opencode-skills-collection 4.0.53 → 4.0.55

package/bundled-skills/stripe-integration/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: stripe-integration
-description: "Master Stripe payment processing integration for robust, PCI-compliant payment flows including checkout, subscriptions, webhooks, and refunds."
+description: "Implement and verify Stripe checkout, subscriptions, webhooks and refunds with explicit server-side authorization and retry boundaries."
 risk: critical
 source: community
 date_added: "2026-02-27"
@@ -8,7 +8,7 @@ date_added: "2026-02-27"
 
 # Stripe Integration
 
-Master Stripe payment processing integration for robust, PCI-compliant payment flows including checkout, subscriptions, webhooks, and refunds.
+Implement and verify Stripe checkout, subscriptions, webhooks and refunds with explicit server-side authorization and retry boundaries.
 
 ## Do not use this skill when
 
@@ -20,7 +20,7 @@ Master Stripe payment processing integration for robust, PCI-compliant payment f
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
+- Inspect the installed Stripe SDK and pinned API/webhook version. This single-file skill has no bundled playbook or production wrapper.
 
 ## Use this skill when
 
@@ -37,13 +37,13 @@ Master Stripe payment processing integration for robust, PCI-compliant payment f
 ### 1. Payment Flows
 **Checkout Session (Hosted)**
 - Stripe-hosted payment page
-- Minimal PCI compliance burden
+- Reduced direct card-data handling
 - Fastest implementation
 - Supports one-time and recurring payments
 
 **Payment Intents (Custom UI)**
 - Full control over payment UI
-- Requires Stripe.js for PCI compliance
+- Uses Stripe.js/Elements to avoid handling raw card data directly
 - More complex implementation
 - Better customization options
 
@@ -74,6 +74,12 @@ Master Stripe payment processing integration for robust, PCI-compliant payment f
 - Track customer metadata
 - Manage billing details
 
+## Inputs and safety boundary
+
+Use an explicitly authorized Stripe test account/sandbox, server-owned order and customer records, the installed SDK/API version and expected webhook types. Amounts, currencies, price/customer IDs and refund permissions must come from authenticated server policy, not arbitrary client parameters. Checkout/Elements can reduce card-data exposure; they do not establish PCI compliance by themselves.
+
+The snippets are integration sketches. Test secret keys and webhook signing secrets are different; load them from the project secret mechanism and never print them. No live payment, refund, customer update or account configuration is authorized merely by reading this skill.
+
 ## Quick Start
 
 ```python
@@ -111,7 +117,7 @@ print(session.url)
 
 ### Pattern 1: One-Time Payment (Hosted Checkout)
 ```python
-def create_checkout_session(amount, currency='usd'):
+def create_checkout_session(amount, order_attempt_id, currency='usd'):
     """Create a one-time payment checkout session."""
     try:
         session = stripe.checkout.Session.create(
@@ -133,7 +139,8 @@ def create_checkout_session(amount, currency='usd'):
             metadata={
                 'order_id': 'order_123',
                 'user_id': 'user_456'
-            }
+            },
+            idempotency_key=order_attempt_id
         )
         return session
     except stripe.error.StripeError as e:
@@ -144,7 +151,7 @@ def create_checkout_session(amount, currency='usd'):
 
 ### Pattern 2: Custom Payment Intent Flow
 ```python
-def create_payment_intent(amount, currency='usd', customer_id=None):
+def create_payment_intent(amount, order_attempt_id, currency='usd', customer_id=None):
     """Create a payment intent for custom checkout UI."""
     intent = stripe.PaymentIntent.create(
         amount=amount,
@@ -155,9 +162,10 @@ def create_payment_intent(amount, currency='usd', customer_id=None):
         },
         metadata={
             'integration_check': 'accept_a_payment'
-        }
+        },
+        idempotency_key=order_attempt_id
     )
-    return intent.client_secret  # Send to frontend
+    return intent.client_secret  # Only to the authenticated client for this order; never log it
 
 # Frontend (JavaScript)
 """
@@ -181,32 +189,16 @@ const {error, paymentIntent} = await stripe.confirmCardPayment(
 if (error) {
     // Handle error
 } else if (paymentIntent.status === 'succeeded') {
-    // Payment successful
+    // Update display only; server fulfillment still verifies payment state
 }
 """
 ```
 
-### Pattern 3: Subscription Creation
-```python
-def create_subscription(customer_id, price_id):
-    """Create a subscription for a customer."""
-    try:
-        subscription = stripe.Subscription.create(
-            customer=customer_id,
-            items=[{'price': price_id}],
-            payment_behavior='default_incomplete',
-            payment_settings={'save_default_payment_method': 'on_subscription'},
-            expand=['latest_invoice.payment_intent'],
-        )
+### Pattern 3: Subscription creation contract
 
-        return {
-            'subscription_id': subscription.id,
-            'client_secret': subscription.latest_invoice.payment_intent.client_secret
-        }
-    except stripe.error.StripeError as e:
-        print(f"Subscription creation failed: {e}")
-        raise
-```
+Use the flow documented for the account’s pinned API version. Do not assume `latest_invoice.payment_intent` exists in every version or that every invoice has an immediately confirmable payment. Resolve an authorized customer and allowed price, create the incomplete subscription with an idempotency key, and handle the returned confirmation state through that version’s API. Grant access from verified subscription/invoice state; test trials, zero-amount invoices, delayed payments, cancellation and retries.
+
+See [Stripe subscription integration](https://docs.stripe.com/billing/subscriptions/build-subscriptions). The customer portal below also requires ownership checks before accepting a customer ID.
 
 ### Pattern 4: Customer Portal
 ```python
@@ -233,8 +225,10 @@ endpoint_secret = os.environ["STRIPE_WEBHOOK_SECRET"]
 
 @app.route('/webhook', methods=['POST'])
 def webhook():
-    payload = request.data
+    payload = request.get_data(cache=False)  # Exact raw bytes; enforce an ingress body-size limit
     sig_header = request.headers.get('Stripe-Signature')
+    if not sig_header:
+        return 'Missing signature', 400
 
     try:
         event = stripe.Webhook.construct_event(
@@ -243,10 +237,12 @@ def webhook():
     except ValueError:
         # Invalid payload
         return 'Invalid payload', 400
-    except stripe.error.SignatureVerificationError:
+    except stripe.SignatureVerificationError:
         # Invalid signature
         return 'Invalid signature', 400
 
+    # Integration sketch: durable deduplication/queueing below must precede effects.
+    # Bind account, mode, order, amount/currency and expected current state first.
     # Handle the event
     if event['type'] == 'payment_intent.succeeded':
         payment_intent = event['data']['object']
@@ -286,37 +282,22 @@ def handle_subscription_canceled(subscription):
     print(f"Subscription canceled: {subscription['id']}")
 ```
 
-### Webhook Best Practices
-```python
-import hashlib
-import hmac
-
-def verify_webhook_signature(payload, signature, secret):
-    """Manually verify webhook signature."""
-    expected_sig = hmac.new(
-        secret.encode('utf-8'),
-        payload,
-        hashlib.sha256
-    ).hexdigest()
-
-    return hmac.compare_digest(signature, expected_sig)
-
-def handle_webhook_idempotently(event_id, handler):
-    """Ensure webhook is processed exactly once."""
-    # Check if event already processed
-    if is_event_processed(event_id):
-        return
-
-    # Process event
-    try:
-        handler()
-        mark_event_processed(event_id)
-    except Exception as e:
-        log_error(e)
-        # Stripe will retry failed webhooks
-        raise
+### Signature, duplication and fulfillment
+
+Use `stripe.Webhook.construct_event` with the raw bytes, full `Stripe-Signature` header and correct endpoint secret. A bare HMAC over the body does not implement Stripe’s timestamped header format or replay tolerance. Keep the SDK’s timestamp check and verify both invalid and stale signatures. See [Stripe webhook documentation](https://docs.stripe.com/webhooks).
+
+```text
+Verify signature and event/account/mode before accepting the event.
+Atomically insert event.id into a durable inbox with a unique constraint.
+Return 2xx only after durable acceptance; retryable storage failure remains a failure.
+A worker reconciles current payment/order state and applies a guarded transition.
+Use a unique order/fulfillment key as well: different events can describe the same payment.
+Commit the state change and an outbox entry together; downstream effects are idempotent.
+Duplicate/concurrent delivery returns the recorded result without fulfilling twice.
 ```
 
+A check-then-handle-then-mark sequence is not atomic and does not provide exactly-once effects. Events can arrive out of order. The sample Flask handlers above are placeholders, not a complete durable processor; do not deploy them as fulfillment. Checkout success redirects are UI signals, not proof of payment. Consult [fulfillment guidance](https://docs.stripe.com/checkout/fulfillment) and [request idempotency](https://docs.stripe.com/api/idempotent_requests).
+
 ## Customer Management
 
 ```python
@@ -362,25 +343,27 @@ def list_customer_payment_methods(customer_id):
 ## Refund Handling
 
 ```python
-def create_refund(payment_intent_id, amount=None, reason=None):
+def create_refund(payment_intent_id, refund_attempt_id, amount=None, reason=None):
     """Create a refund."""
     refund_params = {
         'payment_intent': payment_intent_id
     }
 
-    if amount:
+    if amount is not None:
+        if type(amount) is not int or amount <= 0:
+            raise ValueError("Refund amount must be a positive minor-unit integer")
         refund_params['amount'] = amount  # Partial refund
 
     if reason:
         refund_params['reason'] = reason  # 'duplicate', 'fraudulent', 'requested_by_customer'
 
-    refund = stripe.Refund.create(**refund_params)
+    refund = stripe.Refund.create(**refund_params, idempotency_key=refund_attempt_id)
     return refund
 
-def handle_dispute(charge_id, evidence):
+def handle_dispute(dispute_id, evidence):
     """Update dispute with evidence."""
     stripe.Dispute.modify(
-        charge_id,
+        dispute_id,
         evidence={
             'customer_name': evidence.get('customer_name'),
             'customer_email_address': evidence.get('customer_email'),
@@ -430,16 +413,11 @@ def test_payment_flow():
     assert confirmed.status == 'succeeded'
 ```
 
-## Resources
+## Worked verification case
 
-- **references/checkout-flows.md**: Detailed checkout implementation
-- **references/webhook-handling.md**: Webhook security and processing
-- **references/subscription-management.md**: Subscription lifecycle
-- **references/customer-management.md**: Customer and payment method handling
-- **references/invoice-generation.md**: Invoicing and billing
-- **assets/stripe-client.py**: Production-ready Stripe client wrapper
-- **assets/webhook-handler.py**: Complete webhook processor
-- **assets/checkout-config.json**: Checkout configuration templates
+For an authorized test order, deliver the same valid payment event twice and concurrently, then a stale/invalid signature and an older out-of-order state event. Expected: one durable fulfillment, rejected invalid signatures, and no rollback of a newer state. Simulate a storage failure before inbox commit; it must not return a success that loses the event. Assert a zero-amount refund is rejected rather than silently becoming a full refund.
+
+These are acceptance checks to implement in the project. This skill records no live transaction result and includes no hidden client wrapper or extra reference files.
 
 ## Best Practices
 
@@ -461,6 +439,9 @@ def test_payment_flow():
 - **Ignoring Test Mode**: Test all edge cases with test cards
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
-- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+- API versions, event payloads and SDK exception namespaces differ; verify the installed version rather than combining examples from different releases.
+- Request idempotency keys must stay bound to the same logical operation and parameters; a new key on every retry can duplicate a charge or refund.
+- Webhook deduplication alone does not prevent duplicate business effects from different events.
+- Client success, test-card success and a signature check do not establish full fulfillment, tax, compliance or subscription correctness.
+- Customer, payment-method, dispute and refund mutations require server-side ownership/role checks and explicit task authorization.

package/bundled-skills/styleseed-design-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: styleseed-design-review
-description: Reviews UI/frontend code and tells you exactly why it "looks AI-generated" — then how to fix it. Use it when a React/Tailwind/HTML interface looks off, generic, or unfinished, when you want a design score before shipping, or when asked to make UI look more professional, polished, or...
+description: "Reviews UI/frontend code and tells you exactly why it \"looks AI-generated\" — then how to fix it."
 risk: safe
 source: https://github.com/bitjaru/styleseed/tree/main/skills/styleseed-design-review
 source_repo: bitjaru/styleseed

package/bundled-skills/subagent-orchestrator/SKILL.md

@@ -2,6 +2,7 @@
 name: subagent-orchestrator
 risk: safe
 source: community
+date_added: "2026-09-04"
 description: Coordinate quota-aware parallel subagents for large, multi-file Antigravity tasks.
 version: 1.0.0
 author: community

package/bundled-skills/subject-line-psychologist/SKILL.md

@@ -112,6 +112,12 @@ Before finalizing output, the agent asks:
 - [ ] Is it short enough for the device context?
 - [ ] Does the email body satisfy the promise?
 
+## Example
+
+**User request:**
+
+> Rewrite these email subject lines for stronger open-rate psychology while preserving clarity and truthful claims.
+
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.

package/bundled-skills/supabase/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: supabase
-description: "Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout,..."
+description: "Use when doing ANY task involving Supabase."
 risk: critical
 source: https://github.com/supabase/agent-skills/tree/main/skills/supabase
 source_repo: supabase/agent-skills

package/bundled-skills/supabase-automation/SKILL.md

@@ -238,6 +238,12 @@ Automate Supabase operations including database queries, table schema inspection
 ## When to Use
 This skill is applicable to execute the workflow or actions described in the overview.
 
+## Example
+
+**User request:**
+
+> Automate Supabase database queries, table management, project administration, storage, edge functions, and SQL execution via Rube MCP (Composio).
+
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.

package/bundled-skills/superpowers-lab/SKILL.md

@@ -22,6 +22,12 @@ This skill provides guidance and patterns for lab environment for claude superpo
 
 For more information, see the [source repository](https://github.com/obra/superpowers-lab).
 
+## Example
+
+**User request:**
+
+> Use @superpowers-lab for this task: Lab environment for Claude superpowers.
+
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.

package/bundled-skills/supply-chain-risk-auditor/SKILL.md

@@ -9,6 +9,7 @@ allowed-tools:
   - Grep
 risk: critical
 source: community
+date_added: "2026-09-04"
 ---
 
 # Supply Chain Risk Auditor
@@ -67,6 +68,12 @@ You achieve your purpose by:
 
 **NOTE:** Do not add sections beyond those noted in `results-template.md`.
 
+## Example
+
+**User request:**
+
+> Assess dependency risk before a security audit.
+
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.

package/bundled-skills/swiftui-expert-skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: swiftui-expert-skill
-description: Use when writing, reviewing, or refactoring SwiftUI code for iOS or macOS, including state management and `@Observable` data flow, view composition and invalidation/performance, lists and `ForEach` identity, environment usage, localization, animations, Liquid Glass adoption, migrating...
+description: "Write, review, and refactor SwiftUI for iOS or macOS, covering data flow, view composition, performance, identity, environment, localization, animation, API migration, and Instruments traces."
 risk: critical
 source: https://github.com/AvdLee/SwiftUI-Agent-Skill/tree/main/swiftui-expert-skill
 source_repo: AvdLee/SwiftUI-Agent-Skill