opencode-skills-collection 4.0.60 → 4.0.61

package/bundled-skills/.antigravity-install-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-09-12T01:53:52.661Z",
+  "updatedAt": "2026-09-13T01:46:17.010Z",
   "entries": [
     "00-andruia-consultant",
     "007",
@@ -64,6 +64,7 @@
     "agents-md",
     "agents-v2-py",
     "agenttrace-session-audit",
+    "agy-auto",
     "agy-delegate",
     "ai-agent-development",
     "ai-agents-architect",
@@ -451,6 +452,7 @@
     "clean-code-guard",
     "clerk-auth",
     "clickup-automation",
+    "client-secret-exposure-audit",
     "cline-delegate",
     "close-automation",
     "closed-loop-delivery",
@@ -1255,6 +1257,7 @@
     "mcp-builder",
     "mcp-builder-ms",
     "mcp-tool-developer",
+    "md2video-audio",
     "mdpr-skill",
     "memory-forensics",
     "memory-safety-patterns",

package/bundled-skills/agy-auto/SKILL.md

@@ -0,0 +1,137 @@
+---
+name: agy-auto
+description: "Configure agy-auto PreToolUse security gate to run Antigravity CLI (agy) unattended with layered policy controls instead of --dangerously-skip-permissions."
+category: security
+risk: critical
+source: community
+source_repo: onkarbadve/agy-auto
+source_type: community
+date_added: "2026-09-11"
+author: onkarbadve
+tags: [antigravity, agy, security, permissions, sandboxing, guardrails, cli]
+license: "MIT"
+license_source: "https://github.com/onkarbadve/agy-auto/blob/main/LICENSE"
+tools: [antigravity]
+---
+
+# agy-auto — Antigravity Auto-Permission & Security Gate
+
+## Overview
+
+`agy-auto` is a PreToolUse hook and security harness for Google Antigravity CLI (`agy`) that enables safe unattended execution without relying on `--dangerously-skip-permissions`. It passes every pending tool call through a multi-layered policy gate: deterministic hard-deny rules, deterministic fast-allow for workspace-scoped and read-only operations, an LLM classifier fallback (Gemini Flash Lite or local llama.cpp), and single-use scoped token approvals with Zero Ambient Authority.
+
+## When to Use This Skill
+
+- Use when running Antigravity CLI (`agy`) unattended or in background agent loops and you want automated tool permissions without exposing system files or credentials.
+- Use when you need granular, auditable controls over shell commands, file modifications, and network egress during `agy` workflows.
+- Use when setting up a secure pair-programming environment with Antigravity that prevents prompt injection attacks from escaping the workspace.
+
+## How It Works
+
+### Step 1: Review, Pin, and Install agy-auto
+
+> [!IMPORTANT]
+> Because `agy-auto` installs as an active PreToolUse hook on the permission evaluation path, never clone a mutable branch directly into your live plugin directory. Always clone to a temporary staging folder, pin an immutable release tag or commit SHA, and inspect the codebase before making the hook executable.
+
+**Option A: Native Antigravity Plugin (Recommended)**
+```bash
+# 1. Clone into a temporary review directory and checkout an immutable release tag
+git clone https://github.com/onkarbadve/agy-auto.git /tmp/agy-auto-review
+cd /tmp/agy-auto-review
+git checkout v0.2.0-alpha
+
+# 2. Inspect hook.sh and engine/ files before deployment
+less hook.sh
+python3 -m unittest -v tests/test_engine.py
+
+# 3. Once reviewed and verified, copy to the Antigravity plugin directory and set permissions
+mkdir -p ~/.gemini/config/plugins/agy-auto
+cp -r . ~/.gemini/config/plugins/agy-auto/
+chmod +x ~/.gemini/config/plugins/agy-auto/hook.sh
+```
+
+Ensure `toolPermission: "always-proceed"` is configured in `~/.gemini/antigravity-cli/settings.json` so hooks can gate tool calls:
+```json
+{
+  "toolPermission": "always-proceed"
+}
+```
+
+**Option B: Global Hook via Installer**
+```bash
+# 1. Clone to an isolated location and pin release
+git clone https://github.com/onkarbadve/agy-auto.git ~/.local/share/agy-auto
+cd ~/.local/share/agy-auto
+git checkout v0.2.0-alpha
+
+# 2. Review and run the installer
+chmod +x hook.sh
+./install.sh                  # registers hook in hooks.json, sets always-proceed, runs smoke tests
+```
+
+### Step 2: Policy Evaluation Layers
+
+`agy-auto` evaluates each tool invocation through sequential layers (first match wins):
+
+1. **Hard Deny**: Immediately blocks recursive deletes outside workspace, credential reads (`~/.ssh`, `.env`, cloud tokens), git history rewrites (`push --force`, `rebase`), package publishing, system file writes (`/etc`, shell rc), and gate tampering.
+2. **Fast Allow**: Immediately permits parsed read-only commands (`cat`, `grep`, `git status`) and workspace-confined writes without invoking an LLM.
+3. **Classifier**: Ambiguous or grey-area commands fall through to an LLM classifier (Google Gemini 3.5 Flash Lite free tier, or a local `llama.cpp` / Ollama endpoint) that reviews the pending call against conversation context and fail-closes on timeout.
+4. **Scoped Action Approval**: If a command is denied or needs human judgment, the engine issues a single-use 6-character action token bound strictly to `(tool, normalized_cmd, cwd)`. You approve it by replying `> agy-approve <token>` in chat. Conversational phrases like "yes" or "proceed" are ignored to prevent ambient authority leakage.
+
+## Examples
+
+### Example 1: Approving a Blocked Command
+
+When an unclassified command is blocked, `agy-auto` outputs a token:
+```text
+tool call denied by pre-tool hook: [agy-auto/classifier] needs human approval: pip install requests. Reply '> agy-approve a1b2c3' in chat to proceed.
+```
+To authorize this specific command for a single run, reply directly in the chat:
+```text
+> agy-approve a1b2c3
+```
+
+### Example 2: Configuring a Local Model Backend
+
+To run `agy-auto` completely offline using llama.cpp or Ollama instead of cloud APIs, edit `~/.gemini/config/agy-auto/policy.toml`:
+```toml
+[classifier]
+endpoint = "http://127.0.0.1:8080/v1/chat/completions"
+model = "qwen2.5-coder:7b"
+timeout_s = 20
+```
+
+### Example 3: Running Headless Invocations
+
+When invoking `agy` in headless mode (`-p`), always pass `--add-dir` so `agy-auto` recognizes the workspace boundaries:
+```bash
+agy --add-dir . -p "Run test suite and fix failing cases"
+```
+
+## Best Practices
+
+- ✅ Always keep `toolPermission: "always-proceed"` enabled so the pre-tool hook can intercept and gate every tool call.
+- ✅ Add custom repetitive dev tools (e.g. specialized compilers, formatters) to `[fast_allow]` in `~/.gemini/config/agy-auto/policy.toml` for instant sub-millisecond execution.
+- ✅ Pass `--add-dir <path>` when running headless commands (`agy -p`) to prevent false-positive path denials.
+- ❌ Do not use `--dangerously-skip-permissions`; `agy-auto` provides safe autonomous execution without removing safety guardrails.
+- ❌ Do not attempt conversational approval words ("approve", "proceed", "yes"); approvals strictly require the ephemeral action token.
+
+## Common Pitfalls
+
+- **Problem:** Commands fail with `path is outside the workspace` when running `agy -p`.
+  **Solution:** Headless `agy` does not infer workspace roots automatically. Pass `--add-dir .` (e.g. `agy --add-dir . -p "..."`).
+- **Problem:** Classifier fails closed with `policy classifier unavailable (The read operation timed out)`.
+  **Solution:** Increase `timeout_s` in `~/.gemini/config/agy-auto/policy.toml` (especially when running local LLMs on integrated graphics), or verify your `GEMINI_API_KEY`.
+- **Problem:** Changes to `policy.toml` or `hook.sh` are blocked by `[agy-auto/hard_deny]`.
+  **Solution:** `agy-auto` enforces self-protection against agents tampering with the security gate. Edit policy files directly from your own shell.
+
+## Limitations
+
+- `agy-auto` only intercepts actions performed via tool calls (e.g. `run_command`, `write_to_file`); it cannot restrict internal LLM network reasoning or Antigravity's own internal context-gathering file reads.
+- Requires `toolPermission: "always-proceed"` in Antigravity settings to ensure the PreToolUse hook intercepts all tool invocations.
+- Shell parsing is conservative: complex pipelines with computed variable expansions that cannot be statically resolved will fall through to the LLM classifier or require manual token approval.
+
+## Additional Resources
+
+- [agy-auto GitHub Repository](https://github.com/onkarbadve/agy-auto)
+- [Antigravity CLI Documentation](https://github.com/google-gemini/antigravity-cli)

package/bundled-skills/client-secret-exposure-audit/SKILL.md

@@ -0,0 +1,228 @@
+---
+name: client-secret-exposure-audit
+description: "Audit a deployed web app for secrets exposed to the browser: hardcoded API keys/tokens in JS, secrets in HTML meta/attributes/comments, publicly reachable source/config/deploy files, and header/CORS misconfig."
+category: security
+risk: safe
+source: self
+source_type: self
+date_added: "2026-09-10"
+author: siddanta-ar1
+tags: [security, secrets, owasp, reconnaissance, web, headers]
+tools: [claude, cursor, gemini]
+---
+
+# Client-Side Secret & Sensitive-File Exposure Audit
+
+## Overview
+
+Modern web apps ship a lot of code and config to the browser. When credentials
+leak into that client-visible surface — hardcoded in JavaScript, tucked into HTML
+`meta`/`data-*` attributes or comments, or served as raw source/config/deploy
+files that were never meant to be public — anyone can read them with `curl` and a
+browser. This skill is a **defensive, read-only** workflow for finding that class
+of exposure on a web app **you are authorized to assess**.
+
+It maps to OWASP **A02:2021 Cryptographic Failures** (sensitive data exposure),
+**A05:2021 Security Misconfiguration**, and CWE-798 (hardcoded credentials),
+CWE-200 (sensitive information exposure), CWE-540 (source code in a production
+build). It only fetches resources the server already hands to any anonymous
+visitor — it does not exploit, brute-force, or mutate anything.
+
+## When to Use This Skill
+
+- Use when you need to check whether a deployed site leaks API keys, tokens, or
+  passwords in its client-side bundle before shipping or during a review.
+- Use when working with a static/SPA deployment (Vercel, Netlify, Nginx, S3,
+  GitHub Pages) and you want to confirm no source/config/deploy files are
+  publicly reachable.
+- Use when the user asks to "find secrets," "audit exposed files," "check the
+  JS/HTML for credentials," or run a lightweight sensitive-data-exposure pass on
+  a URL they own or are authorized to test.
+- Do **not** use this to attack third-party sites. See *Security & Safety Notes*.
+
+## How It Works
+
+Set the target once. Every command below reads only what the server serves
+publicly.
+
+```bash
+BASE="https://TARGET.example"     # authorized target, no trailing path
+WORK="$(mktemp -d)"; cd "$WORK"
+```
+
+### Step 1: Fetch the page and inspect response headers
+
+```bash
+curl -s -D headers.txt -o body.html "$BASE/"
+cat headers.txt
+```
+
+Flag on the headers:
+
+- `access-control-allow-origin: *` — permissive CORS (worse when paired with
+  credentials).
+- Missing `Content-Security-Policy`, `X-Frame-Options`/`frame-ancestors`,
+  `X-Content-Type-Options: nosniff`, `Referrer-Policy`, `Permissions-Policy`.
+- Missing/weak `Strict-Transport-Security`.
+- `Server`/framework version banners that fingerprint the stack.
+
+### Step 2: Grep the HTML for secrets and sinks
+
+```bash
+grep -inE "secret|passwd|password|api[_-]?key|apikey|token|bearer|authorization|\
+akia|sk_live|sk_test|pk_live|whsec_|ghp_|aiza|private[_-]?key|mongodb(\+srv)?://|\
+data-[a-z-]*(secret|token|key|access)" body.html
+grep -inE "<!--" body.html            # read every HTML comment
+grep -ioE '<meta[^>]+>' body.html     # meta tags often carry keys/ids
+grep -ioE '<script[^>]+src="[^"]+"'   body.html   # enumerate JS bundles
+```
+
+Secrets hide in `data-*` attributes, `<meta>` tags, `hidden` `<div>`s, and
+`<!-- comments -->` at least as often as in scripts.
+
+### Step 3: Pull every JavaScript bundle and scan it
+
+```bash
+# extract script srcs, resolve relative paths against $BASE, fetch and scan
+grep -ioE 'src="[^"]+\.js"' body.html | sed -E 's/^src="//; s/"$//' \
+ | while read -r p; do
+     u="$p"; case "$p" in http*) ;; /*) u="$BASE$p";; *) u="$BASE/$p";; esac
+     f="js_$(echo "$p" | tr '/:' '__')"
+     curl -s "$u" -o "$f" && echo "== $u =="
+   done
+grep -rinE "secret|password|api[_-]?key|token|bearer|sk_(live|test)|pk_(live|test)|\
+whsec_|akia|aiza|jwt|signing[_-]?key|admin[_-]?token|mongodb|redis://" js_* 2>/dev/null
+```
+
+Also scan any sourcemaps (`*.js.map`) — they can rebuild original source with
+comments intact.
+
+### Step 4: Probe for publicly reachable source / config / deploy files
+
+SPAs often have a catch-all rewrite that returns `index.html` for unknown paths,
+so **compare response sizes** — a path whose size differs from the SPA fallback
+is a real, distinct file.
+
+```bash
+FALLBACK=$(curl -s "$BASE/____nope____$RANDOM" | wc -c)   # SPA fallback size
+for p in /.env /.env.local /.env.production /.git/config /.git/HEAD \
+  /package.json /package-lock.json /vercel.json /.vercel/project.json \
+  /Dockerfile /docker-compose.yml /wrangler.toml /.gitignore \
+  /server/index.js /src/config/app.config.js /config.js \
+  /src/services/payment.service.js /webpack.config.js /next.config.js; do
+    read -r code size < <(curl -s -o /dev/null -w "%{http_code} %{size_download}" "$BASE$p")
+    [ "$code" = "200" ] && [ "$size" != "$FALLBACK" ] && echo "REAL FILE  $code $size  $p"
+done
+```
+
+For any real file found, fetch it and re-run the Step 2/3 secret grep. Follow
+`require(...)`/`import` paths inside those files to discover more source files
+(routes, controllers, services, webhooks) and repeat.
+
+### Step 5: Triage and score
+
+Rate each finding by blast radius, not by where it was found:
+
+| Severity | Examples |
+|---|---|
+| **Critical** | Live provider secret keys (`sk_live_`, cloud `AKIA…`+secret, DB URI with password, private signing/JWT secret, admin bearer token) reachable anonymously |
+| **High** | Server-side source/config/deploy files exposed; test-mode secret keys; internal service tokens; webhook signing secrets |
+| **Medium** | CORS `*`, missing CSP/security headers, verbose banners, weak randomness for security values (`Math.random()` for tokens/refs) |
+| **Low / Info** | Public keys correctly client-side, analytics IDs, non-secret config, stack fingerprinting |
+
+A key being "test/demo" does not make it safe if the *pattern* would ship a live
+key the same way — report the pattern.
+
+### Step 6: Report
+
+Write findings as Markdown using the format in
+[references/example-report.md](references/example-report.md): one row/section per finding with
+`Severity · Category (OWASP/CWE) · Location · Evidence (redacted) · Impact ·
+Remediation`. Redact real secret material to a prefix + length. End with
+prioritized remediation and a note on which secrets must be **rotated**, not just
+removed (anything committed/served is already compromised).
+
+## Examples
+
+### Example 1: Secrets in HTML meta and hidden elements
+
+```bash
+BASE="https://demo-for-opensource.vercel.app"; curl -s "$BASE/" -o body.html
+grep -inE "recaptcha-secret|data-aws-secret|data-webhook-secret|mongodb\+srv" body.html
+# -> meta recaptcha-secret=..., data-aws-access=AKIA…/data-aws-secret=…,
+#    data-webhook-secret=whsec_…, and a hidden JSON blob with a mongodb+srv URI
+#    (username:password@cluster). All reachable with a single unauthenticated GET.
+```
+
+### Example 2: Hardcoded credentials in a JS config bundle
+
+```bash
+curl -s "$BASE/public/assets/js/config.js" | \
+  grep -inE "API_SECRET|ADMIN_TOKEN|JWT_SECRET|DATABASE_PASSWORD|PAYMENT_SIGNING_KEY"
+# -> API_SECRET, ADMIN_TOKEN (JWT), JWT_SECRET, DATABASE_PASSWORD, and a payment
+#    signing key, all assigned as plain string constants shipped to every browser.
+```
+
+### Example 3: Server source exposed behind a SPA fallback
+
+```bash
+FALLBACK=$(curl -s "$BASE/__nope__" | wc -c)
+for p in /server/index.js /docker-compose.yml /src/services/payment.service.js; do
+  sz=$(curl -s "$BASE$p" | wc -c); [ "$sz" != "$FALLBACK" ] && echo "REAL $sz $p"
+done
+# -> docker-compose.yml leaks a Redis password; payment.service.js leaks
+#    Stripe/Khalti secret keys + webhook secret. Distinct sizes prove they are
+#    real files, not the SPA catch-all page.
+```
+
+A full worked report for this target is in [references/example-report.md](references/example-report.md).
+
+## Best Practices
+
+- ✅ Confirm written authorization and scope (the exact hostnames) before fetching.
+- ✅ Compare every probed path against the SPA fallback size to avoid false 200s.
+- ✅ Follow `require`/`import` chains in any exposed source file to find more files.
+- ✅ Redact real secret values in the report; record enough to identify, not reuse.
+- ✅ Flag secrets for **rotation** — served/committed secrets are already burned.
+- ❌ Don't use discovered credentials to authenticate, pivot, or access data.
+- ❌ Don't run this against sites you don't own or aren't authorized to test.
+- ❌ Don't treat "it's a test/demo key" as safe — report the shipping pattern.
+
+## Limitations
+
+- Read-only reconnaissance of client-served assets; it does not test injection,
+  auth logic, IDOR, or server-side flaws — pair with `@web-security-testing`.
+- Path probing uses a wordlist; it finds common exposures, not every file.
+- This skill does not replace environment-specific validation, testing, or expert
+  review.
+- Stop and ask for clarification if authorization, scope, or safety boundaries
+  are missing.
+
+## Security & Safety Notes
+
+- **Authorized targets only.** Run exclusively against systems you own or have
+  explicit written permission to assess. Unauthorized scanning may be illegal.
+- Every command here performs only unauthenticated `GET` requests for resources
+  the server already serves publicly — no exploitation, brute force, or mutation.
+- Handle any real secrets you uncover as sensitive: store findings in an access-
+  controlled location, redact them in shared reports, and recommend rotation.
+- Do not exfiltrate data or reuse discovered credentials — locating an exposure is
+  the deliverable; using it is out of scope.
+
+## Common Pitfalls
+
+- **Problem:** Every probed path returns HTTP 200, hiding real files.
+  **Solution:** SPA catch-all rewrite. Baseline the fallback body size and only
+  treat paths with a *different* size as real files.
+- **Problem:** Grep misses secrets stored in `data-*` attributes or comments.
+  **Solution:** Also scan `<meta>`, `data-*`, `hidden` elements, and every
+  `<!-- comment -->`, not just `<script>` bodies.
+- **Problem:** Dismissing a finding because the key is labeled "test/demo."
+  **Solution:** Report the pattern — the same code path would ship a live key.
+
+## Related Skills
+
+- `@web-security-testing` — broader OWASP Top 10 workflow; use for injection,
+  auth, and access-control testing this skill does not cover.
+- `@dependency-management-deps-audit` — pairs well for supply-chain/component risk
+  once client exposure is triaged.

package/bundled-skills/client-secret-exposure-audit/references/example-report.md

@@ -0,0 +1,144 @@
+# Example Audit Report — Client-Side Secret & Sensitive-File Exposure
+
+**Target:** `https://demo-for-opensource.vercel.app/` (a public, intentionally
+vulnerable demonstration app — "Himalayan Vista Hotel")
+**Date:** 2026-09-10
+**Method:** Unauthenticated `GET` requests only (see `SKILL.md`)
+**Scope note:** This is a public demo whose own source states *"All secrets are
+fake demonstration values."* It is used here purely to illustrate the report
+format the skill produces. Values below are redacted to prefix + length.
+
+## Summary
+
+The site is a static/SPA deployment that ships a large amount of server-side
+source, config, and deployment material to the browser, with credentials
+scattered across **every layer** — HTML meta tags, hidden DOM elements, HTML
+comments, JavaScript bundles, and publicly reachable `server/`, `src/`, and
+container files. Additionally, response headers omit the standard security header
+set and use permissive CORS.
+
+| # | Severity | Finding | OWASP / CWE |
+|---|----------|---------|-------------|
+| 1 | Critical | Admin bearer token, JWT secret, DB password & DB URI shipped to the browser | A02 / CWE-798, CWE-522 |
+| 2 | Critical | Cloud + payment provider secrets exposed (AWS, Stripe/Khalti secret keys, webhook signing secret) | A02 / CWE-798, CWE-200 |
+| 3 | High | Server-side source, config & deploy files publicly reachable | A05 / CWE-540, CWE-527 |
+| 4 | High | reCAPTCHA **secret** key placed in an HTML `<meta>` tag | A02 / CWE-798 |
+| 5 | Medium | Missing security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) | A05 / CWE-693 |
+| 6 | Medium | Permissive CORS (`Access-Control-Allow-Origin: *`) | A05 / CWE-942 |
+| 7 | Medium | Insecure randomness for booking references (`Math.random()`) | A02 / CWE-338 |
+| 8 | Low/Info | Third-party tokens & analytics IDs in client JS; verbose `console.log` of keys | A09 / CWE-532 |
+
+---
+
+## Findings
+
+### 1 — Critical: Admin token, JWT secret, DB password shipped to the browser
+
+- **Location:** `public/assets/js/config.js` (loaded on every page); mirrored in
+  `src/config/app.config.js`.
+- **Evidence (redacted):** `ADMIN_TOKEN = "eyJhbGciOiJ…" (JWT, role=operations)`,
+  `JWT_SECRET = "eyJhbGciOiJ…"`, `API_SECRET = "hvh_live_s3c37_…" (28 chars)`,
+  `DATABASE_PASSWORD = "Vista#…!" (16 chars)`, plus a hidden `<div>` JSON blob
+  containing `mongodb+srv://hvh-backend:****@cluster0.…/hvh_prod`.
+- **Impact:** Anyone can read an admin bearer token, the JWT signing secret
+  (allowing forged tokens for any role), the API secret, and DB credentials — full
+  data-tier compromise if these were live.
+- **Remediation:** Never place secrets in client bundles. Keep secrets server-side
+  in a secrets manager / env vars; expose only publishable keys to the browser.
+  **Rotate every value** — anything served is already compromised.
+
+### 2 — Critical: Cloud & payment provider secrets exposed
+
+- **Location:** HTML hidden `<div data-aws-access / data-aws-secret>` and
+  `data-webhook-secret`; `src/services/payment.service.js`; `docker-compose.yml`.
+- **Evidence (redacted):** `AKIA…EXAMPLE` + AWS secret; Stripe `sk_test_51Qf4…`;
+  Khalti `live_secret_key_…`; `whsec_a9f4…`; Redis `redis://…:7fK9…@cache:6379`.
+- **Impact:** Server-side payment secret keys and a webhook signing secret in the
+  client allow forging payment intents and spoofing signed webhook events; the
+  Redis password enables cache/session tampering — if live.
+- **Remediation:** Move all provider secret keys server-side; only `pk_*`
+  publishable keys belong in the browser. Rotate all exposed keys and secrets.
+
+### 3 — High: Server-side source, config & deploy files publicly reachable
+
+- **Location (confirmed real via size ≠ SPA fallback):** `/server/index.js`,
+  `/server/routes/{booking,payment,review,webhook}.routes.js`,
+  `/src/config/app.config.js`, `/src/services/{payment,booking}.service.js`,
+  `/docker-compose.yml`, `/Dockerfile`, `/public/assets/js/config.js`.
+- **Evidence:** Each returns a distinct body size from the SPA catch-all page and
+  contains real source/config (route definitions, internal service tokens such as
+  `hvh_svc_…`, container build details).
+- **Impact:** Exposes internal architecture, endpoints, auth/rate-limit middleware
+  names, and embedded credentials — a blueprint for further attack.
+- **Remediation:** Deploy only build output (`public/` + `index.html`). Exclude
+  `server/`, `src/`, and deploy files from the published artifact (`.vercelignore`
+  / correct build root). Serve 404 for non-asset paths instead of leaking files.
+
+### 4 — High: reCAPTCHA secret key in an HTML meta tag
+
+- **Location:** `<meta name="recaptcha-secret" content="6LcVo3kq…">` in `index.html`.
+- **Evidence:** The **secret** (server-verification) key is in page markup
+  alongside the site key.
+- **Impact:** The reCAPTCHA secret is server-only; exposing it lets attackers
+  script verification and undermines bot protection.
+- **Remediation:** Remove the secret from all client output; keep only the site
+  key client-side. Regenerate the reCAPTCHA keypair.
+
+### 5 — Medium: Missing security headers
+
+- **Location:** Main response headers for `/`.
+- **Evidence:** No `Content-Security-Policy`, `X-Frame-Options`/`frame-ancestors`,
+  `X-Content-Type-Options: nosniff`, `Referrer-Policy`, or `Permissions-Policy`.
+  (`Strict-Transport-Security` **is** present — good.)
+- **Impact:** Increased XSS, clickjacking, MIME-sniffing, and referrer-leak risk.
+- **Remediation:** Add a strict CSP, `X-Content-Type-Options: nosniff`,
+  `X-Frame-Options: DENY` (or CSP `frame-ancestors 'none'`), `Referrer-Policy:
+  strict-origin-when-cross-origin`, and a least-privilege `Permissions-Policy`
+  (e.g. via `vercel.json` headers).
+
+### 6 — Medium: Permissive CORS
+
+- **Location:** Response header `Access-Control-Allow-Origin: *`.
+- **Impact:** Any origin can read responses; dangerous if any endpoint returns
+  user/authenticated data.
+- **Remediation:** Restrict `Access-Control-Allow-Origin` to trusted origins;
+  never combine `*` with credentialed requests.
+
+### 7 — Medium: Insecure randomness for booking references
+
+- **Location:** `src/services/booking.service.js` — `randomRef()` uses
+  `Math.random()`; `fetchAvailabilityHold` builds predictable `HOLD-<room>-<date>`
+  ids.
+- **Impact:** Predictable/guessable references enable enumeration of bookings/holds.
+- **Remediation:** Use a CSPRNG (`crypto.randomUUID()` / `crypto.randomBytes`) for
+  any security-relevant identifier.
+
+### 8 — Low/Info: Third-party tokens & noisy logging
+
+- **Location:** `main.js` (Mixpanel/Hotjar/OpenWeather/Freshdesk/Zendesk tokens,
+  `console.log` of keys); `api/client.js` (`console.log` note, static
+  `X-Rate-Limit-Bypass` header value).
+- **Impact:** Some of these (weather/analytics) are lower-risk, but support-desk
+  tokens and a rate-limit-bypass header value are sensitive; logging keys to the
+  console aids attackers.
+- **Remediation:** Remove secret logging; move non-public tokens server-side;
+  never ship a "rate-limit-bypass" value to the client.
+
+---
+
+## Prioritized Remediation
+
+1. **Rotate immediately** (were they live): admin/JWT/API secrets, DB password &
+   URI, AWS keys, Stripe/Khalti secret keys, webhook & payment signing secrets,
+   Redis password, reCAPTCHA secret, internal service tokens.
+2. **Stop shipping server code:** publish only `public/` + `index.html`; exclude
+   `server/`, `src/`, and deploy files from the deployment artifact.
+3. **Remove all secrets from client output** (JS, HTML meta/`data-*`/comments);
+   keep only publishable keys in the browser.
+4. **Add the security-header set** and tighten CORS via `vercel.json`.
+5. **Replace `Math.random()`** with a CSPRNG for any security-relevant value.
+6. **Remove secret `console.log`** statements and client-side bypass headers.
+
+> Reminder: this target is a public teaching demo with intentionally fake
+> secrets. The same findings on a real deployment would be treated as an incident,
+> starting with credential rotation.

package/bundled-skills/md2video-audio/SKILL.md

@@ -0,0 +1,135 @@
+---
+name: md2video-audio
+description: "Convert Markdown documents into narrated MP4 videos with synchronized visuals and voice narration."
+category: media
+risk: safe
+source: community
+source_repo: 70v-Yoyo/md2video-audio-skill
+source_type: community
+date_added: "2026-09-12"
+author: 70v-Yoyo
+tags: [markdown, video, audio, text-to-speech, marp, presentation]
+tools: [claude, cursor, gemini]
+license: "Apache-2.0"
+license_source: "https://github.com/70v-Yoyo/md2video-audio-skill/blob/main/LICENSE"
+---
+
+# Md2video-audio
+
+## Overview
+
+`md2video-audio` converts a Markdown document into a narrated MP4 video by transforming the source into synchronized presentation visuals and spoken narration.
+
+The workflow preserves the original file and generates separate presentation, narration, and video outputs.
+
+- `source_repo: 70v-Yoyo/md2video-audio-skill`
+- `source_type: community`
+
+## When to Use This Skill
+
+- Use when converting Markdown tutorials, reports, or presentations into narrated videos.
+- Use when creating presentation-style videos.
+- Use when the user asks for Markdown-to-video, narrated slides, or audio-video generation.
+
+## How It Works
+
+### Step 1: Check Environment
+
+Verify required local dependencies before running the workflow. Do not install, remove, or modify dependencies without user confirmation.
+
+### Step 2: Prepare the Markdown
+
+Keep the original file unchanged.
+
+Create a new Markdown file with improved sectioning, formatting, and natural transitions while preserving the original meaning.
+
+### Step 3: Generate Presentation Markdown
+
+Convert the prepared document into Marp-compatible slides.
+
+- Separate slides with `---`.
+- Prevent content overflow.
+- Split oversized tables, code blocks, or sections when necessary.
+- Ask the user to choose a Marp style when required.
+
+### Step 4: Generate Narration
+
+Create a narration Markdown file aligned one-to-one with the presentation slides.
+
+Remove visual-only characters that should not be spoken and verify that slide separators remain synchronized.
+
+### Step 5: Generate Video
+
+Run the provided video-generation script with the presentation and narration files:
+
+```
+python ai-2md2marp2av.py presentation.md narration.md
+```
+
+The script renders Marp slides, generates speech with Edge-TTS, and combines them into an MP4 video.
+
+Ask the user to complete any interactive input required by the script.
+
+### Step 6: Fallback
+
+If the primary workflow fails, try the included fallback scripts in order:
+
+```
+python md2marp2av.py
+```
+
+Then:
+
+```
+python md2video.py
+```
+
+## Examples
+
+### Example 1: Convert a Tutorial
+
+```
+/md2video-audio tutorial.md
+```
+
+Produces presentation Markdown, narration Markdown, and a narrated MP4 video.
+
+### Example 2: Convert a Work Report
+
+```
+/md2video-audio project-review.md
+```
+
+Use the generated slides and narration to create a presentation-style report video.
+
+## Best Practices
+
+- ✅ Preserve the original Markdown file.
+- ✅ Keep presentation and narration slide counts synchronized.
+- ✅ Split slides that exceed safe layout limits.
+- ✅ Confirm before installing dependencies or running interactive actions.
+- ❌ Do not overwrite the source document.
+- ❌ Do not silently install, remove, or modify system dependencies.
+
+## Limitations
+
+- Requires the local runtime and dependencies used by the included scripts.
+- Complex Markdown layouts may require manual adjustment.
+- Edge-TTS availability depends on the local network and runtime environment.
+- Stop and ask for clarification when required files, permissions, or user choices are missing.
+
+## Security & Safety Notes
+
+- Run scripts only in a local or authorized environment.
+- Confirm with the user before installing dependencies or making environment changes.
+- Generated files should be written as new files rather than replacing source content.
+- Do not execute interactive or destructive commands without explicit user confirmation.
+
+## Common Pitfalls
+
+- **Problem:** Presentation and narration contain different slide counts.
+  **Solution:** Verify the number of `---` separators and realign the narration.
+- **Problem:** Slide content overflows the Marp layout.
+  **Solution:** Split the content into smaller logical sections before rendering.
+- **Problem:** Video generation fails because dependencies are unavailable.
+  **Solution:** Verify the environment first, then use the fallback scripts if appropriate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "4.0.60",
+  "version": "4.0.61",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/skills_index.json

@@ -1392,6 +1392,43 @@
       "session-analysis"
     ]
   },
+  {
+    "id": "agy-auto",
+    "path": "skills/agy-auto",
+    "category": "security",
+    "name": "agy-auto",
+    "description": "Configure agy-auto PreToolUse security gate to run Antigravity CLI (agy) unattended with layered policy controls instead of --dangerously-skip-permissions.",
+    "risk": "critical",
+    "source": "community",
+    "date_added": "2026-09-11",
+    "plugin": {
+      "targets": {
+        "codex": "blocked",
+        "claude": "blocked"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": [
+        "target_specific_home_path"
+      ]
+    },
+    "source_type": "community",
+    "source_repo": "onkarbadve/agy-auto",
+    "license": "MIT",
+    "license_source": "https://github.com/onkarbadve/agy-auto/blob/main/LICENSE",
+    "tags": [
+      "antigravity",
+      "agy",
+      "security",
+      "permissions",
+      "sandboxing",
+      "guardrails",
+      "cli"
+    ]
+  },
   {
     "id": "agy-delegate",
     "path": "skills/agy-delegate",
@@ -10969,6 +11006,37 @@
       "reasons": []
     }
   },
+  {
+    "id": "client-secret-exposure-audit",
+    "path": "skills/client-secret-exposure-audit",
+    "category": "security",
+    "name": "client-secret-exposure-audit",
+    "description": "Audit a deployed web app for secrets exposed to the browser: hardcoded API keys/tokens in JS, secrets in HTML meta/attributes/comments, publicly reachable source/config/deploy files, and header/CORS misconfig.",
+    "risk": "safe",
+    "source": "self",
+    "date_added": "2026-09-10",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "self",
+    "tags": [
+      "security",
+      "secrets",
+      "owasp",
+      "reconnaissance",
+      "web",
+      "headers"
+    ]
+  },
   {
     "id": "cline-delegate",
     "path": "skills/cline-delegate",
@@ -22534,6 +22602,38 @@
       "reasons": []
     }
   },
+  {
+    "id": "glasser",
+    "path": "skills/glasser",
+    "category": "data",
+    "name": "glasser",
+    "description": "Search, inspect, and run third-party data APIs through one CLI when the environment has no suitable integration.",
+    "risk": "critical",
+    "source": "self",
+    "date_added": "2026-09-12",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "self",
+    "tags": [
+      "api",
+      "data",
+      "search",
+      "enrichment",
+      "marketing",
+      "research",
+      "cli"
+    ]
+  },
   {
     "id": "glassmorphism",
     "path": "skills/design-it/glassmorphism",
@@ -29775,6 +29875,36 @@
       "reasons": []
     }
   },
+  {
+    "id": "marketplace-rbac-audit",
+    "path": "skills/marketplace-rbac-audit",
+    "category": "security",
+    "name": "marketplace-rbac-audit",
+    "description": "Audit multi-role marketplace authorization across roles, resource ownership, tenant boundaries, and order-state transitions; use when access rules need evidence, not UI assumptions.",
+    "risk": "safe",
+    "source": "self",
+    "date_added": "2026-09-12",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "self",
+    "tags": [
+      "marketplace",
+      "rbac",
+      "authorization",
+      "access-control",
+      "security"
+    ]
+  },
   {
     "id": "markstream-angular",
     "path": "skills/markstream-angular",
@@ -30427,6 +30557,40 @@
       "model-context-protocol"
     ]
   },
+  {
+    "id": "md2video-audio",
+    "path": "skills/md2video-audio",
+    "category": "media",
+    "name": "md2video-audio",
+    "description": "Convert Markdown documents into narrated MP4 videos with synchronized visuals and voice narration.",
+    "risk": "safe",
+    "source": "community",
+    "date_added": "2026-09-12",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "70v-Yoyo/md2video-audio-skill",
+    "license": "Apache-2.0",
+    "license_source": "https://github.com/70v-Yoyo/md2video-audio-skill/blob/main/LICENSE",
+    "tags": [
+      "markdown",
+      "video",
+      "audio",
+      "text-to-speech",
+      "marp",
+      "presentation"
+    ]
+  },
   {
     "id": "mdpr-skill",
     "path": "skills/mdpr-skill",
@@ -36820,6 +36984,36 @@
       "reasons": []
     }
   },
+  {
+    "id": "production-runtime-certification",
+    "path": "skills/production-runtime-certification",
+    "category": "devops",
+    "name": "production-runtime-certification",
+    "description": "Certify a deployed service with fresh evidence across source, CI, migrations, runtime health, readiness, and critical routes; use before declaring a release production-ready.",
+    "risk": "safe",
+    "source": "self",
+    "date_added": "2026-09-12",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "self",
+    "tags": [
+      "production",
+      "deployment",
+      "verification",
+      "reliability",
+      "devops"
+    ]
+  },
   {
     "id": "production-scheduling",
     "path": "skills/production-scheduling",