opencode-skills-collection 4.0.15 → 4.0.16

package/bundled-skills/docs/integrations/jetski-cortex.md

@@ -1,9 +1,9 @@
 ---
 title: Jetski/Cortex + Gemini Integration Guide
-description: "Use agentic-awesome-skills with Jetski/Cortex without hitting context-window overflow with 1,993+ skills."
+description: "Use agentic-awesome-skills with Jetski/Cortex without hitting context-window overflow with 1,994+ skills."
 ---
 
-# Jetski/Cortex + Gemini: safe integration with 1,993+ skills
+# Jetski/Cortex + Gemini: safe integration with 1,994+ skills
 
 > **Custom-host integration:** This guide documents a low-level, direct-manifest lazy loader for Jetski/Cortex and similar hosts. For Codex or Claude Code, the recommended path is [AAS Core](../users/aas-core.md), which provides neutral, deterministic catalog retrieval and validates exact agent-selected IDs through a bounded, read-only MCP server.
 
@@ -25,7 +25,7 @@ Never do:
 - concatenate all `SKILL.md` content into a single system prompt;
 - re-inject the entire library for **every** request.
 
-With 1,993+ skills, this approach fills the context window before user messages are even added, causing truncation.
+With 1,994+ skills, this approach fills the context window before user messages are even added, causing truncation.
 
 ---
 

package/bundled-skills/docs/integrations/jetski-gemini-loader/README.md

@@ -23,7 +23,7 @@ This example shows one way to integrate **agentic-awesome-skills** with a Jetski
 - How to enforce a **maximum number of skills per turn** via `maxSkillsPerTurn`.
 - How to choose whether to **truncate or error** when too many skills are requested via `overflowBehavior`.
 
-This pattern avoids context overflow when you have 1,993+ skills installed.
+This pattern avoids context overflow when you have 1,994+ skills installed.
 
 Manifest contract references:
 

package/bundled-skills/docs/maintainers/repo-growth-seo.md

@@ -29,7 +29,7 @@ Preferred homepage:
 Preferred social preview:
 
 - lead with `AAS Core` and the profile → stack → plan flow;
-- present `1,993+ Agentic Skills` as supporting catalog evidence, not a second product;
+- present `1,994+ Agentic Skills` as supporting catalog evidence, not a second product;
 - mention Codex and Claude as the current Core agent path, with broader host compatibility as distribution support;
 - avoid dense text and tiny logos that disappear in social cards.
 

package/bundled-skills/docs/maintainers/skills-update-guide.md

@@ -72,7 +72,7 @@ The update process refreshes:
 - Canonical skills index (`skills_index.json`)
 - Compatibility mirror (`data/skills_index.json`)
 - Web app skills data (`apps\web-app\public\skills.json`)
-- All 1,993+ skills from the skills directory
+- All 1,994+ skills from the skills directory
 
 ## When to Update
 

package/bundled-skills/docs/users/aas-core.md

@@ -30,7 +30,7 @@ AAS MCP does not scan the repository and does not decide which skills are best.
 > **Release boundary:** AAS Core landed after release 14.6.0. Use an exact Core-capable release rather than an unreviewed moving tag.
 
 ```bash
-npm exec --yes --ignore-scripts --package=agentic-awesome-skills@15.6.0 -- aas mcp configure \
+npm exec --yes --ignore-scripts --package=agentic-awesome-skills@15.7.0 -- aas mcp configure \
   --host codex \
   --scope user \
   --config /absolute/path/to/codex/config.toml \

package/bundled-skills/docs/users/bundles.md

@@ -1062,4 +1062,4 @@ Found a skill that should be in a bundle? Or want to create a new bundle? [Open
 
 ---
 
-_Last updated: June 2026 | Total Skills: 1,993+ | Total Bundles: 58_
+_Last updated: June 2026 | Total Skills: 1,994+ | Total Bundles: 58_

package/bundled-skills/docs/users/claude-code-skills.md

@@ -17,7 +17,7 @@ Configure AAS Core for Claude Code, describe the task and constraints, let Claud
 - It lets Claude search the verified local catalog without loading the full library into context.
 - It preserves Claude's exact selection without using metadata as an eligibility gate.
 - It keeps MCP discovery read-only and CLI changes approval-gated.
-- It includes 1,993+ skills instead of a narrow single-domain starter pack.
+- It includes 1,994+ skills instead of a narrow single-domain starter pack.
 - It supports the standard `.claude/skills/` path and the Claude Code plugin marketplace flow.
 - It also ships generated bundle plugins so teams can install focused packs like `Essentials` or `Security Developer` from the marketplace metadata.
 - It includes onboarding docs, bundles, and workflows so new users do not need to guess where to begin.

package/bundled-skills/docs/users/faq.md

@@ -31,6 +31,11 @@ Skills are specialized instruction files that teach AI assistants how to handle
 
 **No.** With AAS Core, ask the agent to inspect the project and choose the exact skills from the complete catalog. On a broad direct install, all skills may be present locally while the host loads only the skills it invokes.
 
+The direct installer keeps its historical full-catalog default for compatibility,
+but now shows the risk distribution before writing. Use `audit --skills <ids>` to
+read an exact selection and its bundled files without executing them, then use
+the same `--skills` selection with `--dry-run` before installation.
+
 Use [Starter Packs](bundles.md) as human-curated presets when you want a fixed starting point.
 
 If you want a narrower install surface for **Claude Code** or **Codex**, use the new plugin distributions documented in [plugins.md](plugins.md) instead of the full library install.
@@ -128,8 +133,13 @@ We classify skills so you know what you're running. These values map directly to
 
 ### Can these skills hack my computer?
 
-**No.** Skills are text files. However, they _instruct_ the AI to run commands. If a skill says "delete all files", a compliant AI might try to do it.
-_Always check the Risk label and review the code._
+A Markdown file is not a running process, but calling it “just text” is not a
+sufficient security model. A loaded skill can instruct an agent to run commands,
+use credentials, access the network, or modify files. Installation alone is not
+evidence that any of that happened; execution logs and resulting system changes
+are. Review the exact skill and every bundled file before use, keep agent
+permissions narrow, and require confirmation for consequential actions. See
+[Security, trust, and antivirus alerts](security-and-antivirus.md).
 
 ---
 

package/bundled-skills/docs/users/gemini-cli-skills.md

@@ -12,7 +12,7 @@ Install into the Gemini skills path, then ask Gemini to apply one skill at a tim
 
 - It installs directly into the expected Gemini skills path.
 - It includes both core software engineering skills and deeper agent/LLM-oriented skills.
-- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,993+ files.
+- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,994+ files.
 - It is useful whether you want a broad internal skill library or a single repo to test many workflows quickly.
 
 ## Install Gemini CLI Skills

package/bundled-skills/docs/users/getting-started.md

@@ -48,6 +48,20 @@ npx agentic-awesome-skills
 This clones to `~/.agents/skills` by default. Use `--cursor`, `--claude`, `--gemini`, `--codex`, `--kiro`, or `--agy` to install for a specific tool, or `--path <dir>` for a custom location. Run `npx agentic-awesome-skills --help` for details.
 The installer uses a shallow clone by default so you get the current library without paying for the full git history on first install.
 
+With no selector, the legacy-compatible default installs the complete catalog
+and prints a risk summary before writing. That includes `unknown`, `critical`,
+and authorized-use-only `offensive` skills. Installed text is not automatically
+executed, but it can influence an agent when loaded, so review an exact set first:
+
+```bash
+npx agentic-awesome-skills audit --skills brainstorming,backend-dev-guidelines
+npx agentic-awesome-skills --skills brainstorming,backend-dev-guidelines --dry-run
+```
+
+You can also ask your agent to read the selected `SKILL.md` and every bundled
+file before installation. The static audit reports risky capabilities; it does
+not prove that a skill is safe. See [Security, trust, and antivirus alerts](security-and-antivirus.md).
+
 If you see a 404 error, use: `npx github:sickn33/agentic-awesome-skills`
 
 **Option B — git clone:**

package/bundled-skills/docs/users/kiro-integration.md

@@ -18,7 +18,7 @@ Kiro is AWS's agentic AI IDE that combines:
 
 Kiro's agentic capabilities are enhanced by skills that provide:
 
-- **Domain expertise** across 1,993+ specialized areas
+- **Domain expertise** across 1,994+ specialized areas
 - **Best practices** from Anthropic, OpenAI, Google, Microsoft, and AWS
 - **Workflow automation** for common development tasks
 - **AWS-specific patterns** for serverless, infrastructure, and cloud architecture

package/bundled-skills/docs/users/security-and-antivirus.md

@@ -0,0 +1,63 @@
+# Security, Trust, and Antivirus Alerts
+
+## The trust boundary
+
+A skill is instruction content, not an executable process. Copying a `SKILL.md`
+does not itself run the commands it contains. The security boundary changes when
+an agent loads those instructions and receives permission to use a shell,
+network, credentials, filesystem, browser, MCP server, or other tool.
+
+Treat every community skill and every bundled file as untrusted input until you
+have reviewed the exact installed revision. A risk label describes intended
+capability; it is not a malware verdict or safety certificate. Repository stars,
+contributors, Markdown-only packaging, and a commit pin are not substitutes for
+review.
+
+## Review before installation
+
+Use an exact selection and inspect it without execution:
+
+```bash
+npx agentic-awesome-skills audit --skills <skill-id,skill-id>
+npx agentic-awesome-skills --skills <skill-id,skill-id> --dry-run
+```
+
+The audit recursively reads the selected skill directories and reports command,
+network, credential, filesystem, privileged, destructive, symlink, and binary
+signals. Read the files behind every finding and ask your agent to explain them.
+Static pattern matching can miss dangerous logic and can flag legitimate
+security examples, so a clean report does not prove safety.
+
+For external sources, require a full commit pin or immutable release, download
+to a temporary review directory, inspect package scripts and every bundled file,
+and approve the final copy separately. Do not pipe remote content into a shell or
+clone a moving branch directly into an active agent directory.
+
+## If antivirus flags a skill
+
+Security documentation often contains exploit names, commands, or payload
+fragments that signature scanners recognize. A detection in Markdown can be a
+correct content detection without showing that a Trojan executed. Do not dismiss
+it, but distinguish content from activity:
+
+1. Stop the agent and quarantine or move the flagged skill out of active paths.
+2. Record the exact file, detector name, package version, and file hash.
+3. Review the file and adjacent bundled content without executing anything.
+4. Check agent transcripts, shell history, process logs, downloads, persistence
+   locations, credential access, and unexpected filesystem or network changes.
+5. Run your operating system's trusted security scan. Rotate credentials only
+   when exposure or suspicious activity is plausible; reinstall the system when
+   forensic evidence or incident-response guidance justifies it, not solely
+   because a text signature matched.
+6. Report reproducible findings privately through the process in
+   [`SECURITY.md`](../../SECURITY.md). Include evidence of execution or impact
+   separately from the flagged text.
+
+## Safer operating defaults
+
+- Install only the skills needed for the task when practical.
+- Keep agent permissions least-privileged and avoid administrator access.
+- Require current-conversation approval for destructive, privileged, financial,
+  account-write, credential, publishing, and offensive-security actions.
+- Use disposable environments for offensive or untrusted workflows.
+- Preserve logs and backups so actions can be audited and reversed where possible.

package/bundled-skills/docs/users/usage.md

@@ -39,7 +39,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of AAS Core
 
 When you ran `npx agentic-awesome-skills` or cloned the repository, you:
 
-✅ **Downloaded 1,993+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
+✅ **Downloaded 1,994+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
 ✅ **Made them available** to your AI assistant
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)
 
@@ -231,7 +231,7 @@ Let's actually use a skill right now. Follow these steps:
 
 ## Direct-install Step 5: Pick Skills Manually
 
-Don't try to use all 1,993+ skills at once. Here's a sensible approach:
+Don't try to use all 1,994+ skills at once. Here's a sensible approach:
 
 If you want a tool-specific starting point before choosing skills, use:
 
@@ -362,7 +362,7 @@ Usually no, but if your AI doesn't recognize a skill:
 
 ### "Can I load all skills into the model at once?"
 
-No. Even though you have 1,993+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 1,994+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
 
 The intended pattern is:
 

package/bundled-skills/docs/users/visual-guide.md

@@ -40,7 +40,7 @@ agentic-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 1,993+ skills live here
+├── 📁 skills/                          ← 1,994+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -53,7 +53,7 @@ agentic-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (1,993+ total)
+│   └── ... (1,994+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -106,7 +106,7 @@ agentic-awesome-skills/
 
 ```
                     ┌─────────────────────────┐
-                    │  1,993+ SKILLS          │
+                    │  1,994+ SKILLS          │
                     └────────────┬────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
@@ -207,7 +207,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (1,993+ total)                │
+│   └── ... (1,994+ total)                │
 └─────────────────────────────────────────┘
 ```
 

package/bundled-skills/docs-architect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docs-architect
 description: Creates comprehensive technical documentation from existing codebases. Analyzes architecture, design patterns, and implementation details to produce long-form technical manuals and ebooks.
-risk: unknown
+risk: safe
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/docs-as-marketing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docs-as-marketing
 description: Transform documentation into a powerful marketing channel that attracts, converts, and retains developers. This skill covers creating documentation that ranks in search, converts visitors into users, and accelerates adoption through exceptional information architecture and...
-risk: unknown
+risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/docs-as-marketing
 source_repo: jonathimer/devmarketing-skills
 source_type: community

package/bundled-skills/documentation-and-adrs/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: documentation-and-adrs
 description: Records decisions and documentation. Use when making architectural decisions, changing public APIs, shipping features, or when you need to record context that future engineers and agents will need to understand the codebase.
-risk: unknown
+risk: critical
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/documentation-and-adrs
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/docusign-automation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docusign-automation
 description: "Automate DocuSign tasks via Rube MCP (Composio): templates, envelopes, signatures, document management. Always search tools first for current schemas."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/docx-official/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docx-official
 description: "A user may ask you to create, edit, or analyze the contents of a .docx file. A .docx file is essentially a ZIP archive containing XML files and other resources that you can read or edit. You have different tools and workflows available for different tasks."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/dotnet-architect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dotnet-architect
 description: Expert .NET backend architect specializing in C#, ASP.NET Core, Entity Framework, Dapper, and enterprise application patterns.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/doubt-driven-development/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: doubt-driven-development
 description: Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident...
-risk: unknown
+risk: critical
 source: https://github.com/addyosmani/agent-skills/tree/main/skills/doubt-driven-development
 source_repo: addyosmani/agent-skills
 source_type: community

package/bundled-skills/dwarf-expert/SKILL.md

@@ -7,7 +7,7 @@ allowed-tools:
   - Grep
   - Glob
   - WebSearch
-risk: unknown
+risk: critical
 source: community
 ---
 # Overview

package/bundled-skills/dx-optimizer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dx-optimizer
 description: Developer Experience specialist. Improves tooling, setup, and workflows. Use PROACTIVELY when setting up new projects, after team feedback, or when development friction is noticed.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/eas-update-insights/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: eas-update-insights
 description: "Check the health of published EAS Updates: crash rates, install/launch counts, unique users, payload size, and the split between embedded and OTA users per channel. Use when the user asks how an update is performing, whether a rollout is healthy, how many users are on the embedded..."
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/eas-update-insights
 source_repo: expo/skills
 source_type: official

package/bundled-skills/elixir-pro/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: elixir-pro
 description: Write idiomatic Elixir code with OTP patterns, supervision trees, and Phoenix LiveView. Masters concurrency, fault tolerance, and distributed systems.
-risk: unknown
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---

package/bundled-skills/email-sequence/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: email-sequence
 description: "You are an expert in email marketing and automation. Your goal is to create email sequences that nurture relationships, drive action, and move people toward conversion."
-risk: unknown
+risk: none
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/embedding-strategies/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: embedding-strategies
 description: "Guide to selecting and optimizing embedding models for vector search applications."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/emergency-card/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: emergency-card
 description: 生成紧急情况下快速访问的医疗信息摘要卡片。当用户需要旅行、就诊准备、紧急情况或询问"紧急信息"、"医疗卡片"、"急救信息"时使用此技能。提取关键信息（过敏、用药、急症、植入物），支持多格式输出（JSON、文本、二维码），用于急救或快速就医。
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/enhance-prompt/SKILL.md

@@ -4,7 +4,7 @@ description: Transforms vague UI ideas into polished, Stitch-optimized prompts.
 allowed-tools:
   - "Read"
   - "Write"
-risk: unknown
+risk: critical
 source: community
 ---
 

package/bundled-skills/environment-setup-guide/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: environment-setup-guide
 description: "Guide developers through setting up development environments with proper tools, dependencies, and configurations"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/error-debugging-multi-agent-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-debugging-multi-agent-review
 description: "Use when working with error debugging multi agent review"
-risk: unknown
+risk: safe
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/error-diagnostics-smart-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: error-diagnostics-smart-debug
 description: "Use when working with error diagnostics smart debug"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/ethical-hacking-methodology/SKILL.md

@@ -7,6 +7,20 @@ author: zebbern
 date_added: "2026-02-27"
 ---
 
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
 > AUTHORIZED USE ONLY: Use this skill only for authorized penetration testing engagements, defensive validation, or controlled educational environments.
 
 # Ethical Hacking Methodology

package/bundled-skills/event-sourcing-architect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: event-sourcing-architect
 description: "Expert in event sourcing, CQRS, and event-driven architecture patterns. Masters event store design, projection building, saga orchestration, and eventual consistency patterns. Use PROACTIVELY for event-sourced systems, audit trail requirements, or complex domain modeling with temporal queries."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/event-store-design/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: event-store-design
 description: "Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/exa-search/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: exa-search
 description: "Semantic search, similar content discovery, and structured research using Exa API. Use when you need semantic/embeddings-based search, finding similar content, or searching by category (company, people, research papers, etc.)."
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/executing-plans/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: executing-plans
 description: "Use when you have a written implementation plan to execute in a separate session with review checkpoints"
-risk: unknown
+risk: critical
 source: community
 date_added: "2026-02-27"
 ---

package/bundled-skills/expo-api-routes/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-api-routes
 description: Guidelines for creating API routes in Expo Router with EAS Hosting
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-api-routes
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-brownfield/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-brownfield
 description: Integrate Expo and React Native into an existing native iOS or Android app. Use when the user mentions brownfield, embedding React Native in a native app, AAR/XCFramework, or adding Expo to an existing Kotlin/Swift project. Covers both the isolated approach and the integrated approach.
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-brownfield
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-cicd-workflows/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-cicd-workflows
 description: Helps understand and write EAS workflow YAML files for Expo projects. Use this skill when the user asks about CI/CD or workflows in an Expo or EAS context, mentions .eas/workflows/, or wants help with EAS build pipelines or deployment automation.
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-cicd-workflows
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-deployment/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-deployment
 description: Deploy Expo apps to production with EAS — build and submit to the iOS App Store, Google Play Store, and TestFlight, configure eas.json build and submit profiles, manage app versions and build numbers, publish App Store metadata and ASO, and deploy web bundles and API routes via EAS...
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-deployment
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-dev-client/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-dev-client
 description: Build Expo app for development
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-dev-client
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-examples/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-examples
 description: Expo's official example projects — the expo/examples repo of ~70 `with-*` integrations (Stripe, Clerk, Supabase, OpenAI, maps, Reanimated, SQLite, Skia, NativeWind, and more). Use when integrating a third-party library or service into an existing Expo app and you want the canonical,...
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-examples
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-module/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-module
 description: Guide for creating and writing Expo native modules and views using the Expo Modules API (Swift, Kotlin, TypeScript). Covers module definition DSL, native views, shared objects, config plugins, lifecycle hooks, autolinking, and type system. Use when building or modifying native modules...
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-module
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-observe/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-observe
 description: Use for anything related to EAS Observe — adding `expo-observe` to an Expo project (AppMetricsRoot/ObserveRoot HOC, markInteractive, the useObserve hook, and the Expo Router / React Navigation integrations for per-route metrics), querying via the EAS CLI (`eas observe:metrics-summary`,...
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-observe
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-tailwind-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-tailwind-setup
 description: Set up Tailwind CSS v4 in Expo with react-native-css and NativeWind v5 for universal styling
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-tailwind-setup
 source_repo: expo/skills
 source_type: official

package/bundled-skills/expo-ui/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: expo-ui
 description: "Build native UI with the @expo/ui package: real SwiftUI on iOS and Jetpack Compose on Android rendered from React in an Expo or React Native app. Covers universal cross-platform components (Host, Column, Row, Button, Text, List, and more imported from @expo/ui), drop-in replacements..."
-risk: unknown
+risk: critical
 source: https://github.com/expo/skills/tree/main/plugins/expo/skills/expo-ui
 source_repo: expo/skills
 source_type: official