opencode-skills-antigravity 1.0.31 → 1.0.33

package/bundled-skills/pagerduty-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pagerduty-automation
 description: "Automate PagerDuty tasks via Rube MCP (Composio): manage incidents, services, schedules, escalation policies, and on-call rotations. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/pentest-checklist/SKILL.md

@@ -1,12 +1,14 @@
 ---
 name: pentest-checklist
 description: "Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities."
-risk: unknown
+risk: offensive
 source: community
 author: zebbern
 date_added: "2026-02-27"
 ---
 
+> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
+
 # Pentest Checklist
 
 ## Purpose

package/bundled-skills/pentest-commands/SKILL.md

@@ -1,12 +1,14 @@
 ---
 name: pentest-commands
 description: "Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments."
-risk: unknown
+risk: offensive
 source: community
 author: zebbern
 date_added: "2026-02-27"
 ---
 
+> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
+
 # Pentest Commands
 
 ## Purpose

package/bundled-skills/personal-tool-builder/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: personal-tool-builder
 description: "You believe the best tools come from real problems. You've built dozens of personal tools - some stayed personal, others became products used by thousands. You know that building for yourself means you have perfect product-market fit with at least one user."
-risk: unknown
+risk: critical
 source: "vibeship-spawner-skills (Apache 2.0)"
 date_added: "2026-02-27"
 ---

package/bundled-skills/pipedrive-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pipedrive-automation
 description: "Automate Pipedrive CRM operations including deals, contacts, organizations, activities, notes, and pipeline management via Rube MCP (Composio). Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/posix-shell-pro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: posix-shell-pro
 description: Expert in strict POSIX sh scripting for maximum portability across Unix-like systems. Specializes in shell scripts that run on any POSIX-compliant shell (dash, ash, sh, bash --posix).
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/postgres-best-practices/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: postgres-best-practices
 description: "Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/posthog-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: posthog-automation
 description: "Automate PostHog tasks via Rube MCP (Composio): events, feature flags, projects, user profiles, annotations. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/postmark-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: postmark-automation
 description: "Automate Postmark email delivery tasks via Rube MCP (Composio): send templated emails, manage templates, monitor delivery stats and bounces. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/pptx/ooxml/scripts/unpack.py

@@ -2,22 +2,47 @@
 """Unpack and format XML contents of Office files (.docx, .pptx, .xlsx)"""
 
 import random
+import shutil
+import stat
 import sys
 import zipfile
 from pathlib import Path
 
 
+def _is_zip_symlink(member: zipfile.ZipInfo) -> bool:
+    return stat.S_ISLNK(member.external_attr >> 16)
+
+
+def _is_safe_destination(output_root: Path, member_name: str) -> bool:
+    destination = output_root / member_name
+    return destination.resolve().is_relative_to(output_root.resolve())
+
+
+def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_root: Path):
+    destination = output_root / member.filename
+    if member.is_dir():
+        destination.mkdir(parents=True, exist_ok=True)
+        return
+
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    with archive.open(member, "r") as source, open(destination, "wb") as target:
+        shutil.copyfileobj(source, target)
+
+
 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
     output_path = Path(output_dir)
     output_path.mkdir(parents=True, exist_ok=True)
+    output_root = output_path.resolve()
 
     with zipfile.ZipFile(input_file) as archive:
         for member in archive.infolist():
-            destination = output_path / member.filename
-            if not destination.resolve().is_relative_to(output_path.resolve()):
+            if _is_zip_symlink(member):
+                raise ValueError(f"Unsafe archive entry: {member.filename}")
+            if not _is_safe_destination(output_root, member.filename):
                 raise ValueError(f"Unsafe archive entry: {member.filename}")
 
-        archive.extractall(output_path)
+        for member in archive.infolist():
+            _extract_member(archive, member, output_path)
 
 
 def pretty_print_xml(output_path: Path):

package/bundled-skills/pptx-official/ooxml/scripts/unpack.py

@@ -2,22 +2,47 @@
 """Unpack and format XML contents of Office files (.docx, .pptx, .xlsx)"""
 
 import random
+import shutil
+import stat
 import sys
 import zipfile
 from pathlib import Path
 
 
+def _is_zip_symlink(member: zipfile.ZipInfo) -> bool:
+    return stat.S_ISLNK(member.external_attr >> 16)
+
+
+def _is_safe_destination(output_root: Path, member_name: str) -> bool:
+    destination = output_root / member_name
+    return destination.resolve().is_relative_to(output_root.resolve())
+
+
+def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_root: Path):
+    destination = output_root / member.filename
+    if member.is_dir():
+        destination.mkdir(parents=True, exist_ok=True)
+        return
+
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    with archive.open(member, "r") as source, open(destination, "wb") as target:
+        shutil.copyfileobj(source, target)
+
+
 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
     output_path = Path(output_dir)
     output_path.mkdir(parents=True, exist_ok=True)
+    output_root = output_path.resolve()
 
     with zipfile.ZipFile(input_file) as archive:
         for member in archive.infolist():
-            destination = output_path / member.filename
-            if not destination.resolve().is_relative_to(output_path.resolve()):
+            if _is_zip_symlink(member):
+                raise ValueError(f"Unsafe archive entry: {member.filename}")
+            if not _is_safe_destination(output_root, member.filename):
                 raise ValueError(f"Unsafe archive entry: {member.filename}")
 
-        archive.extractall(output_path)
+        for member in archive.infolist():
+            _extract_member(archive, member, output_path)
 
 
 def pretty_print_xml(output_path: Path):

package/bundled-skills/product-manager/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: product-manager
 description: "Senior PM agent with 6 knowledge domains, 30+ frameworks, 12 templates, and 32 SaaS metrics with formulas. Pure Markdown, zero scripts."
-risk: unknown
+risk: safe
 version: "1.0.0"
 author: "Digidai"
 tags: ["product-management", "saas", "frameworks", "metrics", "strategy"]

package/bundled-skills/projection-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: projection-patterns
 description: "Build read models and projections from event streams. Use when implementing CQRS read sides, building materialized views, or optimizing query performance in event-sourced systems."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/prompt-caching/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: prompt-caching
 description: "You're a caching specialist who has reduced LLM costs by 90% through strategic caching. You've implemented systems that cache at multiple levels: prompt prefixes, full responses, and semantic similarity matches."
-risk: unknown
+risk: none
 source: "vibeship-spawner-skills (Apache 2.0)"
 date_added: "2026-02-27"
 ---

package/bundled-skills/protocol-reverse-engineering/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: protocol-reverse-engineering
 description: "Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/python-development-python-scaffold/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: python-development-python-scaffold
 description: "You are a Python project architecture expert specializing in scaffolding production-ready Python applications. Generate complete project structures with modern tooling (uv, FastAPI, Django), type hint"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/python-packaging/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: python-packaging
 description: "Comprehensive guide to creating, structuring, and distributing Python packages using modern packaging tools, pyproject.toml, and publishing to PyPI."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/python-performance-optimization/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: python-performance-optimization
 description: "Profile and optimize Python code using cProfile, memory profilers, and performance best practices. Use when debugging slow Python code, optimizing bottlenecks, or improving application performance."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/python-testing-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: python-testing-patterns
 description: "Implement comprehensive testing strategies with pytest, fixtures, mocking, and test-driven development. Use when writing Python tests, setting up test suites, or implementing testing best practices."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/quant-analyst/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: quant-analyst
 description: Build financial models, backtest trading strategies, and analyze market data. Implements risk metrics, portfolio optimization, and statistical arbitrage.
-risk: unknown
+risk: safe
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/react-best-practices/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: react-best-practices
 description: "Comprehensive performance optimization guide for React and Next.js applications, maintained by Vercel. Use when writing new React components or Next.js pages, implementing data fetching (client or server-side), or reviewing code for performance issues."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/react-modernization/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: react-modernization
 description: "Master React version upgrades, class to hooks migration, concurrent features adoption, and codemods for automated transformation."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/react-native-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: react-native-architecture
 description: "Production-ready patterns for React Native development with Expo, including navigation, state management, native modules, and offline-first architecture."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/react-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: react-patterns
 description: "Modern React patterns and principles. Hooks, composition, performance, TypeScript best practices."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/red-team-tactics/SKILL.md

@@ -1,11 +1,13 @@
 ---
 name: red-team-tactics
 description: "Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting."
-risk: unknown
+risk: offensive
 source: community
 date_added: "2026-02-27"
 ---
 
+> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
+
 # Red Team Tactics
 
 > Adversary simulation principles based on MITRE ATT&CK framework.

package/bundled-skills/red-team-tools/SKILL.md

@@ -1,12 +1,14 @@
 ---
 name: red-team-tools
 description: "Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces."
-risk: unknown
+risk: offensive
 source: community
 author: zebbern
 date_added: "2026-02-27"
 ---
 
+> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
+
 # Red Team Tools and Methodology
 
 ## Purpose

package/bundled-skills/reddit-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: reddit-automation
 description: "Automate Reddit tasks via Rube MCP (Composio): search subreddits, create posts, manage comments, and browse top content. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/remotion-best-practices/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: remotion-best-practices
 description: "Best practices for Remotion - Video creation in React"
-risk: unknown
+risk: safe
 source: community
 tags: "remotion, video, react, animation, composition"
 date_added: "2026-02-27"

package/bundled-skills/reverse-engineer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: reverse-engineer
 description: Expert reverse engineer specializing in binary analysis, disassembly, decompilation, and software analysis. Masters IDA Pro, Ghidra, radare2, x64dbg, and modern RE toolchains.
-risk: unknown
+risk: offensive
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/risk-manager/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: risk-manager
 description: Monitor portfolio risk, R-multiples, and position limits. Creates hedging strategies, calculates expectancy, and implements stop-losses.
-risk: unknown
+risk: safe
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/risk-metrics-calculation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: risk-metrics-calculation
 description: "Calculate portfolio risk metrics including VaR, CVaR, Sharpe, Sortino, and drawdown analysis. Use when measuring portfolio risk, implementing risk limits, or building risk monitoring systems."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/rust-async-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: rust-async-patterns
 description: "Master Rust async programming with Tokio, async traits, error handling, and concurrent patterns. Use when building async Rust applications, implementing concurrent systems, or debugging async code."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/salesforce-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: salesforce-automation
 description: "Automate Salesforce tasks via Rube MCP (Composio): leads, contacts, accounts, opportunities, SOQL queries. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/salesforce-development/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: salesforce-development
 description: "Use @wire decorator for reactive data binding with Lightning Data Service or Apex methods. @wire fits LWC's reactive architecture and enables Salesforce performance optimizations."
-risk: unknown
+risk: safe
 source: "vibeship-spawner-skills (Apache 2.0)"
 date_added: "2026-02-27"
 ---

package/bundled-skills/scala-pro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: scala-pro
 description: Master enterprise-grade Scala development with functional programming, distributed systems, and big data processing. Expert in Apache Pekko, Akka, Spark, ZIO/Cats Effect, and reactive architectures.
-risk: unknown
+risk: safe
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/screen-reader-testing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: screen-reader-testing
 description: "Practical guide to testing web applications with screen readers for comprehensive accessibility validation."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/security-compliance-compliance-check/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: security-compliance-compliance-check
 description: "You are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2, PCI-DSS, and other industry standards. Perform comprehensive compliance audits and provide implementation guidance for achieving and maintaining compliance."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/security-requirement-extraction/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: security-requirement-extraction
 description: "Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/security-scanning-security-dependencies/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: security-scanning-security-dependencies
 description: "You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across multiple ecosystems to identify vulnerabilities, assess risks, and provide automated remediation strategies."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/segment-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: segment-automation
 description: "Automate Segment tasks via Rube MCP (Composio): track events, identify users, manage groups, page views, aliases, batch operations. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/segment-cdp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: segment-cdp
 description: "Client-side tracking with Analytics.js. Include track, identify, page, and group calls. Anonymous ID persists until identify merges with user."
-risk: unknown
+risk: safe
 source: "vibeship-spawner-skills (Apache 2.0)"
 date_added: "2026-02-27"
 ---

package/bundled-skills/sendgrid-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: sendgrid-automation
 description: "Automate SendGrid email delivery workflows including marketing campaigns (Single Sends), contact and list management, sender identity setup, and email analytics through Composio's SendGrid toolkit."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/senior-architect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: senior-architect
 description: "Complete toolkit for senior architect with modern tools and best practices."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/senior-fullstack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: senior-fullstack
 description: "Complete toolkit for senior fullstack with modern tools and best practices."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/sentry-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: sentry-automation
 description: "Automate Sentry tasks via Rube MCP (Composio): manage issues/events, configure alerts, track releases, monitor projects and teams. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/seo-audit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: seo-audit
 description: Diagnose and audit SEO issues affecting crawlability, indexation, rankings, and organic performance.
-risk: unknown
+risk: safe
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/seo-content-auditor/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: seo-content-auditor
 description: Analyzes provided content for quality, E-E-A-T signals, and SEO best practices. Scores content and provides improvement recommendations based on established guidelines.
-risk: unknown
+risk: safe
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/seo-fundamentals/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: seo-fundamentals
 description: Core principles of SEO including E-E-A-T, Core Web Vitals, technical foundations, content quality, and how modern search engines evaluate pages.
-risk: unknown
+risk: safe
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/seo-images/SKILL.md

@@ -5,7 +5,7 @@ description: >
   sizes, formats, responsive images, lazy loading, and CLS prevention. Use when
   user says "image optimization", "alt text", "image SEO", "image size",
   or "image audit".
-risk: unknown
+risk: safe
 source: "https://github.com/AgriciDaniel/claude-seo"
 date_added: "2026-03-21"
 user-invokable: true

package/bundled-skills/seo-page/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Deep single-page SEO analysis covering on-page elements, content quality,
   technical meta tags, schema, images, and performance. Use when user says
   "analyze this page", "check page SEO", or provides a single URL for review.
-risk: unknown
+risk: safe
 source: "https://github.com/AgriciDaniel/claude-seo"
 date_added: "2026-03-21"
 user-invokable: true

package/bundled-skills/server-management/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: server-management
 description: "Server management principles and decision-making. Process management, monitoring strategy, and scaling decisions. Teaches thinking, not commands."
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/service-mesh-expert/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: service-mesh-expert
 description: "Expert service mesh architect specializing in Istio, Linkerd, and cloud-native networking patterns. Masters traffic management, security policies, observability integration, and multi-cluster mesh con"
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---