Add Sub Rosa community skill

[karagozemin]

Summary

• list the Sub Rosa Agent Skill in the Community Skills catalog
• link directly to the public skill maintained with the Sub Rosa Core v2 SDK
• cover sealed-bid asset auctions, confidential proposal rounds, Drand reveal, SAC escrow and atomic settlement, lifecycle automation, receipts, and current testnet safety boundaries

Skill source

https://github.com/karagozemin/Sub-Rosa/blob/feat/core-v2/skills/sub-rosa/SKILL.md

Validation

• Agent Skills quick_validate.py: passed
• pnpm lint: passed
• pnpm lint:ts: passed
• pnpm build: passed
• verified the skill URL is publicly readable and the card appears in the static site and generated llms.txt

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[kaankacar]

Thanks for this, Emin — Sub Rosa is a genuinely interesting pattern (sealed-bid auctions with Drand-timed reveal and SAC escrow), and the card entry itself is clean, so I went ahead and did the full check:

• The ECOSYSTEM_CARDS entry is the only change in the diff — no stray edits to SKILL_CARD_SOURCES or the skills/ tree — and the fields match the EcosystemCardSource type and its neighbors.
• The linked skill (github.com/karagozemin/Sub-Rosa/blob/main/skills/sub-rosa/SKILL.md) resolves and is public; I cloned the repo and read SKILL.md plus both reference docs in full. Frontmatter is valid, internal links to references/integration.md and references/security-and-lifecycle.md resolve, and the workflow/API described lines up with the @sub-rosa/sdk README on GitHub.
• @sub-rosa/sdk is a real, published npm package (currently 0.2.2) and exports the functions the docs reference (createAssetAuctionRound, sealAssetBid, submitV2, etc.).
• I checked both deployment tuples against the network directly: the testnet contract (CCOVGOQQ...C5OV) and mainnet contract (CDQOFNCJ...C325) both exist and share the WASM hash 2c7bc6b4..., exactly as documented. Mainnet shows only 1 storage entry / 0 events so far, which is consistent with the doc's own "capped deployment, no independent funds-handling audit yet" framing rather than overclaiming production use.
• The Drand quicknet reference checks out too — bls-unchained-g1-rfc9380 / quicknet matches the public drand.sh beacon info.
• No red flags on the security bar: every state-changing call goes through an explicit preflight*V2 + signature step, there's no operator-only emergency path, and secrets are pulled from caller-provided config, not a predictable path.

This is good to merge.