opencode-skills-collection 4.0.29 → 4.0.31

package/bundled-skills/.antigravity-install-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-08-12T00:55:43.080Z",
+  "updatedAt": "2026-08-14T00:56:33.364Z",
   "entries": [
     "00-andruia-consultant",
     "007",
@@ -161,6 +161,7 @@
     "astro",
     "astropy",
     "async-python-patterns",
+    "atlas-cloud-media",
     "atlas-contract",
     "atlas-ledger",
     "attack-tree-construction",
@@ -1883,6 +1884,7 @@
     "update-swiftui-apis",
     "upgrading-expo",
     "upstash-qstash",
+    "us-property-data",
     "usage-based-pricing",
     "use-dom",
     "user-thoughts",

package/bundled-skills/atlas-cloud-media/SKILL.md

@@ -0,0 +1,257 @@
+---
+name: atlas-cloud-media
+description: "Generate Atlas Cloud images and videos through its asynchronous media API with schema-first model selection and credential-safe polling."
+category: media
+risk: safe
+source: self
+source_type: self
+date_added: "2026-08-12"
+author: binyangzhu000-sudo
+tags: [atlas-cloud, image-generation, video-generation, media-api]
+tools: [claude, codex, cursor, gemini]
+---
+
+# Atlas Cloud Media
+
+## Overview
+
+Use Atlas Cloud's asynchronous media API to generate images or videos. This
+source-only skill describes model discovery, schema validation, task
+submission, bounded polling, and safe output retrieval; it does not bundle an
+SDK, executable, or hosted runtime.
+
+## When to Use This Skill
+
+- Use when the user explicitly asks to generate an image or video with Atlas
+  Cloud.
+- Use when an existing workflow needs an Atlas Cloud image or video generation
+  request and can make HTTPS calls.
+- Use when model-specific parameters must be discovered before submission.
+- Do not use this skill for OpenAI-compatible text chat; that API has a
+  different base URL and contract.
+
+## Preconditions
+
+1. Confirm the user is authorized to send the prompt and any reference media
+   to a third-party service.
+2. Explain that generation is paid and obtain approval before submitting a
+   billable request.
+3. Require `ATLASCLOUD_API_KEY` to be present in the environment. Never ask the
+   user to paste it into chat, source files, command history, or logs.
+4. Confirm the output directory and whether the user wants image generation,
+   video generation, or both.
+
+## API Contract
+
+| Operation | Method and endpoint |
+| --- | --- |
+| List models | `GET https://api.atlascloud.ai/api/v1/models` |
+| Generate image | `POST https://api.atlascloud.ai/api/v1/model/generateImage` |
+| Generate video | `POST https://api.atlascloud.ai/api/v1/model/generateVideo` |
+| Poll task | `GET https://api.atlascloud.ai/api/v1/model/prediction/{id}` |
+
+Generation and polling requests use these headers:
+
+```text
+Authorization: Bearer $ATLASCLOUD_API_KEY
+Content-Type: application/json
+```
+
+The model catalog is public. Each catalog entry includes a `schema` URL; fetch
+that schema and validate parameters against it before sending a paid request.
+Do not guess parameters from another model, because names such as `size`,
+`ratio`, `aspect_ratio`, `image`, and `image_url` are model-specific.
+
+## Workflow
+
+### 1. Discover and Validate a Model
+
+Fetch the catalog, filter by `type` (`Image` or `Video`), and match the user's
+requested capability. Read the selected entry's `schema`, verify that all
+required fields are present, and show the model and billable action to the user
+before submission.
+
+Example discovery request:
+
+```bash
+curl --fail --silent --show-error \
+  "https://api.atlascloud.ai/api/v1/models" \
+  --output /tmp/atlas-models.json
+
+jq -r '.data[] | select(.type == "Image") | [.model, .displayName, .schema] | @tsv' \
+  /tmp/atlas-models.json
+```
+
+### 2. Submit One Generation Task
+
+Build the JSON body in a file so that quoting is deterministic and request
+details can be reviewed without exposing the API key.
+
+Image example using a catalog-confirmed model:
+
+```bash
+jq -n \
+  --arg model "qwen-image-3.0/text-to-image" \
+  --arg prompt "A paper-cut city map in blue and white, clean editorial style" \
+  '{model: $model, prompt: $prompt, size: "1024*1024", n: 1}' \
+  > /tmp/atlas-image-request.json
+
+curl --fail --silent --show-error \
+  --request POST \
+  "https://api.atlascloud.ai/api/v1/model/generateImage" \
+  --header "Authorization: Bearer $ATLASCLOUD_API_KEY" \
+  --header "Content-Type: application/json" \
+  --data @/tmp/atlas-image-request.json \
+  --output /tmp/atlas-submit.json
+```
+
+Video example using a catalog-confirmed model:
+
+```bash
+jq -n \
+  --arg model "bytedance/seedance-2.0-fast/text-to-video" \
+  --arg prompt "A small paper boat crossing a calm pond, locked camera" \
+  '{
+    model: $model,
+    prompt: $prompt,
+    duration: 4,
+    resolution: "480p",
+    ratio: "16:9",
+    generate_audio: false,
+    watermark: false
+  }' > /tmp/atlas-video-request.json
+
+curl --fail --silent --show-error \
+  --request POST \
+  "https://api.atlascloud.ai/api/v1/model/generateVideo" \
+  --header "Authorization: Bearer $ATLASCLOUD_API_KEY" \
+  --header "Content-Type: application/json" \
+  --data @/tmp/atlas-video-request.json \
+  --output /tmp/atlas-submit.json
+```
+
+Check that `.data.id` is a non-empty string before polling. Treat a non-2xx
+response or a missing ID as submission failure; do not retry a billable request
+automatically because the original task may still have been accepted.
+
+### 3. Poll with a Deadline
+
+Poll every three seconds. Accept `completed` or `succeeded` as success, stop on
+`failed` or `timeout`, and stop after ten minutes. Preserve the prediction ID
+for diagnostics, but never log request headers or the API key.
+
+```bash
+prediction_id=$(jq -er '.data.id | select(type == "string" and length > 0)' \
+  /tmp/atlas-submit.json)
+
+for attempt in $(seq 1 200); do
+  sleep 3
+  curl --fail --silent --show-error \
+    "https://api.atlascloud.ai/api/v1/model/prediction/$prediction_id" \
+    --header "Authorization: Bearer $ATLASCLOUD_API_KEY" \
+    --output /tmp/atlas-prediction.json
+
+  status=$(jq -r '.data.status // "unknown"' /tmp/atlas-prediction.json)
+  case "$status" in
+    completed|succeeded) break ;;
+    failed|timeout)
+      jq -r '.data.error // "Atlas Cloud generation failed"' \
+        /tmp/atlas-prediction.json >&2
+      exit 1
+      ;;
+  esac
+done
+
+test "$status" = "completed" || test "$status" = "succeeded"
+```
+
+### 4. Download and Verify the Output
+
+Read the first HTTPS URL from `.data.outputs`. Atlas output URLs are temporary,
+so download promptly. Do not send `Authorization` or any other Atlas request
+headers to the output host. Reject non-HTTPS URLs and inspect the downloaded
+file's content type and size before treating it as a valid deliverable.
+
+```bash
+output_url=$(jq -er '.data.outputs[0] | select(startswith("https://"))' \
+  /tmp/atlas-prediction.json)
+
+curl --fail --silent --show-error --location \
+  "$output_url" \
+  --output ./atlas-output.bin
+
+test -s ./atlas-output.bin
+file ./atlas-output.bin
+```
+
+Rename the file only after its detected type is known. Report the local path,
+model ID, dimensions or duration, and whether the output passed basic playback
+or decode validation.
+
+## Failure Handling
+
+- `401` or `403`: stop and ask the user to verify access. Do not print or rotate
+  the key automatically.
+- `400` or `422`: fetch the model's current schema and correct the payload. Do
+  not blindly resubmit.
+- `429`: stop and report rate limiting; respect any `Retry-After` value.
+- `5xx` or network timeout: first poll a known prediction ID. Do not create a
+  second paid task unless the user approves the possible duplicate charge.
+- `failed` or `timeout`: report the sanitized service error and prediction ID;
+  do not claim an output was generated.
+- Missing or invalid media: keep the original response for diagnosis, do not
+  overwrite an existing destination, and do not mark the task complete.
+
+## Best Practices
+
+- Use the public catalog and per-model schema immediately before generation.
+- Submit one task at a time unless the user explicitly approves a batch and its
+  cost.
+- Keep prompts, reference-media rights, and provider content policies visible
+  in the approval step.
+- Use short polling intervals only while a task is active; always enforce a
+  deadline.
+- Download expiring outputs promptly and validate them locally.
+- Never forward the Atlas bearer token to CDN or user-supplied URLs.
+
+## Limitations
+
+- This source-only skill provides operational instructions, not an installed
+  Atlas Cloud client, bundled script, queue worker, or retry service.
+- Available models, schemas, prices, and output retention can change; the live
+  catalog is authoritative.
+- Model availability does not guarantee a prompt or reference asset is allowed.
+- Generation is asynchronous and may take several minutes.
+- Basic file checks do not replace human review of media quality, factual
+  accuracy, rights, or safety.
+
+## Security & Safety Notes
+
+- Treat prompts and uploaded media as data sent to a third party; obtain user
+  consent first and avoid unnecessary personal or confidential information.
+- Keep credentials in environment variables or an approved secret manager.
+- Redact authorization headers and signed output URLs from logs and bug reports.
+- Never execute downloaded media as code, and never use this workflow for bulk
+  hosting or unrelated file transfer.
+- Follow applicable laws, provider policies, and intellectual-property rights.
+
+## Common Pitfalls
+
+- **Problem:** A payload copied from another model returns a validation error.
+  **Solution:** Fetch the selected catalog entry's current `schema` and rebuild
+  the request from that schema.
+- **Problem:** A network timeout causes a duplicate paid request.
+  **Solution:** Preserve and poll the original prediction ID before considering
+  a resubmission.
+- **Problem:** The downloaded file is HTML or JSON instead of media.
+  **Solution:** Check the HTTP status, content type, file signature, and size
+  before renaming or publishing it.
+- **Problem:** Output download leaks the API key to another host.
+  **Solution:** Use a fresh download request with no Atlas authorization header.
+
+## Related Skills
+
+- `@video-router` - Decide whether a request should use generated video before
+  submitting a billable task.
+- `@image-studio` - Plan and review image-production work around generated
+  assets.

package/bundled-skills/docs/integrations/jetski-cortex.md

@@ -1,9 +1,9 @@
 ---
 title: Jetski/Cortex + Gemini Integration Guide
-description: "Use agentic-awesome-skills with Jetski/Cortex without hitting context-window overflow with 2,007+ skills."
+description: "Use agentic-awesome-skills with Jetski/Cortex without hitting context-window overflow with 2,009+ skills."
 ---
 
-# Jetski/Cortex + Gemini: safe integration with 2,007+ skills
+# Jetski/Cortex + Gemini: safe integration with 2,009+ skills
 
 > **Custom-host integration:** This guide documents a low-level, direct-manifest lazy loader for Jetski/Cortex and similar hosts. For Codex or Claude Code, the recommended path is [AAS Core](../users/aas-core.md), which provides neutral, deterministic catalog retrieval and validates exact agent-selected IDs through a bounded, read-only MCP server.
 
@@ -25,7 +25,7 @@ Never do:
 - concatenate all `SKILL.md` content into a single system prompt;
 - re-inject the entire library for **every** request.
 
-With 2,007+ skills, this approach fills the context window before user messages are even added, causing truncation.
+With 2,009+ skills, this approach fills the context window before user messages are even added, causing truncation.
 
 ---
 

package/bundled-skills/docs/integrations/jetski-gemini-loader/README.md

@@ -23,7 +23,7 @@ This example shows one way to integrate **agentic-awesome-skills** with a Jetski
 - How to enforce a **maximum number of skills per turn** via `maxSkillsPerTurn`.
 - How to choose whether to **truncate or error** when too many skills are requested via `overflowBehavior`.
 
-This pattern avoids context overflow when you have 2,007+ skills installed.
+This pattern avoids context overflow when you have 2,009+ skills installed.
 
 Manifest contract references:
 

package/bundled-skills/docs/maintainers/repo-growth-seo.md

@@ -29,7 +29,7 @@ Preferred homepage:
 Preferred social preview:
 
 - lead with `AAS Core` and the profile → stack → plan flow;
-- present `2,007+ Agentic Skills` as supporting catalog evidence, not a second product;
+- present `2,009+ Agentic Skills` as supporting catalog evidence, not a second product;
 - mention Codex and Claude as the current Core agent path, with broader host compatibility as distribution support;
 - avoid dense text and tiny logos that disappear in social cards.
 

package/bundled-skills/docs/maintainers/skills-update-guide.md

@@ -72,7 +72,7 @@ The update process refreshes:
 - Canonical skills index (`skills_index.json`)
 - Compatibility mirror (`data/skills_index.json`)
 - Web app skills data (`apps\web-app\public\skills.json`)
-- All 2,007+ skills from the skills directory
+- All 2,009+ skills from the skills directory
 
 ## When to Update
 

package/bundled-skills/docs/users/aas-core.md

@@ -30,7 +30,7 @@ AAS MCP does not scan the repository and does not decide which skills are best.
 > **Release boundary:** AAS Core landed after release 14.6.0. Use an exact Core-capable release rather than an unreviewed moving tag.
 
 ```bash
-npm exec --yes --ignore-scripts --package=agentic-awesome-skills@15.12.0 -- aas mcp configure \
+npm exec --yes --ignore-scripts --package=agentic-awesome-skills@15.13.0 -- aas mcp configure \
   --host codex \
   --scope user \
   --config /absolute/path/to/codex/config.toml \

package/bundled-skills/docs/users/bundles.md

@@ -1064,4 +1064,4 @@ Found a skill that should be in a bundle? Or want to create a new bundle? [Open
 
 ---
 
-_Last updated: June 2026 | Total Skills: 2,007+ | Total Bundles: 58_
+_Last updated: June 2026 | Total Skills: 2,009+ | Total Bundles: 58_

package/bundled-skills/docs/users/claude-code-skills.md

@@ -17,7 +17,7 @@ Configure AAS Core for Claude Code, describe the task and constraints, let Claud
 - It lets Claude search the verified local catalog without loading the full library into context.
 - It preserves Claude's exact selection without using metadata as an eligibility gate.
 - It keeps MCP discovery read-only and CLI changes approval-gated.
-- It includes 2,007+ skills instead of a narrow single-domain starter pack.
+- It includes 2,009+ skills instead of a narrow single-domain starter pack.
 - It supports the standard `.claude/skills/` path and the Claude Code plugin marketplace flow.
 - It also ships generated bundle plugins so teams can install focused packs like `Essentials` or `Security Developer` from the marketplace metadata.
 - It includes onboarding docs, bundles, and workflows so new users do not need to guess where to begin.

package/bundled-skills/docs/users/faq.md

@@ -304,6 +304,10 @@ To manage a reproducible exact set and inspect every install, update, or removal
 npx agentic-awesome-skills@14.3.0 --path .agents/skills --release 14.3.0 --skills frontend-design,backend-dev-guidelines --dry-run
 ```
 
+Default and `--release` installs fail closed unless the cloned Git commit matches
+the immutable `gitHead` recorded for that exact npm version. `--tag` intentionally
+accepts mutable Git refs and prints a warning because it skips that identity check.
+
 Remove `--dry-run` only after reviewing the plan.
 
 To review a Core stack manifest or immutable plan visually, use the hosted [Skill Workbench](https://sickn33.github.io/agentic-awesome-skills/workbench). It imports the JSON in browser memory and checks the supported artifact structure; it does not assemble a stack, generate install commands, access the filesystem, or install skills.

package/bundled-skills/docs/users/gemini-cli-skills.md

@@ -12,7 +12,7 @@ Install into the Gemini skills path, then ask Gemini to apply one skill at a tim
 
 - It installs directly into the expected Gemini skills path.
 - It includes both core software engineering skills and deeper agent/LLM-oriented skills.
-- It helps new users get started with bundles and workflows rather than forcing a cold start from 2,007+ files.
+- It helps new users get started with bundles and workflows rather than forcing a cold start from 2,009+ files.
 - It is useful whether you want a broad internal skill library or a single repo to test many workflows quickly.
 
 ## Install Gemini CLI Skills

package/bundled-skills/docs/users/getting-started.md

@@ -210,7 +210,7 @@ A: Use the activation flow in [agent-overload-recovery.md](agent-overload-recove
 A: The Antigravity CLI reads skill directories from `~/.gemini/antigravity-cli/skills/<skill>/SKILL.md`. Run `npx agentic-awesome-skills --agy`, restart `agy`, then open `/skills` or type a specific slash command such as `/brainstorming`.
 
 **Q: What if OpenCode or another `.agents/skills` host becomes unstable with a full install?**
-A: Start with a reduced install instead of copying the whole library. For example: `npx agentic-awesome-skills --path .agents/skills --category development,backend --risk safe,none`. You can narrow further with `--tags` and use a trailing `-` to exclude values such as `typescript-`. To manage a reproducible exact set, first preview it with `npx agentic-awesome-skills@14.3.0 --path .agents/skills --release 14.3.0 --skills frontend-design,backend-dev-guidelines --dry-run`, then remove `--dry-run` only after reviewing the plan.
+A: Start with a reduced install instead of copying the whole library. For example: `npx agentic-awesome-skills --path .agents/skills --category development,backend --risk safe,none`. You can narrow further with `--tags` and use a trailing `-` to exclude values such as `typescript-`. To manage a reproducible exact set, first preview it with `npx agentic-awesome-skills@14.3.0 --path .agents/skills --release 14.3.0 --skills frontend-design,backend-dev-guidelines --dry-run`, then remove `--dry-run` only after reviewing the plan. Default and `--release` installs verify the cloned commit against the exact npm release's immutable `gitHead`; `--tag` is an explicit mutable-ref escape hatch and is not release-identity verified.
 
 **Q: Is this free?**
 A: Yes. Original code and tooling are MIT-licensed, and original documentation/non-code written content is CC BY 4.0. See [../../LICENSE](../../LICENSE) and [../../LICENSE-CONTENT](../../LICENSE-CONTENT).

package/bundled-skills/docs/users/kiro-integration.md

@@ -18,7 +18,7 @@ Kiro is AWS's agentic AI IDE that combines:
 
 Kiro's agentic capabilities are enhanced by skills that provide:
 
-- **Domain expertise** across 2,007+ specialized areas
+- **Domain expertise** across 2,009+ specialized areas
 - **Best practices** from Anthropic, OpenAI, Google, Microsoft, and AWS
 - **Workflow automation** for common development tasks
 - **AWS-specific patterns** for serverless, infrastructure, and cloud architecture

package/bundled-skills/docs/users/usage.md

@@ -39,7 +39,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of AAS Core
 
 When you ran `npx agentic-awesome-skills` or cloned the repository, you:
 
-✅ **Downloaded 2,007+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
+✅ **Downloaded 2,009+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
 ✅ **Made them available** to your AI assistant
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)
 
@@ -231,7 +231,7 @@ Let's actually use a skill right now. Follow these steps:
 
 ## Direct-install Step 5: Pick Skills Manually
 
-Don't try to use all 2,007+ skills at once. Here's a sensible approach:
+Don't try to use all 2,009+ skills at once. Here's a sensible approach:
 
 If you want a tool-specific starting point before choosing skills, use:
 
@@ -362,7 +362,7 @@ Usually no, but if your AI doesn't recognize a skill:
 
 ### "Can I load all skills into the model at once?"
 
-No. Even though you have 2,007+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 2,009+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
 
 The intended pattern is:
 

package/bundled-skills/docs/users/visual-guide.md

@@ -40,7 +40,7 @@ agentic-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 2,007+ skills live here
+├── 📁 skills/                          ← 2,009+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -53,7 +53,7 @@ agentic-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (2,007+ total)
+│   └── ... (2,009+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -106,7 +106,7 @@ agentic-awesome-skills/
 
 ```
                     ┌─────────────────────────┐
-                    │  2,007+ SKILLS          │
+                    │  2,009+ SKILLS          │
                     └────────────┬────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
@@ -207,7 +207,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (2,007+ total)                │
+│   └── ... (2,009+ total)                │
 └─────────────────────────────────────────┘
 ```
 

package/bundled-skills/loki-mode/examples/todo-app-generated/frontend/package-lock.json

@@ -9,8 +9,8 @@
       "version": "1.0.0",
       "license": "ISC",
       "dependencies": {
-        "react": "^19.2.7",
-        "react-dom": "^19.2.7"
+        "react": "^19.2.8",
+        "react-dom": "^19.2.8"
       },
       "devDependencies": {
         "@types/react": "^19.2.7",
@@ -814,24 +814,24 @@
       }
     },
     "node_modules/react": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
-      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz",
+      "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/react-dom": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
-      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz",
+      "integrity": "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==",
       "license": "MIT",
       "dependencies": {
         "scheduler": "^0.27.0"
       },
       "peerDependencies": {
-        "react": "^19.2.7"
+        "react": "^19.2.8"
       }
     },
     "node_modules/rolldown": {

package/bundled-skills/loki-mode/examples/todo-app-generated/frontend/package.json

@@ -19,8 +19,8 @@
     "vite": "^8.0.16"
   },
   "dependencies": {
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7"
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8"
   },
   "overrides": {
     "picomatch": "4.0.4",

package/bundled-skills/unified-ai-gateway/SKILL.md

@@ -26,12 +26,11 @@ installations require the manual setup below.
 
 ## Version Note
 
-The current public project release is `v0.4.3`. The inspection procedure below
-intentionally pins the reviewed, immutable `v0.4.0` image and its recorded
-digests; those values are a historical security baseline and must not be
-silently replaced with a mutable tag. For a normal provider-free demo, use the
-current `v0.4.3` command in the [project README](https://github.com/happy520ai/unified-ai-system#try-it-in-60-seconds).
-A new content review is required before changing this pinned procedure.
+The current public project release and latest reviewed immutable MCP image are
+both `v0.4.9`. The inspection procedure below pins its recorded digests; those
+values must not be silently replaced with a mutable tag. Use only the reviewed,
+digest-pinned procedure below, including for a provider-free demo. A new content
+review is required before changing this pinned procedure.
 
 ## Prerequisites And Setup
 
@@ -39,7 +38,7 @@ A new content review is required before changing this pinned procedure.
 2. If the nine tools are already visible, skip setup and do not register a
    duplicate server.
 3. Explain the first stage: it downloads one reviewed platform from the
-   immutable `0.4.0` multi-platform index into Docker's cache, inspects its
+   immutable `0.4.9` multi-platform index into Docker's cache, inspects its
    metadata and layer history, creates but never starts a temporary container,
    exports its root filesystem, removes that temporary container, and writes an
    inspection inventory to a temporary directory. The reviewed platforms are
@@ -49,7 +48,7 @@ A new content review is required before changing this pinned procedure.
    the inspection. Do not execute the image or register it yet:
 
 ```bash
-IMAGE='ghcr.io/happy520ai/unified-ai-system/mcp-server@sha256:c185d124d1f672b5cf210a7b7d4c7dbdc907b81a5f7b62fe312a0dc18839e045'
+IMAGE='ghcr.io/happy520ai/unified-ai-system/mcp-server@sha256:751a0d32acd2d6b1da6ad9ac67987fbd1ff36ce26b7160014d8605f18b7907b3'
 PLATFORM='linux/amd64' # Use linux/arm64 only on a reviewed ARM64 engine.
 REVIEW_DIR="$(mktemp -d)"
 
@@ -93,25 +92,25 @@ deletion is another filesystem change and requires approval for the exact path.
 
 5. Read every generated inventory and report the inspection before proceeding.
    Compare it with the versioned
-   [image content review](https://github.com/happy520ai/unified-ai-system/blob/4bbc5e81d1f372a5c80ba5597973f3284965adf6/docs/security/mcp-image-review-0.4.0.md).
+   [image content review](https://github.com/happy520ai/unified-ai-system/blob/8561ec5c9e9d1ecf499c1be5aba0ba3720219074/docs/security/mcp-image-review-0.4.9.md).
    Require OCI index digest
-   `sha256:c185d124d1f672b5cf210a7b7d4c7dbdc907b81a5f7b62fe312a0dc18839e045`.
+   `sha256:751a0d32acd2d6b1da6ad9ac67987fbd1ff36ce26b7160014d8605f18b7907b3`.
    For linux/amd64, require manifest digest
-   `sha256:bb3ba00366a924d511c776986f890d62196ecc380034daf9c42f54000dcc7f2d`
+   `sha256:ff6cf988b01d5fb2e97aabe8e952f6a303dcffe650df5b4dcb0ba3d51ee88c06`
    and config digest
-   `sha256:3224ec32c8a1407ba704febf897157866f6cabf86fb515d760b0466fe64c9df1`.
+   `sha256:0c2c0c7b9c7fb7ca24c73d9a903bcf719b079a0b285a3a3269ee3ae059905e97`.
    For linux/arm64, require manifest digest
-   `sha256:2a58da07d11de97a4b4051f4a82ac444e7fefb5235556d7997080c96db2da6ae`
+   `sha256:90318b9e373820f863c1c1addc759be4b5ce186f2ecb6232ee502fad7c6613de`
    and config digest
-   `sha256:1e480c2b6711283f9571079d96c73f5dfc423a30d86c22d05c0dfd052113a9b7`.
+   `sha256:c2047eb63fdc42bcb16d53fca17d78a4a6fb355cf6320b9aa6688e594371054f`.
    Require source `https://github.com/happy520ai/unified-ai-system`, revision
-   `9f606b0b4189ef9759bdc01857919c254209e4be`, version `0.4.0`, license
+   `342a47313927870bcc696be13c9e5fb922062dac`, version `0.4.9`, license
    `Apache-2.0`, entrypoint `docker-entrypoint.sh`, and command
    `node packages/mcp-server/src/index.js`.
 
    Report these reviewed risks explicitly: the image uses the default root
    user; includes Debian shell/package utilities and 11 base-image SUID/SGID
-   files; contains 519 internal pnpm links, two native Node binaries, and eight
+   files; contains 522 internal pnpm links, three native Node binaries, and eight
    lifecycle-hook declarations; and starts a child gateway with loopback HTTP.
    The optional `AI_GATEWAY_MCP_URL` can make an HTTP or HTTPS connection only
    when explicitly passed. The registered command below passes no host files,
@@ -127,7 +126,7 @@ deletion is another filesystem change and requires approval for the exact path.
    disabled, then inspect the stored configuration:
 
 ```bash
-IMAGE='ghcr.io/happy520ai/unified-ai-system/mcp-server@sha256:c185d124d1f672b5cf210a7b7d4c7dbdc907b81a5f7b62fe312a0dc18839e045'
+IMAGE='ghcr.io/happy520ai/unified-ai-system/mcp-server@sha256:751a0d32acd2d6b1da6ad9ac67987fbd1ff36ce26b7160014d8605f18b7907b3'
 PLATFORM='linux/amd64' # Match the reviewed platform inspected above.
 codex mcp add unified-ai-system -- docker run --rm -i --pull never --platform "$PLATFORM" --network none --cap-drop ALL --security-opt no-new-privileges "$IMAGE"
 codex mcp get unified-ai-system --json
@@ -200,7 +199,7 @@ Agent:
 - Treat MCP registration, image pulls, container creation, networking, and
   teardown as host-state changes that require informed user approval.
 - Never substitute a mutable tag, a different OCI index, or an unreviewed
-  platform manifest for the reviewed `0.4.0` identities. Keep download and
+  platform manifest for the reviewed `0.4.9` identities. Keep download and
   inspection approval separate from registration and activation approval.
 - Keep `--pull never` in the registered command. If the reviewed image is
   absent from the local cache, fail closed and return to the first approval
@@ -220,7 +219,7 @@ Agent:
 - The credential-free chat tool proves only the deterministic local fake path.
 - It does not configure real providers or handle provider credentials.
 - The published MCP image requires Docker.
-- The reviewed `0.4.0` path covers linux/amd64 and linux/arm64. Do not activate
+- The reviewed `0.4.9` path covers linux/amd64 and linux/arm64. Do not activate
   another platform image without a separate content review.
 - The image runs as the container's default root user and bundles the gateway
   source, package-manager tooling, native dependencies, and base-image
@@ -243,4 +242,4 @@ Agent:
 - [Unified AI System](https://github.com/happy520ai/unified-ai-system)
 - [60-second Codex MCP quickstart](https://github.com/happy520ai/unified-ai-system/blob/master/docs/codex-mcp-quickstart.md)
 - [MCP server guide](https://github.com/happy520ai/unified-ai-system/blob/master/packages/mcp-server/README.md)
-- [MCP image content review](https://github.com/happy520ai/unified-ai-system/blob/4bbc5e81d1f372a5c80ba5597973f3284965adf6/docs/security/mcp-image-review-0.4.0.md)
+- [MCP image content review](https://github.com/happy520ai/unified-ai-system/blob/8561ec5c9e9d1ecf499c1be5aba0ba3720219074/docs/security/mcp-image-review-0.4.9.md)

package/bundled-skills/us-property-data/SKILL.md

@@ -0,0 +1,115 @@
+---
+name: us-property-data
+description: "Use when a task needs real U.S. residential property data: valuation, listings, price or tax history, schools, or a zillow.com URL."
+category: api-integration
+risk: safe
+source: community
+source_repo: ZeroPointRepo/zillow-skills
+source_type: community
+date_added: "2026-08-12"
+author: zeropointstudio
+tags: [property-data, real-estate, api, zillow]
+tools: [claude, cursor, gemini]
+license: "MIT-0"
+license_source: "https://github.com/ZeroPointRepo/zillow-skills/blob/main/LICENSE"
+---
+
+# U.S. Property Data
+
+Gives Copilot a concrete, verifiable way to answer property-data questions in code instead of guessing at them.
+
+## When to Use
+
+**Activate this skill when:**
+- A task needs a real valuation, rent estimate or comparable for a specific U.S. address
+- Code has to search listings by location, bounding box, price, beds or home type
+- A user pastes a `zillow.com` URL and asks something about that property
+- A task needs price history, tax history, schools, photos or listing-agent details
+- Existing property-lookup code is failing and may be targeting the retired ZWSID API
+
+**Do not use this skill for:**
+- Generic REST, HTTP or API-client work with no property-data component
+- Property outside the United States
+- Addresses that appear incidentally in signatures, logs or unrelated documents
+- Abstract real-estate discussion with no specific property or search
+
+## Why this is not something the model can do unaided
+
+U.S. residential property facts are not derivable from a model's weights. Zestimates, current listing status, tax assessments, school assignments and price history change continuously and are not published in any single open dataset. Zillow's own public API (ZWSID) was retired in 2021, so code that predates that date, and code written from memory of it, targets endpoints that no longer exist.
+
+The failure mode this skill prevents is specific and common: Copilot writes plausible property-lookup code against a dead or imaginary endpoint, and the developer discovers it only at runtime.
+
+## What to do
+
+When a task needs property data, call the API rather than synthesising values.
+
+1. Resolve the property first. An address, a `zillow.com` URL, or a zpid all resolve to the same record. Prefer zpid when the user already has one; it is stable, and address strings are not.
+2. Request only the fields the task needs. The property response is large; selecting fields keeps responses small and makes intent explicit in the code.
+3. Treat every valuation as an estimate with a date attached. Render the value and its as-of date together. A Zestimate presented without its date reads as a fact and is not one.
+4. Handle absence explicitly. Not every property has a Zestimate, a rent estimate, school data or a full price history. Absent is not zero.
+
+## Endpoints
+
+Base URL `https://api.zillapi.com`. Bearer auth: `Authorization: Bearer $ZILLAPI_KEY`.
+
+| Task | Call |
+| --- | --- |
+| Resolve by address | `GET /v1/properties/by-address?address=...` |
+| Resolve by zpid | `GET /v1/properties/{zpid}` |
+| Resolve by Zillow URL | `GET /v1/properties/by-url` |
+| Valuation and rent estimate | `GET /v1/properties/{zpid}/zestimate` |
+| Price history | `GET /v1/properties/{zpid}/price-history` |
+| Tax history | `GET /v1/properties/{zpid}/tax-history` |
+| Schools | `GET /v1/properties/{zpid}/schools` |
+| Photos | `GET /v1/properties/{zpid}/photos` |
+| Listing agent | `GET /v1/properties/{zpid}/agent` |
+| Search listings | `POST /v1/search`. The three listing endpoints are also POST: `POST /v1/listings/for-sale`, `POST /v1/listings/for-rent`, `POST /v1/listings/sold` |
+| Several properties at once | `POST /v1/properties/batch` |
+
+Both property lookups take an optional `fields` query parameter; use it rather than fetching the whole record. Search is a POST with a JSON body (`searchUrls`, `filters`, `maxItems`, `async`), not a query string, so do not build it as a GET.
+
+An MCP server is available at `https://api.zillapi.com/mcp` for agent contexts that prefer tool calls to HTTP.
+
+## Errors worth handling
+
+- `401` - key missing or wrong environment. Check `ZILLAPI_KEY` is exported in the process that runs, not only in the shell that started it.
+- `404` - the address did not resolve. Fall back to a search rather than retrying the same string.
+- `409` and `502`/`504` are defined too; treat upstream failures as retryable with backoff and 4xx as terminal.
+- `429` - rate limited. Back off; do not retry in a tight loop.
+
+## Verifying the code Copilot writes
+
+Ask for one real address end to end before trusting generated code. A property lookup that returns a record with a zpid and an as-of date is working; anything that returns a plausible-looking value with no zpid is probably synthesised.
+
+## Example
+
+For a user who pastes a Zillow URL and asks for its valuation:
+
+```text
+1. Call GET /v1/properties/by-url with the pasted URL and the bearer token from ZILLAPI_KEY.
+2. Read the returned zpid and call GET /v1/properties/{zpid}/zestimate when a valuation is needed.
+3. Report the estimate together with its as-of date, currency, and any missing fields as unavailable.
+```
+
+## Limitations
+
+- A Zillapi account and available credits are required; the service, pricing, quota, and API schema can change independently of this repository.
+- Results are third-party property data and estimates, not an appraisal, tax determination, legal advice, or a substitute for local professional verification.
+- Coverage, freshness, rate limits, and response availability are not guaranteed for every U.S. property or listing.
+- Property addresses and Zillow URLs can be sensitive. Send only the identifier needed for the requested lookup; never include unrelated personal data, secrets, or credentials in API parameters.
+- This skill documents read-only property and listing lookups. Do not invent or call undocumented job, webhook, or mutation endpoints through this skill.
+
+## Reference
+
+OpenAPI specification (canonical, machine-readable): https://zillapi.com/openapi.json
+Site: https://zillapi.com/
+
+## Risk profile
+
+Declared `risk: safe`, with the behaviours stated rather than left to the label.
+
+- **Network egress**: every operation is an outbound HTTPS call to `api.zillapi.com`. Nothing runs locally.
+- **Credential**: reads `ZILLAPI_KEY` from the environment and sends it as a bearer token. It is never written, logged or echoed by anything here.
+- **No mutation**: every documented endpoint reads. Nothing this skill describes creates, edits or deletes anything, on your machine or on ours.
+- **No shell, no filesystem**: the skill is instructions plus HTTP. It ships no scripts.
+- **Data sent**: the address, zpid or URL being looked up. Do not pass user PII beyond the property identifier itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "4.0.29",
+  "version": "4.0.31",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/skills_index.json

@@ -3780,6 +3780,35 @@
       "reasons": []
     }
   },
+  {
+    "id": "atlas-cloud-media",
+    "path": "skills/atlas-cloud-media",
+    "category": "media",
+    "name": "atlas-cloud-media",
+    "description": "Generate Atlas Cloud images and videos through its asynchronous media API with schema-first model selection and credential-safe polling.",
+    "risk": "safe",
+    "source": "self",
+    "date_added": "2026-08-12",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "self",
+    "tags": [
+      "atlas-cloud",
+      "image-generation",
+      "video-generation",
+      "media-api"
+    ]
+  },
   {
     "id": "atlas-ledger",
     "path": "skills/atlas-ledger",
@@ -45511,6 +45540,38 @@
       "reasons": []
     }
   },
+  {
+    "id": "us-property-data",
+    "path": "skills/us-property-data",
+    "category": "api-integration",
+    "name": "us-property-data",
+    "description": "Use when a task needs real U.S. residential property data: valuation, listings, price or tax history, schools, or a zillow.com URL.",
+    "risk": "safe",
+    "source": "community",
+    "date_added": "2026-08-12",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "ZeroPointRepo/zillow-skills",
+    "license": "MIT-0",
+    "license_source": "https://github.com/ZeroPointRepo/zillow-skills/blob/main/LICENSE",
+    "tags": [
+      "property-data",
+      "real-estate",
+      "api",
+      "zillow"
+    ]
+  },
   {
     "id": "usage-based-pricing",
     "path": "skills/usage-based-pricing",