opencode-skills-collection 4.0.47 → 4.0.49

package/bundled-skills/liuguang-banlan-ui/scripts/manifest_parser.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""Parse the data-only subset used by Liuguang theme manifests."""
+
+from __future__ import annotations
+
+import json
+import pathlib
+import re
+from dataclasses import dataclass
+
+
+MAX_MANIFEST_BYTES = 256 * 1024
+MAX_NESTING_DEPTH = 64
+
+
+class ManifestSyntaxError(ValueError):
+    """Raised when a manifest contains code or unsupported JavaScript syntax."""
+
+
+@dataclass(frozen=True)
+class Token:
+    kind: str
+    value: str
+    offset: int
+
+
+TOKEN_RE = re.compile(
+    r"""
+    (?P<whitespace>\s+)
+  | (?P<line_comment>//[^\r\n]*)
+  | (?P<block_comment>/\*.*?\*/)
+  | (?P<string>"(?:\\["\\/bfnrt]|\\u[0-9A-Fa-f]{4}|[^"\\\x00-\x1f])*")
+  | (?P<number>-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?)
+  | (?P<identifier>[A-Za-z_$][A-Za-z0-9_$]*)
+  | (?P<punctuation>[{}\[\]:,;=.])
+    """,
+    re.VERBOSE | re.DOTALL,
+)
+
+
+def tokenize(source: str) -> list[Token]:
+    tokens: list[Token] = []
+    offset = 0
+    while offset < len(source):
+        match = TOKEN_RE.match(source, offset)
+        if match is None:
+            raise ManifestSyntaxError(f"unsupported syntax at byte offset {offset}")
+        kind = match.lastgroup
+        if kind not in {"whitespace", "line_comment", "block_comment"}:
+            tokens.append(Token(kind or "unknown", match.group(0), offset))
+        offset = match.end()
+    tokens.append(Token("eof", "", len(source)))
+    return tokens
+
+
+class Parser:
+    def __init__(self, source: str) -> None:
+        self.tokens = tokenize(source)
+        self.index = 0
+
+    @property
+    def current(self) -> Token:
+        return self.tokens[self.index]
+
+    def take(self, value: str | None = None, kind: str | None = None) -> Token:
+        token = self.current
+        if value is not None and token.value != value:
+            raise ManifestSyntaxError(
+                f"expected {value!r} at byte offset {token.offset}, found {token.value!r}"
+            )
+        if kind is not None and token.kind != kind:
+            raise ManifestSyntaxError(
+                f"expected {kind} at byte offset {token.offset}, found {token.value!r}"
+            )
+        self.index += 1
+        return token
+
+    def accept(self, value: str) -> bool:
+        if self.current.value != value:
+            return False
+        self.index += 1
+        return True
+
+    def parse(self) -> dict:
+        self.take("window")
+        self.take(".")
+        self.take("SPECTRAL_THEME")
+        self.take("=")
+        value = self.parse_value(0)
+        self.accept(";")
+        self.take(kind="eof")
+        if not isinstance(value, dict):
+            raise ManifestSyntaxError("SPECTRAL_THEME must be an object")
+        return value
+
+    def parse_value(self, depth: int):
+        if depth > MAX_NESTING_DEPTH:
+            raise ManifestSyntaxError("manifest nesting limit exceeded")
+        token = self.current
+        if token.value == "{":
+            return self.parse_object(depth + 1)
+        if token.value == "[":
+            return self.parse_array(depth + 1)
+        if token.kind == "string":
+            self.index += 1
+            return json.loads(token.value)
+        if token.kind == "number":
+            self.index += 1
+            try:
+                return (
+                    float(token.value)
+                    if any(mark in token.value for mark in ".eE")
+                    else int(token.value)
+                )
+            except ValueError as error:
+                raise ManifestSyntaxError("numeric literal exceeds the supported range") from error
+        if token.kind == "identifier" and token.value in {"true", "false", "null"}:
+            self.index += 1
+            return {"true": True, "false": False, "null": None}[token.value]
+        raise ManifestSyntaxError(
+            f"only data literals are allowed at byte offset {token.offset}; found {token.value!r}"
+        )
+
+    def parse_object(self, depth: int) -> dict:
+        result: dict = {}
+        self.take("{")
+        if self.accept("}"):
+            return result
+        while True:
+            token = self.current
+            if token.kind == "identifier":
+                key = self.take(kind="identifier").value
+            elif token.kind == "string":
+                key = json.loads(self.take(kind="string").value)
+            else:
+                raise ManifestSyntaxError(
+                    f"object keys must be identifiers or strings at byte offset {token.offset}"
+                )
+            if key in result:
+                raise ManifestSyntaxError(f"duplicate object key: {key}")
+            self.take(":")
+            result[key] = self.parse_value(depth)
+            if self.accept("}"):
+                return result
+            self.take(",")
+            if self.accept("}"):
+                return result
+
+    def parse_array(self, depth: int) -> list:
+        result: list = []
+        self.take("[")
+        if self.accept("]"):
+            return result
+        while True:
+            result.append(self.parse_value(depth))
+            if self.accept("]"):
+                return result
+            self.take(",")
+            if self.accept("]"):
+                return result
+
+
+def parse_manifest(source: str) -> dict:
+    return Parser(source).parse()
+
+
+def load_manifest(path: pathlib.Path) -> dict:
+    with path.open("rb") as manifest:
+        raw = manifest.read(MAX_MANIFEST_BYTES + 1)
+    if len(raw) > MAX_MANIFEST_BYTES:
+        raise ManifestSyntaxError(
+            f"manifest exceeds the {MAX_MANIFEST_BYTES}-byte size limit"
+        )
+    try:
+        source = raw.decode("utf-8-sig")
+    except UnicodeDecodeError as error:
+        raise ManifestSyntaxError("manifest must be valid UTF-8") from error
+    return parse_manifest(source)

package/bundled-skills/liuguang-banlan-ui/scripts/measure_preview.py

@@ -6,9 +6,10 @@ from __future__ import annotations
 import argparse
 import json
 import pathlib
-import subprocess
 import sys
 
+from manifest_parser import ManifestSyntaxError, load_manifest
+
 try:
     import numpy as np
     from PIL import Image
@@ -29,21 +30,6 @@ except ModuleNotFoundError as exc:
     raise SystemExit(2)
 
 
-def load_config(path: pathlib.Path) -> dict:
-    source = (
-        "global.window={};require(require('path').resolve(process.argv[1]));"
-        "process.stdout.write(JSON.stringify(window.SPECTRAL_THEME));"
-    )
-    result = subprocess.run(
-        ["node", "-e", source, str(path)],
-        check=True,
-        capture_output=True,
-        text=True,
-        encoding="utf-8",
-    )
-    return json.loads(result.stdout)
-
-
 def srgb_to_oklab(rgb: np.ndarray) -> tuple[np.ndarray, np.ndarray]:
     linear = np.where(
         rgb <= 0.04045,
@@ -129,7 +115,18 @@ def main() -> None:
     parser.add_argument("--image", required=True, type=pathlib.Path)
     parser.add_argument("--config", required=True, type=pathlib.Path)
     args = parser.parse_args()
-    config = load_config(args.config.resolve())
+    try:
+        config = load_manifest(args.config.resolve())
+    except (ManifestSyntaxError, OSError) as error:
+        print(
+            json.dumps(
+                {"status": "invalid", "errors": [str(error)]},
+                ensure_ascii=False,
+                indent=2,
+            ),
+            file=sys.stderr,
+        )
+        raise SystemExit(1) from error
     payload = {
         "schemaVersion": "1.0",
         "theme": config["label"],

package/bundled-skills/liuguang-banlan-ui/scripts/validate_manifest.py

@@ -8,23 +8,9 @@ import json
 import math
 import pathlib
 import re
-import subprocess
 import sys
 
-
-def load_manifest(path: pathlib.Path) -> dict:
-    program = (
-        "global.window={};require(require('path').resolve(process.argv[1]));"
-        "process.stdout.write(JSON.stringify(window.SPECTRAL_THEME));"
-    )
-    result = subprocess.run(
-        ["node", "-e", program, str(path)],
-        check=True,
-        capture_output=True,
-        text=True,
-        encoding="utf-8",
-    )
-    return json.loads(result.stdout)
+from manifest_parser import ManifestSyntaxError, load_manifest
 
 
 def require(condition: bool, message: str, errors: list[str]) -> None:
@@ -161,7 +147,17 @@ def main() -> None:
     parser = argparse.ArgumentParser()
     parser.add_argument("config", type=pathlib.Path)
     args = parser.parse_args()
-    config = load_manifest(args.config.resolve())
+    try:
+        config = load_manifest(args.config.resolve())
+    except (ManifestSyntaxError, OSError) as error:
+        print(
+            json.dumps(
+                {"status": "invalid", "errors": [str(error)]},
+                ensure_ascii=False,
+                indent=2,
+            )
+        )
+        raise SystemExit(1) from error
     errors = validate(config)
     if errors:
         print(json.dumps({"status": "invalid", "errors": errors}, ensure_ascii=False, indent=2))

package/bundled-skills/lovable-cleanup/SKILL.md

@@ -1,13 +1,15 @@
 ---
 name: lovable-cleanup
-description: "Audits and strips Lovable scaffolding from Vite + React projects — removes lovable-tagger, swaps placeholder assets, prunes unused Radix deps, and cleans generated docs so the codebase ships as yours."
+description: "Audits and strips Lovable scaffolding from Vite + React projects — removes lovable-tagger, swaps placeholder assets, prunes unused Radix deps, cleans generated docs, and neutralizes stale favicon/CDN caching so the codebase ships as yours."
 risk: safe
 source: community
 source_repo: whoisabhishekadhikari/lovable-cleanup
 source_type: community
 author: whoisabhishekadhikari
 date_added: "2026-06-13"
-tags: [lovable, cleanup, vite, react, shadcn, devtools]
+date_updated: "2026-08-31"
+version: "2.0.0"
+tags: [lovable, cleanup, vite, react, shadcn, devtools, vercel, favicon]
 tools: [claude, cursor, codex, antigravity, gemini-cli]
 ---
 
@@ -23,7 +25,7 @@ tools: [claude, cursor, codex, antigravity, gemini-cli]
 Lovable (lovable.dev) bootstraps Vite + React + shadcn/ui projects with its own tagger
 dependency, branding, placeholder assets, and generated markdown docs baked in. Most
 developers export from Lovable and want a clean, ownable codebase before shipping or
-open-sourcing. This skill covers all 14 areas where Lovable leaves fingerprints.
+open-sourcing. This skill covers all 15 areas where Lovable leaves fingerprints.
 
 ---
 
@@ -75,6 +77,8 @@ shadcn components via the `asChild` prop.
 6. Environment & Git (Areas 9 & 12) — security sweep
 7. SEO / deploy (Area 11) — usually a no-op; confirm and move on
 8. Unused deps (Area 13) — safe to defer until after ship if on a deadline
+9. Favicon / CDN cache (Area 15) — do ASAP after assets are swapped; browser
+   or CDN caching can keep the old icon visible, so verify the live response
 
 ---
 
@@ -137,7 +141,7 @@ Replace these files (keep filenames, swap content):
 
 | File | Action |
 |---|---|
-| `favicon.ico` | Replace with real icon |
+| `favicon.ico` | Overwrite with real icon — do NOT just delete, see Area 15 |
 | `favicon.png` | Replace with real icon |
 | `og-image.png` / `logo.png` | Replace with real brand assets |
 | `placeholder.svg` | Usually unused — safe to delete |
@@ -292,6 +296,17 @@ grep -in "lovable" components.json eslint.config.js
 
 ---
 
+### Area 15 · Favicon removal & stale CDN caches (Vercel)
+
+Lovable ships a default `favicon.ico` that browsers auto-request from site root
+and that can remain visible after cleanup through browser or CDN caching. Handle
+the four steps — replace the path, link all icon flavours, keep unversioned icon
+URLs revalidatable, and verify after deploy — then purge the confirmed Vercel
+project cache only if the live response stays stale. Full commands/JSON live in
+[references/favicon-vercel-cleanup.md](references/favicon-vercel-cleanup.md).
+
+---
+
 ## Master Scan Command
 
 <!-- security-allowlist: recursive grep across project directory, read-only, no network -->
@@ -342,6 +357,9 @@ Agent:
 - ✅ **Do:** Run dep removal (Areas 2 & 7) before touching source files
 - ✅ **Do:** Skim Lovable-generated docs before deleting — may contain useful arch notes
 - ✅ **Do:** Verify `npm run build` passes after every batch of changes
+- ✅ **Do:** Replace favicons at the existing paths (Area 15), then verify the
+  live response and purge only the confirmed project if it remains stale
+- ✅ **Do:** Deploy replacement favicon content and cache headers in the same commit
 - ✅ **Do:** Replace OG image before launch — it directly affects social sharing previews
 - ❌ **Don't:** Remove `@radix-ui/react-slot` — it's an indirect dep of most shadcn components
 - ❌ **Don't:** Leave empty env vars like `LOVABLE_PROJECT_ID=` — delete the whole line
@@ -350,8 +368,8 @@ Agent:
 
 ## Limitations
 
-- This skill does not create or source brand assets (favicons, OG images) — it only flags
-  what needs replacing. The user must supply real assets.
+- This skill does not create or source real brand assets (favicons, OG images). Area 15
+  generates a transparent placeholder ICO only — the user must supply genuine artwork.
 - Dep pruning (Area 13) is safe but not foolproof — some Radix packages are indirect deps
   not caught by a direct `grep`. Always verify with `npm run build`.
 - The skill does not modify `components.json` aliases automatically — it only scans and
@@ -380,6 +398,14 @@ the `from '@radix-ui/...'` import to find which component depends on it.
 **Solution:** Check for a `<Helmet>` or `<Head>` component in `src/App.tsx` or a layout
 wrapper — React-level title tags override `index.html` at runtime.
 
+### Problem: Old favicon still serving after deletion (Vercel)
+
+**Symptoms:** `curl -sI https://<domain>/favicon.ico` returns the old ETag with
+`x-vercel-cache: HIT` after the replacement deployment.
+**Solution:** Overwrite `public/favicon.ico` with replacement content (a transparent
+1×1 ICO if no real asset yet), verify the custom domain, then use the explicit
+Vercel CDN purge only if the response remains stale — see Area 15.
+
 ---
 
 ## Related Skills

package/bundled-skills/lovable-cleanup/references/favicon-vercel-cleanup.md

@@ -0,0 +1,106 @@
+# Favicon removal & stale CDN caches (Vercel)
+
+Lovable ships a default `favicon.ico`, and browsers auto-request it from site
+root even when `index.html` links a different icon. Browser and CDN layers can
+therefore keep showing the old icon after a replacement deployment. Treat the
+cleanup as both a file-path and cache-verification problem.
+
+## 1 · Overwrite in place, don't delete
+
+Prefer replacing the same path in the deployment instead of deleting it. The
+production URL then keeps returning a valid icon while the new bytes establish
+a new content identity; browsers that request `/favicon.ico` implicitly do not
+fall back to an old cached asset merely because the HTML link changed.
+
+If no real brand icon is ready, use the bundled helper to write a valid
+transparent 1×1 ICO. It resolves the physical project root, rejects a symlinked
+`public/` directory or favicon target, writes an exclusive same-directory
+temporary file with no-follow semantics where available, then atomically
+renames it into place.
+
+<!-- security-allowlist: writes a 70-byte ICO into the project's public/, local only -->
+```bash
+node "<skill-dir>/scripts/write-transparent-favicon.js" "$PWD"
+```
+
+## 2 · Link all icon flavours in `index.html`
+
+Browsers may request `/favicon.ico` even without a link, so keep that path and
+the modern/Apple entry points available:
+
+```html
+<link rel="icon" type="image/x-icon" href="/favicon.ico" />
+<link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+```
+
+`apple-touch-icon.png` must be a real PNG (recommended 180×180). A solid brand-
+colour square is an acceptable placeholder; flag it for later replacement.
+
+## 3 · Keep unversioned icon URLs revalidatable (`vercel.json`)
+
+Vercel documents `public, max-age=0, must-revalidate` as its default response
+policy and recommends long-lived `immutable` caching for content-hashed assets.
+The standard favicon entry points below are not content-hashed, so keep them
+revalidatable unless the HTML points at a versioned filename:
+
+- `/favicon.ico`, `/favicon.svg`, `/apple-touch-icon.png` →
+  `public, max-age=0, must-revalidate`
+- A content-hashed asset such as `/favicon-a1b2c3.svg` may use
+  `public, max-age=31536000, immutable`.
+
+```json
+{
+  "headers": [
+    {
+      "source": "/favicon.ico",
+      "headers": [{ "key": "Cache-Control", "value": "public, max-age=0, must-revalidate" }]
+    },
+    {
+      "source": "/favicon.svg",
+      "headers": [{ "key": "Cache-Control", "value": "public, max-age=0, must-revalidate" }]
+    },
+    {
+      "source": "/apple-touch-icon.png",
+      "headers": [{ "key": "Cache-Control", "value": "public, max-age=0, must-revalidate" }]
+    }
+  ]
+}
+```
+
+Never mark an unversioned icon URL `immutable`: it tells browsers not to
+revalidate for the max-age lifetime, so a replacement may not propagate for up
+to a year. Use `immutable` only on content-hashed URLs.
+
+## 4 · Verify after deploy
+
+<!-- security-allowlist: remote curl header check of own domain, read-only -->
+```bash
+curl -sI https://YOUR-DOMAIN/favicon.ico \
+  | grep -i "cache-control\|etag\|x-vercel-cache"
+```
+
+Expect the replacement ETag and `Cache-Control: public, max-age=0,
+must-revalidate` on the unversioned icon URLs.
+
+If the confirmed production domain still serves the old edge response, verify
+the linked Vercel project and team first, ask for explicit approval, then purge
+that project's CDN cache:
+
+<!-- security-allowlist: explicit remote cache purge for the confirmed Vercel project; requires user approval -->
+```bash
+vercel cache purge --type cdn
+```
+
+Re-run the header check after the purge. Do not purge a project inferred only
+from the current directory or a preview URL.
+
+**Gotcha — the staging URL:** a `*.vercel.app` preview may be SSO-protected
+(`_vercel_sso_nonce` 302) and wrap deploys in a provider frame that injects
+platform branding. Always verify icons on the real custom domain.
+
+## Official references
+
+- [Vercel Cache-Control headers](https://vercel.com/docs/caching/cache-control-headers)
+- [Vercel CDN cache](https://vercel.com/docs/caching/cdn-cache)
+- [Vercel cache purge CLI](https://vercel.com/docs/cli/cache)

package/bundled-skills/lovable-cleanup/scripts/write-transparent-favicon.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+"use strict";
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+
+function fail(message) {
+  throw new Error(`Refusing favicon write: ${message}`);
+}
+
+function existingStat(target) {
+  try {
+    return fs.lstatSync(target);
+  } catch (error) {
+    if (error && error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function transparentIco() {
+  const bytes = Buffer.alloc(6 + 16 + 40 + 8);
+  bytes.writeUInt16LE(1, 2);
+  bytes.writeUInt16LE(1, 4);
+  bytes.writeUInt8(1, 6);
+  bytes.writeUInt8(1, 7);
+  bytes.writeUInt16LE(1, 10);
+  bytes.writeUInt16LE(32, 12);
+  bytes.writeUInt32LE(40 + 8, 14);
+  bytes.writeUInt32LE(22, 18);
+  bytes.writeUInt32LE(40, 22);
+  bytes.writeInt32LE(1, 26);
+  bytes.writeInt32LE(2, 30);
+  bytes.writeUInt16LE(1, 34);
+  bytes.writeUInt16LE(32, 36);
+  bytes.writeUInt32LE(0, 38);
+  bytes.writeUInt32LE(8, 42);
+  return bytes;
+}
+
+function main() {
+  const requestedRoot = path.resolve(process.argv[2] || process.cwd());
+  const projectRoot = fs.realpathSync(requestedRoot);
+  const publicDirectory = path.join(projectRoot, "public");
+  const publicStat = fs.lstatSync(publicDirectory);
+  if (publicStat.isSymbolicLink() || !publicStat.isDirectory()) {
+    fail("public/ must be a real directory, not a symlink or special file");
+  }
+  if (fs.realpathSync(publicDirectory) !== publicDirectory) {
+    fail("public/ resolves outside the physical project path");
+  }
+
+  const target = path.join(publicDirectory, "favicon.ico");
+  const targetStat = existingStat(target);
+  if (targetStat && targetStat.isSymbolicLink()) {
+    fail("public/favicon.ico is a symbolic link");
+  }
+  if (targetStat && !targetStat.isFile()) {
+    fail("public/favicon.ico is not a regular file");
+  }
+
+  const temporary = path.join(
+    publicDirectory,
+    `.favicon.ico.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`,
+  );
+  const flags =
+    fs.constants.O_WRONLY |
+    fs.constants.O_CREAT |
+    fs.constants.O_EXCL |
+    (fs.constants.O_NOFOLLOW || 0);
+  let descriptor;
+  try {
+    descriptor = fs.openSync(temporary, flags, 0o600);
+    fs.writeFileSync(descriptor, transparentIco());
+    fs.fsyncSync(descriptor);
+    fs.fchmodSync(descriptor, 0o644);
+    fs.closeSync(descriptor);
+    descriptor = undefined;
+    fs.renameSync(temporary, target);
+  } finally {
+    if (descriptor !== undefined) fs.closeSync(descriptor);
+    const temporaryStat = existingStat(temporary);
+    if (temporaryStat && temporaryStat.isFile()) fs.unlinkSync(temporary);
+  }
+  process.stdout.write(`Wrote ${target}\n`);
+}
+
+main();

package/bundled-skills/multi-source-search/scripts/validate_report.py

@@ -21,6 +21,11 @@ def canonical_url(value):
     """Return a conservative identity for an HTTP(S) URL, or None if invalid."""
     if not nonempty(value):
         return None
+    if any(
+        character.isspace() or ord(character) < 0x20 or ord(character) == 0x7F
+        for character in value
+    ):
+        return None
     try:
         parsed = urlsplit(value)
         hostname = parsed.hostname

package/bundled-skills/omp-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: omp-delegate
 description: Delegate coding tasks to Oh My Pi (`omp`) only when the user explicitly
   requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/opencode-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: opencode-delegate
 description: Delegate coding tasks to the OpenCode CLI only when the user explicitly
   requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/pentest-tools/references/pentest-ai-agents-matrix.md

@@ -10,11 +10,14 @@
 
 ## 安装方式（外部可选）
 
-```bash
-curl -fsSL https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/main/install.sh | bash  # security-allowlist: curl-pipe-bash
-```
-
-或者只参考其 prompt 模式，不实际安装。
+默认只参考其 prompt 模式，不安装外部代码。不得从可变的 `main` 分支
+下载并直接执行安装脚本，也不得把下载内容通过管道交给 shell。
+
+如果用户明确要求安装，先在仓库页面选择并记录一个完整的 40 位 commit
+SHA，在私有审查目录中下载该 commit 的完整源码，核对仓库身份、许可证、
+文件清单、安装脚本及其后续下载。只有在展示确切变更和命令并获得单独批准
+后，才可从已审查的本地副本执行；任一依赖仍指向分支、标签、`latest` 或未审查
+远程脚本时必须停止。
 
 ---
 

package/bundled-skills/pi-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-delegate
 description: Delegate coding tasks to the Pi coding agent CLI (`pi`) only when the
   user explicitly requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/prompt-caching/SKILL.md

@@ -34,7 +34,7 @@ Caching strategies for LLM prompts including Anthropic prompt caching, response
 ### Primary_tools
 
 - Anthropic Prompt Caching - Native prompt caching in Claude API
-- Redis - In-memory cache for responses
+- Redis - In-memory cache for responses (ioredis on servers; @upstash/redis over HTTP on serverless, see `upstash-redis`)
 - OpenAI Caching - Automatic caching in OpenAI API
 
 ## Patterns
@@ -91,6 +91,8 @@ import { createHash } from 'crypto';
 import Redis from 'ioredis';
 
 const redis = new Redis(process.env.REDIS_URL);
+// Serverless/edge alternative without a persistent connection:
+// import { Redis } from '@upstash/redis'; const redis = Redis.fromEnv();  // then use redis.set(key, value, { ex: ttl })
 
 class ResponseCache {
     private ttl = 3600;  // 1 hour default

package/bundled-skills/qoder-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: qoder-delegate
 description: Delegate coding tasks to the Qoder CLI (`qodercli`) only when the user
   explicitly requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills