opencode-skills-collection 4.0.48 → 4.0.49

package/bundled-skills/verify-citations/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: verify-citations
+description: Verify citations and references in a document, report, or article against real sources. Use when the user asks to fact-check, verify references, check citations, or validate evidence in research reports, tender responses, whitepapers, or academic writing.
+category: document-verification
+risk: critical
+source: community
+source_repo: Sketchjar/stipple-agent-skills
+source_type: community
+date_added: "2026-08-31"
+author: Sketchjar
+tags: [document-verification, fact-checking, stipple, authenticity]
+tools: [claude, cursor, gemini, codex]
+license: "Apache-2.0"
+license_source: "https://github.com/Sketchjar/stipple-agent-skills/blob/main/LICENSE"
+---
+
+# Citation Verification
+
+Verify that citations in a document actually resolve and support the claims they're attached to. Uses the Stipple API (free anonymous tier, no signup) for citation resolution, arithmetic recomputation, and unsupported-claim detection.
+
+## When to use
+
+- Before submitting or publishing a research report, tender response, or whitepaper
+- Reviewing an LLM-generated document (LLM citations are plausibly-formatted and frequently wrong)
+- Due diligence on third-party reports
+- Academic reference checking
+
+## Instructions
+
+1. **Get the document.** Ask the user for a URL to the report, or a local file path (PDF, DOCX, Markdown). If the user pastes text directly, skip to step 3 with `text` input.
+
+2. **Run verification.** POST the document to Stipple's citation verification endpoint:
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/verify-references \
+     -F "file=@report.pdf" \
+     -H "Authorization: Bearer $STIPPLE_API_KEY"
+   ```
+
+   The anonymous free tier works without the Authorization header. Deep mode (`?deep=true`) costs more credits but cross-checks citations against live web sources.
+
+3. **Interpret the response.** The result includes:
+   - `verification_coverage` — percentage of claims verified (e.g. "78%")
+   - `citations[]` — per-citation status: resolved and matching, resolved but mismatched, or unresolvable, with the issue explained
+   - `arithmetic[]` — recomputed figures vs stated figures (flags decimal shifts, wrong sums)
+   - `unsupported_claims[]` — claims with no citation at all
+
+4. **Report honestly.** Present results as *verification coverage*, not a truth verdict:
+   - "21/27 citations resolve and match"
+   - "[x] FY24+FY25 revenue stated $4.2m, actual $3.7m"
+   - "[!] 'industry-leading accuracy' — no source in document"
+   - Unverified ≠ false. The goal is telling the user *which* claims are backed and which aren't.
+
+5. **Offer remediation.** For failed citations, suggest: fixing the decimal shift, finding the correct source, or removing the unsupported claim.
+
+## Output format
+
+```
+Verification coverage: 78%
+
+Citations: 21/27 resolve and match
+  [+] "ABS unemployment 4.1% April 2026" — matches abs.gov.au
+  [-] "AI adoption grew 340% in 2025" — source states 34%, decimal shifted
+
+Arithmetic: 12/13 recompute correctly
+  [x] FY24 + FY25 revenue — stated $4.2m, actual $3.7m
+
+Unsupported claims: 2
+  [!] "industry-leading accuracy" — no source in document
+```
+
+## Limitations and Safety
+
+- Uploading a report or manuscript sends its contents to a hosted third party; deep
+  mode also retrieves external sources. Obtain approval before transmission, remove
+  confidential or personal material, and verify current retention and deletion terms.
+- Resolution and textual support do not establish that a source is authoritative or
+  that a claim is true. Inspect consequential citations in the primary source and
+  preserve page, edition, date, and access context.
+- Treat unresolved or unsupported claims as review items, not proof of fabrication,
+  and keep a human reviewer responsible for publication or academic decisions.
+
+## Notes
+
+- Works on PDF, DOCX, MD, TXT. For pasted text, POST JSON: `{"text": "..."}`
+- Deep verification (`deep=true`) is slower and costs more credits but resolves citations against live sources
+- Pairs well with `verify-document` (is the source doc itself authentic?) run first
+- Anonymous free tier: shared weekly allowance. Get a free key at https://www.stipple.sh for your own metering

package/bundled-skills/verify-document/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: verify-document
+description: Check whether a document (PDF or image) shows signs of tampering or forgery before you rely on it. Use when the user asks to verify a payslip, invoice, bank statement, ID document, contract, or any document where authenticity matters.
+category: document-verification
+risk: critical
+source: community
+source_repo: Sketchjar/stipple-agent-skills
+source_type: community
+date_added: "2026-08-31"
+author: Sketchjar
+tags: [document-verification, fact-checking, stipple, authenticity]
+tools: [claude, cursor, gemini, codex]
+license: "Apache-2.0"
+license_source: "https://github.com/Sketchjar/stipple-agent-skills/blob/main/LICENSE"
+---
+
+# Document Verification
+
+Inspect a document for forensic authenticity signals — not a fraud verdict, but a risk band with the evidence behind it. Uses the Stipple API (free anonymous tier, no signup).
+
+## When to use
+
+- Before onboarding a tenant, contractor, or employee from uploaded documents
+- Before paying an invoice that arrived by email
+- Before relying on a bank statement, payslip, or certificate in any workflow
+- Reviewing documents in due diligence, claims processing, or loan applications
+
+## Instructions
+
+1. **Get the document.** URL or local file path (PDF, PNG, JPEG, BMP, TIFF).
+
+2. **Optionally check the cache first.** If the user has the file's SHA-256, check whether it's already been inspected (free):
+
+   ```bash
+   curl "https://www.stipple.sh/v1/warrants/check?sha256=<hash>"
+   ```
+
+3. **Run verification.** POST the document:
+
+   ```bash
+   curl -X POST https://www.stipple.sh/v1/warrants \
+     -F "file=@payslip.pdf" \
+     -H "Authorization: Bearer $STIPPLE_API_KEY"
+   ```
+
+   Add `?fresh=true` to force re-inspection of a previously cached document. Add `?deep=true` for deep inspection (more thorough, more credits).
+
+4. **Interpret the response.** Two independent axes — read both:
+
+   | Axis | Question it answers |
+   |---|---|
+   | `risk_band` | Does anything look tampered? (low / medium / high) |
+   | `inspection_quality` | Could the engine actually see enough to judge? (thorough / limited / poor) |
+
+   A clean phone photo of a real payslip is commonly `low` risk + `limited` quality — **low coverage is not risk**. Per-signal `evidence` includes: amount/words mismatch, font discontinuity in values, date anomalies, document label integrity, identifier checksums (ABN/ACN/TFN), table arithmetic.
+
+5. **Report honestly.** This is a *signal with evidence*, not a verdict:
+   - "risk_band: LOW — nothing looks tampered"
+   - "inspection_quality: limited — couldn't inspect everything; low coverage is NOT fraud"
+   - Show the per-signal evidence for anything flagged
+
+6. **Pair with related checks.** For identity documents, follow with a 100-point identity check (`/v1/identity-check`). For extraction, use `extract-document-data`.
+
+## Output format
+
+```
+risk_band:           LOW — Nothing looks tampered.
+inspection_quality:  limited
+recommended action:  review_before_action
+
+evidence (signals):
+  [pass] Amount words/figure mismatch: Spelled-out amounts agree with figures.
+  [pass] Font discontinuity in value: Numeric values share the font of surrounding text.
+  [skip] Identifier checksum: No checksummable identifier (ABN/ACN/TFN) present.
+```
+
+## Limitations and Safety
+
+- This workflow uploads documents to a hosted third party. Obtain explicit approval,
+  minimize personal, financial, identity, and confidential data, and confirm the
+  provider's current retention, residency, access, and deletion terms first.
+- Forensic signals can miss sophisticated tampering or flag benign editing, scanning,
+  compression, and template artifacts. A low-risk result is not proof of authenticity,
+  and a high-risk result is not proof of fraud.
+- Preserve the original bytes and use authoritative issuer verification plus a
+  qualified human reviewer before payment, onboarding, lending, employment,
+  disciplinary, compliance, or legal action.
+
+## Notes
+
+- Document types the engine recognizes (payslips, invoices, bank statements) get type-specific checks; unrecognized types get generic checks only — say so in your report
+- Identical files are cached by content hash — re-checking the same bytes returns instantly and free
+- This measures *forensic integrity*, not *authorship style* — for "was this written by AI", use AI-text detection instead
+- Anonymous free tier: shared weekly allowance. Free key at https://www.stipple.sh

package/bundled-skills/vibe-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: vibe-delegate
 description: Delegate coding tasks to the Mistral Vibe CLI (`vibe`) only when the
   user explicitly requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/warp-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: warp-delegate
 description: Delegate coding tasks to the Warp Agent CLI (`oz`) only when the user
   explicitly requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/bundled-skills/zcode-delegate/SKILL.md

@@ -2,7 +2,7 @@
 name: zcode-delegate
 description: Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly
   requests it, while the orchestrator retains review and landing responsibility.
-risk: safe
+risk: critical
 category: agent-orchestration
 source: https://github.com/amElnagdy/delegate-skills
 source_repo: amElnagdy/delegate-skills

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "4.0.48",
+  "version": "4.0.49",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",