opencode-skills-collection 4.0.47 → 4.0.49

package/bundled-skills/upstash-redis/SKILL.md

@@ -0,0 +1,156 @@
+---
+name: upstash-redis
+description: "Use the @upstash/redis HTTP client for caching, sessions, counters, and Redis data structures from serverless and edge runtimes without connection pooling."
+category: backend
+risk: critical
+source: self
+source_type: self
+date_added: "2026-08-31"
+author: CahidArda
+tags: [upstash, redis, cache, serverless, edge, key-value]
+tools: [claude, codex, cursor, gemini]
+---
+
+# Upstash Redis
+
+## Overview
+
+`@upstash/redis` is a Redis client that talks to an Upstash Redis database over
+HTTPS instead of a TCP connection. Because every command is a stateless HTTP
+request, it works in environments where a pooled TCP client is awkward or
+impossible: Vercel and Netlify functions, Cloudflare Workers, Deno, Bun, and
+Next.js middleware. The client serializes and deserializes JavaScript values
+automatically, so numbers and objects round-trip without manual `JSON.parse`.
+
+## When to Use This Skill
+
+- Use when the user needs a cache, session store, counter, leaderboard, or
+  simple queue from a serverless or edge function.
+- Use when the user mentions Upstash Redis, `UPSTASH_REDIS_REST_URL`, or
+  `@upstash/redis`.
+- Use when migrating an `ioredis` or `node-redis` call site to a runtime that
+  cannot hold a persistent TCP socket.
+- Do not use for a self-hosted or non-Upstash Redis server; the client only
+  speaks the Upstash REST protocol. Use `ioredis` or `node-redis` there.
+- Do not use for Redis administration or CLI work; see `redis-cli`.
+
+## How It Works
+
+### Step 1: Configure credentials
+
+Create a database in the Upstash console and copy the REST URL and token into
+environment variables. Never hardcode them.
+
+```bash
+UPSTASH_REDIS_REST_URL=https://<your-db>.upstash.io
+UPSTASH_REDIS_REST_TOKEN=<your-rest-token>
+```
+
+### Step 2: Create one client per module
+
+```typescript
+import { Redis } from "@upstash/redis";
+
+export const redis = Redis.fromEnv();
+```
+
+On Cloudflare Workers, import from `@upstash/redis/cloudflare` and pass the
+worker `env` object: `Redis.fromEnv(env)`.
+
+### Step 3: Call Redis commands as methods
+
+Command names are lowercase methods (`get`, `set`, `hset`, `zadd`, `incr`).
+Values are auto-serialized; pass and receive native JavaScript types.
+
+## Examples
+
+### Example 1: Cache-aside with a TTL
+
+```typescript
+import { Redis } from "@upstash/redis";
+
+const redis = Redis.fromEnv();
+
+export async function getUser(id: string) {
+  const cached = await redis.get<{ id: string; name: string }>(`user:${id}`);
+  if (cached) return cached;
+
+  const user = await db.users.findById(id);
+  await redis.set(`user:${id}`, user, { ex: 3600 }); // expires in 1 hour
+  return user;
+}
+
+export async function invalidateUser(id: string) {
+  await redis.del(`user:${id}`);
+}
+```
+
+### Example 2: Batch commands in a pipeline
+
+```typescript
+const pipeline = redis.pipeline();
+pipeline.hset("user:1", { name: "Alice", plan: "pro" });
+pipeline.incr("signups:total");
+pipeline.zadd("leaderboard", { score: 120, member: "user:1" });
+const [hsetResult, signups, zaddResult] = await pipeline.exec();
+```
+
+`pipeline()` batches independent commands into one round trip. It is not
+atomic; use `redis.multi()` for MULTI/EXEC or a reviewed server-side Lua script
+when commands must run as one unit.
+
+## Best Practices
+
+- ✅ Read credentials with `Redis.fromEnv()` or from a secrets manager.
+- ✅ Set a TTL (`{ ex: seconds }`) on cache entries so stale data expires.
+- ✅ Namespace keys (`user:123`, `session:abc`) to keep the keyspace readable.
+- ✅ Use `pipeline()` or `mget`/`mset` instead of many sequential awaits.
+- ❌ Don't `JSON.stringify` values before `set`; the client already does it.
+- ❌ Don't call `keys("*")` in request handlers; use `scan` for large keyspaces.
+- ❌ Don't store secrets or PII in Redis without a retention plan and TTL.
+
+## Limitations
+
+- Requires an Upstash Redis database; it cannot connect to other Redis servers.
+- Each command is an HTTP request, so latency is higher than a warm TCP
+  connection; batch with pipelines where it matters.
+- Transactions (`multi()`) do not roll back on runtime errors, and `WATCH` is
+  not available over REST; use a Lua script for atomic check-and-set.
+- Pub/Sub subscribe and blocking commands (`BLPOP`, `XREAD BLOCK`) are not
+  supported over the REST client.
+- This skill covers the TypeScript client only. Python, Go, and other SDKs
+  differ in method names.
+- This skill does not replace environment-specific validation, testing, or
+  expert review.
+
+## Security & Safety Notes
+
+- The REST token grants full read/write access to the database. Keep it in
+  server-side environment variables; never ship it to a browser bundle.
+- Use a read-only token from the console for read-only workloads.
+- Commands such as `flushdb` and `del` are destructive; confirm with the user
+  before running them against a production database.
+
+## Common Pitfalls
+
+- **Problem:** `get` returns `null` in production but works locally.
+  **Solution:** The deployment is missing `UPSTASH_REDIS_REST_URL` or
+  `UPSTASH_REDIS_REST_TOKEN`; check the platform's environment settings.
+- **Problem:** A number comes back as a string after `incr` on a value set
+  with `JSON.stringify`.
+  **Solution:** Store the raw number (`redis.set("n", 1)`) and let the client
+  serialize it.
+
+## Related Skills
+
+- `@upstash-ratelimit` - Rate limiting built on this client.
+- `@upstash-qstash` - HTTP message queue and schedules when you need delivery
+  guarantees rather than a data store.
+- `@redis-cli` - Inspecting and administering Redis from the command line.
+- `@bullmq-specialist` - Job queues on a TCP Redis you operate yourself.
+
+## Additional Resources
+
+- [Upstash Redis documentation](https://upstash.com/docs/redis)
+- [@upstash/redis on GitHub](https://github.com/upstash/redis-js)
+- [TypeScript SDK reference](https://upstash.com/docs/redis/sdks/ts/overview)

package/bundled-skills/verify-citations/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: verify-citations
+description: Verify citations and references in a document, report, or article against real sources. Use when the user asks to fact-check, verify references, check citations, or validate evidence in research reports, tender responses, whitepapers, or academic writing.
+category: document-verification
+risk: critical
+source: community
+source_repo: Sketchjar/stipple-agent-skills
+source_type: community
+date_added: "2026-08-31"
+author: Sketchjar
+tags: [document-verification, fact-checking, stipple, authenticity]
+tools: [claude, cursor, gemini, codex]
+license: "Apache-2.0"
+license_source: "https://github.com/Sketchjar/stipple-agent-skills/blob/main/LICENSE"
+---
+
+# Citation Verification
+
+Verify that citations in a document actually resolve and support the claims they're attached to. Uses the Stipple API (free anonymous tier, no signup) for citation resolution, arithmetic recomputation, and unsupported-claim detection.
+
+## When to use
+
+- Before submitting or publishing a research report, tender response, or whitepaper
+- Reviewing an LLM-generated document (LLM citations are plausibly-formatted and frequently wrong)
+- Due diligence on third-party reports
+- Academic reference checking
+
+## Instructions
+
+1. **Get the document.** Ask the user for a URL to the report, or a local file path (PDF, DOCX, Markdown). If the user pastes text directly, skip to step 3 with `text` input.
+
+2. **Run verification.** POST the document to Stipple's citation verification endpoint:
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/verify-references \
+     -F "file=@report.pdf" \
+     -H "Authorization: Bearer $STIPPLE_API_KEY"
+   ```
+
+   The anonymous free tier works without the Authorization header. Deep mode (`?deep=true`) costs more credits but cross-checks citations against live web sources.
+
+3. **Interpret the response.** The result includes:
+   - `verification_coverage` — percentage of claims verified (e.g. "78%")
+   - `citations[]` — per-citation status: resolved and matching, resolved but mismatched, or unresolvable, with the issue explained
+   - `arithmetic[]` — recomputed figures vs stated figures (flags decimal shifts, wrong sums)
+   - `unsupported_claims[]` — claims with no citation at all
+
+4. **Report honestly.** Present results as *verification coverage*, not a truth verdict:
+   - "21/27 citations resolve and match"
+   - "[x] FY24+FY25 revenue stated $4.2m, actual $3.7m"
+   - "[!] 'industry-leading accuracy' — no source in document"
+   - Unverified ≠ false. The goal is telling the user *which* claims are backed and which aren't.
+
+5. **Offer remediation.** For failed citations, suggest: fixing the decimal shift, finding the correct source, or removing the unsupported claim.
+
+## Output format
+
+```
+Verification coverage: 78%
+
+Citations: 21/27 resolve and match
+  [+] "ABS unemployment 4.1% April 2026" — matches abs.gov.au
+  [-] "AI adoption grew 340% in 2025" — source states 34%, decimal shifted
+
+Arithmetic: 12/13 recompute correctly
+  [x] FY24 + FY25 revenue — stated $4.2m, actual $3.7m
+
+Unsupported claims: 2
+  [!] "industry-leading accuracy" — no source in document
+```
+
+## Limitations and Safety
+
+- Uploading a report or manuscript sends its contents to a hosted third party; deep
+  mode also retrieves external sources. Obtain approval before transmission, remove
+  confidential or personal material, and verify current retention and deletion terms.
+- Resolution and textual support do not establish that a source is authoritative or
+  that a claim is true. Inspect consequential citations in the primary source and
+  preserve page, edition, date, and access context.
+- Treat unresolved or unsupported claims as review items, not proof of fabrication,
+  and keep a human reviewer responsible for publication or academic decisions.
+
+## Notes
+
+- Works on PDF, DOCX, MD, TXT. For pasted text, POST JSON: `{"text": "..."}`
+- Deep verification (`deep=true`) is slower and costs more credits but resolves citations against live sources
+- Pairs well with `verify-document` (is the source doc itself authentic?) run first
+- Anonymous free tier: shared weekly allowance. Get a free key at https://www.stipple.sh for your own metering

package/bundled-skills/verify-document/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: verify-document
+description: Check whether a document (PDF or image) shows signs of tampering or forgery before you rely on it. Use when the user asks to verify a payslip, invoice, bank statement, ID document, contract, or any document where authenticity matters.
+category: document-verification
+risk: critical
+source: community
+source_repo: Sketchjar/stipple-agent-skills
+source_type: community
+date_added: "2026-08-31"
+author: Sketchjar
+tags: [document-verification, fact-checking, stipple, authenticity]
+tools: [claude, cursor, gemini, codex]
+license: "Apache-2.0"
+license_source: "https://github.com/Sketchjar/stipple-agent-skills/blob/main/LICENSE"
+---
+
+# Document Verification
+
+Inspect a document for forensic authenticity signals — not a fraud verdict, but a risk band with the evidence behind it. Uses the Stipple API (free anonymous tier, no signup).
+
+## When to use
+
+- Before onboarding a tenant, contractor, or employee from uploaded documents
+- Before paying an invoice that arrived by email
+- Before relying on a bank statement, payslip, or certificate in any workflow
+- Reviewing documents in due diligence, claims processing, or loan applications
+
+## Instructions
+
+1. **Get the document.** URL or local file path (PDF, PNG, JPEG, BMP, TIFF).
+
+2. **Optionally check the cache first.** If the user has the file's SHA-256, check whether it's already been inspected (free):
+
+   ```bash
+   curl "https://www.stipple.sh/v1/warrants/check?sha256=<hash>"
+   ```
+
+3. **Run verification.** POST the document:
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/warrants \
+     -F "file=@payslip.pdf" \
+     -H "Authorization: Bearer $STIPPLE_API_KEY"
+   ```
+
+   Add `?fresh=true` to force re-inspection of a previously cached document. Add `?deep=true` for deep inspection (more thorough, more credits).
+
+4. **Interpret the response.** Two independent axes — read both:
+
+   | Axis | Question it answers |
+   |---|---|
+   | `risk_band` | Does anything look tampered? (low / medium / high) |
+   | `inspection_quality` | Could the engine actually see enough to judge? (thorough / limited / poor) |
+
+   A clean phone photo of a real payslip is commonly `low` risk + `limited` quality — **low coverage is not risk**. Per-signal `evidence` includes: amount/words mismatch, font discontinuity in values, date anomalies, document label integrity, identifier checksums (ABN/ACN/TFN), table arithmetic.
+
+5. **Report honestly.** This is a *signal with evidence*, not a verdict:
+   - "risk_band: LOW — nothing looks tampered"
+   - "inspection_quality: limited — couldn't inspect everything; low coverage is NOT fraud"
+   - Show the per-signal evidence for anything flagged
+
+6. **Pair with related checks.** For identity documents, follow with a 100-point identity check (`/v1/identity-check`). For extraction, use `extract-document-data`.
+
+## Output format
+
+```
+risk_band:           LOW — Nothing looks tampered.
+inspection_quality:  limited
+recommended action:  review_before_action
+
+evidence (signals):
+  [pass] Amount words/figure mismatch: Spelled-out amounts agree with figures.
+  [pass] Font discontinuity in value: Numeric values share the font of surrounding text.
+  [skip] Identifier checksum: No checksummable identifier (ABN/ACN/TFN) present.
+```
+
+## Limitations and Safety
+
+- This workflow uploads documents to a hosted third party. Obtain explicit approval,
+  minimize personal, financial, identity, and confidential data, and confirm the
+  provider's current retention, residency, access, and deletion terms first.
+- Forensic signals can miss sophisticated tampering or flag benign editing, scanning,
+  compression, and template artifacts. A low-risk result is not proof of authenticity,
+  and a high-risk result is not proof of fraud.
+- Preserve the original bytes and use authoritative issuer verification plus a
+  qualified human reviewer before payment, onboarding, lending, employment,
+  disciplinary, compliance, or legal action.
+
+## Notes
+
+- Document types the engine recognizes (payslips, invoices, bank statements) get type-specific checks; unrecognized types get generic checks only — say so in your report
+- Identical files are cached by content hash — re-checking the same bytes returns instantly and free
+- This measures *forensic integrity*, not *authorship style* — for "was this written by AI", use AI-text detection instead
+- Anonymous free tier: shared weekly allowance. Free key at https://www.stipple.sh

package/bundled-skills/vibe-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: vibe-delegate
 description: Delegate coding tasks to the Mistral Vibe CLI (`vibe`) only when the
   user explicitly requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/warp-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: warp-delegate
 description: Delegate coding tasks to the Warp Agent CLI (`oz`) only when the user
   explicitly requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/zcode-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: zcode-delegate
 description: Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly
   requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "4.0.47",
+  "version": "4.0.49",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",