feat: add nordvpn client skill

skills/nordvpn-client/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: nordvpn-client
+description: Use when managing NordVPN on macOS or Linux, including install/bootstrap, login, connect, disconnect, status checks, or verifying a VPN location before running another skill.
+---
+
+# NordVPN Client
+
+Cross-platform NordVPN lifecycle management for macOS and Linux hosts.
+
+## What This Skill Is For
+
+- Probing whether NordVPN is already installed
+- Bootstrapping NordVPN if it is missing
+- Logging in through the Linux CLI or the macOS app/CLI path
+- Connecting to a country or city before a follow-up action such as `web-automation`
+- Disconnecting and checking VPN status
+- Verifying public IP and geolocation after connect
+
+## Command Surface
+
+```bash
+node scripts/nordvpn-client.js status
+node scripts/nordvpn-client.js install
+node scripts/nordvpn-client.js login
+node scripts/nordvpn-client.js verify
+node scripts/nordvpn-client.js verify --country "Italy"
+node scripts/nordvpn-client.js verify --country "Italy" --city "Milan"
+node scripts/nordvpn-client.js connect --country "Italy"
+node scripts/nordvpn-client.js connect --city "Milan"
+node scripts/nordvpn-client.js connect --country "Italy" --city "Milan"
+node scripts/nordvpn-client.js disconnect
+```
+
+## Platform Notes
+
+- Linux:
+  - uses the official `nordvpn` CLI
+  - install path follows NordVPN's Linux installer
+  - token login is supported through `NORDVPN_TOKEN`
+- macOS:
+  - prefers Homebrew cask install: `brew install --cask nordvpn`
+  - prefers a usable `nordvpn` CLI if the installed package exposes one
+  - otherwise falls back to opening the NordVPN app and guiding the manual login/connect path
+
+## Credentials
+
+Do not store secrets in this skill.
+
+Supported env vars:
+
+- `NORDVPN_TOKEN`
+- `NORDVPN_USERNAME`
+- `NORDVPN_PASSWORD`
+
+Optional credential file env vars:
+
+- `NORDVPN_TOKEN_FILE`
+- `NORDVPN_PASSWORD_FILE`
+
+## Verification Behavior
+
+`status`, `verify`, and `connect` report machine-readable JSON including:
+
+- platform
+- install state
+- auth state
+- connection state
+- requested target
+- public IP lookup and geolocation
+
+Use this skill first, then run the follow-up task under the active VPN session.
+Use `verify` when you want an explicit post-connect location check without changing VPN state.
+
+## Known Boundaries
+
+- Linux country connect is official CLI behavior.
+- Linux city connect is attempted through the CLI target string and then validated by post-connect IP/location checks.
+- macOS app-only fallback cannot guarantee non-interactive login/connect if the installed app does not expose a CLI. In that case the skill will open the app and return a clear manual-action-required result.