opencode-skills-collection 3.1.12 → 3.1.13

package/bundled-skills/openapi-spec-generator/SKILL.md

@@ -0,0 +1,335 @@
+---
+name: openapi-spec-generator
+description: Generate complete, production-ready OpenAPI 3.x and Swagger 2.0 specifications from natural language descriptions, code, or partial specs. Use this skill whenever the user mentions OpenAPI, Swagger, API spec, REST API documentation, YAML/JSON API schema, endpoint documentation, API...
+risk: unknown
+source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/openapi-spec-generator
+source_repo: LambdaTest/agent-skills
+source_type: community
+date_added: 2026-07-01
+license: MIT
+license_source: https://github.com/LambdaTest/agent-skills/blob/main/LICENSE
+---
+
+# OpenAPI / Swagger Specification Generator
+## When to Use
+
+Use this skill when you need generate complete, production-ready OpenAPI 3.x and Swagger 2.0 specifications from natural language descriptions, code, or partial specs. Use this skill whenever the user mentions OpenAPI, Swagger, API spec, REST API documentation, YAML/JSON API schema, endpoint documentation, API...
+
+
+Generate complete, valid OpenAPI 3.x or Swagger 2.0 specifications from descriptions, code, or partial specs.
+
+## Workflow
+
+### Step 1 — Gather Context
+
+Before writing any YAML/JSON, ask (or infer from context) the following:
+
+| Question | Why it matters |
+|---|---|
+| OpenAPI 3.x or Swagger 2.0? | Different `info`, `servers`/`host`, `components`/`definitions` structure |
+| Output format: YAML or JSON? | YAML default unless user specifies JSON |
+| What does this API do? | Sets `info.title`, `info.description`, tags |
+| List of endpoints (or code to extract from)? | Core paths object |
+| Authentication type(s)? | `securitySchemes` — see reference |
+| Common data models or entities? | `components/schemas` / `definitions` |
+| Any existing partial spec to extend? | Merge rather than overwrite |
+
+If the user provides code (Express routes, FastAPI, Django URLs, Spring controllers, etc.), **extract endpoints automatically** — do not ask what the user already told you.
+
+### Step 2 — Build the Spec
+
+Follow the structure guide for the chosen version. Always produce a **complete, valid spec** — never leave placeholder comments like `# TODO: add schema`.
+
+#### OpenAPI 3.x Skeleton
+
+```yaml
+openapi: "3.1.0"
+info:
+  title: <API Title>
+  version: "1.0.0"
+  description: <Short description>
+  contact:
+    name: <Team or Author>
+    email: <contact@example.com>
+servers:
+  - url: https://api.example.com/v1
+    description: Production
+  - url: https://staging-api.example.com/v1
+    description: Staging
+tags:
+  - name: <Tag>
+    description: <Tag description>
+paths:
+  /resource:
+    get:
+      summary: List resources
+      operationId: listResources
+      tags: [<Tag>]
+      parameters: []
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ResourceList"
+              example:
+                items: []
+                total: 0
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalError"
+      security:
+        - BearerAuth: []
+components:
+  schemas: {}
+  responses:
+    Unauthorized:
+      description: Authentication required
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/Error"
+    InternalError:
+      description: Internal server error
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/Error"
+  securitySchemes: {}
+```
+
+#### Swagger 2.0 Skeleton
+
+```yaml
+swagger: "2.0"
+info:
+  title: <API Title>
+  version: "1.0.0"
+  description: <Short description>
+host: api.example.com
+basePath: /v1
+schemes: [https]
+consumes: [application/json]
+produces: [application/json]
+tags: []
+paths: {}
+definitions: {}
+securityDefinitions: {}
+```
+
+### Step 3 — Schemas and Models
+
+- **Always use `$ref`** for any schema used in more than one place.
+- Include `example` or `examples` on every schema and response body.
+- Mark required fields with the `required` array.
+- Use `nullable: true` (OAS 3.0) or `x-nullable: true` (Swagger 2.0) for optional nullable fields.
+- Prefer `format` keywords: `int32`, `int64`, `float`, `date`, `date-time`, `uuid`, `email`, `uri`, `byte`, `binary`.
+
+**Common schema patterns:**
+
+```yaml
+# Pagination wrapper
+PagedResult:
+  type: object
+  required: [items, total, page, pageSize]
+  properties:
+    items:
+      type: array
+      items:
+        $ref: "#/components/schemas/Resource"
+    total:
+      type: integer
+      format: int64
+      example: 100
+    page:
+      type: integer
+      format: int32
+      example: 1
+    pageSize:
+      type: integer
+      format: int32
+      example: 20
+
+# Standard error
+Error:
+  type: object
+  required: [code, message]
+  properties:
+    code:
+      type: string
+      example: RESOURCE_NOT_FOUND
+    message:
+      type: string
+      example: The requested resource was not found.
+    details:
+      type: object
+      additionalProperties: true
+
+# Timestamps mixin (use allOf)
+Timestamps:
+  type: object
+  properties:
+    createdAt:
+      type: string
+      format: date-time
+    updatedAt:
+      type: string
+      format: date-time
+```
+
+### Step 4 — Security Schemes
+
+Read `reference/security-schemes.md` for detailed patterns. Quick reference:
+
+| Scheme | OAS 3.x type | Notes |
+|---|---|---|
+| Bearer JWT | `http`, scheme `bearer` | Most common for REST APIs |
+| API Key (header) | `apiKey`, in `header` | e.g. `X-API-Key` |
+| API Key (query) | `apiKey`, in `query` | Avoid — leaks in logs |
+| OAuth 2 | `oauth2` | Use `flows` to define grant types |
+| Basic Auth | `http`, scheme `basic` | Only over HTTPS |
+| OpenID Connect | `openIdConnect` | Provide `openIdConnectUrl` |
+
+Apply security **globally** at the root and **override per-operation** only where it differs (e.g., public endpoints use `security: []`).
+
+### Step 5 — Parameters
+
+**Path parameters** — always `required: true`:
+```yaml
+parameters:
+  - name: userId
+    in: path
+    required: true
+    schema:
+      type: string
+      format: uuid
+    example: 123e4567-e89b-12d3-a456-426614174000
+```
+
+**Query parameters** — document defaults and enums:
+```yaml
+  - name: status
+    in: query
+    schema:
+      type: string
+      enum: [active, inactive, pending]
+      default: active
+```
+
+**Headers** — include `X-Request-ID`, correlation IDs, etc. as common parameters defined under `components/parameters`.
+
+### Step 6 — Response Codes
+
+Always include at minimum:
+
+| Code | When |
+|---|---|
+| `200` | Successful GET, PUT, PATCH |
+| `201` | Successful POST that creates a resource |
+| `204` | Successful DELETE (no body) |
+| `400` | Validation / bad request |
+| `401` | Missing or invalid auth |
+| `403` | Authenticated but not authorized |
+| `404` | Resource not found |
+| `409` | Conflict (duplicate, state mismatch) |
+| `422` | Unprocessable entity (semantic errors) |
+| `429` | Rate limited |
+| `500` | Internal server error |
+
+Use `$ref` to `components/responses` for `401`, `403`, `404`, `429`, `500` to avoid repetition.
+
+### Step 7 — Quality Checklist
+
+Before delivering the spec, verify:
+
+- [ ] `openapi` or `swagger` version field present
+- [ ] Every path has at least one operation
+- [ ] Every operation has `operationId` (camelCase, unique)
+- [ ] Every operation has at least one `200`/`201`/`204` response
+- [ ] `4xx` and `5xx` responses defined for all operations
+- [ ] All `$ref` targets exist in `components/` or `definitions/`
+- [ ] Required fields listed in `required` array for all request/response bodies
+- [ ] Security schemes defined AND applied
+- [ ] At least one `example` per schema or response body
+- [ ] Tags defined at root level to match operation tags
+- [ ] No orphaned schemas (everything in `components/schemas` is referenced)
+
+### Step 8 — Output
+
+1. Emit the complete YAML (or JSON) spec in a code block labeled `yaml` or `json`.
+2. After the spec, provide a brief **summary table** of endpoints generated.
+3. Offer to:
+   - Export as `.yaml` / `.json` file
+   - Validate against Spectral or swagger-parser
+   - Generate mock server config (Prism)
+   - Generate client SDK stubs (language of choice)
+
+---
+
+## Extracting from Code
+
+When the user provides source code, extract:
+
+**Express / Koa / Fastify (Node.js)**
+- Look for `.get()`, `.post()`, `.put()`, `.patch()`, `.delete()` calls
+- Route params `:param` → path parameter `{param}`
+- Middleware like `authenticate` → note security requirement
+- `req.body`, `req.query`, `req.params` usage → infer request schema
+
+**FastAPI / Flask (Python)**
+- Decorators: `@app.get()`, `@router.post()`, etc.
+- Pydantic models → translate directly to JSON Schema
+- `Query()`, `Path()`, `Body()` → map to parameter location
+
+**Spring Boot (Java)**
+- `@GetMapping`, `@PostMapping`, etc.
+- `@PathVariable`, `@RequestParam`, `@RequestBody`
+- DTO classes → schemas
+
+**Django REST Framework**
+- `ViewSet` and `Router` → CRUD endpoints
+- `Serializer` fields → schema properties
+
+**Rails**
+- `routes.rb` resource routes → standard REST endpoints
+- Strong params → request body schema
+
+---
+
+## Reference Files
+
+- `reference/security-schemes.md` — Detailed security scheme examples for all auth types
+- `reference/common-patterns.md` — Pagination, HATEOAS, problem+json, webhooks, file upload patterns
+
+Read these when the user asks about a specific pattern or when generating complex auth/pagination setups.
+
+
+---
+
+## After Completing the OpenAPI/Swagger Specification design
+
+Once the OpenAPI/Swagger Specification output is delivered, ask the user:
+
+"Would you like me to generate API test cases for this design? (yes/no)"
+
+If the user says **yes**:
+- Check if the API Test Case Generator skill is available in the installed skills list
+- If the skill **is available**:
+  - Read and follow the instructions in the API Test Case Generator skill
+  - Use the specification output above as the input
+- If the skill **is NOT available**:
+  - Inform the user: "It looks like the API Documentation skill isn't installed.
+    You can install it and re-run.
+
+If the user says **no**:
+- End the task here
+
+---
+
+## Limitations
+
+- Use this skill only when the task clearly matches its upstream source and local project context.
+- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
+- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.

package/bundled-skills/performance-optimization/SKILL.md

@@ -0,0 +1,363 @@
+---
+name: performance-optimization
+description: Optimizes application performance. Use when performance requirements exist, when you suspect performance regressions, or when Core Web Vitals or load times need improvement. Use when profiling reveals bottlenecks that need fixing.
+risk: unknown
+source: https://github.com/addyosmani/agent-skills/tree/main/skills/performance-optimization
+source_repo: addyosmani/agent-skills
+source_type: community
+date_added: 2026-07-01
+license: MIT
+license_source: https://github.com/addyosmani/agent-skills/blob/main/LICENSE
+---
+
+# Performance Optimization
+
+## Overview
+
+Measure before optimizing. Performance work without measurement is guessing — and guessing leads to premature optimization that adds complexity without improving what matters. Profile first, identify the actual bottleneck, fix it, measure again. Optimize only what measurements prove matters.
+
+## When to Use
+
+- Performance requirements exist in the spec (load time budgets, response time SLAs)
+- Users or monitoring report slow behavior
+- Core Web Vitals scores are below thresholds
+- You suspect a change introduced a regression
+- Building features that handle large datasets or high traffic
+
+**When NOT to use:** Don't optimize before you have evidence of a problem. Premature optimization adds complexity that costs more than the performance it gains.
+
+## Core Web Vitals Targets
+
+| Metric | Good | Needs Improvement | Poor |
+|--------|------|-------------------|------|
+| **LCP** (Largest Contentful Paint) | ≤ 2.5s | ≤ 4.0s | > 4.0s |
+| **INP** (Interaction to Next Paint) | ≤ 200ms | ≤ 500ms | > 500ms |
+| **CLS** (Cumulative Layout Shift) | ≤ 0.1 | ≤ 0.25 | > 0.25 |
+
+## The Optimization Workflow
+
+```
+1. MEASURE  → Establish baseline with real data
+2. IDENTIFY → Find the actual bottleneck (not assumed)
+3. FIX      → Address the specific bottleneck
+4. VERIFY   → Measure again, confirm improvement
+5. GUARD    → Add monitoring or tests to prevent regression
+```
+
+### Step 1: Measure
+
+Two complementary approaches — use both:
+
+- **Synthetic (Lighthouse, DevTools Performance tab):** Controlled conditions, reproducible. Best for CI regression detection and isolating specific issues.
+- **RUM (web-vitals library, CrUX):** Real user data in real conditions. Required to validate that a fix actually improved user experience.
+
+**Frontend:**
+```bash
+# Synthetic: Lighthouse in Chrome DevTools (or CI)
+# Chrome DevTools → Performance tab → Record
+# Chrome DevTools MCP → Performance trace
+
+# RUM: Web Vitals library in code
+import { onLCP, onINP, onCLS } from 'web-vitals';
+
+onLCP(console.log);
+onINP(console.log);
+onCLS(console.log);
+```
+
+**Backend:**
+```bash
+# Response time logging
+# Application Performance Monitoring (APM)
+# Database query logging with timing
+
+# Simple timing
+console.time('db-query');
+const result = await db.query(...);
+console.timeEnd('db-query');
+```
+
+### Where to Start Measuring
+
+Use the symptom to decide what to measure first:
+
+```
+What is slow?
+├── First page load
+│   ├── Large bundle? --> Measure bundle size, check code splitting
+│   ├── Slow server response? --> Measure TTFB in DevTools Network waterfall
+│   │   ├── DNS long? --> Add dns-prefetch / preconnect for known origins
+│   │   ├── TCP/TLS long? --> Enable HTTP/2, check edge deployment, keep-alive
+│   │   └── Waiting (server) long? --> Profile backend, check queries and caching
+│   └── Render-blocking resources? --> Check network waterfall for CSS/JS blocking
+├── Interaction feels sluggish
+│   ├── UI freezes on click? --> Profile main thread, look for long tasks (>50ms)
+│   ├── Form input lag? --> Check re-renders, controlled component overhead
+│   └── Animation jank? --> Check layout thrashing, forced reflows
+├── Page after navigation
+│   ├── Data loading? --> Measure API response times, check for waterfalls
+│   └── Client rendering? --> Profile component render time, check for N+1 fetches
+└── Backend / API
+    ├── Single endpoint slow? --> Profile database queries, check indexes
+    ├── All endpoints slow? --> Check connection pool, memory, CPU
+    └── Intermittent slowness? --> Check for lock contention, GC pauses, external deps
+```
+
+### Step 2: Identify the Bottleneck
+
+Common bottlenecks by category:
+
+**Frontend:**
+
+| Symptom | Likely Cause | Investigation |
+|---------|-------------|---------------|
+| Slow LCP | Large images, render-blocking resources, slow server | Check network waterfall, image sizes |
+| High CLS | Images without dimensions, late-loading content, font shifts | Check layout shift attribution |
+| Poor INP | Heavy JavaScript on main thread, large DOM updates | Check long tasks in Performance trace |
+| Slow initial load | Large bundle, many network requests | Check bundle size, code splitting |
+
+**Backend:**
+
+| Symptom | Likely Cause | Investigation |
+|---------|-------------|---------------|
+| Slow API responses | N+1 queries, missing indexes, unoptimized queries | Check database query log |
+| Memory growth | Leaked references, unbounded caches, large payloads | Heap snapshot analysis |
+| CPU spikes | Synchronous heavy computation, regex backtracking | CPU profiling |
+| High latency | Missing caching, redundant computation, network hops | Trace requests through the stack |
+
+### Step 3: Fix Common Anti-Patterns
+
+#### N+1 Queries (Backend)
+
+```typescript
+// BAD: N+1 — one query per task for the owner
+const tasks = await db.tasks.findMany();
+for (const task of tasks) {
+  task.owner = await db.users.findUnique({ where: { id: task.ownerId } });
+}
+
+// GOOD: Single query with join/include
+const tasks = await db.tasks.findMany({
+  include: { owner: true },
+});
+```
+
+#### Unbounded Data Fetching
+
+```typescript
+// BAD: Fetching all records
+const allTasks = await db.tasks.findMany();
+
+// GOOD: Paginated with limits
+const tasks = await db.tasks.findMany({
+  take: 20,
+  skip: (page - 1) * 20,
+  orderBy: { createdAt: 'desc' },
+});
+```
+
+#### Missing Image Optimization (Frontend)
+
+```html
+<!-- BAD: No dimensions, no format optimization -->
+<img src="/hero.jpg" />
+
+<!-- GOOD: Hero / LCP image — art direction + resolution switching, high priority -->
+<!--
+  Two techniques combined:
+  - Art direction (media): different crop/composition per breakpoint
+  - Resolution switching (srcset + sizes): right file size per screen density
+-->
+<picture>
+  <!-- Mobile: portrait crop (8:10) -->
+  <source
+    media="(max-width: 767px)"
+    srcset="/hero-mobile-400.avif 400w, /hero-mobile-800.avif 800w"
+    sizes="100vw"
+    width="800"
+    height="1000"
+    type="image/avif"
+  />
+  <source
+    media="(max-width: 767px)"
+    srcset="/hero-mobile-400.webp 400w, /hero-mobile-800.webp 800w"
+    sizes="100vw"
+    width="800"
+    height="1000"
+    type="image/webp"
+  />
+  <!-- Desktop: landscape crop (2:1) -->
+  <source
+    srcset="/hero-800.avif 800w, /hero-1200.avif 1200w, /hero-1600.avif 1600w"
+    sizes="(max-width: 1200px) 100vw, 1200px"
+    width="1200"
+    height="600"
+    type="image/avif"
+  />
+  <source
+    srcset="/hero-800.webp 800w, /hero-1200.webp 1200w, /hero-1600.webp 1600w"
+    sizes="(max-width: 1200px) 100vw, 1200px"
+    width="1200"
+    height="600"
+    type="image/webp"
+  />
+  <img
+    src="/hero-desktop.jpg"
+    width="1200"
+    height="600"
+    fetchpriority="high"
+    alt="Hero image description"
+  />
+</picture>
+
+<!-- GOOD: Below-the-fold image — lazy loaded + async decoding -->
+<img
+  src="/content.webp"
+  width="800"
+  height="400"
+  loading="lazy"
+  decoding="async"
+  alt="Content image description"
+/>
+```
+
+#### Unnecessary Re-renders (React)
+
+```tsx
+// BAD: Creates new object on every render, causing children to re-render
+function TaskList() {
+  return <TaskFilters options={{ sortBy: 'date', order: 'desc' }} />;
+}
+
+// GOOD: Stable reference
+const DEFAULT_OPTIONS = { sortBy: 'date', order: 'desc' } as const;
+function TaskList() {
+  return <TaskFilters options={DEFAULT_OPTIONS} />;
+}
+
+// Use React.memo for expensive components
+const TaskItem = React.memo(function TaskItem({ task }: Props) {
+  return <div>{/* expensive render */}</div>;
+});
+
+// Use useMemo for expensive computations
+function TaskStats({ tasks }: Props) {
+  const stats = useMemo(() => calculateStats(tasks), [tasks]);
+  return <div>{stats.completed} / {stats.total}</div>;
+}
+```
+
+#### Large Bundle Size
+
+```typescript
+// Modern bundlers (Vite, webpack 5+) handle named imports with tree-shaking automatically,
+// provided the dependency ships ESM and is marked `sideEffects: false` in package.json.
+// Profile before changing import styles — the real gains come from splitting and lazy loading.
+
+// GOOD: Dynamic import for heavy, rarely-used features
+const ChartLibrary = lazy(() => import('./ChartLibrary'));
+
+// GOOD: Route-level code splitting wrapped in Suspense
+const SettingsPage = lazy(() => import('./pages/Settings'));
+
+function App() {
+  return (
+    <Suspense fallback={<Spinner />}>
+      <SettingsPage />
+    </Suspense>
+  );
+}
+```
+
+#### Missing Caching (Backend)
+
+```typescript
+// Cache frequently-read, rarely-changed data
+const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
+let cachedConfig: AppConfig | null = null;
+let cacheExpiry = 0;
+
+async function getAppConfig(): Promise<AppConfig> {
+  if (cachedConfig && Date.now() < cacheExpiry) {
+    return cachedConfig;
+  }
+  cachedConfig = await db.config.findFirst();
+  cacheExpiry = Date.now() + CACHE_TTL;
+  return cachedConfig;
+}
+
+// HTTP caching headers for static assets
+app.use('/static', express.static('public', {
+  maxAge: '1y',           // Cache for 1 year
+  immutable: true,        // Never revalidate (use content hashing in filenames)
+}));
+
+// Cache-Control for API responses
+res.set('Cache-Control', 'public, max-age=300'); // 5 minutes
+```
+
+## Performance Budget
+
+Set budgets and enforce them:
+
+```
+JavaScript bundle: < 200KB gzipped (initial load)
+CSS: < 50KB gzipped
+Images: < 200KB per image (above the fold)
+Fonts: < 100KB total
+API response time: < 200ms (p95)
+Time to Interactive: < 3.5s on 4G
+Lighthouse Performance score: ≥ 90
+```
+
+**Enforce in CI:**
+```bash
+# Bundle size check
+npx bundlesize --config bundlesize.config.json
+
+# Lighthouse CI
+npx lhci autorun
+```
+
+## See Also
+
+For detailed performance checklists, optimization commands, and anti-pattern reference, see `references/performance-checklist.md`.
+
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+|---|---|
+| "We'll optimize later" | Performance debt compounds. Fix obvious anti-patterns now, defer micro-optimizations. |
+| "It's fast on my machine" | Your machine isn't the user's. Profile on representative hardware and networks. |
+| "This optimization is obvious" | If you didn't measure, you don't know. Profile first. |
+| "Users won't notice 100ms" | Research shows 100ms delays impact conversion rates. Users notice more than you think. |
+| "The framework handles performance" | Frameworks prevent some issues but can't fix N+1 queries or oversized bundles. |
+
+## Red Flags
+
+- Optimization without profiling data to justify it
+- N+1 query patterns in data fetching
+- List endpoints without pagination
+- Images without dimensions, lazy loading, or responsive sizes
+- Bundle size growing without review
+- No performance monitoring in production
+- `React.memo` and `useMemo` everywhere (overusing is as bad as underusing)
+
+## Verification
+
+After any performance-related change:
+
+- [ ] Before and after measurements exist (specific numbers)
+- [ ] The specific bottleneck is identified and addressed
+- [ ] Core Web Vitals are within "Good" thresholds
+- [ ] Bundle size hasn't increased significantly
+- [ ] No N+1 queries in new data fetching code
+- [ ] Performance budget passes in CI (if configured)
+- [ ] Existing tests still pass (optimization didn't break behavior)
+
+## Limitations
+
+- Use this skill only when the task clearly matches its upstream source and local project context.
+- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
+- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.