opencode-skills-antigravity 1.0.39 → 1.0.41

package/bundled-skills/.antigravity-install-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-03-29T15:34:05.670Z",
+  "updatedAt": "2026-03-29T17:33:00.169Z",
   "entries": [
     ".gitignore",
     "00-andruia-consultant",
@@ -658,13 +658,18 @@
     "hubspot-automation",
     "hubspot-integration",
     "hugging-face-cli",
+    "hugging-face-community-evals",
     "hugging-face-dataset-viewer",
     "hugging-face-datasets",
     "hugging-face-evaluation",
+    "hugging-face-gradio",
     "hugging-face-jobs",
     "hugging-face-model-trainer",
     "hugging-face-paper-publisher",
+    "hugging-face-papers",
     "hugging-face-tool-builder",
+    "hugging-face-trackio",
+    "hugging-face-vision-trainer",
     "hybrid-cloud-architect",
     "hybrid-cloud-networking",
     "hybrid-search-implementation",
@@ -701,6 +706,7 @@
     "javascript-typescript-typescript-scaffold",
     "jira-automation",
     "jobgpt",
+    "jq",
     "json-canvas",
     "julia-pro",
     "junta-leiloeiros",
@@ -1215,11 +1221,13 @@
     "threejs-skills",
     "threejs-textures",
     "tiktok-automation",
+    "tmux",
     "todoist-automation",
     "tool-design",
     "tool-use-guardian",
     "top-web-vulnerabilities",
     "track-management",
+    "transformers-js",
     "travel-health-analyzer",
     "trello-automation",
     "trigger-dev",
@@ -1261,6 +1269,7 @@
     "vexor-cli",
     "vibe-code-auditor",
     "vibers-code-review",
+    "viboscope",
     "videodb",
     "videodb-skills",
     "viral-generator-builder",

package/bundled-skills/docs/integrations/jetski-cortex.md

@@ -1,9 +1,9 @@
 ---
 title: Jetski/Cortex + Gemini Integration Guide
-description: "Come usare antigravity-awesome-skills con Jetski/Cortex evitando l’overflow di contesto con 1.331+ skill."
+description: "Come usare antigravity-awesome-skills con Jetski/Cortex evitando l’overflow di contesto con 1.340+ skill."
 ---
 
-# Jetski/Cortex + Gemini: integrazione sicura con 1.331+ skill
+# Jetski/Cortex + Gemini: integrazione sicura con 1.340+ skill
 
 Questa guida mostra come integrare il repository `antigravity-awesome-skills` con un agente basato su **Jetski/Cortex + Gemini** (o framework simili) **senza superare il context window** del modello.
 
@@ -23,7 +23,7 @@ Non bisogna mai:
 - concatenare il contenuto di tutte le `SKILL.md` in un singolo system prompt;
 - reiniettare l’intera libreria per **ogni** richiesta.
 
-Con oltre 1.331 skill, questo approccio riempie il context window prima ancora di aggiungere i messaggi dell’utente, causando l’errore di truncation.
+Con oltre 1.340 skill, questo approccio riempie il context window prima ancora di aggiungere i messaggi dell’utente, causando l’errore di truncation.
 
 ---
 

package/bundled-skills/docs/integrations/jetski-gemini-loader/README.md

@@ -20,7 +20,7 @@ This example shows one way to integrate **antigravity-awesome-skills** with a Je
 - How to enforce a **maximum number of skills per turn** via `maxSkillsPerTurn`.
 - How to choose whether to **truncate or error** when too many skills are requested via `overflowBehavior`.
 
-This pattern avoids context overflow when you have 1,331+ skills installed.
+This pattern avoids context overflow when you have 1,340+ skills installed.
 
 ---
 

package/bundled-skills/docs/maintainers/repo-growth-seo.md

@@ -6,7 +6,7 @@ This document keeps the repository's GitHub-facing discovery copy aligned with t
 
 Preferred positioning:
 
-> Installable GitHub library of 1,331+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and other AI coding assistants.
+> Installable GitHub library of 1,340+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and other AI coding assistants.
 
 Key framing:
 
@@ -20,7 +20,7 @@ Key framing:
 
 Preferred description:
 
-> Installable GitHub library of 1,331+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and more. Includes installer CLI, bundles, workflows, and official/community skill collections.
+> Installable GitHub library of 1,340+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and more. Includes installer CLI, bundles, workflows, and official/community skill collections.
 
 Preferred homepage:
 
@@ -28,7 +28,7 @@ Preferred homepage:
 
 Preferred social preview:
 
-- use a clean preview image that says `1,331+ Agentic Skills`;
+- use a clean preview image that says `1,340+ Agentic Skills`;
 - mention Claude Code, Cursor, Codex CLI, and Gemini CLI;
 - avoid dense text and tiny logos that disappear in social cards.
 

package/bundled-skills/docs/maintainers/security-findings-triage-2026-03-29-refresh.csv

@@ -0,0 +1,34 @@
+finding_id,title,current_status,current_paths,validation_reason,evidence
+1,Unsanitized frontmatter name enables path traversal in sync script,obsolete/not reproducible on current HEAD,tools/scripts/sync_microsoft_skills.py,sync_microsoft_skills.py now sanitizes flat names and constrains delete/copy targets to safe in-repo paths.,tools/scripts/tests/test_sync_microsoft_skills_security.py
+2,Stored XSS via rehype-raw rendering of skill markdown,obsolete/not reproducible on current HEAD,apps/web-app/src/pages/SkillDetail.tsx,SkillDetail still renders markdown without rehype-raw; the reported stored-XSS path does not reproduce.,apps/web-app/src/pages/SkillDetail.tsx
+3,Symlink-following copy leaks host files in setup_web,obsolete/not reproducible on current HEAD,tools/scripts/setup_web.js,setup_web.js now uses lstatSync plus resolveSafeRealPath() and skips out-of-root symlinks.,tools/scripts/tests/copy_security.test.js
+4,Insecure install guidance allows remote script execution,obsolete/not reproducible on current HEAD,skills/apify-actorization/SKILL.md,The Apify skill no longer recommends pipe-to-shell installs or token-on-command-line login.,skills/apify-actorization/SKILL.md
+5,"setup_web.js now follows symlinks, enabling file exfiltration",duplicate of another finding,tools/scripts/setup_web.js,Same root cause/fix area as finding 3.,tools/scripts/setup_web.js
+6,Symlink traversal in web asset setup copies arbitrary files,duplicate of another finding,tools/scripts/setup_web.js,Same root cause/fix area as finding 3.,tools/scripts/setup_web.js
+7,Symlink file copying in .github/skills sync leaks host files,obsolete/not reproducible on current HEAD,tools/scripts/sync_microsoft_skills.py,Microsoft sync now rejects unsafe symlink targets and only accepts safe regular files that stay within the cloned source root.,tools/scripts/tests/test_sync_microsoft_skills_security.py
+8,Symlinked file copy in Microsoft skill sync can leak host data,duplicate of another finding,tools/scripts/sync_microsoft_skills.py,Same root cause/fix area as finding 7.,tools/scripts/sync_microsoft_skills.py
+9,Committed Python bytecode can hide malicious logic,obsolete/not reproducible on current HEAD,skills/ui-ux-pro-max/scripts/__pycache__,Tracked __pycache__ artifacts are absent on current main and repo hygiene tests fail if they reappear.,tools/scripts/tests/repo_hygiene_security.test.js
+10,Symlinked SKILL.md can leak host files via index script,obsolete/not reproducible on current HEAD,tools/scripts/generate_index.py,generate_index.py now ignores symlinked SKILL.md files during index generation.,tools/scripts/tests/test_frontmatter_parsing_security.py
+11,"Example loader trusts manifest paths, enabling file read",obsolete/not reproducible on current HEAD,docs/integrations/jetski-gemini-loader/loader.mjs,The Jetski loader rejects symlinked skill directories/files and any resolved SKILL.md outside the configured skills root.,tools/scripts/tests/jetski_gemini_loader.test.cjs
+12,TLS certificate verification disabled in new scrapers,obsolete/not reproducible on current HEAD,skills/junta-leiloeiros/scripts/scraper/base_scraper.py | skills/junta-leiloeiros/scripts/web_scraper_fallback.py,TLS verification is enabled by default again; insecure behavior requires an explicit opt-out environment flag.,skills/junta-leiloeiros/scripts/scraper/base_scraper.py
+13,Complete bundle omits valid skill categories,obsolete/not reproducible on current HEAD,tools/lib/skill-filter.js | tools/scripts/build-catalog.js | data/bundles.json,The old helper-path omission still does not drive shipped bundle output; current bundles come from build-catalog.js.,tools/scripts/build-catalog.js
+14,Malformed frontmatter delimiter breaks YAML parsing for skills,obsolete/not reproducible on current HEAD,skills/alpha-vantage/SKILL.md,The malformed --- Unknown frontmatter regression is no longer present in alpha-vantage.,tools/scripts/tests/repo_hygiene_security.test.js
+15,ws_listener writes sensitive events to predictable /tmp files,obsolete/not reproducible on current HEAD,skills/videodb/scripts/ws_listener.py,ws_listener.py now defaults to a user-owned state directory and uses secure file creation.,tools/scripts/tests/local_temp_safety.test.js
+16,Symlink traversal lets /skills/ serve arbitrary local files,obsolete/not reproducible on current HEAD,apps/web-app/refresh-skills-plugin.js,refresh-skills-plugin.js resolves real paths under the skills root before serving /skills/*; the public Pages app no longer exposes the maintainer sync surface.,apps/web-app/refresh-skills-plugin.js
+17,Sync Skills endpoint follows symlinks from downloaded archive,duplicate of another finding,apps/web-app/refresh-skills-plugin.js,Same root cause/fix area as finding 16.,apps/web-app/refresh-skills-plugin.js
+18,Validation crash if YAML frontmatter is not a mapping,obsolete/not reproducible on current HEAD,tools/scripts/validate_skills.py,validate_skills.py now rejects non-mapping YAML frontmatter cleanly instead of crashing downstream validation.,tools/scripts/tests/test_frontmatter_parsing_security.py
+19,Anonymous Supabase writes allow skill star tampering,obsolete/not reproducible on current HEAD,apps/web-app/src/hooks/useSkillStars.ts | apps/web-app/src/lib/supabase.ts,useSkillStars now stores saves locally in the browser and no longer performs shared frontend writes through the public Supabase client.,apps/web-app/src/hooks/useSkillStars.ts
+20,Metadata fixer overwrites symlinked SKILL.md targets,obsolete/not reproducible on current HEAD,tools/scripts/fix_skills_metadata.py,fix_skills_metadata.py now skips symlinked SKILL.md files and non-mapping frontmatter.,tools/scripts/fix_skills_metadata.py
+21,Installer now dereferences symlinks during copy,obsolete/not reproducible on current HEAD,tools/bin/install.js,install.js now uses lstatSync plus resolveSafeRealPath() and skips symlinks that resolve outside the cloned repo root.,tools/scripts/tests/copy_security.test.js
+22,Installer merge path dereferences symlinks when copying,duplicate of another finding,tools/bin/install.js,Same root cause/fix area as finding 21.,tools/bin/install.js
+23,Cleanup sync deletes arbitrary paths via flat_name,duplicate of another finding,tools/scripts/sync_microsoft_skills.py,Same root cause/fix area as finding 1.,tools/scripts/sync_microsoft_skills.py
+24,Audio transcription example allows Python code injection,obsolete/not reproducible on current HEAD,skills/audio-transcriber/examples/basic-transcription.sh,The audio transcription example now uses a quoted heredoc and passes values via environment variables.,skills/audio-transcriber/examples/basic-transcription.sh
+25,Unbounded recursive skill traversal can crash catalog build,obsolete/not reproducible on current HEAD,tools/lib/skill-utils.js | tools/scripts/build-catalog.js,The claimed recursive symlink traversal in catalog discovery still does not reproduce on current code paths.,tools/lib/skill-utils.js
+26,Release scripts still use root skills_index.json path,obsolete/not reproducible on current HEAD,tools/scripts/update_readme.py | tools/scripts/generate_index.py | tools/scripts/release_workflow.js,"Root skills_index.json remains the canonical generated index, so the reported release-script path mismatch does not reproduce.",tools/scripts/release_workflow.js
+27,Symlink traversal in skill normalization allows file overwrite,obsolete/not reproducible on current HEAD,tools/lib/skill-utils.js | tools/scripts/normalize-frontmatter.js,"skill-utils.js now relies on lstatSync-based safe directory/file discovery, so normalization does not treat symlinked skill folders as writable local skills.",tools/lib/skill-utils.js
+28,last30days skill passes user input directly to Bash command,obsolete/not reproducible on current HEAD,skills/last30days/SKILL.md,"The last30days skill still passes user input as a quoted value through a temp file, so the reported direct shell-injection sink does not reproduce.",skills/last30days/SKILL.md
+29,Unvalidated YAML frontmatter can crash index generation,duplicate of another finding,tools/scripts/generate_index.py,Same root cause/fix area as finding 18.,tools/scripts/generate_index.py
+30,Predictable /tmp counter file enables local file clobbering,obsolete/not reproducible on current HEAD,skills/cc-skill-strategic-compact/suggest-compact.sh,The strategic compact hook now stores state under XDG_STATE_HOME instead of predictable shared /tmp paths.,tools/scripts/tests/local_temp_safety.test.js
+31,Symlink traversal risk in new sync script,obsolete/not reproducible on current HEAD,tools/scripts/sync_recommended_skills.sh,sync_recommended_skills.sh now preserves symlinks with cp -RP and avoids the destructive glob-delete pattern from the original report.,tools/scripts/tests/repo_hygiene_security.test.js
+32,skills_manager allows path traversal in enable/disable operations,obsolete/not reproducible on current HEAD,tools/scripts/skills_manager.py,skills_manager.py now resolves candidate paths relative to the intended base directory and rejects traversal attempts.,tools/scripts/tests/test_skills_manager_security.py
+33,Zip Slip risk in Office unpack scripts,obsolete/not reproducible on current HEAD,skills/docx-official/ooxml/scripts/unpack.py | skills/pptx-official/ooxml/scripts/unpack.py,The Office unpack helpers now validate archive members and reject traversal/symlink-style entries before extraction.,tools/scripts/tests/test_office_unpack_security.py

package/bundled-skills/docs/maintainers/security-findings-triage-2026-03-29-refresh.md

@@ -8,6 +8,8 @@ baseline.
 - Current verification target: `main@d63d99381b8f613f99c8cb7b758e7879b401f8a0`
 - The 2026-03-15 markdown file and CSV remain useful as historical input, not
   as the current source of truth.
+- A machine-readable companion export for this refresh lives at
+  [`security-findings-triage-2026-03-29-refresh.csv`](security-findings-triage-2026-03-29-refresh.csv).
 - Status meanings are unchanged:
   `still present and exploitable`, `still present but low practical risk`,
   `obsolete/not reproducible on current HEAD`, `duplicate of another finding`.

package/bundled-skills/docs/maintainers/skills-update-guide.md

@@ -69,7 +69,7 @@ For manual updates, you need:
 The update process refreshes:
 - Skills index (`skills_index.json`)
 - Web app skills data (`apps\web-app\public\skills.json`)
-- All 1,331+ skills from the skills directory
+- All 1,340+ skills from the skills directory
 
 ## When to Update
 

package/bundled-skills/docs/sources/sources.md

@@ -24,7 +24,7 @@ The following skills were added from the curated collection at [VoltAgent/awesom
 | :------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------ | :--------- | :--------------------------------- |
 | `vercel-deploy-claimable`                                                                    | [Vercel Labs](https://github.com/vercel-labs/agent-skills)                | MIT        | Official Vercel skill              |
 | `design-md`                                                                                  | [Google Labs (Stitch)](https://github.com/google-labs-code/stitch-skills) | Compatible | Google Labs Stitch skills          |
-| `hugging-face-cli`, `hugging-face-jobs`                                                      | [Hugging Face](https://github.com/huggingface/skills)                     | Compatible | Official Hugging Face skills       |
+| `hugging-face-cli`, `hugging-face-community-evals`, `hugging-face-dataset-viewer`, `hugging-face-gradio`, `hugging-face-jobs`, `hugging-face-model-trainer`, `hugging-face-paper-publisher`, `hugging-face-papers`, `hugging-face-trackio`, `hugging-face-vision-trainer`, `transformers-js` | [Hugging Face](https://github.com/huggingface/skills) | Compatible | Official Hugging Face skills |
 | `culture-index`, `fix-review`, `sharp-edges`                                                 | [Trail of Bits](https://github.com/trailofbits/skills)                    | Compatible | Security skills from Trail of Bits |
 | `expo-deployment`, `upgrading-expo`                                                          | [Expo](https://github.com/expo/skills)                                    | Compatible | Official Expo skills               |
 | `commit`, `create-pr`, `find-bugs`, `iterate-pr`                                             | [Sentry](https://github.com/getsentry/skills)                             | Compatible | Sentry dev team skills             |
@@ -118,7 +118,7 @@ The following skills were added during the March 2026 skills update:
 ### Machine Learning & Data
 | Skill | Source | License | Notes |
 |-------|--------|---------|-------|
-| `hugging-face-dataset-viewer`, `hugging-face-datasets`, `hugging-face-evaluation`, `hugging-face-model-trainer`, `hugging-face-paper-publisher`, `hugging-face-tool-builder` | [huggingface/skills](https://github.com/huggingface/skills) | Compatible | HuggingFace ML tools |
+| `hugging-face-datasets`, `hugging-face-evaluation`, `hugging-face-tool-builder` | [huggingface/skills](https://github.com/huggingface/skills) | Compatible | Hugging Face ecosystem extensions |
 | `numpy`, `pandas`, `scipy`, `matplotlib`, `scikit-learn`, `jupyter-workflow` | [K-Dense-AI/claude-scientific-skills](https://github.com/K-Dense-AI/claude-scientific-skills) | Compatible | Data science essentials |
 | `biopython`, `scanpy`, `uniprot-database`, `pubmed-database` | [K-Dense-AI/claude-scientific-skills](https://github.com/K-Dense-AI/claude-scientific-skills) | Compatible | Bioinformatics tools |
 

package/bundled-skills/docs/users/bundles.md

@@ -673,4 +673,4 @@ Found a skill that should be in a bundle? Or want to create a new bundle? [Open
 
 ---
 
-_Last updated: March 2026 | Total Skills: 1,331+ | Total Bundles: 37_
+_Last updated: March 2026 | Total Skills: 1,340+ | Total Bundles: 37_

package/bundled-skills/docs/users/claude-code-skills.md

@@ -12,7 +12,7 @@ Install the library into Claude Code, then invoke focused skills directly in the
 
 ## Why use this repo for Claude Code
 
-- It includes 1,331+ skills instead of a narrow single-domain starter pack.
+- It includes 1,340+ skills instead of a narrow single-domain starter pack.
 - It supports the standard `.claude/skills/` path and the Claude Code plugin marketplace flow.
 - It also ships generated bundle plugins so teams can install focused packs like `Essentials` or `Security Developer` from the marketplace metadata.
 - It includes onboarding docs, bundles, and workflows so new users do not need to guess where to begin.

package/bundled-skills/docs/users/gemini-cli-skills.md

@@ -12,7 +12,7 @@ Install into the Gemini skills path, then ask Gemini to apply one skill at a tim
 
 - It installs directly into the expected Gemini skills path.
 - It includes both core software engineering skills and deeper agent/LLM-oriented skills.
-- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,331+ files.
+- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,340+ files.
 - It is useful whether you want a broad internal skill library or a single repo to test many workflows quickly.
 
 ## Install Gemini CLI Skills

package/bundled-skills/docs/users/getting-started.md

@@ -1,4 +1,4 @@
-# Getting Started with Antigravity Awesome Skills (V9.1.0)
+# Getting Started with Antigravity Awesome Skills (V9.2.0)
 
 **New here? This guide will help you supercharge your AI Agent in 5 minutes.**
 

package/bundled-skills/docs/users/kiro-integration.md

@@ -18,7 +18,7 @@ Kiro is AWS's agentic AI IDE that combines:
 
 Kiro's agentic capabilities are enhanced by skills that provide:
 
-- **Domain expertise** across 1,331+ specialized areas
+- **Domain expertise** across 1,340+ specialized areas
 - **Best practices** from Anthropic, OpenAI, Google, Microsoft, and AWS
 - **Workflow automation** for common development tasks
 - **AWS-specific patterns** for serverless, infrastructure, and cloud architecture

package/bundled-skills/docs/users/usage.md

@@ -14,7 +14,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of a full l
 
 When you ran `npx antigravity-awesome-skills` or cloned the repository, you:
 
-✅ **Downloaded 1,331+ skill files** to your computer (default: `~/.gemini/antigravity/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)  
+✅ **Downloaded 1,340+ skill files** to your computer (default: `~/.gemini/antigravity/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)  
 ✅ **Made them available** to your AI assistant  
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)
 
@@ -34,7 +34,7 @@ Bundles are **curated groups** of skills organized by role. They help you decide
 
 **Analogy:**
 
-- You installed a toolbox with 1,331+ tools (✅ done)
+- You installed a toolbox with 1,340+ tools (✅ done)
 - Bundles are like **labeled organizer trays** saying: "If you're a carpenter, start with these 10 tools"
 - You can either **pick skills from the tray** or install that tray as a focused marketplace bundle plugin
 
@@ -212,7 +212,7 @@ Let's actually use a skill right now. Follow these steps:
 
 ## Step 5: Picking Your First Skills (Practical Advice)
 
-Don't try to use all 1,331+ skills at once. Here's a sensible approach:
+Don't try to use all 1,340+ skills at once. Here's a sensible approach:
 
 If you want a tool-specific starting point before choosing skills, use:
 
@@ -343,7 +343,7 @@ Usually no, but if your AI doesn't recognize a skill:
 
 ### "Can I load all skills into the model at once?"
 
-No. Even though you have 1,331+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 1,340+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
 
 The intended pattern is:
 

package/bundled-skills/docs/users/visual-guide.md

@@ -34,7 +34,7 @@ antigravity-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 1,331+ skills live here
+├── 📁 skills/                          ← 1,340+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -47,7 +47,7 @@ antigravity-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (1,331+ total)
+│   └── ... (1,340+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -100,7 +100,7 @@ antigravity-awesome-skills/
 
 ```
                     ┌─────────────────────────┐
-                    │  1,331+ SKILLS          │
+                    │  1,340+ SKILLS          │
                     └────────────┬────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
@@ -201,7 +201,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (1,331+ total)                │
+│   └── ... (1,340+ total)                │
 └─────────────────────────────────────────┘
 ```