Sync vendored skills with skills main (4ae5d847 / #69)

[davidmytton]

Summary

Updates the vendored skill tree to match current arcjet/skills main at 4ae5d847970cc3eb7adffb54290f371332421131 (arcjet/skills#69, merged 2026-09-22).

This is a follow-up to #28, which synced b9606c28 (skills#68). Skills#69 is published installs for Python Google ADK and JS Cloudflare Think Guard. Git SHA pins are gone (a71970dc, b06e584d).

Files were fetched from GitHub (tarball of arcjet/skills at that SHA) rather than rewritten by hand. After copy, this repo’s dprint formatter was applied so CI’s format check passes. Formatting-only paths collapsed to no-ops after dprint (italic *word* → _word_, existing \|\| table escapes kept). The skill-tree delta is the skills#69 content plus the two new skill directories.

What changed

Canonical copy is plugins/arcjet/skills/ (skills/ is the inbound symlink). Only that tree and CHANGELOG.md were updated.

Skill	Install	Example
integrate-arcjet-guard-google-adk-py	pip install "arcjet[google-adk]" or uv add "arcjet[google-adk]"	examples/fastapi-google-adk-guard on arcjet-py main
integrate-arcjet-guard-cloudflare-think	npm install @arcjet/guard @cloudflare/think or pnpm add @arcjet/guard @cloudflare/think	examples/cloudflare-think-agent — main 404s, so this is the branch tree. Docs: https://docs.arcjet.com/guards/cloudflare-think/

• Python Google ADK: guard_tool on LlmAgent(before_tool_callback=), guard_plugin first on Runner(plugins=), google_adk_context. Not the JS @arcjet/guard/google-adk/v2 path.
• Cloudflare Think: published @arcjet/guard plus peer @cloudflare/think >=0.3.0 <1, path /v0. guardHooks / cloudflareThinkContext. Not @arcjet/guard/vercel-ai/v7.
• actor / inputs teaching and HITL warnings stay (Python server_input / local_input and require_confirmation; JS policyInput and Think needsApproval).
• Routing tables in arcjet/SKILL.md, guards_python.md, and guards_javascript.md point at the new skills. The JS Google ADK reference sends Python readers to integrate-arcjet-guard-google-adk-py.

No extra remote-policy teaching beyond that SHA.

What was left alone

Deprecated alias skill directories are not generated from the canonical skill. They are standalone deprecation stubs (add-request-protection, add-guard-protection, protect-route, add-ai-protection) and were left unchanged.

evals/ is not vendored. Skills README.md and CONTRIBUTING.md are not vendored.

No marketplace catalog or plugin-manifest work. Hosts discover skills by scanning plugins/arcjet/skills/ (./skills/ in the Codex manifest).

Test plan

• dprint check
• bash scripts/validate.sh
• Vendored arcjet/ and integrate-arcjet-guard-* dirs match skills main at 4ae5d847 after dprint (italic underscores only)
• Confirmed skills#69 files are the only skill-tree delta versus plugin main
• Confirmed no a71970dc / b06e584d git SHA pins remain in the vendored tree
• Confirmed alias skill directories unchanged
• CI lint + validate jobs (green)