feat: add price intelligence skill

[shrey150]

Summary

• add a price-intelligence skill for paid, parallel comparisons across Amazon, Target, Walmart, Best Buy, and eBay
• include a dependency-free Node.js controller and Browserbase-styled localhost viewer with payment journaling, cooperative cancellation, deterministic cleanup, and no checkout behavior
• add repository metadata, synthetic eval prompts, the MIT license, and the README catalog entry

Safety and privacy

• user and webpage text enters the controller as quoted JSON on stdin, then reaches subprocesses through argument arrays rather than shell interpolation
• navigation, recorded results, and recommendations are bound to each assigned retailer domain
• capability URLs stay in mode-restricted local state, the viewer rejects untrusted Host headers, and successful cleanup removes payment artifacts and capability fields
• fixtures and evidence use only synthetic product data and public canonical retailer or example.com URLs

E2E Test Matrix

Command / flow	Observed output	Confidence / sufficiency
node scripts/validate-skills.mjs	All 17 repository skills passed with 0 failures, errors, or warnings.	Proves the new anatomy, frontmatter, license, README registration, and existing skills satisfy the repository validator.
node <skill dir>/scripts/controller.mjs self-test --item "Example Product"	Rendered five synthetic retailer rows, selected the lowest eligible in-stock result, served healthy HTML, rejected an untrusted Host with 403, and confirmed viewer shutdown.	Exercises result ranking, retailer-domain enforcement, viewer rendering/security, and process-owned cleanup without spending funds.
Final live flow: start --minutes 5 --count 1 --no-open with JSON stdin, retailer navigation, JSON result recording, then report --run current	Payment and Browserbase attachment completed 1/1; the localhost viewer was healthy; off-retailer navigation and recording were rejected; report stopped 1/1 Browse daemons and deleted 1 MPP session. Persisted state contained 0 capability fields, 0 live capability values, and 0 payment artifacts; the viewer was no longer reachable.	Proves the final code against the real paid lifecycle with a 0.01 USDC.e session cap plus network fee. It validates one real session end to end, not the content accuracy of all five retailers in one run.
Quoted-stdin adversarial flow using literal $() and backtick text	The exact metacharacter text reached the browser/result state; no marker command executed. An eligible=true out-of-stock result and an off-retailer URL were both rejected.	Proves untrusted product and page text is data rather than shell code, and inconsistent results cannot win.
Synthetic crash recovery: terminate the controller immediately after an MPP response, then stop --run current	Cleanup recovered the gateway session from the protected response journal, deleted it, removed artifacts, and left 0 capability fields.	Fault-injects the narrow crash window that could otherwise orphan a paid session; the fixture creates no real paid resource.
Synthetic malformed-response recovery followed by another start	The run became stopped_with_warning, moved both protected artifacts out of the active run root, and the next start reached wallet preflight instead of being blocked.	Proves an unidentifiable provider response remains available for private diagnosis without permanently bricking future comparisons.
Synthetic parallel-attach failure with one immediate failure and one delayed daemon	Startup waited for both attachment tasks, cleanup deleted 2/2 synthetic sessions, and no delayed Browse daemon marker survived.	Proves a late attachment cannot recreate a daemon after cleanup reports success.
Mixed-case Windows environment fixture through wallet preflight	Path, SystemRoot, USERPROFILE, AppData, and LOCALAPPDATA all reached the Tempo subprocess; the fixture returned the expected wallet-not-ready result.	Proves Windows platform keys survive the strict child environment without widening it to unrelated credentials.
Read-only forward tests for a missing item and an unapproved comparison	Missing item asked for the product and stopped; unapproved comparison disclosed the 0.10 USDC.e five-session cap plus fees and waited. No payment or browser tool was called.	Proves the skill does not spend before it has both an item and explicit paid-run authorization.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e1978e1. Configure here.}