opencode-skills-collection 4.0.14 → 4.0.16

package/bundled-skills/.antigravity-install-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-07-28T01:21:13.118Z",
+  "updatedAt": "2026-07-30T01:15:43.018Z",
   "entries": [
     "00-andruia-consultant",
     "007",
@@ -350,6 +350,7 @@
     "brand-guidelines-community",
     "brand-perception-psychologist",
     "brave-man",
+    "brendangregg-use-tsa",
     "brevo-automation",
     "broken-authentication",
     "brooks-audit",
@@ -359,6 +360,7 @@
     "brooks-review",
     "brooks-sweep",
     "brooks-test",
+    "browser-act",
     "browser-automation",
     "browser-extension-builder",
     "browser-harness",
@@ -464,6 +466,7 @@
     "codex-profiles",
     "codex-review",
     "codex-subagent",
+    "cohesivity",
     "cold-email",
     "comfyui-gateway",
     "commit",

package/bundled-skills/3d-web-experience/SKILL.md

@@ -4,7 +4,7 @@ description: Expert in building 3D experiences for the web - Three.js, React
   Three Fiber, Spline, WebGL, and interactive 3D scenes. Covers product
   configurators, 3D portfolios, immersive websites, and bringing depth to web
   experiences.
-risk: unknown
+risk: critical
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/ab-test-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ab-test-setup
 description: "Structured guide for setting up A/B tests with mandatory gates for hypothesis, metrics, and execution readiness."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/ab-testing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ab-testing
 description: When the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "should I test this,"...
-risk: unknown
+risk: critical
 source: https://github.com/coreyhaines31/marketingskills/tree/main/skills/ab-testing
 source_repo: coreyhaines31/marketingskills
 source_type: community

package/bundled-skills/accint-commitments/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: accint-commitments
 description: Triage acc's open promises and close them with honest real-world verdicts via acc_act(runtime="outcome").
-risk: unknown
+risk: critical
 source: https://github.com/maxbaluev/accreted-intelligence/tree/main/plugins/claude/skills/commitments
 source_repo: maxbaluev/accreted-intelligence
 source_type: community

package/bundled-skills/accint-frames/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: accint-frames
 description: Drain acc's deliberation queue — open/waiting brain_frames checkpointed by headless runs — via acc_act(runtime="continue").
-risk: unknown
+risk: critical
 source: https://github.com/maxbaluev/accreted-intelligence/tree/main/plugins/claude/skills/frames
 source_repo: maxbaluev/accreted-intelligence
 source_type: community

package/bundled-skills/accint-solve/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: accint-solve
 description: Route a goal through acc's scored-memory loop via acc_act(runtime="solve"); deliberate any returned brain_frame and submit via continue.
-risk: unknown
+risk: critical
 source: https://github.com/maxbaluev/accreted-intelligence/tree/main/plugins/claude/skills/solve
 source_repo: maxbaluev/accreted-intelligence
 source_type: community

package/bundled-skills/ad-creative/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ad-creative
 description: "Create, iterate, and scale paid ad creative for Google Ads, Meta, LinkedIn, TikTok, and similar platforms. Use when generating headlines, descriptions, primary text, or large sets of ad variations for testing and performance optimization."
-risk: unknown
+risk: critical
 source: "https://github.com/coreyhaines31/marketingskills"
 date_added: "2026-03-21"
 metadata:

package/bundled-skills/add-app-clip/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: add-app-clip
 description: Add an iOS App Clip target to an Expo app. Use when the user mentions App Clip, AASA, apple-app-site-association, appclips, smart app banner, or wants to ship a lightweight iOS Clip invoked from a URL alongside their parent app.
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/add-app-clip
 source_repo: expo/skills
 source_type: official

package/bundled-skills/address-github-comments/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: address-github-comments
 description: "Use when you need to address review or issue comments on an open GitHub Pull Request using the gh CLI."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/agent-framework-azure-ai-py/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-framework-azure-ai-py
 description: "Build persistent agents on Azure AI Foundry using the Microsoft Agent Framework Python SDK."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/agent-manager-skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-manager-skill
 description: "Manage multiple local CLI agents via tmux sessions (start/stop/monitor/assign) with cron-friendly scheduling."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/agent-memory/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-memory
 description: A hybrid memory system that provides persistent, searchable knowledge management for AI agents.
-risk: unknown
+risk: critical
 source: https://github.com/webzler/agentMemory/tree/main/
 source_repo: webzler/agentMemory
 source_type: community

package/bundled-skills/agent-memory-mcp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-memory-mcp
 description: "A hybrid memory system that provides persistent, searchable knowledge management for AI agents (Architecture, Patterns, Decisions)."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---
@@ -16,18 +16,29 @@ This skill provides a persistent, searchable memory bank that automatically sync
 
 ## Setup
 
-1. **Clone the Repository**:
-   Clone the `agentMemory` project into your agent's workspace or a parallel directory:
+1. **Review the Repository**:
+   Ask the user to approve network access to the named repository, then clone the
+   pinned revision into a temporary directory, not an active skills path:
 
    ```bash
-   git clone https://github.com/webzler/agentMemory.git .agent/skills/agent-memory
+   review_dir="$(mktemp -d)"
+   git clone --filter=blob:none https://github.com/webzler/agentMemory.git "$review_dir/agent-memory"
+   git -C "$review_dir/agent-memory" checkout --detach 0409b7b7bb6fe443d0d4b6a6b1ee0d4df214f3cd
+   git -C "$review_dir/agent-memory" ls-files
    ```
 
-2. **Install Dependencies**:
+   Read all bundled files and inspect `package.json`, lockfiles, lifecycle
+   scripts, network behavior, credential access, and filesystem scope. Show the
+   findings and exact commit, then wait for explicit user approval.
+
+2. **Install the Reviewed Revision**:
+
+   Copy the reviewed tree to a user-selected location after approval. Install
+   locked dependencies only after the package scripts have been reviewed:
 
    ```bash
-   cd .agent/skills/agent-memory
-   npm install
+   cd <approved-agent-memory-directory>
+   npm ci
    npm run compile
    ```
 
@@ -90,3 +101,4 @@ This skill is applicable to execute the workflow or actions described in the ove
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+- Re-review upstream before changing the pinned revision; a commit pin improves reproducibility but is not a trust guarantee.

package/bundled-skills/agent-orchestration-improve-agent/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-orchestration-improve-agent
 description: "Systematic improvement of existing agents through performance analysis, prompt engineering, and continuous iteration."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/agent-orchestration-multi-agent-optimize/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-orchestration-multi-agent-optimize
 description: "Optimize multi-agent systems with coordinated profiling, workload distribution, and cost-aware orchestration. Use when improving agent performance, throughput, or reliability."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/agent-squad/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-squad
 description: Main agent orchestrator that coordinates a specialized squad of agents
-risk: unknown
+risk: critical
 source: community
 role: Orchestrator / Agent Panel
 phase: all

package/bundled-skills/agent-tool-builder/SKILL.md

@@ -4,7 +4,7 @@ description: Tools are how AI agents interact with the world. A well-designed
   tool is the difference between an agent that works and one that hallucinates,
   fails silently, or costs 10x more tokens than necessary. This skill covers
   tool design from schema to error handling.
-risk: unknown
+risk: critical
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/agents-md/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agents-md
 description: This skill should be used when the user asks to "create AGENTS.md", "update AGENTS.md", "maintain agent docs", "set up CLAUDE.md", or needs to keep agent instructions concise. Enforces research-backed best practices for minimal, high-signal agent documentation.
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/agents-v2-py/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agents-v2-py
 description: "Build container-based Foundry Agents with Azure AI Projects SDK (ImageBasedHostedAgentDefinition). Use when creating hosted agents with custom container images in Azure AI Foundry."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/ai-agents-architect/SKILL.md

@@ -2,7 +2,7 @@
 name: ai-agents-architect
 description: Expert in designing and building autonomous AI agents. Masters tool
   use, memory systems, planning strategies, and multi-agent orchestration.
-risk: unknown
+risk: none
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/ai-analyzer/SKILL.md

@@ -2,7 +2,7 @@
 name: ai-analyzer
 description: AI驱动的综合健康分析系统，整合多维度健康数据、识别异常模式、预测健康风险、提供个性化建议。支持智能问答和AI健康报告生成。
 allowed-tools: Read, Grep, Glob, Write
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/ai-engineer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ai-engineer
 description: Build production-ready LLM applications, advanced RAG systems, and intelligent agents. Implements vector search, multimodal AI, agent orchestration, and enterprise AI integrations.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/ai-engineering-toolkit/SKILL.md

@@ -10,6 +10,20 @@ tags: [prompt-engineering, rag, security, evaluation, ai-engineering, llm]
 tools: [claude, cursor, gemini, copilot]
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 # AI Engineering Toolkit
 
 ## Overview
@@ -43,11 +57,6 @@ Walks through a complete architecture decision tree: document format → parsing
 
 ### Skill 4: Agent Safety Guard
 
-> **⚠️ AUTHORIZED USE ONLY**
-> This skill is for educational purposes or authorized security assessments only.
-> You must have explicit, written permission from the system owner before using this tool.
-> Misuse of this tool is illegal and strictly prohibited.
-
 Executes a 65-point red-team audit across 5 attack categories: direct prompt injection, indirect prompt injection (via RAG documents), information extraction (system prompt / API key leakage), tool abuse (SQL injection, path traversal, command injection), and goal hijacking. The AI constructs adversarial test prompts for evaluation purposes, asks the user for confirmation before each test phase, judges pass/fail, and generates fix recommendations. All tests are contained within the evaluation context and do not interact with external systems. It is recommended to run audits in a sandboxed environment (Docker/VM).
 
 ### Skill 5: Eval Harness Builder

package/bundled-skills/ai-seo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ai-seo
 description: "Optimize content for AI search and LLM citations across AI Overviews, ChatGPT, Perplexity, Claude, Gemini, and similar systems. Use when improving AI visibility, answer engine optimization, or citation readiness."
-risk: unknown
+risk: critical
 source: "https://github.com/coreyhaines31/marketingskills"
 date_added: "2026-03-21"
 metadata:

package/bundled-skills/ai-wrapper-product/SKILL.md

@@ -3,7 +3,7 @@ name: ai-wrapper-product
 description: Expert in building products that wrap AI APIs (OpenAI, Anthropic,
   etc. ) into focused tools people will pay for. Not just "ChatGPT but
   different" - products that solve specific problems with AI.
-risk: unknown
+risk: critical
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/algolia-search/SKILL.md

@@ -2,7 +2,7 @@
 name: algolia-search
 description: Expert patterns for Algolia search implementation, indexing
   strategies, React InstantSearch, and relevance tuning
-risk: unknown
+risk: critical
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/algorithmic-art/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: algorithmic-art
 description: "Algorithmic philosophies are computational aesthetic movements that are then expressed through code. Output .md files (philosophy), .html files (interactive viewer), and .js files (generative algorithms)."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/alpha-vantage/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alpha-vantage
 description: "Access 20+ years of global financial data: equities, options, forex, crypto, commodities, economic indicators, and 50+ technical indicators."
-risk: unknown
+risk: critical
 source: community
 metadata:
     skill-author: K-Dense Inc.

package/bundled-skills/alternatives-pages/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alternatives-pages
 description: 'Create "[Competitor] alternative" and comparison pages for developer tools. Build honest, high-converting comparison content that ranks for competitive search terms. Trigger phrases: "alternatives page", "comparison page", "vs page", "[competitor] alternative", "competitor comparison",...'
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/alternatives-pages
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/analytics/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: analytics
 description: When the user wants to set up, improve, or audit analytics tracking and measurement. Also use when the user mentions "set up tracking," "GA4," "Google Analytics," "conversion tracking," "event tracking," "UTM parameters," "tag manager," "GTM," "analytics implementation," "tracking...
-risk: unknown
+risk: critical
 source: https://github.com/coreyhaines31/marketingskills/tree/main/skills/analytics
 source_repo: coreyhaines31/marketingskills
 source_type: community

package/bundled-skills/analytics-tracking/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: analytics-tracking
 description: Design, audit, and improve analytics tracking systems that produce reliable, decision-ready data.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/analyze-project/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: analyze-project
 description: Forensic root cause analyzer for Antigravity sessions. Classifies scope deltas, rework patterns, root causes, hotspots, and auto-improves prompts/health.
-risk: unknown
+risk: critical
 source: community
 version: "1.0"
 tags: [analysis, diagnostics, meta, root-cause, project-health, session-review]

package/bundled-skills/angular-migration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: angular-migration
 description: "Master AngularJS to Angular migration, including hybrid apps, component conversion, dependency injection changes, and routing migration."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/anti-deception/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: anti-deception
 description: Use BEFORE responding when the user's request shows pressure to validate or agree ("tell them what they want", "make them happy", "convince them"), manufactured urgency (artificial deadline), authority appeals (citing investors, advisors, lawyers, experts), demands to certify without...
-risk: unknown
+risk: critical
 source: https://github.com/ejentum/ejentum-mcp/tree/main/skills/anti-deception
 source_repo: ejentum/ejentum-mcp
 source_type: community

package/bundled-skills/anti-reversing-techniques/SKILL.md

@@ -6,6 +6,20 @@ source: community
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 > **AUTHORIZED USE ONLY**: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis:
 > 1. **Verify authorization**: Confirm you have explicit written permission from the software owner, or are operating within a legitimate security context (CTF, authorized pentest, malware analysis, security research)
 > 2. **Document scope**: Ensure your activities fall within the defined scope of your authorization

package/bundled-skills/antigravity-maintainer-batch-release/SKILL.md

@@ -43,10 +43,12 @@ Before changing anything:
    - Run `npm run validate`, `npm run validate:references`, `npm run security:docs`, changed-skill evidence, and the relevant tests.
    - Treat the entire tracked `skills/<skill-id>/**` subtree as skill content. Inspect semantics, safety, provenance, declared risk, limitations, and every bundled file directly, including nested examples, scripts, lockfiles, references, and assets. Never reduce evidence or review to `SKILL.md` or a fixed support-directory allowlist.
    - Require changed-skill evidence to cover every Git record in each changed canonical skill subtree. Require the `skill-review` workflow for changes under `skills/**` or `plugins/**/skills/**`; its reusable result must be keyed by the complete nearest skill-directory fingerprint on the exact current head SHA.
+   - Keep canonical skill ownership lookup proportional to changed-path depth, not total registry size, and preserve the five-minute trusted evaluator budget so repository-wide evidence completes without weakening fail-closed checks. Parse a legacy executable-mode canonical `SKILL.md` only as private, non-executable snapshot data; keep it reported as unsafe and never materialize symlinks, gitlinks, or other executable files.
    - `review` means Tessl semantic review actually ran or a valid identical-content result was reused.
    - `manual-review-required` means Tessl credentials or credits were unavailable, or Tessl did not produce a passing result. Perform the maintainer semantic review and attest with `--reviewed-head <full-40-character-sha>`.
    - Any non-passing Tessl outcome produces `manual-review-required`; complete the semantic review and bind the judgment to the exact head instead of treating a heuristic score as merge authority.
    - Never report `manual-review-required` as “Tessl passed.”
+   - A verified upstream repository rename may bypass the provenance-identity blocker only through an exact entry in the trusted protected-base exception ledger. Record the skill ID, old and new `source_repo`, stable upstream repository ID, verification date, and canonical GitHub URL; all other provenance changes remain blocked.
 
 3. Run checks in parallel where independent.
    - Use the repository validation, test, docs-security, source-credit, reference, warning-budget, and targeted app checks required by the changed files.

package/bundled-skills/api-analyzer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-analyzer
 description: Validates whether an API request is correct based on provided inputs (method, URL, headers, body, auth, query params). Use this skill whenever a user wants to check, validate, debug, or verify an API call — including when they paste a curl command, show endpoint details, ask "is this...
-risk: unknown
+risk: none
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/api-analyzer
 source_repo: LambdaTest/agent-skills
 source_type: community

package/bundled-skills/api-and-interface-design/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-and-interface-design
 description: Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface. Use when creating REST or GraphQL endpoints, defining type contracts between modules, or establishing boundaries between frontend and backend.
-risk: unknown
+risk: none
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/api-and-interface-design
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/api-designer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-designer
 description: Generates complete, production-ready REST API endpoint specifications for any system or domain the user describes. Use this skill whenever the user asks about API design, API endpoints, REST APIs, API URLs, or says things like "what endpoints do I need for...", "design an API for...",...
-risk: unknown
+risk: safe
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/api-designer
 source_repo: LambdaTest/agent-skills
 source_type: community

package/bundled-skills/api-documentation-generator/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-documentation-generator
 description: "Generate comprehensive, developer-friendly API documentation from code, including endpoints, parameters, examples, and best practices"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/api-documenter/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-documenter
 description: Master API documentation with OpenAPI 3.1, AI-powered tools, and modern developer experience practices. Create interactive docs, generate SDKs, and build comprehensive developer portals.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/api-fuzzing-bug-bounty/SKILL.md

@@ -7,6 +7,20 @@ author: zebbern
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 > AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
 
 # API Fuzzing for Bug Bounty

package/bundled-skills/api-integration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-integration
 description: Designs event-driven architectures, webhook systems, API chaining flows, ETL pipelines, and integration patterns between services. Use whenever the user asks about webhooks, event streaming, API composition, connecting two or more APIs, building pipelines, Pub/Sub, Kafka topics, ETL...
-risk: unknown
+risk: none
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/api-integration-helper
 source_repo: LambdaTest/agent-skills
 source_type: community

package/bundled-skills/api-onboarding/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-onboarding
 description: 'Reduce time-to-first-API-call (TTFAC) by optimizing every step of the developer onboarding journey. This skill covers authentication simplification, sandbox environments, interactive documentation, and identifying and eliminating common failure points. Trigger phrases: "API...'
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/api-onboarding
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/api-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-patterns
 description: "API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination."
-risk: unknown
+risk: none
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/api-sdk-generator/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-sdk-generator
 description: Generates client SDK code, API wrapper libraries, request/response models, and language-specific usage patterns for any REST API. Use whenever the user asks to "generate an SDK", "write a client library", "create API wrappers", "generate TypeScript types from my API", "write a Python...
-risk: unknown
+risk: critical
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/api-sdk-generator
 source_repo: LambdaTest/agent-skills
 source_type: community

package/bundled-skills/api-security-best-practices/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-security-best-practices
 description: "Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/api-testing-observability-api-mock/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: api-testing-observability-api-mock
 description: "You are an API mocking expert specializing in realistic mock services for development, testing, and demos. Design mocks that simulate real API behavior and enable parallel development."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/apify-actor-development/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: apify-actor-development
 description: "Important: Before you begin, fill in the generatedBy property in the meta section of .actor/actor.json. Replace it with the tool and model you're currently using, such as \"Claude Code with Claude Sonnet 4.5\". This helps Apify monitor and improve AGENTS.md for specific AI tools and models."
-risk: unknown
+risk: critical
 source: community
 ---