opencode-skills-collection 4.0.15 → 4.0.16

package/bundled-skills/create-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: create-pr
 description: Alias for pr-writer. Use when users explicitly ask for "create-pr" or reference the legacy skill name. Redirects to the canonical PR writing workflow.
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/crewai/SKILL.md

@@ -2,7 +2,7 @@
 name: crewai
 description: Expert in CrewAI - the leading role-based multi-agent framework
   used by 60% of Fortune 500 companies.
-risk: unknown
+risk: critical
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/cro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cro
 description: When the user wants to optimize, improve, or increase conversions on any marketing page or form — including homepage, landing pages, pricing pages, feature pages, lead capture forms, or contact forms. Also use when the user says 'CRO,' 'conversion rate optimization,' 'this page isn't...
-risk: unknown
+risk: safe
 source: https://github.com/coreyhaines31/marketingskills/tree/main/skills/cro
 source_repo: coreyhaines31/marketingskills
 source_type: community

package/bundled-skills/csharp-pro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: csharp-pro
 description: Write modern C# code with advanced features like records, pattern matching, and async/await. Optimizes .NET applications, implements enterprise patterns, and ensures comprehensive testing.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/cucumber-skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cucumber-skill
 description: 'Generates Cucumber BDD tests with Gherkin feature files and step definitions in Java, JavaScript, or Ruby. Use when user mentions "Cucumber", "Gherkin", "Feature/Scenario", "Given/When/Then", "BDD". Triggers on: "Cucumber", "Gherkin", "BDD", "Feature file", "Given/When/Then", "step...'
-risk: unknown
+risk: critical
 source: https://github.com/LambdaTest/agent-skills/tree/main/cucumber-skill
 source_repo: LambdaTest/agent-skills
 source_type: community

package/bundled-skills/customer-research/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: customer-research
 description: When the user wants to conduct, analyze, or synthesize customer research. Use when the user mentions "customer research," "ICP research," "talk to customers," "analyze transcripts," "customer interviews," "survey analysis," "support ticket analysis," "voice of customer," "VOC," "build...
-risk: unknown
+risk: critical
 source: https://github.com/coreyhaines31/marketingskills/tree/main/skills/customer-research
 source_repo: coreyhaines31/marketingskills
 source_type: community

package/bundled-skills/customer-support/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: customer-support
 description: Elite AI-powered customer support specialist mastering conversational AI, automated ticketing, sentiment analysis, and omnichannel support experiences.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/cypress-skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cypress-skill
 description: Generates production-grade Cypress E2E and component tests in JavaScript or TypeScript. Supports local execution and TestMu AI cloud. Use when the user asks to write Cypress tests, set up Cypress, test with cy commands, or mentions "Cypress", "cy.visit", "cy.get", "cy.intercept"....
-risk: unknown
+risk: critical
 source: https://github.com/LambdaTest/agent-skills/tree/main/cypress-skill
 source_repo: LambdaTest/agent-skills
 source_type: community

package/bundled-skills/daily-gift/SKILL.md

@@ -2,7 +2,7 @@
 name: daily-gift
 description: "Relationship-aware daily gift engine with five-stage creative pipeline — editorial judgment, synthesis, concept generation, visual strategy, and rendering in H5, image, or video"
 category: productivity
-risk: unknown
+risk: critical
 source: community
 source_repo: openclaw/skills
 source_type: community

package/bundled-skills/daily-news-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: daily-news-report
 description: "Scrapes content based on a preset URL list, filters high-quality technical information, and generates daily Markdown reports."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/data-engineer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-engineer
 description: Build scalable data pipelines, modern data warehouses, and real-time streaming architectures. Implements Apache Spark, dbt, Airflow, and cloud-native data platforms.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/data-engineering-data-driven-feature/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-engineering-data-driven-feature
 description: "Build features guided by data insights, A/B testing, and continuous measurement using specialized agents for analysis, implementation, and experimentation."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/data-engineering-data-pipeline/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-engineering-data-pipeline
 description: "You are a data pipeline architecture expert specializing in scalable, reliable, and cost-effective data pipelines for batch and streaming data processing."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/data-quality-frameworks/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-quality-frameworks
 description: "Implement data quality validation with Great Expectations, dbt tests, and data contracts. Use when building data quality pipelines, implementing validation rules, or establishing data contracts."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/data-scientist/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-scientist
 description: Expert data scientist for advanced analytics, machine learning, and statistical modeling. Handles complex data analysis, predictive modeling, and business intelligence.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/database-admin/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: database-admin
 description: Expert database administrator specializing in modern cloud databases, automation, and reliability engineering.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/database-architect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: database-architect
 description: Expert database architect specializing in data layer design from scratch, technology selection, schema modeling, and scalable database architectures.
-risk: unknown
+risk: none
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/database-migration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: database-migration
 description: "Master database schema and data migrations across ORMs (Sequelize, TypeORM, Prisma), including rollback strategies and zero-downtime deployments."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/database-migrations-migration-observability/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: database-migrations-migration-observability
 description: "Migration monitoring, CDC, and observability infrastructure"
-risk: unknown
+risk: critical
 source: community
 tags: "database, cdc, debezium, kafka, prometheus, grafana, monitoring"
 date_added: "2026-02-27"

package/bundled-skills/database-migrations-sql-migrations/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: database-migrations-sql-migrations
 description: "SQL database migrations with zero-downtime strategies for PostgreSQL, MySQL, and SQL Server. Focus on data integrity and rollback plans."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/database-optimizer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: database-optimizer
 description: Expert database optimizer specializing in modern performance tuning, query optimization, and scalable architectures.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/debug-buttercup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: debug-buttercup
 description: "All pods run in namespace crs. Use when pods in the crs namespace are in CrashLoopBackOff, OOMKilled, or restarting, multiple services restart simultaneously (cascade failure), or redis is unresponsive or showing AOF warnings."
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/debugging-and-error-recovery/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: debugging-and-error-recovery
 description: Guides systematic root-cause debugging. Use when tests fail, builds break, behavior doesn't match expectations, or you encounter any unexpected error. Use when you need a systematic approach to finding and fixing the root cause rather than guessing.
-risk: unknown
+risk: critical
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/debugging-and-error-recovery
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/debugging-code/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: debugging-code
 description: Interactively debug source code — set breakpoints, step through execution line by line, inspect live variable state, evaluate expressions against the running program, and navigate the call stack to trace root causes. Use when a program crashes, raises unexpected exceptions, produces...
-risk: unknown
+risk: critical
 source: https://github.com/AlmogBaku/debug-skill/tree/master/skills/debugging-code
 source_repo: AlmogBaku/debug-skill
 source_type: community

package/bundled-skills/debugging-toolkit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: debugging-toolkit
 description: "Use when working with debugging toolkit smart debug (Alias for debugging-toolkit-smart-debug)"
-risk: unknown
+risk: none
 source: "alias"
 date_added: "2026-06-02"
 ---

package/bundled-skills/debugging-toolkit-smart-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: debugging-toolkit-smart-debug
 description: "Use when working with debugging toolkit smart debug"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/defi-protocol-templates/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: defi-protocol-templates
 description: "Implement DeFi protocols with production-ready templates for staking, AMMs, governance, and lending systems. Use when building decentralized finance applications or smart contract protocols."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/defuddle/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: defuddle
 description: Extract clean markdown content from web pages using Defuddle CLI, removing clutter and navigation to save tokens. Use instead of WebFetch when the user provides a URL to read or analyze, for online documentation, articles, blog posts, or any standard web page.
-risk: unknown
+risk: critical
 source: "https://github.com/kepano/obsidian-skills"
 date_added: "2026-03-21"
 ---

package/bundled-skills/dependency-management-deps-audit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dependency-management-deps-audit
 description: "You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/deprecation-and-migration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: deprecation-and-migration
 description: Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another. Use when deciding whether to maintain or sunset existing code.
-risk: unknown
+risk: critical
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/deprecation-and-migration
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/design-orchestration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: design-orchestration
 description: Orchestrates design workflows by routing work through brainstorming, multi-agent review, and execution readiness in the correct order.
-risk: unknown
+risk: none
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/design-philosophy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: design-philosophy
 description: Visual philosophy and art-direction for frontend. Use when creating high-concept work, campaigns, or when the user asks for a visual philosophy, manifesto, or unmistakable art-like aesthetic.
-risk: unknown
+risk: none
 source: https://github.com/connerkward/ckw-design-skill/tree/main/design-philosophy
 source_repo: connerkward/ckw-design-skill
 source_type: community

package/bundled-skills/design-spatial/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: design-spatial
 description: Design — spatial composition
-risk: unknown
+risk: critical
 source: https://github.com/connerkward/ckw-design-skill/tree/main/deterministic-design/design-spatial
 source_repo: connerkward/ckw-design-skill
 source_type: community

package/bundled-skills/design-system/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: design-system
 description: "Mechanical implementation invariants for frontend design: token architecture, typography hierarchy, loading order, FOUT prevention, chrome stability, motion timing, color semantics. Use with design when building components, pages, or design systems. (Aesthetic direction lives in..."
-risk: unknown
+risk: critical
 source: https://github.com/connerkward/ckw-design-skill/tree/main/design-system
 source_repo: connerkward/ckw-design-skill
 source_type: community

package/bundled-skills/design-thinking/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: design-thinking
 description: Direction and intent for frontend design. Use with design when defining purpose, tone, domain, color world, and review bar; includes cross-domain lens from cinema, architecture, marketing, UX, automotive, industrial design.
-risk: unknown
+risk: critical
 source: https://github.com/connerkward/ckw-design-skill/tree/main/design-thinking
 source_repo: connerkward/ckw-design-skill
 source_type: community

package/bundled-skills/design-ux/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: design-ux
 description: UX / usability audit — heuristic evaluation of INTERACTIVE UIs (not just visual polish). Load with design when a UI "feels off", "sucks to use", is hard to learn, needs an instruction wall, or before shipping an interactive tool/editor/app. Scores the RENDERED UI against Nielsen's 10 +...
-risk: unknown
+risk: critical
 source: https://github.com/connerkward/ckw-design-skill/tree/main/deterministic-design/design-ux
 source_repo: connerkward/ckw-design-skill
 source_type: community

package/bundled-skills/dev-to-hashnode/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dev-to-hashnode
 description: When the user wants to publish on Dev.to, Hashnode, or other developer blogging platforms. Trigger phrases include "Dev.to," "Hashnode," "developer blog," "cross-posting," "technical blogging," "canonical URL," or "developer content platform."
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/dev-to-hashnode
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/developer-advocacy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: developer-advocacy
 description: When the user wants to do developer advocacy activities including conference talks, live coding, podcasts, and building in public. Trigger phrases include "developer advocacy," "devrel," "conference talk," "CFP," "call for papers," "live coding," "podcast," "building in public,"...
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/developer-advocacy
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/developer-audience-context/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: developer-audience-context
 description: When the user wants to establish or update their developer audience context. Also use when starting any other developer marketing skill to ensure foundational context is loaded. Trigger phrases include "developer persona," "target developers," "who are our developers," "developer...
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/developer-audience-context
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/developer-churn/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: developer-churn
 description: When the user wants to understand, reduce, or recover from developer churn. Trigger phrases include "why developers leave," "churn rate," "win-back campaign," "at-risk users," "developer retention," "preventing churn," or "competitor switching."
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/developer-churn
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/developer-listening/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: developer-listening
 description: "Monitor what developers say about your brand, competitors, and the problems they're solving. Track mentions and conversations across GitHub, Hacker News, Reddit, Stack Overflow, Twitter, and Discord. Trigger phrases: \"developer listening\", \"monitor developer conversations\", \"track..."
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/developer-listening
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/developer-newsletter/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: developer-newsletter
 description: When the user wants to create, write, or improve a newsletter for developer audiences. Trigger phrases include "newsletter," "email marketing," "developer email," "weekly digest," "dev newsletter," "email subscribers," "newsletter growth," or "email list."
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/developer-newsletter
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/developer-onboarding/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: developer-onboarding
 description: 'Get developers to "Hello World" fast with optimized quickstarts, tutorials, and sample apps. Trigger phrases: developer onboarding, time to first value, quickstart guide, hello world tutorial, developer activation, onboarding checklist, sample apps, getting started experience, reduce...'
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/developer-onboarding
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/developer-sandbox/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: developer-sandbox
 description: 'Design and build interactive playgrounds that let developers experience your product without commitment. This skill covers playground architecture, pre-populated examples, embedding strategies, gating decisions, and converting playground users to signups. Trigger phrases: "developer...'
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/developer-sandbox
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/developer-seo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: developer-seo
 description: 'SEO strategy for technical queries and developer audiences. Covers keyword research for "how to X in language" queries, error message SEO, Stack Overflow-style content, technical long-tail keywords, and competing with official documentation sites. Use when asked about: - SEO for...'
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/developer-seo
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/developer-signup-flow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: developer-signup-flow
 description: "Design frictionless signup experiences for developers including GitHub OAuth, API key generation, and onboarding personalization. Trigger phrases: developer signup, dev registration, OAuth flow, API key onboarding, reduce signup friction, developer authentication, signup conversion,..."
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/developer-signup-flow
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/devops-troubleshooter/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: devops-troubleshooter
 description: Expert DevOps troubleshooter specializing in rapid incident response, advanced debugging, and modern observability.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/devrel-content/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: devrel-content
 description: When the user wants to create technical content for developers including blog posts, tutorials, and documentation. Trigger phrases include "write a blog post," "technical article," "developer content," "tutorial," "devrel content," "dev blog," "technical writing," or "content for...
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/devrel-content
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/differential-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: differential-review
 description: "Security-focused code review for PRs, commits, and diffs."
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/discord-bot-architect/SKILL.md

@@ -3,7 +3,7 @@ name: discord-bot-architect
 description: Specialized skill for building production-ready Discord bots.
   Covers Discord.js (JavaScript) and Pycord (Python), gateway intents, slash
   commands, interactive components, rate limiting, and sharding.
-risk: unknown
+risk: critical
 source: vibeship-spawner-skills (Apache 2.0)
 date_added: 2026-02-27
 ---

package/bundled-skills/dispatching-parallel-agents/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dispatching-parallel-agents
 description: "Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/distributed-debugging-debug-trace/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: distributed-debugging-debug-trace
 description: "You are a debugging expert specializing in setting up comprehensive debugging environments, distributed tracing, and diagnostic tools. Configure debugging workflows, implement tracing solutions, and establish troubleshooting practices for development and production environments."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/django-access-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: django-access-review
 description: django-access-review
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/django-perf-review/SKILL.md

@@ -3,7 +3,7 @@ name: django-perf-review
 description: Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems.
 allowed-tools: Read, Grep, Glob, Bash, Task
 license: LICENSE
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/django-pro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: django-pro
 description: Master Django 5.x with async views, DRF, Celery, and Django Channels. Build scalable web applications with proper architecture, testing, and deployment.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/doc-coauthoring/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: doc-coauthoring
 description: "This skill provides a structured workflow for guiding users through collaborative document creation. Act as an active guide, walking users through three stages: Context Gathering, Refinement & Structure, and Reader Testing."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/docker-expert/SKILL.md

@@ -2,7 +2,7 @@
 name: docker-expert
 description: "You are an advanced Docker containerization expert with comprehensive, practical knowledge of container optimization, security hardening, multi-stage builds, orchestration patterns, and production deployment strategies based on current industry best practices."
 category: devops
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/docs/contributors/security-guardrails.md

@@ -21,8 +21,13 @@ Every offensive skill **MUST** begin with this exact disclaimer in its `SKILL.md
 
 Offensive skills must **NEVER** run fully autonomously.
 
-- **Requirement**: The skill description/instructions must explicitly tell the agent to _ask for user confirmation_ before executing any exploit or attack command.
-- **Agent Instruction**: "Ask the user to verify the target URL/IP before running."
+- **Requirement**: Before each command that probes, exploits, changes, persists
+  on, extracts data from, or attempts credential access against a target, the
+  agent must collect the exact target, written-authorization confirmation, and
+  permitted scope; show the exact command and expected effect; and wait for
+  explicit confirmation in the current conversation.
+- Without that confirmation, the skill must remain read-only and provide
+  defensive guidance only.
 
 ### 3. Safe by Design
 
@@ -42,6 +47,18 @@ _Examples: Linting, Log Analysis, Configuration Auditing._
 - **Documentation review**: Defensive skills with command examples must still be reviewed for unsafe command patterns.
 - **High-risk examples** (`curl|bash`, `wget|sh`, etc.) must use explicit allowlisting comments and clear warning context in the skill body when retained for operational examples.
 
+## External Source Installation
+
+- Do not clone or download a moving branch directly into an active skills,
+  plugin, hook, or agent-configuration directory.
+- Pin external examples to a full reviewed commit or immutable release, clone to
+  a temporary review directory, and inspect every bundled file before activation.
+- Report scripts, package lifecycle hooks, symlinks, binaries, network access,
+  credential handling, privileged actions, and destructive operations.
+- Obtain explicit user approval before downloading and again before copying,
+  installing dependencies, enabling hooks, or changing agent configuration.
+- A pin provides reproducibility, not proof of trust; upgrading requires a new review.
+
 ---
 
 ## ⚖️ Legal Disclaimer