opencode-skills-collection 4.0.14 → 4.0.16

package/bundled-skills/docs-architect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docs-architect
 description: Creates comprehensive technical documentation from existing codebases. Analyzes architecture, design patterns, and implementation details to produce long-form technical manuals and ebooks.
-risk: unknown
+risk: safe
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/docs-as-marketing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docs-as-marketing
 description: Transform documentation into a powerful marketing channel that attracts, converts, and retains developers. This skill covers creating documentation that ranks in search, converts visitors into users, and accelerates adoption through exceptional information architecture and...
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/docs-as-marketing
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/documentation-and-adrs/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: documentation-and-adrs
 description: Records decisions and documentation. Use when making architectural decisions, changing public APIs, shipping features, or when you need to record context that future engineers and agents will need to understand the codebase.
-risk: unknown
+risk: critical
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/documentation-and-adrs
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/docusign-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docusign-automation
 description: "Automate DocuSign tasks via Rube MCP (Composio): templates, envelopes, signatures, document management. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/docx-official/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docx-official
 description: "A user may ask you to create, edit, or analyze the contents of a .docx file. A .docx file is essentially a ZIP archive containing XML files and other resources that you can read or edit. You have different tools and workflows available for different tasks."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/dotnet-architect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dotnet-architect
 description: Expert .NET backend architect specializing in C#, ASP.NET Core, Entity Framework, Dapper, and enterprise application patterns.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/doubt-driven-development/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: doubt-driven-development
 description: Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident...
-risk: unknown
+risk: critical
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/doubt-driven-development
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/dwarf-expert/SKILL.md

@@ -7,7 +7,7 @@ allowed-tools:
   - Grep
   - Glob
   - WebSearch
-risk: unknown
+risk: critical
 source: community
 ---
 # Overview

package/bundled-skills/dx-optimizer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dx-optimizer
 description: Developer Experience specialist. Improves tooling, setup, and workflows. Use PROACTIVELY when setting up new projects, after team feedback, or when development friction is noticed.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/eas-update-insights/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: eas-update-insights
 description: "Check the health of published EAS Updates: crash rates, install/launch counts, unique users, payload size, and the split between embedded and OTA users per channel. Use when the user asks how an update is performing, whether a rollout is healthy, how many users are on the embedded..."
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/eas-update-insights
 source_repo: expo/skills
 source_type: official

package/bundled-skills/elixir-pro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: elixir-pro
 description: Write idiomatic Elixir code with OTP patterns, supervision trees, and Phoenix LiveView. Masters concurrency, fault tolerance, and distributed systems.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/email-sequence/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: email-sequence
 description: "You are an expert in email marketing and automation. Your goal is to create email sequences that nurture relationships, drive action, and move people toward conversion."
-risk: unknown
+risk: none
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/embedding-strategies/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: embedding-strategies
 description: "Guide to selecting and optimizing embedding models for vector search applications."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/emergency-card/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: emergency-card
 description: 生成紧急情况下快速访问的医疗信息摘要卡片。当用户需要旅行、就诊准备、紧急情况或询问"紧急信息"、"医疗卡片"、"急救信息"时使用此技能。提取关键信息（过敏、用药、急症、植入物），支持多格式输出（JSON、文本、二维码），用于急救或快速就医。
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/enhance-prompt/SKILL.md

@@ -4,7 +4,7 @@ description: Transforms vague UI ideas into polished, Stitch-optimized prompts.
 allowed-tools:
   - "Read"
   - "Write"
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/environment-setup-guide/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: environment-setup-guide
 description: "Guide developers through setting up development environments with proper tools, dependencies, and configurations"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/error-debugging-multi-agent-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-debugging-multi-agent-review
 description: "Use when working with error debugging multi agent review"
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/error-diagnostics-smart-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-diagnostics-smart-debug
 description: "Use when working with error diagnostics smart debug"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/ethical-hacking-methodology/SKILL.md

@@ -7,6 +7,20 @@ author: zebbern
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 > AUTHORIZED USE ONLY: Use this skill only for authorized penetration testing engagements, defensive validation, or controlled educational environments.
 
 # Ethical Hacking Methodology

package/bundled-skills/event-sourcing-architect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: event-sourcing-architect
 description: "Expert in event sourcing, CQRS, and event-driven architecture patterns. Masters event store design, projection building, saga orchestration, and eventual consistency patterns. Use PROACTIVELY for event-sourced systems, audit trail requirements, or complex domain modeling with temporal queries."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/event-store-design/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: event-store-design
 description: "Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/exa-search/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: exa-search
 description: "Semantic search, similar content discovery, and structured research using Exa API. Use when you need semantic/embeddings-based search, finding similar content, or searching by category (company, people, research papers, etc.)."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/executing-plans/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: executing-plans
 description: "Use when you have a written implementation plan to execute in a separate session with review checkpoints"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/expo-api-routes/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-api-routes
 description: Guidelines for creating API routes in Expo Router with EAS Hosting
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-api-routes
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-brownfield/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-brownfield
 description: Integrate Expo and React Native into an existing native iOS or Android app. Use when the user mentions brownfield, embedding React Native in a native app, AAR/XCFramework, or adding Expo to an existing Kotlin/Swift project. Covers both the isolated approach and the integrated approach.
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-brownfield
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-cicd-workflows/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-cicd-workflows
 description: Helps understand and write EAS workflow YAML files for Expo projects. Use this skill when the user asks about CI/CD or workflows in an Expo or EAS context, mentions .eas/workflows/, or wants help with EAS build pipelines or deployment automation.
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-cicd-workflows
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-deployment/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-deployment
 description: Deploy Expo apps to production with EAS — build and submit to the iOS App Store, Google Play Store, and TestFlight, configure eas.json build and submit profiles, manage app versions and build numbers, publish App Store metadata and ASO, and deploy web bundles and API routes via EAS...
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-deployment
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-dev-client/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-dev-client
 description: Build Expo app for development
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-dev-client
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-examples/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-examples
 description: Expo's official example projects — the expo/examples repo of ~70 `with-*` integrations (Stripe, Clerk, Supabase, OpenAI, maps, Reanimated, SQLite, Skia, NativeWind, and more). Use when integrating a third-party library or service into an existing Expo app and you want the canonical,...
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-examples
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-module/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-module
 description: Guide for creating and writing Expo native modules and views using the Expo Modules API (Swift, Kotlin, TypeScript). Covers module definition DSL, native views, shared objects, config plugins, lifecycle hooks, autolinking, and type system. Use when building or modifying native modules...
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-module
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-observe/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-observe
 description: Use for anything related to EAS Observe — adding `expo-observe` to an Expo project (AppMetricsRoot/ObserveRoot HOC, markInteractive, the useObserve hook, and the Expo Router / React Navigation integrations for per-route metrics), querying via the EAS CLI (`eas observe:metrics-summary`,...
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-observe
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-tailwind-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-tailwind-setup
 description: Set up Tailwind CSS v4 in Expo with react-native-css and NativeWind v5 for universal styling
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-tailwind-setup
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-ui/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-ui
 description: "Build native UI with the @expo/ui package: real SwiftUI on iOS and Jetpack Compose on Android rendered from React in an Expo or React Native app. Covers universal cross-platform components (Host, Column, Row, Button, Text, List, and more imported from @expo/ui), drop-in replacements..."
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-ui
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-ui-jetpack-compose/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-ui-jetpack-compose
 description: expo-ui-jetpack-compose
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/expo-ui-swift-ui/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-ui-swift-ui
 description: expo-ui-swift-ui
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/faf-context/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: faf-context
 description: Get your project to 100% ✪ AI-readiness, fast — the AI auto-detects your stack and only asks for what it can't know (your goal and the human "why"). Least typing, maximum context. For time-conscious builders; feeds into faf-expert for depth.
-risk: unknown
+risk: critical
 source: https://github.com/Wolfe-Jam/faf-skills/tree/main/skills/faf-context
 source_repo: Wolfe-Jam/faf-skills
 source_type: community

package/bundled-skills/faf-go/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: faf-go
 description: Guided interview to Gold Code (100% AI-Readiness). Use when helping users improve their .faf file through questions. Leverages Claude Code's AskUserQuestion for seamless integration. Just type /faf-go and answer questions till done.
-risk: unknown
+risk: critical
 source: https://github.com/Wolfe-Jam/faf-skills/tree/main/skills/faf-go
 source_repo: Wolfe-Jam/faf-skills
 source_type: community

package/bundled-skills/family-health-analyzer/SKILL.md

@@ -2,7 +2,7 @@
 name: family-health-analyzer
 description: 分析家族病史、评估遗传风险、识别家庭健康模式、提供个性化预防建议
 allowed-tools: Read, Write, Grep, Glob
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/fastapi-pro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fastapi-pro
 description: Build high-performance async APIs with FastAPI, SQLAlchemy 2.0, and Pydantic V2. Master microservices, WebSockets, and modern Python async patterns.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/fastapi-router-py/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fastapi-router-py
 description: "Create FastAPI routers following established patterns with proper authentication, response models, and HTTP status codes."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/fastapi-templates/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fastapi-templates
 description: "Create production-ready FastAPI projects with async patterns, dependency injection, and comprehensive error handling. Use when building new FastAPI applications or setting up backend API projects."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/favicon/SKILL.md

@@ -4,7 +4,7 @@ argument-hint: [path to source image]
 description: Generate favicons from a source image
 allowed-tools: Bash(magick *), Bash(which *), Bash(cp *), Bash(mkdir *)
 context: fork
-risk: unknown
+risk: critical
 source: community
 metadata:
   author: Shpigford

package/bundled-skills/fda-medtech-compliance-auditor/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fda-medtech-compliance-auditor
 description: "Expert AI auditor for Medical Device (SaMD) compliance, IEC 62304, and 21 CFR Part 820. Reviews DHFs, technical files, and software validation."
-risk: unknown
+risk: none
 source: community
 ---
 

package/bundled-skills/ffuf-web-fuzzing/SKILL.md

@@ -1,10 +1,24 @@
 ---
 name: ffuf-web-fuzzing
 description: Expert guidance for ffuf web fuzzing during penetration testing, including authenticated fuzzing with raw requests, auto-calibration, and result analysis
-risk: unknown
+risk: offensive
 source: community
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 # FFUF (Fuzz Faster U Fool) Skill
 
 ## When to Use

package/bundled-skills/file-organizer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: file-organizer
 description: "6. Reduces Clutter: Identifies old files you probably don't need anymore"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/file-path-traversal/SKILL.md

@@ -6,8 +6,15 @@ source: community
 author: zebbern
 date_added: "2026-02-27"
 ---
-
-> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, ask for the exact target URL, IP, account, or resource and confirmation of written authorization and permitted scope.
+> Show the exact command(s), explain their expected effect, and wait for explicit confirmation in the current conversation.
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
 
 # File Path Traversal Testing
 

package/bundled-skills/filesystem-context/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: filesystem-context
 description: Use for file-based context management, dynamic context discovery, and reducing context window bloat. Offload context to files for just-in-time loading.
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/find-bugs/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: find-bugs
 description: Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/find-complementary-founders/SKILL.md

@@ -254,7 +254,7 @@ owner's approved profile:
 ```bash
 python3 scripts/moltbook_publish.py draft-profile-reply \
   --profile owner-profile.public.json \
-  --profile-url https://github.com/OWNER/REPO/blob/main/owner-profile.public.json \
+  --profile-url https://github.com/OWNER/REPO/blob/FULL_40_CHARACTER_COMMIT_SHA/owner-profile.public.json \
   --output owner-profile-reply.draft.json
 ```
 

package/bundled-skills/find-complementary-founders/references/profile-schema.md

@@ -86,7 +86,7 @@ owner. Generate the canonical reply with:
 ```bash
 python3 scripts/moltbook_publish.py draft-profile-reply \
   --profile owner-profile.public.json \
-  --profile-url https://github.com/OWNER/REPO/blob/main/owner-profile.public.json
+  --profile-url https://github.com/OWNER/REPO/blob/FULL_40_CHARACTER_COMMIT_SHA/owner-profile.public.json
 ```
 
 The reply begins with `FINDMATE_OWNER_PROFILE_V1` and explicitly states that

package/bundled-skills/find-complementary-founders/scripts/github_thread.py

@@ -13,7 +13,6 @@ import re
 import sys
 from pathlib import Path
 from urllib.error import HTTPError, URLError
-from urllib.parse import urlparse
 from urllib.request import Request, urlopen
 
 REPOSITORY = "merc1305/findMate"
@@ -85,7 +84,10 @@ def approval_hash(operation: str, payload: dict) -> str:
 
 
 def render_inline_profile_reply(profile: dict) -> str:
-    placeholder_url = "https://github.com/merc1305/findMate/issues/2"
+    placeholder_url = (
+        "https://github.com/merc1305/findMate/blob/"
+        f"{'0' * 40}/inline-profile.json"
+    )
     try:
         body = PUBLISHER.render_profile_reply(profile, placeholder_url)
     except PUBLISHER.PublishError as exc:
@@ -229,15 +231,9 @@ def safe_profile_url(body: str) -> str | None:
     matches = PROFILE_URL_PATTERN.findall(body)
     if len(matches) != 1:
         return None
-    url = matches[0]
-    parsed = urlparse(url)
-    if (
-        parsed.scheme != "https"
-        or not parsed.hostname
-        or parsed.username
-        or parsed.query
-        or parsed.fragment
-    ):
+    try:
+        url = PUBLISHER.immutable_github_profile_url(matches[0])
+    except PUBLISHER.PublishError:
         return None
     return url