opencode-skills-collection 3.1.5 → 3.1.7

package/bundled-skills/.antigravity-install-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-06-24T02:01:40.611Z",
+  "updatedAt": "2026-06-26T02:05:23.006Z",
   "entries": [
     "00-andruia-consultant",
     "007",
@@ -620,6 +620,7 @@
     "embedding-strategies",
     "emblemai-crypto-wallet",
     "emergency-card",
+    "emil-design-eng",
     "emotional-arc-designer",
     "employment-contract-templates",
     "energy-procurement",
@@ -850,6 +851,7 @@
     "indexing-issue-auditor",
     "industrial-brutalist-ui",
     "infinite-gratitude",
+    "infinity",
     "ingest-youtube",
     "inngest",
     "instagram",
@@ -1261,6 +1263,7 @@
     "requesting-code-review",
     "returns-reverse-logistics",
     "reverse-engineer",
+    "review-animations",
     "revops",
     "rich-elicitation",
     "risk-manager",

package/bundled-skills/007/scripts/scanners/dependency_scanner.py

@@ -155,7 +155,7 @@ _DOCKER_COPY_SENSITIVE_RE = re.compile(
 )
 
 _DOCKER_CURL_PIPE_RE = re.compile(
-    r"""(?:curl|wget)\s+[^|]*\|\s*(?:bash|sh|zsh|python|perl|ruby|node)""",
+    r"""(?:curl|wget)\s+[^|]*\|\s*(?:bash|sh|zsh|python|perl|ruby|node)""",  # security-allowlist: curl-pipe-bash, wget-pipe-sh
     re.IGNORECASE,
 )
 
@@ -776,7 +776,7 @@ def analyze_dockerfile(filepath: Path, verbose: bool = False) -> dict:
                 file=file_str,
                 line=line_num,
                 severity="CRITICAL",
-                description="Pipe-to-shell pattern detected (curl|bash). Remote code execution risk",
+                description="Pipe-to-shell pattern detected (curl|bash). Remote code execution risk",  # security-allowlist: curl-pipe-bash
                 recommendation="Download scripts first, verify checksum, then execute",
                 pattern="curl_pipe_bash",
             ))

package/bundled-skills/docs/integrations/jetski-cortex.md

@@ -1,9 +1,9 @@
 ---
 title: Jetski/Cortex + Gemini Integration Guide
-description: "Use antigravity-awesome-skills with Jetski/Cortex without hitting context-window overflow with 1,681+ skills."
+description: "Use antigravity-awesome-skills with Jetski/Cortex without hitting context-window overflow with 1,684+ skills."
 ---
 
-# Jetski/Cortex + Gemini: safe integration with 1,681+ skills
+# Jetski/Cortex + Gemini: safe integration with 1,684+ skills
 
 This guide shows how to integrate the `antigravity-awesome-skills` repository with an agent based on **Jetski/Cortex + Gemini** (or similar frameworks) **without exceeding the model context window**.
 
@@ -23,7 +23,7 @@ Never do:
 - concatenate all `SKILL.md` content into a single system prompt;
 - re-inject the entire library for **every** request.
 
-With 1,681+ skills, this approach fills the context window before user messages are even added, causing truncation.
+With 1,684+ skills, this approach fills the context window before user messages are even added, causing truncation.
 
 ---
 

package/bundled-skills/docs/integrations/jetski-gemini-loader/README.md

@@ -21,7 +21,7 @@ This example shows one way to integrate **antigravity-awesome-skills** with a Je
 - How to enforce a **maximum number of skills per turn** via `maxSkillsPerTurn`.
 - How to choose whether to **truncate or error** when too many skills are requested via `overflowBehavior`.
 
-This pattern avoids context overflow when you have 1,681+ skills installed.
+This pattern avoids context overflow when you have 1,684+ skills installed.
 
 Manifest contract references:
 

package/bundled-skills/docs/maintainers/repo-growth-seo.md

@@ -6,7 +6,7 @@ This document keeps the repository's GitHub-facing discovery copy aligned with t
 
 Preferred positioning:
 
-> Installable GitHub library of 1,681+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and other AI coding assistants.
+> Installable GitHub library of 1,684+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and other AI coding assistants.
 
 Key framing:
 
@@ -20,7 +20,7 @@ Key framing:
 
 Preferred description:
 
-> Installable GitHub library of 1,681+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and more. Includes installer CLI, bundles, workflows, and official/community skill collections.
+> Installable GitHub library of 1,684+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and more. Includes installer CLI, bundles, workflows, and official/community skill collections.
 
 Preferred homepage:
 
@@ -28,7 +28,7 @@ Preferred homepage:
 
 Preferred social preview:
 
-- use a clean preview image that says `1,681+ Agentic Skills`;
+- use a clean preview image that says `1,684+ Agentic Skills`;
 - mention Claude Code, Cursor, Codex CLI, and Gemini CLI;
 - avoid dense text and tiny logos that disappear in social cards.
 

package/bundled-skills/docs/maintainers/skills-update-guide.md

@@ -72,7 +72,7 @@ The update process refreshes:
 - Canonical skills index (`skills_index.json`)
 - Compatibility mirror (`data/skills_index.json`)
 - Web app skills data (`apps\web-app\public\skills.json`)
-- All 1,681+ skills from the skills directory
+- All 1,684+ skills from the skills directory
 
 ## When to Update
 

package/bundled-skills/docs/users/bundles.md

@@ -1061,4 +1061,4 @@ Found a skill that should be in a bundle? Or want to create a new bundle? [Open
 
 ---
 
-_Last updated: June 2026 | Total Skills: 1,681+ | Total Bundles: 59_
+_Last updated: June 2026 | Total Skills: 1,684+ | Total Bundles: 59_

package/bundled-skills/docs/users/claude-code-skills.md

@@ -12,7 +12,7 @@ Install the library into Claude Code, then invoke focused skills directly in the
 
 ## Why use this repo for Claude Code
 
-- It includes 1,681+ skills instead of a narrow single-domain starter pack.
+- It includes 1,684+ skills instead of a narrow single-domain starter pack.
 - It supports the standard `.claude/skills/` path and the Claude Code plugin marketplace flow.
 - It also ships generated bundle plugins so teams can install focused packs like `Essentials` or `Security Developer` from the marketplace metadata.
 - It includes onboarding docs, bundles, and workflows so new users do not need to guess where to begin.

package/bundled-skills/docs/users/gemini-cli-skills.md

@@ -12,7 +12,7 @@ Install into the Gemini skills path, then ask Gemini to apply one skill at a tim
 
 - It installs directly into the expected Gemini skills path.
 - It includes both core software engineering skills and deeper agent/LLM-oriented skills.
-- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,681+ files.
+- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,684+ files.
 - It is useful whether you want a broad internal skill library or a single repo to test many workflows quickly.
 
 ## Install Gemini CLI Skills

package/bundled-skills/docs/users/getting-started.md

@@ -1,4 +1,4 @@
-# Getting Started with Antigravity Awesome Skills (V13.1.1)
+# Getting Started with Antigravity Awesome Skills (V13.2.0)
 
 **New here? This guide will help you supercharge your AI Agent in 5 minutes.**
 

package/bundled-skills/docs/users/kiro-integration.md

@@ -18,7 +18,7 @@ Kiro is AWS's agentic AI IDE that combines:
 
 Kiro's agentic capabilities are enhanced by skills that provide:
 
-- **Domain expertise** across 1,681+ specialized areas
+- **Domain expertise** across 1,684+ specialized areas
 - **Best practices** from Anthropic, OpenAI, Google, Microsoft, and AWS
 - **Workflow automation** for common development tasks
 - **AWS-specific patterns** for serverless, infrastructure, and cloud architecture

package/bundled-skills/docs/users/usage.md

@@ -14,7 +14,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of a full l
 
 When you ran `npx antigravity-awesome-skills` or cloned the repository, you:
 
-✅ **Downloaded 1,681+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
+✅ **Downloaded 1,684+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
 ✅ **Made them available** to your AI assistant  
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)
 
@@ -34,7 +34,7 @@ Bundles are **curated groups** of skills organized by role. They help you decide
 
 **Analogy:**
 
-- You installed a toolbox with 1,681+ tools (✅ done)
+- You installed a toolbox with 1,684+ tools (✅ done)
 - Bundles are like **labeled organizer trays** saying: "If you're a carpenter, start with these 10 tools"
 - You can either **pick skills from the tray** or install that tray as a focused marketplace bundle plugin
 
@@ -212,7 +212,7 @@ Let's actually use a skill right now. Follow these steps:
 
 ## Step 5: Picking Your First Skills (Practical Advice)
 
-Don't try to use all 1,681+ skills at once. Here's a sensible approach:
+Don't try to use all 1,684+ skills at once. Here's a sensible approach:
 
 If you want a tool-specific starting point before choosing skills, use:
 
@@ -343,7 +343,7 @@ Usually no, but if your AI doesn't recognize a skill:
 
 ### "Can I load all skills into the model at once?"
 
-No. Even though you have 1,681+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 1,684+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
 
 The intended pattern is:
 

package/bundled-skills/docs/users/visual-guide.md

@@ -34,7 +34,7 @@ antigravity-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 1,681+ skills live here
+├── 📁 skills/                          ← 1,684+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -47,7 +47,7 @@ antigravity-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (1,681+ total)
+│   └── ... (1,684+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -100,7 +100,7 @@ antigravity-awesome-skills/
 
 ```
                     ┌─────────────────────────┐
-                    │  1,681+ SKILLS          │
+                    │  1,684+ SKILLS          │
                     └────────────┬────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
@@ -201,7 +201,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (1,681+ total)                │
+│   └── ... (1,684+ total)                │
 └─────────────────────────────────────────┘
 ```
 

package/bundled-skills/docx-official/ooxml/scripts/pack.py

@@ -16,6 +16,17 @@ import zipfile
 from pathlib import Path
 
 
+def validate_input_tree(input_dir: Path):
+    root = input_dir.resolve(strict=True)
+    for path in input_dir.rglob("*"):
+        if path.is_symlink():
+            raise ValueError(f"Refusing to pack symlink: {path}")
+        try:
+            path.resolve(strict=True).relative_to(root)
+        except (OSError, ValueError):
+            raise ValueError(f"Refusing to pack path outside input directory: {path}") from None
+
+
 def main():
     parser = argparse.ArgumentParser(description="Pack a directory into an Office file")
     parser.add_argument("input_directory", help="Unpacked Office document directory")
@@ -60,6 +71,7 @@ def pack_document(input_dir, output_file, validate=False):
         raise ValueError(f"{input_dir} is not a directory")
     if output_file.suffix.lower() not in {".docx", ".pptx", ".xlsx"}:
         raise ValueError(f"{output_file} must be a .docx, .pptx, or .xlsx file")
+    validate_input_tree(input_dir)
 
     # Work in temporary directory to avoid modifying original
     with tempfile.TemporaryDirectory() as temp_dir:

package/bundled-skills/docx-official/ooxml/scripts/unpack.py

@@ -8,6 +8,11 @@ import sys
 import zipfile
 from pathlib import Path
 
+MAX_ARCHIVE_MEMBERS = 5000
+MAX_MEMBER_SIZE = 100 * 1024 * 1024
+MAX_TOTAL_UNCOMPRESSED = 512 * 1024 * 1024
+MAX_COMPRESSION_RATIO = 1000
+
 
 def _is_zip_symlink(member: zipfile.ZipInfo) -> bool:
     return stat.S_ISLNK(member.external_attr >> 16)
@@ -29,19 +34,35 @@ def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_ro
         shutil.copyfileobj(source, target)
 
 
+def _validate_archive_members(archive: zipfile.ZipFile, output_root: Path):
+    members = archive.infolist()
+    if len(members) > MAX_ARCHIVE_MEMBERS:
+        raise ValueError("Archive contains too many entries")
+
+    total_size = 0
+    for member in members:
+        if _is_zip_symlink(member):
+            raise ValueError(f"Unsafe archive entry: {member.filename}")
+        if not _is_safe_destination(output_root, member.filename):
+            raise ValueError(f"Unsafe archive entry: {member.filename}")
+        if member.file_size > MAX_MEMBER_SIZE:
+            raise ValueError(f"Archive entry too large: {member.filename}")
+        total_size += member.file_size
+        if total_size > MAX_TOTAL_UNCOMPRESSED:
+            raise ValueError("Archive uncompressed size is too large")
+        if member.compress_size and member.file_size / member.compress_size > MAX_COMPRESSION_RATIO:
+            raise ValueError(f"Archive entry compression ratio too high: {member.filename}")
+
+    return members
+
+
 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
     output_path = Path(output_dir)
     output_path.mkdir(parents=True, exist_ok=True)
     output_root = output_path.resolve()
 
     with zipfile.ZipFile(input_file) as archive:
-        for member in archive.infolist():
-            if _is_zip_symlink(member):
-                raise ValueError(f"Unsafe archive entry: {member.filename}")
-            if not _is_safe_destination(output_root, member.filename):
-                raise ValueError(f"Unsafe archive entry: {member.filename}")
-
-        for member in archive.infolist():
+        for member in _validate_archive_members(archive, output_root):
             _extract_member(archive, member, output_path)
 
 

package/bundled-skills/docx-official/ooxml/scripts/validation/base.py

@@ -9,6 +9,14 @@ from pathlib import Path
 import lxml.etree
 
 
+def hardened_xml_parser():
+    return lxml.etree.XMLParser(resolve_entities=False, no_network=True, load_dtd=False, huge_tree=False)
+
+
+def parse_xml(source, **kwargs):
+    return lxml.etree.parse(source, parser=hardened_xml_parser(), **kwargs)
+
+
 def safe_extract_all(zip_ref, destination):
     """Extract a zip archive without allowing members to escape destination."""
     destination = Path(destination).resolve()
@@ -149,7 +157,7 @@ class BaseSchemaValidator:
         for xml_file in self.xml_files:
             try:
                 # Try to parse the XML file
-                lxml.etree.parse(str(xml_file))
+                parse_xml(str(xml_file))
             except lxml.etree.XMLSyntaxError as e:
                 errors.append(
                     f"  {xml_file.relative_to(self.unpacked_dir)}: "
@@ -177,7 +185,7 @@ class BaseSchemaValidator:
 
         for xml_file in self.xml_files:
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
                 declared = set(root.nsmap.keys()) - {None}  # Exclude default namespace
 
                 for attr_val in [
@@ -208,7 +216,7 @@ class BaseSchemaValidator:
 
         for xml_file in self.xml_files:
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
                 file_ids = {}  # Track IDs that must be unique within this file
 
                 # Remove all mc:AlternateContent elements from the tree
@@ -328,7 +336,7 @@ class BaseSchemaValidator:
         for rels_file in rels_files:
             try:
                 # Parse relationships file
-                rels_root = lxml.etree.parse(str(rels_file)).getroot()
+                rels_root = parse_xml(str(rels_file)).getroot()
 
                 # Get the directory where this .rels file is located
                 rels_dir = rels_file.parent
@@ -429,7 +437,7 @@ class BaseSchemaValidator:
 
             try:
                 # Parse the .rels file to get valid relationship IDs and their types
-                rels_root = lxml.etree.parse(str(rels_file)).getroot()
+                rels_root = parse_xml(str(rels_file)).getroot()
                 rid_to_type = {}
 
                 for rel in rels_root.findall(
@@ -452,7 +460,7 @@ class BaseSchemaValidator:
                         rid_to_type[rid] = type_name
 
                 # Parse the XML file to find all r:id references
-                xml_root = lxml.etree.parse(str(xml_file)).getroot()
+                xml_root = parse_xml(str(xml_file)).getroot()
 
                 # Find all elements with r:id attributes
                 for elem in xml_root.iter():
@@ -549,7 +557,7 @@ class BaseSchemaValidator:
 
         try:
             # Parse and get all declared parts and extensions
-            root = lxml.etree.parse(str(content_types_file)).getroot()
+            root = parse_xml(str(content_types_file)).getroot()
             declared_parts = set()
             declared_extensions = set()
 
@@ -611,7 +619,7 @@ class BaseSchemaValidator:
                     continue
 
                 try:
-                    root_tag = lxml.etree.parse(str(xml_file)).getroot().tag
+                    root_tag = parse_xml(str(xml_file)).getroot().tag
                     root_name = root_tag.split("}")[-1] if "}" in root_tag else root_tag
 
                     if root_name in declarable_roots and path_str not in declared_parts:
@@ -850,15 +858,12 @@ class BaseSchemaValidator:
         try:
             # Load schema
             with open(schema_path, "rb") as xsd_file:
-                parser = lxml.etree.XMLParser()
-                xsd_doc = lxml.etree.parse(
-                    xsd_file, parser=parser, base_url=str(schema_path)
-                )
+                xsd_doc = parse_xml(xsd_file, base_url=str(schema_path))
                 schema = lxml.etree.XMLSchema(xsd_doc)
 
             # Load and preprocess XML
             with open(xml_file, "r") as f:
-                xml_doc = lxml.etree.parse(f)
+                xml_doc = parse_xml(f)
 
             xml_doc, _ = self._remove_template_tags_from_text_nodes(xml_doc)
             xml_doc = self._preprocess_for_mc_ignorable(xml_doc)

package/bundled-skills/docx-official/ooxml/scripts/validation/docx.py

@@ -10,7 +10,7 @@ from pathlib import Path
 
 import lxml.etree
 
-from .base import BaseSchemaValidator
+from .base import BaseSchemaValidator, parse_xml
 
 
 def safe_extract_all(zip_ref, destination):
@@ -100,7 +100,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
                 continue
 
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
 
                 # Find all w:t elements
                 for elem in root.iter(f"{{{self.WORD_2006_NAMESPACE}}}t"):
@@ -153,7 +153,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
                 continue
 
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
 
                 # Find all w:t elements that are descendants of w:del elements
                 namespaces = {"w": self.WORD_2006_NAMESPACE}
@@ -199,7 +199,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
                 continue
 
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
                 # Count all w:p elements
                 paragraphs = root.findall(f".//{{{self.WORD_2006_NAMESPACE}}}p")
                 count = len(paragraphs)
@@ -221,7 +221,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
 
                 # Parse document.xml
                 doc_xml_path = temp_dir + "/word/document.xml"
-                root = lxml.etree.parse(doc_xml_path).getroot()
+                root = parse_xml(doc_xml_path).getroot()
 
                 # Count all w:p elements
                 paragraphs = root.findall(f".//{{{self.WORD_2006_NAMESPACE}}}p")
@@ -244,7 +244,7 @@ class DOCXSchemaValidator(BaseSchemaValidator):
                 continue
 
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
                 namespaces = {"w": self.WORD_2006_NAMESPACE}
 
                 # Find w:delText in w:ins that are NOT within w:del

package/bundled-skills/docx-official/ooxml/scripts/validation/pptx.py

@@ -4,7 +4,7 @@ Validator for PowerPoint presentation XML files against XSD schemas.
 
 import re
 
-from .base import BaseSchemaValidator
+from .base import BaseSchemaValidator, parse_xml
 
 
 class PPTXSchemaValidator(BaseSchemaValidator):
@@ -86,7 +86,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
 
         for xml_file in self.xml_files:
             try:
-                root = lxml.etree.parse(str(xml_file)).getroot()
+                root = parse_xml(str(xml_file)).getroot()
 
                 # Check all elements for ID attributes
                 for elem in root.iter():
@@ -142,7 +142,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
         for slide_master in slide_masters:
             try:
                 # Parse the slide master file
-                root = lxml.etree.parse(str(slide_master)).getroot()
+                root = parse_xml(str(slide_master)).getroot()
 
                 # Find the corresponding _rels file for this slide master
                 rels_file = slide_master.parent / "_rels" / f"{slide_master.name}.rels"
@@ -155,7 +155,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
                     continue
 
                 # Parse the relationships file
-                rels_root = lxml.etree.parse(str(rels_file)).getroot()
+                rels_root = parse_xml(str(rels_file)).getroot()
 
                 # Build a set of valid relationship IDs that point to slide layouts
                 valid_layout_rids = set()
@@ -209,7 +209,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
 
         for rels_file in slide_rels_files:
             try:
-                root = lxml.etree.parse(str(rels_file)).getroot()
+                root = parse_xml(str(rels_file)).getroot()
 
                 # Find all slideLayout relationships
                 layout_rels = [
@@ -258,7 +258,7 @@ class PPTXSchemaValidator(BaseSchemaValidator):
         for rels_file in slide_rels_files:
             try:
                 # Parse the relationships file
-                root = lxml.etree.parse(str(rels_file)).getroot()
+                root = parse_xml(str(rels_file)).getroot()
 
                 # Find all notesSlide relationships
                 for rel in root.findall(