opencode-skills-collection 4.0.17 → 4.0.18

package/bundled-skills/context-guardian/scripts/context_snapshot.py

@@ -17,6 +17,8 @@ Uso:
 import json
 import sys
 import os
+import re
+import stat
 from datetime import datetime
 from pathlib import Path
 
@@ -24,6 +26,7 @@ from pathlib import Path
 SCRIPT_DIR = Path(__file__).resolve().parent
 SKILL_DIR = SCRIPT_DIR.parent
 DATA_DIR = SKILL_DIR / "data"
+SNAPSHOT_NAME = re.compile(r"\Asnapshot-\d{8}-\d{6}\.md\Z")
 
 # ── Functions ──────────────────────────────────────────────────────────────
 
@@ -32,6 +35,35 @@ def ensure_data_dir():
     DATA_DIR.mkdir(parents=True, exist_ok=True)
 
 
+def snapshot_path(filename: str, *, must_exist: bool = True) -> Path:
+    """Resolve a canonical snapshot name without following links."""
+    if not isinstance(filename, str) or not SNAPSHOT_NAME.fullmatch(filename):
+        raise ValueError("Nome de snapshot invalido")
+    filepath = DATA_DIR / filename
+    if must_exist:
+        try:
+            stat = filepath.lstat()
+        except FileNotFoundError:
+            raise FileNotFoundError(filename) from None
+        if filepath.is_symlink() or not filepath.is_file():
+            raise ValueError("Snapshot deve ser um arquivo regular")
+    return filepath
+
+
+def read_snapshot_file(filepath: Path) -> str:
+    flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
+    descriptor = os.open(filepath, flags)
+    try:
+        if not stat.S_ISREG(os.fstat(descriptor).st_mode):
+            raise ValueError("Snapshot deve ser um arquivo regular")
+        with os.fdopen(descriptor, "r", encoding="utf-8") as handle:
+            descriptor = -1
+            return handle.read()
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+
+
 def save_snapshot(project: str = "", phase: str = "", summary: str = "") -> str:
     """
     Create a new snapshot file with metadata header.
@@ -44,7 +76,7 @@ def save_snapshot(project: str = "", phase: str = "", summary: str = "") -> str:
 
     timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")
     filename = f"snapshot-{timestamp}.md"
-    filepath = DATA_DIR / filename
+    filepath = snapshot_path(filename, must_exist=False)
 
     header = f"""# Context Guardian Snapshot — {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}
 **Projeto**: {project or 'nao especificado'}
@@ -99,8 +131,10 @@ def list_snapshots() -> list[dict]:
     ensure_data_dir()
     snapshots = []
 
-    for f in sorted(DATA_DIR.glob("snapshot-*.md"), reverse=True):
-        stat = f.stat()
+    for f in sorted(DATA_DIR.iterdir(), reverse=True):
+        if not SNAPSHOT_NAME.fullmatch(f.name) or f.is_symlink() or not f.is_file():
+            continue
+        stat = f.lstat()
         snapshots.append({
             "file": f.name,
             "path": str(f),
@@ -118,8 +152,8 @@ def read_latest() -> dict:
         return {"error": "Nenhum snapshot encontrado."}
 
     latest = snapshots[0]
-    path = Path(latest["path"])
-    content = path.read_text(encoding="utf-8")
+    path = snapshot_path(latest["file"])
+    content = read_snapshot_file(path)
 
     return {
         "file": latest["file"],
@@ -131,11 +165,12 @@ def read_latest() -> dict:
 
 def read_snapshot(filename: str) -> dict:
     """Read a specific snapshot by filename."""
-    filepath = DATA_DIR / filename
-    if not filepath.exists():
-        return {"error": f"Arquivo nao encontrado: {filename}"}
+    try:
+        filepath = snapshot_path(filename)
+    except (ValueError, FileNotFoundError) as error:
+        return {"error": f"Arquivo invalido ou nao encontrado: {filename}", "detail": str(error)}
 
-    content = filepath.read_text(encoding="utf-8")
+    content = read_snapshot_file(filepath)
     return {
         "file": filename,
         "path": str(filepath),
@@ -151,7 +186,7 @@ def prune_snapshots(keep: int = 10) -> dict:
 
     to_remove = snapshots[keep:]
     for s in to_remove:
-        Path(s["path"]).unlink()
+        snapshot_path(s["file"]).unlink()
 
     return {"pruned": len(to_remove), "remaining": keep}
 

package/bundled-skills/cowork-to-code-bridge/SKILL.md

@@ -0,0 +1,243 @@
+---
+name: cowork-to-code-bridge
+description: "Use an already-installed, independently verified cowork-to-code bridge to run narrowly approved actions on the user's own macOS, Linux, or WSL2 machine through a local file queue."
+risk: critical
+source: https://github.com/abhinaykrupa/cowork-to-code-bridge/tree/97f515d425df587c281effb02cda9ad0fd470790
+source_repo: abhinaykrupa/cowork-to-code-bridge
+source_type: community
+license: MIT
+license_source: https://github.com/abhinaykrupa/cowork-to-code-bridge/blob/97f515d425df587c281effb02cda9ad0fd470790/LICENSE
+date_added: "2026-07-30"
+---
+
+# cowork-to-code-bridge
+
+Use this skill only when the user explicitly asks to operate on a machine they
+own or administer and the required work cannot be completed in the current
+sandbox. The bridge queues a named script through a shared local directory; it
+does not make a local task safe merely because it opens no inbound port.
+
+> [!WARNING]
+> The bridge daemon and its scripts run with the local account's permissions.
+> They can access local files, credentials, processes, and outbound network
+> connections available to that account. Treat every queued task as execution
+> on the user's real machine.
+
+## When to Use
+
+Use this skill only when all of the following are true:
+
+- the user explicitly requested work on their own machine;
+- the bridge was already installed and independently verified by the owner;
+- the exact local path, action, permission scope, and expected output are known;
+- the action cannot be completed safely in the current sandbox;
+- a fixed approved script can perform the task, or the user explicitly approves
+  the stronger `run_claude.sh` boundary described below.
+
+Examples include an explicitly requested disk-health check, repository status,
+or a bounded edit in one named worktree. Do not activate this skill from a
+generic request to write code, reason about a problem, or edit files already
+available in the current environment.
+
+## Do Not Bootstrap from Mutable Upstream Instructions
+
+This skill does not endorse the upstream one-line installer. The reviewed
+upstream snapshot is:
+
+```text
+commit: 97f515d425df587c281effb02cda9ad0fd470790
+install.sh sha256: 887f5fa18b49602a119e01d58c80b7ca63832fb339aa513aa72f5a1faadc14f8
+LICENSE sha256: 43b7d2c43544fb06c3ebb6529073f3536e5e2ef5a41198e0c59e0a50c088b534
+```
+
+The installer at that commit still resolves mutable inputs: a PyPI range,
+GitHub `main` fallbacks, a `bridge_client.py` fetch from `main`, optional
+Homebrew/Python installation, and optional Claude CLI installation. Pinning only
+the outer `install.sh` therefore does not pin the installed system.
+
+For a new installation, stop and ask the owner to perform an independent
+installer and dependency audit or wait for an upstream immutable installation
+path. Do not download and execute the installer, pipe remote content to a shell,
+or silently patch and run it from this skill.
+
+To inspect the reviewed snapshot without installing it:
+
+```bash
+git init cowork-to-code-bridge-review
+cd cowork-to-code-bridge-review
+git remote add origin https://github.com/abhinaykrupa/cowork-to-code-bridge.git
+git fetch --depth=1 origin 97f515d425df587c281effb02cda9ad0fd470790
+git checkout --detach FETCH_HEAD
+test "$(git rev-parse HEAD)" = "97f515d425df587c281effb02cda9ad0fd470790"
+shasum -a 256 install.sh LICENSE
+```
+
+Inspection is read-only evidence, not authorization to install.
+
+## Required Machine-Side Preconditions
+
+Before queueing any task, require the owner to confirm all of these:
+
+1. `BRIDGE_ROOT` is an absolute path owned by the local account and is not
+   group- or world-writable.
+2. The token file and queue/result directories are owner-only; no symlink or
+   shared-directory indirection is present.
+3. `cowork-to-code-bridge-selfcheck` succeeds on the machine.
+4. The daemon runs in a dedicated environment with unrelated API keys and cloud
+   credentials removed. Never assume ambient credentials are safe.
+5. `BRIDGE_ALLOW_UNAUTH` is not enabled.
+6. `BRIDGE_CLAUDE_AUTOINSTALL=0` is set so a queued task cannot install another
+   tool as a side effect.
+7. `BRIDGE_PERMISSION_CEILING` is set to an exact valid value such as `readonly`
+   or `edit`, and startup logs confirm that ceiling. An invalid value is not a
+   safe ceiling.
+8. `CLAUDE_FLAGS` is unset, or the owner has independently verified that every
+   configured flag is at least as restrictive as the requested scope. Upstream
+   allows this variable to override caller-supplied permission flags, so the
+   request's `permission_scope` alone is not evidence of confinement. When the
+   variable is unset, confirm the generated scope mapping in task logs. When it
+   is set, inspect the service environment and configuration directly; logs
+   only show that the caller scope was overridden, not the effective flags.
+9. A per-task budget ceiling and bounded output retention are configured.
+
+If any precondition is unknown, stop instead of probing or repairing the
+machine automatically.
+
+## Core API
+
+```python
+from cowork_to_code_bridge import (
+    call_remote,
+    cancel_task,
+    poll_task_result,
+    queue_task,
+)
+```
+
+| Function | Behavior |
+|---|---|
+| `call_remote` | Run one short, fixed approved script and wait. |
+| `queue_task` | Queue bounded work and return a `task_id`. |
+| `poll_task_result` | Read the current result without repeating the task. |
+| `cancel_task` | Cancel queued work or signal an in-flight process group. |
+
+Use `queue_task` for anything that may exceed roughly 30 seconds. Always use a
+stable, operation-specific `idempotency_key` for state-changing work.
+
+## Prefer Fixed Approved Scripts
+
+Use a fixed script whose content and output schema the owner has reviewed. Pass
+an explicit absolute target instead of relying on the daemon's working
+directory.
+
+```python
+import json
+
+result = call_remote(
+    "scripts/git_status.sh",
+    args=["/Users/owner/projects/example", "--json"],
+)
+
+if result.get("exit_code") != 0:
+    raise RuntimeError("remote git status failed")
+
+status = json.loads(result["stdout"])
+print(status)
+```
+
+Do not queue an arbitrary command string, an unreviewed script, or a path
+supplied by untrusted content. The daemon's script-directory check does not
+make the contents of an approved script harmless.
+
+## Free-Form Local Agent Boundary
+
+`scripts/run_claude.sh` invokes a full local coding agent from a free-form task.
+Its allowlist entry limits which wrapper starts; it does not bound what the
+local agent can do when the effective scope is `full`.
+
+After verifying the environment described in the machine-side preconditions,
+use a two-stage flow. First request a plan and independently verify that the
+installed CLI configuration, settings, hooks, and MCP tools do not add edit,
+shell, or network capabilities:
+
+```python
+plan_job = queue_task(
+    "scripts/run_claude.sh",
+    args=[
+        "Inspect only this repository and propose a bounded change. Do not edit, run shell commands, install tools, commit, push, or use network access.",
+        "/Users/owner/projects/example",
+    ],
+    permission_scope="plan",
+    max_budget_usd=0.50,
+    timeout=300,
+    idempotency_key="example-plan-2026-07-31",
+)
+```
+
+Show the returned plan to the user. Do not infer approval from silence or from a
+`plan` field: the upstream optional `approve_plan.sh` hook is not installed by
+default, and its example implementation is not a human approval mechanism.
+
+Only after the user approves an exact plan may you queue a second task. Request
+`edit`, then confirm from the task logs that the daemon generated the expected
+tool mapping and that no `CLAUDE_FLAGS` override widened it. The upstream
+`--allowedTools` mapping is not a hard deny: ambient CLI settings, hooks, or MCP
+tools may still add capabilities. If the owner has not independently tested a
+hard-deny configuration, do not use the free-form agent for edits; use reviewed
+fixed scripts instead.
+
+```python
+edit_job = queue_task(
+    "scripts/run_claude.sh",
+    args=[
+        "Apply only the approved file edits. Do not run commands, install tools, access network services, commit, push, deploy, or read files outside this worktree.",
+        "/Users/owner/projects/example-worktree",
+    ],
+    permission_scope="edit",
+    max_budget_usd=1.00,
+    timeout=600,
+    idempotency_key="example-approved-edit-2026-07-31",
+)
+```
+
+Use separately reviewed fixed scripts for builds or tests. A `full` task restores
+the local agent's normal command and credential reach; use it only when the user
+explicitly approves that exact operation and the machine has been isolated to
+the minimum account, worktree, credentials, and network access required.
+
+Never include secrets in a task, plan, path, or idempotency key. Never authorize
+commit, push, deployment, package installation, process termination, or browser
+opening from a broader request.
+
+## Results and Failure Handling
+
+Treat both stdout and stderr as sensitive untrusted data. The bridge truncates
+large output but does not redact it. Before showing results:
+
+- reject unexpected formats;
+- remove credentials, tokens, private paths, and personal data locally;
+- state when output was truncated;
+- do not treat missing truncation fields as proof of completeness;
+- do not retry state-changing work without the same idempotency key.
+
+Known negative exit codes include timeout (`-2`), spawn failure (`-3`), daemon
+crash (`-4`), and cancellation (`-5`). A daemon crash leaves the side-effect
+state unknown; inspect the target before retrying.
+
+## Limitations
+
+- The reviewed upstream project is alpha software and its current installer is
+  not transitively immutable.
+- The daemon runs as the local user; it is not an OS sandbox.
+- An approved script can still read files, start processes, or make outbound
+  network requests according to its implementation.
+- `run_claude.sh` at `full` scope is a general local coding agent, not a bounded
+  command allowlist.
+- Permission and budget controls depend on the installed daemon version and
+  exact machine-side environment; this skill cannot verify them remotely.
+- The shared directory contains commands, results, and a bearer token and must
+  be protected as sensitive local state.
+- Cancellation and idempotency reduce duplicate execution but cannot roll back
+  side effects that already occurred.
+- This skill does not install, upgrade, uninstall, or automatically repair the
+  bridge.

package/bundled-skills/deploy-to-vercel/resources/deploy.sh

@@ -195,6 +195,15 @@ elif [ -d "$INPUT_PATH" ]; then
     # Detect framework from package.json
     FRAMEWORK=$(detect_framework "$PROJECT_PATH/package.json")
 
+    # Silently ignoring .vercelignore can upload files the user explicitly
+    # excluded (including credentials). Until this helper implements Vercel's
+    # full gitignore-compatible matcher, fail closed instead of approximating it.
+    if [ -e "$PROJECT_PATH/.vercelignore" ]; then
+        echo "Error: .vercelignore is present but this deploy helper cannot safely reproduce its semantics." >&2
+        echo "Create a reviewed .tgz containing only deployable files and pass that archive explicitly." >&2
+        exit 1
+    fi
+
     # Stage files into a temporary directory to avoid mutating the source tree.
     mkdir -p "$STAGING_DIR"
     echo "Staging project files..." >&2
@@ -234,6 +243,10 @@ if [ "$FRAMEWORK" != "null" ]; then
     echo "Detected framework: $FRAMEWORK" >&2
 fi
 
+if [ -f "$INPUT_PATH" ] && [[ "$INPUT_PATH" == *.tgz ]]; then
+    echo "Warning: a supplied .tgz is uploaded byte-for-byte; review its contents for secrets first." >&2
+fi
+
 # Deploy
 echo "Deploying..." >&2
 RESPONSE=$(curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK")

package/bundled-skills/docs/integrations/jetski-cortex.md

@@ -1,9 +1,9 @@
 ---
 title: Jetski/Cortex + Gemini Integration Guide
-description: "Use agentic-awesome-skills with Jetski/Cortex without hitting context-window overflow with 1,994+ skills."
+description: "Use agentic-awesome-skills with Jetski/Cortex without hitting context-window overflow with 1,997+ skills."
 ---
 
-# Jetski/Cortex + Gemini: safe integration with 1,994+ skills
+# Jetski/Cortex + Gemini: safe integration with 1,997+ skills
 
 > **Custom-host integration:** This guide documents a low-level, direct-manifest lazy loader for Jetski/Cortex and similar hosts. For Codex or Claude Code, the recommended path is [AAS Core](../users/aas-core.md), which provides neutral, deterministic catalog retrieval and validates exact agent-selected IDs through a bounded, read-only MCP server.
 
@@ -25,7 +25,7 @@ Never do:
 - concatenate all `SKILL.md` content into a single system prompt;
 - re-inject the entire library for **every** request.
 
-With 1,994+ skills, this approach fills the context window before user messages are even added, causing truncation.
+With 1,997+ skills, this approach fills the context window before user messages are even added, causing truncation.
 
 ---
 

package/bundled-skills/docs/integrations/jetski-gemini-loader/README.md

@@ -23,7 +23,7 @@ This example shows one way to integrate **agentic-awesome-skills** with a Jetski
 - How to enforce a **maximum number of skills per turn** via `maxSkillsPerTurn`.
 - How to choose whether to **truncate or error** when too many skills are requested via `overflowBehavior`.
 
-This pattern avoids context overflow when you have 1,994+ skills installed.
+This pattern avoids context overflow when you have 1,997+ skills installed.
 
 Manifest contract references:
 

package/bundled-skills/docs/maintainers/repo-growth-seo.md

@@ -29,7 +29,7 @@ Preferred homepage:
 Preferred social preview:
 
 - lead with `AAS Core` and the profile → stack → plan flow;
-- present `1,994+ Agentic Skills` as supporting catalog evidence, not a second product;
+- present `1,997+ Agentic Skills` as supporting catalog evidence, not a second product;
 - mention Codex and Claude as the current Core agent path, with broader host compatibility as distribution support;
 - avoid dense text and tiny logos that disappear in social cards.
 

package/bundled-skills/docs/maintainers/skills-update-guide.md

@@ -72,7 +72,7 @@ The update process refreshes:
 - Canonical skills index (`skills_index.json`)
 - Compatibility mirror (`data/skills_index.json`)
 - Web app skills data (`apps\web-app\public\skills.json`)
-- All 1,994+ skills from the skills directory
+- All 1,997+ skills from the skills directory
 
 ## When to Update
 

package/bundled-skills/docs/users/aas-core.md

@@ -30,7 +30,7 @@ AAS MCP does not scan the repository and does not decide which skills are best.
 > **Release boundary:** AAS Core landed after release 14.6.0. Use an exact Core-capable release rather than an unreviewed moving tag.
 
 ```bash
-npm exec --yes --ignore-scripts --package=agentic-awesome-skills@15.7.0 -- aas mcp configure \
+npm exec --yes --ignore-scripts --package=agentic-awesome-skills@15.7.1 -- aas mcp configure \
   --host codex \
   --scope user \
   --config /absolute/path/to/codex/config.toml \

package/bundled-skills/docs/users/bundles.md

@@ -1062,4 +1062,4 @@ Found a skill that should be in a bundle? Or want to create a new bundle? [Open
 
 ---
 
-_Last updated: June 2026 | Total Skills: 1,994+ | Total Bundles: 58_
+_Last updated: June 2026 | Total Skills: 1,997+ | Total Bundles: 58_

package/bundled-skills/docs/users/claude-code-skills.md

@@ -17,7 +17,7 @@ Configure AAS Core for Claude Code, describe the task and constraints, let Claud
 - It lets Claude search the verified local catalog without loading the full library into context.
 - It preserves Claude's exact selection without using metadata as an eligibility gate.
 - It keeps MCP discovery read-only and CLI changes approval-gated.
-- It includes 1,994+ skills instead of a narrow single-domain starter pack.
+- It includes 1,997+ skills instead of a narrow single-domain starter pack.
 - It supports the standard `.claude/skills/` path and the Claude Code plugin marketplace flow.
 - It also ships generated bundle plugins so teams can install focused packs like `Essentials` or `Security Developer` from the marketplace metadata.
 - It includes onboarding docs, bundles, and workflows so new users do not need to guess where to begin.

package/bundled-skills/docs/users/faq.md

@@ -31,10 +31,12 @@ Skills are specialized instruction files that teach AI assistants how to handle
 
 **No.** With AAS Core, ask the agent to inspect the project and choose the exact skills from the complete catalog. On a broad direct install, all skills may be present locally while the host loads only the skills it invokes.
 
-The direct installer keeps its historical full-catalog default for compatibility,
-but now shows the risk distribution before writing. Use `audit --skills <ids>` to
-read an exact selection and its bundled files without executing them, then use
-the same `--skills` selection with `--dry-run` before installation.
+The direct installer keeps its historical full-catalog default for other hosts,
+but Antigravity requires an exact selection, metadata filter, or explicit
+`--all` consent because its watched directory can overload the host. Use
+`audit --skills <ids>` to read an exact selection and its bundled files without
+executing them, then use the same `--skills` selection with `--dry-run` before
+installation.
 
 Use [Starter Packs](bundles.md) as human-curated presets when you want a fixed starting point.
 
@@ -156,7 +158,10 @@ The package publishes separate `agentic-awesome-skills`, `aas`, and `aas-mcp` bi
 It depends on how you install:
 
 - **Using the installer CLI (`npx agentic-awesome-skills`)**:
-  The default install target is `~/.agents/skills/` for Antigravity's global library.
+  The default target is `~/.agents/skills/` for Antigravity's global library.
+  Because Antigravity may overload when the complete catalog is present, the
+  installer requires `--skills`, a metadata filter, or explicit `--all` consent
+  before cloning or changing that target.
 - **Using a tool-specific flag**:
   Use `--claude`, `--cursor`, `--gemini`, `--codex`, `--kiro`, or `--antigravity` to target the matching tool path automatically.
 - **Using a manual clone or custom workspace path**:
@@ -172,6 +177,13 @@ git clone https://github.com/sickn33/agentic-awesome-skills.git .agent/skills
 
 For direct skill distribution, the installer CLI performs a lighter shallow clone of the current library. Manual `git clone` remains appropriate when you want the full repository history or plan to contribute from the same checkout. For Codex or Claude users who want project-specific agent selection with reproducible state, start with AAS Core instead of treating a full-library install as the primary product path.
 
+For Antigravity, ask a Codex or Claude agent with the read-only AAS Core MCP
+configured to inspect the project and choose exact IDs, then preview the selected
+set with `npx agentic-awesome-skills --antigravity --skills <ids> --dry-run`.
+AAS MCP selects and validates IDs but does not install them. The complete catalog
+requires the explicit `npx agentic-awesome-skills --antigravity --all` override
+because it can exhaust context or trigger a truncation crash loop.
+
 **Tool-specific paths:**
 
 - Claude Code: `.claude/skills/`
@@ -236,10 +248,11 @@ So it is normal for the **full library** to be larger than the **plugin-safe** p
 **Yes.** Use the same standard install flow as other platforms:
 
 ```bash
-npx agentic-awesome-skills
+npx agentic-awesome-skills --antigravity --skills brainstorming --dry-run
 ```
 
-If you have an older clone created around the removed symlink workaround, reinstall into a fresh directory or rerun `npx agentic-awesome-skills`.
+If you have an older clone created around the removed symlink workaround,
+reinstall into a fresh directory or rerun the installer with an exact selection.
 
 For AAS Core MCP configuration, native Windows 10 and 11 with Node.js 22 are supported preview targets. A preview failure with `AAS_ADAPTER_WINDOWS_ACL_FAILED` refers to the Codex/Claude configuration directory or file checked with PowerShell `Get-Acl`, not the AAS cache and not `icacls`. Read the returned `path`, `phase`, `status`, and bounded diagnostic; correct the named configuration-path ownership problem, then rerun preview. Never add `--approve` before an approval digest is produced. See the [AAS Core Windows notes](aas-core.md#native-windows-and-codex).
 

package/bundled-skills/docs/users/gemini-cli-skills.md

@@ -12,7 +12,7 @@ Install into the Gemini skills path, then ask Gemini to apply one skill at a tim
 
 - It installs directly into the expected Gemini skills path.
 - It includes both core software engineering skills and deeper agent/LLM-oriented skills.
-- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,994+ files.
+- It helps new users get started with bundles and workflows rather than forcing a cold start from 1,997+ files.
 - It is useful whether you want a broad internal skill library or a single repo to test many workflows quickly.
 
 ## Install Gemini CLI Skills

package/bundled-skills/docs/users/getting-started.md

@@ -42,22 +42,34 @@ If you prefer a marketplace-style install for **Claude Code** or **Codex**, use
 **Option A — npx (easiest):**
 
 ```bash
-npx agentic-awesome-skills
+npx agentic-awesome-skills --antigravity --skills brainstorming,systematic-debugging --dry-run
 ```
 
-This clones to `~/.agents/skills` by default. Use `--cursor`, `--claude`, `--gemini`, `--codex`, `--kiro`, or `--agy` to install for a specific tool, or `--path <dir>` for a custom location. Run `npx agentic-awesome-skills --help` for details.
+Antigravity installs to `~/.agents/skills`. Because that host may load enough
+installed instructions to exhaust its context or enter a truncation crash loop,
+the bare command and `--antigravity` now require `--skills`, a metadata filter,
+or the explicit `--all` override. Use `--cursor`, `--claude`, `--gemini`,
+`--codex`, `--kiro`, or `--agy` for other tool paths, or `--path <dir>` for a
+custom location. Run `npx agentic-awesome-skills --help` for details.
 The installer uses a shallow clone by default so you get the current library without paying for the full git history on first install.
 
-With no selector, the legacy-compatible default installs the complete catalog
-and prints a risk summary before writing. That includes `unknown`, `critical`,
-and authorized-use-only `offensive` skills. Installed text is not automatically
-executed, but it can influence an agent when loaded, so review an exact set first:
+For Antigravity, ask a Codex or Claude agent with the read-only AAS Core MCP
+configured to inspect the project, search the complete catalog, and choose exact
+skill IDs. AAS MCP does not install them; after selection, have the agent run the
+preview command above, show you the plan, and repeat it without `--dry-run` only
+after review. Other direct-install targets keep the legacy-compatible complete
+catalog behavior when no selector is supplied and print a risk summary before
+writing. Installed text is not automatically executed, but it can influence an
+agent when loaded, so review an exact set first:
 
 ```bash
 npx agentic-awesome-skills audit --skills brainstorming,backend-dev-guidelines
 npx agentic-awesome-skills --skills brainstorming,backend-dev-guidelines --dry-run
 ```
 
+Use `npx agentic-awesome-skills --antigravity --all` only when you deliberately
+accept the full catalog's context, truncation, and crash-loop risk.
+
 You can also ask your agent to read the selected `SKILL.md` and every bundled
 file before installation. The static audit reports risky capabilities; it does
 not prove that a skill is safe. See [Security, trust, and antivirus alerts](security-and-antivirus.md).

package/bundled-skills/docs/users/kiro-integration.md

@@ -18,7 +18,7 @@ Kiro is AWS's agentic AI IDE that combines:
 
 Kiro's agentic capabilities are enhanced by skills that provide:
 
-- **Domain expertise** across 1,994+ specialized areas
+- **Domain expertise** across 1,997+ specialized areas
 - **Best practices** from Anthropic, OpenAI, Google, Microsoft, and AWS
 - **Workflow automation** for common development tasks
 - **AWS-specific patterns** for serverless, infrastructure, and cloud architecture

package/bundled-skills/docs/users/usage.md

@@ -39,7 +39,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of AAS Core
 
 When you ran `npx agentic-awesome-skills` or cloned the repository, you:
 
-✅ **Downloaded 1,994+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
+✅ **Downloaded 1,997+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
 ✅ **Made them available** to your AI assistant
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)
 
@@ -231,7 +231,7 @@ Let's actually use a skill right now. Follow these steps:
 
 ## Direct-install Step 5: Pick Skills Manually
 
-Don't try to use all 1,994+ skills at once. Here's a sensible approach:
+Don't try to use all 1,997+ skills at once. Here's a sensible approach:
 
 If you want a tool-specific starting point before choosing skills, use:
 
@@ -362,7 +362,7 @@ Usually no, but if your AI doesn't recognize a skill:
 
 ### "Can I load all skills into the model at once?"
 
-No. Even though you have 1,994+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 1,997+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
 
 The intended pattern is:
 

package/bundled-skills/docs/users/visual-guide.md

@@ -40,7 +40,7 @@ agentic-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 1,994+ skills live here
+├── 📁 skills/                          ← 1,997+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -53,7 +53,7 @@ agentic-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (1,994+ total)
+│   └── ... (1,997+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -106,7 +106,7 @@ agentic-awesome-skills/
 
 ```
                     ┌─────────────────────────┐
-                    │  1,994+ SKILLS          │
+                    │  1,997+ SKILLS          │
                     └────────────┬────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
@@ -207,7 +207,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (1,994+ total)                │
+│   └── ... (1,997+ total)                │
 └─────────────────────────────────────────┘
 ```