opencode-skills-collection 3.1.6 → 3.1.8

package/bundled-skills/gh-image/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: gh-image
+description: "Upload local images to GitHub and get canonical user-attachments embed URLs; use when asked to attach a screenshot to a PR, issue, or comment, or to embed before/after images in a README."
+category: developer-tools
+risk: safe
+source: community
+source_type: community
+source_repo: drogers0/gh-image
+date_added: "2026-06-25"
+author: drogers0
+license: MIT
+license_source: "https://github.com/drogers0/gh-image/blob/main/LICENSE"
+tags:
+  - github
+  - images
+  - screenshots
+  - gh-extension
+  - cli
+tools:
+  - claude-code
+  - codex-cli
+  - cursor
+  - gemini-cli
+---
+
+# Upload images to GitHub (gh-image)
+
+GitHub has **no public API** for image uploads — the web UI uses an internal
+endpoint that mints `user-attachments` URLs scoped to the repo's visibility.
+[`gh-image`](https://github.com/drogers0/gh-image) (MIT, © drogers0) replicates
+that flow as a `gh` CLI extension, so an agent can upload a local image from the
+terminal and get a ready-to-embed Markdown image line back.
+
+## Overview
+
+This skill drives `gh-image` to turn a local image file into a hosted GitHub
+`user-attachments` URL, then embeds that URL into a pull request, issue, or
+comment. It is the missing "attach a screenshot" capability for terminal agents.
+
+## When to Use This Skill
+
+Use this skill when asked to:
+
+- "Attach a screenshot to the PR" or "add an image to the PR description"
+- "Put this image in the issue" / "comment with these screenshots"
+- "Show the test results / before-and-after in the PR"
+- Embed any local image into GitHub Markdown without leaving the terminal
+
+## How It Works
+
+### Step 1: Verify prerequisites
+
+```bash
+gh auth status                                   # gh installed & authenticated
+gh extension list | grep -q 'drogers0/gh-image' \
+  || gh extension install drogers0/gh-image      # idempotent install
+```
+
+`gh-image` does **not** use the `gh` token for the upload (that endpoint rejects
+tokens). It needs a GitHub `user_session` cookie, resolved in this order:
+`--token <value>` flag → `GH_SESSION_TOKEN` env var (use in CI/headless) → a
+logged-in browser's cookie store (default for local use).
+
+### Step 2: Upload
+
+```bash
+# Use an absolute path; --repo is optional inside a repo working dir.
+gh image "/abs/path/screenshot.png" --repo <owner>/<repo>
+```
+
+`gh image` prints Markdown to **stdout**, one line per image:
+
+```
+![screenshot.png](https://github.com/user-attachments/assets/<uuid>)
+```
+
+Capture that output — it is the embeddable reference.
+
+### Step 3: Embed into the PR / issue / comment
+
+```bash
+MD="$(gh image "/abs/path/shot.png" --repo owner/repo)"
+BODY="$(gh pr view <pr> --repo owner/repo --json body -q .body)"
+printf '%s\n\n## Screenshots\n\n%s\n' "$BODY" "$MD" \
+  | gh pr edit <pr> --repo owner/repo --body-file -
+```
+
+Use `gh pr comment`, `gh issue edit`, or `gh issue comment` with `--body-file -`
+for other targets. Always pass `--body-file -` (not inline `--body`) so multi-line
+bodies and special characters can't break shell quoting.
+
+### Step 4: Verify
+
+```bash
+gh pr view <pr> --repo owner/repo --json body -q .body   # confirm URL present
+```
+
+## Examples
+
+- **Attach a CleanShot screenshot to PR #42:** upload the file, append it under a
+  `## Screenshots` heading in the PR body.
+- **Embed before/after images in a README:** upload both, paste the two Markdown
+  lines into the README at the relevant section.
+
+## Best Practices
+
+- Resolve globs to absolute paths first; quote paths with spaces/Unicode.
+- For display sizing, embed an HTML tag instead of bare Markdown:
+  `<img width="800" src="https://github.com/user-attachments/assets/<uuid>" />`.
+- In CI, set `GH_SESSION_TOKEN` from a dedicated bot account.
+
+## Limitations
+
+- **Session cookie required.** A `user_session` cookie grants full account access
+  (not scoped like a PAT) — treat it like a password; use a bot account in CI.
+- **Write access to the target repo is required**; orgs that enforce SAML SSO need
+  the session authorized at `https://github.com/orgs/<org>/sso` first.
+- **Private-repo images stay private:** the `user-attachments` URL inherits repo
+  visibility, so an anonymous fetch on a private repo returns 404/403 by design.
+- **Windows + Chrome 127+** cannot read cookies (library limitation) — use another
+  browser or `GH_SESSION_TOKEN`.
+- The skill embeds the Markdown itself; `gh-image` only prints the URL.

package/bundled-skills/github-actions-debugger/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: github-actions-debugger
+description: "Specialized skill for diagnosing, analyzing, and fixing failing GitHub Actions workflows by parsing run logs and pipeline definitions."
+category: devops
+risk: safe
+source: community
+source_type: community
+date_added: "2026-06-25"
+author: Owais
+tags: [github-actions, ci-cd, devops, debugging, workflows]
+tools: [claude, cursor, gemini, antigravity]
+---
+
+# GitHub Actions Pipeline Debugger
+
+## Overview
+
+This skill is designed to act as an expert CI/CD diagnostician. It focuses specifically on reading raw logs from failed GitHub Actions, identifying the root cause of the crash or failure, and outputting the precise YAML or code changes required to fix the pipeline.
+
+## When to Use
+
+- Use when a GitHub Actions workflow fails unexpectedly and the error log is long, obscure, or misleading.
+- Use when debugging dependency mismatch errors, missing secrets, caching issues, or runner environment problems in CI.
+- Use to optimize slow pipelines by identifying bottlenecks in workflow steps.
+- Use to update and modernize deprecated actions or workflow syntax.
+
+## How It Works
+
+1. **Log Ingestion & Redaction:** Analyze the provided GitHub Actions workflow log (often exported as a raw text file or pasted directly). **CRITICAL SAFETY REQUIREMENT:** The user/agent must redact all sensitive credentials, secrets, tokens, private keys, and internal system paths from the logs before pasting or uploading them.
+2. **Context Mapping:** Cross-reference the failure point with the specific step and job in the `.github/workflows/*.yml` definition.
+3. **Root Cause Analysis:** Identify if the failure is due to:
+   - Missing or misconfigured secrets (`${{ secrets.API_KEY }}`).
+   - Node/Python/OS environment version mismatches.
+   - Flaky tests or timeout limits.
+   - Syntax errors in bash scripts run within the `run:` block.
+   - Invalid action versions or deprecated actions.
+4. **Resolution Proposal:** Provide a direct `diff` of the `.yml` file or the underlying script that needs to be modified.
+
+## Best Practices
+
+- **Provide Full Context:** Always review both the workflow definition (`.yml` file) and the failure log simultaneously to ensure accurate diagnosis.
+- **Check Action Versions:** Many failures are caused by deprecated runtime versions (e.g., Node.js 16) in older third-party actions (e.g., `actions/checkout@v2`). Always recommend upgrading to the latest major versions (e.g., `v4`).
+- **Permissions Audit:** Ensure the workflow has the correct `permissions:` block if it's attempting to write to the repository, packages, or deploy environments.
+- **Reproducibility:** If a test fails in CI but passes locally, investigate environment differences such as timezone, headless browser state, memory limits, or parallel execution race conditions.
+
+## Examples
+
+### Example 1: Fixing a Deprecated Node.js Action Version Error
+**Failing Log:**
+```text
+Warning: The Go/Node.js/Python version used by this action is deprecated.
+Error: Node.js 16 actions are deprecated. Please update to use Node.js 20.
+```
+
+**Proposed Fix Diff:**
+```diff
+       - name: Checkout Code
+-        uses: actions/checkout@v2
++        uses: actions/checkout@v4
+```
+
+### Example 2: Diagnosing and Fixing a Missing Repository Secret
+**Failing Log:**
+```text
+Run npm run deploy
+  npm run deploy
+  shell: /usr/bin/bash -e {0}
+Error: API Key is required for deployment. Process exited with code 1.
+```
+
+**Proposed Fix Diff:**
+```diff
+       - name: Deploy App
+         run: npm run deploy
++        env:
++          DEPLOY_API_KEY: ${{ secrets.DEPLOY_API_KEY }}
+```
+
+## Security & Safety Notes
+
+- **Credential Exposure & Raw Log Redaction**: Under no circumstances should raw logs containing unmasked secrets, private URLs, deployment targets, or tokens be processed without prior redaction. Always ensure the user or agent redacts all sensitive info before ingestion.
+- **Dry-Run Mode**: When recommending modifications to bash script steps inside workflows, ensure you suggest adding flags like `--dry-run` or staging execution where possible to prevent unintended side effects in downstream environments during debugging.
+
+## Limitations
+
+- The skill cannot securely read repository secrets. It can only infer missing or malformed secrets if the log complains about undefined environment variables or authentication failures.
+- It cannot execute the GitHub action itself to test the fix; validation requires pushing the proposed fix to the repository and triggering a workflow run.
+- Network-related transient failures (e.g., a package registry being down temporarily) might be incorrectly diagnosed as structural workflow issues if not carefully analyzed.
+
+## Common Pitfalls
+
+- **Ignoring Transient Failures**: Mistaking temporary network dropouts or registry downtime (e.g., npm or pip install errors) for actual code or configuration bugs. Always check if a rerun succeeds before attempting heavy changes.
+- **Hardcoding Tokens**: Fixing authentication errors by hardcoding secrets or API tokens directly into the YAML files instead of utilizing GitHub Secrets (`${{ secrets.SECRET_NAME }}`).
+- **Overlooking Caching Side Effects**: Forgetting that outdated cache keys can keep corrupt dependencies loaded. If dependency installation is failing, try running a job with actions caching bypassed.
+
+## Related Skills
+
+- `@devops-troubleshooter` - General DevOps and infrastructure issue resolution.
+- `@cicd-automation-workflow-automate` - For creating new CI/CD pipelines from scratch.

package/bundled-skills/hugging-face-model-trainer/scripts/convert_to_gguf.py

@@ -132,6 +132,7 @@ ADAPTER_MODEL = require_hf_id(os.environ.get("ADAPTER_MODEL", "evalstate/qwen-ca
 BASE_MODEL = require_hf_id(os.environ.get("BASE_MODEL", "Qwen/Qwen2.5-0.5B"), "BASE_MODEL")
 OUTPUT_REPO = require_hf_id(os.environ.get("OUTPUT_REPO", "evalstate/qwen-capybara-medium-gguf"), "OUTPUT_REPO")
 username = require_hf_id(os.environ.get("HF_USERNAME", ADAPTER_MODEL.split('/')[0]), "HF_USERNAME")
+TRUST_REMOTE_CODE = os.environ.get("TRUST_REMOTE_CODE", "").strip().lower() in {"1", "true", "yes"}
 
 print(f"\n📦 Configuration:")
 print(f"   Base model: {BASE_MODEL}")
@@ -147,7 +148,7 @@ try:
         BASE_MODEL,
         dtype=torch.float16,
         device_map="auto",
-        trust_remote_code=True,
+        trust_remote_code=TRUST_REMOTE_CODE,
     )
     print("   ✅ Base model loaded")
 except Exception as e:
@@ -169,7 +170,7 @@ except Exception as e:
 
 try:
     # Load tokenizer
-    tokenizer = AutoTokenizer.from_pretrained(ADAPTER_MODEL, trust_remote_code=True)
+    tokenizer = AutoTokenizer.from_pretrained(ADAPTER_MODEL, trust_remote_code=TRUST_REMOTE_CODE)
     print("   ✅ Tokenizer loaded")
 except Exception as e:
     print(f"   ❌ Failed to load tokenizer: {e}")

package/bundled-skills/infinity/SKILL.md

@@ -0,0 +1,173 @@
+---
+name: infinity
+description: "Enforces a strict input boundary protocol (detect, classify, filter, verify) to ensure untrusted data never reaches business logic raw."
+risk: safe
+source: community
+date_added: "2026-06-23"
+---
+
+# infinity — Input Boundary & Validation Protocol
+
+## Core Philosophy
+
+> Nothing untrusted ever reaches the core — it is stopped before contact. No external data touches the codebase raw. Every boundary where data enters the system must have a filter.
+
+The #1 source of silent bugs, crashes, and vulnerabilities is external data that arrives in an unexpected shape and gets used directly without checking. This skill enforces a filter layer at every entry point, every time.
+
+---
+
+## When to Use This Skill
+
+- Use when you need to handle an API response
+- Use when reading user input or adding a form handler
+- Use when working with environment variables or CLI arguments
+- Use when parsing webhooks or reading from the filesystem
+- Use when any code calls `.body`, `.params`, `.query`, `.env`, `fs.read`, or a third-party SDK response
+
+---
+
+## The Four Phases
+
+### PHASE 1 — Boundary Detection
+
+Before writing or modifying any code that involves external data, the AI must identify and list every entry point in scope:
+
+- HTTP request bodies, headers, query params
+- User form inputs and UI-submitted data
+- Environment variables and config files
+- Third-party API responses
+- Webhook payloads
+- File reads from disk
+- CLI arguments
+- Database query results from external sources
+- WebSocket messages
+
+> **The AI must not write any data-handling logic until every entry point in scope is listed.**
+
+---
+
+### PHASE 2 — Classify Each Input
+
+For every entry point identified, the AI classifies it into one of three trust levels:
+
+| Level | Definition | Examples |
+|---|---|---|
+| `TRUSTED` | Internal constants, hardcoded values, your own compile-time config | Enum values, hardcoded defaults, internal constants |
+| `SEMI-TRUSTED` | Your own internal services, internal APIs, controlled infrastructure | Internal microservice responses, your own database reads |
+| `UNTRUSTED` | Anything from users, the internet, third parties, or the filesystem | User input, external API responses, uploaded files, env vars, CLI args |
+
+> **Rule:** `TRUSTED` inputs may be used directly. `SEMI-TRUSTED` and `UNTRUSTED` inputs must pass through a filter layer before any use.
+
+The AI outputs this classification before writing any handling code:
+
+```
+INFINITY — BOUNDARY MAP
+─────────────────────────────────────────
+Entry Point              | Trust Level  | Filter Required
+─────────────────────────────────────────
+req.body.email           | UNTRUSTED    | ✓ format + sanitize
+process.env.API_KEY      | UNTRUSTED    | ✓ presence + non-empty
+internalService.getData()| SEMI-TRUSTED | ✓ schema validate
+PAGINATION_LIMIT = 20    | TRUSTED      | ✗ none needed
+─────────────────────────────────────────
+```
+
+---
+
+### PHASE 3 — Mandatory Filter Layer
+
+Every `UNTRUSTED` and `SEMI-TRUSTED` input must pass through validation before it reaches any business logic, storage, or rendering. The AI must apply the right filter type for the right context:
+
+**Type Checking**
+- Verify the input is the expected type before using it
+- Never assume a string is a string, a number is a number, or an array is an array
+
+**Schema Validation**
+- For objects and API responses, validate shape before accessing nested fields
+- If a required field is missing, reject — do not use a fallback that hides the problem
+
+**Sanitization**
+- Strip or escape content before rendering to UI (prevent XSS)
+- Normalize strings before storage (trim whitespace, consistent casing where appropriate)
+
+**Presence & Format Checks**
+- Env vars: must exist and be non-empty before use
+- IDs and tokens: must match expected format before use
+
+**Rejection Rule**
+- On invalid input: reject explicitly and return a clear error
+- Never silently use bad data with a fallback
+- Never let bad data pass through to fix itself "downstream"
+
+```
+// WRONG — using raw input directly
+const user = await db.find(req.params.id);
+
+// RIGHT — validate before use
+const id = req.params.id;
+if (!id || typeof id !== 'string' || !isValidUUID(id)) {
+  return res.status(400).json({ error: 'Invalid ID format' });
+}
+const user = await db.find(id);
+```
+
+---
+
+### PHASE 4 — Self-Check Before Done
+
+Before the AI declares any data-handling code complete, it traces each entry point and confirms:
+
+```
+INFINITY — VERIFICATION
+─────────────────────────────────────────
+Entry Point              | Filter Exists | Filter Type
+─────────────────────────────────────────
+req.body.email           | ✓ YES         | format + sanitize
+process.env.API_KEY      | ✓ YES         | presence check
+internalService.getData()| ✓ YES         | schema validation
+─────────────────────────────────────────
+Unfiltered inputs reaching logic: NONE ✓
+─────────────────────────────────────────
+```
+
+If any `UNTRUSTED` or `SEMI-TRUSTED` input reaches logic, storage, or rendering without a filter — the AI flags it. It does not silently pass.
+
+---
+
+## Hard Rules (Never Violated)
+
+- **No raw external data in business logic.** Ever.
+- **No silent fallbacks on bad input.** Reject explicitly.
+- **No assuming shape.** Even if the API "always" returns a string — validate it.
+- **No skipping env var checks.** Missing env vars must fail loudly at startup, not silently at runtime.
+- **No partial filtering.** If you validate presence but not format, it is not filtered.
+- **No filtering in the wrong place.** Filters go at the entry point — not somewhere downstream after the data has already been used once.
+
+---
+
+## What This Skill Prevents
+
+- SQL injection via unvalidated query params
+- Crashes from unexpected API response shapes
+- XSS from unescaped user content rendered to UI
+- Silent failures from missing env variables discovered at runtime
+- Type errors from assuming external data matches expected shape
+- Security vulnerabilities from untrusted data reaching sensitive operations
+
+---
+
+## Quick Reference
+
+| Phase | Action | Writes Code? |
+|---|---|---|
+| 1 — Detect | List all entry points in scope | ❌ No |
+| 2 — Classify | Assign trust level to each input | ❌ No |
+| 3 — Filter | Write filter layer for all UNTRUSTED + SEMI-TRUSTED | ✅ Yes |
+| 4 — Verify | Trace each input, confirm filter exists | ❌ No |
+
+---
+
+## Limitations
+
+- Does not apply to purely internal logic with no external data involvement.
+- May add verbosity to trivial scripts where strict validation is not required.

package/bundled-skills/loki-mode/autonomy/run.sh

@@ -711,21 +711,30 @@ generate_dashboard() {
             if (seconds < 3600) return Math.floor(seconds / 60) + 'm';
             return Math.floor(seconds / 3600) + 'h ' + Math.floor((seconds % 3600) / 60) + 'm';
         }
+        function escapeHtml(value) {
+            return String(value ?? '').replace(/[&<>"']/g, (char) => ({
+                '&': '&amp;',
+                '<': '&lt;',
+                '>': '&gt;',
+                '"': '&quot;',
+                "'": '&#39;'
+            })[char]);
+        }
         function renderAgent(agent) {
             const modelClass = getModelClass(agent.model);
-            const modelName = agent.model || 'Sonnet 4.5';
-            const agentType = agent.agent_type || 'general-purpose';
+            const modelName = escapeHtml(agent.model || 'Sonnet 4.5');
+            const agentType = escapeHtml(agent.agent_type || 'general-purpose');
             const status = agent.status === 'completed' ? 'completed' : 'active';
-            const currentTask = agent.current_task || (agent.tasks_completed && agent.tasks_completed.length > 0
+            const currentTask = escapeHtml(agent.current_task || (agent.tasks_completed && agent.tasks_completed.length > 0
                 ? 'Completed: ' + agent.tasks_completed.join(', ')
-                : 'Initializing...');
+                : 'Initializing...'));
             const duration = formatDuration(agent.spawned_at);
             const tasksCount = agent.tasks_completed ? agent.tasks_completed.length : 0;
 
             return `
                 <div class="agent-card">
                     <div class="agent-header">
-                        <div class="agent-id">${agent.agent_id || 'Unknown'}</div>
+                        <div class="agent-id">${escapeHtml(agent.agent_id || 'Unknown')}</div>
                         <div class="model-badge ${modelClass}">${modelName}</div>
                     </div>
                     <div class="agent-type">${agentType}</div>
@@ -740,9 +749,9 @@ generate_dashboard() {
         }
         function renderTask(task) {
             const payload = task.payload || {};
-            const title = payload.description || payload.action || task.type || 'Task';
-            const error = task.lastError ? `<div class="error">${task.lastError}</div>` : '';
-            return `<div class="task"><div class="id">${task.id}</div><span class="type">${task.type || 'general'}</span><div class="title">${title}</div>${error}</div>`;
+            const title = escapeHtml(payload.description || payload.action || task.type || 'Task');
+            const error = task.lastError ? `<div class="error">${escapeHtml(task.lastError)}</div>` : '';
+            return `<div class="task"><div class="id">${escapeHtml(task.id)}</div><span class="type">${escapeHtml(task.type || 'general')}</span><div class="title">${title}</div>${error}</div>`;
         }
         async function loadData() {
             const [pending, progress, completed, failed, agents] = await Promise.all([

package/bundled-skills/loki-mode/examples/todo-app-generated/backend/package-lock.json

@@ -8,10 +8,10 @@
       "name": "todo-app-backend",
       "version": "1.0.0",
       "dependencies": {
-        "better-sqlite3": "^12.8.0",
-        "cors": "^2.8.5",
+        "better-sqlite3": "^12.10.0",
+        "cors": "^2.8.6",
         "express": "^4.18.2",
-        "express-rate-limit": "^8.5.1",
+        "express-rate-limit": "^8.5.2",
         "ip-address": "^10.2.0"
       },
       "devDependencies": {
@@ -303,9 +303,9 @@
       "license": "MIT"
     },
     "node_modules/better-sqlite3": {
-      "version": "12.8.0",
-      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.8.0.tgz",
-      "integrity": "sha512-RxD2Vd96sQDjQr20kdP+F+dK/1OUNiVOl200vKBZY8u0vTwysfolF6Hq+3ZK2+h8My9YvZhHsF+RSGZW2VYrPQ==",
+      "version": "12.10.0",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.10.0.tgz",
+      "integrity": "sha512-CyzaZRQKyHkB2ZInfTTl2nvT33EbDpjkLEbE8/Zck3Ll6O0qqvuGdrJ45HgtH+HykRg88ITY3AdreBGN70aBSQ==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
@@ -313,7 +313,7 @@
         "prebuild-install": "^7.1.1"
       },
       "engines": {
-        "node": "20.x || 22.x || 23.x || 24.x || 25.x"
+        "node": "20.x || 22.x || 23.x || 24.x || 25.x || 26.x"
       }
     },
     "node_modules/bindings": {
@@ -459,9 +459,9 @@
       "license": "MIT"
     },
     "node_modules/cors": {
-      "version": "2.8.5",
-      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.5.tgz",
-      "integrity": "sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==",
+      "version": "2.8.6",
+      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
+      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
       "license": "MIT",
       "dependencies": {
         "object-assign": "^4",
@@ -469,6 +469,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/create-require": {
@@ -688,9 +692,9 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "8.5.1",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.1.tgz",
-      "integrity": "sha512-5O6KYmyJEpuPJV5hNTXKbAHWRqrzyu+OI3vUnSd2kXFubIVpG7ezpgxQy76Zo5GQZtrQBg86hF+CM/NX+cioiQ==",
+      "version": "8.5.2",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.2.tgz",
+      "integrity": "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==",
       "license": "MIT",
       "dependencies": {
         "ip-address": "^10.2.0"

package/bundled-skills/loki-mode/examples/todo-app-generated/backend/package.json

@@ -9,10 +9,10 @@
     "dev": "ts-node src/index.ts"
   },
   "dependencies": {
-    "better-sqlite3": "^12.8.0",
-    "cors": "^2.8.5",
+    "better-sqlite3": "^12.10.0",
+    "cors": "^2.8.6",
     "express": "^4.18.2",
-    "express-rate-limit": "^8.5.1",
+    "express-rate-limit": "^8.5.2",
     "ip-address": "^10.2.0"
   },
   "devDependencies": {

package/bundled-skills/loki-mode/examples/todo-app-generated/frontend/package-lock.json

@@ -9,8 +9,8 @@
       "version": "1.0.0",
       "license": "ISC",
       "dependencies": {
-        "react": "^19.2.3",
-        "react-dom": "^19.2.3"
+        "react": "^19.2.7",
+        "react-dom": "^19.2.7"
       },
       "devDependencies": {
         "@types/react": "^19.2.7",
@@ -814,24 +814,24 @@
       }
     },
     "node_modules/react": {
-      "version": "19.2.3",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.3.tgz",
-      "integrity": "sha512-Ku/hhYbVjOQnXDZFv2+RibmLFGwFdeeKHFcOTlrt7xplBnya5OGn/hIRDsqDiSUcfORsDC7MPxwork8jBwsIWA==",
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
+      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/react-dom": {
-      "version": "19.2.3",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.3.tgz",
-      "integrity": "sha512-yELu4WmLPw5Mr/lmeEpox5rw3RETacE++JgHqQzd2dg+YbJuat3jH4ingc+WPZhxaoFzdv9y33G+F7Nl5O0GBg==",
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
+      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
       "license": "MIT",
       "dependencies": {
         "scheduler": "^0.27.0"
       },
       "peerDependencies": {
-        "react": "^19.2.3"
+        "react": "^19.2.7"
       }
     },
     "node_modules/rolldown": {

package/bundled-skills/loki-mode/examples/todo-app-generated/frontend/package.json

@@ -19,8 +19,8 @@
     "vite": "^8.0.16"
   },
   "dependencies": {
-    "react": "^19.2.3",
-    "react-dom": "^19.2.3"
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7"
   },
   "overrides": {
     "picomatch": "4.0.4",

package/bundled-skills/macos-spm-app-packaging/assets/templates/setup_dev_signing.sh

@@ -14,8 +14,13 @@ fi
 
 echo "Creating self-signed certificate '$CERT_NAME'..."
 
-TEMP_CONFIG=$(mktemp)
-trap "rm -f $TEMP_CONFIG" EXIT
+TEMP_DIR=$(mktemp -d)
+chmod 700 "$TEMP_DIR"
+TEMP_CONFIG="$TEMP_DIR/dev.cnf"
+KEY_PATH="$TEMP_DIR/dev.key"
+CRT_PATH="$TEMP_DIR/dev.crt"
+P12_PATH="$TEMP_DIR/dev.p12"
+trap 'rm -rf "$TEMP_DIR"' EXIT
 
 cat > "$TEMP_CONFIG" <<EOFCONF
 [ req ]
@@ -34,18 +39,16 @@ extendedKeyUsage = codeSigning
 EOFCONF
 
 openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 \
-    -nodes -keyout /tmp/dev.key -out /tmp/dev.crt \
+    -nodes -keyout "$KEY_PATH" -out "$CRT_PATH" \
     -config "$TEMP_CONFIG" 2>/dev/null
 
-openssl pkcs12 -export -out /tmp/dev.p12 \
-    -inkey /tmp/dev.key -in /tmp/dev.crt \
+openssl pkcs12 -export -out "$P12_PATH" \
+    -inkey "$KEY_PATH" -in "$CRT_PATH" \
     -passout pass: 2>/dev/null
 
-security import /tmp/dev.p12 -k ~/Library/Keychains/login.keychain-db \
+security import "$P12_PATH" -k ~/Library/Keychains/login.keychain-db \
   -T /usr/bin/codesign -T /usr/bin/security
 
-rm -f /tmp/dev.{key,crt,p12}
-
 echo ""
 echo "Trust this certificate for code signing in Keychain Access."
 echo "Then export in your shell profile:"