@oriro/orirocli 0.1.0

package/skills/technical/auth-security/SKILL.md

@@ -0,0 +1,209 @@
+---
+watermark: ORIRO
+name: auth-security
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+  Authentication, authorization, and web security — OWASP Top 10, JWT, OAuth,
+  password hashing, HTTPS, CORS, CSP, and security best practices. Activate
+  for questions about securing a web application, implementing auth, preventing
+  attacks, or any security question. Sources: OWASP, NIST, security documentation.
+---
+
+# Authentication, Authorization, and Web Security
+
+## OWASP Top 10 (2021) — most critical web risks
+
+### A01 Broken Access Control
+
+Most common vulnerability. Users can access data/functions they shouldn't.
+**Prevention:** Deny by default. Check authorization on every request (not just the UI). Never trust client-supplied IDs for ownership.
+
+```ts
+// WRONG: Trust client's claimed userId
+const data = await db.post.findUnique({ where: { id: req.params.postId } });
+
+// CORRECT: Verify ownership
+const data = await db.post.findUnique({
+  where: { id: req.params.postId, userId: session.userId },
+});
+if (!data) return res.status(404).json({ error: "Not found" });
+```
+
+### A02 Cryptographic Failures
+
+Sensitive data exposed due to weak/missing encryption.
+**Prevention:** HTTPS everywhere. Encrypt sensitive data at rest. Use strong algorithms (AES-256, SHA-256+). Never MD5/SHA-1 for passwords.
+
+### A03 Injection (SQL, Command, LDAP)
+
+Attacker-controlled input executed as commands.
+**Prevention:** Parameterized queries always. Never string-concatenate SQL.
+
+```ts
+// VULNERABLE:
+const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);
+
+// SAFE:
+const user = await db.query("SELECT * FROM users WHERE email = $1", [email]);
+// Or use ORM (Prisma, Drizzle) which always parameterizes
+```
+
+### A07 Identification and Authentication Failures
+
+Weak authentication mechanisms.
+**Prevention:** Multi-factor authentication. Secure password requirements. Rate limit login attempts. Secure session management.
+
+## Password security
+
+### Hashing (NEVER store plaintext passwords)
+
+```ts
+import bcrypt from "bcryptjs";
+
+// Storing a password
+const saltRounds = 12; // Higher = slower = more secure (10-14 typical)
+const hash = await bcrypt.hash(password, saltRounds);
+
+// Verifying
+const isValid = await bcrypt.compare(inputPassword, storedHash);
+```
+
+**Use bcrypt, Argon2, or scrypt.** Never MD5, SHA-1, or SHA-256 for passwords (too fast — easy to brute force).
+**Argon2id** is the current best recommendation (winner of Password Hashing Competition).
+
+### Password requirements (NIST SP 800-63B)
+
+Minimum 8 characters. No complexity requirements (they reduce entropy). Block known breached passwords. Allow all Unicode.
+Longer passphrases > complex short passwords.
+
+## JWT security
+
+### Common mistakes
+
+```ts
+// NEVER: Decode without verification
+const payload = JSON.parse(atob(token.split(".")[1])); // NO! Not verified.
+
+// CORRECT: Verify and decode
+import jwt from "jsonwebtoken";
+const payload = jwt.verify(token, process.env.JWT_SECRET); // Throws on invalid
+
+// NEVER: Store sensitive data in JWT payload (it's base64 encoded, not encrypted)
+// JWT payload is visible to anyone — don't put passwords, SSNs, etc.
+
+// ALWAYS: Set reasonable expiry
+const token = jwt.sign({ userId }, secret, { expiresIn: "15m" });
+```
+
+### Token storage
+
+**Access token:** Memory (React state) or httpOnly cookie. NOT localStorage (XSS vulnerable).
+**Refresh token:** httpOnly, Secure, SameSite=Strict cookie only.
+
+## HTTPS and transport security
+
+### TLS/HTTPS
+
+**HSTS (HTTP Strict Transport Security):**
+
+```
+Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+```
+
+Forces HTTPS. Prevents downgrade attacks.
+
+**Certificate management:** Use Let's Encrypt (free) or cloud provider certificates. Auto-renew.
+
+## Security headers
+
+```
+Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'
+X-Frame-Options: DENY
+X-Content-Type-Options: nosniff
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: camera=(), microphone=(), geolocation=()
+```
+
+**CSP:** Content Security Policy prevents XSS by controlling which scripts can execute.
+
+## CORS (Cross-Origin Resource Sharing)
+
+Browser security model. APIs must explicitly allow cross-origin requests.
+
+```ts
+// Express CORS
+import cors from "cors";
+app.use(
+  cors({
+    origin: ["https://myapp.com", "https://www.myapp.com"],
+    credentials: true,
+    methods: ["GET", "POST", "PATCH", "DELETE"],
+  }),
+);
+
+// Never: origin: '*' with credentials: true
+// Never: origin: '*' for APIs with sensitive data
+```
+
+## Authorization patterns
+
+### RBAC (Role-Based Access Control)
+
+Assign users to roles. Roles have permissions.
+
+```ts
+const permissions = {
+  admin: ["read", "write", "delete", "manage_users"],
+  editor: ["read", "write"],
+  viewer: ["read"],
+};
+
+function can(user: User, action: string): boolean {
+  return permissions[user.role]?.includes(action) ?? false;
+}
+```
+
+### ABAC (Attribute-Based Access Control)
+
+More granular. Decisions based on attributes of user, resource, and environment.
+
+```ts
+function canEditPost(user: User, post: Post): boolean {
+  return post.authorId === user.id || user.role === "admin";
+}
+```
+
+## Common attack prevention
+
+### XSS (Cross-Site Scripting)
+
+Never `innerHTML` with user content. Use framework's rendering (React auto-escapes).
+Sanitize HTML if you must render it (use DOMPurify).
+CSP headers as defense-in-depth.
+
+### CSRF (Cross-Site Request Forgery)
+
+SameSite=Strict or Lax cookies prevent most CSRF.
+CSRF tokens for additional protection.
+
+### Rate limiting
+
+```ts
+import rateLimit from "express-rate-limit";
+
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 5, // 5 attempts per window
+  message: { error: "Too many login attempts" },
+});
+app.post("/auth/login", loginLimiter, loginHandler);
+```
+
+### SQL injection (parameterized queries — see above)
+
+### Dependency security
+
+`npm audit` regularly. Dependabot/Renovate for automated updates. Pin major versions.
+
+Sources: OWASP Top 10 (owasp.org — free), NIST SP 800-63B (free), MDN Web Security (free), Auth0 security blog (free), Have I Been Pwned API (free for breach checking)

package/skills/technical/blockchain-web3/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/technical/blockchain-web3/SKILL.md

@@ -0,0 +1,84 @@
+---
+watermark: ORIRO
+disable-model-invocation: true
+name: blockchain-web3
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+  Blockchain and Web3 — consensus mechanisms, smart contracts, Ethereum/Solidity,
+  DeFi, NFTs, and practical blockchain development. Sources: Ethereum documentation
+  (CC-BY-SA), Solidity docs (GPL), OpenZeppelin (MIT).
+---
+
+# Blockchain and Web3 Development
+
+## Blockchain fundamentals
+
+### How a blockchain works
+
+Linked blocks: Each block contains hash of previous block + transactions + timestamp + nonce.
+Changing any block invalidates all subsequent blocks.
+**Immutability** comes from this chained structure, not encryption.
+
+### Consensus mechanisms
+
+**Proof of Work (PoW):** Bitcoin. Miners solve computational puzzle. Energy intensive.
+**Proof of Stake (PoS):** Ethereum (post-Merge). Validators stake ETH. Energy efficient (~99.95% less energy than PoW).
+**Delegated PoS:** Token holders vote for validators. Faster but more centralized.
+
+## Ethereum and smart contracts
+
+### Smart contracts
+
+Self-executing code on the blockchain. Code is law.
+Deployed once, immutable (unless using proxy patterns).
+**Gas:** Computation fee. ETH burned since EIP-1559 (Aug 2021).
+
+### Solidity basics
+
+```solidity
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+contract SimpleToken {
+    mapping(address => uint256) public balances;
+    uint256 public totalSupply;
+
+    constructor(uint256 _supply) {
+        totalSupply = _supply;
+        balances[msg.sender] = _supply;
+    }
+
+    function transfer(address _to, uint256 _amount) public {
+        require(balances[msg.sender] >= _amount, "Insufficient balance");
+        balances[msg.sender] -= _amount;
+        balances[_to] += _amount;
+    }
+}
+```
+
+**Data types:** uint256, address, bool, string, bytes32.
+**Visibility:** public, private, internal, external.
+**State variables** cost gas to write. Local variables are free.
+
+## Token standards
+
+**ERC-20:** Fungible tokens. Most DeFi tokens. transferFrom, approve, allowance.
+**ERC-721:** Non-fungible tokens (NFTs). Each token has unique ID.
+**ERC-1155:** Multi-token standard. Mix fungible and NFT in one contract.
+
+## DeFi primitives
+
+**DEX (Decentralized Exchange):** Uniswap AMM model. x × y = k constant product formula.
+**Lending protocols:** Aave, Compound. Overcollateralized loans. Health factor triggers liquidation.
+**Yield farming:** Provide liquidity → receive trading fees + token rewards.
+
+## Development tools
+
+**Hardhat:** Local Ethereum development. Testing in TypeScript/JavaScript.
+**Foundry:** Rust-based. Fast testing in Solidity.
+**OpenZeppelin:** Audited contract templates. Use instead of writing from scratch.
+**Wagmi/viem:** React hooks for Ethereum frontend.
+
+Sources: Ethereum documentation (ethereum.org — CC-BY-SA, free),
+Solidity docs (docs.soliditylang.org — GPL, free), OpenZeppelin docs (MIT, free)

package/skills/technical/cloud-architecture/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/technical/cloud-architecture/SKILL.md

@@ -0,0 +1,85 @@
+---
+watermark: ORIRO
+name: cloud-architecture
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+
+  Cloud architecture — serverless, containers, managed services, cost optimization, availability, and cloud design patterns.
+
+
+
+  Sources: Technical documentation, public guidelines, industry best practices.
+---
+
+# Cloud Architecture
+
+## Serverless vs. containers vs. VMs
+
+|                | Serverless                     | Containers                   | VMs                |
+| -------------- | ------------------------------ | ---------------------------- | ------------------ |
+| **Startup**    | Cold starts (ms-s)             | Fast (ms)                    | Slow (min)         |
+| **Scale**      | 0 to ∞ automatically           | Scale to preset max          | Manual or auto     |
+| **Cost model** | Per invocation                 | Per running container        | Per hour running   |
+| **Management** | None                           | Some                         | Most               |
+| **Best for**   | Event-driven, variable traffic | Stateful apps, microservices | Legacy, compliance |
+
+## Serverless patterns (AWS Lambda / Cloud Run / Vercel Functions)
+
+**When to use:**
+
+- Intermittent or unpredictable traffic
+- Event-driven workloads (file uploads, webhooks)
+- APIs that scale to zero (dev/staging environments)
+
+**When NOT to use:**
+
+- Persistent connections (WebSockets)
+- Long-running jobs (> 15 min for Lambda)
+- Workloads where cold start latency is unacceptable
+
+**Cold start mitigation:** Provisioned concurrency (Lambda), minimum instances (Cloud Run), ping-based warming.
+
+## Key design principles
+
+### High availability
+
+**Multi-AZ deployment:** Replicate across availability zones. Single zone outage (common) = no downtime.
+**Health checks + auto-replacement:** Load balancer removes unhealthy instances. Auto-scaling replaces them.
+**Circuit breakers:** When a downstream service is unhealthy, stop calling it. Fail fast. Retry with backoff.
+
+### Stateless design
+
+Applications should be stateless — any instance can handle any request.
+State stored in: Database, Redis, S3 — NOT in application memory.
+Enables: Horizontal scaling, easy replacement of instances.
+
+### Database patterns for cloud
+
+**Managed databases:** RDS, Cloud SQL, Aurora, PlanetScale. Handles backups, patching, failover.
+**Read replicas:** Scale reads. Primary handles writes.
+**Connection pooling (critical):** PgBouncer or Prisma Data Proxy. Lambda functions must use connection pooling (each invocation opens a new connection otherwise → connection exhaustion).
+**Multi-region:** Active-active (complex) or active-passive (simpler, some recovery time).
+
+## Cost optimization
+
+### Right-sizing
+
+Start with the smallest instance that meets performance requirements.
+Benchmark first. Scale when metrics show the need.
+Reserved instances (1-3 year commitment) for predictable base load: 30-60% savings vs. on-demand.
+Spot instances for fault-tolerant batch workloads: 70-90% savings.
+
+### Storage tiering
+
+S3 Intelligent-Tiering: Automatically moves objects to cheaper storage based on access patterns.
+Archive cold data to Glacier ($0.004/GB vs $0.023/GB Standard).
+Delete what you don't need (surprising how often this is forgotten).
+
+### Architecture for cost
+
+CDN + static assets: Serve from CDN, not from compute.
+Background jobs: Use spot instances or serverless for async work.
+Caching: Redis reduces database calls and compute.
+
+Sources: AWS Well-Architected Framework (aws.amazon.com/architecture/well-architected — free), GCP best practices (cloud.google.com/architecture — free), Azure Architecture Center (free), Cloudflare architecture blog (free)

package/skills/technical/content-platform/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/technical/content-platform/SKILL.md

@@ -0,0 +1,134 @@
+---
+watermark: ORIRO
+disable-model-invocation: true
+name: content-platform
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+
+
+
+
+  Content platform development — CMS, media management, publishing workflows, SEO, and content delivery.
+
+  Sources: Stripe docs, Anthropic docs, Sanity/Contentful docs, industry-specific technical resources.
+---
+
+# Content Platform Development
+
+## CMS architecture
+
+### Headless CMS vs. traditional
+
+**Traditional (WordPress):** CMS manages content AND presentation. Coupled.
+**Headless:** CMS manages content only. Exposes content via API. Frontend is separate.
+**Benefits of headless:** Use any frontend framework. Better performance. Multi-channel (web, mobile, voice, IoT).
+
+### Headless CMS options
+
+**Sanity:** Flexible content modeling. Real-time collaboration. GROQ query language. Generous free tier.
+**Contentful:** Enterprise-grade. Strong CDN. Good API.
+**Strapi:** Self-hosted (open source) or cloud. Full customization.
+**Payload:** Code-first headless CMS. TypeScript native. Self-hosted. Growing fast.
+**Directus:** Database-first. Wraps existing database.
+**Notion as CMS:** Via Notion API for simple blogs. Limited but no setup.
+
+### Content modeling (Sanity example)
+
+```ts
+// schemas/post.ts
+export default {
+  name: "post",
+  title: "Blog Post",
+  type: "document",
+  fields: [
+    { name: "title", title: "Title", type: "string", validation: (Rule) => Rule.required() },
+    { name: "slug", title: "Slug", type: "slug", options: { source: "title" } },
+    { name: "publishedAt", title: "Published At", type: "datetime" },
+    { name: "author", title: "Author", type: "reference", to: [{ type: "author" }] },
+    { name: "mainImage", title: "Main Image", type: "image", options: { hotspot: true } },
+    {
+      name: "categories",
+      title: "Categories",
+      type: "array",
+      of: [{ type: "reference", to: [{ type: "category" }] }],
+    },
+    { name: "body", title: "Body", type: "array", of: [{ type: "block" }, { type: "image" }] },
+  ],
+};
+```
+
+## Media management
+
+### Image optimization
+
+```tsx
+// Next.js Image component handles optimization automatically
+import Image from "next/image";
+
+<Image
+  src={imageSrc}
+  alt="Description"
+  width={800}
+  height={450}
+  priority // For above-the-fold images
+  placeholder="blur"
+  blurDataURL={blurDataUrl}
+/>;
+```
+
+**CDN:** Cloudflare Images, Vercel Image Optimization, Cloudinary (transform on-the-fly).
+**Formats:** WebP for photos (25-35% smaller than JPEG). AVIF even smaller but less support.
+**Responsive images:** Different sizes for different screen widths. srcset attribute.
+**Lazy loading:** `loading="lazy"` for below-fold images. Native browser support.
+
+### Video
+
+**Upload:** Direct to Cloudflare Stream, Mux, or Vimeo.
+**Never:** Serve raw video from your own servers at scale.
+**HLS (HTTP Live Streaming):** Adaptive bitrate. Player downloads appropriate quality based on bandwidth.
+**Thumbnails:** Auto-generate at upload. Store in CDN.
+
+## Publishing workflows
+
+### Draft/Published state
+
+```prisma
+model Post {
+  id          String     @id @default(cuid())
+  status      PostStatus @default(DRAFT)  // DRAFT, REVIEW, PUBLISHED, ARCHIVED
+  publishedAt DateTime?
+  scheduledFor DateTime? // Future publish
+}
+```
+
+### Content versioning
+
+Store all edits. Allow rollback to any previous version. Show diff between versions.
+Simple: Store JSON snapshots in a revisions table with authorId and timestamp.
+
+## SEO implementation
+
+```tsx
+// Next.js metadata API
+export async function generateMetadata({ params }): Promise<Metadata> {
+  const post = await getPost(params.slug);
+  return {
+    title: post.title,
+    description: post.excerpt,
+    openGraph: {
+      title: post.title,
+      description: post.excerpt,
+      images: [{ url: post.mainImage.url, width: 1200, height: 630 }],
+    },
+    twitter: { card: "summary_large_image", title: post.title },
+  };
+}
+```
+
+**Structured data (JSON-LD):** Article, BreadcrumbList, FAQPage schemas.
+**Sitemap:** Auto-generated. Include all published content. Update on publish.
+**RSS feed:** Still important for readers and podcast aggregators.
+**Robots.txt:** Control crawler access.
+
+Sources: Sanity documentation (sanity.io/docs — free), Next.js docs (nextjs.org/docs — free), MDN SEO guide (free), web.dev SEO (free)

package/skills/technical/cybersecurity-advanced/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.