opencode-skills-collection 4.0.0 → 4.0.1

package/bundled-skills/wp-guard/references/review-checklist.md

@@ -0,0 +1,57 @@
+# WP Guard — Review Checklist
+
+Structured walk for review mode. Lead with findings, not summary. Cite file:line. Prioritize: security → silent breakage → i18n → performance.
+
+## Contents
+
+- Pass 1: Security sweep
+- Pass 2: API and hook correctness
+- Pass 3: i18n
+- Pass 4: Performance
+- Pass 5: Packaging hygiene
+- Reporting
+
+## Pass 1: Security sweep (must fix)
+
+Grep-driven; check every hit:
+
+- `echo`, `print`, `<?=`, `printf` — every variable escaped with the context-correct `esc_*`/`wp_kses`? (Rule 1)
+- `$_POST`, `$_GET`, `$_REQUEST`, `$_SERVER`, `$_COOKIE` — `wp_unslash()` then sanitized? (Rule 2)
+- `add_action( 'wp_ajax_`, `admin_post_`, `rest_api_init` — every state-changing handler has BOTH `current_user_can()` and a nonce check / real `permission_callback`? (Rule 3)
+- `$wpdb->` — every variable behind `prepare()` placeholders? `esc_like()` for LIKE? (Rule 4)
+- `$_FILES` — handled via `wp_handle_upload()` with type allowlist?
+- Secrets: API keys hardcoded? Logged? In autoloaded options when they belong in constants/env?
+
+## Pass 2: API and hook correctness (should fix)
+
+- Every hooked hook and called function exists in supported WP/plugin versions? (Rule 6 — hallucinated hooks fail silently)
+- Hook timing right? (No front-end work on admin hooks, no early queries, no `init`-heavy work per request)
+- Core API replacements: curl, raw `<script>` echoes, manual cron loops, direct file ops? (Rule 5)
+- Prefixes on every public name: functions, options, transients, meta keys, handles, AJAX actions? (Rule 7)
+- `ABSPATH` guard present in working files? (Rule 8)
+- `wp_safe_redirect()` + `exit` after state changes?
+
+## Pass 3: i18n (should fix; blocking on multilingual projects)
+
+- User-facing strings without wrappers? Wrong/non-literal text domain? (Rule 9)
+- Placeholders without translator comments? Plural logic without `_n()`?
+- Concatenated sentence fragments?
+- Stored user-facing strings (options/meta) that multilingual plugins can't see? (see [i18n.md](i18n.md))
+- Raw `date()`/`number_format()` for display?
+
+## Pass 4: Performance (worth noting; blocking on every-request paths)
+
+- `posts_per_page => -1`, `query_posts()`, unbounded `get_users()`/`get_terms()`? (Rule 10)
+- Queries or `get_post_meta()` inside loops without cache priming?
+- Remote calls without transient/object caching? (Rule 11)
+- Large options autoloading? Unconditional asset enqueues?
+
+## Pass 5: Packaging hygiene
+
+- WooCommerce code in scope → hand off to woo-guard when it is installed; otherwise apply WooCommerce's HPOS, CRUD, checkout, and money rules from its developer documentation.
+- Activation/deactivation/uninstall: scheduled events cleared, transients cleaned, uninstall removes its data?
+- Direct entry files, readme version mismatches, debug code (`error_log`, `var_dump`) left in?
+
+## Reporting
+
+Use the SKILL.md reporting format. Lead with the security findings and an overall verdict (merge / fix first / do not merge). End with at most three positives worth keeping — reviewers who only list faults get ignored.

package/bundled-skills/wp-guard/references/security.md

@@ -0,0 +1,100 @@
+# WP Guard — Security Reference
+
+## Contents
+
+- Escaping: context → function
+- Sanitization: input type → function
+- The unslash-then-sanitize order
+- Nonce + capability lifecycle
+- REST API permissions
+- $wpdb->prepare details
+- File uploads
+- Common AI-generated violations
+
+## Escaping: context → function
+
+Escape at the moment of output, with the function matching the destination context:
+
+| Output context | Function |
+|---|---|
+| HTML body text | `esc_html()` |
+| HTML attribute | `esc_attr()` |
+| URL (href/src/action) | `esc_url()` (display) / `esc_url_raw()` (storage/redirects) |
+| Data for inline JS | `wp_json_encode()` + `wp_add_inline_script()`; `esc_js()` is legacy — single-quoted strings in inline attributes only |
+| Textarea content | `esc_textarea()` |
+| Rich/user HTML | `wp_kses_post()` or `wp_kses()` with an explicit allowlist |
+| Translation + output | `esc_html__()`, `esc_html_e()`, `esc_attr__()` — escape and translate in one call |
+
+Trust nothing at output time — not even your own stored options; another plugin or a compromised import may have written them. "Escaped on save" is not a defense.
+
+## Sanitization: input type → function
+
+| Expected input | Function |
+|---|---|
+| Plain text line | `sanitize_text_field()` |
+| Multiline text | `sanitize_textarea_field()` |
+| Integer / ID | `absint()` or `intval()` |
+| Slug/key | `sanitize_key()` / `sanitize_title()` |
+| Email | `sanitize_email()` + `is_email()` check |
+| URL | `esc_url_raw()` |
+| HTML payload | `wp_kses_post()` / `wp_kses()` |
+| File name | `sanitize_file_name()` |
+| Anything enumerable | strict allowlist comparison (`in_array( $v, $allowed, true )`) |
+
+## The unslash-then-sanitize order
+
+WordPress adds slashes to superglobals. The correct pipeline is always:
+
+```php
+$status = sanitize_key( wp_unslash( $_POST['ncs_status'] ?? '' ) );
+```
+
+`wp_unslash()` first, sanitizer second. Sanitizing slashed data corrupts legitimate input and hides bugs.
+
+## Nonce + capability lifecycle
+
+Both checks, always, for any state change. They answer different questions:
+
+- `current_user_can( 'manage_options' )` — is this user *allowed* to do this? (authorization)
+- `check_admin_referer( 'ncs_save_settings' )` / `check_ajax_referer( 'ncs_action', 'nonce' )` — did this request *intend* this action? (CSRF protection)
+
+A nonce without a capability check lets any logged-in subscriber fire admin actions. A capability check without a nonce leaves CSRF open. AI-generated handlers routinely have one, the other, or neither — verify both exist on every `admin_post_*`, `wp_ajax_*`, and form handler.
+
+Generate nonces with `wp_nonce_field()` (forms) or `wp_create_nonce()` (AJAX/REST payloads). Nonces are per-user and time-limited; do not cache pages containing them.
+
+## REST API permissions
+
+- Every route registers a real `permission_callback`. `__return_true` is acceptable only for genuinely public read-only data — never for writes.
+- Validate and sanitize via the route's `args` schema (`validate_callback`, `sanitize_callback`) instead of manual checks inside the handler.
+- Cookie-authenticated REST requests require the `X-WP-Nonce` header (`wp_rest` nonce); custom auth schemes must fail closed.
+
+## $wpdb->prepare details
+
+```php
+$row = $wpdb->get_row(
+	$wpdb->prepare(
+		"SELECT * FROM {$wpdb->prefix}ncs_log WHERE user_id = %d AND event = %s",
+		$user_id,
+		$event
+	)
+);
+```
+
+- Placeholders: `%s`, `%d`, `%f`; `%i` for table/column identifiers (WP ≥ 6.2).
+- `IN ( … )` lists: build placeholders dynamically — `implode( ',', array_fill( 0, count( $ids ), '%d' ) )` — then prepare with the spread array.
+- LIKE queries: `$wpdb->esc_like()` the term *before* passing it as a `%s` parameter.
+- Never interpolate `$_REQUEST` data anywhere near SQL, even "validated" data.
+- Prefer `WP_Query`, `get_posts()`, meta/term/option APIs when they can express the query — they bring caching for free.
+
+## File uploads
+
+Use `wp_handle_upload()` / media APIs — never move `$_FILES` manually. Validate type with `wp_check_filetype_and_ext()` against an allowlist; never trust the client MIME. Store outside executable paths; WordPress handles this when you use its APIs.
+
+## Common AI-generated violations
+
+1. `echo '<div>' . $title . '</div>';` — unescaped output (Rule 1). Published research: XSS appears in 86% of AI generations tested on XSS-prone tasks (see [sources.md](sources.md)).
+2. `wp_ajax_` handler with neither `check_ajax_referer()` nor `current_user_can()` (Rule 3).
+3. `"SELECT * FROM {$wpdb->posts} WHERE post_title = '$title'"` — interpolated SQL (Rule 4).
+4. `permission_callback => '__return_true'` on a POST route (Rule 3).
+5. `curl_init()` inside a plugin (Rule 5) — breaks proxies, blocks, and filters that `wp_remote_*` honors.
+6. Echoed `<script>` blocks with interpolated PHP — combines Rules 1 and 5; use `wp_enqueue_script()` + `wp_add_inline_script()`/`wp_localize_script()`.

package/bundled-skills/wp-guard/references/sources.md

@@ -0,0 +1,27 @@
+# WP Guard — Sources
+
+Central bibliography. Operational guidance lives in the other references; read this file only when a source URL is needed.
+
+## Contents
+
+- WordPress handbooks and standards
+- Research on AI-generated code defects
+
+## WordPress handbooks and standards
+
+- Plugin Handbook — Security: https://developer.wordpress.org/plugins/security/
+- Common APIs Handbook — Sanitizing Data: https://developer.wordpress.org/apis/security/sanitizing/
+- Common APIs Handbook — Escaping Data: https://developer.wordpress.org/apis/security/escaping/
+- Nonces: https://developer.wordpress.org/apis/security/nonces/
+- WordPress Coding Standards (WPCS ruleset): https://github.com/WordPress/WordPress-Coding-Standards
+- Plugin Handbook — Internationalization: https://developer.wordpress.org/plugins/internationalization/
+- wpdb::prepare() reference: https://developer.wordpress.org/reference/classes/wpdb/prepare/
+- REST API Handbook — Adding Custom Endpoints: https://developer.wordpress.org/rest-api/extending-the-rest-api/adding-custom-endpoints/
+- Options autoloading (WP 6.6+): https://make.wordpress.org/core/2024/06/18/options-api-disabling-autoload-for-large-options/
+- Script loading strategies (WP 6.3+): https://make.wordpress.org/core/2023/07/14/registering-scripts-with-async-and-defer-attributes-in-wordpress-6-3/
+
+## Research on AI-generated code defects
+
+- Veracode, 2025 GenAI Code Security Report — 45% of AI-generated samples contained OWASP Top 10 vulnerabilities; XSS failed in 86% of XSS-prone tasks: https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/
+- Perry et al., "Do Users Write More Insecure Code with AI Assistants?", ACM CCS 2023: https://arxiv.org/abs/2211.03622
+- GitGuardian, State of Secrets Sprawl 2025 — 40% higher secret-leak incidence in Copilot-active repos: https://www.gitguardian.com/state-of-secrets-sprawl-report-2025

package/bundled-skills/writing-skills/gotchas.md

@@ -15,7 +15,7 @@ Tribal knowledge to avoid common mistakes.
 ```yaml
 # ❌ BAD: Mixed list and map
 metadata:
-  references: 
+  references:
   triggers: a, b, c
   - item1
   - item2

package/bundled-skills/writing-skills/references/standards/metadata-standard.md

@@ -47,7 +47,7 @@ metadata:
 ^[a-z0-9]+(-[a-z0-9]+)*$
 ```
 
-**Valid**: `my-skill`, `git-release`, `tdd`  
+**Valid**: `my-skill`, `git-release`, `tdd`
 **Invalid**: `My-Skill`, `my_skill`, `-my-skill`, `my--skill`
 
 ## Common Metadata Keys

package/bundled-skills/x-twitter-scraper/SKILL.md

@@ -1,11 +1,16 @@
 ---
 name: x-twitter-scraper
-description: "X/Twitter automation skill for tweet search, follower export, posting, DMs, webhooks, MCP, SDKs, Hermes Tweet, and TweetClaw."
+description: "Use Xquik for X data workflows: tweet search, user lookup, follower export, media downloads, monitors, webhooks, REST API, MCP, SDK setup, and approval-gated account actions."
 category: data
 risk: critical
 source: community
-tags: "[twitter, x-api, tweet-search, twitter-api, twitter-scraper, follower-export, automation, mcp, sdk, webhooks, hermes-agent, hermes-tweet, openclaw, tweetclaw]"
+source_repo: Xquik-dev/x-twitter-scraper
+source_type: official
+author: Xquik
+tags: [twitter, x, social-media, x-api, tweet-search, follower-export, automation, mcp, sdk, webhooks]
 date_added: "2026-02-28"
+license: MIT
+license_source: https://github.com/Xquik-dev/x-twitter-scraper/blob/master/LICENSE
 plugin:
   targets:
     codex: blocked
@@ -16,9 +21,9 @@ plugin:
 
 ## Overview
 
-Gives AI agents X (Twitter) data and automation workflows through the Xquik platform. Covers tweet search, advanced Twitter search, profile tweets, user lookup, follower export, media download, posting, replies, DMs, giveaway draws, account monitoring, webhooks, 23 bulk extraction tools, MCP, official SDKs, the Hermes Tweet Hermes Agent plugin, and the TweetClaw OpenClaw plugin.
+Gives AI agents X (Twitter) data and automation workflows through the Xquik platform. Covers tweet search, profile tweets, user lookup, follower export, media download, replies, DMs, giveaway draws, account monitoring, webhooks, bulk extraction tools, remote MCP, OpenAPI, and official SDKs.
 
-This repository entry is documentation-only: it does not include an executable scraper, binary, package, or vendored runtime code. The external Xquik, Hermes Tweet, and TweetClaw tools referenced below must be reviewed and installed separately before use.
+This repository entry is documentation-only: it does not include an executable scraper, binary, package, or vendored runtime code. Review the Xquik service, public docs, and SDK package before use.
 
 Because this workflow can automate authenticated X/Twitter account actions, treat it as critical-risk guidance. Only use it with accounts and targets you are authorized to operate, and require explicit user approval before posting, replying, liking, reposting, following, unfollowing, sending DMs, creating monitors, registering webhooks, or starting bulk extraction.
 
@@ -35,8 +40,6 @@ Because this workflow can automate authenticated X/Twitter account actions, trea
 - User wants to run a giveaway draw from tweet replies
 - User needs real-time monitoring of an X account (new tweets, follower changes)
 - User wants webhook delivery of monitored events
-- User wants the Hermes Tweet Hermes Agent plugin with `tweet_explore`, `tweet_read`, and approval-gated `tweet_action`
-- User wants the TweetClaw OpenClaw plugin instead of direct REST or MCP setup
 - User asks about trending topics on X
 
 ## Setup
@@ -57,25 +60,15 @@ git clone https://github.com/Xquik-dev/x-twitter-scraper.git .claude/skills/x-tw
 git clone https://github.com/Xquik-dev/x-twitter-scraper.git .agents/skills/x-twitter-scraper
 ```
 
-### Use the Hermes Agent Plugin
+### Use the TypeScript SDK
 
-For Hermes Agent runtime tools, install Hermes Tweet. It wraps the same Xquik API with `tweet_explore` for endpoint discovery, `tweet_read` for read-only calls, and approval-gated `tweet_action` for writes and private actions.
+For JavaScript or TypeScript integrations, install the validated SDK package:
 
 ```bash
-hermes plugins install Xquik-dev/hermes-tweet --enable
+npm install x-developer@2.4.16
 ```
 
-Use Hermes Tweet when a Hermes Agent should search Twitter/X, read tweet replies, look up users, export followers, monitor tweets, post tweets, post replies, send DMs, or automate X actions with explicit approval gates.
-
-### Use the OpenClaw Plugin
-
-For OpenClaw runtime tools, install TweetClaw. It wraps the same Xquik API with `explore` for endpoint discovery and `tweetclaw` for approved calls.
-
-```bash
-openclaw plugins install @xquik/tweetclaw
-```
-
-Use TweetClaw when the agent should search tweets, post tweets, post replies, send DMs, export followers, download media, create monitors, deliver webhooks, or run giveaway draws from OpenClaw.
+Use REST, the SDK, or MCP depending on the host environment. Verify unfamiliar endpoint parameters against the current docs or OpenAPI spec before constructing calls.
 
 ### Get an API Key
 
@@ -101,12 +94,10 @@ export XQUIK_API_KEY
 | Account Monitoring | Track new tweets, replies, retweets, quotes, follower changes |
 | Webhooks | HMAC-signed real-time event delivery to your endpoint |
 | Giveaway Draws | Random winner selection from tweet replies with filters |
-| 23 Extraction Tools | Followers, following, verified followers, mentions, posts, replies, reposts, quotes, threads, articles, communities, lists, Spaces, people search, media, likes, and more |
+| Bulk Extraction Tools | Followers, following, verified followers, mentions, posts, replies, reposts, quotes, threads, articles, communities, lists, Spaces, people search, media, likes, and more |
 | Write Actions | Send tweets, post replies, like, repost, follow, unfollow, and send DMs after explicit approval |
 | SDKs | Official TypeScript, Python, Ruby, Go, Kotlin, Java, PHP, C#, CLI, and Terraform clients |
 | MCP Server | StreamableHTTP endpoint for AI-native integrations |
-| Hermes Tweet Hermes Agent Plugin | Installable `hermes-tweet` runtime with `tweet_explore`, `tweet_read`, and approval-gated `tweet_action` tools |
-| TweetClaw OpenClaw Plugin | Installable `@xquik/tweetclaw` runtime with `explore` and `tweetclaw` tools |
 
 ## Examples
 
@@ -135,11 +126,6 @@ export XQUIK_API_KEY
 "Monitor @openai for new tweets and notify me via webhook"
 ```
 
-**Use Hermes Agent:**
-```
-"Use Hermes Tweet to search Twitter/X for this launch, read the tweet replies, and prepare a draft reply for approval"
-```
-
 **Bulk extraction:**
 ```
 "Extract all followers of @anthropic"
@@ -177,10 +163,6 @@ export XQUIK_API_KEY
 
 https://github.com/Xquik-dev/x-twitter-scraper
 
-Hermes Tweet Hermes Agent plugin: https://github.com/Xquik-dev/hermes-tweet
-
-TweetClaw OpenClaw plugin: https://github.com/Xquik-dev/tweetclaw
-
 **Maintained By:** [Xquik](https://xquik.com)
 
 ## Limitations

package/bundled-skills/xss-html-injection/SKILL.md

@@ -193,7 +193,7 @@ document.writeln()
 element.innerHTML
 element.outerHTML
 element.insertAdjacentHTML()
-eval()
+eval() <!-- security-allowlist: XSS sink inventory -->
 setTimeout()
 setInterval()
 Function()
@@ -317,7 +317,7 @@ Fake login form or misleading content here
 
 ```javascript
 // String concatenation
-<script>eval('al'+'ert(1)')</script>
+<script>eval('al'+'ert(1)')</script> <!-- security-allowlist: controlled XSS obfuscation example -->
 
 // Template literals
 <script>alert`1`</script>
@@ -326,7 +326,7 @@ Fake login form or misleading content here
 <script>[].constructor.constructor('alert(1)')()</script>
 
 // Base64 encoding
-<script>eval(atob('YWxlcnQoMSk='))</script>
+<script>eval(atob('YWxlcnQoMSk='))</script> <!-- security-allowlist: controlled XSS obfuscation example -->
 
 // Without parentheses
 <script>alert`1`</script>

package/bundled-skills/youtube-seo-optimizer/SKILL.md

@@ -911,7 +911,7 @@ Then run the Quality Checklist below.
 
 **Podcast, existing episode, underperforming:** User says "My episode with [guest] has barely any views, here's the URL." → Fetch URL, confirm target keyword, produce Mode D audit — scorecard, detailed findings, rewritten metadata, action plan.
 
-**Short-form, new clip from a podcast:** User says "Cut a Short from the Antigravity Awesome Skills part of that episode." → Mode E: reuse episode's keyword and tags, 60-70 char title, 150-200 word description, 3-5 hashtags including `#Shorts`, cross-post caption.
+**Short-form, new clip from a podcast:** User says "Cut a Short from the Agentic Awesome Skills part of that episode." → Mode E: reuse episode's keyword and tags, 60-70 char title, 150-200 word description, 3-5 hashtags including `#Shorts`, cross-post caption.
 
 ---
 

package/bundled-skills/youtube-summarizer/CHANGELOG.md

@@ -32,8 +32,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### 🔗 Related
 
-- Identified by Codex automated review in antigravity-awesome-skills PR #62
-- Also fixed in antigravity-awesome-skills fork
+- Identified by Codex automated review in agentic-awesome-skills PR #62
+- Also fixed in the agentic-awesome-skills fork
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",