opencode-skills-collection 4.0.52 → 4.0.54

package/bundled-skills/docs/contributors/quality-bar.md

@@ -1,104 +0,0 @@
-# 🏆 Quality Bar & Validation Standards
-
-To transform **Agentic Awesome Skills** from a collection of scripts into a trusted platform, every skill must meet a specific standard of quality and safety.
-
-## The "Validated" Badge ✅
-
-A skill earns the "Validated" badge only if it meets these **6 quality checks**. Some are enforced automatically today, while others still require reviewer judgment:
-
-### 1. Metadata Integrity
-
-The `SKILL.md` frontmatter must be valid YAML and contain:
-
-- `name`: Kebab-case, matches folder name.
-- `description`: Under 200 chars, clear value prop.
-- `risk`: One of `[none, safe, critical, offensive, unknown]`. Use `unknown` only for legacy or unclassified skills; prefer a concrete level for new skills.
-- `source`: URL to original source (or "self" if original).
-
-### 2. Clear Triggers ("When to use")
-
-The skill MUST have a section explicitly stating when to trigger it.
-
-- **Good**: "Use when the user asks to debug a React component."
-- **Bad**: "This skill helps you with code."
-Accepted headings: `## When to Use`, `## Use this skill when`, `## When to Use This Skill`.
-
-### 3. Safety & Risk Classification
-
-Every skill must declare its risk level:
-
-- ⚪ **unknown**: Legacy or unclassified content. Avoid this for new skills unless maintainer triage is genuinely needed.
-- 🟢 **none**: Pure text/reasoning (e.g., Brainstorming).
-- 🔵 **safe**: Reads files, runs safe commands (e.g., Linter).
-- 🟠 **critical**: Modifies state, deletes files, pushes to prod (e.g., Git Push).
-- 🔴 **offensive**: Pentesting/Red Team tools. **MUST** have "Authorized Use Only" warning.
-
-### 4. Copy-Pasteable Examples
-
-At least one code block or interaction example that a user (or agent) can immediately use.
-
-### 5. Explicit Limitations
-
-A list of known edge cases or things the skill _cannot_ do.
-
-- _Example_: "Does not work on Windows without WSL."
-
-### 6. Instruction Safety Review
-
-If a skill includes command examples, remote fetch steps, secrets, or mutation guidance, the PR must document the risk and pass `npm run security:docs` in addition to normal validation.
-
-For pull requests that add or modify `SKILL.md`, GitHub also runs the automated `skill-review` workflow. Treat that review as part of the normal PR quality gate and address any actionable findings before merge. A successful result is reused when a later push has the identical changed-skill content; if Tessl credits are unavailable, the workflow records `manual-review-required` for exact-head maintainer attestation instead of pretending an automated review passed.
-Automated checks are necessary, but they do **not** replace manual reviewer judgment on logic, safety, and likely failure modes.
-
-`npm run security:docs` enforces a repo-wide scan for:
-
-- command pipelines like `curl ... | bash`, `wget ... | sh`, `irm ... | iex`,
-- inline token/secret-style command examples,
-- deliberate allowlisted high-risk documentation commands via `<!-- security-allowlist: ... -->`.
-
-### Additional Maintainer Audit
-
-Use `npm run audit:skills` when you need a repo-wide report that goes beyond schema validation and answers:
-
-- which skills are structurally valid but still need usability cleanup,
-- which skills still have truncated descriptions (issue `#365`),
-- which skills are missing examples or limitations,
-- and which skills have the highest concentration of warnings/errors.
-
-Risk labels remain declared metadata. The audit validates their presence and shape, while ambiguous `risk: unknown` cases require semantic review rather than lexical inference.
-
----
-
-## Support Levels
-
-We also categorize skills by who maintains them:
-
-| Level         | Badge | Meaning                                             |
-| :------------ | :---- | :-------------------------------------------------- |
-| **Official**  | 🟣    | Maintained by the core team. High reliability.      |
-| **Community** | ⚪    | Contributed by the ecosystem. Best effort support.  |
-| **Verified**  | ✨    | Community skill that has passed deep manual review. |
-
----
-
-## How to Validate Your Skill
-
-The canonical validator is `tools/scripts/validate_skills.py`, but the recommended entrypoint is `npm run validate` before submitting a PR:
-
-```bash
-npm run validate
-npm run audit:skills
-npm run validate:references
-npm test
-npm run security:docs
-```
-
-Notes:
-
-- `npm run validate` is the operational contributor gate.
-- `npm run audit:skills` is the maintainer-facing compliance/usability report for the full library.
-- `npm run security:docs` is required for command-heavy or risky skill content.
-- PRs that touch `SKILL.md` also get an automated `skill-review` GitHub Actions check.
-- Skill changes and risky guidance still require a manual logic review before merge, even when the automated gates pass.
-- `npm run validate:strict` is a useful hardening pass, but the repository still contains legacy skills that do not yet satisfy strict validation.
-- Examples and limitations remain part of the quality bar even when they are not fully auto-enforced by the current validator.

package/bundled-skills/docs/contributors/security-guardrails.md

@@ -1,70 +0,0 @@
-# 🛡️ Security Guardrails & Policy
-
-Agentic Awesome Skills is a powerful toolkit. With great power comes great responsibility. This document defines the **Rules of Engagement** for all security and offensive capabilities in this repository.
-
-## 🔴 Offensive Skills Policy (The "Red Line")
-
-**What is an Offensive Skill?**
-Any skill designed to penetrate, exploit, disrupt, or simulate attacks against systems.
-_Examples: Pentesting, SQL Injection, Phishing Simulation, Red Teaming._
-
-### 1. The "Authorized Use Only" Disclaimer
-
-Every offensive skill **MUST** begin with this exact disclaimer in its `SKILL.md`:
-
-> **⚠️ AUTHORIZED USE ONLY**
-> This skill is for educational purposes or authorized security assessments only.
-> You must have explicit, written permission from the system owner before using this tool.
-> Misuse of this tool is illegal and strictly prohibited.
-
-### 2. Mandatory User Confirmation
-
-Offensive skills must **NEVER** run fully autonomously.
-
-- **Requirement**: Before each command that probes, exploits, changes, persists
-  on, extracts data from, or attempts credential access against a target, the
-  agent must collect the exact target, written-authorization confirmation, and
-  permitted scope; show the exact command and expected effect; and wait for
-  explicit confirmation in the current conversation.
-- Without that confirmation, the skill must remain read-only and provide
-  defensive guidance only.
-
-### 3. Safe by Design
-
-- **No Weaponized Payloads**: Skills should not include active malware, ransomware, or non-educational exploits.
-- **Sandbox Recommended**: Instructions should recommend running in a contained environment (Docker/VM).
-
----
-
-## 🔵 Defensive Skills Policy
-
-**What is a Defensive Skill?**
-Tools for hardening, auditing, monitoring, or protecting systems.
-_Examples: Linting, Log Analysis, Configuration Auditing._
-
-- **Data Privacy**: Defensive skills must not upload data to 3rd party servers without explicit user consent.
-- **Non-Destructive**: Audits should be read-only by default.
-- **Documentation review**: Defensive skills with command examples must still be reviewed for unsafe command patterns.
-- **High-risk examples** (`curl|bash`, `wget|sh`, etc.) must use explicit allowlisting comments and clear warning context in the skill body when retained for operational examples.
-
-## External Source Installation
-
-- Do not clone or download a moving branch directly into an active skills,
-  plugin, hook, or agent-configuration directory.
-- Pin external examples to a full reviewed commit or immutable release, clone to
-  a temporary review directory, and inspect every bundled file before activation.
-- Report scripts, package lifecycle hooks, symlinks, binaries, network access,
-  credential handling, privileged actions, and destructive operations.
-- Obtain explicit user approval before downloading and again before copying,
-  installing dependencies, enabling hooks, or changing agent configuration.
-- A pin provides reproducibility, not proof of trust; upgrading requires a new review.
-
----
-
-## ⚖️ Legal Disclaimer
-
-By using this repository, you agree that:
-
-1. You are responsible for your own actions.
-2. The authors and contributors are not liable for any damage caused by these tools.
-3. You will comply with all local, state, and federal laws regarding cybersecurity.