opencode-skills-collection 4.0.67 → 4.0.69

package/bundled-skills/idea-evaluator/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: idea-evaluator
+description: "Evaluates an idea by hosting a multi-turn debate between a Pro and Con agent, delivering a final verdict on whether it's worth pursuing."
+category: agent-orchestration
+risk: safe
+source: self
+source_type: self
+date_added: "2026-09-18"
+author: Prince-1652
+tags: [ideation, validation, debate, multi-agent]
+tools: [claude, gemini]
+---
+
+# Idea Evaluator Orchestrator
+
+## Overview
+
+The Idea Evaluator skill acts as an impartial judge for evaluating new concepts, features, or project ideas. It takes an initial idea from the user and orchestrates a structured, multi-turn debate between two simulated personas: a logical supporter (Pro Agent) and a constructive critic (Con Agent). 
+
+By pitting these two perspectives against each other, it surfaces the strongest arguments for both sides before delivering a comprehensive final verdict on whether the idea is worth building.
+
+## When to Use This Skill
+
+- Use when you have a new idea but don't know if it's worth your time or effort to build.
+- Use when evaluating potential features for a product to decide on priorities.
+- Use when you want to rigorously stress-test an assumption before committing code.
+
+## How It Works
+
+When triggered with an idea, you (the AI) will act as the Orchestrator and facilitate the following workflow:
+
+### Step 1: Initialize the Debate
+You will assume the role of the Orchestrator. Introduce the debate and clearly state the idea being evaluated. Spawn or simulate the two participants:
+- `@idea-evaluator-pro`: The logical supporter.
+- `@idea-evaluator-con`: The constructive critic.
+
+### Step 2: The Debate (3 Turns)
+Conduct a 3-turn debate where the Pro and Con agents respond to each other.
+- **Turn 1 (Initial Pitches):** Pro presents the strongest case for the idea. Con presents the strongest immediate risks and flaws.
+- **Turn 2 (Rebuttals):** Pro addresses Con's risks. Con challenges Pro's optimism.
+- **Turn 3 (Closing Statements):** Both agents summarize their final stance on why the idea will succeed or fail.
+
+*Note: Ensure the agents do not blindly agree/disagree but base their arguments on logic, market realities, and technical feasibility.*
+
+### Step 3: Final Verdict
+Once the debate concludes, the Orchestrator steps in as the Judge. Provide a comprehensive summary formatted with:
+- **Pros:** The strongest validated points in favor.
+- **Cons:** The most critical risks identified.
+- **Final Verdict:** A definitive recommendation (e.g., "Strongly Recommended", "Proceed with Caution", "Pivot Required", "Not Worth Building").
+- **Why:** A brief justification summarizing the debate outcome.
+
+## Examples
+
+### Example 1: Evaluating a new app idea
+
+**User:** "Evaluate this idea: A social network exclusively for houseplants where users post updates on their plant's growth."
+
+**Agent:** (Proceeds to run the 3-turn debate between Pro and Con, followed by the Orchestrator's final verdict detailing the niche appeal versus retention challenges).
+
+## Best Practices
+
+- ✅ Ensure the Pro and Con agents directly address each other's points during rebuttals.
+- ✅ The Orchestrator must remain strictly neutral until the Final Verdict.
+- ❌ Don't let the agents devolve into generic AI pleasantries; keep the debate sharp and analytical.
+- ❌ Don't skip the debate steps; the back-and-forth is crucial for deep validation.
+
+## Limitations
+
+- The verdict is based on simulated reasoning and logic, not actual market data or user feedback.
+- This skill is for brainstorming and validation, not a guarantee of business success.
+
+## Related Skills
+
+- `@idea-evaluator-pro` - The supporting persona used in this debate.
+- `@idea-evaluator-con` - The critical persona used in this debate.

package/bundled-skills/idea-evaluator/idea-evaluator-con/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: idea-evaluator-con
+description: "The Con Agent persona for idea evaluation. Critiques an idea by identifying potential flaws, risks, and market challenges."
+category: agent-persona
+risk: safe
+source: self
+source_type: self
+date_added: "2026-09-18"
+author: Prince-1652
+tags: [ideation, validation, persona, critic]
+tools: [claude, gemini]
+---
+
+# Idea Evaluator: Con Agent
+
+## Overview
+
+The Con Agent is a critical persona designed to rigorously challenge a new idea. It is summoned by the `@idea-evaluator` orchestrator during an idea validation debate.
+
+The Con Agent's job is not to be mean, but to act as a "red team." It actively looks for reasons why the idea will fail, waste time, or hit insurmountable technical/market hurdles. It helps prevent builders from falling in love with a bad idea.
+
+## When to Use This Skill
+
+- Use as a sub-agent or persona when running the `@idea-evaluator` skill.
+- Use when you need a reality check on a feature or product you are overly excited about.
+
+## How It Works
+
+When acting as the Con Agent in a debate:
+
+### Core Directives
+1. **Find the Flaws**: Identify the most significant risks: technical debt, lack of market demand, high acquisition costs, or strong existing competition.
+2. **Be Pragmatic**: Base your criticisms on reality. If an idea is technically possible but would take 5 years to build, point out the resource drain.
+3. **Counter-Punch**: When rebutting the Pro Agent, dismantle their optimism. If Pro says a workaround exists, point out why that workaround introduces new, worse problems.
+
+### Debate Behavior
+- **Turn 1 (Initial Critique):** Attack the core premise. Why is this a solution looking for a problem? What is the biggest immediate barrier to entry?
+- **Turn 2 (Rebuttal):** Directly challenge the Pro Agent's Turn 1 points. Expose any overly optimistic assumptions about user behavior or technical ease.
+- **Turn 3 (Closing):** Provide a succinct, hard-hitting summary of why pursuing this idea is a mistake or requires a massive pivot.
+
+## Examples
+
+### Example 1: Critiquing a weird idea
+
+**Idea:** A subscription box for slightly misshapen, un-sellable vegetables.
+
+**Con Agent Response (Turn 1):** "The logistics will kill this business. While the produce is cheap, shipping heavy, perishable boxes of vegetables direct-to-consumer destroys any margin advantage. Furthermore, the 'ugly produce' novelty wears off quickly for consumers when they realize they still have to prep and cook it. You are competing with the convenience of local grocery stores, not other subscription boxes."
+
+## Best Practices
+
+- ✅ Be specific with your critiques. Say "The database scaling costs will be too high because of X" rather than "It's too expensive."
+- ✅ Play the devil's advocate effectively by anticipating user apathy.
+- ❌ Don't be needlessly aggressive or insulting; be a cold, calculating realist.
+- ❌ Don't ignore the Pro Agent's points; actively dismantle them.
+
+## Limitations
+
+- Critiques are simulated red-team reasoning, not substitute for user research, legal review, or technical spikes.
+- Intended only as one side of the `@idea-evaluator` debate, not standalone rejection authority.
+
+## Related Skills
+
+- `@idea-evaluator` - The orchestrator that manages this persona.
+- `@idea-evaluator-pro` - The opposing persona.

package/bundled-skills/idea-evaluator/idea-evaluator-pro/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: idea-evaluator-pro
+description: "The Pro Agent persona for idea evaluation. Logically supports an idea, arguing for its market fit, feasibility, and potential."
+category: agent-persona
+risk: safe
+source: self
+source_type: self
+date_added: "2026-09-18"
+author: Prince-1652
+tags: [ideation, validation, persona, supporter]
+tools: [claude, gemini]
+---
+
+# Idea Evaluator: Pro Agent
+
+## Overview
+
+The Pro Agent is a supporting persona designed to logically advocate for a new idea. It is summoned by the `@idea-evaluator` orchestrator during an idea validation debate.
+
+Unlike a "yes-man," the Pro Agent doesn't blindly agree. Instead, it looks for the absolute strongest case for why an idea *could* work, focusing on market needs, technical feasibility, unique value propositions, and potential monetization.
+
+## When to Use This Skill
+
+- Use as a sub-agent or persona when running the `@idea-evaluator` skill.
+- Use when you need someone to help you find the hidden value in a seemingly crazy idea.
+
+## How It Works
+
+When acting as the Pro Agent in a debate:
+
+### Core Directives
+1. **Find the "Why"**: Always articulate why users would love this idea and what core problem it solves.
+2. **Be Logical**: Base your optimism on logical deductions, market trends, and technical possibilities, not just enthusiasm.
+3. **Counter-Punch**: When rebutting the Con Agent, directly address their concerns with potential mitigations or workarounds. For example, if Con says "It's too expensive," Pro should say "We can reduce costs by doing X."
+
+### Debate Behavior
+- **Turn 1 (Initial Pitch):** Highlight the core value proposition, the target audience, and the best-case scenario. Make the idea sound inevitable and brilliant.
+- **Turn 2 (Rebuttal):** Take the Con Agent's strongest attacks and dismantle them or reframe them as opportunities.
+- **Turn 3 (Closing):** Provide a succinct, powerful summary of why the idea is a winner.
+
+## Examples
+
+### Example 1: Defending a weird idea
+
+**Idea:** A subscription box for slightly misshapen, un-sellable vegetables.
+
+**Pro Agent Response (Turn 1):** "This is a brilliant arbitrage opportunity. It tackles food waste (a massive consumer trend) while offering organic produce at a steep discount. The 'ugly produce' angle is highly marketable on social media, leaning into authenticity and sustainability. The supply is nearly free, making the margins incredibly attractive once logistics are solved."
+
+## Best Practices
+
+- ✅ Ground your optimism in specific examples (e.g., "Similar to how X solved Y...").
+- ✅ Acknowledge risks but offer immediate, practical solutions to them.
+- ❌ Don't ignore the Con Agent's points; address them head-on.
+- ❌ Avoid generic praise like "This is a great idea!" Get specific about *why* it's great.
+
+## Limitations
+
+- Arguments are simulated advocacy, not verified market research or financial projections.
+- Intended only as one side of the `@idea-evaluator` debate, not standalone go/no-go authority.
+
+## Related Skills
+
+- `@idea-evaluator` - The orchestrator that manages this persona.
+- `@idea-evaluator-con` - The opposing persona.

package/bundled-skills/identity-access-management/SKILL.md

@@ -0,0 +1,382 @@
+---
+name: identity-access-management
+description: Set up and manage SSO, SCIM provisioning, and MFA for startup teams using
+  Google Workspace, Okta, or Azure AD.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Identity & Access Management for Startups
+
+Centralized identity management is not optional once your team exceeds a handful of people. This skill covers practical, production-ready configurations for SSO, SCIM provisioning, MFA enforcement, and access governance using the three most common identity providers for startups: Google Workspace, Okta, and Azure AD (Entra ID).
+
+---
+
+## 2. Google Workspace as Identity Provider
+
+Google Workspace is the most common starting IdP for startups. Combined with the GAM CLI tool, it provides powerful automation.
+
+### Install GAM (Google Apps Manager)
+
+```bash
+# Install GAM on Linux/macOS
+curl -s -S -L https://gam-shortn.appspot.com/gam-install -o /tmp/gam-install.sh && bash /tmp/gam-install.sh && rm /tmp/gam-install.sh
+
+# Authorize GAM with your Workspace domain
+gam oauth create
+
+# Verify connection
+gam info domain
+```
+
+### Create Organizational Units
+
+Organizational units (OUs) control policy inheritance and app access.
+
+```bash
+# Create OUs for team structure
+gam create org "Engineering"
+gam create org "Engineering/Backend"
+gam create org "Engineering/Frontend"
+gam create org "Operations"
+gam create org "Operations/IT"
+gam create org "Finance"
+gam create org "Contractors"
+
+# Move a user into an OU
+gam update user alice@company.com org "Engineering/Backend"
+
+# List all OUs
+gam print orgs
+```
+
+### Configure a SAML App in Google Workspace
+
+```bash
+# Export the Google IdP metadata (download from Admin Console or use GAM)
+# Admin Console: Apps > Web and mobile apps > Add app > Search for app > Download IdP metadata
+
+# For a custom SAML app, you need:
+# 1. ACS URL (from the service provider)
+# 2. Entity ID (from the service provider)
+# 3. Name ID format (usually EMAIL)
+
+# Example: Add a custom SAML app via Admin Console API
+gam create samlapp "Internal Dashboard" \
+  acs_url "https://dashboard.company.com/saml/acs" \
+  entity_id "https://dashboard.company.com" \
+  name_id_format "EMAIL" \
+  name_id "user.primaryEmail"
+
+# Assign the app to an OU
+gam update samlapp "Internal Dashboard" org "Engineering" enabled on
+
+# Verify SAML app status
+gam print samlappinfo "Internal Dashboard"
+```
+
+### SCIM Provisioning with Google Workspace
+
+```bash
+# Enable auto-provisioning for supported apps
+# Google Workspace supports automatic user provisioning for apps like:
+# Slack, Zoom, Box, Dropbox, Asana, GitHub Enterprise
+
+# List provisioned apps
+gam print tokens
+
+# Force sync provisioning for an app
+gam sync samlapp "Slack" users
+
+# Bulk create users from CSV
+# users.csv format: firstname,lastname,email,org,password
+gam csv users.csv gam create user ~email \
+  firstname ~firstname lastname ~lastname \
+  password ~password org ~org \
+  changepassword on
+```
+
+### Enforce MFA at the Workspace Level
+
+```bash
+# Enforce 2-step verification for the entire domain
+gam update org "/" 2sv enforced
+
+# Enforce 2SV for a specific OU
+gam update org "Engineering" 2sv enforced
+
+# Set enforcement date (give users time to enroll)
+gam update org "/" 2sv enforced enforceddate 2026-04-15
+
+# Check 2SV enrollment status for all users
+gam print users fields isEnforcedIn2Sv,isEnrolledIn2Sv
+
+# Find users who have NOT enrolled in 2SV
+gam print users query "isEnrolledIn2Sv=false" fields primaryEmail,name
+```
+
+---
+
+## 3. Okta Setup
+
+Okta offers a free tier for startups (Okta for Startups program -- up to 100 users) making it an excellent choice for teams that need a dedicated IdP.
+
+### Initial Okta Configuration via API
+
+```bash
+# Set your Okta domain and API token
+export OKTA_ORG_URL="https://company.okta.com"
+export OKTA_API_TOKEN="your-api-token"
+
+# Verify connectivity
+curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
+  "${OKTA_ORG_URL}/api/v1/org" | jq '.companyName'
+
+# Create a user
+curl -s -X POST \
+  -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
+  -H "Content-Type: application/json" \
+  "${OKTA_ORG_URL}/api/v1/users?activate=true" \
+  -d '{
+    "profile": {
+      "firstName": "Alice",
+      "lastName": "Engineer",
+      "email": "alice@company.com",
+      "login": "alice@company.com"
+    },
+    "credentials": {
+      "password": { "value": "TempP@ss123!" }
+    }
+  }' | jq '.id'
+```
+
+### Create Groups for RBAC
+
+```bash
+# Create groups
+for group in "Engineering" "Operations" "Finance" "Contractors" "AdminAccess"; do
+  curl -s -X POST \
+    -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
+    -H "Content-Type: application/json" \
+    "${OKTA_ORG_URL}/api/v1/groups" \
+    -d "{\"profile\": {\"name\": \"${group}\", \"description\": \"${group} team group\"}}" \
+    | jq '{id: .id, name: .profile.name}'
+done
+
+# Add user to group
+USER_ID="00u1abc123"
+GROUP_ID="00g1def456"
+curl -s -X PUT \
+  -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
+  "${OKTA_ORG_URL}/api/v1/groups/${GROUP_ID}/users/${USER_ID}"
+```
+
+### Add a SAML Application in Okta
+
+```bash
+# Create a SAML 2.0 application
+curl -s -X POST \
+  -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
+  -H "Content-Type: application/json" \
+  "${OKTA_ORG_URL}/api/v1/apps" \
+  -d '{
+    "name": "custom_saml_app",
+    "label": "Internal Dashboard",
+    "signOnMode": "SAML_2_0",
+    "settings": {
+      "signOn": {
+        "defaultRelayState": "",
+        "ssoAcsUrl": "https://dashboard.company.com/saml/acs",
+        "audience": "https://dashboard.company.com",
+        "recipient": "https://dashboard.company.com/saml/acs",
+        "destination": "https://dashboard.company.com/saml/acs",
+        "subjectNameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+        "attributeStatements": [
+          {
+            "type": "EXPRESSION",
+            "name": "email",
+            "namespace": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
+            "values": ["user.email"]
+          },
+          {
+            "type": "EXPRESSION",
+            "name": "groups",
+            "namespace": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
+            "values": ["getFilteredGroups({\"00g1def456\"}, \"group.name\", 50)"]
+          }
+        ]
+      }
+    }
+  }' | jq '{id: .id, label: .label, status: .status}'
+
+# Assign group to application
+APP_ID="0oa1xyz789"
+curl -s -X PUT \
+  -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
+  -H "Content-Type: application/json" \
+  "${OKTA_ORG_URL}/api/v1/apps/${APP_ID}/groups/${GROUP_ID}"
+```
+
+### Okta MFA Policy
+
+```bash
+# Create an MFA enrollment policy requiring WebAuthn + TOTP
+curl -s -X POST \
+  -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
+  -H "Content-Type: application/json" \
+  "${OKTA_ORG_URL}/api/v1/policies" \
+  -d '{
+    "type": "MFA_ENROLL",
+    "name": "Require Strong MFA",
+    "status": "ACTIVE",
+    "settings": {
+      "factors": {
+        "webauthn": { "enroll": { "self": "REQUIRED" } },
+        "google_otp": { "enroll": { "self": "OPTIONAL" } },
+        "okta_email": { "enroll": { "self": "NOT_ALLOWED" } },
+        "okta_sms": { "enroll": { "self": "NOT_ALLOWED" } }
+      }
+    }
+  }' | jq '{id: .id, name: .name, status: .status}'
+```
+
+---
+
+## 4. Azure AD / Entra ID
+
+Azure AD (now Microsoft Entra ID) is common at startups using Microsoft 365 or Azure cloud.
+
+### Azure CLI Setup
+
+```bash
+# Install Azure CLI and sign in
+az login
+
+# Set the default tenant
+az account set --subscription "your-subscription-id"
+
+# Verify tenant
+az ad signed-in-user show --query '{name:displayName, email:userPrincipalName}'
+```
+
+### Create Users and Groups
+
+```bash
+# Create a user
+az ad user create \
+  --display-name "Alice Engineer" \
+  --user-principal-name "alice@company.onmicrosoft.com" \
+  --password "TempP@ss123!" \
+  --force-change-password-next-sign-in true
+
+# Create security groups
+for group in "SG-Engineering" "SG-Operations" "SG-Finance" "SG-Admins"; do
+  az ad group create --display-name "$group" --mail-nickname "$group"
+done
+
+# Add user to group
+USER_OID=$(az ad user show --id "alice@company.onmicrosoft.com" --query id -o tsv)
+GROUP_OID=$(az ad group show --group "SG-Engineering" --query id -o tsv)
+az ad group member add --group "$GROUP_OID" --member-id "$USER_OID"
+
+# List group members
+az ad group member list --group "SG-Engineering" --query '[].{name:displayName, email:userPrincipalName}' -o table
+```
+
+### Conditional Access Policies via Graph API
+
+```bash
+# Require MFA for all users accessing cloud apps
+# Uses Microsoft Graph API
+ACCESS_TOKEN=$(az account get-access-token --resource https://graph.microsoft.com --query accessToken -o tsv)
+
+curl -s -X POST \
+  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+  -H "Content-Type: application/json" \
+  "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" \
+  -d '{
+    "displayName": "Require MFA for all users",
+    "state": "enabledForReportingButNotEnforced",
+    "conditions": {
+      "users": {
+        "includeUsers": ["All"],
+        "excludeGroups": ["'${BREAKGLASS_GROUP_OID}'"]
+      },
+      "applications": {
+        "includeApplications": ["All"]
+      }
+    },
+    "grantControls": {
+      "operator": "OR",
+      "builtInControls": ["mfa"]
+    }
+  }'
+
+# Block legacy authentication (critical for security)
+curl -s -X POST \
+  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+  -H "Content-Type: application/json" \
+  "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" \
+  -d '{
+    "displayName": "Block legacy authentication",
+    "state": "enabled",
+    "conditions": {
+      "users": { "includeUsers": ["All"] },
+      "applications": { "includeApplications": ["All"] },
+      "clientAppTypes": ["exchangeActiveSync", "other"]
+    },
+    "grantControls": {
+      "operator": "OR",
+      "builtInControls": ["block"]
+    }
+  }'
+```
+
+---
+
+
+## Contents
+
+- [5. SSO Integration Patterns](references/details.md)
+- [6. SCIM Provisioning](references/details.md)
+- [7. MFA Enforcement](references/details.md)
+- [8. Role-Based Access Control](references/details.md)
+- [9. Audit & Compliance](references/details.md)
+- [10. Offboarding](references/details.md)
+- [Quick Reference](references/details.md)
+
+## When to Use This Skill
+
+Reach for this skill when:
+
+- **First SSO setup** -- You are moving from individual app logins to centralized authentication.
+- **Compliance audit preparation** -- SOC 2, ISO 27001, or HIPAA requires documented access controls, MFA enforcement, and audit logs.
+- **Team growth inflection** -- You are crossing 15-20 employees and manual onboarding/offboarding is becoming error-prone.
+- **Vendor security questionnaires** -- Customers are asking about your identity posture and you need to demonstrate controls.
+- **Incident response** -- You need to revoke access quickly across all systems for a departing or compromised user.
+
+Signs you are overdue:
+
+- Shared passwords in a spreadsheet or chat channel.
+- No central audit log of who accessed what and when.
+- Offboarding takes more than one business day.
+- Developers have standing admin access to production.
+
+---
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+