opencode-skills-collection 3.1.14 → 3.1.16

package/bundled-skills/push-skill-to-github/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: push-skill-to-github
+description: "Commit and push skill changes to the configured skills repository after review and validation."
+category: development
+risk: critical
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [skills, git, publishing]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+---
+
+# Push Skills to GitHub
+
+## When to Use
+
+- Use when skill changes are ready to commit and push to the configured skills repo.
+- Use when the user asks to save or publish skill updates after validation.
+
+For committing any skill change to the user's private skills repo, git root **`~/.agents`** (this is also the canonical skill folder; `.claude` and `.pi/agent/skills` symlink to `~/.agents/skills`). Pushes here auto-publish a sanitized public mirror to `davidondrej/skills` — never push directly to that public repo.
+
+Use this after creating or editing a skill. If the skill is distributed to all agents, do that first (`distribute-skill-to-all-agents`), then run this to push the canonical copy.
+
+## Steps
+
+**Not in cmux?** (no `$CMUX_WORKSPACE_ID`): skip the cmux pane steps — just run the git commands from step 2 directly in any available terminal, then verify the push output.
+
+1. **Open a fresh cmux pane** in the current workspace, no focus steal:
+   ```bash
+   cmux new-pane --type terminal --direction right --workspace "$CMUX_WORKSPACE_ID" --focus false
+   cmux list-panes --workspace "$CMUX_WORKSPACE_ID"   # note the NEW pane + its surface ref
+   ```
+2. **Stage, commit, push** in `~/.agents` (send to the new pane's surface):
+   ```bash
+   cmux send --surface surface:NEW 'cd ~/.agents && git add -A && git commit -m "<concise message>" && git push'
+   cmux send-key --surface surface:NEW enter
+   ```
+3. **Verify** the push landed:
+   ```bash
+   sleep 2
+   cmux read-screen --surface surface:NEW | tail -15   # expect "main -> main"
+   ```
+4. **Close the pane** once confirmed:
+   ```bash
+   cmux close-surface --surface surface:NEW
+   cmux list-panes --workspace "$CMUX_WORKSPACE_ID"    # confirm the pane is gone
+   ```
+
+## Notes
+- Always run git from `~/.agents` (the repo root), not `~/.agents/skills`.
+- Write a concise, specific commit message describing the skill change.
+- Only push to GitHub when the user asks. Don't push speculatively.
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.

package/bundled-skills/rclone-cli/references/commands/rclone_completion_powershell.md

@@ -18,10 +18,11 @@ Generate the autocompletion script for powershell.
 To load completions in your current shell session:
 
 ```console
-rclone completion powershell | Out-String | Invoke-Expression
+rclone completion powershell | Out-File -Encoding utf8 "$HOME\Documents\PowerShell\rclone-completion.ps1"
 ```
 
-To load completions for every new session, add the output of the above command
+Inspect the generated script, then dot-source it from your profile if you want completions
+for every new session.
 to your powershell profile.
 
 If output_file is "-" or missing, then the output will be written to stdout.

package/bundled-skills/read-all-adrs/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: read-all-adrs
+description: "Read every ADR in a project before summarizing architectural context or decisions."
+category: productivity
+risk: safe
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [adr, documentation, architecture]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+disable-model-invocation: true
+---
+
+<!-- TODO(David): write the strong wording here -->
+
+## When to Use
+
+- Use when the user explicitly asks to load ADR context.
+- Use when architectural decisions must be understood before changing or judging a project.
+
+Read EVERY single ADR `.md` file in this project's `docs/adr/` folder, start to
+finish.
+
+Do not skim. Read each ADR completely before summarizing.
+
+Read every single ADR file, for this project, in full.
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.

package/bundled-skills/remote-gpu-trainer/scripts/verify_local.py

@@ -22,6 +22,19 @@ import sys
 from pathlib import Path
 
 
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
+
 def main() -> int:
     ap = argparse.ArgumentParser()
     ap.add_argument("ckpt_dir", help="Directory containing ablation subdirs (each with best.pth + best_metrics.json)")
@@ -33,7 +46,7 @@ def main() -> int:
                          "needed only when a checkpoint pickles non-tensor objects (e.g. an args Namespace); OFF by default")
     args = ap.parse_args()
 
-    root = Path(args.ckpt_dir)
+    root = safe_user_path(args.ckpt_dir)
     if not root.exists():
         print(f"ERROR: {root} does not exist")
         return 1

package/bundled-skills/research-prompt/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: research-prompt
+description: "Turn vague research needs into one precise deep-research prompt with context and output criteria."
+category: research
+risk: safe
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [research, prompting, briefs]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+---
+
+# Research Prompt
+
+## When to Use
+
+- Use when the user wants a deep-research brief or researcher prompt.
+- Use when a vague research question needs to become one precise self-contained paragraph.
+
+Goal: turn a vague research need into ONE self-contained paragraph that a researcher with zero prior knowledge of the project can act on with zero back-and-forth.
+
+## Rules
+
+- **One paragraph.** No headers, no bullet list in the deliverable.
+- **Prompt the job, not the topic.** Give search handles (timeframe, ranking, source type, decision logic) — not just a subject.
+- **Assume zero prior knowledge.** Write for a researcher who has never heard of the project. Open by explaining, in plain English, what the project/product is, why it exists, and the current situation — so they understand what's going on, what we need, and why we need it.
+- **Lead with the goal + decision.** Right after that explainer, state the single question the research must answer and the decision/use it informs.
+- **Embed all context.** Names, dates, product, prior known facts, constraints. The researcher must not need to ask anything or guess.
+- **Number the sub-questions inline** (1, 2, 3…) so coverage is explicit. Keep to 3–6. One mission per prompt — don't cram unrelated questions.
+- **State constraints.** What to include, what to avoid (e.g. "only non-Chinese competitors", "no marketing fluff").
+- **Source hierarchy.** Prefer primary sources (official docs, GitHub, papers, filings, changelogs); forums/X/Reddit are weak signal only, never factual proof.
+- **Contradiction handling.** If sources conflict, separate confirmed facts / inference / unresolved uncertainty — don't force fake consensus. Flag low-confidence claims for verification.
+- **Completion bar (define "done").** Don't stop at the first plausible answer. Corroborate each key claim with multiple independent primary sources where they exist; where sources are scarce, say so explicitly instead of padding. Keep going until every numbered sub-question is covered to this bar.
+- **Gap round before finishing.** Require a final self-critique pass: list gaps, contradictions, and any single-source claims, then run another round of searches to close them — repeat until clean.
+- **Constrain output hard, method loosely.** Be strict on the deliverable; leave the search path flexible so the researcher can explore.
+- **Demand a fixed output per finding:** source link + specific claim + one-line "why it matters / why a viewer should care".
+- Verifiable, citable facts only. No opinions.
+- **Last sentence:** instruct them to output everything into a single detailed markdown file.
+
+## Process
+
+1. Pull context from the relevant project files / conversation (dates, names, known facts, audience, end use), and write a 1–2 sentence plain-English explainer of what the project is and why it exists for a reader who knows nothing.
+2. Identify the ONE question the research answers.
+3. Draft 3–6 numbered sub-questions that fully cover it.
+4. Add include/avoid constraints + the per-finding output format.
+5. Compress to one clean paragraph. Cut filler.
+
+## Template
+
+> [For a reader with zero prior knowledge: in 1–2 plain-English sentences, what the project/product is, why it exists, and the current situation.] Research [TOPIC + key identifying facts] to answer one question: [THE QUESTION] — for [DECISION / END USE]. Find: (1) …; (2) …; (3) …; (4) …. [Constraints: include X, avoid Y.] Prefer primary sources; treat forums/social as weak signal only; if sources conflict, separate fact from inference and flag what needs verification. Don't stop at the first plausible answer: corroborate each key claim with multiple independent primary sources where they exist (and say so explicitly where they don't), continuing until every numbered question is covered to that bar. Before finishing, do a self-critique pass — list gaps, contradictions, and any single-source claims, then run another round of searches to close them, repeating until clean. For each point, give the source link, the specific claim, and a one-line "why it matters". No marketing fluff — verifiable, citable facts only. Output everything into a single detailed markdown file.
+
+## Executing the prompt
+
+To run the finished prompt with an AI researcher, execute it via DeepAPI `POST /v1/research/deep` — follow the `deep-research` skill.
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.

package/bundled-skills/run-deep-swe/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: run-deep-swe
+description: "Run reproducible DeepSWE coding-agent benchmark evaluations through OpenRouter and mini-swe-agent."
+category: agent-evaluation
+risk: critical
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [benchmark, deepswe, openrouter, evaluation]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+disable-model-invocation: true
+---
+
+# Run DeepSWE via OpenRouter
+
+## When to Use
+
+- Use when the user wants to benchmark a model on DeepSWE or mini-swe-agent tasks.
+- Use when you need a reproducible coding-agent evaluation plan and output artifacts.
+
+DeepSWE (deepswe.datacurve.ai) is a 113-task Harbor-compatible coding-agent benchmark. It runs via **Pier** (Harbor fork) driving **mini-swe-agent** (model-agnostic). Any model reachable through OpenRouter can be scored.
+
+## Prerequisites — state-check first
+
+```bash
+which uv git docker || echo "MISSING: install uv, git, docker"
+docker info >/dev/null 2>&1 || echo "MISSING: Docker daemon not running (Pier's default sandbox)"
+echo "OPENROUTER_API_KEY set? ${OPENROUTER_API_KEY:+YES}"
+```
+
+**Docker must be running** — Pier sandboxes each task in Docker by default (`--env modal` for cloud instead).
+
+`OPENROUTER_API_KEY` must already be present in the environment. If it is unset,
+ask the user to configure their preferred secret-management path; do not read
+shell startup files, print secrets, or invent a key.
+
+## Setup
+
+```bash
+git clone https://github.com/datacurve-ai/deep-swe && cd deep-swe
+uv tool install datacurve-pier            # PyPI (preferred)
+# or: uv tool install git+https://github.com/datacurve-ai/pier
+# pier bundles mini-swe-agent as the --agent driver
+```
+
+Run all `pier` commands from inside `deep-swe/`, using relative `-p tasks/...`.
+
+## OpenRouter wiring (the part the docs don't spell out)
+
+mini-swe-agent has a native OpenRouter model class. Both routes below use `OPENROUTER_API_KEY` and the OpenRouter slug (`vendor/model`, e.g. `minimax/minimax-m3`):
+
+**Route A — native OpenRouter class (preferred, hits openrouter.ai/api/v1 directly):**
+```bash
+pier run -p deep-swe/tasks --agent mini-swe-agent \
+  --model minimax/minimax-m3 --model-class openrouter
+```
+
+**Route B — LiteLLM provider prefix (fallback; same key):**
+```bash
+pier run -p deep-swe/tasks --agent mini-swe-agent \
+  --model openrouter/minimax/minimax-m3
+```
+
+Notes:
+- Slug = the exact OpenRouter slug. Verify it at openrouter.ai/models before running.
+- Free/zero-cost models: OpenRouter cost tracking can error. Set `export MSWEA_COST_TRACKING=ignore_errors`.
+- Flag spelling can vary by version — confirm with `pier run --help` and `mini --help`.
+
+## Smoke test FIRST (1 task — do this before any full run)
+
+Always validate end-to-end wiring on a single task before spending tokens on the corpus:
+
+```bash
+pier run -p deep-swe/tasks/<task-id> --agent mini-swe-agent \
+  --model minimax/minimax-m3 --model-class openrouter
+# list available task ids:
+ls deep-swe/tasks
+```
+
+Pass criteria: run completes, model returns actions (not auth/format errors), a score/trajectory is emitted. If it 401s → key wrong. If "provider not provided"/"model not mapped" → fix slug or switch route.
+
+## Subset run (deterministic sample)
+
+```bash
+pier run -p deep-swe/tasks --agent mini-swe-agent \
+  --model minimax/minimax-m3 --model-class openrouter \
+  --n-tasks 10 --sample-seed 0
+```
+
+## Full 113-task corpus (costs tokens + time — confirm with user first)
+
+```bash
+pier run -p deep-swe/tasks --agent mini-swe-agent \
+  --model minimax/minimax-m3 --model-class openrouter
+# add `--env modal` to run in parallel Modal sandboxes (needs Modal configured)
+```
+
+## Output & leaderboard
+
+- Trials land in `jobs/<run>/<trial_id>/`. Inspect with `pier view jobs/<run>`, `pier analyze jobs/<run>`, or `pier critique run jobs/<run>`.
+- Report: the exact command used, pass/fail, score, and any blockers.
+- Submit results for the official leaderboard to: **<email-address>**
+
+## Failure modes
+
+| Symptom | Cause | Fix |
+|---|---|---|
+| HTTP 401 | bad/missing key | re-export `OPENROUTER_API_KEY` |
+| "LLM Provider NOT provided" | missing slug prefix | use Route B `openrouter/...` or Route A with `--model-class openrouter` |
+| "model isn't mapped"/cost error | unknown cost for model | `export MSWEA_COST_TRACKING=ignore_errors` |
+| unknown flag | version drift | check `pier run --help` |
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.

package/bundled-skills/senior-architect/scripts/architecture_diagram_generator.py

@@ -9,13 +9,26 @@ import sys
 import json
 import argparse
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Dict, List, Optional
 
 class ArchitectureDiagramGenerator:
     """Main class for architecture diagram generator functionality"""
     
     def __init__(self, target_path: str, verbose: bool = False):
-        self.target_path = Path(target_path)
+        self.target_path = safe_user_path(target_path)
         self.verbose = verbose
         self.results = {}
     
@@ -104,7 +117,7 @@ def main():
     if args.json:
         output = json.dumps(results, indent=2)
         if args.output:
-            with open(args.output, 'w') as f:
+            with safe_user_path(args.output).open('w') as f:
                 f.write(output)
             print(f"Results written to {args.output}")
         else:

package/bundled-skills/senior-architect/scripts/dependency_analyzer.py

@@ -9,13 +9,26 @@ import sys
 import json
 import argparse
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Dict, List, Optional
 
 class DependencyAnalyzer:
     """Main class for dependency analyzer functionality"""
     
     def __init__(self, target_path: str, verbose: bool = False):
-        self.target_path = Path(target_path)
+        self.target_path = safe_user_path(target_path)
         self.verbose = verbose
         self.results = {}
     
@@ -104,7 +117,7 @@ def main():
     if args.json:
         output = json.dumps(results, indent=2)
         if args.output:
-            with open(args.output, 'w') as f:
+            with safe_user_path(args.output).open('w') as f:
                 f.write(output)
             print(f"Results written to {args.output}")
         else:

package/bundled-skills/senior-architect/scripts/project_architect.py

@@ -9,13 +9,26 @@ import sys
 import json
 import argparse
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Dict, List, Optional
 
 class ProjectArchitect:
     """Main class for project architect functionality"""
     
     def __init__(self, target_path: str, verbose: bool = False):
-        self.target_path = Path(target_path)
+        self.target_path = safe_user_path(target_path)
         self.verbose = verbose
         self.results = {}
     
@@ -104,7 +117,7 @@ def main():
     if args.json:
         output = json.dumps(results, indent=2)
         if args.output:
-            with open(args.output, 'w') as f:
+            with safe_user_path(args.output).open('w') as f:
                 f.write(output)
             print(f"Results written to {args.output}")
         else:

package/bundled-skills/senior-frontend/scripts/bundle_analyzer.py

@@ -17,6 +17,19 @@ import os
 import re
 import sys
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Dict, List, Optional, Any, Tuple
 
 
@@ -375,7 +388,7 @@ def main():
     )
 
     args = parser.parse_args()
-    project_dir = Path(args.project_dir).resolve()
+    project_dir = safe_user_path(args.project_dir).resolve()
 
     if not project_dir.exists():
         print(f"Error: Directory not found: {project_dir}", file=sys.stderr)

package/bundled-skills/senior-frontend/scripts/frontend_scaffolder.py

@@ -16,6 +16,19 @@ import json
 import os
 import sys
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Dict, List, Optional
 
 
@@ -989,7 +1002,7 @@ def main():
 
     result = scaffold_project(
         name=args.name,
-        output_dir=Path(args.dir),
+        output_dir=safe_user_path(args.dir),
         template=args.template,
         features=features,
         dry_run=args.dry_run,

package/bundled-skills/senior-fullstack/scripts/code_quality_analyzer.py

@@ -9,13 +9,26 @@ import sys
 import json
 import argparse
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Dict, List, Optional
 
 class CodeQualityAnalyzer:
     """Main class for code quality analyzer functionality"""
     
     def __init__(self, target_path: str, verbose: bool = False):
-        self.target_path = Path(target_path)
+        self.target_path = safe_user_path(target_path)
         self.verbose = verbose
         self.results = {}
     
@@ -104,7 +117,7 @@ def main():
     if args.json:
         output = json.dumps(results, indent=2)
         if args.output:
-            with open(args.output, 'w') as f:
+            with safe_user_path(args.output).open('w') as f:
                 f.write(output)
             print(f"Results written to {args.output}")
         else:

package/bundled-skills/senior-fullstack/scripts/fullstack_scaffolder.py

@@ -9,13 +9,26 @@ import sys
 import json
 import argparse
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Dict, List, Optional
 
 class FullstackScaffolder:
     """Main class for fullstack scaffolder functionality"""
     
     def __init__(self, target_path: str, verbose: bool = False):
-        self.target_path = Path(target_path)
+        self.target_path = safe_user_path(target_path)
         self.verbose = verbose
         self.results = {}
     
@@ -104,7 +117,7 @@ def main():
     if args.json:
         output = json.dumps(results, indent=2)
         if args.output:
-            with open(args.output, 'w') as f:
+            with safe_user_path(args.output).open('w') as f:
                 f.write(output)
             print(f"Results written to {args.output}")
         else:

package/bundled-skills/senior-fullstack/scripts/project_scaffolder.py

@@ -9,13 +9,26 @@ import sys
 import json
 import argparse
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Dict, List, Optional
 
 class ProjectScaffolder:
     """Main class for project scaffolder functionality"""
     
     def __init__(self, target_path: str, verbose: bool = False):
-        self.target_path = Path(target_path)
+        self.target_path = safe_user_path(target_path)
         self.verbose = verbose
         self.results = {}
     
@@ -104,7 +117,7 @@ def main():
     if args.json:
         output = json.dumps(results, indent=2)
         if args.output:
-            with open(args.output, 'w') as f:
+            with safe_user_path(args.output).open('w') as f:
                 f.write(output)
             print(f"Results written to {args.output}")
         else:

package/bundled-skills/setup-help/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: setup-help
+description: "Walk a user through setup or installation one step at a time with the remaining steps visible."
+category: productivity
+risk: safe
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [setup, onboarding, installation]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+disable-model-invocation: true
+---
+
+# setup-help
+
+## When to Use
+
+- Use when the user asks to set up, install, configure, or get something working step by step.
+- Use when the setup has multiple steps and benefits from one-at-a-time guidance.
+
+Guide the user through any setup, one step at a time, in plain English.
+
+## Response format (every single response)
+
+1. **Current step** — ONE atomic action. A single click, field, or command — not a checklist. 1–2 lines max. If it needs sub-steps, it's too big: split it and push the rest into "Still remaining". Plain English.
+2. A `----` divider.
+3. **Still remaining** — a numbered list of the setup steps left after this one. Max 8 items, ever.
+
+Repeat this format for every response until setup is done.
+
+## Rules
+
+- Before the first step, build a complete canonical checklist from the user's outline, repo/docs, current screen, and any discovered prerequisites.
+- The **Still remaining** list must never exceed 8 items — more is overwhelming. Track ALL unfinished checklist items internally; if more than 8 remain, show the nearest steps individually and merge the later ones into broader phase-level items so the list stays at 8 or fewer. Never silently drop a required step from internal tracking.
+- If a new required step is discovered mid-setup, add it to **Still remaining** immediately in the correct order.
+- Before every response, audit the current step plus **Still remaining** against the canonical checklist. If any unfinished step is missing, fix the list before replying.
+- Only give instructions for the current step. Do not jump ahead.
+- Keep it concise. Short sentences. No filler.
+- After the user finishes a step, move the next "remaining" item up to "Current step".
+- Update the "Still remaining" list each time as steps get done.
+- When nothing remains, say setup is complete instead of showing the list.
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.