opencode-skills-collection 4.0.0 → 4.0.2

package/bundled-skills/wp-guard/references/sources.md

@@ -0,0 +1,27 @@
+# WP Guard — Sources
+
+Central bibliography. Operational guidance lives in the other references; read this file only when a source URL is needed.
+
+## Contents
+
+- WordPress handbooks and standards
+- Research on AI-generated code defects
+
+## WordPress handbooks and standards
+
+- Plugin Handbook — Security: https://developer.wordpress.org/plugins/security/
+- Common APIs Handbook — Sanitizing Data: https://developer.wordpress.org/apis/security/sanitizing/
+- Common APIs Handbook — Escaping Data: https://developer.wordpress.org/apis/security/escaping/
+- Nonces: https://developer.wordpress.org/apis/security/nonces/
+- WordPress Coding Standards (WPCS ruleset): https://github.com/WordPress/WordPress-Coding-Standards
+- Plugin Handbook — Internationalization: https://developer.wordpress.org/plugins/internationalization/
+- wpdb::prepare() reference: https://developer.wordpress.org/reference/classes/wpdb/prepare/
+- REST API Handbook — Adding Custom Endpoints: https://developer.wordpress.org/rest-api/extending-the-rest-api/adding-custom-endpoints/
+- Options autoloading (WP 6.6+): https://make.wordpress.org/core/2024/06/18/options-api-disabling-autoload-for-large-options/
+- Script loading strategies (WP 6.3+): https://make.wordpress.org/core/2023/07/14/registering-scripts-with-async-and-defer-attributes-in-wordpress-6-3/
+
+## Research on AI-generated code defects
+
+- Veracode, 2025 GenAI Code Security Report — 45% of AI-generated samples contained OWASP Top 10 vulnerabilities; XSS failed in 86% of XSS-prone tasks: https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/
+- Perry et al., "Do Users Write More Insecure Code with AI Assistants?", ACM CCS 2023: https://arxiv.org/abs/2211.03622
+- GitGuardian, State of Secrets Sprawl 2025 — 40% higher secret-leak incidence in Copilot-active repos: https://www.gitguardian.com/state-of-secrets-sprawl-report-2025

package/bundled-skills/writing-skills/gotchas.md

@@ -15,7 +15,7 @@ Tribal knowledge to avoid common mistakes.
 ```yaml
 # ❌ BAD: Mixed list and map
 metadata:
-  references: 
+  references:
   triggers: a, b, c
   - item1
   - item2

package/bundled-skills/writing-skills/references/standards/metadata-standard.md

@@ -47,7 +47,7 @@ metadata:
 ^[a-z0-9]+(-[a-z0-9]+)*$
 ```
 
-**Valid**: `my-skill`, `git-release`, `tdd`  
+**Valid**: `my-skill`, `git-release`, `tdd`
 **Invalid**: `My-Skill`, `my_skill`, `-my-skill`, `my--skill`
 
 ## Common Metadata Keys

package/bundled-skills/x-twitter-scraper/SKILL.md

@@ -1,11 +1,16 @@
 ---
 name: x-twitter-scraper
-description: "X/Twitter automation skill for tweet search, follower export, posting, DMs, webhooks, MCP, SDKs, Hermes Tweet, and TweetClaw."
+description: "Use Xquik for X data workflows: tweet search, user lookup, follower export, media downloads, monitors, webhooks, REST API, MCP, SDK setup, and approval-gated account actions."
 category: data
 risk: critical
 source: community
-tags: "[twitter, x-api, tweet-search, twitter-api, twitter-scraper, follower-export, automation, mcp, sdk, webhooks, hermes-agent, hermes-tweet, openclaw, tweetclaw]"
+source_repo: Xquik-dev/x-twitter-scraper
+source_type: official
+author: Xquik
+tags: [twitter, x, social-media, x-api, tweet-search, follower-export, automation, mcp, sdk, webhooks]
 date_added: "2026-02-28"
+license: MIT
+license_source: https://github.com/Xquik-dev/x-twitter-scraper/blob/master/LICENSE
 plugin:
   targets:
     codex: blocked
@@ -16,9 +21,9 @@ plugin:
 
 ## Overview
 
-Gives AI agents X (Twitter) data and automation workflows through the Xquik platform. Covers tweet search, advanced Twitter search, profile tweets, user lookup, follower export, media download, posting, replies, DMs, giveaway draws, account monitoring, webhooks, 23 bulk extraction tools, MCP, official SDKs, the Hermes Tweet Hermes Agent plugin, and the TweetClaw OpenClaw plugin.
+Gives AI agents X (Twitter) data and automation workflows through the Xquik platform. Covers tweet search, profile tweets, user lookup, follower export, media download, replies, DMs, giveaway draws, account monitoring, webhooks, bulk extraction tools, remote MCP, OpenAPI, and official SDKs.
 
-This repository entry is documentation-only: it does not include an executable scraper, binary, package, or vendored runtime code. The external Xquik, Hermes Tweet, and TweetClaw tools referenced below must be reviewed and installed separately before use.
+This repository entry is documentation-only: it does not include an executable scraper, binary, package, or vendored runtime code. Review the Xquik service, public docs, and SDK package before use.
 
 Because this workflow can automate authenticated X/Twitter account actions, treat it as critical-risk guidance. Only use it with accounts and targets you are authorized to operate, and require explicit user approval before posting, replying, liking, reposting, following, unfollowing, sending DMs, creating monitors, registering webhooks, or starting bulk extraction.
 
@@ -35,8 +40,6 @@ Because this workflow can automate authenticated X/Twitter account actions, trea
 - User wants to run a giveaway draw from tweet replies
 - User needs real-time monitoring of an X account (new tweets, follower changes)
 - User wants webhook delivery of monitored events
-- User wants the Hermes Tweet Hermes Agent plugin with `tweet_explore`, `tweet_read`, and approval-gated `tweet_action`
-- User wants the TweetClaw OpenClaw plugin instead of direct REST or MCP setup
 - User asks about trending topics on X
 
 ## Setup
@@ -57,25 +60,15 @@ git clone https://github.com/Xquik-dev/x-twitter-scraper.git .claude/skills/x-tw
 git clone https://github.com/Xquik-dev/x-twitter-scraper.git .agents/skills/x-twitter-scraper
 ```
 
-### Use the Hermes Agent Plugin
+### Use the TypeScript SDK
 
-For Hermes Agent runtime tools, install Hermes Tweet. It wraps the same Xquik API with `tweet_explore` for endpoint discovery, `tweet_read` for read-only calls, and approval-gated `tweet_action` for writes and private actions.
+For JavaScript or TypeScript integrations, install the validated SDK package:
 
 ```bash
-hermes plugins install Xquik-dev/hermes-tweet --enable
+npm install x-developer@2.4.16
 ```
 
-Use Hermes Tweet when a Hermes Agent should search Twitter/X, read tweet replies, look up users, export followers, monitor tweets, post tweets, post replies, send DMs, or automate X actions with explicit approval gates.
-
-### Use the OpenClaw Plugin
-
-For OpenClaw runtime tools, install TweetClaw. It wraps the same Xquik API with `explore` for endpoint discovery and `tweetclaw` for approved calls.
-
-```bash
-openclaw plugins install @xquik/tweetclaw
-```
-
-Use TweetClaw when the agent should search tweets, post tweets, post replies, send DMs, export followers, download media, create monitors, deliver webhooks, or run giveaway draws from OpenClaw.
+Use REST, the SDK, or MCP depending on the host environment. Verify unfamiliar endpoint parameters against the current docs or OpenAPI spec before constructing calls.
 
 ### Get an API Key
 
@@ -101,12 +94,10 @@ export XQUIK_API_KEY
 | Account Monitoring | Track new tweets, replies, retweets, quotes, follower changes |
 | Webhooks | HMAC-signed real-time event delivery to your endpoint |
 | Giveaway Draws | Random winner selection from tweet replies with filters |
-| 23 Extraction Tools | Followers, following, verified followers, mentions, posts, replies, reposts, quotes, threads, articles, communities, lists, Spaces, people search, media, likes, and more |
+| Bulk Extraction Tools | Followers, following, verified followers, mentions, posts, replies, reposts, quotes, threads, articles, communities, lists, Spaces, people search, media, likes, and more |
 | Write Actions | Send tweets, post replies, like, repost, follow, unfollow, and send DMs after explicit approval |
 | SDKs | Official TypeScript, Python, Ruby, Go, Kotlin, Java, PHP, C#, CLI, and Terraform clients |
 | MCP Server | StreamableHTTP endpoint for AI-native integrations |
-| Hermes Tweet Hermes Agent Plugin | Installable `hermes-tweet` runtime with `tweet_explore`, `tweet_read`, and approval-gated `tweet_action` tools |
-| TweetClaw OpenClaw Plugin | Installable `@xquik/tweetclaw` runtime with `explore` and `tweetclaw` tools |
 
 ## Examples
 
@@ -135,11 +126,6 @@ export XQUIK_API_KEY
 "Monitor @openai for new tweets and notify me via webhook"
 ```
 
-**Use Hermes Agent:**
-```
-"Use Hermes Tweet to search Twitter/X for this launch, read the tweet replies, and prepare a draft reply for approval"
-```
-
 **Bulk extraction:**
 ```
 "Extract all followers of @anthropic"
@@ -177,10 +163,6 @@ export XQUIK_API_KEY
 
 https://github.com/Xquik-dev/x-twitter-scraper
 
-Hermes Tweet Hermes Agent plugin: https://github.com/Xquik-dev/hermes-tweet
-
-TweetClaw OpenClaw plugin: https://github.com/Xquik-dev/tweetclaw
-
 **Maintained By:** [Xquik](https://xquik.com)
 
 ## Limitations

package/bundled-skills/xss-html-injection/SKILL.md

@@ -193,7 +193,7 @@ document.writeln()
 element.innerHTML
 element.outerHTML
 element.insertAdjacentHTML()
-eval()
+eval() <!-- security-allowlist: XSS sink inventory -->
 setTimeout()
 setInterval()
 Function()
@@ -317,7 +317,7 @@ Fake login form or misleading content here
 
 ```javascript
 // String concatenation
-<script>eval('al'+'ert(1)')</script>
+<script>eval('al'+'ert(1)')</script> <!-- security-allowlist: controlled XSS obfuscation example -->
 
 // Template literals
 <script>alert`1`</script>
@@ -326,7 +326,7 @@ Fake login form or misleading content here
 <script>[].constructor.constructor('alert(1)')()</script>
 
 // Base64 encoding
-<script>eval(atob('YWxlcnQoMSk='))</script>
+<script>eval(atob('YWxlcnQoMSk='))</script> <!-- security-allowlist: controlled XSS obfuscation example -->
 
 // Without parentheses
 <script>alert`1`</script>

package/bundled-skills/youtube-seo-optimizer/SKILL.md

@@ -911,7 +911,7 @@ Then run the Quality Checklist below.
 
 **Podcast, existing episode, underperforming:** User says "My episode with [guest] has barely any views, here's the URL." → Fetch URL, confirm target keyword, produce Mode D audit — scorecard, detailed findings, rewritten metadata, action plan.
 
-**Short-form, new clip from a podcast:** User says "Cut a Short from the Antigravity Awesome Skills part of that episode." → Mode E: reuse episode's keyword and tags, 60-70 char title, 150-200 word description, 3-5 hashtags including `#Shorts`, cross-post caption.
+**Short-form, new clip from a podcast:** User says "Cut a Short from the Agentic Awesome Skills part of that episode." → Mode E: reuse episode's keyword and tags, 60-70 char title, 150-200 word description, 3-5 hashtags including `#Shorts`, cross-post caption.
 
 ---
 

package/bundled-skills/youtube-summarizer/CHANGELOG.md

@@ -32,8 +32,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### 🔗 Related
 
-- Identified by Codex automated review in antigravity-awesome-skills PR #62
-- Also fixed in antigravity-awesome-skills fork
+- Identified by Codex automated review in agentic-awesome-skills PR #62
+- Also fixed in the agentic-awesome-skills fork
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,6 +46,6 @@
     "@types/bun": "*",
     "@types/node": "^26.0.0",
     "@types/strip-json-comments": "^3.0.0",
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   }
 }