opencode-skills-collection 3.1.14 → 3.1.16

package/bundled-skills/shodan-reconnaissance/SKILL.md

@@ -437,8 +437,9 @@ shodan search 'ssl.cert.issuer.cn:self-signed'
 #!/usr/bin/env python3
 import shodan
 import json
+import os
 
-API_KEY = 'YOUR_API_KEY'
+API_KEY = os.environ["SHODAN_API_KEY"]
 api = shodan.Shodan(API_KEY)
 
 def recon_organization(org_name):

package/bundled-skills/short/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: short
+description: "Rewrite the previous response more briefly while preserving the substance."
+category: writing
+risk: safe
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [writing, editing, concise]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+disable-model-invocation: true
+---
+
+rewrite your last response to be simpler & shorter. do not do anything else.
+
+## When to Use
+
+- Use when the user asks for a shorter, simpler, or TLDR version of the previous response.
+- Use when the current answer should be compressed without changing the substance.
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.

package/bundled-skills/skill-creator/scripts/init_skill.py

@@ -15,6 +15,19 @@ import sys
 from pathlib import Path
 
 
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
+
 SKILL_TEMPLATE = """---
 name: {skill_name}
 description: [TODO: Complete and informative explanation of what the skill does and when to use it. Include WHEN to use this skill - specific scenarios, file types, or tasks that trigger it.]
@@ -203,7 +216,7 @@ def init_skill(skill_name, path):
         Path to created skill directory, or None if error
     """
     # Determine skill directory path
-    skill_dir = Path(path).resolve() / skill_name
+    skill_dir = safe_user_path(path).resolve() / skill_name
 
     # Check if directory already exists
     if skill_dir.exists():
@@ -285,7 +298,7 @@ def main():
         sys.exit(1)
 
     skill_name = sys.argv[1]
-    path = sys.argv[3]
+    path = safe_user_path(sys.argv[3])
 
     print(f"🚀 Initializing skill: {skill_name}")
     print(f"   Location: {path}")

package/bundled-skills/skill-creator/scripts/package_skill.py

@@ -12,7 +12,21 @@ Example:
 
 import sys
 import zipfile
+import tempfile
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from quick_validate import validate_skill
 
 
@@ -37,7 +51,7 @@ def package_skill(skill_path, output_dir=None):
     Returns:
         Path to the created .skill file, or None if error
     """
-    skill_path = Path(skill_path).resolve()
+    skill_path = safe_user_path(skill_path).resolve()
 
     # Validate skill folder exists
     if not skill_path.exists():
@@ -66,7 +80,7 @@ def package_skill(skill_path, output_dir=None):
     # Determine output location
     skill_name = skill_path.name
     if output_dir:
-        output_path = Path(output_dir).resolve()
+        output_path = safe_user_path(output_dir).resolve()
         output_path.mkdir(parents=True, exist_ok=True)
     else:
         output_path = Path.cwd()
@@ -75,14 +89,17 @@ def package_skill(skill_path, output_dir=None):
 
     # Create the .skill file (zip format)
     try:
-        with zipfile.ZipFile(skill_filename, 'w', zipfile.ZIP_DEFLATED) as zipf:
-            # Walk through the skill directory
-            for file_path in skill_path.rglob('*'):
-                if should_include(file_path, skill_path):
-                    # Calculate the relative path within the zip
-                    arcname = file_path.relative_to(skill_path.parent)
-                    zipf.write(file_path, arcname)
-                    print(f"  Added: {arcname}")
+        with tempfile.TemporaryDirectory() as temp_dir:
+            temp_zip_path = Path(temp_dir) / "skill.zip"
+            with zipfile.ZipFile(temp_zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
+                # Walk through the skill directory
+                for file_path in skill_path.rglob('*'):
+                    if should_include(file_path, skill_path):
+                        # Calculate the relative path within the zip
+                        arcname = file_path.relative_to(skill_path.parent)
+                        zipf.write(file_path, arcname)
+                        print(f"  Added: {arcname}")
+            skill_filename.write_bytes(temp_zip_path.read_bytes())
 
         print(f"\n✅ Successfully packaged skill to: {skill_filename}")
         return skill_filename
@@ -100,8 +117,8 @@ def main():
         print("  python utils/package_skill.py skills/public/my-skill ./dist")
         sys.exit(1)
 
-    skill_path = sys.argv[1]
-    output_dir = sys.argv[2] if len(sys.argv) > 2 else None
+    skill_path = safe_user_path(sys.argv[1])
+    output_dir = safe_user_path(sys.argv[2]) if len(sys.argv) > 2 else None
 
     print(f"📦 Packaging skill: {skill_path}")
     if output_dir:

package/bundled-skills/skill-creator/scripts/quick_validate.py

@@ -9,9 +9,21 @@ import re
 import yaml
 from pathlib import Path
 
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 def validate_skill(skill_path):
     """Basic validation of a skill"""
-    skill_path = Path(skill_path)
+    skill_path = safe_user_path(skill_path)
 
     # Check SKILL.md exists
     skill_md = skill_path / 'SKILL.md'
@@ -92,4 +104,4 @@ if __name__ == "__main__":
     
     valid, message = validate_skill(sys.argv[1])
     print(message)
-    sys.exit(0 if valid else 1)
+    sys.exit(0 if valid else 1)

package/bundled-skills/skill-creator-ms/SKILL.md

@@ -412,7 +412,7 @@ client = MyClient(endpoint, credential)
 
 #### ❌ INCORRECT: Hardcoded Credentials
 \`\`\`python
-client = MyClient(endpoint, api_key="hardcoded")  # Security risk
+client = MyClient(endpoint, credential="[redacted API key]")  # Security risk
 \`\`\`
 ```
 

package/bundled-skills/skill-installer/scripts/install_skill.py

@@ -33,6 +33,40 @@ import re
 from pathlib import Path
 from datetime import datetime
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
+
+def copy_tree_contents(source_dir: Path, target_dir: Path, *, ignore=None) -> None:
+    target_dir.mkdir(parents=True, exist_ok=True)
+
+    for current_dir, dirs, files in os.walk(source_dir, followlinks=False):
+        current_path = Path(current_dir)
+        ignored_names = set(ignore(str(current_path), dirs + files)) if ignore is not None else set()
+        dirs[:] = [directory for directory in dirs if directory not in ignored_names]
+
+        relative_dir = current_path.relative_to(source_dir)
+        target_current_dir = target_dir / relative_dir
+        target_current_dir.mkdir(parents=True, exist_ok=True)
+
+        for file_name in files:
+            if file_name in ignored_names:
+                continue
+            source_path = current_path / file_name
+            if not source_path.is_file():
+                continue
+            (target_current_dir / file_name).write_bytes(source_path.read_bytes())
+
 # Add scripts directory to path for imports
 SCRIPT_DIR = Path(__file__).parent.resolve()
 sys.path.insert(0, str(SCRIPT_DIR))
@@ -147,7 +181,7 @@ def safe_skill_path(root: Path, skill_name: str) -> Path:
 
 def resolve_skill_source(source: str) -> Path:
     """Resolve and validate a local skill source directory."""
-    source_path = Path(source).expanduser().resolve()
+    source_path = safe_user_path(source).expanduser().resolve()
     if not source_path.is_dir():
         raise ValueError(f"Source does not exist or is not a directory: {source_path}")
     if not (source_path / "SKILL.md").is_file():
@@ -164,7 +198,7 @@ def md5_dir(path: Path, exclude_dirs: set = None) -> str:
     if exclude_dirs is None:
         exclude_dirs = {"backups", "staging", ".git", "__pycache__", "node_modules", ".venv"}
 
-    root_path = Path(path).resolve(strict=True)
+    root_path = safe_user_path(path).resolve(strict=True)
     if not root_path.is_dir():
         raise ValueError(f"Hash target must be a directory: {root_path}")
 
@@ -173,7 +207,7 @@ def md5_dir(path: Path, exclude_dirs: set = None) -> str:
         # Filter out excluded directories
         dirs[:] = [d for d in dirs if d not in exclude_dirs]
         for f in sorted(files):
-            fp = Path(root) / f
+            fp = safe_user_path(root) / f
             try:
                 resolved_fp = fp.resolve(strict=True)
                 resolved_fp.relative_to(root_path)
@@ -370,7 +404,7 @@ def step4_check_conflicts(skill_name: str) -> dict:
 def _backup_ignore(directory, contents):
     """Ignore function for shutil.copytree to skip backup/staging dirs."""
     ignored = set()
-    dir_path = Path(directory)
+    dir_path = safe_user_path(directory)
     for item in contents:
         item_path = dir_path / item
         if item_path.is_symlink():
@@ -436,7 +470,7 @@ def step6_copy_to_skills_root(source_path: Path, skill_name: str) -> dict:
 
     # Copy to staging first (skip backups/staging to prevent recursion)
     try:
-        shutil.copytree(source_path, staging, ignore=_backup_ignore, dirs_exist_ok=True)
+        copy_tree_contents(source_path, staging, ignore=_backup_ignore)
     except Exception as e:
         return {"success": False, "error": f"Copy to staging failed: {e}"}
 
@@ -470,7 +504,7 @@ def step6_copy_to_skills_root(source_path: Path, skill_name: str) -> dict:
     except Exception as e:
         # Try copy + delete as fallback (cross-device moves)
         try:
-            shutil.copytree(staging, dest, dirs_exist_ok=True)
+            copy_tree_contents(staging, dest)
             shutil.rmtree(staging, ignore_errors=True)
         except Exception as e2:
             shutil.rmtree(staging, ignore_errors=True)
@@ -496,7 +530,7 @@ def step7_register_claude(skill_name: str) -> dict:
 
     # Copy SKILL.md
     try:
-        shutil.copy2(source_skill_md, claude_dest_dir / "SKILL.md")
+        (claude_dest_dir / "SKILL.md").write_bytes(source_skill_md.read_bytes())
     except Exception as e:
         return {"success": False, "error": f"Failed to copy SKILL.md to Claude skills: {e}"}
 
@@ -507,7 +541,7 @@ def step7_register_claude(skill_name: str) -> dict:
         try:
             if claude_refs.exists():
                 shutil.rmtree(claude_refs)
-            shutil.copytree(refs_dir, claude_refs)
+            copy_tree_contents(refs_dir, claude_refs)
         except Exception:
             pass  # Non-critical
 

package/bundled-skills/skill-installer/scripts/package_skill.py

@@ -23,8 +23,22 @@ import sys
 import json
 import re
 import zipfile
+import tempfile
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 # ── Configuration ──────────────────────────────────────────────────────────
 
 SKILLS_ROOT = Path(r"C:\Users\renat\skills")
@@ -51,7 +65,7 @@ SAFE_ARCHIVE_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$")
 
 def resolve_existing_dir(path) -> Path:
     """Resolve a user-provided directory and require it to exist."""
-    resolved = Path(path).expanduser().resolve()
+    resolved = safe_user_path(path).expanduser().resolve()
     if not resolved.is_dir():
         raise ValueError(f"Directory not found: {resolved}")
     return resolved
@@ -59,7 +73,7 @@ def resolve_existing_dir(path) -> Path:
 
 def resolve_output_dir(path) -> Path:
     """Resolve a user-provided output directory."""
-    resolved = Path(path).expanduser().resolve()
+    resolved = safe_user_path(path).expanduser().resolve()
     if resolved.exists() and not resolved.is_dir():
         raise ValueError(f"Output path is not a directory: {resolved}")
     return resolved
@@ -218,14 +232,9 @@ def package_skill(skill_dir: Path, output_dir: Path = None) -> dict:
 
     # Collect files
     files_to_include = []
-    for root, dirs, files in os.walk(skill_dir):
-        # Filter directories in-place to skip excluded ones
-        dirs[:] = [d for d in dirs if d not in EXCLUDE_DIRS]
-
-        for f in files:
-            fp = Path(root) / f
-            if should_include(fp, skill_dir):
-                files_to_include.append(fp)
+    for fp in safe_user_path(skill_dir).rglob("*"):
+        if fp.is_file() and should_include(fp, skill_dir):
+            files_to_include.append(fp)
 
     if not files_to_include:
         return {"success": False, "error": "No files to package"}
@@ -233,13 +242,16 @@ def package_skill(skill_dir: Path, output_dir: Path = None) -> dict:
     # Create ZIP with skill folder as root
     # CRITICAL: ZIP paths MUST use forward slashes, not Windows backslashes
     try:
-        with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_DEFLATED) as zf:
-            for fp in sorted(files_to_include):
-                rel_path = fp.relative_to(skill_dir)
-                # Convert Windows backslash to forward slash for ZIP compatibility
-                rel_posix = rel_path.as_posix()
-                archive_path = f"{skill_name_lower}/{rel_posix}"
-                zf.write(fp, archive_path)
+        with tempfile.TemporaryDirectory() as temp_dir:
+            temp_zip_path = Path(temp_dir) / "skill.zip"
+            with zipfile.ZipFile(temp_zip_path, "w", zipfile.ZIP_DEFLATED) as zf:
+                for fp in sorted(files_to_include):
+                    rel_path = fp.relative_to(skill_dir)
+                    # Convert Windows backslash to forward slash for ZIP compatibility
+                    rel_posix = rel_path.as_posix()
+                    archive_path = f"{skill_name_lower}/{rel_posix}"
+                    zf.write(fp, archive_path)
+            zip_path.write_bytes(temp_zip_path.read_bytes())
 
         # Verify ZIP is not empty and valid
         with zipfile.ZipFile(zip_path, "r") as zf_check:

package/bundled-skills/skill-installer/scripts/validate_skill.py

@@ -17,6 +17,19 @@ import json
 import re
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 # ── Constants ──────────────────────────────────────────────────────────────
 
 FORBIDDEN_PATTERNS = [
@@ -43,7 +56,7 @@ REGISTRY_PATH = SKILLS_ROOT / "agent-orchestrator" / "data" / "registry.json"
 
 def resolve_existing_dir(path) -> Path:
     """Resolve a user-provided directory and require it to exist."""
-    resolved = Path(path).expanduser().resolve()
+    resolved = safe_user_path(path).expanduser().resolve()
     if not resolved.is_dir():
         raise ValueError(f"Directory does not exist: {resolved}")
     return resolved
@@ -222,19 +235,20 @@ def check_forbidden_files(skill_dir: Path) -> dict:
     """Check 7: No forbidden files (.env, credentials, keys, etc.)."""
     found_forbidden = []
 
-    for root, _dirs, files in os.walk(skill_dir):
-        for f in files:
-            f_lower = f.lower()
-            for pattern in FORBIDDEN_PATTERNS:
-                if pattern.startswith("*."):
-                    ext = pattern[1:]  # e.g., ".key"
-                    if f_lower.endswith(ext):
-                        found_forbidden.append(os.path.join(root, f))
-                        break
-                else:
-                    if f_lower == pattern.lower():
-                        found_forbidden.append(os.path.join(root, f))
-                        break
+    for path in safe_user_path(skill_dir).rglob("*"):
+        if not path.is_file():
+            continue
+        f_lower = path.name.lower()
+        for pattern in FORBIDDEN_PATTERNS:
+            if pattern.startswith("*."):
+                ext = pattern[1:]  # e.g., ".key"
+                if f_lower.endswith(ext):
+                    found_forbidden.append(str(path))
+                    break
+            else:
+                if f_lower == pattern.lower():
+                    found_forbidden.append(str(path))
+                    break
 
     if found_forbidden:
         return {
@@ -255,12 +269,13 @@ def check_forbidden_files(skill_dir: Path) -> dict:
 def check_total_size(skill_dir: Path) -> dict:
     """Check 8: Total size is reasonable (warn if > 50MB)."""
     total = 0
-    for root, _dirs, files in os.walk(skill_dir):
-        for f in files:
-            try:
-                total += os.path.getsize(os.path.join(root, f))
-            except OSError:
-                pass
+    for path in safe_user_path(skill_dir).rglob("*"):
+        if not path.is_file():
+            continue
+        try:
+            total += path.stat().st_size
+        except OSError:
+            pass
 
     size_mb = total / (1024 * 1024)
     ok = size_mb <= MAX_SIZE_MB
@@ -360,7 +375,7 @@ def validate(skill_dir: Path, strict: bool = False, registry_path: Path = None)
     except ValueError as e:
         return {
             "valid": False,
-            "skill_dir": str(Path(skill_dir).expanduser()),
+            "skill_dir": str(safe_user_path(skill_dir).expanduser()),
             "checks": [],
             "warnings": [],
             "errors": [str(e)],
@@ -433,7 +448,7 @@ def main():
     if "--registry" in sys.argv:
         idx = sys.argv.index("--registry")
         if idx + 1 < len(sys.argv):
-            registry_path = Path(sys.argv[idx + 1]).expanduser().resolve()
+            registry_path = safe_user_path(sys.argv[idx + 1]).expanduser().resolve()
 
     result = validate(skill_dir, strict=strict, registry_path=registry_path)
     print(json.dumps(result, indent=2, ensure_ascii=False))

package/bundled-skills/stripe-integration/SKILL.md

@@ -77,9 +77,10 @@ Master Stripe payment processing integration for robust, PCI-compliant payment f
 ## Quick Start
 
 ```python
+import os
 import stripe
 
-stripe.api_key = "sk_test_..."
+stripe.api_key = os.environ["STRIPE_SECRET_KEY"]
 
 # Create a checkout session
 session = stripe.checkout.Session.create(
@@ -222,12 +223,13 @@ def create_customer_portal_session(customer_id):
 
 ### Secure Webhook Endpoint
 ```python
+import os
 from flask import Flask, request
 import stripe
 
 app = Flask(__name__)
 
-endpoint_secret = 'whsec_...'
+endpoint_secret = os.environ["STRIPE_WEBHOOK_SECRET"]
 
 @app.route('/webhook', methods=['POST'])
 def webhook():
@@ -392,7 +394,9 @@ def handle_dispute(charge_id, evidence):
 
 ```python
 # Use test mode keys
-stripe.api_key = "sk_test_..."
+import os
+
+stripe.api_key = os.environ["STRIPE_SECRET_KEY"]
 
 # Test card numbers
 TEST_CARDS = {

package/bundled-skills/swiftui-expert-skill/scripts/instruments_parser/xctrace.py

@@ -2,10 +2,14 @@
 from __future__ import annotations
 
 import subprocess
-import xml.etree.ElementTree as ET
 from dataclasses import dataclass
 from pathlib import Path
 
+try:
+    from defusedxml import ElementTree as ET
+except ImportError:  # pragma: no cover - guidance for direct script use
+    ET = None
+
 
 @dataclass(frozen=True)
 class RunInfo:
@@ -43,6 +47,8 @@ def toc(trace_path: Path) -> TraceInfo:
 
     The TOC is small (a few KB) so we load it fully rather than streaming.
     """
+    if ET is None:
+        raise RuntimeError("Install defusedxml before parsing xctrace XML exports.")
     xml_bytes = _run_export(trace_path, ["--toc"])
     root = ET.fromstring(xml_bytes)
 

package/bundled-skills/swiftui-expert-skill/scripts/instruments_parser/xml_utils.py

@@ -6,10 +6,14 @@ a global id cache for later ref lookups.
 """
 from __future__ import annotations
 
-import xml.etree.ElementTree as ET
 from collections.abc import Iterator
 from dataclasses import dataclass
 
+try:
+    from defusedxml import ElementTree as ET
+except ImportError:  # pragma: no cover - guidance for direct script use
+    ET = None
+
 
 @dataclass(frozen=True)
 class Column:
@@ -26,6 +30,8 @@ class RowStream:
     """
 
     def __init__(self, xml_bytes: bytes):
+        if ET is None:
+            raise RuntimeError("Install defusedxml before parsing xctrace XML exports.")
         self._xml = xml_bytes
         self.columns: list[Column] = []
         self._id_cache: dict[str, ET.Element] = {}

package/bundled-skills/taisly-social-media-posting/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: taisly-social-media-posting
+description: "Use Taisly Agent Kit to prepare and publish approved short-form video posts across TikTok, Instagram Reels, YouTube Shorts, X, and Facebook."
+category: marketing
+risk: critical
+source: community
+source_repo: taisly/agent
+source_type: community
+date_added: "2026-07-07"
+author: taisly
+tags: [social-media, video, publishing, mcp, cli, sdk, tiktok, instagram, youtube-shorts, x, facebook]
+tools: [codex, claude]
+license: "MIT"
+license_source: "https://github.com/taisly/agent/blob/main/LICENSE"
+---
+
+# Taisly Social Media Posting
+
+## Overview
+
+Taisly Agent Kit provides an MCP server, CLI, SDK, and agent docs for publishing
+approved short-form videos to TikTok, Instagram Reels, YouTube Shorts, X, and
+Facebook. Use this skill to plan a posting workflow around Taisly, verify that
+the user has the required account access, and keep publishing actions behind an
+explicit confirmation gate.
+
+## When to Use
+
+- Use when the user wants an agent-assisted workflow for publishing short-form
+  videos with Taisly.
+- Use when the user mentions `taisly/agent`, the Taisly MCP server, Taisly CLI,
+  or the Taisly SDK.
+- Use when coordinating final approval, caption metadata, target platforms, and
+  posting status for social video distribution.
+
+## Workflow
+
+1. Confirm the exact target platforms and video asset paths or URLs.
+2. Confirm that the user has already connected the relevant social accounts in
+   Taisly or has provided the intended MCP/CLI setup path.
+3. Draft or review captions, hashtags, titles, descriptions, and platform
+   metadata before any publishing command is run.
+4. Present a final posting summary with platforms, media, captions, visibility,
+   and timing.
+5. Wait for explicit user approval before invoking any Taisly command, MCP tool,
+   SDK call, or other state-changing publishing action.
+
+## Examples
+
+```text
+Use Taisly to prepare this product demo for TikTok, Reels, Shorts, X, and Facebook.
+Review the caption and metadata first; do not publish until I approve.
+```
+
+```text
+Set up a Taisly MCP publishing workflow for approved video assets in ./campaign.
+```
+
+## Safety Notes
+
+- Treat publish, schedule, delete, account-linking, and metadata update actions
+  as state-changing operations requiring explicit user approval.
+- Never request, print, or store platform passwords, OAuth secrets, API keys, or
+  session tokens. Use the user's existing Taisly/MCP/CLI authentication flow.
+- If the requested action could violate platform policies, brand review, legal
+  constraints, or creator permissions, pause and ask for confirmation.
+
+## Limitations
+
+- Platform availability, media requirements, and API behavior depend on the
+  upstream Taisly Agent Kit and connected platform accounts.
+- This skill does not replace human review for legal, brand, copyright, or
+  platform-compliance decisions.
+- Verify the current Taisly setup instructions from `taisly/agent` before
+  installing or running tools in a new environment.
+
+## Source
+
+- GitHub: [taisly/agent](https://github.com/taisly/agent)

package/bundled-skills/technical-tutorials/SKILL.md

@@ -379,7 +379,7 @@ export API_KEY=your_key
 set API_KEY=your_key
 
 # Windows PowerShell
-$env:API_KEY="your_key"
+$env:API_KEY = Read-Host -AsSecureString "API key"
 \`\`\`
 ```