Add Zo Q&A App skill

[jyonah]

Description

Adds the Zo Q&A App skill to the Official category.

Features

• Real-time Q&A for live events — Submit questions, vote, TV wall display
• Setup wizard — Configure title, logo, and branding
• 4 logo options — None, URL, upload, or ask Zo to generate
• Admin controls — Enable/disable submissions, export data, reset, merge questions
• White-label ready — Customize all branding

Routes Created

Pages (6)

• /qa — Landing page
• /qa/setup — Setup wizard
• /qa/submit — Submit questions
• /qa/vote — Vote on questions
• /qa/tv — TV wall for projectors
• /qa/admin — Admin panel

API (8)

• /api/qa/questions — List/create questions
• /api/qa/questions/:id — Edit/delete questions
• /api/qa/questions/:id/vote — Toggle vote
• /api/qa/admin/settings — Runtime settings
• /api/qa/admin/config — Branding config
• /api/qa/admin/export — Export data
• /api/qa/admin/reset — Reset data
• /api/qa/admin/merge — Merge questions

Installation

Users can install by asking their Zo:

Install the Zo Q&A app

Repository

https://github.com/jyonah/zo-qa-app

Testing

The app has been tested on a live Zo instance and includes:

• Comprehensive testing guide (TESTING.md)
• Audit report (AUDIT_REPORT.md)
• Simplified MVP (no event handling, no admin tokens)

Screenshot

The app provides a clean, professional interface for live event Q&A with real-time voting and TV wall display.

[skeletor-js]

@jyonah Hey, thanks for submitting this! Cool concept for live events. A few things need to change before it can be merged though.

Needs to move to Community/.
The Official/ directory is reserved for Zo-team skills. Community contributions go in Community/zo-qa-app per the repo guidelines. Manifest entry needs updating too.

Code needs to be in the PR.
Right now the SKILL.md fetches all route code from your external repo at install time. That means the actual application code is unreviewed and can change after merge with no visibility here. Please add the route code into the PR (e.g. assets/routes/ or scripts/) so it can be reviewed, version-controlled, and audited in one place.

Admin endpoints need auth.
The reset, export, merge, and settings endpoints are open to anyone who knows the URL. Even for an MVP, destructive operations need at least a shared secret or bearer token. For a live event tool this is especially important since attendees could find the endpoints. This isn't explicitly blocking but should be reviewed and considered before resubmitting since the PR description explicitly calls out no admin tokens.

Happy to re-review once these are addressed.