feat(skills): add 5-skill suite (recon, inventory, explore, screenshot-all, diff)

[HermeticOrmus]

Why

vibe-check covers the "execute a known plan against a known UI" use case. This PR adds five complementary skills for the workflows Vibium users hit before and around that:

Skill	Question it answers
vibe-recon	What is this app and how does auth work? (no login)
vibe-inventory	What does it do, structurally? Routes + APIs + permissions
vibe-explore	What can I do here? Click everything safely and report
vibe-screenshot-all	Show me what every page looks like
vibe-diff	What changed since last time?

Each skill is self-contained — SKILL.md + bash runner + helper JS where needed. Binary resolution mirrors vibe-check's pattern (vibium → ./clicker/bin/vibium → ./node_modules/.bin/vibium). No Go binary changes; pure-additive PR.

What changed

skills/
├── vibe-recon/             4 files — recon.sh + bundle-grep.sh + probe.js + SKILL.md
├── vibe-inventory/         5 files — inventory.sh + walk.sh + bundle-grep.sh + probe.js + SKILL.md
├── vibe-explore/           5 files — explore.sh + dismiss-consent.js + enumerate-clickables.js + probe-state.js + SKILL.md
├── vibe-screenshot-all/    2 files — screenshot-all.sh + SKILL.md
└── vibe-diff/              2 files — diff.sh + SKILL.md

+18 files, ~830 lines, 0 existing files modified.

vibe-recon — auth-wall + edge mapping (no login)

Edge curl, redirect chain, security headers, navigates the landing page, captures any visible login DOM, pulls the SPA bundle for grep-based route discovery. Read-only mode for "look but don't touch."

vibe-inventory — structural feature map

Walks every route the SPA bundle declares (capped at --max-routes, default 30), captures per-route status / tables / grids / inputs / buttons, screenshots each, and grep the bundle for /api/* endpoints + permission tokens (Word:Word:Word) + role names. Login-aware via --auth-required (pause for manual sign-in).

vibe-explore — click safe elements + rank capabilities

Inverse of vibe-check: clicks every safe interactive element on the page, classifies each outcome (navigation / modal / inline-disclosure / external / noop / route-error), screenshots before+after, then produces a ranked "what you can do here" report.

Hard safety filter on by default — skips delete / submit / pay / sign-out / send / post / checkout patterns, form submits, external-origin links, target=_blank anchors. --include-destructive lifts the filter.

Includes a 4-strategy consent-banner dismissal (visible-button-text → vendor-specific Usercentrics/OneTrust/Cookiebot → shadow-DOM walk → force-hide-CSS). Required to make the click loop work on real-world consent-walled sites.

vibe-screenshot-all — visual catalog

One PNG per route + a contact-sheet HTML for stakeholder review or visual regression baselines. No DOM probe, no clicking.

vibe-diff — what changed between two snapshots

Pure file-based diff between two vibe-inventory run dirs. Surfaces new/removed routes, new/removed API endpoints, new/removed permission tokens, version bump, bundle-size delta. No browser, no daemon — just comm and diff against the artifacts.

How to test

Each skill ships a self-contained bash runner. Smoke tests run against public sites, no login required:

make build-go

# vibe-recon
mkdir /tmp/recon && skills/vibe-recon/recon.sh /tmp/recon https://raven-eye.app
# expect: edge-headers.txt, app.bundle.js (~10 MB), api-endpoints.txt (~280 lines), 01-landing.png

# vibe-inventory (will only walk routes the bundle declares)
mkdir /tmp/inv && skills/vibe-inventory/inventory.sh /tmp/inv https://raven-eye.app --max-routes 5
# expect: per-route JSON + PNG in routes/, api-endpoints.txt, permissions.txt

# vibe-explore against any public site
mkdir /tmp/expl && skills/vibe-explore/explore.sh /tmp/expl https://github.com/VibiumDev/vibium --max 8
# expect: 8 clicks attempted, results.jsonl with outcome per click, before/after screenshots

# vibe-screenshot-all
mkdir /tmp/shots && skills/vibe-screenshot-all/screenshot-all.sh /tmp/shots https://raven-eye.app --max-routes 5
# expect: contact-sheet.html with embedded PNGs

# vibe-diff (after two inventory runs)
skills/vibe-diff/diff.sh /tmp/inv-old /tmp/inv-new
# expect: DIFF.md in /tmp/inv-new with route/endpoint/permission deltas

All bash scripts pass bash -n; all JS helpers pass new Function(code) parse. vibe-recon end-to-end against https://raven-eye.app produces 280 API endpoints across 60 domains, 25 React Router patterns. vibe-explore end-to-end against https://github.com/VibiumDev/vibium produces 7/8 clicks landing real outcomes including mega-menu disclosures.

Notes

• Each skill stands alone — maintainers can accept any subset. The two commits split as vibe-recon + vibe-inventory + vibe-screenshot-all + vibe-diff first, then vibe-explore second; happy to squash if preferred.
• One bug surfaced and fixed during smoke-testing: the bundle-grep.sh regex /assets/<name>.js was matching /assets/manifest.json truncated to .js on greedy-prefix engines. Fix requires a non-word boundary after .js (commit ce7df57).
• vibe-explore was originally a separate branch (feature/vibe-explore-skill); consolidated into this suite branch and the standalone branch retired.
• Each skill is run via its bash entry point. The SKILL.md files are the agent-facing one-pagers (matching vibe-check's style); the bash runners are what an operator would invoke directly.
• No new prerequisites beyond vibium and jq — both already required by other parts of the repo or trivially installable.