opencode-skills-collection 4.0.15 → 4.0.16

package/bundled-skills/n8n-expression-syntax/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: n8n-expression-syntax
 description: Validate n8n expression syntax and fix common errors. Use when writing n8n expressions, using {{}} syntax, accessing $json/$node variables, troubleshooting expression errors, or working with webhook data in workflows.
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/n8n-mcp-tools-expert/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: n8n-mcp-tools-expert
 description: Expert guide for using n8n-mcp MCP tools effectively. Use when searching for nodes, validating configurations, accessing templates, managing workflows, or using any n8n-mcp tool. Provides tool selection guidance, parameter formats, and common patterns.
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/n8n-node-configuration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: n8n-node-configuration
 description: Operation-aware node configuration guidance. Use when configuring nodes, understanding property dependencies, determining required fields, choosing between get_node detail levels, or learning common configuration patterns by node type.
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/n8n-subworkflows/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: n8n-subworkflows
 description: Build reusable n8n sub-workflows with typed inputs, all-vs-each execution, discoverable naming, and agent-tool exposure.
-risk: unknown
+risk: critical
 source: https://github.com/czlonkowski/n8n-skills/tree/main/skills/n8n-subworkflows
 source_repo: czlonkowski/n8n-skills
 source_type: community

package/bundled-skills/n8n-validation-expert/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: n8n-validation-expert
 description: "Expert guide for interpreting and fixing n8n validation errors."
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/n8n-workflow-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: n8n-workflow-patterns
 description: "Proven architectural patterns for building n8n workflows."
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/native-data-fetching/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: native-data-fetching
 description: Use when implementing or debugging ANY network request, API call, or data fetching. Covers fetch API, React Query, SWR, error handling, caching, offline support, and Expo Router data loaders (`useLoaderData`).
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/native-data-fetching
 source_repo: expo/skills
 source_type: official

package/bundled-skills/neon-ai-gateway/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: neon-ai-gateway
 description: One API and one credential for frontier and open-source LLMs, built into your Neon branch and powered by Databricks. Use when a user wants to call an LLM, add AI/chat/an agent to their app, route between model providers (OpenAI, Anthropic, Google/Gemini, Meta, Alibaba, DeepSeek), or...
-risk: unknown
+risk: critical
 source: https://github.com/neondatabase/agent-skills/tree/main/skills/neon-ai-gateway
 source_repo: neondatabase/agent-skills
 source_type: official

package/bundled-skills/neon-functions/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: neon-functions
 description: Long-running, serverless Node.js HTTP functions deployed onto your Neon branch, with DATABASE_URL injected automatically and compute that runs next to your data. Use when a user wants to host an API, an AI agent with long streaming responses, a WebSocket or server-sent-events (SSE)...
-risk: unknown
+risk: critical
 source: https://github.com/neondatabase/agent-skills/tree/main/skills/neon-functions
 source_repo: neondatabase/agent-skills
 source_type: official

package/bundled-skills/neon-object-storage/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: neon-object-storage
 description: S3-compatible object storage that branches with your Neon project, so files and the database stay in sync across every branch. Use when a user wants object storage, a bucket, blob/file storage, or somewhere to put uploads, images, documents, avatars, or user-generated files for their...
-risk: unknown
+risk: critical
 source: https://github.com/neondatabase/agent-skills/tree/main/skills/neon-object-storage
 source_repo: neondatabase/agent-skills
 source_type: official

package/bundled-skills/neon-postgres/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: neon-postgres
 description: Guides and best practices for working with Neon Serverless Postgres. Covers setup, connection methods, branching, autoscaling, scale-to-zero, read replicas, connection pooling, Neon Auth, and the Neon CLI, MCP server, REST API, TypeScript SDK, and Python SDK. Use when users ask about...
-risk: unknown
+risk: critical
 source: https://github.com/neondatabase/agent-skills/tree/main/skills/neon-postgres
 source_repo: neondatabase/agent-skills
 source_type: official

package/bundled-skills/neon-postgres-branches/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: neon-postgres-branches
 description: Choose and create the right Neon branch type for testing and development. Use when users ask about Neon branching, migration testing with real data, isolated test environments, schema-only branch workflows for sensitive data, or branch creation via Neon CLI or Neon MCP. Triggers...
-risk: unknown
+risk: critical
 source: https://github.com/neondatabase/agent-skills/tree/main/skills/neon-postgres-branches
 source_repo: neondatabase/agent-skills
 source_type: official

package/bundled-skills/neon-postgres-egress-optimizer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: neon-postgres-egress-optimizer
 description: Diagnose and fix excessive Postgres egress (network data transfer) in a codebase. Use when a user mentions high database bills, unexpected data transfer costs, network transfer charges, egress spikes, "why is my Neon bill so high", "database costs jumped", SELECT * optimization, query...
-risk: unknown
+risk: critical
 source: https://github.com/neondatabase/agent-skills/tree/main/skills/neon-postgres-egress-optimizer
 source_repo: neondatabase/agent-skills
 source_type: official

package/bundled-skills/nestjs-expert/SKILL.md

@@ -2,7 +2,7 @@
 name: nestjs-expert
 description: "You are an expert in Nest.js with deep knowledge of enterprise-grade Node.js application architecture, dependency injection patterns, decorators, middleware, guards, interceptors, pipes, testing strategies, database integration, and authentication systems."
 category: framework
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/network-101/SKILL.md

@@ -1,12 +1,26 @@
 ---
 name: network-101
 description: "Configure and test common network services (HTTP, HTTPS, SNMP, SMB) for penetration testing lab environments. Enable hands-on practice with service enumeration, log analysis, and security testing against properly configured target systems."
-risk: unknown
+risk: offensive
 source: community
 author: zebbern
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 # Network 101
 
 ## Purpose

package/bundled-skills/networkx/SKILL.md

@@ -4,7 +4,7 @@ description: "NetworkX is a Python package for creating, manipulating, and analy
 license: 3-clause BSD license
 metadata:
     skill-author: K-Dense Inc.
-risk: unknown
+risk: critical
 source: "https://github.com/networkx/networkx"
 ---
 

package/bundled-skills/new-rails-project/SKILL.md

@@ -4,7 +4,7 @@ argument-hint: [project name]
 description: Create a new Rails project
 allowed-tools: Bash(rails *), Bash(bundle *), Bash(bin/*), Bash(npm *), Bash(yarn *)
 context: fork
-risk: unknown
+risk: critical
 source: community
 metadata:
   author: Shpigford

package/bundled-skills/newman-cicd-integration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: newman-cicd-integration
 description: Generate ready-to-use CI/CD pipeline configurations that install and run Newman for automated API testing. Use this skill whenever the user wants to run Newman in a CI pipeline, integrate Postman collections into automated builds, set up API tests in GitHub Actions, GitLab CI, Jenkins,...
-risk: unknown
+risk: critical
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/newman/newman-cicd-helper
 source_repo: LambdaTest/agent-skills
 source_type: community

package/bundled-skills/nextjs-best-practices/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: nextjs-best-practices
 description: "Next.js App Router principles. Server Components, data fetching, routing patterns."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/nft-standards/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: nft-standards
 description: "Master ERC-721 and ERC-1155 NFT standards, metadata best practices, and advanced NFT features."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/nodejs-best-practices/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: nodejs-best-practices
 description: "Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/nosql-expert/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: nosql-expert
 description: "Expert guidance for distributed NoSQL databases (Cassandra, DynamoDB). Focuses on mental models, query-first modeling, single-table design, and avoiding hot partitions in high-scale systems."
-risk: unknown
+risk: none
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/notebooklm/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: notebooklm
 description: "Interact with Google NotebookLM to query documentation with Gemini's source-grounded answers. Each question opens a fresh browser session, retrieves the answer exclusively from your uploaded documents, and closes."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/notion-template-business/SKILL.md

@@ -4,7 +4,7 @@ description: Expert in building and selling Notion templates as a business - not
   just making templates, but building a sustainable digital product business.
   Covers template design, pricing, marketplaces, marketing, and scaling to real
   revenue.
-risk: unknown
+risk: critical
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/nutrition-analyzer/SKILL.md

@@ -2,7 +2,7 @@
 name: nutrition-analyzer
 description: 分析营养数据、识别营养模式、评估营养状况，并提供个性化营养建议。支持与运动、睡眠、慢性病数据的关联分析。
 allowed-tools: Read, Grep, Glob, Write
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/nx-workspace-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: nx-workspace-patterns
 description: "Configure and optimize Nx monorepo workspaces. Use when setting up Nx, configuring project boundaries, optimizing build caching, or implementing affected commands."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/observability-and-instrumentation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: observability-and-instrumentation
 description: Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting. Use when shipping any feature that runs in production and you need evidence it works. Use when production issues are reported but you can't tell what happened...
-risk: unknown
+risk: critical
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/observability-and-instrumentation
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/observability-engineer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: observability-engineer
 description: Build production-ready monitoring, logging, and tracing systems. Implements comprehensive observability strategies, SLI/SLO management, and incident response workflows.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/observability-monitoring-monitor-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: observability-monitoring-monitor-setup
 description: "You are a monitoring and observability expert specializing in implementing comprehensive monitoring solutions. Set up metrics collection, distributed tracing, log aggregation, and create insightful da"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/observability-monitoring-slo-implement/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: observability-monitoring-slo-implement
 description: "You are an SLO (Service Level Objective) expert specializing in implementing reliability standards and error budget-based engineering practices. Design comprehensive SLO frameworks, establish meaningful SLIs, and create monitoring systems that balance reliability with feature velocity."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/obsidian-bases/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: obsidian-bases
 description: Create and edit Obsidian Bases (.base files) with views, filters, formulas, and summaries. Use when working with .base files, creating database-like views of notes, or when the user mentions Bases, table views, card views, filters, or formulas in Obsidian.
-risk: unknown
+risk: critical
 source: "https://github.com/kepano/obsidian-skills"
 date_added: "2026-03-21"
 ---

package/bundled-skills/obsidian-cli/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: obsidian-cli
 description: "Use the Obsidian CLI to read, create, search, and manage vault content, or to develop and debug Obsidian plugins and themes from the command line."
-risk: unknown
+risk: critical
 source: "https://github.com/kepano/obsidian-skills"
 date_added: "2026-03-21"
 ---

package/bundled-skills/obsidian-markdown/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: obsidian-markdown
 description: Create and edit Obsidian Flavored Markdown with wikilinks, embeds, callouts, properties, and other Obsidian-specific syntax. Use when working with .md files in Obsidian, or when the user mentions wikilinks, callouts, frontmatter, tags, embeds, or Obsidian notes.
-risk: unknown
+risk: critical
 source: "https://github.com/kepano/obsidian-skills"
 date_added: "2026-03-21"
 ---

package/bundled-skills/occupational-health-analyzer/SKILL.md

@@ -2,7 +2,7 @@
 name: occupational-health-analyzer
 description: 分析职业健康数据、识别工作相关健康风险、评估职业健康状况、提供个性化职业健康建议。支持与睡眠、运动、心理健康等其他健康数据的关联分析。
 allowed-tools: Read, Grep, Glob, Write, Edit
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/odoo-edi-connector/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: odoo-edi-connector
 description: "Guide for implementing EDI (Electronic Data Interchange) with Odoo: X12, EDIFACT document mapping, partner onboarding, and automated order processing."
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/odoo-l10n-compliance/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: odoo-l10n-compliance
 description: "Country-specific Odoo localization: tax configuration, e-invoicing (CFDI, FatturaPA, SAF-T), fiscal reporting, and country chart of accounts setup."
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/odoo-shopify-integration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: odoo-shopify-integration
 description: "Connect Odoo with Shopify: sync products, inventory, orders, and customers using the Shopify API and Odoo's external API or connector modules."
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/odoo-woocommerce-bridge/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: odoo-woocommerce-bridge
 description: "Sync Odoo with WooCommerce: products, inventory, orders, and customers via WooCommerce REST API and Odoo external API."
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/odw/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: odw
 description: Dynamic multi-agent workflows — plan first, then orchestrate parallel agents with adversarial verification via the local odw daemon. Use when the user asks for a "workflow", says "ultracode", or hands you a task spanning many files/items that benefits from parallel agents.
-risk: unknown
+risk: critical
 source: https://github.com/Suraj1235/open-dynamic-workflows/tree/main/packages/antigravity-adapter/skills/odw
 source_repo: Suraj1235/open-dynamic-workflows
 source_type: community

package/bundled-skills/offers/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: offers
 description: When the user wants to design, construct, or improve an offer — the thing they actually sell — including value framing, bonus stacking, guarantee design, scarcity/urgency, naming, and payment structure. Also use when the user mentions 'offer,' 'offer design,' 'build an offer,' 'grand...
-risk: unknown
+risk: safe
 source: https://github.com/coreyhaines31/marketingskills/tree/main/skills/offers
 source_repo: coreyhaines31/marketingskills
 source_type: community

package/bundled-skills/on-call-handoff-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: on-call-handoff-patterns
 description: "Effective patterns for on-call shift transitions, ensuring continuity, context transfer, and reliable incident response across shifts."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/onboarding/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: onboarding
 description: When the user wants to optimize post-signup onboarding, user activation, first-run experience, or time-to-value. Also use when the user mentions "onboarding flow," "activation rate," "user activation," "first-run experience," "empty states," "onboarding checklist," "aha moment," "new...
-risk: unknown
+risk: safe
 source: https://github.com/coreyhaines31/marketingskills/tree/main/skills/onboarding
 source_repo: coreyhaines31/marketingskills
 source_type: community

package/bundled-skills/onboarding-cro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: onboarding-cro
 description: "You are an expert in user onboarding and activation. Your goal is to help users reach their \"aha moment\" as quickly as possible and establish habits that lead to long-term retention."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/open-source-marketing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: open-source-marketing
 description: When the user wants to market an open source project authentically. Trigger phrases include "open source marketing," "OSS marketing," "GitHub marketing," "promote my library," "grow stars," "launch open source," "open source growth," or "contributor marketing."
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/open-source-marketing
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/openapi-spec-generator/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: openapi-spec-generator
 description: Generate complete, production-ready OpenAPI 3.x and Swagger 2.0 specifications from natural language descriptions, code, or partial specs. Use this skill whenever the user mentions OpenAPI, Swagger, API spec, REST API documentation, YAML/JSON API schema, endpoint documentation, API...
-risk: unknown
+risk: critical
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/openapi-spec-generator
 source_repo: LambdaTest/agent-skills
 source_type: community

package/bundled-skills/outlook-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: outlook-automation
 description: "Automate Outlook tasks via Rube MCP (Composio): emails, calendar, contacts, folders, attachments. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/page-cro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: page-cro
 description: Analyze and optimize individual pages for conversion performance.
-risk: unknown
+risk: none
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/paid-ads/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: paid-ads
 description: "You are an expert performance marketer with direct access to ad platform accounts. Your goal is to help create, optimize, and scale paid advertising campaigns that drive efficient customer acquisition."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/parallel-agents/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: parallel-agents
 description: "Multi-agent orchestration patterns. Use when multiple independent tasks can run with different domain expertise or when comprehensive analysis requires multiple perspectives."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/payment-integration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: payment-integration
 description: Integrate Stripe, PayPal, and payment processors. Handles checkout flows, subscriptions, webhooks, and PCI compliance. Use PROACTIVELY when implementing payments, billing, or subscription features.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/paypal-integration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: paypal-integration
 description: "Master PayPal payment integration including Express Checkout, IPN handling, recurring billing, and refund workflows."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/paywall-upgrade-cro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: paywall-upgrade-cro
 description: "You are an expert in in-app paywalls and upgrade flows. Your goal is to convert free users to paid, or upgrade users to higher tiers, at moments when they've experienced enough value to justify the commitment."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/pci-compliance/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pci-compliance
 description: "Master PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/pdf-official/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pdf-official
 description: "This guide covers essential PDF processing operations using Python libraries and command-line tools. For advanced features, JavaScript libraries, and detailed examples, see reference.md. If you need to fill out a PDF form, read forms.md and follow its instructions."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/pentest-checklist/SKILL.md

@@ -7,6 +7,20 @@ author: zebbern
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 > AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
 
 # Pentest Checklist

package/bundled-skills/pentest-commands/SKILL.md

@@ -7,6 +7,20 @@ author: zebbern
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 > AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
 
 # Pentest Commands

package/bundled-skills/performance-engineer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: performance-engineer
 description: "Expert performance engineer specializing in modern observability,"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---