opencode-skills-collection 4.0.54 → 4.0.56

package/bundled-skills/notebooklm/scripts/config.py

@@ -4,6 +4,7 @@ Centralizes constants, selectors, and paths
 """
 
 import os
+import stat
 from pathlib import Path
 
 # Paths
@@ -19,6 +20,35 @@ STATE_FILE = BROWSER_STATE_DIR / "state.json"
 AUTH_INFO_FILE = DATA_DIR / "auth_info.json"
 LIBRARY_FILE = DATA_DIR / "library.json"
 
+def protect_state_path(path, *, directory=False):
+    """Repair only owned state paths; never follow links or mutate hard links."""
+    flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0)
+    if path.is_symlink():
+        raise OSError(f"Refusing linked state path: {path}")
+    if directory:
+        path.mkdir(parents=True, exist_ok=True, mode=0o700)
+        # Windows does not support opening directories this way; privacy there
+        # is governed by the user profile ACL, not POSIX permission bits.
+        if os.name == "nt":
+            path.chmod(0o700)
+            return
+        flags |= getattr(os, "O_DIRECTORY", 0)
+    elif not path.exists():
+        return
+    fd = os.open(path, flags)
+    try:
+        info = os.fstat(fd)
+        valid = stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode) and info.st_nlink == 1
+        if not valid:
+            raise OSError(f"Refusing unsafe state path: {path}")
+        if hasattr(os, "fchmod"):
+            os.fchmod(fd, 0o700 if directory else 0o600)
+        else:
+            os.chmod(path, 0o600)
+    finally:
+        os.close(fd)
+
+
 # Browser profiles and storage-state files contain live Google credentials.
 # A restrictive umask also covers files created later by Chromium.
 os.umask(0o077)
@@ -31,18 +61,10 @@ def ensure_private_state():
         DATA_DIR.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
         shutil.move(str(LEGACY_DATA_DIR), str(DATA_DIR))
         print(f"⚠️ Migrated sensitive NotebookLM state to private user storage: {DATA_DIR}")
-    for directory in (DATA_DIR.parent.parent, DATA_DIR.parent, DATA_DIR, BROWSER_STATE_DIR, BROWSER_PROFILE_DIR):
-        directory.mkdir(parents=True, exist_ok=True, mode=0o700)
-        try:
-            directory.chmod(0o700)
-        except OSError:
-            pass
+    for directory in (DATA_DIR, BROWSER_STATE_DIR, BROWSER_PROFILE_DIR):
+        protect_state_path(directory, directory=True)
     for file_path in (STATE_FILE, AUTH_INFO_FILE, LIBRARY_FILE):
-        if file_path.exists() and not file_path.is_symlink():
-            try:
-                file_path.chmod(0o600)
-            except OSError:
-                pass
+        protect_state_path(file_path)
 
 # NotebookLM Selectors
 QUERY_INPUT_SELECTORS = [

package/bundled-skills/observability-and-instrumentation/SKILL.md

@@ -88,7 +88,10 @@ logger.warn({
 ```typescript
 // Express: child logger per request, ID propagated downstream
 app.use((req, res, next) => {
-  req.id = req.headers['x-request-id'] ?? crypto.randomUUID();
+  const suppliedId = req.headers['x-request-id'];
+  req.id = typeof suppliedId === 'string' && /^[A-Za-z0-9_-]{1,64}$/.test(suppliedId)
+    ? suppliedId
+    : crypto.randomUUID();
   req.log = logger.child({ requestId: req.id });
   res.setHeader('x-request-id', req.id);
   next();

package/bundled-skills/observability-and-instrumentation/references/observability-checklist.md

@@ -0,0 +1,13 @@
+# Instrumentation acceptance checklist
+
+## Inputs
+
+Write the on-call questions and identify the authorized staging environment.
+
+## Procedure and verification
+
+Check structured event names and bounded correlation identifiers; reject or regenerate malformed external identifiers. Confirm redaction on nested errors and request paths. Verify rate, error and duration metrics with bounded labels; follow a request across service boundaries. Exercise an allowed failure and verify its log, metric and trace. Test alert delivery only to an authorized test destination, then restore any changed thresholds.
+
+## Limitations
+
+Record evidence and untested boundaries before launch. Do not send private data to an external telemetry backend without authorization. Head sampling can discard errors before tail sampling sees them; document that coverage limit.

package/bundled-skills/pci-compliance/SKILL.md

@@ -1,488 +1,42 @@
 ---
 name: pci-compliance
-description: "Master PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data."
+description: "Review payment data flows and engineering control evidence for a scoped PCI assessment, without claiming certification."
 risk: critical
 source: community
 date_added: "2026-02-27"
 ---
 
-# PCI Compliance
+# Payment Data and PCI Evidence Review
 
-Master PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data.
+## When to Use
 
-## Do not use this skill when
+Review payment data flows, prepare engineering controls or collect evidence for a scoped PCI assessment. This skill does not certify compliance or determine assessment eligibility on its own.
 
-- The task is unrelated to pci compliance
-- You need a different domain or tool outside this scope
+## Inputs and prerequisites
 
-## Instructions
+Identify the merchant/service-provider role, acquiring institution, processor integration, systems handling account data and the applicable assessment documents. Obtain the current documents from the [PCI SSC document library](https://www.pcisecuritystandards.org/document_library/); confirm applicability with the responsible assessor or acquiring institution.
 
-- Clarify goals, constraints, and required inputs.
-- Apply relevant best practices and validate outcomes.
-- Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
+## Procedure
 
-## Use this skill when
+1. Follow `resources/implementation-playbook.md` to map forms, APIs, storage, queues, logs, telemetry, backups and support exports.
+2. Prefer provider-hosted collection when appropriate. Verify what the application actually receives; a tokenization claim does not prove that raw account data never reaches another system.
+3. Minimize retained data and document purpose, access, retention and deletion. Do not retain sensitive authentication data after authorization, even encrypted. Do not build a custom card vault from an illustrative encryption snippet.
+4. Map required controls to implementation evidence: network boundaries, system configuration, data protection, access, monitoring, testing and operational ownership. Keep unverified controls marked as gaps.
+5. Use allowlisted event fields in logs and responses. Test nested errors and retries with synthetic data; denylist filtering cannot anticipate every sensitive field name.
+6. Verify role and resource authorization together. A broad payment role does not grant access to every customer's payment method.
+7. Produce a control/evidence/gap/owner table and remediation plan. Treat SAQ eligibility, transaction thresholds and formal attestation as decisions requiring the applicable current guidance.
 
-- Building payment processing systems
-- Handling credit card information
-- Implementing secure payment flows
-- Conducting PCI compliance audits
-- Reducing PCI compliance scope
-- Implementing tokenization and encryption
-- Preparing for PCI DSS assessments
+## Example
 
-## PCI DSS Requirements (12 Core Requirements)
+Input: a checkout webhook is copied into application logs. Replace the log payload with approved event type, internal request ID and outcome fields. Exercise success, failure and retries using the processor's test environment. Verify the logs contain no synthetic account-data markers and that payment handling still meets its contract.
 
-### Build and Maintain Secure Network
-1. Install and maintain firewall configuration
-2. Don't use vendor-supplied defaults for passwords
+## Verification
 
-### Protect Cardholder Data
-3. Protect stored cardholder data
-4. Encrypt transmission of cardholder data across public networks
-
-### Maintain Vulnerability Management
-5. Protect systems against malware
-6. Develop and maintain secure systems and applications
-
-### Implement Strong Access Control
-7. Restrict access to cardholder data by business need-to-know
-8. Identify and authenticate access to system components
-9. Restrict physical access to cardholder data
-
-### Monitor and Test Networks
-10. Track and monitor all access to network resources and cardholder data
-11. Regularly test security systems and processes
-
-### Maintain Information Security Policy
-12. Maintain a policy that addresses information security
-
-## Compliance Levels
-
-**Level 1**: > 6 million transactions/year (annual ROC required)
-**Level 2**: 1-6 million transactions/year (annual SAQ)
-**Level 3**: 20,000-1 million e-commerce transactions/year
-**Level 4**: < 20,000 e-commerce or < 1 million total transactions
-
-## Data Minimization (Never Store)
-
-```python
-# NEVER STORE THESE
-PROHIBITED_DATA = {
-    'full_track_data': 'Magnetic stripe data',
-    'cvv': 'Card verification code/value',
-    'pin': 'PIN or PIN block'
-}
-
-# CAN STORE (if encrypted)
-ALLOWED_DATA = {
-    'pan': 'Primary Account Number (card number)',
-    'cardholder_name': 'Name on card',
-    'expiration_date': 'Card expiration',
-    'service_code': 'Service code'
-}
-
-class PaymentData:
-    """Safe payment data handling."""
-
-    def __init__(self):
-        self.prohibited_fields = ['cvv', 'cvv2', 'cvc', 'pin']
-
-    def sanitize_log(self, data):
-        """Remove sensitive data from logs."""
-        sanitized = data.copy()
-
-        # Mask PAN
-        if 'card_number' in sanitized:
-            card = sanitized['card_number']
-            sanitized['card_number'] = f"{card[:6]}{'*' * (len(card) - 10)}{card[-4:]}"
-
-        # Remove prohibited data
-        for field in self.prohibited_fields:
-            sanitized.pop(field, None)
-
-        return sanitized
-
-    def validate_no_prohibited_storage(self, data):
-        """Ensure no prohibited data is being stored."""
-        for field in self.prohibited_fields:
-            if field in data:
-                raise SecurityError(f"Attempting to store prohibited field: {field}")
-```
-
-## Tokenization
-
-### Using Payment Processor Tokens
-```python
-import stripe
-
-class TokenizedPayment:
-    """Handle payments using tokens (no card data on server)."""
-
-    @staticmethod
-    def create_payment_method_token(card_details):
-        """Create token from card details (client-side only)."""
-        # THIS SHOULD ONLY BE DONE CLIENT-SIDE WITH STRIPE.JS
-        # NEVER send card details to your server
-
-        """
-        // Frontend JavaScript
-        const stripe = Stripe('pk_...');
-
-        const {token, error} = await stripe.createToken({
-            card: {
-                number: '4242424242424242',
-                exp_month: 12,
-                exp_year: 2024,
-                cvc: '123'
-            }
-        });
-
-        // Send token.id to server (NOT card details)
-        """
-        pass
-
-    @staticmethod
-    def charge_with_token(token_id, amount):
-        """Charge using token (server-side)."""
-        import os
-
-        # Your server only sees the token, never the card number
-        stripe.api_key = os.environ["STRIPE_SECRET_KEY"]
-
-        charge = stripe.Charge.create(
-            amount=amount,
-            currency="usd",
-            source=token_id,  # Token instead of card details
-            description="Payment"
-        )
-
-        return charge
-
-    @staticmethod
-    def store_payment_method(customer_id, payment_method_token):
-        """Store payment method as token for future use."""
-        stripe.Customer.modify(
-            customer_id,
-            source=payment_method_token
-        )
-
-        # Store only customer_id and payment_method_id in your database
-        # NEVER store actual card details
-        return {
-            'customer_id': customer_id,
-            'has_payment_method': True
-            # DO NOT store: card number, CVV, etc.
-        }
-```
-
-### Custom Tokenization (Advanced)
-```python
-import secrets
-from cryptography.fernet import Fernet
-
-class TokenVault:
-    """Secure token vault for card data (if you must store it)."""
-
-    def __init__(self, encryption_key):
-        self.cipher = Fernet(encryption_key)
-        self.vault = {}  # In production: use encrypted database
-
-    def tokenize(self, card_data):
-        """Convert card data to token."""
-        # Generate secure random token
-        token = secrets.token_urlsafe(32)
-
-        # Encrypt card data
-        encrypted = self.cipher.encrypt(json.dumps(card_data).encode())
-
-        # Store token -> encrypted data mapping
-        self.vault[token] = encrypted
-
-        return token
-
-    def detokenize(self, token):
-        """Retrieve card data from token."""
-        encrypted = self.vault.get(token)
-        if not encrypted:
-            raise ValueError("Token not found")
-
-        # Decrypt
-        decrypted = self.cipher.decrypt(encrypted)
-        return json.loads(decrypted.decode())
-
-    def delete_token(self, token):
-        """Remove token from vault."""
-        self.vault.pop(token, None)
-```
-
-## Encryption
-
-### Data at Rest
-```python
-from cryptography.hazmat.primitives.ciphers.aead import AESGCM
-import os
-
-class EncryptedStorage:
-    """Encrypt data at rest using AES-256-GCM."""
-
-    def __init__(self, encryption_key):
-        """Initialize with 256-bit key."""
-        self.key = encryption_key  # Must be 32 bytes
-
-    def encrypt(self, plaintext):
-        """Encrypt data."""
-        # Generate random nonce
-        nonce = os.urandom(12)
-
-        # Encrypt
-        aesgcm = AESGCM(self.key)
-        ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)
-
-        # Return nonce + ciphertext
-        return nonce + ciphertext
-
-    def decrypt(self, encrypted_data):
-        """Decrypt data."""
-        # Extract nonce and ciphertext
-        nonce = encrypted_data[:12]
-        ciphertext = encrypted_data[12:]
-
-        # Decrypt
-        aesgcm = AESGCM(self.key)
-        plaintext = aesgcm.decrypt(nonce, ciphertext, None)
-
-        return plaintext.decode()
-
-# Usage
-storage = EncryptedStorage(os.urandom(32))
-encrypted_pan = storage.encrypt("4242424242424242")
-# Store encrypted_pan in database
-```
-
-### Data in Transit
-```python
-# Always use TLS 1.2 or higher
-# Flask/Django example
-app.config['SESSION_COOKIE_SECURE'] = True  # HTTPS only
-app.config['SESSION_COOKIE_HTTPONLY'] = True
-app.config['SESSION_COOKIE_SAMESITE'] = 'Strict'
-
-# Enforce HTTPS
-from flask_talisman import Talisman
-Talisman(app, force_https=True)
-```
-
-## Access Control
-
-```python
-from functools import wraps
-from flask import session
-
-def require_pci_access(f):
-    """Decorator to restrict access to cardholder data."""
-    @wraps(f)
-    def decorated_function(*args, **kwargs):
-        user = session.get('user')
-
-        # Check if user has PCI access role
-        if not user or 'pci_access' not in user.get('roles', []):
-            return {'error': 'Unauthorized access to cardholder data'}, 403
-
-        # Log access attempt
-        audit_log(
-            user=user['id'],
-            action='access_cardholder_data',
-            resource=f.__name__
-        )
-
-        return f(*args, **kwargs)
-
-    return decorated_function
-
-@app.route('/api/payment-methods')
-@require_pci_access
-def get_payment_methods():
-    """Retrieve payment methods (restricted access)."""
-    # Only accessible to users with pci_access role
-    pass
-```
-
-## Audit Logging
-
-```python
-import logging
-from datetime import datetime
-
-class PCIAuditLogger:
-    """PCI-compliant audit logging."""
-
-    def __init__(self):
-        self.logger = logging.getLogger('pci_audit')
-        # Configure to write to secure, append-only log
-
-    def log_access(self, user_id, resource, action, result):
-        """Log access to cardholder data."""
-        entry = {
-            'timestamp': datetime.utcnow().isoformat(),
-            'user_id': user_id,
-            'resource': resource,
-            'action': action,
-            'result': result,
-            'ip_address': request.remote_addr
-        }
-
-        self.logger.info(json.dumps(entry))
-
-    def log_authentication(self, user_id, success, method):
-        """Log authentication attempt."""
-        entry = {
-            'timestamp': datetime.utcnow().isoformat(),
-            'user_id': user_id,
-            'event': 'authentication',
-            'success': success,
-            'method': method,
-            'ip_address': request.remote_addr
-        }
-
-        self.logger.info(json.dumps(entry))
-
-# Usage
-audit = PCIAuditLogger()
-audit.log_access(user_id=123, resource='payment_methods', action='read', result='success')
-```
-
-## Security Best Practices
-
-### Input Validation
-```python
-import re
-
-def validate_card_number(card_number):
-    """Validate card number format (Luhn algorithm)."""
-    # Remove spaces and dashes
-    card_number = re.sub(r'[\s-]', '', card_number)
-
-    # Check if all digits
-    if not card_number.isdigit():
-        return False
-
-    # Luhn algorithm
-    def luhn_checksum(card_num):
-        def digits_of(n):
-            return [int(d) for d in str(n)]
-
-        digits = digits_of(card_num)
-        odd_digits = digits[-1::-2]
-        even_digits = digits[-2::-2]
-        checksum = sum(odd_digits)
-        for d in even_digits:
-            checksum += sum(digits_of(d * 2))
-        return checksum % 10
-
-    return luhn_checksum(card_number) == 0
-
-def sanitize_input(user_input):
-    """Sanitize user input to prevent injection."""
-    # Remove special characters
-    # Validate against expected format
-    # Escape for database queries
-    pass
-```
-
-## PCI DSS SAQ (Self-Assessment Questionnaire)
-
-### SAQ A (Least Requirements)
-- E-commerce using hosted payment page
-- No card data on your systems
-- ~20 questions
-
-### SAQ A-EP
-- E-commerce with embedded payment form
-- Uses JavaScript to handle card data
-- ~180 questions
-
-### SAQ D (Most Requirements)
-- Store, process, or transmit card data
-- Full PCI DSS requirements
-- ~300 questions
-
-## Compliance Checklist
-
-```python
-PCI_COMPLIANCE_CHECKLIST = {
-    'network_security': [
-        'Firewall configured and maintained',
-        'No vendor default passwords',
-        'Network segmentation implemented'
-    ],
-    'data_protection': [
-        'No storage of CVV, track data, or PIN',
-        'PAN encrypted when stored',
-        'PAN masked when displayed',
-        'Encryption keys properly managed'
-    ],
-    'vulnerability_management': [
-        'Anti-virus installed and updated',
-        'Secure development practices',
-        'Regular security patches',
-        'Vulnerability scanning performed'
-    ],
-    'access_control': [
-        'Access restricted by role',
-        'Unique IDs for all users',
-        'Multi-factor authentication',
-        'Physical security measures'
-    ],
-    'monitoring': [
-        'Audit logs enabled',
-        'Log review process',
-        'File integrity monitoring',
-        'Regular security testing'
-    ],
-    'policy': [
-        'Security policy documented',
-        'Risk assessment performed',
-        'Security awareness training',
-        'Incident response plan'
-    ]
-}
-```
-
-## Resources
-
-- **references/data-minimization.md**: Never store prohibited data
-- **references/tokenization.md**: Tokenization strategies
-- **references/encryption.md**: Encryption requirements
-- **references/access-control.md**: Role-based access
-- **references/audit-logging.md**: Comprehensive logging
-- **assets/pci-compliance-checklist.md**: Complete checklist
-- **assets/encrypted-storage.py**: Encryption utilities
-- **scripts/audit-payment-system.sh**: Compliance audit script
-
-## Common Violations
-
-1. **Storing CVV**: Never store card verification codes
-2. **Unencrypted PAN**: Card numbers must be encrypted at rest
-3. **Weak Encryption**: Use AES-256 or equivalent
-4. **No Access Controls**: Restrict who can access cardholder data
-5. **Missing Audit Logs**: Must log all access to payment data
-6. **Insecure Transmission**: Always use TLS 1.2+
-7. **Default Passwords**: Change all default credentials
-8. **No Security Testing**: Regular penetration testing required
-
-## Reducing PCI Scope
-
-1. **Use Hosted Payments**: Stripe Checkout, PayPal, etc.
-2. **Tokenization**: Replace card data with tokens
-3. **Network Segmentation**: Isolate cardholder data environment
-4. **Outsource**: Use PCI-compliant payment processors
-5. **No Storage**: Never store full card details
-
-By minimizing systems that touch card data, you reduce compliance burden significantly.
+- Data-flow inventory reconciled with actual integration and telemetry.
+- Access denial produces no payment or data side effect.
+- Redaction checked on nested data and exceptions.
+- Evidence tied to actual configuration and test results, with explicit gaps.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
-- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+Encryption, hosted checkout or a passed scan alone does not prove compliance. This package includes no automated audit script, payment processor client or certified encryption utility. Use reviewed integration code and qualified assessment for the actual environment; never use live cardholder data as a test fixture.

package/bundled-skills/pci-compliance/resources/implementation-playbook.md

@@ -0,0 +1,23 @@
+# Payment control evidence review
+
+## Inputs
+
+Payment data-flow map, integration type, provider responsibilities, applicable assessment documents and a nonproduction environment.
+
+## Procedure
+
+1. Identify where account data could enter forms, logs, traces, queues, backups and support exports. Prefer provider-hosted collection and minimize local data handling.
+2. Map each required control to actual implementation evidence, owner and gap. Verify access boundaries and redaction using synthetic payment test data; do not copy live card data into the report.
+3. Prepare a remediation list and assessment questions for the responsible qualified reviewer or acquiring institution. Keep engineering tests separate from compliance attestation.
+
+## Worked example
+
+A payment webhook is logged in full. Replace it with an allowlisted event record and test nested fields, exceptions and retry logs for data exposure.
+
+## Verification and handoff
+
+Report the actual files or configuration changed, checks performed, observed results and any untested environment. Keep the original inputs and evidence sufficient to reproduce the conclusion.
+
+## Limitations
+
+Encryption alone does not establish compliance. SAQ eligibility and assessment requirements must be confirmed for the actual payment integration.

package/bundled-skills/postmortem-writing/SKILL.md

@@ -167,7 +167,7 @@ The deployment completed at 14:23, but the first alert didn't fire until 14:31 (
 ### Customer Impact
 - 12,000 unique customers affected
 - Average impact duration: 35 minutes
-- 847 support tickets (23% of affected users)
+- 847 support tickets (about 7.1% of the affected-user count; not necessarily unique users)
 - Customer satisfaction score dropped 12 points
 
 ### Business Impact

package/bundled-skills/postmortem-writing/resources/implementation-playbook.md

@@ -0,0 +1,23 @@
+# Evidence-based postmortem
+
+## Inputs
+
+Incident timeline, impact measurements, recovery evidence and access-controlled source links.
+
+## Procedure
+
+1. Normalize timestamps and distinguish detection, mitigation and full recovery. Mark estimates and unknown intervals explicitly.
+2. Link causal statements to observations. Describe conditions and system safeguards rather than assigning blame; do not force a single cause or a fixed number of whys.
+3. Assign each accepted action an owner, deadline and observable completion criterion. Review factual disagreements before sharing the document with the authorized audience.
+
+## Worked example
+
+An outage spans 10:00 to 10:20, while detection occurs at 10:05. Report twenty minutes of impact and five minutes to detection, with sources for both.
+
+## Verification and handoff
+
+Report the actual files or configuration changed, checks performed, observed results and any untested environment. Keep the original inputs and evidence sufficient to reproduce the conclusion.
+
+## Limitations
+
+Template incident details are fictional and must not be copied as evidence. Ticket creation and publication are separate from drafting.

package/bundled-skills/pydantic-models-py/SKILL.md

@@ -12,9 +12,7 @@ Create Pydantic models following the multi-model pattern for clean API contracts
 
 ## Quick Start
 
-Copy the template from assets/template.py and replace placeholders:
-- `{{ResourceName}}` → PascalCase name (e.g., `Project`)
-- `{{resource_name}}` → snake_case name (e.g., `project`)
+Use the inline model patterns below and adapt class names and fields to the actual API contract. Inspect the installed Pydantic version before selecting configuration syntax; these fragments require the imports and application types shown by your project. Do not assume a standalone template file is bundled.
 
 ## Multi-Model Pattern