opencode-skills-antigravity 1.0.31 → 1.0.33

package/bundled-skills/documentation-generation-doc-generate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: documentation-generation-doc-generate
 description: "You are a documentation expert specializing in creating comprehensive, maintainable documentation from code. Generate API docs, architecture diagrams, user guides, and technical references using AI-powered analysis and industry best practices."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/documentation-templates/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: documentation-templates
 description: "Documentation templates and structure guidelines. README, API docs, code comments, and AI-friendly documentation."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/docx/ooxml/scripts/unpack.py

@@ -2,22 +2,47 @@
 """Unpack and format XML contents of Office files (.docx, .pptx, .xlsx)"""
 
 import random
+import shutil
+import stat
 import sys
 import zipfile
 from pathlib import Path
 
 
+def _is_zip_symlink(member: zipfile.ZipInfo) -> bool:
+    return stat.S_ISLNK(member.external_attr >> 16)
+
+
+def _is_safe_destination(output_root: Path, member_name: str) -> bool:
+    destination = output_root / member_name
+    return destination.resolve().is_relative_to(output_root.resolve())
+
+
+def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_root: Path):
+    destination = output_root / member.filename
+    if member.is_dir():
+        destination.mkdir(parents=True, exist_ok=True)
+        return
+
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    with archive.open(member, "r") as source, open(destination, "wb") as target:
+        shutil.copyfileobj(source, target)
+
+
 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
     output_path = Path(output_dir)
     output_path.mkdir(parents=True, exist_ok=True)
+    output_root = output_path.resolve()
 
     with zipfile.ZipFile(input_file) as archive:
         for member in archive.infolist():
-            destination = output_path / member.filename
-            if not destination.resolve().is_relative_to(output_path.resolve()):
+            if _is_zip_symlink(member):
+                raise ValueError(f"Unsafe archive entry: {member.filename}")
+            if not _is_safe_destination(output_root, member.filename):
                 raise ValueError(f"Unsafe archive entry: {member.filename}")
 
-        archive.extractall(output_path)
+        for member in archive.infolist():
+            _extract_member(archive, member, output_path)
 
 
 def pretty_print_xml(output_path: Path):

package/bundled-skills/docx-official/ooxml/scripts/unpack.py

@@ -2,22 +2,47 @@
 """Unpack and format XML contents of Office files (.docx, .pptx, .xlsx)"""
 
 import random
+import shutil
+import stat
 import sys
 import zipfile
 from pathlib import Path
 
 
+def _is_zip_symlink(member: zipfile.ZipInfo) -> bool:
+    return stat.S_ISLNK(member.external_attr >> 16)
+
+
+def _is_safe_destination(output_root: Path, member_name: str) -> bool:
+    destination = output_root / member_name
+    return destination.resolve().is_relative_to(output_root.resolve())
+
+
+def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_root: Path):
+    destination = output_root / member.filename
+    if member.is_dir():
+        destination.mkdir(parents=True, exist_ok=True)
+        return
+
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    with archive.open(member, "r") as source, open(destination, "wb") as target:
+        shutil.copyfileobj(source, target)
+
+
 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
     output_path = Path(output_dir)
     output_path.mkdir(parents=True, exist_ok=True)
+    output_root = output_path.resolve()
 
     with zipfile.ZipFile(input_file) as archive:
         for member in archive.infolist():
-            destination = output_path / member.filename
-            if not destination.resolve().is_relative_to(output_path.resolve()):
+            if _is_zip_symlink(member):
+                raise ValueError(f"Unsafe archive entry: {member.filename}")
+            if not _is_safe_destination(output_root, member.filename):
                 raise ValueError(f"Unsafe archive entry: {member.filename}")
 
-        archive.extractall(output_path)
+        for member in archive.infolist():
+            _extract_member(archive, member, output_path)
 
 
 def pretty_print_xml(output_path: Path):

package/bundled-skills/dotnet-backend-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dotnet-backend-patterns
 description: "Master C#/.NET patterns for building production-grade APIs, MCP servers, and enterprise backends with modern best practices (2024/2025)."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/dropbox-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dropbox-automation
 description: "Automate Dropbox file management, sharing, search, uploads, downloads, and folder operations via Rube MCP (Composio). Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/e2e-testing-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: e2e-testing-patterns
 description: "Build reliable, fast, and maintainable end-to-end test suites that provide confidence to ship code quickly and catch regressions before users do."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/email-systems/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: email-systems
 description: "You are an email systems engineer who has maintained 99.9% deliverability across millions of emails. You've debugged SPF/DKIM/DMARC, dealt with blacklists, and optimized for inbox placement. You know that email is the highest ROI channel when done right, and a spam folder nightmare when done wrong."
-risk: unknown
+risk: none
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: '2026-02-27'
 ---

package/bundled-skills/employment-contract-templates/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: employment-contract-templates
 description: "Templates and patterns for creating legally sound employment documentation including contracts, offer letters, and HR policies."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/error-debugging-error-analysis/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-debugging-error-analysis
 description: "You are an expert error analysis specialist with deep expertise in debugging distributed systems, analyzing production incidents, and implementing comprehensive observability solutions."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/error-debugging-error-trace/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-debugging-error-trace
 description: "You are an error tracking and observability expert specializing in implementing comprehensive error monitoring solutions. Set up error tracking systems, configure alerts, implement structured logging, and ensure teams can quickly identify and resolve production issues."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/error-detective/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-detective
 description: Search logs and codebases for error patterns, stack traces, and anomalies. Correlates errors across systems and identifies root causes.
-risk: unknown
+risk: safe
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/error-diagnostics-error-analysis/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-diagnostics-error-analysis
 description: "You are an expert error analysis specialist with deep expertise in debugging distributed systems, analyzing production incidents, and implementing comprehensive observability solutions."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/error-diagnostics-error-trace/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-diagnostics-error-trace
 description: "You are an error tracking and observability expert specializing in implementing comprehensive error monitoring solutions. Set up error tracking systems, configure alerts, implement structured logging,"
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/error-handling-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-handling-patterns
 description: "Build resilient applications with robust error handling strategies that gracefully handle failures and provide excellent debugging experiences."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/evolution/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: evolution
 description: "This skill enables makepad-skills to self-improve continuously during development."
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/fda-food-safety-auditor/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fda-food-safety-auditor
 description: "Expert AI auditor for FDA Food Safety (FSMA), HACCP, and PCQI compliance. Reviews food facility records and preventive controls."
-risk: unknown
+risk: safe
 source: community
 ---
 

package/bundled-skills/figma-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: figma-automation
 description: "Automate Figma tasks via Rube MCP (Composio): files, components, design tokens, comments, exports. Always search tools first for current schemas."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/file-path-traversal/SKILL.md

@@ -1,12 +1,14 @@
 ---
 name: file-path-traversal
 description: "Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code."
-risk: unknown
+risk: offensive
 source: community
 author: zebbern
 date_added: "2026-02-27"
 ---
 
+> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
+
 # File Path Traversal Testing
 
 ## Purpose

package/bundled-skills/file-uploads/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: file-uploads
 description: "Careful about security and performance. Never trusts file extensions. Knows that large uploads need special handling. Prefers presigned URLs over server proxying."
-risk: unknown
+risk: none
 source: "vibeship-spawner-skills (Apache 2.0)"
 date_added: "2026-02-27"
 ---

package/bundled-skills/finishing-a-development-branch/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: finishing-a-development-branch
 description: "Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/fixing-metadata/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fixing-metadata
 description: "Audit and fix HTML metadata including page titles, meta descriptions, canonical URLs, Open Graph tags, Twitter cards, favicons, JSON-LD structured data, and robots directives. Use when adding or reviewing SEO and social metadata."
-risk: unknown
+risk: safe
 source: community
 version: 1.0.1
 license: MIT

package/bundled-skills/fixing-motion-performance/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fixing-motion-performance
 description: Audit and fix animation performance issues including layout thrashing, compositor properties, scroll-linked motion, and blur effects. Use when animations stutter, transitions jank, or reviewing CSS/JS animation performance.
-risk: unknown
+risk: safe
 source: community
 ---
 

package/bundled-skills/fp-types-ref/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fp-types-ref
 description: Quick reference for fp-ts types. Use when user asks which type to use, needs Option/Either/Task decision help, or wants fp-ts imports.
-risk: unknown
+risk: safe
 source: community
 version: 1.0.0
 tags: [fp-ts, typescript, quick-reference, option, either, task]

package/bundled-skills/framework-migration-code-migrate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: framework-migration-code-migrate
 description: "You are a code migration expert specializing in transitioning codebases between frameworks, languages, versions, and platforms. Generate comprehensive migration plans, automated migration scripts, and"
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/framework-migration-deps-upgrade/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: framework-migration-deps-upgrade
 description: "You are a dependency management expert specializing in safe, incremental upgrades of project dependencies. Plan and execute dependency updates with minimal risk, proper testing, and clear migration pa"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/freshdesk-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: freshdesk-automation
 description: "Automate Freshdesk helpdesk operations including tickets, contacts, companies, notes, and replies via Rube MCP (Composio). Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/freshservice-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: freshservice-automation
 description: "Automate Freshservice ITSM tasks via Rube MCP (Composio): create/update tickets, bulk operations, service requests, and outbound emails. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/game-development/2d-games/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: 2d-games
 description: "2D game development principles. Sprites, tilemaps, physics, camera."
-risk: unknown
+risk: none
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/game-development/mobile-games/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mobile-games
 description: "Mobile game development principles. Touch input, battery, performance, app stores."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/game-development/pc-games/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pc-games
 description: "PC and console game development principles. Engine selection, platform features, optimization strategies."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/gdpr-data-handling/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gdpr-data-handling
 description: "Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/gh-review-requests/SKILL.md

@@ -2,7 +2,7 @@
 name: gh-review-requests
 description: Fetch unread GitHub notifications for open PRs where review is requested from a specified team or opened by a team member. Use when asked to "find PRs I need to review", "show my review requests", "what needs my review", "fetch GitHub review requests", or "check team review queue".
 allowed-tools: Bash
-risk: unknown
+risk: safe
 source: community
 ---
 

package/bundled-skills/git-advanced-workflows/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: git-advanced-workflows
 description: "Master advanced Git techniques to maintain clean history, collaborate effectively, and recover from any situation with confidence."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/git-pr-workflows-git-workflow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: git-pr-workflows-git-workflow
 description: "Orchestrate a comprehensive git workflow from code review through PR creation, leveraging specialized agents for quality assurance, testing, and deployment readiness. This workflow implements modern g"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/git-pr-workflows-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: git-pr-workflows-onboard
 description: "You are an **expert onboarding specialist and knowledge transfer architect** with deep experience in remote-first organizations, technical team integration, and accelerated learning methodologies. You"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/git-pushing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: git-pushing
 description: "Stage all changes, create a conventional commit, and push to the remote branch. Use when explicitly asks to push changes (\"push this\", \"commit and push\"), mentions saving work to remote (\"save to github\", \"push to remote\"), or completes a feature and wants to share it."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/github-actions-templates/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-actions-templates
 description: "Production-ready GitHub Actions workflow patterns for testing, building, and deploying applications."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/github-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-automation
 description: "Automate GitHub repositories, issues, pull requests, branches, CI/CD, and permissions via Rube MCP (Composio). Manage code workflows, review PRs, search code, and handle deployments programmatically."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/github-workflow-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-workflow-automation
 description: "Patterns for automating GitHub workflows with AI assistance, inspired by [Gemini CLI](https://github.com/google-gemini/gemini-cli) and modern DevOps practices."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/gitlab-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gitlab-automation
 description: "Automate GitLab project management, issues, merge requests, pipelines, branches, and user operations via Rube MCP (Composio). Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/gitlab-ci-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gitlab-ci-patterns
 description: "Comprehensive GitLab CI/CD pipeline patterns for automated testing, building, and deployment."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/gitops-workflow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gitops-workflow
 description: "Complete guide to implementing GitOps workflows with ArgoCD and Flux for automated Kubernetes deployments."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/gmail-automation/SKILL.md

@@ -2,7 +2,7 @@
 name: gmail-automation
 description: "Lightweight Gmail integration with standalone OAuth authentication. No MCP server required."
 license: Apache-2.0
-risk: unknown
+risk: critical
 source: community
 metadata:
   author: sanjay3290

package/bundled-skills/go-concurrency-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: go-concurrency-patterns
 description: "Master Go concurrency with goroutines, channels, sync primitives, and context. Use when building concurrent Go applications, implementing worker pools, or debugging race conditions."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/godot-gdscript-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: godot-gdscript-patterns
 description: "Master Godot 4 GDScript patterns including signals, scenes, state machines, and optimization. Use when building Godot games, implementing game systems, or learning GDScript best practices."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/google-analytics-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: google-analytics-automation
 description: "Automate Google Analytics tasks via Rube MCP (Composio): run reports, list accounts/properties, funnels, pivots, key events. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/google-calendar-automation/SKILL.md

@@ -2,7 +2,7 @@
 name: google-calendar-automation
 description: "Lightweight Google Calendar integration with standalone OAuth authentication. No MCP server required."
 license: Apache-2.0
-risk: unknown
+risk: critical
 source: community
 metadata:
   author: sanjay3290

package/bundled-skills/google-docs-automation/SKILL.md

@@ -2,7 +2,7 @@
 name: google-docs-automation
 description: "Lightweight Google Docs integration with standalone OAuth authentication. No MCP server required."
 license: Apache-2.0
-risk: unknown
+risk: critical
 source: community
 metadata:
   author: sanjay3290

package/bundled-skills/google-drive-automation/SKILL.md

@@ -2,7 +2,7 @@
 name: google-drive-automation
 description: "Lightweight Google Drive integration with standalone OAuth authentication. No MCP server required. Full read/write access."
 license: Apache-2.0
-risk: unknown
+risk: critical
 source: community
 metadata:
   author: sanjay3290

package/bundled-skills/google-sheets-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: google-sheets-automation
 description: "Lightweight Google Sheets integration with standalone OAuth authentication. No MCP server required. Full read/write access."
-risk: unknown
+risk: critical
 source: community
 license: Apache-2.0
 metadata:

package/bundled-skills/google-slides-automation/SKILL.md

@@ -2,7 +2,7 @@
 name: google-slides-automation
 description: "Lightweight Google Slides integration with standalone OAuth authentication. No MCP server required. Full read/write access."
 license: Apache-2.0
-risk: unknown
+risk: critical
 source: community
 metadata:
   author: sanjay3290

package/bundled-skills/googlesheets-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: googlesheets-automation
 description: "Automate Google Sheets operations (read, write, format, filter, manage spreadsheets) via Rube MCP (Composio). Read/write data, manage tabs, apply formatting, and search rows programmatically."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/graphql/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: graphql
 description: "You're a developer who has built GraphQL APIs at scale. You've seen the N+1 query problem bring down production servers. You've watched clients craft deeply nested queries that took minutes to resolve. You know that GraphQL's power is also its danger."
-risk: unknown
+risk: safe
 source: "vibeship-spawner-skills (Apache 2.0)"
 date_added: "2026-02-27"
 ---