase, credential operation, or data mutation; when checking whether approval still matches the exact action; or when auditing action evidence for forged results, parameter swaps, replay, correlated reviewers, missing evidence, expiry, or stale monitoring. Produce an evidence-based review only—never execute or authorize the action. | None |
+| [verify-citations](../skills/verify-citations/SKILL.md)<br />`gh skills install github/awesome-copilot verify-citations` | Verify citations and references in a document, report, or article against real sources. Use when the user asks to fact-check, verify references, check citations, or validate evidence in research reports, tender responses, whitepapers, or academic writing. | None |
+| [verify-document](../skills/verify-document/SKILL.md)<br />`gh skills install github/awesome-copilot verify-document` | Check whether a document (PDF or image) shows signs of tampering or forgery before you rely on it. Use when the user asks to verify a payslip, invoice, bank statement, ID document, contract, or any document where authenticity matters. | None |
 | [vscode-ext-commands](../skills/vscode-ext-commands/SKILL.md)<br />`gh skills install github/awesome-copilot vscode-ext-commands` | Guidelines for contributing commands in VS Code extensions. Indicates naming convention, visibility, localization and other relevant attributes, following VS Code extension development guidelines, libraries and good practices | None |
 | [vscode-ext-localization](../skills/vscode-ext-localization/SKILL.md)<br />`gh skills install github/awesome-copilot vscode-ext-localization` | Guidelines for proper localization of VS Code extensions, following VS Code extension development guidelines, libraries and good practices | None |
 | [web-design-reviewer](../skills/web-design-reviewer/SKILL.md)<br />`gh skills install github/awesome-copilot web-design-reviewer` | This skill enables visual inspection of websites running locally or remotely to identify and fix design issues. Triggers on requests like "review website design", "check the UI", "fix the layout", "find design problems". Detects issues with responsive design, accessibility, visual consistency, and layout breakage, then performs fixes at the source code level. | `references/framework-fixes.md`<br />`references/visual-checklist.md` |

@@ -0,0 +1,66 @@
+---
+name: verify-citations
+description: Verify citations and references in a document, report, or article against real sources. Use when the user asks to fact-check, verify references, check citations, or validate evidence in research reports, tender responses, whitepapers, or academic writing.
+---
+
+# Citation Verification
+
+Verify that citations in a document actually resolve and support the claims they're attached to. Uses the Stipple API (free anonymous tier, no signup) for citation resolution, arithmetic recomputation, and unsupported-claim detection.
+
+## When to use
+
+- Before submitting or publishing a research report, tender response, or whitepaper
+- Reviewing an LLM-generated document (LLM citations are plausibly-formatted and frequently wrong)
+- Due diligence on third-party reports
+- Academic reference checking
+
+## Instructions
+
+1. **Get the document.** Ask the user for a URL to the report, or a local file path (PDF, DOCX, Markdown). If the user pastes text directly, skip to step 3 with `text` input.
+
+2. **Run verification.** POST the document to Stipple's citation verification endpoint:
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/verify-references \
+     -F "file=@report.pdf" \
+     -H "Authorization: Bearer $STIPPLE_API_KEY"
+   ```
+
+   The anonymous free tier works without the Authorization header. Deep mode (`?deep=true`) costs more credits but cross-checks citations against live web sources.
+
+3. **Interpret the response.** The result includes:
+   - `verification_coverage` — percentage of claims verified (e.g. "78%")
+   - `citations[]` — per-citation status: resolved and matching, resolved but mismatched, or unresolvable, with the issue explained
+   - `arithmetic[]` — recomputed figures vs stated figures (flags decimal shifts, wrong sums)
+   - `unsupported_claims[]` — claims with no citation at all
+
+4. **Report honestly.** Present results as *verification coverage*, not a truth verdict:
+   - "21/27 citations resolve and match"
+   - "[x] FY24+FY25 revenue stated $4.2m, actual $3.7m"
+   - "[!] 'industry-leading accuracy' — no source in document"
+   - Unverified ≠ false. The goal is telling the user *which* claims are backed and which aren't.
+
+5. **Offer remediation.** For failed citations, suggest: fixing the decimal shift, finding the correct source, or removing the unsupported claim.
+
+## Output format
+
+```
+Verification coverage: 78%
+
+Citations: 21/27 resolve and match
+  [+] "ABS unemployment 4.1% April 2026" — matches abs.gov.au
+  [-] "AI adoption grew 340% in 2025" — source states 34%, decimal shifted
+
+Arithmetic: 12/13 recompute correctly
+  [x] FY24 + FY25 revenue — stated $4.2m, actual $3.7m
+
+Unsupported claims: 2
+  [!] "industry-leading accuracy" — no source in document
+```
+
+## Notes
+
+- Works on PDF, DOCX, MD, TXT. For pasted text, POST JSON: `{"text": "..."}`
+- Deep verification (`deep=true`) is slower and costs more credits but resolves citations against live sources
+- Pairs well with `verify-document` (is the source doc itself authentic?) run first
+- Anonymous free tier: shared weekly allowance. Get a free key at https://www.stipple.sh for your own metering
@@ -0,0 +1,71 @@
+---
+name: verify-document
+description: Check whether a document (PDF or image) shows signs of tampering or forgery before you rely on it. Use when the user asks to verify a payslip, invoice, bank statement, ID document, contract, or any document where authenticity matters.
+---
+
+# Document Verification
+
+Inspect a document for forensic authenticity signals — not a fraud verdict, but a risk band with the evidence behind it. Uses the Stipple API (free anonymous tier, no signup).
+
+## When to use
+
+- Before onboarding a tenant, contractor, or employee from uploaded documents
+- Before paying an invoice that arrived by email
+- Before relying on a bank statement, payslip, or certificate in any workflow
+- Reviewing documents in due diligence, claims processing, or loan applications
+
+## Instructions
+
+1. **Get the document.** URL or local file path (PDF, PNG, JPEG, BMP, TIFF).
+
+2. **Optionally check the cache first.** If the user has the file's SHA-256, check whether it's already been inspected (free):
+
+   ```bash
+   curl "https://www.stipple.sh/v1/warrants/check?sha256=<hash>"
+   ```
+
+3. **Run verification.** POST the document:
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/warrants \
+     -F "file=@payslip.pdf" \
+     -H "Authorization: Bearer $STIPPLE_API_KEY"
+   ```
+
+   Add `?fresh=true` to force re-inspection of a previously cached document. Add `?deep=true` for deep inspection (more thorough, more credits).
+
+4. **Interpret the response.** Two independent axes — read both:
+
+   | Axis | Question it answers |
+   |---|---|
+   | `risk_band` | Does anything look tampered? (low / medium / high) |
+   | `inspection_quality` | Could the engine actually see enough to judge? (thorough / limited / poor) |
+
+   A clean phone photo of a real payslip is commonly `low` risk + `limited` quality — **low coverage is not risk**. Per-signal `evidence` includes: amount/words mismatch, font discontinuity in values, date anomalies, document label integrity, identifier checksums (ABN/ACN/TFN), table arithmetic.
+
+5. **Report honestly.** This is a *signal with evidence*, not a verdict:
+   - "risk_band: LOW — nothing looks tampered"
+   - "inspection_quality: limited — couldn't inspect everything; low coverage is NOT fraud"
+   - Show the per-signal evidence for anything flagged
+
+6. **Pair with related checks.** For identity documents, follow with a 100-point identity check (`/v1/identity-check`). For extraction, use `extract-document-data`.
+
+## Output format
+
+```
+risk_band:           LOW — Nothing looks tampered.
+inspection_quality:  limited
+recommended action:  review_before_action
+
+evidence (signals):
+  [pass] Amount words/figure mismatch: Spelled-out amounts agree with figures.
+  [pass] Font discontinuity in value: Numeric values share the font of surrounding text.
+  [skip] Identifier checksum: No checksummable identifier (ABN/ACN/TFN) present.
+```
+
+## Notes
+
+- Document types the engine recognizes (payslips, invoices, bank statements) get type-specific checks; unrecognized types get generic checks only — say so in your report
+- Identical files are cached by content hash — re-checking the same bytes returns instantly and free
+- This measures *forensic integrity*, not *authorship style* — for "was this written by AI", use AI-text detection instead
+- Anonymous free tier: shared weekly allowance. Free key at https://www.stipple.sh