opencode-skills-collection 4.0.0 → 4.0.1

package/bundled-skills/ontoly-software-graph/SKILL.md

@@ -0,0 +1,160 @@
+---
+name: ontoly-software-graph
+description: "Use Ontoly's deterministic Software Graph, MCP server, and agent skills for architecture review, request tracing, impact analysis, and dependency analysis."
+category: development
+risk: critical
+source: community
+source_repo: 0xsarwagya/ontoly
+source_type: community
+date_added: "2026-07-14"
+author: 0xsarwagya
+tags: [software-graph, codebase-analysis, mcp, typescript, architecture, impact-analysis]
+tools: [claude, cursor, gemini, codex, antigravity]
+license: MIT
+license_source: "https://github.com/0xsarwagya/ontoly/blob/main/LICENSE"
+---
+
+# Ontoly Software Graph
+
+## Overview
+
+Ontoly builds a deterministic Software Graph from a TypeScript repository and exposes it through CLI queries, MCP capabilities, and agent skills. Use this skill when a coding agent needs evidence-backed codebase understanding before searching files directly.
+
+This skill is an operating guide for the public Ontoly project. It does not contain compiler logic; all software understanding should come from Ontoly's generated graph, semantic model, query engine, and MCP server.
+
+## When to Use This Skill
+
+- Use when the user asks for repository architecture, module ownership, or onboarding help.
+- Use when tracing a request, route, controller, service, provider, dependency, or call chain.
+- Use when estimating impact for removing, renaming, or refactoring a symbol, module, package, route, or service.
+- Use when reviewing dependency topology, circular imports, dead code, configuration usage, or environment variables.
+- Use when the user explicitly wants Ontoly, Software Graph, MCP, graph validation, semantic coverage, or agent skills.
+
+## How It Works
+
+### Step 1: Verify Ontoly Is Available
+
+Check whether the repository already has Ontoly outputs such as `.ontoly/`, `SoftwareGraph.json`, validation reports, or documented Ontoly scripts. If the `ontoly` command is unavailable, ask the user whether to install or use the repository's documented package manager command.
+
+Recommended local checks:
+
+```bash
+ontoly --help
+find . -maxdepth 3 \( -name "SoftwareGraph.json" -o -name ".ontoly" \) -print
+```
+
+### Step 2: Build or Refresh the Graph
+
+Only run a graph build in the repository the user asked about. Tell the user that graph generation may create local Ontoly artifacts before running it.
+
+```bash
+ontoly build .
+```
+
+If the project documents a different command, prefer the documented command over guessing.
+
+### Step 3: Check Trust, Diagnostics, and Coverage
+
+Before answering architectural questions, inspect Ontoly diagnostics, graph statistics, trust, and semantic coverage. Treat unresolved imports, low trust, missing framework detection, or graph validation failures as answer constraints.
+
+Use the CLI or MCP capabilities exposed by the installed Ontoly version. Prefer structured graph queries over text search.
+
+### Step 4: Use Ontoly MCP Capabilities
+
+Start or connect to the Ontoly MCP server when the host supports MCP:
+
+```bash
+ontoly mcp
+```
+
+Use capabilities such as architecture summaries, dependency analysis, request tracing, impact analysis, configuration lookup, framework reports, dead-code analysis, and graph validation when available.
+
+### Step 5: Answer With Evidence
+
+Every answer should include:
+
+- The Ontoly capability or query used.
+- The node, edge, route, package, or diagnostic evidence that supports the answer.
+- A confidence statement derived from graph evidence.
+- Any known limitations caused by missing graph regions or diagnostics.
+
+### Step 6: Fall Back Gracefully
+
+Only inspect repository files directly when Ontoly cannot answer, the graph is missing, diagnostics make the graph untrustworthy for the question, or the user asks for source-level verification. When falling back, explain which graph evidence was insufficient.
+
+## Examples
+
+### Architecture Review
+
+User asks: "Explain this repository."
+
+Workflow:
+
+1. Verify or build the Ontoly graph.
+2. Check graph trust, diagnostics, detected frameworks, packages, modules, services, routes, and largest dependency hubs.
+3. Use Ontoly's architecture summary or equivalent query.
+4. Report the architecture with graph evidence and confidence.
+
+### Request Tracing
+
+User asks: "Trace the login flow."
+
+Workflow:
+
+1. Search graph nodes for authentication routes and controllers.
+2. Trace route-to-controller-to-service-to-repository relationships.
+3. Include unresolved edges or missing relationships as limitations.
+4. Avoid opening source files unless the graph cannot identify the flow.
+
+### Impact Analysis
+
+User asks: "What breaks if I remove UserRepository?"
+
+Workflow:
+
+1. Locate the graph node for `UserRepository`.
+2. Query callers, consumers, dependency injection edges, modules, routes, and packages that reference it.
+3. Separate direct dependents from transitive impact.
+4. Include confidence based on explicit graph relationships.
+
+## Best Practices
+
+- Prefer Ontoly graph queries before grep, AST parsing, or broad file search.
+- Keep graph evidence separate from inference.
+- Treat diagnostics as part of the answer, not as noise.
+- Use exact node IDs, route paths, package names, and relationship names when available.
+- Rebuild the graph after large user changes before making claims about current architecture.
+- Keep fallbacks narrow and explain why they were needed.
+
+## Limitations
+
+- Ontoly does not replace compiler, test, or runtime validation.
+- Graph quality depends on the Ontoly version, supported language frontend, repository setup, and diagnostics.
+- Missing or partial framework detection lowers confidence for framework-specific answers.
+- Do not claim a relationship exists unless it is present in the graph or clearly labeled as an inference.
+- Stop and ask for clarification if the repository path, target graph, or requested analysis scope is ambiguous.
+
+## Security & Safety Notes
+
+- Run Ontoly only on repositories the user is authorized to analyze.
+- Do not send graph files, source code, environment variables, diagnostics, or repository metadata to external services unless the user explicitly requests it.
+- Treat environment-variable nodes, configuration nodes, and diagnostics as potentially sensitive.
+- Graph generation is local analysis but can create files such as graph output, diagnostics, indexes, or caches inside the repository.
+- Do not execute project build scripts, package installation, or network commands unless they are documented by the repository or approved by the user.
+
+## Common Pitfalls
+
+- **Problem:** Answering from file search even though the graph already contains the relationship.
+  **Solution:** Query Ontoly first and use file inspection only as a fallback.
+
+- **Problem:** Reporting low-confidence inference as a graph fact.
+  **Solution:** Label the claim as inferred and cite the supporting graph evidence separately.
+
+- **Problem:** Ignoring diagnostics.
+  **Solution:** Include graph validation and compiler diagnostics when they affect confidence.
+
+## Related Skills
+
+- `@developer-onboarding` - Use for broad onboarding when Ontoly is unavailable.
+- `@sdk-dx` - Use for SDK design and developer experience reviews after Ontoly identifies public APIs.
+- `@api-onboarding` - Use for API-specific onboarding when route and operation evidence is available.

package/bundled-skills/openclaw-github-repo-commander/SKILL.md

@@ -91,7 +91,7 @@ Compare my skill repo with the top 5 similar repos on GitHub
 
 ## Source Attribution
 
-Originally contributed by [@wd041216-bit](https://github.com/wd041216-bit) in [PR #340](https://github.com/sickn33/antigravity-awesome-skills/pull/340). No standalone upstream repository is currently available for this skill.
+Originally contributed by [@wd041216-bit](https://github.com/wd041216-bit) in [PR #340](https://github.com/sickn33/agentic-awesome-skills/pull/340). No standalone upstream repository is currently available for this skill.
 
 **License**: MIT | **Version**: 4.0.0
 

package/bundled-skills/pilot-protocol/SKILL.md

@@ -49,9 +49,12 @@ If this skill adapts material from an external GitHub repository, it declares:
 Download the installer, inspect it, then run it — do not pipe it straight into a shell.
 
 ```bash
-curl -fsSL https://pilotprotocol.network/install.sh -o /tmp/pilot-install.sh
-less /tmp/pilot-install.sh   # review before executing
-sh /tmp/pilot-install.sh
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+installer="$tmpdir/pilot-install.sh"
+curl --fail --show-error --location https://pilotprotocol.network/install.sh -o "$installer"
+less "$installer"   # review the complete installer before executing
+sh "$installer"
 ```
 
 ### Step 2: Start the node and confirm it registered

package/bundled-skills/postgres-readonly-queries/README.md

@@ -0,0 +1,77 @@
+# postgres
+
+Read-only PostgreSQL query skill. Query multiple databases safely with write protection.
+
+## Setup
+
+1. Copy the example config:
+```bash
+cp connections.example.json connections.json
+```
+
+2. Add your database credentials:
+```json
+{
+  "databases": [
+    {
+      "name": "prod",
+      "description": "Production - users, orders, transactions",
+      "host": "db.example.com",
+      "port": 5432,
+      "database": "app_prod",
+      "user": "readonly",
+      "password": "secret",
+      "sslmode": "require"
+    }
+  ]
+}
+```
+
+3. Secure the config:
+```bash
+chmod 600 connections.json
+```
+
+## Usage
+
+```bash
+# List configured databases
+python3 scripts/query.py --list
+
+# List tables
+python3 scripts/query.py --db prod --tables
+
+# Show schema
+python3 scripts/query.py --db prod --schema
+
+# Run query
+python3 scripts/query.py --db prod --query "SELECT * FROM users" --limit 100
+```
+
+## Config Fields
+
+| Field | Required | Default | Description |
+|-------|----------|---------|-------------|
+| name | Yes | - | Database identifier |
+| description | Yes | - | What data it contains (for auto-selection) |
+| host | Yes | - | Hostname |
+| port | No | 5432 | Port |
+| database | Yes | - | Database name |
+| user | Yes | - | Username |
+| password | Yes | - | Password |
+| sslmode | No | prefer | disable, allow, prefer, require, verify-ca, verify-full |
+
+## Safety Features
+
+- **Read-only sessions**: PostgreSQL `readonly=True` mode blocks writes at database level
+- **Query validation**: Only SELECT, SHOW, EXPLAIN, WITH allowed
+- **Single statement**: No multi-statement queries (prevents `SELECT 1; DROP TABLE`)
+- **Timeouts**: 30s query timeout, 10s connection timeout
+- **Memory cap**: Max 10,000 rows per query
+- **Credential protection**: Passwords sanitized from error messages
+
+## Requirements
+
+```bash
+pip install psycopg2-binary
+```

package/bundled-skills/postgres-readonly-queries/SKILL.md

@@ -0,0 +1,152 @@
+---
+name: postgres-readonly-queries
+description: "Execute safe read-only SQL queries against PostgreSQL databases with multi-connection support and defense-in-depth write protection."
+category: data
+risk: safe
+source: https://github.com/sanjay3290/ai-skills/tree/main/skills/postgres
+source_repo: sanjay3290/ai-skills
+source_type: community
+date_added: "2026-07-09"
+author: sanjay3290
+tags: [postgres, sql, database, read-only]
+tools: [claude, cursor, gemini]
+license: "Apache-2.0"
+license_source: "https://github.com/sanjay3290/ai-skills/blob/main/LICENSE"
+---
+
+# PostgreSQL Read-Only Query Skill
+
+## When to Use
+
+- Use when querying PostgreSQL databases and access must stay strictly read-only
+- Use when exploring schemas, tables, and data across multiple configured connections
+- Use when you want defense-in-depth protection against accidental INSERT/UPDATE/DELETE or DDL
+
+Execute safe, read-only queries against configured PostgreSQL databases.
+
+## Requirements
+
+- Python 3.8+
+- psycopg2-binary: `pip install -r requirements.txt`
+
+## Setup
+
+Create `connections.json` in the skill directory or `~/.config/claude/postgres-connections.json`.
+
+**Security**: Set file permissions to `600` since it contains credentials:
+```bash
+chmod 600 connections.json
+```
+
+```json
+{
+  "databases": [
+    {
+      "name": "production",
+      "description": "Main app database - users, orders, transactions",
+      "host": "db.example.com",
+      "port": 5432,
+      "database": "app_prod",
+      "user": "readonly_user",
+      "password": "your-password",
+      "sslmode": "require"
+    }
+  ]
+}
+```
+
+### Config Fields
+
+| Field | Required | Description |
+|-------|----------|-------------|
+| name | Yes | Identifier for the database (case-insensitive) |
+| description | Yes | What data this database contains (used for auto-selection) |
+| host | Yes | Database hostname |
+| port | No | Port number (default: 5432) |
+| database | Yes | Database name |
+| user | Yes | Username |
+| password | Yes | Password |
+| sslmode | No | SSL mode: disable, allow, prefer (default), require, verify-ca, verify-full |
+
+## Usage
+
+### List configured databases
+```bash
+python3 scripts/query.py --list
+```
+
+### Query a database
+```bash
+python3 scripts/query.py --db production --query "SELECT * FROM users LIMIT 10"
+```
+
+### List tables
+```bash
+python3 scripts/query.py --db production --tables
+```
+
+### Show schema
+```bash
+python3 scripts/query.py --db production --schema
+```
+
+### Limit results
+```bash
+python3 scripts/query.py --db production --query "SELECT * FROM orders" --limit 100
+```
+
+## Database Selection
+
+Match user intent to database `description`:
+
+| User asks about | Look for description containing |
+|-----------------|--------------------------------|
+| users, accounts | users, accounts, customers |
+| orders, sales | orders, transactions, sales |
+| analytics, metrics | analytics, metrics, reports |
+| logs, events | logs, events, audit |
+
+If unclear, run `--list` and ask user which database.
+
+## Safety Features
+
+- **Read-only session**: Connection uses PostgreSQL `readonly=True` mode (primary protection)
+- **Query validation**: Only SELECT, SHOW, EXPLAIN, WITH queries allowed
+- **Single statement**: Multiple statements per query rejected
+- **SSL support**: Configurable SSL mode for encrypted connections
+- **Query timeout**: 30-second statement timeout enforced
+- **Memory protection**: Max 10,000 rows per query to prevent OOM
+- **Column width cap**: 100 char max per column for readable output
+- **Credential sanitization**: Error messages don't leak passwords
+
+## Troubleshooting
+
+| Error | Solution |
+|-------|----------|
+| Config not found | Create `connections.json` in skill directory |
+| Authentication failed | Check username/password in config |
+| Connection timeout | Verify host/port, check firewall/VPN |
+| SSL error | Try `"sslmode": "disable"` for local databases |
+| Permission warning | Run `chmod 600 connections.json` |
+
+## Exit Codes
+
+- **0**: Success
+- **1**: Error (config missing, auth failed, invalid query, database error)
+
+## Workflow
+
+1. Run `--list` to show available databases
+2. Match user intent to database description
+3. Run `--tables` or `--schema` to explore structure
+4. Execute query with appropriate LIMIT
+
+## Limitations
+
+- Read-only protections reduce accidental writes but cannot override database-server policy,
+  triggers, extensions, or an over-privileged account. Use a database role with read-only
+  permissions as the primary control.
+- Query results can contain personal, confidential, or regulated data. Confirm the intended
+  database and avoid exporting or sharing results without explicit authorization.
+- The script is not a replacement for backups, auditing, access reviews, or production change
+  controls.

package/bundled-skills/postgres-readonly-queries/connections.example.json

@@ -0,0 +1,34 @@
+{
+  "databases": [
+    {
+      "name": "production",
+      "description": "Main production database - users, orders, transactions, accounts",
+      "host": "prod-db.example.com",
+      "port": 5432,
+      "database": "app_prod",
+      "user": "readonly_user",
+      "password": "your-password-here",
+      "sslmode": "require"
+    },
+    {
+      "name": "analytics",
+      "description": "Analytics warehouse - aggregated metrics, reports, historical data",
+      "host": "analytics-db.example.com",
+      "port": 5432,
+      "database": "analytics",
+      "user": "analyst",
+      "password": "your-password-here",
+      "sslmode": "require"
+    },
+    {
+      "name": "staging",
+      "description": "Staging environment - mirrors production for testing",
+      "host": "localhost",
+      "port": 5432,
+      "database": "app_staging",
+      "user": "dev",
+      "password": "dev-password",
+      "sslmode": "prefer"
+    }
+  ]
+}

package/bundled-skills/postgres-readonly-queries/requirements.txt

@@ -0,0 +1 @@
+psycopg2-binary>=2.9,<3.0