feat: Add App Store Optimization skill + Hook Factory v2.0 updates

[alirezarezvani]

Summary

• Add comprehensive App Store Optimization skill with 8 specialized modules
• Update Hook Factory to v2.0 with interactive mode, installer, and enhanced validation
• Update documentation for Hook Factory improvements
• Remove deprecated psychology-advisor references

Key Features

App Store Optimization Skill (NEW)

Comprehensive ASO skill enabling users to research, optimize, and launch apps successfully on Apple App Store and Google Play Store.

8 Specialized Modules:

• keyword_analyzer.py - Keyword research, search volume & competition analysis
• metadata_optimizer.py - Title/description optimization with character limit validation
• competitor_analyzer.py - Competitor strategy analysis and gap identification
• aso_scorer.py - ASO health scoring (0-100) with prioritized recommendations
• ab_test_planner.py - A/B testing framework with statistical significance
• localization_helper.py - Multi-language strategy with ROI analysis
• review_analyzer.py - Sentiment analysis and issue identification
• launch_checklist.py - Pre-launch checklists and timing optimization

Platform Coverage:

• ✅ Apple App Store (Title, Subtitle, Promotional Text, Description, Keywords)
• ✅ Google Play Store (Title, Short/Full Description)
• ✅ Character limit validation for both platforms
• ✅ Platform-specific best practices

Hook Factory v2.0 Updates

• Interactive CLI with 7-question flow
• Automated installer with atomic operations
• Enhanced 4-layer validation (structure, safety, secrets, events)
• 10 production-ready templates
• Template variable substitution for multiple languages
• Installation examples and comprehensive documentation

Documentation Updates

• Updated CLAUDE.md with Hook Factory v2.0 references
• Updated README.md with latest skill information
• Updated generated-skills/CLAUDE.md catalog
• Removed deprecated psychology-advisor references

Files Changed

• 41 files changed
• 9,267 insertions
• New skill: 14 files (SKILL.md + 8 Python modules + docs + samples)

Testing

• ASO skill validated (YAML frontmatter, naming, structure)
• Hook Factory v2.0 tested (interactive mode, validation, installation)
• Documentation updated and cross-referenced
• No backup files or cache directories in deliverables

Impact

Adds production-ready ASO capabilities for app publishers and enhances Hook Factory with better UX and safety features.

🤖 Generated with Claude Code

[github-actions]

🔒 Security Audit (Claude)

Severity summary: Critical: 0, High: 0, Medium: 3, Low: 2

---

Findings

1) Medium - hook_factory.py:209-236 - Path Traversal Protection Incomplete

• Risk: While sanitize_hook_name() includes basic path traversal checks (line 225), the validation happens AFTER hook name is used to construct paths. An attacker could potentially bypass sanitization if hook_name contains encoded characters or Unicode normalization issues.
• Recommendation: Move path validation BEFORE path construction and add Unicode normalization to prevent bypass via homoglyphs.

2) Medium - hook_factory.py:516-523 - Command Injection Risk via Interactive Mode

• Risk: Interactive mode at line 516 warns about dangerous commands like 'rm -rf' but still allows execution if user confirms. This provides a false sense of security and could lead to accidental destructive operations in automated contexts.
• Recommendation: Block destructive commands entirely in hook generation (rm -rf, dd, chmod 777) rather than relying on user confirmation. Add an explicit --allow-dangerous flag for legitimate use cases.

3) Medium - validator.py:726-751 - Path Traversal Validation Hardcoded

• Risk: The validate_hook_file() function (line 726) restricts file reads to hardcoded safe directories. This is good for security but uses string prefix matching which could be bypassed with symlinks or if safe_dir resolution fails.
• Recommendation: Use os.path.commonpath() instead of string startswith() checks to properly validate paths are within allowed directories, and add symlink detection.

4) Low - installer.py:163-189 - Atomic File Operations Could Leave Temp Files

• Risk: The atomic save operation creates temporary files (line 163-172) but cleanup on exception (line 186) may fail if the temp file path was not set due to earlier errors, potentially leaving sensitive temp files.
• Recommendation: Use tempfile.NamedTemporaryFile within a try-finally block to ensure cleanup, or use atexit.register() for cleanup on process exit.

5) Low - validator.py:532-579 - Overly Broad Secret Detection Patterns

• Risk: The has_potential_secrets() function includes very broad patterns (line 550: any 40-char base64 string, line 570: any 32+ char quoted string) which will generate many false positives and may train users to ignore warnings.
• Recommendation: Tighten patterns to require context (e.g., only flag 40-char strings when near keywords like key, secret, token) and provide an entropy-based check to reduce false positives.

---

Notes:

• Scope: PR diff only (41 files, 9,267 insertions)
• Standards: OWASP Top 10, LLM agent hardening
• Positive findings: Path sanitization is implemented (hook_factory.py:209-236), comprehensive input validation in validator.py, atomic file operations in installer.py, and extensive safety checks for destructive commands.