opencode-skills-collection 4.0.14 → 4.0.16

package/bundled-skills/smtp-penetration-testing/SKILL.md

@@ -7,6 +7,20 @@ author: zebbern
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 > AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
 
 # SMTP Penetration Testing

package/bundled-skills/social-content/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: social-content
 description: "You are an expert social media strategist with direct access to a scheduling platform that publishes to all major social networks. Your goal is to help create engaging content that builds audience, drives engagement, and supports business goals."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/software-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: software-architecture
 description: "Guide for quality focused software architecture. This skill should be used when users want to write code, design architecture, analyze code, in any case that relates to software development."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/source-driven-development/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: source-driven-development
 description: Grounds every implementation decision in official documentation. Use when you want authoritative, source-cited code free from outdated patterns. Use when building with any framework or library where correctness matters.
-risk: unknown
+risk: critical
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/source-driven-development
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/spark-optimization/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: spark-optimization
 description: "Optimize Apache Spark jobs with partitioning, caching, shuffle optimization, and memory tuning. Use when improving Spark performance, debugging slow jobs, or scaling data processing pipelines."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/spec-driven-development/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: spec-driven-development
 description: Creates specs before coding. Use when starting a new project, feature, or significant change and no specification exists yet. Use when requirements are unclear, ambiguous, or only exist as a vague idea.
-risk: unknown
+risk: critical
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/spec-driven-development
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/spec-to-code-compliance/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: spec-to-code-compliance
 description: Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.
-risk: unknown
+risk: safe
 source: community
 ---
 

package/bundled-skills/speckit-updater/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: speckit-updater
 description: SpecKit Safe Update
-risk: unknown
+risk: critical
 source: community
 ---
 
@@ -9,7 +9,10 @@ source: community
 
 This skill provides safe update capabilities for GitHub SpecKit installations, preserving customizations while applying template updates.
 
-**Installation**: Available via plugin (`/plugin marketplace add NotMyself/claude-plugins` then `/plugin install speckit-updater`) or manual Git clone. See README.md for details.
+**Installation**: Before adding any marketplace or manual clone, inspect the
+exact plugin revision and every bundled file, report scripts and network or
+filesystem behavior, and ask for explicit user approval. Do not install a moving
+branch directly into an active agent directory.
 
 ## When to Use
 - You need to update or install SpecKit templates while preserving project customizations.
@@ -22,7 +25,7 @@ When the user invokes `/speckit-updater`, you should:
 
 1. **Run the update orchestrator script** without any flags (conversational mode):
    ```powershell
-   pwsh -NoProfile -Command "& 'C:\Users\bobby\.claude\skills\speckit-updater\scripts\update-wrapper.ps1'"
+   pwsh -NoProfile -File "<skill_path>/scripts/update-wrapper.ps1"
    ```
 
 2. **Parse the output** for markers:
@@ -51,7 +54,7 @@ When the user invokes `/speckit-updater`, you should:
 
 5. **Execute approved action** by re-running with `-Proceed` flag:
    ```powershell
-   pwsh -NoProfile -Command "& 'C:\Users\bobby\.claude\skills\speckit-updater\scripts\update-wrapper.ps1' -Proceed"
+   pwsh -NoProfile -File "<skill_path>/scripts/update-wrapper.ps1" -Proceed
    ```
 
 **Special cases:**

package/bundled-skills/speed/SKILL.md

@@ -2,7 +2,7 @@
 name: speed
 description: Launch RSVP speed reader for text
 trigger: command
-risk: unknown
+risk: critical
 source: community
 tools: Write, Bash, Read
 ---

package/bundled-skills/sql-injection-testing/SKILL.md

@@ -7,6 +7,20 @@ author: zebbern
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 > AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
 
 # SQL Injection Testing

package/bundled-skills/sql-pro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: sql-pro
 description: Master modern SQL with cloud-native databases, OLTP/OLAP optimization, and advanced query techniques. Expert in performance tuning, data modeling, and hybrid analytical systems.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/sqlmap-database-pentesting/SKILL.md

@@ -1,12 +1,26 @@
 ---
 name: sqlmap-database-pentesting
 description: "Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap."
-risk: unknown
+risk: offensive
 source: community
 author: zebbern
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 # SQLMap Database Penetration Testing
 
 ## Purpose

package/bundled-skills/sred-project-organizer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: sred-project-organizer
 description: Take a list of projects and their related documentation, and organize them into the SRED format for submission.
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/sred-work-summary/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: sred-work-summary
 description: Go back through the previous year of work and create a Notion doc that groups relevant links into projects that can then be documented as SRED projects.
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/ssh-penetration-testing/SKILL.md

@@ -6,9 +6,14 @@ source: community
 author: zebbern
 date_added: "2026-02-27"
 ---
-
-> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
-
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+> **Mandatory confirmation gate**
+> Before any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, ask for the exact target URL, IP, account, or resource and confirmation of written authorization and permitted scope.
+> Show the exact command(s), explain their expected effect, and wait for explicit confirmation in the current conversation.
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
 # SSH Penetration Testing
 
 ## Purpose

package/bundled-skills/startup-analyst/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: startup-analyst
 description: Expert startup business analyst specializing in market sizing, financial modeling, competitive analysis, and strategic planning for early-stage companies.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/startup-business-analyst-business-case/SKILL.md

@@ -5,7 +5,7 @@ description: 'Generate comprehensive investor-ready business case document with
   market, solution, financials, and strategy
 
   '
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/startup-business-analyst-financial-projections/SKILL.md

@@ -5,7 +5,7 @@ description: 'Create detailed 3-5 year financial model with revenue, costs, cash
   flow, and scenarios
 
   '
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/startup-business-analyst-market-opportunity/SKILL.md

@@ -5,7 +5,7 @@ description: 'Generate comprehensive market opportunity analysis with TAM/SAM/SO
   calculations
 
   '
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/startup-financial-modeling/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: startup-financial-modeling
 description: "Build comprehensive 3-5 year financial models with revenue projections, cost structures, cash flow analysis, and scenario planning for early-stage startups."
-risk: unknown
+risk: none
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/statsmodels/SKILL.md

@@ -4,7 +4,7 @@ description: "Statsmodels is Python's premier library for statistical modeling,
 license: BSD-3-Clause license
 metadata:
     skill-author: K-Dense Inc.
-risk: unknown
+risk: safe
 source: community
 ---
 

package/bundled-skills/stitch-loop/SKILL.md

@@ -7,7 +7,7 @@ allowed-tools:
   - "Read"
   - "Write"
   - "Bash"
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/stripe-integration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: stripe-integration
 description: "Master Stripe payment processing integration for robust, PCI-compliant payment flows including checkout, subscriptions, webhooks, and refunds."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/styleseed-design-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: styleseed-design-review
 description: Reviews UI/frontend code and tells you exactly why it "looks AI-generated" — then how to fix it. Use it when a React/Tailwind/HTML interface looks off, generic, or unfinished, when you want a design score before shipping, or when asked to make UI look more professional, polished, or...
-risk: unknown
+risk: safe
 source: https://github.com/bitjaru/styleseed/tree/main/skills/styleseed-design-review
 source_repo: bitjaru/styleseed
 source_type: community

package/bundled-skills/subagent-driven-development/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: subagent-driven-development
 description: "Use when executing implementation plans with independent tasks in the current session"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/supabase/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: supabase
 description: "Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout,..."
-risk: unknown
+risk: critical
 source: https://github.com/supabase/agent-skills/tree/main/skills/supabase
 source_repo: supabase/agent-skills
 source_type: official

package/bundled-skills/supabase-postgres-best-practices/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: supabase-postgres-best-practices
 description: Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations.
-risk: unknown
+risk: safe
 source: https://github.com/supabase/agent-skills/tree/main/skills/supabase-postgres-best-practices
 source_repo: supabase/agent-skills
 source_type: official

package/bundled-skills/supply-chain-risk-auditor/SKILL.md

@@ -7,7 +7,7 @@ allowed-tools:
   - Bash
   - Glob
   - Grep
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/swiftui-expert-skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: swiftui-expert-skill
 description: Use when writing, reviewing, or refactoring SwiftUI code for iOS or macOS, including state management and `@Observable` data flow, view composition and invalidation/performance, lists and `ForEach` identity, environment usage, localization, animations, Liquid Glass adoption, migrating...
-risk: unknown
+risk: critical
 source: https://github.com/AvdLee/SwiftUI-Agent-Skill/tree/main/swiftui-expert-skill
 source_repo: AvdLee/SwiftUI-Agent-Skill
 source_type: community

package/bundled-skills/sympy/SKILL.md

@@ -4,7 +4,7 @@ description: "SymPy is a Python library for symbolic mathematics that enables ex
 license: https://github.com/sympy/sympy/blob/master/LICENSE
 metadata:
     skill-author: K-Dense Inc.
-risk: unknown
+risk: safe
 source: "https://github.com/sympy/sympy"
 ---
 

package/bundled-skills/systematic-debugging/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: systematic-debugging
 description: "Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/systems-programming-rust-project/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: systems-programming-rust-project
 description: "You are a Rust project architecture expert specializing in scaffolding production-ready Rust applications. Generate complete project structures with cargo tooling, proper module organization, testing"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/tailwind-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tailwind-patterns
 description: "Tailwind CSS v4 principles. CSS-first configuration, container queries, modern patterns, design token architecture."
-risk: unknown
+risk: none
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/tavily-web/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tavily-web
 description: "Web search, content extraction, crawling, and research capabilities using Tavily API. Use when you need to search the web for current information, extracting content from URLs, or crawling websites."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/tcm-constitution-analyzer/SKILL.md

@@ -2,7 +2,7 @@
 name: tcm-constitution-analyzer
 description: 分析中医体质数据、识别体质类型、评估体质特征,并提供个性化养生建议。支持与营养、运动、睡眠等健康数据的关联分析。
 allowed-tools: Read, Grep, Glob, Write
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/tdd-orchestrator/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tdd-orchestrator
 description: Master TDD orchestrator specializing in red-green-refactor discipline, multi-agent workflow coordination, and comprehensive test-driven development practices.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/tdd-workflow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tdd-workflow
 description: "Test-Driven Development workflow principles. RED-GREEN-REFACTOR cycle."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/tdd-workflows/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tdd-workflows
 description: "Use when working with tdd workflows tdd cycle (Alias for tdd-workflows-tdd-cycle)"
-risk: unknown
+risk: none
 source: "alias"
 date_added: "2026-06-02"
 ---

package/bundled-skills/tdd-workflows-tdd-cycle/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tdd-workflows-tdd-cycle
 description: "Use when working with tdd workflows tdd cycle"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/tdd-workflows-tdd-green/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tdd-workflows-tdd-green
 description: "Implement the minimal code needed to make failing tests pass in the TDD green phase."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/tdd-workflows-tdd-red/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tdd-workflows-tdd-red
 description: "Generate failing tests for the TDD red phase to define expected behavior and edge cases."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/tdd-workflows-tdd-refactor/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tdd-workflows-tdd-refactor
 description: "Use when working with tdd workflows tdd refactor"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/team-composition-analysis/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: team-composition-analysis
 description: "Design optimal team structures, hiring plans, compensation strategies, and equity allocation for early-stage startups from pre-seed through Series A."
-risk: unknown
+risk: none
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/technical-tutorials/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: technical-tutorials
 description: When the user wants to create step-by-step technical tutorials, quickstarts, or code walkthroughs. Trigger phrases include "tutorial," "quickstart," "getting started guide," "walkthrough," "step by step," "how to guide," "hands-on guide," or "code tutorial."
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/technical-tutorials
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/telegram-bot-builder/SKILL.md

@@ -4,7 +4,7 @@ description: Expert in building Telegram bots that solve real problems - from
   simple automation to complex AI-powered bots. Covers bot architecture, the
   Telegram Bot API, user experience, monetization strategies, and scaling bots
   to thousands of users.
-risk: unknown
+risk: critical
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/telegram-mini-app/SKILL.md

@@ -4,7 +4,7 @@ description: Expert in building Telegram Mini Apps (TWA) - web apps that run
   inside Telegram with native-like experience. Covers the TON ecosystem,
   Telegram Web App API, payments, user authentication, and building viral mini
   apps that monetize.
-risk: unknown
+risk: critical
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/temporal-python-pro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: temporal-python-pro
 description: Master Temporal workflow orchestration with Python SDK. Implements durable workflows, saga patterns, and distributed transactions. Covers async/await, testing strategies, and production deployment.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/temporal-python-testing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: temporal-python-testing
 description: "Comprehensive testing approaches for Temporal workflows using pytest, progressive disclosure resources for specific testing scenarios."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/terraform-aws-modules/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: terraform-aws-modules
 description: "Terraform module creation for AWS — reusable modules, state management, and HCL best practices. Use when building or reviewing Terraform AWS infrastructure."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/terraform-module-library/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: terraform-module-library
 description: "Production-ready Terraform module patterns for AWS, Azure, and GCP infrastructure."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/terraform-specialist/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: terraform-specialist
 description: Expert Terraform/OpenTofu specialist mastering advanced IaC automation, state management, and enterprise infrastructure patterns.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/test-automator/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-automator
 description: Master AI-powered test automation with modern frameworks, self-healing tests, and comprehensive quality engineering. Build scalable testing strategies with advanced CI/CD integration.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/test-driven-development/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-driven-development
 description: "Use when implementing any feature or bugfix, before writing implementation code"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/test-framework-migration-skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-framework-migration-skill
 description: Migrates and converts test automation scripts between Selenium, Playwright, Puppeteer, and Cypress. Use when the user asks to migrate, convert, or port tests from one framework to another; rewrite tests in a different framework; or switch from Selenium to Playwright, Playwright to...
-risk: unknown
+risk: critical
 source: https://github.com/LambdaTest/agent-skills/tree/main/test-framework-migration-skill
 source_repo: LambdaTest/agent-skills
 source_type: community