opencode-skills-collection 3.1.0 → 3.1.2

package/bundled-skills/dos-verify-done-claims/SKILL.md

@@ -2,7 +2,7 @@
 name: dos-verify-done-claims
 description: "Before accepting an agent's 'done / shipped / fixed' claim, verify it against ground truth (git ancestry + the commit's own diff) using the DOS kernel's `dos verify` and `dos commit-audit` — never the agent's own narration."
 category: quality
-risk: safe
+risk: critical
 source: community
 source_repo: anthony-chaudhary/dos-kernel
 source_type: community
@@ -12,6 +12,14 @@ tags: [verification, git, ai-agents, trust, quality-gate]
 tools: [claude, cursor, gemini]
 license: "MIT"
 license_source: "https://github.com/anthony-chaudhary/dos-kernel/blob/master/LICENSE"
+plugin:
+  targets:
+    codex: blocked
+    claude: blocked
+  setup:
+    type: manual
+    summary: "Setup installs and executes an external PyPI CLI; keep out of plugin-safe bundles."
+    docs: SKILL.md
 ---
 
 # Verify done-claims against ground truth, not the agent's word
@@ -48,7 +56,9 @@ This skill adapts the DOS reference "witness-claim" pattern
 ### Step 1: Install the kernel (once)
 
 ```bash
-pip install dos-kernel        # provides the `dos` CLI; deterministic, no key
+python3 -m venv .dos-venv
+. .dos-venv/bin/activate
+python -m pip install 'dos-kernel==<reviewed-version>'  # provides the `dos` CLI
 ```
 
 ### Step 2: Audit the latest commit's claim vs its diff
@@ -144,7 +154,8 @@ dos verify --workspace . AUTH AUTH2 --json --no-ci
 
 ## Security & Safety Notes
 
-- This skill runs shell commands: `pip install dos-kernel` and the read-only
+- This skill runs shell commands: installing `dos-kernel` into an isolated
+  virtualenv and the read-only
   `dos` verbs (`dos commit-audit`, `dos verify`). These verbs never **mutate**
   the repo or push. `dos commit-audit` only reads git history and the working
   tree (no network). `dos verify` is also git-only **unless** the workspace has
@@ -153,7 +164,8 @@ dos verify --workspace . AUTH AUTH2 --json --no-ci
   (as the examples above do) to force the git-only path and guarantee no network.
 - `pip install dos-kernel` installs from PyPI. The distribution name is
   `dos-kernel` (the bare `dos` on PyPI is an unrelated package — do not install
-  it). Pin a version in locked environments.
+  it). Pin a reviewed version; do not install an unpinned latest release into a
+  global Python environment.
 - Run in the repository you intend to adjudicate; the `--workspace .` argument
   scopes every verdict to that repo.
 

package/bundled-skills/ecl-harness-engineer/agents/creator-config.md

@@ -98,7 +98,7 @@ set -euo pipefail
 
 # Start PostgreSQL
 docker run -d --name harness-postgres \
-  -p 5432:5432 \
+  -p 127.0.0.1:5432:5432 \
   -e POSTGRES_PASSWORD=testpass \
   postgres:16
 

package/bundled-skills/ecl-harness-engineer/references/environment-config-guide.md

@@ -55,7 +55,7 @@ Guide for collecting complete environment information and generating `harness/co
       "type": "database",
       "required": true,
       "image": "postgres:15",
-      "ports": ["5432:5432"],
+      "ports": ["127.0.0.1:5432:5432"],
       "env": {
         "POSTGRES_USER": "${DB_USER:-postgres}",
         "POSTGRES_PASSWORD": "${DB_PASSWORD}",
@@ -441,7 +441,7 @@ echo "=== Tearing down environment ==="
 
 # Stop Docker services
 if [ -f "$PROJECT_ROOT/docker-compose.yml" ]; then
-    docker-compose -f "$PROJECT_ROOT/docker-compose.yml" down -v
+    docker-compose -f "$PROJECT_ROOT/docker-compose.yml" down
 fi
 
 # Clean up optional runtime verification artifacts when advanced tracing is enabled

package/bundled-skills/ecl-harness-engineer/references/environment-detection-guide.md

@@ -223,7 +223,7 @@ if ! docker ps -q -f name={{name}} | grep -q .; then
   echo "Starting PostgreSQL ({{name}})..."
   docker run -d \
     --name {{name}} \
-    -p {{connection.default_port}}:5432 \
+    -p 127.0.0.1:{{connection.default_port}}:5432 \
     -e POSTGRES_USER=${{{connection.user_env}}:-postgres} \
     -e POSTGRES_PASSWORD=${{{connection.password_env}}:-postgres} \
     -e POSTGRES_DB=${{{connection.database_env}}:-{{../project_name}}} \
@@ -241,7 +241,7 @@ if ! docker ps -q -f name={{name}} | grep -q .; then
   echo "Starting MySQL ({{name}})..."
   docker run -d \
     --name {{name}} \
-    -p {{connection.default_port}}:3306 \
+    -p 127.0.0.1:{{connection.default_port}}:3306 \
     -e MYSQL_ROOT_PASSWORD=${{{connection.password_env}}:-root} \
     -e MYSQL_DATABASE=${{{connection.database_env}}:-{{../project_name}}} \
     {{setup.docker_image}}
@@ -262,7 +262,7 @@ fi
 {{#if (eq type "redis")}}
 if ! docker ps -q -f name={{name}} | grep -q .; then
   echo "Starting Redis ({{name}})..."
-  docker run -d --name {{name}} -p 6379:6379 {{setup.docker_image}}
+  docker run -d --name {{name}} -p 127.0.0.1:6379:6379 {{setup.docker_image}}
   echo "Redis started."
 fi
 {{/if}}
@@ -507,7 +507,7 @@ services:
   postgres:
     image: postgres:16
     ports:
-      - "5432:5432"
+      - "127.0.0.1:5432:5432"
     environment:
       POSTGRES_PASSWORD: ${DB_PASSWORD}
 ```

package/bundled-skills/event-staffing-ordering/SKILL.md

@@ -50,6 +50,10 @@ Collect before submitting:
 - **Attire/uniform requirements**
 - **Special requirements** (bilingual staff, certifications, overnight shifts)
 
+Do not collect payment details, credentials, private attendee data, venue
+contracts, or other sensitive documents in chat. Route those through TempGuru's
+human-reviewed submission and contracting process instead.
+
 ### 2. Validate with the MCP tools
 
 1. `get_cities` — confirm coverage and market tier.

package/bundled-skills/grill-me/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: grill-me
+description: A relentless interview to sharpen a plan or design.
+disable-model-invocation: true
+category: "productivity"
+risk: "safe"
+source: "community"
+source_repo: "mattpocock/skills"
+source_type: "community"
+date_added: "2026-06-19"
+author: "Matt Pocock"
+license: "MIT"
+license_source: "https://github.com/mattpocock/skills/blob/main/LICENSE"
+tags:
+  - productivity
+  - workflow
+  - coding-agents
+tools:
+  - claude-code
+  - codex-cli
+  - cursor
+---
+
+## When to Use
+
+Use when this workflow matches the user request: A relentless interview to sharpen a plan or design.
+
+
+_Source: [mattpocock/skills](https://github.com/mattpocock/skills) (MIT)._Run a `/grilling` session.
+
+
+## Limitations
+
+- Requires the upstream tool, account, API key, or local setup when the workflow names one.
+- Does not authorize destructive, production, paid, or external-message actions without explicit user approval.
+- Validate generated artifacts or recommendations against the user's real sources before treating them as final.

package/bundled-skills/grill-with-docs/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: grill-with-docs
+description: A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
+disable-model-invocation: true
+category: "productivity"
+risk: "safe"
+source: "community"
+source_repo: "mattpocock/skills"
+source_type: "community"
+date_added: "2026-06-19"
+author: "Matt Pocock"
+license: "MIT"
+license_source: "https://github.com/mattpocock/skills/blob/main/LICENSE"
+tags:
+  - productivity
+  - workflow
+  - coding-agents
+tools:
+  - claude-code
+  - codex-cli
+  - cursor
+---
+
+## When to Use
+
+Use when this workflow matches the user request: A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
+
+
+_Source: [mattpocock/skills](https://github.com/mattpocock/skills) (MIT)._Run a `/grilling` session, using the `/domain-modeling` skill.
+
+
+## Limitations
+
+- Requires the upstream tool, account, API key, or local setup when the workflow names one.
+- Does not authorize destructive, production, paid, or external-message actions without explicit user approval.
+- Validate generated artifacts or recommendations against the user's real sources before treating them as final.

package/bundled-skills/grilling/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: grilling
+description: Interview the user relentlessly about a plan or design. Use when the user wants to stress-test a plan before building, or uses any 'grill' trigger phrases.
+category: "productivity"
+risk: "safe"
+source: "community"
+source_repo: "mattpocock/skills"
+source_type: "community"
+date_added: "2026-06-19"
+author: "Matt Pocock"
+license: "MIT"
+license_source: "https://github.com/mattpocock/skills/blob/main/LICENSE"
+tags:
+  - productivity
+  - workflow
+  - coding-agents
+tools:
+  - claude-code
+  - codex-cli
+  - cursor
+---
+
+## When to Use
+
+Use when this workflow matches the user request: Interview the user relentlessly about a plan or design. Use when the user wants to stress-test a plan before building, or uses any 'grill' trigger phrases.
+
+
+_Source: [mattpocock/skills](https://github.com/mattpocock/skills) (MIT)._Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
+
+Ask the questions one at a time, waiting for feedback on each question before continuing. Asking multiple questions at once is bewildering.
+
+If a question can be answered by exploring the codebase, explore the codebase instead.
+
+
+## Limitations
+
+- Requires the upstream tool, account, API key, or local setup when the workflow names one.
+- Does not authorize destructive, production, paid, or external-message actions without explicit user approval.
+- Validate generated artifacts or recommendations against the user's real sources before treating them as final.

package/bundled-skills/handoff/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: handoff
+description: Compact the current conversation into a handoff document for another agent to pick up.
+argument-hint: "What will the next session be used for?"
+disable-model-invocation: true
+category: "productivity"
+risk: "safe"
+source: "community"
+source_repo: "mattpocock/skills"
+source_type: "community"
+date_added: "2026-06-19"
+author: "Matt Pocock"
+license: "MIT"
+license_source: "https://github.com/mattpocock/skills/blob/main/LICENSE"
+tags:
+  - productivity
+  - workflow
+  - coding-agents
+tools:
+  - claude-code
+  - codex-cli
+  - cursor
+---
+
+## When to Use
+
+Use when this workflow matches the user request: Compact the current conversation into a handoff document for another agent to pick up.
+
+
+_Source: [mattpocock/skills](https://github.com/mattpocock/skills) (MIT)._Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save to the temporary directory of the user's OS - not the current workspace.
+
+Include a "suggested skills" section in the document, which suggests skills that the agent should invoke.
+
+Do not duplicate content already captured in other artifacts (PRDs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.
+
+Redact any sensitive information, such as API keys, passwords, or personally identifiable information.
+
+If the user passed arguments, treat them as a description of what the next session will focus on and tailor the doc accordingly.
+
+
+## Limitations
+
+- Requires the upstream tool, account, API key, or local setup when the workflow names one.
+- Does not authorize destructive, production, paid, or external-message actions without explicit user approval.
+- Validate generated artifacts or recommendations against the user's real sources before treating them as final.

package/bundled-skills/image-generator/.env.example

@@ -0,0 +1,7 @@
+# Gemini API Key for Image Generation
+# Get your key from: https://aistudio.google.com/
+#
+# Set this as an environment variable in your shell profile (~/.zshrc or ~/.bashrc):
+#   export GEMINI_API_KEY="your_api_key_here"
+
+GEMINI_API_KEY=your_api_key_here