opencode-skills-collection 3.1.13 → 3.1.14

package/bundled-skills/hugging-face-model-trainer/scripts/convert_to_gguf.py

@@ -34,11 +34,13 @@ Usage:
     - BASE_MODEL: Base model used for fine-tuning (e.g., "Qwen/Qwen2.5-0.5B")
     - OUTPUT_REPO: Where to upload GGUF files (e.g., "username/my-model-gguf")
     - HF_USERNAME: Your Hugging Face username (optional, for README)
+    - TRUST_REMOTE_CODE: Set to "1" only for reviewed model repositories that require custom code
 
 Dependencies: All required packages are declared in PEP 723 header above.
 """
 
 import os
+import re
 import sys
 import torch
 from transformers import AutoModelForCausalLM, AutoTokenizer
@@ -99,6 +101,23 @@ def run_command(cmd, description):
         return False
 
 
+HF_REPO_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,95}/[A-Za-z0-9][A-Za-z0-9._-]{0,95}$")
+
+
+def require_hf_repo_id(value, name):
+    """Reject local paths, URLs, and shell-like values before loading models."""
+    if not HF_REPO_ID_RE.fullmatch(value):
+        print(
+            f"   Invalid {name}: {value!r}. Use a Hugging Face repo id like owner/model.",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+
+def env_flag(name):
+    return os.environ.get(name, "").strip().lower() in {"1", "true", "yes", "on"}
+
+
 print("🔄 GGUF Conversion Script")
 print("=" * 60)
 
@@ -112,11 +131,17 @@ ADAPTER_MODEL = os.environ.get("ADAPTER_MODEL", "evalstate/qwen-capybara-medium"
 BASE_MODEL = os.environ.get("BASE_MODEL", "Qwen/Qwen2.5-0.5B")
 OUTPUT_REPO = os.environ.get("OUTPUT_REPO", "evalstate/qwen-capybara-medium-gguf")
 username = os.environ.get("HF_USERNAME", ADAPTER_MODEL.split('/')[0])
+TRUST_REMOTE_CODE = env_flag("TRUST_REMOTE_CODE")
+
+require_hf_repo_id(ADAPTER_MODEL, "ADAPTER_MODEL")
+require_hf_repo_id(BASE_MODEL, "BASE_MODEL")
+require_hf_repo_id(OUTPUT_REPO, "OUTPUT_REPO")
 
 print(f"\n📦 Configuration:")
 print(f"   Base model: {BASE_MODEL}")
 print(f"   Adapter model: {ADAPTER_MODEL}")
 print(f"   Output repo: {OUTPUT_REPO}")
+print(f"   Trust remote code: {TRUST_REMOTE_CODE}")
 
 # Step 1: Load base model and adapter
 print("\n🔧 Step 1: Loading base model and LoRA adapter...")
@@ -127,7 +152,7 @@ try:
         BASE_MODEL,
         dtype=torch.float16,
         device_map="auto",
-        trust_remote_code=True,
+        trust_remote_code=TRUST_REMOTE_CODE,
     )
     print("   ✅ Base model loaded")
 except Exception as e:
@@ -149,7 +174,10 @@ except Exception as e:
 
 try:
     # Load tokenizer
-    tokenizer = AutoTokenizer.from_pretrained(ADAPTER_MODEL, trust_remote_code=True)
+    tokenizer = AutoTokenizer.from_pretrained(
+        ADAPTER_MODEL,
+        trust_remote_code=TRUST_REMOTE_CODE,
+    )
     print("   ✅ Tokenizer loaded")
 except Exception as e:
     print(f"   ❌ Failed to load tokenizer: {e}")

package/bundled-skills/mdpr-skill/SKILL.md

@@ -0,0 +1,233 @@
+---
+name: mdpr-skill
+description: "Review MDPR Markdown presentation workflows with semantic hints, visual checks, and deterministic renderer boundaries."
+category: productivity
+risk: safe
+source: community
+source_repo: ch040602/mdpr-skill
+source_type: community
+date_added: "2026-07-01"
+author: ch040602
+tags: [mdpr, presentations, markdown, powerpoint, codex, visual-review, agent-hints]
+tools: [claude, cursor, gemini, codex, antigravity]
+license: "MIT"
+license_source: "https://github.com/ch040602/mdpr-skill/blob/main/LICENSE"
+---
+
+# mdpr-skill
+
+## Overview
+
+Use this skill as the optional agent companion for
+[MDPR](https://github.com/ch040602/MdPr), a deterministic
+Markdown-to-presentation runtime. MDPR owns parsing, layout, theming,
+validation, and final PPTX/HTML/PDF rendering. This skill helps an agent review
+MDPR workflows, propose weak semantic hints, and explain visual findings without
+taking control of slide geometry.
+
+The upstream skill source is
+[`ch040602/mdpr-skill`](https://github.com/ch040602/mdpr-skill), which includes
+schemas, review commands, compatibility artifacts, visual evidence examples, and
+MDPR boundary documentation.
+
+## When to Use This Skill
+
+- Use when the user asks about MDPR, `mdpresent`, Markdown-to-PPTX, or
+  Markdown presentation review.
+- Use when generated MDPR artifacts need semantic, narrative, accessibility, or
+  visual review notes.
+- Use when the user wants Codex-style presentation workflow hints while keeping
+  MDPR as the deterministic renderer.
+- Use when comparing MDPR output against image-only deck generators such as a
+  codex-ppt style workflow.
+- Use when a reusable theme or style-pack proposal should be expressed as an
+  approval-bound MDPR candidate instead of direct final slide edits.
+
+## Core Boundary
+
+- Let MDPR own parsing, slide splitting, recipes, layout, coordinates,
+  geometry, typography, colors, z-order, arrows, effects, exact icon assets,
+  renderer object IDs, and final PPTX objects.
+- Keep agent output semantic, evidence-based, and schema-valid.
+- Express fixes as Markdown cleanup, MDPR rulebook changes, config changes,
+  deterministic policy changes, or approval-bound proposals.
+- Preserve the ability to build the same deck with all agent hints disabled.
+- Do not mutate source Markdown unless the user explicitly asks for a cleaned
+  source draft.
+
+## How It Works
+
+### Step 1: Identify the MDPR Surface
+
+Classify the user's request before producing advice:
+
+- `semantic hints`: compact intent, grouping, importance, and icon-keyword
+  suggestions.
+- `review report`: visual or narrative concerns grounded in rendered evidence,
+  manifests, or validation reports.
+- `layout intent`: high-level layout goals from a summarized template catalog,
+  never concrete placeholder coordinates.
+- `theme candidate`: reusable token and style-pack proposal for later MDPR
+  approval/import gates.
+- `codex-ppt compatibility`: feature mapping and comparison notes only; do not
+  turn MDPR into a full-slide image renderer.
+
+### Step 2: Ground Every Finding
+
+Reference available evidence such as:
+
+- source Markdown path or heading text
+- MDPR manifest summaries
+- rendered preview image paths
+- validation report IDs
+- source notes or citation metadata
+- schema names such as `agent-hint.json`, `review-report.json`, or
+  `mdpr-theme-candidate-v1`
+
+If evidence is missing, say what artifact is needed instead of inventing a
+pass/fail result.
+
+### Step 3: Keep Hints Weak
+
+Allowed hints:
+
+- slide or section intent
+- content grouping
+- relative importance
+- icon-search keywords
+- accessibility or citation review notes
+- generated-image candidate briefs when an icon would be too small or too
+  semantically ambiguous
+
+Disallowed hints:
+
+- final coordinates, sizes, z-order, geometry, or object IDs
+- exact colors, typography, arrows, effects, or icon asset choices
+- final layout IDs or placeholder IDs
+- pass/fail validation decisions not backed by MDPR validation
+
+### Step 4: Route Fixes to MDPR-Owned Changes
+
+When repeated issues appear, recommend a deterministic follow-up surface:
+
+- Markdown cleanup
+- MDPR rulebook change
+- MDPR config/profile change
+- MDPR theme-pack registration
+- MDPR validation improvement
+- approval-bound deck-local override or style-pack candidate
+
+## Useful Local Commands
+
+Run these only when the upstream `mdpr-skill` CLI is available in the current
+workspace and the referenced input files exist.
+
+```bash
+node bin/mdpr-skill.js hint --source-sha256 <64hex> --out .mdpresent/proposals/agent-hint.json
+node bin/mdpr-skill.js review --manifest dist/mdpresent-manifest.json --out .mdpresent/review/review-report.json
+node bin/mdpr-skill.js narrative --markdown deck.md --manifest dist/mdpresent-manifest.json --out .mdpresent/review/narrative-review.json
+node bin/mdpr-skill.js layout-intent --layout-catalog template-layout-catalog.json --out .mdpresent/review/layout-intent.json
+node bin/mdpr-skill.js accessibility --markdown deck.md --audience "executive review" --out .mdpresent/review/accessibility-review.json
+```
+
+## Examples
+
+### Review a Rendered MDPR Deck
+
+1. Read the source Markdown, manifest summary, rendered image list, and any
+   validation report.
+2. Separate source-content problems from renderer/rulebook problems.
+3. Report only evidence-backed visual concerns.
+4. Recommend deterministic MDPR fixes when the same issue repeats.
+
+```markdown
+Finding: Slide 4 has weak visual hierarchy between the metric and explanation.
+Evidence: rendered/slide-04.png, manifest slide id `s4`, heading "Revenue Mix".
+MDPR-owned fix: adjust the metric-card recipe spacing rule or choose a
+deterministic layout profile with stronger numeric emphasis.
+```
+
+### Propose a Theme Candidate
+
+1. Treat the source design as a visual system, not content to copy.
+2. Extract reusable tokens, semantic layout blueprints, decoration grammar, and
+   best-fit scenarios.
+3. Emit an approval-bound `mdpr-theme-candidate-v1`.
+4. Keep `mdprOwnsFinalLayout`, `mdprOwnsFinalThemeBinding`, and
+   `noRawUseInAgentHints` true.
+
+```json
+{
+  "schema": "mdpr-theme-candidate-v1",
+  "source": "rendered reference set approved by user",
+  "useCases": ["executive review", "research update"],
+  "constraints": {
+    "mdprOwnsFinalLayout": true,
+    "mdprOwnsFinalThemeBinding": true,
+    "noRawUseInAgentHints": true
+  }
+}
+```
+
+### Compare with codex-ppt Style Workflows
+
+Use codex-ppt only as a capability reference or image-only baseline. Preserve
+the output-model distinction: codex-ppt style workflows may produce full-slide
+images, while MDPR defaults to editable PPTX/HTML/PDF with deterministic
+validation.
+
+```markdown
+Comparison note: codex-ppt style output may optimize for a single rasterized
+slide image. MDPR should instead preserve editable slide objects and route
+visual improvements through recipes, themes, and validation policies.
+```
+
+## Best Practices
+
+- Do: Prefer concise semantic hints over restating the source.
+- Do: Keep review notes actionable for MDPR maintainers.
+- Do: Call out missing evidence before making quality claims.
+- Do: Treat LLM judgment as triage only; MDPR validation remains the release
+  gate.
+- Avoid: Turning generated asset prompts into final asset selections.
+- Avoid: Recommending raw colors, coordinates, or renderer object IDs from
+  agent judgment alone.
+
+## Limitations
+
+- This skill does not replace MDPR runtime validation.
+- This skill does not generate final slide coordinates or final PPTX objects.
+- This skill does not make MDPR depend on an LLM.
+- This skill should not be used to copy private deck designs or proprietary
+  slide content.
+
+## Common Pitfalls
+
+- **Problem:** Treating mdpr-skill output as final slide layout.
+  **Solution:** Keep hints semantic and let MDPR choose final layout, geometry,
+  and renderer objects.
+
+- **Problem:** Reporting visual issues without evidence.
+  **Solution:** Link each finding to source Markdown, a manifest entry, rendered
+  previews, validation reports, or another concrete artifact.
+
+- **Problem:** Copying codex-ppt image-only behavior into MDPR.
+  **Solution:** Use image-only generators as comparison baselines while
+  preserving MDPR's editable PPTX/HTML/PDF output model.
+
+## Security & Safety Notes
+
+- Review only files the user has provided or authorized.
+- Do not fetch private references, credentials, or paid assets without explicit
+  permission.
+- Do not include secrets, API keys, or private source content in generated
+  review reports or theme candidates.
+- Treat all CLI commands as local workspace commands; confirm input paths exist
+  before running them.
+
+## Related Skills
+
+- `@frontend-slides` - Use for browser-native HTML presentation generation.
+- `@2slides-ppt-generator` - Use for hosted API-based presentation generation.
+- `@office-productivity` - Use for broader document, spreadsheet, and slide
+  workflow coordination.

package/bundled-skills/riffkit/SKILL.md

@@ -2,7 +2,7 @@
 name: riffkit
 description: "Riff a winning TikTok into your own short video — study a proven video's emotion formula and regenerate it with your product, character, and language (EN/ES). Also makes UGC ad creative."
 category: api-integration
-risk: safe
+risk: critical
 source: community
 source_repo: riffkit/skill
 source_type: community
@@ -115,7 +115,7 @@ riff https://www.tiktok.com/@user/video/123 into my product video, in Spanish
 
 Riffkit is a hosted service — generating videos requires a Riffkit account (billed by the second of finished video). No local GPU or models. Create an account at https://riffkit.ai.
 
-**On the `risk: safe` label:** the skill performs no destructive or privileged actions — it only reads account data and submits render jobs a normal authenticated user can make. It *does* trigger a paid render, but that spend is gated behind an explicit, per-run user confirmation (see the workflow's Step 4 and the Security & Safety Notes) — it never spends autonomously. This matches other billed-API skills already in the catalog (e.g. `2slides-ppt-generator`).
+**On the `risk: critical` label:** the skill handles a live account session token and `POST /api/riffs` starts a paid render. The workflow requires explicit, per-run confirmation before submitting, but the catalog risk label must still reflect token handling and billable mutation.
 
 ## Related Skills
 

package/bundled-skills/sql-sentinel/SKILL.md

@@ -2,7 +2,7 @@
 name: sql-sentinel
 description: "Audit SQL for the cost & performance anti-patterns that burn warehouse credits. Scores warehouse health 0-100 and outputs a prioritized cost-reduction plan for BigQuery, Snowflake, Redshift, and Postgres."
 category: data
-risk: safe
+risk: critical
 source: community
 source_repo: takeaseatventure/sql-sentinel
 source_type: community
@@ -10,6 +10,14 @@ date_added: "2026-06-26"
 author: takeaseat
 tags: [sql, bigquery, snowflake, redshift, postgres, data-warehouse, cost-optimization, performance, audit, finops]
 tools: [claude, cursor, codex, gemini]
+plugin:
+  targets:
+    codex: blocked
+    claude: blocked
+  setup:
+    type: manual
+    summary: "Clone the upstream analyzer only after pinning or reviewing the exact commit to run."
+    docs: SKILL.md
 license: "MIT"
 license_source: "https://github.com/takeaseatventure/sql-sentinel/blob/main/LICENSE"
 ---
@@ -22,7 +30,7 @@ A static-analysis skill that audits SQL for the cost & performance anti-patterns
 
 Built for analytics engineers (dbt, Looker), data platform teams running FinOps / "reduce cloud spend" initiatives, and anyone reviewing a SQL pull request before it hits production. Works across BigQuery, Snowflake, Redshift, and Postgres. Zero dependencies, MIT licensed.
 
-The executable engine and full rule set live in the source repository: https://github.com/takeaseatventure/sql-sentinel
+The executable engine and full rule set live in the source repository: https://github.com/takeaseatventure/sql-sentinel. Treat that repository as third-party executable code.
 
 ## When to Use This Skill
 
@@ -38,11 +46,12 @@ The engine splits a SQL script into statements (honoring quotes and comments), r
 
 ### Step 1: Run the audit
 
-Install or clone the source repository, then run the zero-dependency engine:
+Install or clone the source repository only after choosing a reviewed commit, tag, or release to trust. Do not run code from a mutable default branch just because this skill links to it:
 
 ```bash
 git clone https://github.com/takeaseatventure/sql-sentinel.git
 cd sql-sentinel
+git checkout <reviewed-commit-or-tag>
 node scripts/sql-sentinel.js path/to/query.sql
 ```
 

package/bundled-skills/weaviate/references/environment_requirements.md

@@ -30,5 +30,8 @@ Use this reference when building apps that connect to Weaviate and require exter
 
 ## Usage Notes
 
+- Provider keys are not forwarded automatically. Set `WEAVIATE_PROVIDER_KEYS`
+  to a comma-separated allowlist, for example `OPENAI_API_KEY,COHERE_API_KEY`.
 - Set only the provider keys your collection configuration actually uses.
-- If multiple providers are configured, include all corresponding headers.
+- If multiple providers are configured, include only those corresponding
+  headers.

package/bundled-skills/weaviate/scripts/weaviate_conn.py

@@ -3,8 +3,8 @@ Shared Weaviate connection utilities.
 
 This module handles:
 - Environment variable validation
-- API key to header mapping for all supported providers
-- Client connection with automatic header configuration
+- Explicit API key to header mapping for selected providers
+- Client connection with caller-controlled header configuration
 
 Usage in scripts:
     import sys
@@ -23,7 +23,11 @@ from weaviate.classes.init import Auth
 from weaviate.client import WeaviateClient
 from weaviate.classes.init import AdditionalConfig, Timeout
 
-# Canonical environment variable to Weaviate header mapping
+# Canonical environment variable to Weaviate header mapping.
+#
+# These values are never forwarded implicitly. Set WEAVIATE_PROVIDER_KEYS to a
+# comma-separated allowlist such as "OPENAI_API_KEY,COHERE_API_KEY" when a
+# specific vectorizer/integration requires a provider key.
 API_KEY_MAP = {
     "ANTHROPIC_API_KEY": "X-Anthropic-Api-Key",
     "ANYSCALE_API_KEY": "X-Anyscale-Api-Key",
@@ -45,17 +49,37 @@ API_KEY_MAP = {
 }
 
 
+def _selected_provider_keys() -> set[str]:
+    raw = os.environ.get("WEAVIATE_PROVIDER_KEYS", "").strip()
+    if not raw:
+        return set()
+
+    selected = {item.strip() for item in raw.split(",") if item.strip()}
+    unknown = sorted(selected - set(API_KEY_MAP))
+    if unknown:
+        print(
+            "Error: WEAVIATE_PROVIDER_KEYS contains unsupported key(s): "
+            + ", ".join(unknown),
+            file=sys.stderr,
+        )
+        sys.exit(1)
+    return selected
+
+
 def _collect_headers_and_providers() -> tuple[dict[str, str], list[str]]:
     """
-    Scan env once to build Weaviate headers and detected key names.
+    Build Weaviate headers only for explicitly selected provider env vars.
 
     Returns:
         Tuple of (headers, detected_env_var_names)
     """
     headers: dict[str, str] = {}
     detected_providers: list[str] = []
+    selected = _selected_provider_keys()
 
     for env_var, header_name in API_KEY_MAP.items():
+        if env_var not in selected:
+            continue
         value = os.environ.get(env_var, "").strip()
         if not value:
             continue
@@ -97,13 +121,13 @@ def validate_env(require_weaviate: bool = True) -> tuple[str, str]:
 
 def get_headers() -> dict[str, str] | None:
     """
-    Build headers dict from all available API keys in environment.
+    Build headers dict from the WEAVIATE_PROVIDER_KEYS allowlist.
 
-    Scans environment for all known API key variables and builds
-    the appropriate headers dict for Weaviate client connection.
+    Provider keys are sensitive and often unrelated to the current Weaviate
+    operation, so this helper never scans and forwards every matching key.
 
     Returns:
-        Dict of headers if any API keys found, None otherwise
+        Dict of headers if selected API keys are present, None otherwise
     """
     headers, _ = _collect_headers_and_providers()
     return headers if headers else None
@@ -111,7 +135,7 @@ def get_headers() -> dict[str, str] | None:
 
 def get_detected_providers() -> list[str]:
     """
-    Get list of detected API key environment variable names.
+    Get list of selected API key environment variable names that are present.
 
     Returns:
         List of env var names (e.g., ["OPENAI_API_KEY", "COHERE_API_KEY"])
@@ -140,8 +164,8 @@ def get_client(
     """
     Context manager for Weaviate client connection.
 
-    Auto-detects credentials from environment if not provided.
-    Auto-builds headers from all available API keys if not provided.
+    Reads Weaviate credentials from environment if not provided.
+    Builds provider headers only from WEAVIATE_PROVIDER_KEYS when not provided.
 
     Args:
         url: Weaviate cluster URL (default: from WEAVIATE_URL env var)

package/bundled-skills/youtube-notetaker/scripts/serve.py

@@ -74,23 +74,27 @@ def library_path(lib, *parts):
 def media_path(lib, filename):
     if not SAFE_MEDIA_RE.fullmatch(filename or ""):
         return None
-    media_dir = library_path(lib, "_media")
-    if not media_dir or not media_dir.is_dir():
+    root = Path(lib).resolve()
+    candidate = root / "_media" / filename
+    if candidate.is_symlink():
+        return None
+    path = library_path(lib, "_media", filename)
+    if not path or not path.is_file():
         return None
-    for path in media_dir.iterdir():
-        if path.is_file() and path.name == filename:
-            return path
-    return None
+    return path
 
 
 def item_path(lib, slug):
     if not SAFE_SLUG_RE.fullmatch(slug or ""):
         return None
-    target = slug + ".md"
-    for path in Path(lib).resolve().iterdir():
-        if path.is_file() and path.name == target:
-            return path
-    return None
+    root = Path(lib).resolve()
+    candidate = root / (slug + ".md")
+    if candidate.is_symlink():
+        return None
+    path = library_path(lib, slug + ".md")
+    if not path or not path.is_file():
+        return None
+    return path
 
 
 def safe_content_type(ctype):
@@ -222,7 +226,12 @@ def self_test():
         (root / "video_1.md").write_text("---\ntitle: Demo\n---\nBody", encoding="utf-8")
         (root / "_media").mkdir()
         (root / "_media" / "video_1-slide-01.jpg").write_bytes(b"x")
+        (root / "secret.md").write_text("secret", encoding="utf-8")
+        (root / "linked.md").symlink_to(root / "secret.md")
+        (root / "_media" / "linked.jpg").symlink_to(root / "secret.md")
         assert load_item(str(root), "video_1")
+        assert load_item(str(root), "linked") is None
+        assert media_path(str(root), "linked.jpg") is None
         assert load_item(str(root), "../secret") is None
         assert library_path(str(root), "_media", "../video_1.md") is None
         assert safe_content_type("text/html; charset=utf-8") == "text/html; charset=utf-8"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "3.1.13",
+  "version": "3.1.14",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",