opencode-skills-collection 3.1.14 → 3.1.16

package/bundled-skills/mobile-design/scripts/mobile_audit.py

@@ -71,6 +71,19 @@ import re
 import json
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 class MobileAuditor:
     def __init__(self):
         self.issues = []
@@ -612,11 +625,12 @@ class MobileAuditor:
 
     def audit_directory(self, directory: str) -> None:
         extensions = {'.tsx', '.ts', '.jsx', '.js', '.dart'}
-        for root, dirs, files in os.walk(directory):
-            dirs[:] = [d for d in dirs if d not in {'node_modules', '.git', 'dist', 'build', '.next', 'ios', 'android', 'build', '.idea'}]
-            for file in files:
-                if Path(file).suffix in extensions:
-                    self.audit_file(os.path.join(root, file))
+        skipped = {'node_modules', '.git', 'dist', 'build', '.next', 'ios', 'android', 'build', '.idea'}
+        for path in safe_user_path(directory).rglob("*"):
+            if not path.is_file() or any(part in skipped for part in path.parts):
+                continue
+            if path.suffix in extensions:
+                self.audit_file(str(path))
 
     def get_report(self):
         return {
@@ -633,7 +647,7 @@ def main():
         print("Usage: python mobile_audit.py <directory>")
         sys.exit(1)
 
-    path = sys.argv[1]
+    path = safe_user_path(sys.argv[1])
     is_json = "--json" in sys.argv
 
     auditor = MobileAuditor()

package/bundled-skills/monte-carlo-validation-notebook/scripts/resolve_dbt_schema.py

@@ -12,6 +12,19 @@ import argparse
 import re
 import sys
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Dict, List, Optional, Tuple, Union
 
 import yaml
@@ -141,8 +154,8 @@ def main() -> None:
 
     args = parser.parse_args()
 
-    dbt_project_path = Path(args.dbt_project_path)
-    model_path = Path(args.model_path)
+    dbt_project_path = safe_user_path(args.dbt_project_path)
+    model_path = safe_user_path(args.model_path)
 
     if not dbt_project_path.exists():
         print(f"Error: dbt_project.yml not found: {dbt_project_path}", file=sys.stderr)

package/bundled-skills/multi-agent-architect/SKILL.md

@@ -321,7 +321,7 @@ async def reflection_node(state: AgentState) -> AgentState:
 - Never expose API keys in generated code. All secrets must use environment variables:
   ```python
   OPENAI_API_KEY = os.getenv("OPENAI_API_KEY")   # ✅ correct
-  OPENAI_API_KEY = "sk-..."                        # ❌ never do this
+  leaked_openai_token = "[redacted API key]"       # ❌ never do this
   ```
 - Always validate and sanitize user inputs before injecting them into agent prompts — treat all user input as untrusted.
 - Add a permission layer before allowing agents to execute shell commands or write to filesystems.

package/bundled-skills/odoo-rpc-api/SKILL.md

@@ -29,12 +29,13 @@ Odoo exposes a powerful external API via JSON-RPC and XML-RPC, allowing any exte
 ### Example 1: Authenticate and Read Records (Python)
 
 ```python
+import os
 import xmlrpc.client
 
 url = 'https://myodoo.example.com'
 db = 'my_database'
 username = 'admin'
-password = 'my_api_key'  # Use API keys, not passwords, in production
+password = os.environ["ODOO_API_KEY"]  # Use API keys, not passwords, in production
 
 # Step 1: Authenticate
 common = xmlrpc.client.ServerProxy(f'{url}/xmlrpc/2/common')

package/bundled-skills/pci-compliance/SKILL.md

@@ -146,8 +146,10 @@ class TokenizedPayment:
     @staticmethod
     def charge_with_token(token_id, amount):
         """Charge using token (server-side)."""
+        import os
+
         # Your server only sees the token, never the card number
-        stripe.api_key = "sk_..."
+        stripe.api_key = os.environ["STRIPE_SECRET_KEY"]
 
         charge = stripe.Charge.create(
             amount=amount,

package/bundled-skills/pdf-official/scripts/create_validation_image.py

@@ -2,6 +2,20 @@ import json
 import sys
 
 from PIL import Image, ImageDraw
+from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 
 
 # Creates "validation" images with rectangles for the bounding box information that
@@ -35,7 +49,7 @@ if __name__ == "__main__":
         print("Usage: create_validation_image.py [page number] [fields.json file] [input image path] [output image path]")
         sys.exit(1)
     page_number = int(sys.argv[1])
-    fields_json_path = sys.argv[2]
-    input_image_path = sys.argv[3]
-    output_image_path = sys.argv[4]
+    fields_json_path = safe_user_path(sys.argv[2])
+    input_image_path = safe_user_path(sys.argv[3])
+    output_image_path = safe_user_path(sys.argv[4])
     create_validation_image(page_number, fields_json_path, input_image_path, output_image_path)

package/bundled-skills/pdf-official/scripts/extract_form_field_info.py

@@ -141,7 +141,7 @@ def write_field_info(pdf_path: str, json_output_path: str):
     reader = PdfReader(pdf_path)
     field_info = get_field_info(reader)
     with open(json_output_path, "w") as f:
-        json.dump(field_info, f, indent=2)
+        f.write(json.dumps(field_info, indent=2))
     print(f"Wrote {len(field_info)} fields to {json_output_path}")
 
 

package/bundled-skills/personal-tool-builder/SKILL.md

@@ -590,7 +590,7 @@ Recommended fix:
 ### Credential Management
 ```javascript
 // Never in code
-const API_KEY = 'sk-xxx'; // BAD
+const leakedToken = '[redacted API key]'; // BAD
 
 // Environment variable
 const API_KEY = process.env.MY_API_KEY;

package/bundled-skills/pi-custom-model/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: pi-custom-model
+description: "Register custom Pi Agent model slugs so saved OpenRouter variants resolve correctly."
+category: operations
+risk: critical
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [pi-agent, models, openrouter]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+disable-model-invocation: true
+---
+
+# Pi custom / variant model
+
+## When to Use
+Pi's saved default only loads if the exact `provider/id` exists in its model registry. Pi ships a static bundled list per provider — so OpenRouter **routing-shortcut variants** (`:nitro` = sort by throughput, `:floor` = cheapest, `:exacto` = quality tool-use) and any brand-new slug are NOT in it. When the default doesn't resolve, Pi silently falls through to its built-in per-provider default (for openrouter that's `moonshotai/kimi-k2.6`) — looking like Pi "reset" your model. Fix = register the slug as a custom model so `find(provider, id)` matches.
+
+## Files (global)
+- `~/.pi/agent/settings.json` — `defaultProvider`, `defaultModel`, `defaultThinkingLevel`
+- `~/.pi/agent/models.json` — custom models, keyed by provider
+- `~/.pi/agent/auth.json` — provider credentials (check the provider key exists)
+
+## Steps
+1. **Confirm the slug is real** before adding it (e.g. check the OpenRouter model/variant exists). A typo'd id also silently falls back.
+2. **Confirm auth.** The provider must have a key in `auth.json` (or an env var like `OPENROUTER_API_KEY`). No auth → the model is registered but unavailable → still falls back.
+3. **Add the model to `models.json`** under `providers.<provider>.models`. For a **built-in provider** (openrouter, anthropic, etc.) you only supply metadata — `api`, `baseUrl`, and auth are inherited from the bundled defaults. Example:
+   ```json
+   {
+     "providers": {
+       "openrouter": {
+         "models": [
+           {
+             "id": "z-ai/glm-5.2:nitro",
+             "name": "Z.ai: GLM 5.2 (nitro)",
+             "reasoning": true,
+             "thinkingLevelMap": { "xhigh": "xhigh" },
+             "input": ["text"],
+             "cost": { "input": 0.95, "output": 3, "cacheRead": 0.18, "cacheWrite": 0 },
+             "contextWindow": 1048576,
+             "maxTokens": 32768,
+             "compat": { "supportsDeveloperRole": false, "thinkingFormat": "openrouter" }
+           }
+         ]
+       }
+     }
+   }
+   ```
+   Copy `cost`/`contextWindow`/`compat` from the base model (the variant shares them) — find the bundled entry in `<pi-pkg>/node_modules/@earendil-works/pi-ai/dist/providers/<provider>.models.js`. Don't hardcode generic 128k/16k if the real model is bigger.
+4. **Set the default** in `settings.json`: `defaultProvider` + `defaultModel` = the exact id. Leave `defaultThinkingLevel` as the user has it.
+5. **Verify:** `pi --list-models | grep <id>` shows it, and JSON parses. Optionally smoke-test: `pi --provider <p> --model "<id>" "which model are you?"`.
+
+## Quirks
+- **Exact match only.** `find()` is exact `provider`+`id` — no fuzzy/colon-stripping for the *saved default* path. The slug in `settings.json` and `models.json` must be byte-identical.
+- **Silent fallback.** Pi prints no error when the default doesn't resolve; it just shows a different model in the footer. That's the tell.
+- **Don't edit `settings.json` alone.** Setting `defaultModel` to an unregistered slug does nothing — `models.json` is the actual fix.
+- **`enabledModels`** (optional) pins the model picker so Ctrl+P cycling can't drift back: `"enabledModels": ["<provider>/<id>:<thinking>"]`.
+- **Project override.** A repo's `.pi/settings.json` overrides global. If a default reverts only inside one project, check that file first.
+- Restart Pi fully — the registry loads at startup.
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.

package/bundled-skills/pi-web-search/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: pi-web-search
+description: "Give Pi Agents a safe web-search and fetch workflow using the installed pi-web-access package."
+category: research
+risk: safe
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [web-search, pi-agent, research]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+---
+
+# Web Search
+
+## When to Use
+
+- Use when a Pi Agent task needs current web information, page fetches, PDFs, YouTube, or GitHub content.
+- Use when Pi should use its own web-access package instead of another agent browser tool.
+
+The `pi-web-access` package is installed globally. Zero-config via Exa MCP (no API key), with fallback Exa → Perplexity → Gemini.
+
+## CRITICAL: always pass `workflow: "none"`
+
+Every `web_search` call MUST include `workflow: "none"`. This skips the interactive browser curator popup (the user does not want it opening). No exceptions — single query or batched `queries`, always set `workflow: "none"`.
+
+```
+web_search({ queries: ["query 1", "query 2"], workflow: "none" })
+```
+
+## Tools
+
+- `web_search` — search the web; returns synthesized answers with citations. Can be called many times per turn. **Always pass `workflow: "none"`.**
+- `code_search` — zero-key Exa code-context. Use for library/API/code lookups instead of generic `web_search`.
+- `fetch_content` — fetch URL(s) → markdown; handles PDFs, YouTube, GitHub.
+- `get_search_content` — big pages (>30k chars) are truncated in responses but stored in full; call this to pull the rest on demand so they don't blow context.
+
+## fetch_content specifics
+
+- **GitHub URLs are cloned, not scraped** — you get real files + a local path to explore with `read`/`bash` (private repos need the `gh` CLI). Use this for dev work.
+- **PDFs** → auto-extracted to markdown in `~/Downloads/`, readable in sections (text-only, no OCR).
+- **YouTube/video** → full raw transcripts + frame extraction. Needs a `GEMINI_API_KEY` (not zero-config); frame extraction also needs `ffmpeg`/`yt-dlp`.
+
+## Routing — match the user's phrasing
+
+Always use the `web_search` tool. These counts are HARD MINIMUMS — count your queries before answering and do not stop short:
+
+- **"web search"** → **at least 2** queries, varied keywords/angles, then synthesize.
+- **"extensive web research"** → **at least 4** queries, totally different keywords and angles.
+- **"deep research"** → **at least 8** queries, totally different keywords and angles, run across 2–3 successive batches (refine angles after each batch), to learn as much as possible about the topic.
+
+A single batched `web_search` call counts each query in `queries[]` toward the total. If your first batch is under the minimum, fire another batch before synthesizing.
+
+## Fallback / alternative: DeepAPI web search
+
+If the Exa → Perplexity → Gemini chain fails, or you need ranked results with URLs:
+
+```bash
+test -n "$DEEPAPI_API_KEY" || { echo "DEEPAPI_API_KEY is not set"; exit 1; }
+curl -s --max-time 60 "https://deepapi.co/v1/search/web" \
+  -H "Authorization: Bearer $DEEPAPI_API_KEY" -H "Content-Type: application/json" \
+  -H "Idempotency-Key: $(uuidgen)" \
+  -d '{"query": "your search terms", "maxResults": 5, "maxCostUsd": "0.05"}'
+```
+
+Results are in `.output` (title, url, snippet per item). Query under 500 chars. Full details: `deepapi` skill.
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.

package/bundled-skills/playwright-skill/run.js

@@ -13,10 +13,28 @@
 const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');
+const sanitizeFilename = require('sanitize-filename');
 
 // Change to skill directory for proper module resolution
 process.chdir(__dirname);
 
+function safeUserPath(pathValue, baseDir = process.cwd()) {
+  const root = path.resolve(baseDir);
+  const segments = String(pathValue ?? '').split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+  const target = path.resolve(root, ...segments);
+  const rel = path.relative(root, target);
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    throw new Error(`Path escapes allowed directory: ${pathValue}`);
+  }
+  return target;
+}
+
 /**
  * Check if Playwright is installed
  */
@@ -54,7 +72,7 @@ function getCodeToExecute() {
 
   // Case 1: File path provided
   if (args.length > 0 && fs.existsSync(args[0])) {
-    const filePath = path.resolve(args[0]);
+    const filePath = safeUserPath(args[0]);
     console.log(`📄 Executing file: ${filePath}`);
     return fs.readFileSync(filePath, 'utf8');
   }

package/bundled-skills/pptx-official/ooxml/scripts/pack.py

@@ -16,6 +16,19 @@ import zipfile
 from pathlib import Path
 
 
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
+
 def validate_input_tree(input_dir: Path):
     root = input_dir.resolve(strict=True)
     for path in input_dir.rglob("*"):
@@ -27,6 +40,18 @@ def validate_input_tree(input_dir: Path):
             raise ValueError(f"Refusing to pack path outside input directory: {path}") from None
 
 
+def copy_tree_contents(source_dir: Path, target_dir: Path) -> None:
+    target_dir.mkdir(parents=True, exist_ok=True)
+    for source_path in source_dir.rglob("*"):
+        relative_path = source_path.relative_to(source_dir)
+        target_path = target_dir / relative_path
+        if source_path.is_dir():
+            target_path.mkdir(parents=True, exist_ok=True)
+        elif source_path.is_file():
+            target_path.parent.mkdir(parents=True, exist_ok=True)
+            target_path.write_bytes(source_path.read_bytes())
+
+
 def main():
     parser = argparse.ArgumentParser(description="Pack a directory into an Office file")
     parser.add_argument("input_directory", help="Unpacked Office document directory")
@@ -65,7 +90,7 @@ def pack_document(input_dir, output_file, validate=False):
         bool: True if successful, False if validation failed
     """
     input_dir = Path(input_dir)
-    output_file = Path(output_file)
+    output_file = safe_user_path(output_file)
 
     if not input_dir.is_dir():
         raise ValueError(f"{input_dir} is not a directory")
@@ -76,7 +101,7 @@ def pack_document(input_dir, output_file, validate=False):
     # Work in temporary directory to avoid modifying original
     with tempfile.TemporaryDirectory() as temp_dir:
         temp_content_dir = Path(temp_dir) / "content"
-        shutil.copytree(input_dir, temp_content_dir)
+        copy_tree_contents(input_dir, temp_content_dir)
 
         # Process XML files to remove pretty-printing whitespace
         for pattern in ["*.xml", "*.rels"]:
@@ -85,10 +110,12 @@ def pack_document(input_dir, output_file, validate=False):
 
         # Create final Office file as zip archive
         output_file.parent.mkdir(parents=True, exist_ok=True)
-        with zipfile.ZipFile(output_file, "w", zipfile.ZIP_DEFLATED) as zf:
+        temp_zip_path = Path(temp_dir) / "office.zip"
+        with zipfile.ZipFile(temp_zip_path, "w", zipfile.ZIP_DEFLATED) as zf:
             for f in temp_content_dir.rglob("*"):
                 if f.is_file():
                     zf.write(f, f.relative_to(temp_content_dir))
+        output_file.write_bytes(temp_zip_path.read_bytes())
 
         # Validate if requested
         if validate:

package/bundled-skills/pptx-official/ooxml/scripts/unpack.py

@@ -8,6 +8,19 @@ import sys
 import zipfile
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 MAX_ARCHIVE_MEMBERS = 5000
 MAX_MEMBER_SIZE = 100 * 1024 * 1024
 MAX_TOTAL_UNCOMPRESSED = 512 * 1024 * 1024
@@ -30,7 +43,7 @@ def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_ro
         return
 
     destination.parent.mkdir(parents=True, exist_ok=True)
-    with archive.open(member, "r") as source, open(destination, "wb") as target:
+    with archive.open(member, "r") as source, safe_user_path(destination).open("wb") as target:
         shutil.copyfileobj(source, target)
 
 
@@ -57,7 +70,7 @@ def _validate_archive_members(archive: zipfile.ZipFile, output_root: Path):
 
 
 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
     output_path.mkdir(parents=True, exist_ok=True)
     output_root = output_path.resolve()
 
@@ -82,7 +95,7 @@ def main(argv: list[str] | None = None):
         raise SystemExit("Usage: python unpack.py <office_file> <output_dir>")
 
     input_file, output_dir = argv
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
     extract_archive_safely(input_file, output_path)
     pretty_print_xml(output_path)
 

package/bundled-skills/pptx-official/scripts/inventory.py

@@ -28,6 +28,19 @@ import platform
 import sys
 from dataclasses import dataclass
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Any, Dict, List, Optional, Tuple, Union
 
 from PIL import Image, ImageDraw, ImageFont
@@ -79,7 +92,7 @@ The output JSON includes:
 
     args = parser.parse_args()
 
-    input_path = Path(args.input)
+    input_path = safe_user_path(args.input)
     if not input_path.exists():
         print(f"Error: Input file not found: {args.input}")
         sys.exit(1)
@@ -96,7 +109,7 @@ The output JSON includes:
             )
         inventory = extract_text_inventory(input_path, issues_only=args.issues_only)
 
-        output_path = Path(args.output)
+        output_path = safe_user_path(args.output)
         output_path.parent.mkdir(parents=True, exist_ok=True)
         save_inventory(inventory, output_path)
 
@@ -1012,8 +1025,8 @@ def save_inventory(inventory: InventoryData, output_path: Path) -> None:
             shape_key: shape_data.to_dict() for shape_key, shape_data in shapes.items()
         }
 
-    with open(output_path, "w", encoding="utf-8") as f:
-        json.dump(json_inventory, f, indent=2, ensure_ascii=False)
+    with safe_user_path(output_path).open("w", encoding="utf-8") as f:
+        f.write(json.dumps(json_inventory, indent=2, ensure_ascii=False))
 
 
 if __name__ == "__main__":

package/bundled-skills/pptx-official/scripts/rearrange.py

@@ -15,6 +15,19 @@ import sys
 from copy import deepcopy
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 import six
 from pptx import Presentation
 
@@ -53,13 +66,13 @@ Note: Slide indices are 0-based (first slide is 0, second is 1, etc.)
         sys.exit(1)
 
     # Check template exists
-    template_path = Path(args.template)
+    template_path = safe_user_path(args.template)
     if not template_path.exists():
         print(f"Error: Template file not found: {args.template}")
         sys.exit(1)
 
     # Create output directory if needed
-    output_path = Path(args.output)
+    output_path = safe_user_path(args.output)
     output_path.parent.mkdir(parents=True, exist_ok=True)
 
     try:

package/bundled-skills/pptx-official/scripts/replace.py

@@ -12,6 +12,19 @@ unless "paragraphs" is specified in the replacements for that shape.
 import json
 import sys
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Any, Dict, List
 
 from inventory import InventoryData, extract_text_inventory
@@ -359,9 +372,9 @@ def main():
         print(__doc__)
         sys.exit(1)
 
-    input_pptx = Path(sys.argv[1])
-    replacements_json = Path(sys.argv[2])
-    output_pptx = Path(sys.argv[3])
+    input_pptx = safe_user_path(sys.argv[1])
+    replacements_json = safe_user_path(sys.argv[2])
+    output_pptx = safe_user_path(sys.argv[3])
 
     if not input_pptx.exists():
         print(f"Error: Input file '{input_pptx}' not found")

package/bundled-skills/product-manager-toolkit/scripts/customer_interview_analyzer.py

@@ -8,6 +8,20 @@ import re
 from typing import Dict, List, Tuple, Set
 from collections import Counter, defaultdict
 import json
+from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 
 class InterviewAnalyzer:
     """Analyze customer interviews for insights and patterns"""
@@ -424,7 +438,7 @@ def main():
         sys.exit(1)
     
     # Read interview transcript
-    with open(sys.argv[1], 'r') as f:
+    with safe_user_path(sys.argv[1]).open('r') as f:
         interview_text = f.read()
     
     # Analyze

package/bundled-skills/production-code-audit/SKILL.md

@@ -281,7 +281,7 @@ await db.query(query, [email]);
 2. ✅ Hardcoded Secrets Removed
 \`\`\`typescript
 // Before (INSECURE)
-const JWT_SECRET = 'my-secret-key-123';
+const tokenSigningKey = '[redacted weak value]';
 
 // After (SECURE)
 const JWT_SECRET = process.env.JWT_SECRET;