opencode-skills-collection 4.0.52 → 4.0.54

package/bundled-skills/antigravity-workflows/references/workflow-cards.md

@@ -0,0 +1,78 @@
+# Standalone workflow cards
+
+These cards work when the full AAS repository playbooks are absent. Start from the
+user's actual project and its instructions. Each skill ID below is a candidate to
+inspect, not a compulsory stack or an endorsement based on metadata. Preserve an
+already chosen workflow and use the project's existing commands and conventions.
+
+## Ship a SaaS MVP
+
+Input: target user, one primary journey, current code, constraints and deployment
+destination. Use `brainstorming` to resolve the primary outcome and `concise-planning`
+to define observable acceptance. Compare `api-design-principles` and
+`frontend-design` against the actual stack before implementation. Use
+`e2e-testing-patterns` for the core journey and `deployment-procedures` only when
+deployment is authorized. Exit with the implemented journey, its observed test,
+and an explicit deployment status. A local build is not a deployed product.
+
+## Security audit
+
+Input: owned code or explicitly authorized targets and permitted test methods.
+Use `threat-modeling-expert` to map assets and trust boundaries, then choose
+`api-security-best-practices` or `frontend-security-coder` for the affected surface.
+Inspect authentication only if it exists; do not invent endpoints or run exploit
+commands outside the authorized scope. Use `verification-before-completion` to
+connect each finding to a reproduction and a post-fix check. Exit with affected
+paths, actual evidence, residual risks and unresolved blockers; do not infer a
+security certification from a scanner result.
+
+## Build an AI agent system
+
+Input: task, tool permissions, data boundaries and a measurable output. Compare
+`ai-agents-architect` and `llm-app-patterns` for the runtime; use `mcp-builder` when
+the integration actually uses MCP. Before executing tools, define their allowed
+effects and error behavior. Use `agent-evaluation` to choose observable task checks.
+Exit with an actual tool interaction and its checked result, or identify exactly
+which live interaction remains untested. Do not substitute an in-process fixture
+for a claimed real client session.
+
+## QA and browser automation
+
+Input: existing route or journey, supported viewports and the actual test runner.
+Compare `vitest-skill` and `javascript-testing-patterns` for component/unit checks;
+compare `browser-automation` and `e2e-testing-patterns` for browser interactions.
+Use `fixing-accessibility` for names, keyboard access and error associations.
+Record initial, loading, success and failure states. Run the repository's test
+command, repair a reproduced failure, and rerun it. Exit with observed checks and
+browser evidence; mark screen-reader or device coverage untested when unavailable.
+
+## Design a DDD core domain
+
+Input: business vocabulary, representative scenarios and existing boundaries.
+Use `domain-driven-design` to identify the core domain, `ddd-context-mapping` to
+describe upstream/downstream relationships, and `ddd-tactical-patterns` only where
+aggregates and invariants solve an actual problem. Validate a representative
+scenario against those invariants. Exit with the model, boundary decisions and
+worked scenario; do not introduce services or abstractions solely to fit DDD terms.
+
+## Reviewed-selection handoff
+
+After reading the selected instructions and bundled files, bind exact IDs, release
+and destination. For example, from a Codex project where `brainstorming` and
+`systematic-debugging` were actually selected:
+
+```bash
+npm exec --yes --ignore-scripts --package=agentic-awesome-skills@16.7.0 -- \
+  agentic-awesome-skills --release 16.7.0 --path .agents/skills \
+  --skills brainstorming,systematic-debugging --dry-run
+```
+
+Replace these example IDs with the reviewed set. Confirm that this exact release
+contains them and inspect its prerequisites. If preview reports an error, correct
+the cause and rerun the preview. Only after a successful reviewed preview and
+within existing user authorization, repeat the identical command without
+`--dry-run`. Verify the resulting skill files and invoke the chosen skill on the
+real task. The direct installer owns this preview; it does not apply a Core plan.
+
+These are procedure cards, not completed case results. Keep actual output and
+limitations separate from the expected exit condition.

package/bundled-skills/api-analyzer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-analyzer
-description: Validates whether an API request is correct based on provided inputs (method, URL, headers, body, auth, query params). Use this skill whenever a user wants to check, validate, debug, or verify an API call — including when they paste a curl command, show endpoint details, ask "is this...
+description: "Validates whether an API request is correct based on provided inputs (method, URL, headers, body, auth, query params)."
 risk: none
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/api-analyzer
 source_repo: LambdaTest/agent-skills

package/bundled-skills/api-designer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-designer
-description: Generates complete, production-ready REST API endpoint specifications for any system or domain the user describes. Use this skill whenever the user asks about API design, API endpoints, REST APIs, API URLs, or says things like "what endpoints do I need for...", "design an API for...",...
+description: "Generates complete, production-ready REST API endpoint specifications for any system or domain the user describes."
 risk: safe
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/api-designer
 source_repo: LambdaTest/agent-skills

package/bundled-skills/api-integration/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-integration
-description: Designs event-driven architectures, webhook systems, API chaining flows, ETL pipelines, and integration patterns between services. Use whenever the user asks about webhooks, event streaming, API composition, connecting two or more APIs, building pipelines, Pub/Sub, Kafka topics, ETL...
+description: "Designs event-driven architectures, webhook systems, API chaining flows, ETL pipelines, and integration patterns between services."
 risk: none
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/api-integration-helper
 source_repo: LambdaTest/agent-skills

package/bundled-skills/api-onboarding/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-onboarding
-description: 'Reduce time-to-first-API-call (TTFAC) by optimizing every step of the developer onboarding journey. This skill covers authentication simplification, sandbox environments, interactive documentation, and identifying and eliminating common failure points. Trigger phrases: "API...'
+description: "Reduce time-to-first-API-call (TTFAC) by optimizing every step of the developer onboarding journey. This skill covers authentication simplification, sandbox environments, interactive documentation, and identifying and eliminating common failure points."
 risk: critical
 source: https://github.com/jonathimer/devmarketing-skills/tree/main/skills/api-onboarding
 source_repo: jonathimer/devmarketing-skills

package/bundled-skills/api-patterns/SKILL.md

@@ -8,7 +8,7 @@ date_added: "2026-02-27"
 
 # API Patterns
 
-> API design principles and decision-making for 2025.
+> API design decisions tied to the consumers and deployment constraints.
 > **Learn to THINK, not copy fixed patterns.**
 
 ## 🎯 Selective Reading Rule
@@ -38,9 +38,9 @@ date_added: "2026-02-27"
 
 | Need | Skill |
 |------|-------|
-| API implementation | `@[skills/backend-development]` |
+| API implementation | `@[skills/backend-architect]` |
 | Data structure | `@[skills/database-design]` |
-| Security details | `@[skills/security-hardening]` |
+| Security details | `@[skills/api-security-best-practices]` |
 
 ---
 
@@ -79,12 +79,23 @@ Before designing an API:
 
 | Script | Purpose | Command |
 |--------|---------|---------|
-| `scripts/api_validator.py` | API endpoint validation | `python scripts/api_validator.py <project_path>` |
+| `scripts/api_validator.py` | Local heuristic source scan (not schema validation) | `python3 skills/api-patterns/scripts/api_validator.py <project_path>` |
 
 ## When to Use
-This skill is applicable to execute the workflow or actions described in the overview.
+
+Use when defining a new endpoint contract, selecting REST/GraphQL/tRPC for known consumers, or changing pagination, errors, authentication or compatibility behavior. For a bug inside an existing contract, preserve that contract unless the task authorizes a change.
+
+## Inputs and procedure
+
+Record consumers and deployed versions, expected payload size, access rules, compatibility obligations and one concrete operation. Read the relevant files in the map, compare the realistic choices, then specify request/response examples and rejection cases. Types shared at build time do not ensure that independently deployed clients remain compatible.
+
+## Worked example
+
+Input: a public order list changes while clients page through it. Choose a bounded page size and cursor over a stable `(created_at, id)` order. Define the next-cursor format, authorization filter and behavior for a removed record or invalid cursor. Test two equal timestamps and an insertion between pages. Expected: no duplicate IDs within the promised snapshot semantics; document whether newly inserted rows can appear.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
-- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+- The Python helper scans at most 15 matching files using regular expressions and shallow JSON/YAML checks. Its output is a triage hint, not OpenAPI validation, an authorization audit or deployment approval.
+- GraphQL query shape, tRPC inference and HTTP method names do not enforce resource authorization or backwards compatibility.
+- Rate limiting cannot alone prevent all resource exhaustion; size, concurrency, time and provider-cost bounds depend on the operation.
+- Perform security checks only against authorized local/test targets with isolated accounts and a defined scope.

package/bundled-skills/api-patterns/api-style.md

@@ -1,4 +1,4 @@
-# API Style Selection (2025)
+# API Style Selection
 
 > REST vs GraphQL vs tRPC - Hangi durumda hangisi?
 
@@ -29,7 +29,7 @@ Who are the API consumers?
 |--------|------|---------|------|
 | **Best for** | Public APIs | Complex apps | TS monorepos |
 | **Learning curve** | Low | Medium | Low (if TS) |
-| **Over/under fetching** | Common | Solved | Solved |
+| **Over/under fetching** | Shape endpoints for consumers | Client selects fields; enforce cost limits | Depends on procedure design |
 | **Type safety** | Manual (OpenAPI) | Schema-based | Automatic |
 | **Caching** | HTTP native | Complex | Client-based |
 

package/bundled-skills/api-patterns/auth.md

@@ -10,14 +10,15 @@
 | **Session** | Traditional web, simple |
 | **OAuth 2.0** | Third-party integration |
 | **API Keys** | Server-to-server, public APIs |
-| **Passkey** | Modern passwordless (2025+) |
+| **Passkey** | Passwordless user authentication |
 
 ## JWT Principles
 
 ```
 Important:
 ├── Always verify signature
-├── Check expiration
+├── Allow only the expected algorithm and validate issuer/audience
+├── Require and check expiration
 ├── Include minimal claims
 ├── Use short expiry + refresh tokens
 └── Never store sensitive data in JWT

package/bundled-skills/api-patterns/graphql.md

@@ -37,5 +37,5 @@ Protect against:
 ├── Query depth attacks → Set max depth
 ├── Query complexity → Calculate cost
 ├── Batching abuse → Limit batch size
-├── Introspection → Disable in production
+├── Introspection → Set policy for the audience; not an authorization boundary
 ```

package/bundled-skills/api-patterns/scripts/api_validator.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """
-API Validator - Checks API endpoints for best practices.
-Validates OpenAPI specs, response formats, and common issues.
+Heuristic triage of up to 15 matching source/spec files.
+Regex and shallow checks do not validate OpenAPI schemas or security behavior.
 """
 import sys
 import json
@@ -32,7 +32,8 @@ def find_api_files(project_path: Path) -> list:
         files.extend(project_path.glob(pattern))
     
     # Exclude node_modules, etc.
-    return [f for f in files if not any(x in str(f) for x in ['node_modules', '.git', 'dist', 'build', '__pycache__'])]
+    return sorted({f for f in files if f.is_file() and not f.is_symlink()
+                   and not any(x in f.parts for x in ['node_modules', '.git', 'dist', 'build', '__pycache__'])})
 
 def check_openapi_spec(file_path: Path) -> dict:
     """Check OpenAPI/Swagger specification."""
@@ -164,7 +165,7 @@ def main():
     project_path = Path(target)
     
     print("\n" + "=" * 60)
-    print("  API VALIDATOR - Endpoint Best Practices Check")
+    print("  API HEURISTIC TRIAGE - Not schema or security validation")
     print("=" * 60 + "\n")
     
     api_files = find_api_files(project_path)
@@ -174,6 +175,7 @@ def main():
         print("   Looking for: routes/, controllers/, api/, openapi.json/yaml")
         sys.exit(0)
     
+    print(f"[SCOPE] Inspecting {min(15, len(api_files))} of {len(api_files)} matching files.")
     results = []
     for file_path in api_files[:15]:  # Limit
         if 'openapi' in file_path.name.lower() or 'swagger' in file_path.name.lower():
@@ -197,14 +199,14 @@ def main():
                 total_issues += 1
     
     print("\n" + "=" * 60)
-    print(f"[RESULTS] {total_passed} passed, {total_issues} critical issues")
+    print(f"[RESULTS] {total_passed} passed, {total_issues} heuristic issues")
     print("=" * 60)
     
     if total_issues == 0:
-        print("[OK] API validation passed")
+        print("[INFO] No flagged issues in sampled files; validation remains unperformed")
         sys.exit(0)
     else:
-        print("[X] Fix critical issues before deployment")
+        print("[X] Fix heuristic issues before deployment")
         sys.exit(1)
 
 if __name__ == "__main__":

package/bundled-skills/api-patterns/trpc.md

@@ -23,10 +23,10 @@
 
 ```
 Why tRPC:
-├── Zero schema maintenance
+├── Shared TypeScript types; still validate untrusted runtime input
 ├── End-to-end type inference
 ├── IDE autocomplete across stack
-├── Instant API changes reflected
+├── Type errors surface for clients rebuilt against the shared contract
 └── No code generation step
 ```
 

package/bundled-skills/api-patterns/versioning.md

@@ -18,5 +18,5 @@ Consider:
 ├── Public API? → Version in URI
 ├── Internal only? → May not need versioning
 ├── GraphQL? → Typically no versions (evolve schema)
-├── tRPC? → Types enforce compatibility
+├── tRPC? → Test deployed-client compatibility; types only help at build time
 ```

package/bundled-skills/api-sdk-generator/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-sdk-generator
-description: Generates client SDK code, API wrapper libraries, request/response models, and language-specific usage patterns for any REST API. Use whenever the user asks to "generate an SDK", "write a client library", "create API wrappers", "generate TypeScript types from my API", "write a Python...
+description: "Generates client SDK code, API wrapper libraries, request/response models, and language-specific usage patterns for any REST API."
 risk: critical
 source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/api-sdk-generator
 source_repo: LambdaTest/agent-skills