opencode-skills-collection 4.0.48 → 4.0.49

package/bundled-skills/docs/users/usage.md

@@ -39,7 +39,7 @@ If you came in through a **Claude Code** or **Codex** plugin instead of AAS Core
 
 When you ran `npx agentic-awesome-skills` or cloned the repository, you:
 
-✅ **Downloaded 2,097+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
+✅ **Downloaded 2,107+ skill files** to your computer (default: `~/.agents/skills/`; or a custom path like `~/.agent/skills/` if you used `--path`)
 ✅ **Made them available** to your AI assistant
 ❌ **Did NOT enable them all automatically** (they're just sitting there, waiting)
 
@@ -231,7 +231,7 @@ Let's actually use a skill right now. Follow these steps:
 
 ## Direct-install Step 5: Pick Skills Manually
 
-Don't try to use all 2,097+ skills at once. Here's a sensible approach:
+Don't try to use all 2,107+ skills at once. Here's a sensible approach:
 
 If you want a tool-specific starting point before choosing skills, use:
 
@@ -362,7 +362,7 @@ Usually no, but if your AI doesn't recognize a skill:
 
 ### "Can I load all skills into the model at once?"
 
-No. Even though you have 2,097+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
+No. Even though you have 2,107+ skills installed locally, you should **not** concatenate every `SKILL.md` into a single system prompt or context block.
 
 The intended pattern is:
 

package/bundled-skills/docs/users/visual-guide.md

@@ -40,7 +40,7 @@ agentic-awesome-skills/
 ├── 📄 CONTRIBUTING.md                  ← Contributor workflow
 ├── 📄 CATALOG.md                       ← Full generated catalog
 │
-├── 📁 skills/                          ← 2,097+ skills live here
+├── 📁 skills/                          ← 2,107+ skills live here
 │   │
 │   ├── 📁 brainstorming/
 │   │   └── 📄 SKILL.md                 ← Skill definition
@@ -53,7 +53,7 @@ agentic-awesome-skills/
 │   │   └── 📁 2d-games/
 │   │       └── 📄 SKILL.md             ← Nested skills also supported
 │   │
-│   └── ... (2,097+ total)
+│   └── ... (2,107+ total)
 │
 ├── 📁 apps/
 │   └── 📁 web-app/                     ← Interactive browser
@@ -106,7 +106,7 @@ agentic-awesome-skills/
 
 ```
                     ┌─────────────────────────┐
-                    │  2,097+ SKILLS          │
+                    │  2,107+ SKILLS          │
                     └────────────┬────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
@@ -207,7 +207,7 @@ If you want a workspace-style manual install instead, cloning into `.agent/skill
 │   ├── 📁 brainstorming/                 │
 │   ├── 📁 stripe-integration/            │
 │   ├── 📁 react-best-practices/          │
-│   └── ... (2,097+ total)                │
+│   └── ... (2,107+ total)                │
 └─────────────────────────────────────────┘
 ```
 

package/bundled-skills/extract-document-data/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: extract-document-data
+description: Extract structured, grounded fields from documents — values cite their page, missing values abstain instead of hallucinating. Use for parsing invoices, payslips, statements, contracts.
+category: document-verification
+risk: critical
+source: community
+source_repo: Sketchjar/stipple-agent-skills
+source_type: community
+date_added: "2026-08-31"
+author: Sketchjar
+tags: [document-verification, fact-checking, stipple, authenticity]
+tools: [claude, cursor, gemini, codex]
+license: "Apache-2.0"
+license_source: "https://github.com/Sketchjar/stipple-agent-skills/blob/main/LICENSE"
+---
+
+# Extract Document Data
+
+Extract structured JSON from documents with per-value grounding: every extracted value cites where it came from (page number, confidence), and values that aren't clearly present are reported in `not_found` rather than hallucinated. Uses the Stipple API (free anonymous tier).
+
+## When to use
+
+- Parsing payslips, invoices, bank statements, receipts, or contracts
+- Converting unstructured documents to JSON for downstream systems
+- Any extraction where hallucinated values are worse than missing values (lending, accounting, compliance)
+
+## Instructions
+
+1. **Get the document.** URL or local file path (PDF, PNG, JPEG, DOCX).
+
+2. **Choose the extraction mode:**
+   - **Ad-hoc fields** — tell the API exactly which fields you want:
+     ```bash
+     curl -X POST https://www.stipple.sh/v1/extract \
+       -F "file=@payslip.pdf" \
+       -F 'fields=[{"name":"employer_name"},{"name":"net_pay"},{"name":"pay_date"}]' \
+       -H "Authorization: Bearer $STIPPLE_API_KEY"
+     ```
+   - **Template** — use a built-in schema: `payslip`, `tax_invoice`, `bank_statement`, `receipt`, `contract`
+   - **Schema-free** — omit `fields` and let the model extract what it finds
+
+3. **Interpret the response.**
+
+   ```json
+   {
+     "mode": "schema_free",
+     "document_type": "payslip",
+     "pages_read": 1,
+     "fields": {
+       "employer_name": {"value": "Acme Cleaning Pty Ltd", "confidence": 0.95, "page": 1},
+       "net_pay": {"value": "2845.10", "confidence": 0.97, "page": 1}
+     },
+     "not_found": ["ytd_tax"]
+   }
+   ```
+
+   - Every value carries `confidence` (the model's self-report) and `page` (grounding)
+   - `not_found[]` lists requested fields the model couldn't find — **absences are reported, never guessed**
+   - `pages_read` shows how many pages were processed (page limits apply per document)
+
+4. **Report honestly.** This is *extraction, not verification* — values are what the document **shows**, not proof it's genuine:
+   - "Employer: Acme Cleaning Pty Ltd (confidence 0.95, page 1)"
+   - "ytd_tax: not found in document" — never "ytd_tax: 0" or a guess
+   - For "is this document genuine?", pair with the `verify-document` skill first
+
+## Output format
+
+```
+Payslip fields (grounded, not guessed):
+
+  Employer          Acme Cleaning Pty Ltd  (confidence 0.95, page 1)
+  Employee          J. Citizen             (confidence 0.98, page 1)
+  Net pay           2,845.10               (confidence 0.97, page 1)
+  Superannuation    268.20                 (confidence 0.93, page 1)
+
+not_found: ytd_tax
+(absences are reported, never hallucinated)
+```
+
+## Limitations and Safety
+
+- Invoices, statements, payslips, and contracts often contain sensitive personal,
+  financial, or commercial data. Obtain explicit approval before uploading them to
+  a hosted third party, minimize the submitted content, and confirm current
+  retention, residency, access, and deletion terms.
+- Confidence and page grounding do not prove that an extracted value is correct or
+  that the source document is authentic. Reconcile consequential values against the
+  original document and authoritative systems before payment, lending, accounting,
+  compliance, or legal action.
+- Keep the original file and extraction response so a human reviewer can reproduce
+  and correct disputed fields.
+
+## Notes
+
+- Costs 1 credit per page read by the model (minimum 1); free weekly allowance applies
+- Templates: `payslip`, `tax_invoice`, `bank_statement`, `receipt`, `contract` — pass as the `template` form field
+- Tables are extracted with structure preserved; multi-page documents are processed page by page
+- Pairs with `verify-document` (run first, for authenticity) — an extracted value from a tampered document is still wrong
+- Free key at https://www.stipple.sh for metering beyond the anonymous allowance

package/bundled-skills/find-matching-tenders/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: find-matching-tenders
+description: Find open AU/NZ government tenders matching what a company does, ranked by fit with why and gap analysis. Use when the user asks to find tenders, bid opportunities, government contracts, or RFPs for their business (or a client's).
+category: document-verification
+risk: critical
+source: community
+source_repo: Sketchjar/stipple-agent-skills
+source_type: community
+date_added: "2026-08-31"
+author: Sketchjar
+tags: [document-verification, fact-checking, stipple, authenticity]
+tools: [claude, cursor, gemini, codex]
+license: "Apache-2.0"
+license_source: "https://github.com/Sketchjar/stipple-agent-skills/blob/main/LICENSE"
+---
+
+# Find Matching Tenders
+
+Search live AU/NZ government tenders, rank them against what a company actually does (read from its website), and explain why each opportunity is relevant — including the capability gaps to prepare evidence for. Tender search is free forever on the Stipple API; no API key or signup needed.
+
+## When to use
+
+- Business development: "find tenders we could bid on"
+- Market research: "what government work is out there for cybersecurity firms in NSW?"
+- Bid pipeline maintenance: "check for new construction tenders this week"
+
+## Instructions
+
+1. **Get the company profile.** Ask for the company's website URL. If the user provides a description instead, skip resolution and use their description directly as capability context.
+
+2. **Resolve the company** (optional but improves matching):
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/companies/resolve \
+     -H "Content-Type: application/json" \
+     -d '{"query": "https://your-company.com"}'
+   ```
+
+   Returns the company's registered name, ABN, jurisdiction, and status.
+
+3. **Search open tenders** (free, no key):
+
+   ```bash
+   curl "https://www.stipple.sh/v1/tenders?q=construction&jurisdiction=AU&limit=10"
+   ```
+
+   Filters: `q` (keyword), `jurisdiction` (AU, AU-NSW, AU-VIC, NZ, ...), `limit`, `offset`.
+
+4. **Rank against the company** (optional, uses free weekly allowance):
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/tenders/match \
+     -H "Content-Type: application/json" \
+     -d '{"url": "https://your-company.com", "jurisdiction": "AU", "limit": 5}'
+   ```
+
+   Returns ranked matches with `why[]` (why it fits) and `gaps[]` (capability evidence to prepare).
+
+5. **Check data provenance** if results seem thin (free):
+
+   ```bash
+   curl "https://www.stipple.sh/v1/tenders/sources"
+   ```
+
+   Shows which government feeds are indexed and their freshness — explains why a search can be empty.
+
+6. **Report honestly.** Match scores are *fit signals*, not win probabilities. Present `gaps[]` as "prepare evidence for this", not disqualification.
+
+## Output format
+
+```
+Found 403 open tenders matching "construction" (AU/NZ)
+
+#1 [AU-NSW] Digital platform modernisation services
+    buyer:  NSW Department of ...
+    why:    matches 'cloud migration', 'API integration' from your services
+    gap:    no evidence found for 'ICT security assessment'
+    closes: 2026-09-15
+    https://...
+
+#2 [NZ] ...
+```
+
+## Limitations and Safety
+
+- The hosted service receives the search terms and, for matching, the supplied
+  company URL or description. Obtain approval before sending private capability or
+  client information and do not include secrets or non-public bid strategy.
+- Feed coverage and freshness can be incomplete. Confirm eligibility, scope,
+  amendments, deadlines, and submission instructions on the issuing authority's
+  primary tender page before investing time or submitting a bid.
+- Match scores and gap analysis are triage signals, not procurement advice, an
+  eligibility ruling, or a probability of winning.
+
+## Notes
+
+- Tender search and source listing are free forever — no key, no credits
+- Matching costs a small number of credits on the free weekly allowance
+- For ongoing monitoring, pair with a cron job that re-runs step 3 daily and diffs results
+- Data sources: NZ GETS, NSW eTendering, VendorPanel, and other government feeds

package/bundled-skills/grok-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: grok-delegate
 description: Delegate coding tasks to the Grok Build CLI only when the user explicitly
   requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/inngest/SKILL.md

@@ -37,6 +37,7 @@ and durable execution without managing queues or workers.
 ## Scope
 
 - redis-queues -> bullmq-specialist
+- serverless-queues -> upstash-qstash
 - workflow-orchestration -> temporal-craftsman
 - message-streaming -> event-architect
 - infrastructure -> infra-architect
@@ -388,6 +389,7 @@ Fix action: Add idempotency: 'event.data.orderId' to function config
 ### Delegation Triggers
 
 - redis|queue infrastructure|bullmq -> bullmq-specialist (Need Redis-based queue with existing infrastructure)
+- serverless queue|http queue|scheduled http -> upstash-qstash (Need plain HTTP delivery and cron without an event framework)
 - saga|compensation|rollback|long-running workflow -> temporal-craftsman (Need complex workflow orchestration with compensation)
 - event sourcing|event store|cqrs -> event-architect (Need event sourcing patterns)
 - vercel|deploy|production -> vercel-deployment (Need deployment configuration)

package/bundled-skills/kimi-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: kimi-delegate
 description: Delegate coding tasks to the Kimi Code CLI (`kimi`) only when the user
   explicitly requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/liuguang-banlan-ui/SKILL.md

@@ -90,9 +90,10 @@ Maintain a serializable manifest with these top-level fields:
 ### 7. Validate and report
 
 - Scaffold a clean starter with `scripts/scaffold_template.py` when a neutral implementation is needed.
-- Treat JavaScript manifests as executable code: inspect them first and run the
-  bundled helpers only on reviewed, locally authored configuration. Never pass
-  an untrusted or freshly downloaded manifest to either Python helper.
+- The bundled helpers parse only the restricted data-literal assignment used by
+  the starter. They reject expressions, function calls, duplicate keys,
+  unsupported syntax, trailing statements, and oversized manifests without
+  executing JavaScript. Keep runtime theme configs data-only as well.
 - Run `scripts/validate_manifest.py` on each theme config before rendering.
 - Capture desktop and mobile screenshots with a real browser. Inspect them directly if visual capability is available.
 - Run `scripts/measure_preview.py` on the pure field screenshot and retain measured chromatic ratio, luminance statistics, per-color coverage, and effective share.
@@ -122,7 +123,8 @@ Use the bundled starter under `assets/starter/` as a neutral base. Copy only the
 ### scripts/
 
 - `scaffold_template.py`: copy the neutral starter for `opal`, `obsidian`, or both.
-- `validate_manifest.py`: parse a JavaScript manifest through Node and validate required fields and ranges.
+- `manifest_parser.py`: statically parse the restricted data-only manifest grammar without executing JavaScript.
+- `validate_manifest.py`: validate required manifest fields and ranges.
 - `measure_preview.py`: measure a rendered pure-field PNG against the configured OKLCH palette.
 
 ### references/

package/bundled-skills/liuguang-banlan-ui/scripts/manifest_parser.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""Parse the data-only subset used by Liuguang theme manifests."""
+
+from __future__ import annotations
+
+import json
+import pathlib
+import re
+from dataclasses import dataclass
+
+
+MAX_MANIFEST_BYTES = 256 * 1024
+MAX_NESTING_DEPTH = 64
+
+
+class ManifestSyntaxError(ValueError):
+    """Raised when a manifest contains code or unsupported JavaScript syntax."""
+
+
+@dataclass(frozen=True)
+class Token:
+    kind: str
+    value: str
+    offset: int
+
+
+TOKEN_RE = re.compile(
+    r"""
+    (?P<whitespace>\s+)
+  | (?P<line_comment>//[^\r\n]*)
+  | (?P<block_comment>/\*.*?\*/)
+  | (?P<string>"(?:\\["\\/bfnrt]|\\u[0-9A-Fa-f]{4}|[^"\\\x00-\x1f])*")
+  | (?P<number>-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?)
+  | (?P<identifier>[A-Za-z_$][A-Za-z0-9_$]*)
+  | (?P<punctuation>[{}\[\]:,;=.])
+    """,
+    re.VERBOSE | re.DOTALL,
+)
+
+
+def tokenize(source: str) -> list[Token]:
+    tokens: list[Token] = []
+    offset = 0
+    while offset < len(source):
+        match = TOKEN_RE.match(source, offset)
+        if match is None:
+            raise ManifestSyntaxError(f"unsupported syntax at byte offset {offset}")
+        kind = match.lastgroup
+        if kind not in {"whitespace", "line_comment", "block_comment"}:
+            tokens.append(Token(kind or "unknown", match.group(0), offset))
+        offset = match.end()
+    tokens.append(Token("eof", "", len(source)))
+    return tokens
+
+
+class Parser:
+    def __init__(self, source: str) -> None:
+        self.tokens = tokenize(source)
+        self.index = 0
+
+    @property
+    def current(self) -> Token:
+        return self.tokens[self.index]
+
+    def take(self, value: str | None = None, kind: str | None = None) -> Token:
+        token = self.current
+        if value is not None and token.value != value:
+            raise ManifestSyntaxError(
+                f"expected {value!r} at byte offset {token.offset}, found {token.value!r}"
+            )
+        if kind is not None and token.kind != kind:
+            raise ManifestSyntaxError(
+                f"expected {kind} at byte offset {token.offset}, found {token.value!r}"
+            )
+        self.index += 1
+        return token
+
+    def accept(self, value: str) -> bool:
+        if self.current.value != value:
+            return False
+        self.index += 1
+        return True
+
+    def parse(self) -> dict:
+        self.take("window")
+        self.take(".")
+        self.take("SPECTRAL_THEME")
+        self.take("=")
+        value = self.parse_value(0)
+        self.accept(";")
+        self.take(kind="eof")
+        if not isinstance(value, dict):
+            raise ManifestSyntaxError("SPECTRAL_THEME must be an object")
+        return value
+
+    def parse_value(self, depth: int):
+        if depth > MAX_NESTING_DEPTH:
+            raise ManifestSyntaxError("manifest nesting limit exceeded")
+        token = self.current
+        if token.value == "{":
+            return self.parse_object(depth + 1)
+        if token.value == "[":
+            return self.parse_array(depth + 1)
+        if token.kind == "string":
+            self.index += 1
+            return json.loads(token.value)
+        if token.kind == "number":
+            self.index += 1
+            try:
+                return (
+                    float(token.value)
+                    if any(mark in token.value for mark in ".eE")
+                    else int(token.value)
+                )
+            except ValueError as error:
+                raise ManifestSyntaxError("numeric literal exceeds the supported range") from error
+        if token.kind == "identifier" and token.value in {"true", "false", "null"}:
+            self.index += 1
+            return {"true": True, "false": False, "null": None}[token.value]
+        raise ManifestSyntaxError(
+            f"only data literals are allowed at byte offset {token.offset}; found {token.value!r}"
+        )
+
+    def parse_object(self, depth: int) -> dict:
+        result: dict = {}
+        self.take("{")
+        if self.accept("}"):
+            return result
+        while True:
+            token = self.current
+            if token.kind == "identifier":
+                key = self.take(kind="identifier").value
+            elif token.kind == "string":
+                key = json.loads(self.take(kind="string").value)
+            else:
+                raise ManifestSyntaxError(
+                    f"object keys must be identifiers or strings at byte offset {token.offset}"
+                )
+            if key in result:
+                raise ManifestSyntaxError(f"duplicate object key: {key}")
+            self.take(":")
+            result[key] = self.parse_value(depth)
+            if self.accept("}"):
+                return result
+            self.take(",")
+            if self.accept("}"):
+                return result
+
+    def parse_array(self, depth: int) -> list:
+        result: list = []
+        self.take("[")
+        if self.accept("]"):
+            return result
+        while True:
+            result.append(self.parse_value(depth))
+            if self.accept("]"):
+                return result
+            self.take(",")
+            if self.accept("]"):
+                return result
+
+
+def parse_manifest(source: str) -> dict:
+    return Parser(source).parse()
+
+
+def load_manifest(path: pathlib.Path) -> dict:
+    with path.open("rb") as manifest:
+        raw = manifest.read(MAX_MANIFEST_BYTES + 1)
+    if len(raw) > MAX_MANIFEST_BYTES:
+        raise ManifestSyntaxError(
+            f"manifest exceeds the {MAX_MANIFEST_BYTES}-byte size limit"
+        )
+    try:
+        source = raw.decode("utf-8-sig")
+    except UnicodeDecodeError as error:
+        raise ManifestSyntaxError("manifest must be valid UTF-8") from error
+    return parse_manifest(source)

package/bundled-skills/liuguang-banlan-ui/scripts/measure_preview.py

@@ -6,9 +6,10 @@ from __future__ import annotations
 import argparse
 import json
 import pathlib
-import subprocess
 import sys
 
+from manifest_parser import ManifestSyntaxError, load_manifest
+
 try:
     import numpy as np
     from PIL import Image
@@ -29,21 +30,6 @@ except ModuleNotFoundError as exc:
     raise SystemExit(2)
 
 
-def load_config(path: pathlib.Path) -> dict:
-    source = (
-        "global.window={};require(require('path').resolve(process.argv[1]));"
-        "process.stdout.write(JSON.stringify(window.SPECTRAL_THEME));"
-    )
-    result = subprocess.run(
-        ["node", "-e", source, str(path)],
-        check=True,
-        capture_output=True,
-        text=True,
-        encoding="utf-8",
-    )
-    return json.loads(result.stdout)
-
-
 def srgb_to_oklab(rgb: np.ndarray) -> tuple[np.ndarray, np.ndarray]:
     linear = np.where(
         rgb <= 0.04045,
@@ -129,7 +115,18 @@ def main() -> None:
     parser.add_argument("--image", required=True, type=pathlib.Path)
     parser.add_argument("--config", required=True, type=pathlib.Path)
     args = parser.parse_args()
-    config = load_config(args.config.resolve())
+    try:
+        config = load_manifest(args.config.resolve())
+    except (ManifestSyntaxError, OSError) as error:
+        print(
+            json.dumps(
+                {"status": "invalid", "errors": [str(error)]},
+                ensure_ascii=False,
+                indent=2,
+            ),
+            file=sys.stderr,
+        )
+        raise SystemExit(1) from error
     payload = {
         "schemaVersion": "1.0",
         "theme": config["label"],

package/bundled-skills/liuguang-banlan-ui/scripts/validate_manifest.py

@@ -8,23 +8,9 @@ import json
 import math
 import pathlib
 import re
-import subprocess
 import sys
 
-
-def load_manifest(path: pathlib.Path) -> dict:
-    program = (
-        "global.window={};require(require('path').resolve(process.argv[1]));"
-        "process.stdout.write(JSON.stringify(window.SPECTRAL_THEME));"
-    )
-    result = subprocess.run(
-        ["node", "-e", program, str(path)],
-        check=True,
-        capture_output=True,
-        text=True,
-        encoding="utf-8",
-    )
-    return json.loads(result.stdout)
+from manifest_parser import ManifestSyntaxError, load_manifest
 
 
 def require(condition: bool, message: str, errors: list[str]) -> None:
@@ -161,7 +147,17 @@ def main() -> None:
     parser = argparse.ArgumentParser()
     parser.add_argument("config", type=pathlib.Path)
     args = parser.parse_args()
-    config = load_manifest(args.config.resolve())
+    try:
+        config = load_manifest(args.config.resolve())
+    except (ManifestSyntaxError, OSError) as error:
+        print(
+            json.dumps(
+                {"status": "invalid", "errors": [str(error)]},
+                ensure_ascii=False,
+                indent=2,
+            )
+        )
+        raise SystemExit(1) from error
     errors = validate(config)
     if errors:
         print(json.dumps({"status": "invalid", "errors": errors}, ensure_ascii=False, indent=2))