opencode-skills-collection 4.0.67 → 4.0.69

package/bundled-skills/rag-observability-evals/references/details.md

@@ -0,0 +1,92 @@
+# Details (moved from SKILL.md)
+
+> Extended reference content for `rag-observability-evals`, kept under `references/` so the entrypoint stays within the audit budget.
+
+## Alerting Strategy
+
+```yaml
+# rag-alerts.yaml
+groups:
+  - name: rag-quality-alerts
+    rules:
+      - alert: GroundednessDropped
+        expr: rag_groundedness_score < 0.75
+        for: 10m
+        labels:
+          severity: sev2
+        annotations:
+          summary: "Groundedness score dropped below 0.75 for {{ $labels.route }}"
+
+      - alert: HallucinationSpike
+        expr: |
+          rate(rag_hallucination_detected_total[15m])
+          / rate(rag_requests_total[15m]) > 0.10
+        for: 5m
+        labels:
+          severity: sev1
+
+      - alert: IndexStale
+        expr: rag_index_staleness_seconds > 86400
+        for: 5m
+        labels:
+          severity: sev3
+        annotations:
+          summary: "Index {{ $labels.index_name }} not updated in 24h"
+
+      - alert: HighFallbackRate
+        expr: |
+          rate(rag_fallback_triggered_total[10m])
+          / rate(rag_requests_total[10m]) > 0.20
+        for: 10m
+        labels:
+          severity: sev2
+
+      - alert: RetrievalLatencyHigh
+        expr: |
+          histogram_quantile(0.95,
+            rate(rag_retrieval_duration_seconds_bucket[5m])
+          ) > 2.0
+        for: 5m
+        labels:
+          severity: sev2
+```
+
+
+## Practical Guardrails
+
+- Force citations for high-risk domains.
+- Return abstain/fallback when confidence is below threshold.
+- Re-rank retrieved chunks before final generation.
+- Use query rewriting only with strict regression tests.
+
+
+## Incident Triage Checklist
+
+| Symptom | Check First | Check Second |
+|---------|-------------|--------------|
+| Groundedness dropped | Embedding model change? | Chunking/indexing logic change? |
+| Retrieval returning irrelevant docs | Index freshness and document count | Embedding model version mismatch |
+| Latency spike in retrieval | Vector DB connection pool and load | Index size growth beyond threshold |
+| Cost per answer increasing | Token usage per stage breakdown | Cache hit rate decline |
+| Hallucination spike | Model version or temperature change | Context window overflow (truncated docs) |
+
+
+## Troubleshooting
+
+| Issue | Diagnosis | Resolution |
+|-------|-----------|------------|
+| RAGAS eval returns 0 for all metrics | Check dataset format matches expected schema | Ensure contexts are lists, not strings |
+| Groundedness score unreliable | LLM judge inconsistency | Increase judge sample size, set temperature=0 |
+| Index staleness alert firing | Ingestion pipeline failure | Check data source connectivity and ingestion logs |
+| Retrieval recall dropping | Embedding drift after model update | Re-index corpus with current embedding model |
+| High latency in generation | Context too large for model | Reduce top-k or add summarization step |
+
+
+## Related Skills
+
+- rag-infrastructure (`rag-infrastructure`) - Deploy robust RAG backends
+- agent-observability (`agent-observability`) - Instrument requests, traces, and costs
+- agent-evals (`agent-evals`) - Build repeatable eval suites
+- ai-sre-incident-response (`ai-sre-incident-response`) - Incident response for quality regressions
+- opentelemetry (`opentelemetry`) - Distributed tracing for RAG pipelines
+

package/bundled-skills/ralph-loop-yylo/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: ralph-loop-yylo
+description: Execute exactly one explicitly assigned YYLO Ledger task through the
+  Ralph loop to a validated queued commit. Use only when the user explicitly requests
+  ralph-loop-yylo.
+category: agent-orchestration
+risk: critical
+source: https://github.com/yylo-dev/yylo-skills
+source_repo: yylo-dev/yylo-skills
+source_type: community
+date_added: '2026-09-19'
+license: MIT
+license_source: https://github.com/yylo-dev/yylo-skills/blob/main/LICENSE
+compatibility: Requires the `yy` CLI, git and bash. Executes one explicitly assigned
+  Ledger task in its admitted worktree through `yy task start/finish` to a validated
+  queued commit. Never pushes, deploys, merges, or releases.
+---
+
+# Execute one assigned task in the Ralph loop
+
+Read [references/implement.md](references/implement.md) completely and follow it.
+
+Stay within the assigned task. Do not select unrelated work, edit `tasks.md`, auto-tag releases, push, deploy, mutate production, or broaden scope because another issue is noticed. Record a bounded related Kanban follow-up when necessary.
+
+Keep durable instructions concise and evidence-backed. Status belongs in the task response and runtime receipts, not `AGENTS.md`.
+
+Controller checkpoints are best-effort local durability warnings after terminal metadata is durable. They never gate `yy pi`, `yy task`, `yy merge`, product commits, candidates, or releases.
+
+## Complete assigned request
+
+Treat the following as the complete user-assigned request. Preserve task references and directives literally; resolve them only through the normal agent workflow.
+
+$ARGUMENTS
+
+## When to Use
+
+- The user explicitly requests `ralph-loop-yylo` for one already-assigned YYLO Ledger task.
+- You need to implement exactly that task through the validated loop to a queued, review-ready commit.
+
+## Limitations
+
+- Exactly one assigned task per run: never select unrelated work, broaden scope, push, deploy, merge, release, or mutate production.
+- Requires `yy task start TASK_ID` admission and `yy task finish TASK_ID` closure; stop after queueing - only the target owner runs `yy merge land`.
+- Docs-only import: the upstream `scripts/kanban.sh` wrapper is intentionally not bundled; `references/` holds the worker contract.
+- Controller checkpoints are best-effort durability warnings, never lifecycle gates.
+
+### Example
+
+```bash
+yy task start TASK_ID
+yy task preflight TASK_ID
+yy task finish TASK_ID
+```
+
+> Adapted from [yylo-dev/yylo-skills](https://github.com/yylo-dev/yylo-skills) (MIT) - v2.0.1; frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: `scripts/kanban.sh` runtime not bundled.

package/bundled-skills/ralph-loop-yylo/references/first_check.md

@@ -0,0 +1,18 @@
+### Check once
+
+Before editing, verify the task worktree, clean starting state, and frozen admitted
+path scope. Inspect ignore files only when the assigned task requires an ignore
+rule or the task's validation would otherwise produce untracked generated output.
+
+Modify an ignore file only when all of the following are true:
+
+- the change is necessary for the assigned task;
+- the exact file is included in the task's admitted paths;
+- existing project conventions support the rule; and
+- the change is included in focused validation and the task commit.
+
+Do not create or expand `.gitignore`, `.dockerignore`, `.eslintignore`,
+`.prettierignore`, `.npmignore`, `.terraformignore`, or `.helmignore` merely
+because a related tool is present. If a useful ignore-file change is outside the
+assigned scope, record a bounded related follow-up and continue only when the
+current task remains valid without it.

package/bundled-skills/ralph-loop-yylo/references/implement.md

@@ -0,0 +1,60 @@
+<!-- GENERATED DESTINATIONS: edit this canonical source, then run `npm run generate:implementation-contract`. -->
+---
+description: Implement exactly one assigned Kanban task in its admitted Bolt product worktree and stop after queueing it.
+---
+
+# Bolt implementation worker contract
+
+An implementation worker owns one explicitly assigned task. It does not select
+other work, mutate the product target, merge, release, deploy, or clean another
+task's workspace.
+
+## 1. Resolve and preserve admission
+
+1. Read `AGENTS.md` and the complete assigned task from the canonical controller.
+2. Run `yy task start TASK_ID` unless the handoff already contains the matching
+   active Bolt task record. Verify the returned worktree, branch, full target ref,
+   and exact base SHA before editing; stop on missing or contradictory evidence.
+3. Work only in that product worktree. Never edit product files in the controller
+   or copy controller ledgers, specs, state, or artifacts into a task worktree.
+4. Preserve controller identity and workspace-role checks. Controller checkpoints
+   are best-effort local durability warnings after terminal metadata is durable;
+   they are not product inputs or lifecycle gates.
+
+## 2. Implement
+
+1. Edit only requested product paths and preserve project sources of truth.
+2. Use focused affected tests in the edit loop. Other feature worktrees may run
+   concurrently; do not wait for or modify them.
+3. Do not launch lifecycle-semantic reviewers from implementation. Semantic
+   review and project checks are explicit owner operations outside native task
+   delivery; never claim they occurred because a task was queued.
+4. If blocked, record bounded truthful state and stop without claiming success.
+   Durable diagnostic output belongs in a verified Ledger Artifact Record when
+   the installed API supports it; otherwise preserve an external draft and stop,
+   never fall back to product documentation or direct controller-store edits.
+
+## 3. Queue and hand off
+
+1. Run focused tests, required dangerous-path checks, parity checks, and
+   `git diff --check`.
+2. Stage only task-owned paths, commit coherently, and leave the worktree clean.
+3. Run `yy task preflight TASK_ID` before expensive final validation. Repair any
+   admission, generated-output, runtime, or closure refusal while the task is
+   still `WORKING`.
+4. Run `yy task finish TASK_ID`; it validates the exact preflighted tip and
+   records `QUEUED` with its immutable review-ready closure.
+5. Record the commit and bounded response in Kanban. A lifecycle finalizer may
+   attempt a controller checkpoint after terminal metadata is durable; checkpoint
+   failure remains a warning and must not change the task or merge outcome.
+
+Stop after queueing. Read-only delivery observation uses `yy merge status`.
+Only the target owner runs `yy merge land TASK_ID`, which uses native Git and an
+expected-old ref update. If Git integration succeeded but Ledger projection did
+not, recover only with `yy merge project TASK_ID`. Implementation agents do not
+poll, steal authority, discard dirty bytes, or mutate the target.
+
+Release-version changes use this same ordinary task/merge lifecycle. Package
+preparation is maintainer-only and outside `yy`. Never create a tag, push,
+publish, deploy, mutate production, restart services, run post-deploy E2E, or
+clean worktrees without separate authority.

package/bundled-skills/recon-scope-triage/SKILL.md

@@ -0,0 +1,128 @@
+---
+name: recon-scope-triage
+description: Triage ASM/recon output for ownership before testing
+category: security
+risk: offensive
+source: https://github.com/elementalsouls/Claude-BugHunter
+source_repo: elementalsouls/Claude-BugHunter
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/elementalsouls/Claude-BugHunter/blob/main/LICENSE
+compatibility: Requires explicit written authorization for a target scope plus the
+  relevant testing tools for this technique. Docs-only; helper scripts and commands
+  not bundled.
+sources: authorized-engagement
+report_count: 1
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+## When to use this skill
+
+Trigger when:
+- The target brand is a common/dictionary word or shared term (e.g. `apex`, `summit`, `vertex`, `nova`, `core`, `orbit`, `pulse`, `unity`…)
+- You receive an ASM report, recon export, breach combo, repo list, bucket list, or mobile-app list to act on
+- A "Critical" count looks implausibly high (hundreds) for the org's size
+- Any asset's ownership is asserted by the tool but not *proven*
+
+The two failure modes this skill prevents:
+1. **Wasting the engagement** testing/triaging assets that aren't the target's.
+2. **Attacking an innocent third party** that merely shares the name — out of scope, and real harm.
+
+**Rule: ownership is guilty-until-proven. An asset is the target's only when a concrete ownership signal ties it to the target — never because a scanner's keyword matched.**
+
+---
+
+## The collision sources (where keyword-matching lies)
+
+| Recon source | How it collides | Verify ownership by |
+|---|---|---|
+| **GitHub repos** | Search matched the brand word in repo name / topic / a string | Repo owner is the org's GH org; commits from org emails; code references the org's real domains/infra. A repo named `<word>-backend` by a random user = noise. |
+| **Cloud buckets** (S3/GCS) | Bucket names are a **global namespace**; `<word>-static`, `<word>-data`, `<word>-public` exist for *someone* | Bucket content references the target; bucket name correlates with a *confirmed* target subdomain (`x.target.com` ↔ `x-public`) AND content matches; ACL/owner metadata. Generic content (other-language, other-industry) = not theirs. |
+| **Mobile apps** | Store search matched the brand word in app name / package | Publisher account = the org; package reverse-DNS = an owned domain (`com.<owneddomain>.app`); dev cert; app calls owned API hosts. Mature ASM tools emit an "apps_accepted=0" / ownership-confidence field — read it. |
+| **Breach corpora / combos** | Email local-or-domain contains the brand word | **Exact** owned-domain match only (`@target.com`), not `@<word>group.com` / `@something<word>.com`. A different domain that contains the word is a different org. |
+| **Typosquats** | Generated permutations of the name | These are *defensive*/brand-protection findings, not offensive scope — note and move on. |
+| **Stack/forum/paste hits** | Brand word in body | Body references the target's real domain/subdomain/employee/secret. Ownership-confidence < threshold = drop. |
+
+---
+
+## Web "Critical" triage — the soft-404 control
+
+Automated `.env` / `.git` / `actuator` / admin-panel "Criticals" are overwhelmingly **soft-404s**: SPA/framework catch-alls returning HTTP 200 (or 403) for *every* path. Verify EACH before believing it:
+```bash
+# the "finding"
+curl -s -o /tmp/a -w "%{http_code} %{size_download}\n" https://host.target.com/.env
+# a junk control on the same host
+curl -s -o /tmp/b -w "%{http_code} %{size_download}\n" https://host.target.com/zzz-nonsense-$RANDOM
+# identical byte length / body  →  FALSE POSITIVE (catch-all), discard
+cmp -s /tmp/a /tmp/b && echo "SOFT-404 false positive" || echo "differs — investigate"
+```
+Real exposures have a content-type + signature that differs from the catch-all (`.git/config` starts `[core]`; `.env` has `KEY=value`; phpinfo has the XHTML-transitional doctype + `PHP Version`). A physical `.php`/`phpinfo.php` that returns a *bigger/different* body than the junk control is the real-vs-soft-404 tell.
+
+---
+
+## The triage workflow
+
+1. **Confirm the canonical owned-domain set first** (the SOW/program domain + its verified subdomains + the verified Entra/Okta/Google tenant brand name). This is your ownership anchor.
+2. **For each asset class, apply the verify-by column above.** No signal → quarantine, don't test.
+3. **Re-baseline the severity counts** against only-owned assets. Report the *delta* — "N Criticals → M after ownership + soft-404 triage" is itself a finding about the ASM program.
+4. **Quarantine collisions explicitly** (a `loot/quarantined_<source>.txt`) so it's auditable that you saw them and chose not to target them.
+5. **Surface the meta-finding:** if the supplied ASM/recon feed is mostly false-positive, that misallocates the owner's remediation budget and buries real risk — write it up (Medium/Strategic).
+
+---
+
+## Anti-patterns
+
+- **Trusting the tool's "owned" label.** Tools keyword-match; they don't prove ownership. Verify.
+- **Targeting a same-named third party** because it was "in the report." Out of scope + real harm. A combo line `user@<word>company.com` is a different company's employee.
+- **Reporting soft-404s as exposures.** Always run the junk-path control.
+- **Counting typosquats / missing-headers / brand-collision repos as offensive findings.** They're defensive/hygiene/noise — they pad the report and erode credibility.
+- **Skipping triage "to save time."** Untriaged, you spend the whole engagement on other people's assets and find nothing real.
+
+---
+
+## Why this matters (calibration)
+
+For a target whose brand is a common word, expect the bulk of automated "owned" assets to be collisions:
+- **Repos** that are unrelated open-source projects (ad-block lists, scrapers, student projects, a different company's SDK) merely containing the word.
+- **Mobile apps** published by entirely different companies that share the name — banks, credit unions, dating apps, dispensaries, home-care services are all real-world collision categories. (Good ASM tooling will tell you it accepted *zero* as owned.)
+- **Cloud buckets** in the global namespace holding some unrelated org's content (other-language documents, demo/sample data, another industry's files).
+- **Breach combos** full of emails from sibling-named-but-different companies (`<word>group.com`, `<region><word>.com`).
+
+On a real engagement against a dictionary-word brand, after clearing this noise the only genuinely-owned high-severity finding was discoverable solely by manual tradecraft (a JS-bundle → API discovery, see `hunt-spa-api`) — it was nowhere in the hundreds of scanner "Criticals." Triage-first is what made the engagement productive instead of a goose chase.
+
+---
+
+## Related Skills & Chains
+
+- **`triage-validation`** — asset-ownership triage (this skill) precedes finding-validity triage (the 7-Question Gate). Ownership first, then validity.
+- **`redteam-mindset`** — "aggressive default" means probe every *owned* live surface; this skill defines which surfaces are owned so persistence isn't wasted on collisions.
+- **`hunt-spa-api`** — once an API host passes ownership triage, this is how you test it.
+- **`offensive-osint` / `osint-methodology`** — feed ownership anchors (verified domains, tenant brand, dev accounts) from OSINT into this triage.
+
+## Limitations
+
+- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
+- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
+- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.
+
+### Example
+
+```bash
+# Read-only first step; confirm scope before anything active.
+cat scope.txt  # target list from the authorized engagement brief
+```
+
+> Adapted from [elementalsouls/Claude-BugHunter](https://github.com/elementalsouls/Claude-BugHunter) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.