opencode-skills-collection 3.1.7 → 3.1.9

package/bundled-skills/gh-image/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: gh-image
+description: "Upload local images to GitHub and get canonical user-attachments embed URLs; use when asked to attach a screenshot to a PR, issue, or comment, or to embed before/after images in a README."
+category: developer-tools
+risk: safe
+source: community
+source_type: community
+source_repo: drogers0/gh-image
+date_added: "2026-06-25"
+author: drogers0
+license: MIT
+license_source: "https://github.com/drogers0/gh-image/blob/main/LICENSE"
+tags:
+  - github
+  - images
+  - screenshots
+  - gh-extension
+  - cli
+tools:
+  - claude-code
+  - codex-cli
+  - cursor
+  - gemini-cli
+---
+
+# Upload images to GitHub (gh-image)
+
+GitHub has **no public API** for image uploads — the web UI uses an internal
+endpoint that mints `user-attachments` URLs scoped to the repo's visibility.
+[`gh-image`](https://github.com/drogers0/gh-image) (MIT, © drogers0) replicates
+that flow as a `gh` CLI extension, so an agent can upload a local image from the
+terminal and get a ready-to-embed Markdown image line back.
+
+## Overview
+
+This skill drives `gh-image` to turn a local image file into a hosted GitHub
+`user-attachments` URL, then embeds that URL into a pull request, issue, or
+comment. It is the missing "attach a screenshot" capability for terminal agents.
+
+## When to Use This Skill
+
+Use this skill when asked to:
+
+- "Attach a screenshot to the PR" or "add an image to the PR description"
+- "Put this image in the issue" / "comment with these screenshots"
+- "Show the test results / before-and-after in the PR"
+- Embed any local image into GitHub Markdown without leaving the terminal
+
+## How It Works
+
+### Step 1: Verify prerequisites
+
+```bash
+gh auth status                                   # gh installed & authenticated
+gh extension list | grep -q 'drogers0/gh-image' \
+  || gh extension install drogers0/gh-image      # idempotent install
+```
+
+`gh-image` does **not** use the `gh` token for the upload (that endpoint rejects
+tokens). It needs a GitHub `user_session` cookie, resolved in this order:
+`--token <value>` flag → `GH_SESSION_TOKEN` env var (use in CI/headless) → a
+logged-in browser's cookie store (default for local use).
+
+### Step 2: Upload
+
+```bash
+# Use an absolute path; --repo is optional inside a repo working dir.
+gh image "/abs/path/screenshot.png" --repo <owner>/<repo>
+```
+
+`gh image` prints Markdown to **stdout**, one line per image:
+
+```
+![screenshot.png](https://github.com/user-attachments/assets/<uuid>)
+```
+
+Capture that output — it is the embeddable reference.
+
+### Step 3: Embed into the PR / issue / comment
+
+```bash
+MD="$(gh image "/abs/path/shot.png" --repo owner/repo)"
+BODY="$(gh pr view <pr> --repo owner/repo --json body -q .body)"
+printf '%s\n\n## Screenshots\n\n%s\n' "$BODY" "$MD" \
+  | gh pr edit <pr> --repo owner/repo --body-file -
+```
+
+Use `gh pr comment`, `gh issue edit`, or `gh issue comment` with `--body-file -`
+for other targets. Always pass `--body-file -` (not inline `--body`) so multi-line
+bodies and special characters can't break shell quoting.
+
+### Step 4: Verify
+
+```bash
+gh pr view <pr> --repo owner/repo --json body -q .body   # confirm URL present
+```
+
+## Examples
+
+- **Attach a CleanShot screenshot to PR #42:** upload the file, append it under a
+  `## Screenshots` heading in the PR body.
+- **Embed before/after images in a README:** upload both, paste the two Markdown
+  lines into the README at the relevant section.
+
+## Best Practices
+
+- Resolve globs to absolute paths first; quote paths with spaces/Unicode.
+- For display sizing, embed an HTML tag instead of bare Markdown:
+  `<img width="800" src="https://github.com/user-attachments/assets/<uuid>" />`.
+- In CI, set `GH_SESSION_TOKEN` from a dedicated bot account.
+
+## Limitations
+
+- **Session cookie required.** A `user_session` cookie grants full account access
+  (not scoped like a PAT) — treat it like a password; use a bot account in CI.
+- **Write access to the target repo is required**; orgs that enforce SAML SSO need
+  the session authorized at `https://github.com/orgs/<org>/sso` first.
+- **Private-repo images stay private:** the `user-attachments` URL inherits repo
+  visibility, so an anonymous fetch on a private repo returns 404/403 by design.
+- **Windows + Chrome 127+** cannot read cookies (library limitation) — use another
+  browser or `GH_SESSION_TOKEN`.
+- The skill embeds the Markdown itself; `gh-image` only prints the URL.

package/bundled-skills/github-actions-debugger/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: github-actions-debugger
+description: "Specialized skill for diagnosing, analyzing, and fixing failing GitHub Actions workflows by parsing run logs and pipeline definitions."
+category: devops
+risk: safe
+source: community
+source_type: community
+date_added: "2026-06-25"
+author: Owais
+tags: [github-actions, ci-cd, devops, debugging, workflows]
+tools: [claude, cursor, gemini, antigravity]
+---
+
+# GitHub Actions Pipeline Debugger
+
+## Overview
+
+This skill is designed to act as an expert CI/CD diagnostician. It focuses specifically on reading raw logs from failed GitHub Actions, identifying the root cause of the crash or failure, and outputting the precise YAML or code changes required to fix the pipeline.
+
+## When to Use
+
+- Use when a GitHub Actions workflow fails unexpectedly and the error log is long, obscure, or misleading.
+- Use when debugging dependency mismatch errors, missing secrets, caching issues, or runner environment problems in CI.
+- Use to optimize slow pipelines by identifying bottlenecks in workflow steps.
+- Use to update and modernize deprecated actions or workflow syntax.
+
+## How It Works
+
+1. **Log Ingestion & Redaction:** Analyze the provided GitHub Actions workflow log (often exported as a raw text file or pasted directly). **CRITICAL SAFETY REQUIREMENT:** The user/agent must redact all sensitive credentials, secrets, tokens, private keys, and internal system paths from the logs before pasting or uploading them.
+2. **Context Mapping:** Cross-reference the failure point with the specific step and job in the `.github/workflows/*.yml` definition.
+3. **Root Cause Analysis:** Identify if the failure is due to:
+   - Missing or misconfigured secrets (`${{ secrets.API_KEY }}`).
+   - Node/Python/OS environment version mismatches.
+   - Flaky tests or timeout limits.
+   - Syntax errors in bash scripts run within the `run:` block.
+   - Invalid action versions or deprecated actions.
+4. **Resolution Proposal:** Provide a direct `diff` of the `.yml` file or the underlying script that needs to be modified.
+
+## Best Practices
+
+- **Provide Full Context:** Always review both the workflow definition (`.yml` file) and the failure log simultaneously to ensure accurate diagnosis.
+- **Check Action Versions:** Many failures are caused by deprecated runtime versions (e.g., Node.js 16) in older third-party actions (e.g., `actions/checkout@v2`). Always recommend upgrading to the latest major versions (e.g., `v4`).
+- **Permissions Audit:** Ensure the workflow has the correct `permissions:` block if it's attempting to write to the repository, packages, or deploy environments.
+- **Reproducibility:** If a test fails in CI but passes locally, investigate environment differences such as timezone, headless browser state, memory limits, or parallel execution race conditions.
+
+## Examples
+
+### Example 1: Fixing a Deprecated Node.js Action Version Error
+**Failing Log:**
+```text
+Warning: The Go/Node.js/Python version used by this action is deprecated.
+Error: Node.js 16 actions are deprecated. Please update to use Node.js 20.
+```
+
+**Proposed Fix Diff:**
+```diff
+       - name: Checkout Code
+-        uses: actions/checkout@v2
++        uses: actions/checkout@v4
+```
+
+### Example 2: Diagnosing and Fixing a Missing Repository Secret
+**Failing Log:**
+```text
+Run npm run deploy
+  npm run deploy
+  shell: /usr/bin/bash -e {0}
+Error: API Key is required for deployment. Process exited with code 1.
+```
+
+**Proposed Fix Diff:**
+```diff
+       - name: Deploy App
+         run: npm run deploy
++        env:
++          DEPLOY_API_KEY: ${{ secrets.DEPLOY_API_KEY }}
+```
+
+## Security & Safety Notes
+
+- **Credential Exposure & Raw Log Redaction**: Under no circumstances should raw logs containing unmasked secrets, private URLs, deployment targets, or tokens be processed without prior redaction. Always ensure the user or agent redacts all sensitive info before ingestion.
+- **Dry-Run Mode**: When recommending modifications to bash script steps inside workflows, ensure you suggest adding flags like `--dry-run` or staging execution where possible to prevent unintended side effects in downstream environments during debugging.
+
+## Limitations
+
+- The skill cannot securely read repository secrets. It can only infer missing or malformed secrets if the log complains about undefined environment variables or authentication failures.
+- It cannot execute the GitHub action itself to test the fix; validation requires pushing the proposed fix to the repository and triggering a workflow run.
+- Network-related transient failures (e.g., a package registry being down temporarily) might be incorrectly diagnosed as structural workflow issues if not carefully analyzed.
+
+## Common Pitfalls
+
+- **Ignoring Transient Failures**: Mistaking temporary network dropouts or registry downtime (e.g., npm or pip install errors) for actual code or configuration bugs. Always check if a rerun succeeds before attempting heavy changes.
+- **Hardcoding Tokens**: Fixing authentication errors by hardcoding secrets or API tokens directly into the YAML files instead of utilizing GitHub Secrets (`${{ secrets.SECRET_NAME }}`).
+- **Overlooking Caching Side Effects**: Forgetting that outdated cache keys can keep corrupt dependencies loaded. If dependency installation is failing, try running a job with actions caching bypassed.
+
+## Related Skills
+
+- `@devops-troubleshooter` - General DevOps and infrastructure issue resolution.
+- `@cicd-automation-workflow-automate` - For creating new CI/CD pipelines from scratch.

package/bundled-skills/loki-mode/examples/todo-app-generated/frontend/package-lock.json

@@ -9,8 +9,8 @@
       "version": "1.0.0",
       "license": "ISC",
       "dependencies": {
-        "react": "^19.2.3",
-        "react-dom": "^19.2.3"
+        "react": "^19.2.7",
+        "react-dom": "^19.2.7"
       },
       "devDependencies": {
         "@types/react": "^19.2.7",
@@ -814,24 +814,24 @@
       }
     },
     "node_modules/react": {
-      "version": "19.2.3",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.3.tgz",
-      "integrity": "sha512-Ku/hhYbVjOQnXDZFv2+RibmLFGwFdeeKHFcOTlrt7xplBnya5OGn/hIRDsqDiSUcfORsDC7MPxwork8jBwsIWA==",
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
+      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/react-dom": {
-      "version": "19.2.3",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.3.tgz",
-      "integrity": "sha512-yELu4WmLPw5Mr/lmeEpox5rw3RETacE++JgHqQzd2dg+YbJuat3jH4ingc+WPZhxaoFzdv9y33G+F7Nl5O0GBg==",
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
+      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
       "license": "MIT",
       "dependencies": {
         "scheduler": "^0.27.0"
       },
       "peerDependencies": {
-        "react": "^19.2.3"
+        "react": "^19.2.7"
       }
     },
     "node_modules/rolldown": {

package/bundled-skills/loki-mode/examples/todo-app-generated/frontend/package.json

@@ -19,8 +19,8 @@
     "vite": "^8.0.16"
   },
   "dependencies": {
-    "react": "^19.2.3",
-    "react-dom": "^19.2.3"
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7"
   },
   "overrides": {
     "picomatch": "4.0.4",

package/bundled-skills/premium-3d-website/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: premium-3d-website
+description: Guidelines for building premium 3D websites, focusing on custom WebGL shaders, post-processing, physics-based interactions, smooth animations, preloaders, and device optimization.
+category: frontend
+risk: safe
+source: self
+source_type: self
+date_added: "2026-06-25"
+author: Rsmiyani
+tags: [threejs, webgl, shaders, post-processing, creative-coding, premium-design]
+tools: [claude, cursor, gemini]
+---
+
+# Premium 3D Website
+
+## Overview
+
+This skill provides architectural guidelines and code patterns for developing premium, high-end 3D websites. It targets developers looking to implement advanced WebGL visual effects, custom shader pipelines, interactive physics elements, and immersive page transitions while maintaining high performance.
+
+## When to Use This Skill
+
+- Use when designing premium or award-winning creative websites with 3D elements.
+- Use when integrating Three.js, React Three Fiber (R3F), or Spline with custom shaders (GLSL).
+- Use when implementing post-processing effects like bloom, depth-of-field, or custom film grain.
+- Use when designing interactive preloaders and high-performance asset loading strategies.
+- Use when optimizing complex 3D scenes for mobile responsiveness and performance.
+
+## How It Works
+
+### Step 1: Establish the Render Loop and Scene Architecture
+Setting up a robust WebGL context with proper resize handling and performance-friendly pixel ratios is crucial. Keep pixel ratios capped at a maximum of 2 to avoid rendering too many pixels on high-DPI screens.
+
+### Step 2: Implement Shader Effects and Post-Processing
+Incorporate post-processing pipelines (using `EffectComposer` or `@react-three/postprocessing`) to add bloom, chromatic aberration, depth of field, or film grain. Keep pass counts low and combine custom fragment shaders to minimize draw calls.
+
+### Step 3: Integrate Interactive Physics and Motion
+Utilize physics frameworks (such as Cannon.js or Rapier) or procedural spring animations to make 3D objects react to mouse hover, drag, and click inputs with organic feedback.
+
+### Step 4: Asset Pipeline and Preloader
+Optimize 3D models (using Draco compression) and load them using custom loading managers. Render interactive preloaders to entertain users while heavy assets are fetched in the background.
+
+## Examples
+
+### Example 1: Custom Post-processing in React Three Fiber (R3F)
+
+```jsx
+import { Canvas } from '@react-three/fiber';
+import { EffectComposer, Bloom, DepthOfField, Vignette } from '@react-three/postprocessing';
+
+export default function PremiumComposer() {
+  return (
+    <Canvas dpr={[1, 2]} gl={{ powerPreference: "high-performance", antialias: false }}>
+      <ambientLight intensity={0.5} />
+      <mesh>
+        <boxGeometry />
+        <meshStandardMaterial emissive="orange" emissiveIntensity={2.0} />
+      </mesh>
+      
+      <EffectComposer disableNormalPass>
+        <DepthOfField focusDistance={0} focalLength={0.02} bokehScale={2} height={480} />
+        <Bloom luminanceThreshold={0.3} luminanceSmoothing={0.9} height={300} />
+        <Vignette eskil={false} offset={0.1} darkness={1.1} />
+      </EffectComposer>
+    </Canvas>
+  );
+}
+```
+
+### Example 2: Custom GLSL Shader Material for Liquid/Wavy Effects
+
+```javascript
+import * as THREE from 'three';
+
+const CustomWavyMaterial = new THREE.ShaderMaterial({
+  vertexShader: `
+    varying vec2 vUv;
+    uniform float uTime;
+    void main() {
+      vUv = uv;
+      vec3 pos = position;
+      pos.z += sin(pos.x * 5.0 + uTime) * 0.1;
+      pos.z += cos(pos.y * 5.0 + uTime) * 0.1;
+      gl_Position = projectionMatrix * modelViewMatrix * vec4(pos, 1.0);
+    }
+  `,
+  fragmentShader: `
+    varying vec2 vUv;
+    uniform float uTime;
+    uniform vec3 uColor;
+    void main() {
+      float pulse = 0.5 + 0.5 * sin(uTime + vUv.x * 10.0);
+      gl_FragColor = vec4(uColor * pulse, 1.0);
+    }
+  `,
+  uniforms: {
+    uTime: { value: 0.0 },
+    uColor: { value: new THREE.Color('#3b82f6') }
+  }
+});
+```
+
+## Best Practices
+
+- ✅ Set `dpr={[1, 2]}` to restrict the device pixel ratio to a maximum of 2.
+- ✅ Disable antialiasing on the WebGLRenderer when post-processing is active to prevent double-aliasing performance penalties.
+- ✅ Bake ambient occlusion, lighting, and shadows into textures using Blender or other 3D software instead of using dynamic lights and real-time shadows.
+- ✅ Use instance rendering (`THREE.InstancedMesh` or R3F `<Instances>`) for scenes containing multiple identical meshes.
+- ❌ Avoid using uncompressed GLTF/OBJ models. Always compress models using Draco or Meshopt.
+- ❌ Avoid real-time shadow maps (such as `THREE.DirectionalLightShadow`) on mobile or low-end devices due to the heavy performance overhead.
+
+## Limitations
+
+- This skill does not replace environment-specific validation, testing, or expert review.
+- Stop and ask for clarification if required inputs, permissions, or safety boundaries are missing.
+- Complex shader mathematics and advanced physics simulation bounds require manual testing across different device chipsets.
+
+## Security & Safety Notes
+
+- Verify that external 3D model URLs (loaded via `GLTFLoader`) are hosted on trusted, secure CDNs (HTTPS).
+- Do not execute arbitrary, unvalidated shell scripts or use unpinned NPM packages to optimize assets.
+
+## Common Pitfalls
+
+- **Problem**: Severe lag/framerate drop on mobile or high-DPI (Retina) screens.
+  **Solution**: Ensure the pixel ratio is limited to 2 (`renderer.setPixelRatio(Math.min(window.devicePixelRatio, 2))`) and disable unused post-processing passes.
+- **Problem**: Long loading times and white screens during initialization.
+  **Solution**: Use a loading manager (`THREE.LoadingManager`) and display a responsive, interactive preloader to keep the user engaged.
+
+## Related Skills
+
+- `@3d-web-experience` - Core WebGL, Three.js, and Spline concepts.
+- `@scroll-experience` - Integrating 3D animation with scroll controllers.
+- `@performance-optimizer` - General code execution performance tuning.

package/bundled-skills/sql-sentinel/SKILL.md

@@ -0,0 +1,131 @@
+---
+name: sql-sentinel
+description: "Audit SQL for the cost & performance anti-patterns that burn warehouse credits. Scores warehouse health 0-100 and outputs a prioritized cost-reduction plan for BigQuery, Snowflake, Redshift, and Postgres."
+category: data
+risk: safe
+source: community
+source_repo: takeaseatventure/sql-sentinel
+source_type: community
+date_added: "2026-06-26"
+author: takeaseat
+tags: [sql, bigquery, snowflake, redshift, postgres, data-warehouse, cost-optimization, performance, audit, finops]
+tools: [claude, cursor, codex, gemini]
+license: "MIT"
+license_source: "https://github.com/takeaseatventure/sql-sentinel/blob/main/LICENSE"
+---
+
+# sql-sentinel
+
+## Overview
+
+A static-analysis skill that audits SQL for the cost & performance anti-patterns that dominate warehouse bills — `SELECT *`, full-table scans, non-sargable predicates, Cartesian joins, the `NOT IN` NULL trap, and 15 more. It scores warehouse query health 0-100 (A-F) and outputs a prioritized cost-reduction plan, each finding with a `why`, a concrete `fix`, and an estimated savings.
+
+Built for analytics engineers (dbt, Looker), data platform teams running FinOps / "reduce cloud spend" initiatives, and anyone reviewing a SQL pull request before it hits production. Works across BigQuery, Snowflake, Redshift, and Postgres. Zero dependencies, MIT licensed.
+
+The executable engine and full rule set live in the source repository: https://github.com/takeaseatventure/sql-sentinel
+
+## When to Use This Skill
+
+- A user writes or reviews a query for BigQuery, Snowflake, Redshift, Postgres, or Spark SQL.
+- A user asks "why is this query so slow?" or "why is my warehouse bill so high?"
+- A user is about to promote a dashboard query or dbt model to production.
+- A data engineer wants a second pair of eyes before a code review or a cost-optimization sweep.
+- A team is running a "reduce cloud spend" or FinOps initiative.
+
+## How It Works
+
+The engine splits a SQL script into statements (honoring quotes and comments), runs 20 rules over each statement, scores health 0-100 weighted by severity (critical 25, high 12, medium 5, low 1), and returns a prioritized cost-reduction plan.
+
+### Step 1: Run the audit
+
+Install or clone the source repository, then run the zero-dependency engine:
+
+```bash
+git clone https://github.com/takeaseatventure/sql-sentinel.git
+cd sql-sentinel
+node scripts/sql-sentinel.js path/to/query.sql
+```
+
+Or programmatically:
+
+```javascript
+const { auditSql } = require('./scripts/sql-sentinel');
+const report = auditSql(yourSqlString, { dialect: 'bigquery' });
+console.log(report.healthScore);      // 0-100
+console.log(report.grade);            // 'A' | 'B' | 'C' | 'D' | 'E' | 'F'
+console.log(report.prioritizedPlan);  // array, worst findings first
+```
+
+### Step 2: Read the prioritized plan
+
+The output leads with critical findings (Cartesian joins, mass DELETE) and descends to low-severity style issues. Each finding explains *why* it costs money and *how* to fix it.
+
+## Examples
+
+### Example 1: A messy dashboard query
+
+```sql
+SELECT DISTINCT *
+FROM user_events, raw_logs
+WHERE LOWER(event_name) LIKE '%signup%'
+  AND user_id NOT IN (SELECT id FROM deleted_users)
+ORDER BY created_at;
+```
+
+The audit scores this 17/100 (grade F) and flags 7 findings:
+- CRITICAL: comma-join produces a Cartesian product (can turn a $0.02 query into a $200 query)
+- HIGH: `SELECT *` forces full column scan (30-90% wasted bytes on wide tables)
+- HIGH: leading-wildcard `LIKE '%signup%'` defeats indexes
+- HIGH: `LOWER(event_name)` defeats indexes (non-sargable)
+- HIGH: `NOT IN (SELECT ...)` — NULL semantics hazard
+- MEDIUM: `SELECT DISTINCT` dedup cost
+- MEDIUM: `ORDER BY` without `LIMIT` sorts the full result
+
+### Example 2: A clean, sargable query
+
+```sql
+-- This scores 90+/100 (grade A) — no findings
+SELECT id, email, created_at
+FROM users
+WHERE created_at >= TIMESTAMP '2026-01-01'
+  AND created_at <  TIMESTAMP '2026-02-01'
+ORDER BY id
+LIMIT 100;
+```
+
+## The 20 rules (ruleset v1.0.0)
+
+| Rule | Severity | Catches |
+|---|---|---|
+| SQL001 | high | `SELECT *` full column scan |
+| SQL002 | critical | No `WHERE` → full table scan |
+| SQL003 | high | `LIKE '%term'` non-sargable |
+| SQL004 | high | Function on column kills index |
+| SQL005 | critical | `CROSS JOIN` / comma-join |
+| SQL006 | medium | `SELECT DISTINCT` dedup cost |
+| SQL007 | medium | `ORDER BY` without `LIMIT` |
+| SQL008 | high | `NOT IN (SELECT ...)` NULL trap |
+| SQL009 | medium | Implicit type cast |
+| SQL010 | low | Many `OR`s (use `IN`/`UNION`) |
+| SQL011 | medium | `COUNT(DISTINCT)` at scale (use HLL) |
+| SQL012 | low | `LIMIT` without `ORDER BY` |
+| SQL013 | medium | Scalar subquery in `SELECT` |
+| SQL014 | medium | 5+ JOINs broadcast/spill risk |
+| SQL015 | high | Fact table, no partition filter |
+| SQL017 | low | String concat in `SELECT` |
+| SQL018 | medium | Window `OVER ()` no `PARTITION` |
+| SQL020 | critical | `DELETE`/`UPDATE` without `WHERE` |
+| SQL021 | low | `SELECT *` in `EXISTS`/`IN` |
+| SQL022 | medium | `UNION` vs `UNION ALL` |
+
+Run the test suite to verify each rule fires on real SQL:
+
+```bash
+cd scripts && node test.js   # 26 tests, zero dependencies
+```
+
+## Limitations
+
+- This is a **static** analyzer. It finds anti-patterns in the *text* of SQL; it does not read query plans, row counts, or billing. A flagged query on a 100-row table is cheap; the same query on a billion-row table is the problem the rule exists to prevent.
+- The fact-table heuristic (SQL015) keys off table *names* (`*_events`, `*_log`) and is advisory, not definitive.
+- It does not execute SQL — safe to run on any `.sql` file.