@framers/agentos-skills-registry 0.6.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@framers/agentos-skills-registry",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "files": [
     "dist",
     "registry",

package/registry/curated/code-safety/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: code-safety
+version: '1.0.0'
+description: Scan LLM-generated code for security vulnerabilities using language-aware pattern rules
+author: Frame.dev
+namespace: wunderland
+category: security
+tags: [guardrails, code-safety, security, injection, xss, owasp, static-analysis]
+requires_tools: [scan_code]
+metadata:
+  agentos:
+    emoji: "\U0001F6E1"
+---
+
+# Code Safety Scanner
+
+A guardrail automatically scans code in your responses for security
+vulnerabilities. You also have a tool for on-demand code scanning.
+
+## When to Use scan_code
+
+- Before writing code to files via write_file or create_file
+- Before executing code via shell_execute
+- When reviewing user-submitted code for security issues
+- Before presenting code examples that handle user input
+
+## What It Detects
+
+- **Injection**: eval(), exec(), os.system(), command injection
+- **SQL Injection**: string concatenation in SQL queries
+- **XSS**: innerHTML, document.write, dangerouslySetInnerHTML
+- **Path Traversal**: unsanitized ../ in file paths
+- **Hardcoded Secrets**: API keys, passwords, tokens in code
+- **Weak Crypto**: MD5/SHA1 for passwords, Math.random for security
+- **Insecure Deserialization**: pickle.loads, yaml.load without SafeLoader
+- **SSRF**: unvalidated URL construction from user input
+
+## Constraints
+
+- Regex-based detection — may have false positives on safe code patterns
+- Language detection from code fence tags or heuristics
+- Does not perform deep AST analysis

package/registry/curated/grounding-guard/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: grounding-guard
+version: '1.0.0'
+description: Verify response faithfulness against RAG source documents using NLI entailment and LLM-as-judge
+author: Frame.dev
+namespace: wunderland
+category: security
+tags: [guardrails, hallucination, grounding, faithfulness, nli, rag, fact-checking]
+requires_tools: [check_grounding]
+metadata:
+  agentos:
+    emoji: "\U0001F50D"
+---
+
+# Grounding Guard
+
+A guardrail automatically verifies that your responses are faithful to
+the source documents retrieved via RAG. Claims in your output are checked
+against the retrieved sources using NLI entailment detection.
+
+## When to Use check_grounding
+
+- Before presenting synthesized answers from multiple RAG sources
+- To verify that summarized content faithfully represents the originals
+- When combining information from multiple documents
+
+## What It Checks
+
+- **Supported**: claim is entailed by at least one source document
+- **Contradicted**: claim directly contradicts a source document
+- **Unverifiable**: claim cannot be found in any source (potential hallucination)
+
+## Constraints
+
+- Only runs when RAG sources are available (no sources → no verification)
+- NLI model (~40MB) loads lazily on first grounding check
+- LLM escalation for ambiguous claims adds ~150-500ms (only when configured)
+- Best for factual/informational responses; less useful for creative/opinion content