opencode-skills-collection 4.0.1 → 4.0.3

package/bundled-skills/sshepherd/SKILL.md

@@ -0,0 +1,107 @@
+---
+name: sshepherd
+description: "Zero-knowledge SSH ops CLI — server health checks, docker/systemd control, log tailing, Postgres introspection, and declarative deploys, without ever exposing credentials to the agent."
+category: devops
+risk: critical
+source: community
+source_repo: Antheurus/sshepherd
+source_type: community
+date_added: "2026-07-15"
+author: Antheurus
+tags: [ssh, devops, cli, server-ops, postgres, deploy, zero-knowledge]
+tools: [claude, cursor, gemini, codex]
+license: "MIT"
+license_source: "https://github.com/Antheurus/sshepherd/blob/main/LICENSE"
+---
+
+# sshepherd
+
+## Overview
+
+`sshepherd` is a compiled Bun/TypeScript CLI that lets an agent operate a real remote server over SSH — health checks, docker/systemd service control, log tailing, config file edits, read-only Postgres introspection, and declarative deploys — without ever seeing a password, private key, hostname, username, or port. Every operation shells out to the system `ssh` binary through a single transport path and returns the same typed `Envelope<T>` (`ok`, `alias`, `data`, `error`), never a raw terminal dump. The agent passes only a *name* — an ssh alias, a Postgres target, or a deploy recipe — that resolves entirely outside the process.
+
+## When to Use This Skill
+
+- Use when you need to check a remote server's health (disk, memory, CPU, ports, OOM history) without handing the agent SSH credentials.
+- Use when working with remote docker or systemd services — listing, inspecting, or restarting them — or tailing their logs.
+- Use when the user asks to read or edit a remote config file, run a declarative deploy from a named recipe, introspect a remote Postgres database read-only, or audit SSH/security posture on a box.
+
+## How It Works
+
+### Step 1: Declare targets once, outside any prompt
+
+Every connection detail is declared ahead of time and never appears on the command line: ssh aliases in `~/.ssh/config`, Postgres targets in `~/.config/sshepherd/targets.toml`, deploy recipes in recipe TOML files. OpenSSH resolves the real `HostName`/`User`/`Port`/`IdentityFile` internally.
+
+### Step 2: Invoke a group + action by name
+
+```
+sshepherd <group> <action> [positionals...] [--flag value]
+```
+
+Nine command groups — `hosts`, `check`, `logs`, `services`, `deploy`, `config`, `db`, `files`, `security` — 52 ops total. Output is JSON to stdout by default; add `--pretty` for a human-readable table/key-value view. The response only ever echoes back the `alias` it was given — there is no host/user/port/ip field anywhere in the response type, structurally.
+
+### Step 3: Discover the command surface
+
+```bash
+./dist/sshepherd --help                 # list groups
+./dist/sshepherd check --help           # list actions + flags for one group
+```
+
+## Examples
+
+### Example 1: Server health overview
+
+```bash
+./dist/sshepherd check overview lms-server
+```
+
+Returns a JSON envelope with disk, memory, CPU, listening ports, and OOM history for the host behind the `lms-server` alias — the agent never learns the host's address.
+
+### Example 2: Restart a docker service and tail its logs
+
+```bash
+./dist/sshepherd services restart lms-server --name api
+./dist/sshepherd logs tail lms-server --name api --lines 100
+```
+
+### Example 3: Read-only Postgres introspection
+
+```bash
+./dist/sshepherd db tables prod
+```
+
+`prod` is a pg-target name that resolves to *how* to reach `psql` on a host — never a database password. `psql` runs inside the target container, authenticated by peer/trust/`.pgpass` already on the remote.
+
+## Best Practices
+
+- ✅ Declare every alias/target/recipe ahead of time in `~/.ssh/config` / `targets.toml` / recipe TOML — never inline connection details.
+- ✅ Pass only names (alias, pg-target, recipe) to the CLI; let OpenSSH own authentication.
+- ✅ Use `--pretty` for human review and default JSON output for machine parsing.
+- ❌ Don't try to inject a hostname, user, port, or password into a command — the CLI has no field for them.
+- ❌ Don't reach for the `ssh2` npm library or hand-rolled SSH; the whole point is delegating to the trusted system `ssh` binary.
+
+## Limitations
+
+- This skill does not replace environment-specific validation, testing, or expert review.
+- Stop and ask for clarification if required inputs, permissions, or safety boundaries are missing.
+- Requires the system OpenSSH client and pre-declared aliases/targets/recipes; it cannot connect to a host that has not been configured outside the agent.
+- Postgres access is read-only introspection by design.
+
+## Security & Safety Notes
+
+- **Zero-knowledge credential model:** the agent never sees a password, private key, hostname, username, or port. It only ever passes an ssh alias, a pg-target name, or a recipe name; the real connection tuple is resolved by OpenSSH outside the process, and every response echoes back only the alias.
+- **Never reads private key material.** Authentication happens entirely inside OpenSSH's own trusted code path.
+- **Confirmation gate on mutations:** destructive/mutating actions (service restart, config write, deploy) require an explicit `--yes` confirm flag.
+- **Human-only credential entry:** the separate `setup ssh-alias install` action opens a one-shot local browser form that only a human can type a password into — the agent can trigger and wait on it but never sees, logs, or relays the password.
+- Environment expectation: run against hosts you are authorized to operate.
+
+## Common Pitfalls
+
+- **Problem:** Trying to pass a hostname or password directly to a command.
+  **Solution:** Register the target first (`setup ssh-alias register` / `setup db-target`), then reference it only by name.
+- **Problem:** A mutating action returns without doing anything.
+  **Solution:** Add the `--yes` confirm flag — mutations are gated by design.
+
+## Related Skills
+
+- `@devops-automation` - When you need broader CI/CD or infrastructure-as-code automation beyond SSH ops.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "4.0.1",
+  "version": "4.0.3",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,6 +46,6 @@
     "@types/bun": "*",
     "@types/node": "^26.0.0",
     "@types/strip-json-comments": "^3.0.0",
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   }
 }

package/skills_index.json

@@ -498,6 +498,39 @@
       "reasons": []
     }
   },
+  {
+    "id": "ad-campaign-analyzer",
+    "path": "skills/ad-campaign-analyzer",
+    "category": "marketing",
+    "name": "ad-campaign-analyzer",
+    "description": "Analyze cross-channel campaign data, quantify uncertainty, and propose evidence-labeled budget tests without overstating causality.",
+    "risk": "critical",
+    "source": "community",
+    "date_added": "2026-07-16",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "gooseworks-ai/goose-skills",
+    "license": "MIT",
+    "license_source": "https://github.com/gooseworks-ai/goose-skills/blob/main/LICENSE",
+    "tags": [
+      "ads",
+      "analytics",
+      "budget-optimization",
+      "roas",
+      "marketing"
+    ]
+  },
   {
     "id": "ad-creative",
     "path": "skills/ad-creative",
@@ -2388,6 +2421,41 @@
       "reasons": []
     }
   },
+  {
+    "id": "anywrite",
+    "path": "skills/anywrite",
+    "category": "productivity",
+    "name": "anywrite",
+    "description": "Compiled CLI covering all 52 endpoints of the Anytype local API — objects, properties, tags, search, chat, files — one binary, no MCP server needed.",
+    "risk": "critical",
+    "source": "community",
+    "date_added": "2026-07-15",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "Antheurus/anywrite",
+    "license": "MIT",
+    "license_source": "https://github.com/Antheurus/anywrite/blob/main/LICENSE",
+    "tags": [
+      "anytype",
+      "cli",
+      "pkm",
+      "notes",
+      "api-integration",
+      "productivity",
+      "knowledge-management"
+    ]
+  },
   {
     "id": "aomi-transact",
     "path": "skills/aomi-transact",
@@ -11221,6 +11289,39 @@
       "reasons": []
     }
   },
+  {
+    "id": "competitor-ad-intelligence",
+    "path": "skills/competitor-ad-intelligence",
+    "category": "marketing",
+    "name": "competitor-ad-intelligence",
+    "description": "Research public competitor ads, analyze creative patterns and landing pages, and produce an evidence-labeled strategic teardown.",
+    "risk": "critical",
+    "source": "community",
+    "date_added": "2026-07-16",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "gooseworks-ai/goose-skills",
+    "license": "MIT",
+    "license_source": "https://github.com/gooseworks-ai/goose-skills/blob/main/LICENSE",
+    "tags": [
+      "ads",
+      "competitive-intelligence",
+      "meta-ads",
+      "google-ads",
+      "marketing"
+    ]
+  },
   {
     "id": "competitor-alternatives",
     "path": "skills/competitor-alternatives",
@@ -15188,6 +15289,37 @@
     "license": "MIT",
     "license_source": "https://github.com/jonathimer/devmarketing-skills/blob/main/LICENSE"
   },
+  {
+    "id": "diagnose-android-overheating",
+    "path": "skills/diagnose-android-overheating",
+    "category": "debugging",
+    "name": "diagnose-android-overheating",
+    "description": "Use when diagnosing Android overheating, idle heat, thermal throttling, charging or radio heat, or abnormal battery drain with read-only ADB evidence and approval gates.",
+    "risk": "critical",
+    "source": "self",
+    "date_added": "2026-07-16",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "self",
+    "tags": [
+      "android",
+      "adb",
+      "overheating",
+      "thermal",
+      "battery",
+      "diagnostics"
+    ]
+  },
   {
     "id": "diagnosing-bugs",
     "path": "skills/diagnosing-bugs",
@@ -15445,6 +15577,38 @@
       "reasons": []
     }
   },
+  {
+    "id": "ditto",
+    "path": "skills/ditto",
+    "category": "agent-behavior",
+    "name": "ditto",
+    "description": "Use when a user asks to mine or update a private, evidence-backed work profile from local Claude Code, Codex, Copilot CLI, or OpenCode sessions.",
+    "risk": "critical",
+    "source": "community",
+    "date_added": "2026-07-14",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "ohad6k/ditto",
+    "license": "MIT",
+    "license_source": "https://github.com/ohad6k/ditto/blob/v0.3.6/LICENSE",
+    "tags": [
+      "personalization",
+      "context-engineering",
+      "session-mining",
+      "agent-memory"
+    ]
+  },
   {
     "id": "django-access-review",
     "path": "skills/django-access-review",
@@ -20197,7 +20361,7 @@
     "path": "skills/git-pr-workflows-git-workflow",
     "category": "workflow",
     "name": "git-pr-workflows-git-workflow",
-    "description": "Orchestrate a comprehensive git workflow from code review through PR creation, leveraging specialized agents for quality assurance, testing, and deployment readiness. This workflow implements modern g",
+    "description": "Orchestrate review, tests, commits, branch pushes, and pull-request creation with parallel agents. Use when completed changes must move through validation into a PR or guarded merge.",
     "risk": "critical",
     "source": "community",
     "date_added": "2026-02-27",
@@ -20407,7 +20571,7 @@
     "path": "skills/github-automation",
     "category": "workflow",
     "name": "github-automation",
-    "description": "Automate GitHub repositories, issues, pull requests, branches, CI/CD, and permissions via Rube MCP (Composio). Manage code workflows, review PRs, search code, and handle deployments programmatically.",
+    "description": "Operate GitHub issues, pull requests, branches, checks, workflows, and permissions through Rube MCP. Use when GitHub work must be queried or changed programmatically with repository-policy safeguards.",
     "risk": "critical",
     "source": "community",
     "date_added": "2026-02-27",
@@ -31098,6 +31262,38 @@
       "security"
     ]
   },
+  {
+    "id": "optim-agent",
+    "path": "skills/optim-agent",
+    "category": "data",
+    "name": "optim-agent",
+    "description": "Guide agent-driven parameter optimization for configurable systems with measurable objectives. Use for HPO, inference tuning, simulations, or RL/control experiments.",
+    "risk": "safe",
+    "source": "community",
+    "date_added": "2026-07-15",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "Optim-Agent/optim-agent",
+    "license": "MIT",
+    "license_source": "https://github.com/Optim-Agent/optim-agent/blob/main/LICENSE",
+    "tags": [
+      "optimization",
+      "hyperparameter-optimization",
+      "experiments",
+      "tuning"
+    ]
+  },
   {
     "id": "options-flow-analyzer",
     "path": "skills/options-flow-analyzer",
@@ -35266,8 +35462,8 @@
     "path": "skills/repo-maintainer",
     "category": "uncategorized",
     "name": "repo-maintainer",
-    "description": "Championship-grade repository maintenance. Audits for test artifacts, dependency issues, CI/CD health, documentation sync, and FAF alignment. Generates prioritized cleanup plans. Use when repos need deep cleaning or ongoing maintenance.",
-    "risk": "unknown",
+    "description": "Audit and repair repository hygiene across artifacts, dependencies, CI, docs, Git state, and code-quality signals. Use for repository maintenance, cleanup, health checks, or pre-release hardening.",
+    "risk": "critical",
     "source": "https://github.com/Wolfe-Jam/faf-skills/tree/main/skills/repo-maintainer",
     "date_added": "2026-07-01",
     "plugin": {
@@ -40052,6 +40248,41 @@
       "reasons": []
     }
   },
+  {
+    "id": "sshepherd",
+    "path": "skills/sshepherd",
+    "category": "devops",
+    "name": "sshepherd",
+    "description": "Zero-knowledge SSH ops CLI — server health checks, docker/systemd control, log tailing, Postgres introspection, and declarative deploys, without ever exposing credentials to the agent.",
+    "risk": "critical",
+    "source": "community",
+    "date_added": "2026-07-15",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "Antheurus/sshepherd",
+    "license": "MIT",
+    "license_source": "https://github.com/Antheurus/sshepherd/blob/main/LICENSE",
+    "tags": [
+      "ssh",
+      "devops",
+      "cli",
+      "server-ops",
+      "postgres",
+      "deploy",
+      "zero-knowledge"
+    ]
+  },
   {
     "id": "stability-ai",
     "path": "skills/stability-ai",