opencode-skills-collection 4.0.17 → 4.0.18

package/bundled-skills/.antigravity-install-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-07-31T01:29:46.374Z",
+  "updatedAt": "2026-08-01T01:42:51.046Z",
   "entries": [
     "00-andruia-consultant",
     "007",
@@ -520,6 +520,7 @@
     "copywriting-psychologist",
     "core-components",
     "cost-optimization",
+    "cowork-to-code-bridge",
     "cpp-pro",
     "cqrs-implementation",
     "create-branch",
@@ -767,6 +768,7 @@
     "expo-ui-jetpack-compose",
     "expo-ui-swift-ui",
     "fable-safe-prompt",
+    "fact-check-x-complete",
     "faf-context",
     "faf-expert",
     "faf-go",
@@ -1146,6 +1148,7 @@
     "mailtrap-sending-emails",
     "mailtrap-setting-up-sending-domain",
     "mailtrap-testing-with-sandbox",
+    "maintain-codex-wiki",
     "make-automation",
     "makepad-animation",
     "makepad-basics",

package/bundled-skills/2slides-ppt-generator/scripts/download_slides_pages_voices.py

@@ -11,6 +11,9 @@ import argparse
 import ipaddress
 import re
 import socket
+import ssl
+import http.client
+import tempfile
 import requests
 from urllib.parse import urlparse
 from typing import Optional, Dict, Any
@@ -40,15 +43,56 @@ def validate_job_id(job_id: str) -> str:
     return job_id
 
 
-def validate_public_https_url(url: str) -> str:
+def validate_public_https_url(url: str) -> tuple[str, str]:
     parsed = urlparse(url)
-    if parsed.scheme != "https" or not parsed.hostname:
+    if parsed.scheme != "https" or not parsed.hostname or parsed.username or parsed.password or parsed.port not in (None, 443):
         raise ValueError("Download URL must be HTTPS")
+    public_ips = []
     for info in socket.getaddrinfo(parsed.hostname, None):
         ip = ipaddress.ip_address(info[4][0])
-        if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
+        if not ip.is_global:
             raise ValueError("Download URL resolves to a non-public address")
-    return url
+        public_ips.append(str(ip))
+    if not public_ips:
+        raise ValueError("Download URL did not resolve")
+    return url, public_ips[0]
+
+
+def download_pinned_https(url: str, pinned_ip: str, output_path: Path, maximum_bytes: int = 128 * 1024 * 1024) -> int:
+    """Download once from the verified IP while preserving TLS SNI/hostname checks."""
+    parsed = urlparse(url)
+    raw_socket = socket.create_connection((pinned_ip, 443), timeout=30)
+    tls_context = ssl.create_default_context()
+    tls_context.minimum_version = ssl.TLSVersion.TLSv1_2
+    tls_socket = tls_context.wrap_socket(raw_socket, server_hostname=parsed.hostname)
+    request_target = parsed.path or "/"
+    if parsed.query:
+        request_target += f"?{parsed.query}"
+    host = parsed.hostname
+    tls_socket.sendall(
+        f"GET {request_target} HTTP/1.1\r\nHost: {host}\r\nUser-Agent: 2slides-downloader/1\r\nAccept: application/zip\r\nConnection: close\r\n\r\n".encode("ascii")
+    )
+    response = http.client.HTTPResponse(tls_socket)
+    response.begin()
+    if 300 <= response.status < 400:
+        raise ValueError("Download redirects are refused; request a fresh final URL from 2slides")
+    if response.status != 200:
+        raise ValueError(f"Download failed with HTTP {response.status}")
+    declared = response.getheader("Content-Length")
+    if declared and int(declared) > maximum_bytes:
+        raise ValueError("Download exceeds the 128 MiB limit")
+    total = 0
+    with output_path.open("wb") as destination:
+        while True:
+            chunk = response.read(8192)
+            if not chunk:
+                break
+            total += len(chunk)
+            if total > maximum_bytes:
+                raise ValueError("Download exceeds the 128 MiB limit")
+            destination.write(chunk)
+    response.close()
+    return total
 
 
 def get_api_key() -> str:
@@ -120,7 +164,7 @@ def download_slides_pages_voices(
     download_url = data.get("downloadUrl")
     if not download_url:
         raise ValueError("No download URL in response")
-    download_url = validate_public_https_url(download_url)
+    download_url, pinned_ip = validate_public_https_url(download_url)
 
     # Optional: log additional info
     file_name = data.get("fileName", "unknown.zip")
@@ -134,15 +178,16 @@ def download_slides_pages_voices(
 
     print(f"Downloading ZIP archive to: {output_path}...", file=sys.stderr)
 
-    zip_response = requests.get(download_url, stream=True, timeout=120)
-    zip_response.raise_for_status()
-
-    # Save to file
-    with safe_user_path(output_path).open('wb') as f:
-        for chunk in zip_response.iter_content(chunk_size=8192):
-            f.write(chunk)
-
-    file_size = os.path.getsize(output_path)
+    destination = safe_user_path(output_path)
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    with tempfile.NamedTemporaryFile(prefix=".2slides-", suffix=".zip", dir=destination.parent, delete=False) as tmp:
+        temporary = Path(tmp.name)
+    try:
+        file_size = download_pinned_https(download_url, pinned_ip, temporary)
+        os.chmod(temporary, 0o600)
+        os.replace(temporary, destination)
+    finally:
+        temporary.unlink(missing_ok=True)
     print(f"✓ Downloaded successfully!", file=sys.stderr)
     print(f"  File: {output_path}", file=sys.stderr)
     print(f"  Size: {file_size:,} bytes", file=sys.stderr)

package/bundled-skills/antigravity-maintainer-batch-release/SKILL.md

@@ -125,6 +125,7 @@ Every stable or prerelease version requires full release alignment. Creating the
 4. Run `npm run release:prepare -- X.Y.Z`. This creates and pushes `release/vX.Y.Z` and opens the protected release PR.
 5. Merge that release PR through its required checks, update local `main` to equal `origin/main`, and wait for every source, release, or canonical-sync PR in the release path to close. Re-run the release-state and plugin gates if protected `main` moved.
 6. Run `npm run release:publish -- X.Y.Z`. It must resolve exactly one merged release PR from the same repository, authored by the repository owner, with base `main`, exact title `chore: release vX.Y.Z`, and head branch `release/vX.Y.Z`. Zero or multiple candidates fail closed; never select the newest approximate match. The command then verifies that exact protected merge before creating or reusing the tag and GitHub Release.
+   The npm publication workflow must first check out protected `main`, verify that the peeled release tag is an ancestor of current `origin/main`, validate the version directly from the tagged `package.json`, and only then check out or execute tag-controlled code. It has no manual-dispatch bypass.
 7. Wait for publishing workflows, then bind every proof to the exact released commit: verify the tag/ref, GitHub Release, npm version and intended dist-tag, required CI, CodeQL, and the explicitly dispatched release-only Pages build from the exact immutable `vX.Y.Z` tag. Never dispatch Pages from `main` or another branch. Verify live `llms.txt`, `skills.json`, catalog and plugin routes, and the legacy redirect bridge; do not accept a successful run for a different SHA.
 8. After npm confirms `X.Y.Z` as the published dist-tag, discover every already-configured local AAS MCP host from its real configuration and update each one to the exact same package version before declaring the release complete. Updating existing AAS host entries is part of the release; creating a previously absent host configuration still requires explicit authorization.
    - Use the published package's `aas mcp configure` two-pass flow: first preview the change, then repeat the identical command with its approval digest. Supply absolute host-config, cache, and backup paths; require a backup when replacing an existing configuration.

package/bundled-skills/apify-audience-analysis/reference/scripts/run_actor.js

@@ -170,6 +170,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -194,7 +201,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -207,15 +214,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/apify-brand-reputation-monitoring/reference/scripts/run_actor.js

@@ -170,6 +170,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -194,7 +201,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -207,15 +214,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/apify-competitor-intelligence/reference/scripts/run_actor.js

@@ -170,6 +170,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -194,7 +201,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -207,15 +214,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/apify-content-analytics/reference/scripts/run_actor.js

@@ -170,6 +170,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -194,7 +201,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -207,15 +214,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/apify-ecommerce/reference/scripts/run_actor.js

@@ -176,6 +176,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -200,7 +207,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -213,15 +220,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/apify-influencer-discovery/reference/scripts/run_actor.js

@@ -170,6 +170,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -194,7 +201,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -207,15 +214,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/apify-lead-generation/reference/scripts/run_actor.js

@@ -170,6 +170,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -194,7 +201,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -207,15 +214,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/apify-market-research/reference/scripts/run_actor.js

@@ -170,6 +170,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -194,7 +201,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -207,15 +214,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/apify-trend-analysis/reference/scripts/run_actor.js

@@ -170,6 +170,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -194,7 +201,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -207,15 +214,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/apify-ultimate-scraper/reference/scripts/run_actor.js

@@ -170,6 +170,13 @@ async function pollUntilComplete(token, runId, timeout, interval) {
     }
 }
 
+function csvCell(value) {
+    if (value === null || value === undefined) return '';
+    let text = String(value);
+    if (/^[\u0000-\u0020]*[=+@-]/.test(text)) text = `'${text}`;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
 // Download dataset items
 async function downloadResults(token, datasetId, outputPath, format) {
     const url = `https://api.apify.com/v2/datasets/${datasetId}/items?token=${encodeURIComponent(token)}&format=json`;
@@ -194,7 +201,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
         // CSV output
         if (data.length > 0) {
             const fieldnames = Object.keys(data[0]);
-            const csvLines = [fieldnames.join(',')];
+            const csvLines = [fieldnames.map(csvCell).join(',')];
 
             for (const row of data) {
                 const values = fieldnames.map((key) => {
@@ -207,15 +214,7 @@ async function downloadResults(token, datasetId, outputPath, format) {
                         value = JSON.stringify(value) || '';
                     }
 
-                    // CSV escape: wrap in quotes if contains comma, quote, or newline
-                    if (value === null || value === undefined) {
-                        return '';
-                    }
-                    const strValue = String(value);
-                    if (strValue.includes(',') || strValue.includes('"') || strValue.includes('\n')) {
-                        return `"${strValue.replace(/"/g, '""')}"`;
-                    }
-                    return strValue;
+                    return csvCell(value);
                 });
                 csvLines.push(values.join(','));
             }

package/bundled-skills/competitor-analysis/scripts/compile_report.mjs

@@ -247,6 +247,22 @@ function escapeHtml(str) {
   return (str || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }
 
+function safeHttpUrl(value) {
+  try {
+    const parsed = new URL(String(value || '').trim());
+    return parsed.protocol === 'http:' || parsed.protocol === 'https:' ? parsed.href : '';
+  } catch {
+    return '';
+  }
+}
+
+function externalLink(url, label, extra = '') {
+  const safe = safeHttpUrl(url);
+  return safe
+    ? `<a href="${escapeHtml(safe)}" target="_blank" rel="noopener noreferrer"${extra}>${escapeHtml(label || safe)}</a>`
+    : escapeHtml(label || url || '');
+}
+
 function mdToHtml(md) {
   const lines = md.split('\n');
   const out = [];
@@ -283,7 +299,7 @@ function mdToHtml(md) {
           url = url.slice(0, -1);
         }
         if (!url) return raw;
-        return `<a href="${url}" target="_blank">${url}</a>${trail}`;
+        return `${externalLink(url, url)}${trail}`;
       });
       out.push(`<li>${text}</li>`);
       continue;
@@ -394,7 +410,7 @@ const tableRows = competitorRows.map(c => {
     ? `<a href="competitors/${c.slug}.html">${escapeHtml(c.competitor_name)}</a>`
     : escapeHtml(c.competitor_name);
   const websiteHtml = c.website
-    ? `<span class="muted-line"><a href="${escapeHtml(c.website)}" target="_blank" style="color:var(--muted);">${escapeHtml(c.website.replace(/^https?:\/\/(www\.)?/, ''))}</a></span>`
+    ? `<span class="muted-line">${externalLink(c.website, c.website.replace(/^https?:\/\/(www\.)?/, ''), ' style="color:var(--muted);"')}</span>`
     : '';
   // Pricing: prefer pipe-split summary; if there are no pipes (prose drift), truncate hard.
   let pricingShort = splitPipes(c.pricing_tiers).slice(0, 3).join(' · ');
@@ -573,7 +589,7 @@ for (const c of competitorRows) {
   const mentionsHtml = c.mentions.length
     ? c.mentions.map(m => {
         const dateStr = m.date ? `<span class="muted-line" style="color:var(--muted);font-size:0.75rem;margin-left:auto;">${escapeHtml(m.date)}</span>` : '';
-        const linkText = m.url ? `<a href="${escapeHtml(m.url)}" target="_blank">${escapeHtml(m.title || m.url)}</a>` : escapeHtml(m.title);
+        const linkText = m.url ? externalLink(m.url, m.title || m.url) : escapeHtml(m.title);
         const snippet = m.snippet ? ` — <span style="color:var(--muted);">${escapeHtml(m.snippet)}</span>` : '';
         return `<div class="mention-item"><span class="src-pill src-${escapeHtml(m.sourceType)}">${escapeHtml(m.sourceType)}</span><div style="flex:1;">${linkText}${snippet}</div>${dateStr}</div>`;
       }).join('\n')
@@ -581,7 +597,7 @@ for (const c of competitorRows) {
 
   const benchmarksHtml = c.benchmarks.length
     ? `<ul>${c.benchmarks.map(b => {
-        const link = b.url ? `<a href="${escapeHtml(b.url)}" target="_blank">${escapeHtml(b.title || b.url)}</a>` : escapeHtml(b.title);
+        const link = b.url ? externalLink(b.url, b.title || b.url) : escapeHtml(b.title);
         const src = b.source ? ` <span style="color:var(--muted);">(${escapeHtml(b.source)})</span>` : '';
         const finding = b.finding ? ` — ${escapeHtml(b.finding)}` : '';
         return `<li>${link}${src}${finding}</li>`;
@@ -622,7 +638,7 @@ for (const c of competitorRows) {
   <header>
     <h1>${escapeHtml(c.competitor_name)}</h1>
     <div class="meta">
-      ${c.website ? `<a href="${escapeHtml(c.website)}" target="_blank">${escapeHtml(c.website)}</a>` : ''}
+      ${c.website ? externalLink(c.website, c.website) : ''}
       ${c.tagline ? ` · ${escapeHtml(c.tagline)}` : ''}
     </div>
   </header>${screenshotsHtml}
@@ -838,7 +854,7 @@ const sourceFilterButtons = ['All', ...sourceTypes].map(t =>
 ).join('');
 
 const mentionItems = allMentions.map(m => {
-  const link = m.url ? `<a href="${escapeHtml(m.url)}" target="_blank">${escapeHtml(m.title || m.url)}</a>` : escapeHtml(m.title);
+  const link = m.url ? externalLink(m.url, m.title || m.url) : escapeHtml(m.title);
   const snippet = m.snippet ? `<div class="snippet">${escapeHtml(m.snippet)}</div>` : '';
   const date = m.date ? `<span class="date">${escapeHtml(m.date)}</span>` : '';
   return `<div class="mention" data-type="${escapeHtml(m.sourceType)}">