opencode-skills-collection 3.0.31 → 3.0.33

package/bundled-skills/.antigravity-install-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-05-30T01:54:46.605Z",
+  "updatedAt": "2026-06-01T02:30:46.952Z",
   "entries": [
     "00-andruia-consultant",
     "007",
@@ -391,6 +391,7 @@
     "conductor-validator",
     "confluence-automation",
     "constant-time-analysis",
+    "container-security-hardening",
     "content-creator",
     "content-marketer",
     "content-strategy",
@@ -487,6 +488,7 @@
     "django-perf-review",
     "django-pro",
     "doc-coauthoring",
+    "doc2math",
     "docker-expert",
     "docs",
     "docs-architect",
@@ -640,6 +642,7 @@
     "git-pr-workflows-pr-enhance",
     "git-pushing",
     "github",
+    "github-actions-advanced",
     "github-actions-templates",
     "github-automation",
     "github-issue-creator",
@@ -829,6 +832,7 @@
     "logic-lens",
     "logistics-exception-management",
     "loki-mode",
+    "longbridge",
     "loss-aversion-designer",
     "m365-agents-dotnet",
     "m365-agents-py",
@@ -887,6 +891,7 @@
     "ml-pipeline-workflow",
     "mlops-engineer",
     "mmx-cli",
+    "moatmri",
     "mobile-design",
     "mobile-developer",
     "mobile-security-coder",
@@ -931,6 +936,7 @@
     "news-sentiment-engine",
     "nextjs-app-router-patterns",
     "nextjs-best-practices",
+    "nextjs-seo-indexing",
     "nextjs-supabase-auth",
     "nft-standards",
     "nodejs-backend-patterns",
@@ -1121,6 +1127,7 @@
     "robius-state-management",
     "robius-widget-patterns",
     "ruby-pro",
+    "runaway-guard",
     "rust-async-patterns",
     "rust-pro",
     "saas-multi-tenant",
@@ -1139,6 +1146,7 @@
     "scanpy",
     "scarcity-urgency-psychologist",
     "schema-markup",
+    "schema-markup-generator",
     "scientific-writing",
     "scikit-learn",
     "screen-reader-testing",
@@ -1249,6 +1257,7 @@
     "smtp-penetration-testing",
     "snowflake-development",
     "social-content",
+    "social-metadata-hardening",
     "social-orchestrator",
     "social-post-writer-seo",
     "social-proof-architect",
@@ -1412,6 +1421,8 @@
     "vexor",
     "vexor-cli",
     "vibe-code-auditor",
+    "vibe-code-cleanup",
+    "vibecode-production-qa-validator",
     "vibers-code-review",
     "viboscope",
     "videodb",
@@ -1473,7 +1484,9 @@
     "yann-lecun-filosofia",
     "yann-lecun-tecnico",
     "yes-md",
+    "yield-intelligence",
     "youtube-automation",
+    "youtube-full",
     "youtube-summarizer",
     "zapier-make-patterns",
     "zendesk-automation",

package/bundled-skills/bilig-workpaper/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: bilig-workpaper
 description: "Use formula-backed WorkPaper JSON and MCP tools for agent spreadsheet tasks without driving Excel or a browser UI."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-05-21"
 tags:
@@ -10,6 +10,10 @@ tags:
   - mcp
   - xlsx
   - typescript
+plugin:
+  targets:
+    codex: blocked
+    claude: blocked
 ---
 
 # Bilig WorkPaper
@@ -36,6 +40,11 @@ Do not use it for manual spreadsheet editing, VBA/macros, pivots, charts, COM au
 
 Prefer argument arrays in MCP/client configuration. Do not shell-concatenate user-provided paths, sheet names, formulas, or cell addresses. Reject path or cell input containing newlines, backticks, `$(`, `;`, `&`, `|`, `<`, or `>` before using it in a command.
 
+The MCP examples execute the public `@bilig/workpaper` npm package. Treat that
+as third-party code execution: pin the package version you reviewed, run it only
+in a trusted project, and get explicit user approval before starting a writable
+MCP server.
+
 ## Quick MCP Setup
 
 First prove the package-owned challenge works:
@@ -43,7 +52,7 @@ First prove the package-owned challenge works:
 ```json
 {
   "command": "npm",
-  "args": ["exec", "--package", "@bilig/workpaper", "--", "bilig-mcp-challenge"]
+  "args": ["exec", "--package", "@bilig/workpaper@<reviewed-version>", "--", "bilig-mcp-challenge"]
 }
 ```
 
@@ -55,7 +64,7 @@ Then run a writable file-backed MCP server:
   "args": [
     "exec",
     "--package",
-    "@bilig/workpaper",
+    "@bilig/workpaper@<reviewed-version>",
     "--",
     "bilig-workpaper-mcp",
     "--workpaper",

package/bundled-skills/bumblebee/SKILL.md

@@ -136,10 +136,14 @@ If the user has no catalog, run deep without `--findings-only` but warn them tha
 
 ## Step 5 — Generate the Markdown report
 
-Run the bundled helper to turn the NDJSON into a human-readable report:
+Run the bundled helper to turn the NDJSON into a human-readable report. Resolve
+the helper from the installed Bumblebee skill directory; never run a
+workspace-relative `scripts/render_report.py` from the scanned project.
 
 ```bash
-python3 scripts/render_report.py \
+BUMBLEBEE_SKILL_DIR="/absolute/path/to/the/bumblebee-skill-directory"
+test -f "$BUMBLEBEE_SKILL_DIR/scripts/render_report.py"
+python3 "$BUMBLEBEE_SKILL_DIR/scripts/render_report.py" \
   "$OUT/bumblebee-<profile>-$TS.ndjson" \
   "$OUT/bumblebee-<profile>-$TS.report.md"
 ```

package/bundled-skills/bun-development/SKILL.md

@@ -31,9 +31,11 @@ Use this skill when:
 brew install oven-sh/bun/bun
 
 # Alternative: download the official installer, inspect it, then execute it
-curl -fsSLo /tmp/bun-install.sh https://bun.sh/install
-sed -n '1,160p' /tmp/bun-install.sh
-bash /tmp/bun-install.sh
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+curl -fsSLo "$tmpdir/bun-install.sh" https://bun.sh/install
+sed -n '1,160p' "$tmpdir/bun-install.sh"
+bash "$tmpdir/bun-install.sh"
 
 # Windows
 powershell -NoProfile -Command "Invoke-WebRequest https://bun.sh/install.ps1 -OutFile $env:TEMP\\bun-install.ps1; Get-Content $env:TEMP\\bun-install.ps1 -TotalCount 120; powershell -ExecutionPolicy Bypass -File $env:TEMP\\bun-install.ps1"

package/bundled-skills/cloud-penetration-testing/SKILL.md

@@ -29,9 +29,11 @@ curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip
 unzip awscliv2.zip && sudo ./aws/install
 
 # GCP CLI
-curl -fsSLo /tmp/google-cloud-sdk-install.sh https://sdk.cloud.google.com
-sed -n '1,160p' /tmp/google-cloud-sdk-install.sh
-bash /tmp/google-cloud-sdk-install.sh
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+curl -fsSLo "$tmpdir/google-cloud-sdk-install.sh" https://sdk.cloud.google.com
+sed -n '1,160p' "$tmpdir/google-cloud-sdk-install.sh"
+bash "$tmpdir/google-cloud-sdk-install.sh"
 gcloud init
 
 # Additional tools