@oriro/orirocli 0.1.11 → 0.1.12

package/skills/technical/cybersecurity-advanced/SKILL.md

@@ -1,99 +1,99 @@
----
-watermark: ORIRO
-name: cybersecurity-advanced
-provider: ORIRO.ai
-copyright: Copyright (c) 2026 ORIRO.ai
-description: >
-  Advanced cybersecurity — threat modeling, penetration testing concepts, incident
-  response, security operations, cloud security, and enterprise security programs.
-  Activate for questions about enterprise security, threat modeling, security
-  operations, incident response, or advanced security topics. Sources: NIST,
-  MITRE ATT&CK, OWASP, SANS Institute.
----
-
-# Advanced Cybersecurity
-
-## Threat modeling
-
-Process of identifying threats to a system before building or deploying it.
-**STRIDE model:**
-S — Spoofing (falsely claiming an identity)
-T — Tampering (modifying data without authorization)
-R — Repudiation (denying actions taken)
-I — Information disclosure (unauthorized data access)
-D — Denial of Service (making system unavailable)
-E — Elevation of Privilege (gaining unauthorized permissions)
-
-**Process:**
-
-1. Diagram the system (data flow diagram — components, data flows, trust boundaries)
-2. Identify threats using STRIDE per component
-3. Rate each threat (DREAD: Damage, Reproducibility, Exploitability, Affected users, Discoverability)
-4. Mitigate or accept each threat
-
-## MITRE ATT&CK Framework
-
-Comprehensive knowledge base of adversary tactics and techniques.
-**14 Tactics:** Reconnaissance → Resource Development → Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Command and Control → Exfiltration → Impact.
-Each tactic has multiple techniques (e.g., Initial Access: Phishing, Valid Accounts, Exploit Public-Facing Application).
-Use to: Evaluate security coverage, write detection rules, understand attack paths, conduct red team exercises.
-
-## Incident response lifecycle
-
-**Preparation:** IR plan, playbooks, tooling, team roles before incident occurs.
-**Detection and analysis:** Identify anomalies. Determine if it's a real incident.
-**Containment:** Short-term (isolate affected system) and long-term (prevent re-entry).
-**Eradication:** Remove malware, close entry point, patch vulnerability.
-**Recovery:** Restore systems from clean backups. Verify clean.
-**Post-incident activity:** Lessons learned, documentation, improve detection.
-
-**Critical rule:** Preserve evidence before containment when possible. Forensic evidence is volatile.
-
-## Security Operations Center (SOC)
-
-### SIEM (Security Information and Event Management)
-
-Aggregate logs from across the environment. Correlate events. Alert on suspicious patterns.
-Tools: Splunk, Microsoft Sentinel, Elastic SIEM, Sumo Logic.
-Key data sources: Firewall logs, endpoint logs, authentication logs, DNS logs, cloud trail logs.
-
-### Detection logic
-
-**Rules:** Known bad patterns (signature-based). Fast, high precision, misses unknowns.
-**Analytics:** Statistical baselines, anomaly detection. Catches unknowns but generates false positives.
-**Threat hunting:** Proactive searching for hidden threats. Hypothesis-driven.
-
-### Alert triage
-
-Tier 1: Initial alert review, false positive determination.
-Tier 2: Analysis, incident determination.
-Tier 3: Advanced analysis, threat hunting, remediation guidance.
-Mean Time to Detect (MTTD), Mean Time to Respond (MTTR) — key SOC metrics.
-
-## Cloud security
-
-### AWS security fundamentals
-
-**IAM (Identity and Access Management):**
-
-- Principle of least privilege: Only necessary permissions
-- Avoid using root account for anything routine
-- Use IAM roles for services (not access keys)
-- MFA for all human users, especially privileged accounts
-- Regular access key rotation (or eliminate in favor of roles)
-
-**CloudTrail:** All API calls logged. Enable in all regions. Immutable log storage.
-**Config:** Tracks resource configuration changes. Compliance rules.
-**GuardDuty:** Threat detection service. Analyzes CloudTrail, VPC Flow Logs, DNS logs.
-**Security Hub:** Centralized security findings from multiple services.
-
-### Common cloud misconfigurations
-
-- S3 bucket publicly accessible (check bucket policy AND block public access settings)
-- Security group inbound 0.0.0.0/0 on sensitive ports
-- IAM policies with \* permissions
-- Unencrypted data at rest
-- Publicly accessible databases
-- Lack of logging and monitoring
-
-Sources: MITRE ATT&CK (attack.mitre.org — free), NIST Cybersecurity Framework (nist.gov — free), OWASP (owasp.org — free), SANS Institute reading room (many free papers), AWS Security documentation (free)
+---
+watermark: ORIRO
+name: cybersecurity-advanced
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+  Advanced cybersecurity — threat modeling, penetration testing concepts, incident
+  response, security operations, cloud security, and enterprise security programs.
+  Activate for questions about enterprise security, threat modeling, security
+  operations, incident response, or advanced security topics. Sources: NIST,
+  MITRE ATT&CK, OWASP, SANS Institute.
+---
+
+# Advanced Cybersecurity
+
+## Threat modeling
+
+Process of identifying threats to a system before building or deploying it.
+**STRIDE model:**
+S — Spoofing (falsely claiming an identity)
+T — Tampering (modifying data without authorization)
+R — Repudiation (denying actions taken)
+I — Information disclosure (unauthorized data access)
+D — Denial of Service (making system unavailable)
+E — Elevation of Privilege (gaining unauthorized permissions)
+
+**Process:**
+
+1. Diagram the system (data flow diagram — components, data flows, trust boundaries)
+2. Identify threats using STRIDE per component
+3. Rate each threat (DREAD: Damage, Reproducibility, Exploitability, Affected users, Discoverability)
+4. Mitigate or accept each threat
+
+## MITRE ATT&CK Framework
+
+Comprehensive knowledge base of adversary tactics and techniques.
+**14 Tactics:** Reconnaissance → Resource Development → Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Command and Control → Exfiltration → Impact.
+Each tactic has multiple techniques (e.g., Initial Access: Phishing, Valid Accounts, Exploit Public-Facing Application).
+Use to: Evaluate security coverage, write detection rules, understand attack paths, conduct red team exercises.
+
+## Incident response lifecycle
+
+**Preparation:** IR plan, playbooks, tooling, team roles before incident occurs.
+**Detection and analysis:** Identify anomalies. Determine if it's a real incident.
+**Containment:** Short-term (isolate affected system) and long-term (prevent re-entry).
+**Eradication:** Remove malware, close entry point, patch vulnerability.
+**Recovery:** Restore systems from clean backups. Verify clean.
+**Post-incident activity:** Lessons learned, documentation, improve detection.
+
+**Critical rule:** Preserve evidence before containment when possible. Forensic evidence is volatile.
+
+## Security Operations Center (SOC)
+
+### SIEM (Security Information and Event Management)
+
+Aggregate logs from across the environment. Correlate events. Alert on suspicious patterns.
+Tools: Splunk, Microsoft Sentinel, Elastic SIEM, Sumo Logic.
+Key data sources: Firewall logs, endpoint logs, authentication logs, DNS logs, cloud trail logs.
+
+### Detection logic
+
+**Rules:** Known bad patterns (signature-based). Fast, high precision, misses unknowns.
+**Analytics:** Statistical baselines, anomaly detection. Catches unknowns but generates false positives.
+**Threat hunting:** Proactive searching for hidden threats. Hypothesis-driven.
+
+### Alert triage
+
+Tier 1: Initial alert review, false positive determination.
+Tier 2: Analysis, incident determination.
+Tier 3: Advanced analysis, threat hunting, remediation guidance.
+Mean Time to Detect (MTTD), Mean Time to Respond (MTTR) — key SOC metrics.
+
+## Cloud security
+
+### AWS security fundamentals
+
+**IAM (Identity and Access Management):**
+
+- Principle of least privilege: Only necessary permissions
+- Avoid using root account for anything routine
+- Use IAM roles for services (not access keys)
+- MFA for all human users, especially privileged accounts
+- Regular access key rotation (or eliminate in favor of roles)
+
+**CloudTrail:** All API calls logged. Enable in all regions. Immutable log storage.
+**Config:** Tracks resource configuration changes. Compliance rules.
+**GuardDuty:** Threat detection service. Analyzes CloudTrail, VPC Flow Logs, DNS logs.
+**Security Hub:** Centralized security findings from multiple services.
+
+### Common cloud misconfigurations
+
+- S3 bucket publicly accessible (check bucket policy AND block public access settings)
+- Security group inbound 0.0.0.0/0 on sensitive ports
+- IAM policies with \* permissions
+- Unencrypted data at rest
+- Publicly accessible databases
+- Lack of logging and monitoring
+
+Sources: MITRE ATT&CK (attack.mitre.org — free), NIST Cybersecurity Framework (nist.gov — free), OWASP (owasp.org — free), SANS Institute reading room (many free papers), AWS Security documentation (free)

package/skills/technical/data-engineering/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 ORIRO.ai
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/technical/data-engineering/SKILL.md

@@ -1,117 +1,117 @@
----
-watermark: ORIRO
-name: data-engineering
-provider: ORIRO.ai
-copyright: Copyright (c) 2026 ORIRO.ai
-description: >
-
-
-  Data engineering — data pipelines, ETL, data warehouses, data lakes, streaming, and building data infrastructure.
-
-
-  Sources: Technical documentation, public guidelines, industry best practices.
----
-
-# Data Engineering
-
-## The data stack
-
-### Ingestion
-
-**Batch:** Move data in periodic jobs (hourly, daily). Fivetran, Airbyte (open source), custom Python scripts.
-**Streaming:** Continuous data flow. Kafka, AWS Kinesis, Google Pub/Sub. For real-time analytics.
-**Change data capture (CDC):** Capture database changes as events. Debezium. Less latency than batch.
-
-### Storage
-
-**Data warehouse:** Structured data optimized for analytical queries. Snowflake, BigQuery, Redshift, DuckDB.
-**Data lake:** Raw data in any format. S3, GCS. Schema applied at query time (schema-on-read).
-**Lakehouse:** Combines warehouse and lake. Delta Lake, Apache Iceberg. ACID transactions on data lake.
-
-### Transformation
-
-**dbt (data build tool):** SQL-based transformations. Version controlled. Tests. Documentation. Industry standard.
-
-```sql
--- models/staging/stg_orders.sql
-with source as (
-    select * from {{ source('raw', 'orders') }}
-),
-renamed as (
-    select
-        id as order_id,
-        user_id,
-        created_at as ordered_at,
-        status,
-        total_cents / 100.0 as total_usd
-    from source
-    where created_at >= '2020-01-01'  -- Filter test data
-)
-select * from renamed
-```
-
-### Consumption
-
-**BI tools:** Metabase (open source), Looker, Tableau, Mode. Query warehouse directly.
-**APIs:** Expose aggregated data to application.
-**ML pipelines:** Prepare features for models.
-
-## Data modeling
-
-### Kimball dimensional modeling
-
-**Fact tables:** Business events with measurable metrics. Orders, page views, payments.
-**Dimension tables:** Context for facts. Users, products, dates.
-**Star schema:** Fact table in center, dimension tables surrounding. Optimized for analytical queries.
-
-```sql
--- Example star schema
--- Fact: daily_revenue
-SELECT
-    d.year, d.month, d.week,
-    u.country, u.plan,
-    p.category,
-    SUM(f.revenue_usd) as total_revenue,
-    COUNT(DISTINCT f.order_id) as order_count
-FROM fact_orders f
-JOIN dim_date d ON f.ordered_date = d.date
-JOIN dim_users u ON f.user_id = u.user_id
-JOIN dim_products p ON f.product_id = p.product_id
-WHERE d.year = 2024
-GROUP BY 1,2,3,4,5,6;
-```
-
-## Data quality
-
-**Tests in dbt:**
-
-```yaml
-# models/schema.yml
-models:
-  - name: stg_orders
-    columns:
-      - name: order_id
-        tests:
-          - unique
-          - not_null
-      - name: status
-        tests:
-          - accepted_values:
-              values: ["pending", "confirmed", "shipped", "delivered", "cancelled"]
-      - name: total_usd
-        tests:
-          - not_null
-          - dbt_utils.expression_is_true:
-              expression: ">= 0"
-```
-
-**Great Expectations:** More sophisticated data validation. Runs in pipeline, blocks bad data.
-
-## Data governance
-
-**Catalog:** Document what data exists, what it means, who owns it. Alation, Amundsen (open source).
-**Lineage:** Track where data comes from and where it goes. Know impact before changing.
-**Access control:** Row-level security for sensitive data (PII). Column masking.
-**PII handling:** Identify, classify, and protect personal data. Often separate to comply with GDPR/CCPA.
-
-Sources: dbt documentation (docs.getdbt.com — free), BigQuery documentation (free), Kimball Group data warehouse toolkit (principles), Fivetran blog (free), Airbyte documentation (free)
+---
+watermark: ORIRO
+name: data-engineering
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+
+
+  Data engineering — data pipelines, ETL, data warehouses, data lakes, streaming, and building data infrastructure.
+
+
+  Sources: Technical documentation, public guidelines, industry best practices.
+---
+
+# Data Engineering
+
+## The data stack
+
+### Ingestion
+
+**Batch:** Move data in periodic jobs (hourly, daily). Fivetran, Airbyte (open source), custom Python scripts.
+**Streaming:** Continuous data flow. Kafka, AWS Kinesis, Google Pub/Sub. For real-time analytics.
+**Change data capture (CDC):** Capture database changes as events. Debezium. Less latency than batch.
+
+### Storage
+
+**Data warehouse:** Structured data optimized for analytical queries. Snowflake, BigQuery, Redshift, DuckDB.
+**Data lake:** Raw data in any format. S3, GCS. Schema applied at query time (schema-on-read).
+**Lakehouse:** Combines warehouse and lake. Delta Lake, Apache Iceberg. ACID transactions on data lake.
+
+### Transformation
+
+**dbt (data build tool):** SQL-based transformations. Version controlled. Tests. Documentation. Industry standard.
+
+```sql
+-- models/staging/stg_orders.sql
+with source as (
+    select * from {{ source('raw', 'orders') }}
+),
+renamed as (
+    select
+        id as order_id,
+        user_id,
+        created_at as ordered_at,
+        status,
+        total_cents / 100.0 as total_usd
+    from source
+    where created_at >= '2020-01-01'  -- Filter test data
+)
+select * from renamed
+```
+
+### Consumption
+
+**BI tools:** Metabase (open source), Looker, Tableau, Mode. Query warehouse directly.
+**APIs:** Expose aggregated data to application.
+**ML pipelines:** Prepare features for models.
+
+## Data modeling
+
+### Kimball dimensional modeling
+
+**Fact tables:** Business events with measurable metrics. Orders, page views, payments.
+**Dimension tables:** Context for facts. Users, products, dates.
+**Star schema:** Fact table in center, dimension tables surrounding. Optimized for analytical queries.
+
+```sql
+-- Example star schema
+-- Fact: daily_revenue
+SELECT
+    d.year, d.month, d.week,
+    u.country, u.plan,
+    p.category,
+    SUM(f.revenue_usd) as total_revenue,
+    COUNT(DISTINCT f.order_id) as order_count
+FROM fact_orders f
+JOIN dim_date d ON f.ordered_date = d.date
+JOIN dim_users u ON f.user_id = u.user_id
+JOIN dim_products p ON f.product_id = p.product_id
+WHERE d.year = 2024
+GROUP BY 1,2,3,4,5,6;
+```
+
+## Data quality
+
+**Tests in dbt:**
+
+```yaml
+# models/schema.yml
+models:
+  - name: stg_orders
+    columns:
+      - name: order_id
+        tests:
+          - unique
+          - not_null
+      - name: status
+        tests:
+          - accepted_values:
+              values: ["pending", "confirmed", "shipped", "delivered", "cancelled"]
+      - name: total_usd
+        tests:
+          - not_null
+          - dbt_utils.expression_is_true:
+              expression: ">= 0"
+```
+
+**Great Expectations:** More sophisticated data validation. Runs in pipeline, blocks bad data.
+
+## Data governance
+
+**Catalog:** Document what data exists, what it means, who owns it. Alation, Amundsen (open source).
+**Lineage:** Track where data comes from and where it goes. Know impact before changing.
+**Access control:** Row-level security for sensitive data (PII). Column masking.
+**PII handling:** Identify, classify, and protect personal data. Often separate to comply with GDPR/CCPA.
+
+Sources: dbt documentation (docs.getdbt.com — free), BigQuery documentation (free), Kimball Group data warehouse toolkit (principles), Fivetran blog (free), Airbyte documentation (free)

package/skills/technical/database-design/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 ORIRO.ai
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.