opencode-skills-collection 4.0.67 → 4.0.69

package/bundled-skills/windows-hardening/references/details.md

@@ -0,0 +1,204 @@
+# Details (moved from SKILL.md)
+
+> Extended reference content for `windows-hardening`, kept under `references/` so the entrypoint stays within the audit budget.
+
+## BitLocker Drive Encryption
+
+```powershell
+# ============================================
+# Enable BitLocker on OS drive with TPM
+# ============================================
+
+# Check TPM status
+Get-Tpm
+
+# Enable BitLocker with TPM protector
+Enable-BitLocker -MountPoint "C:" -TpmProtector -EncryptionMethod XtsAes256
+
+# Add recovery password protector
+Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector
+
+# Backup recovery key to Active Directory
+Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (
+    (Get-BitLockerVolume -MountPoint "C:").KeyProtector |
+    Where-Object { $_.KeyProtectorType -eq "RecoveryPassword" }
+).KeyProtectorId
+
+# Enable BitLocker on data drives
+Enable-BitLocker -MountPoint "D:" -RecoveryPasswordProtector -EncryptionMethod XtsAes256 -Password (
+    Read-Host -AsSecureString "Enter BitLocker password for D:"
+)
+
+# Check BitLocker status
+Get-BitLockerVolume | Format-Table MountPoint, VolumeStatus, EncryptionMethod, ProtectionStatus
+
+# Configure BitLocker via Group Policy
+# Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption
+# - Require additional authentication at startup: Enabled (Allow BitLocker without a compatible TPM: unchecked)
+# - Choose drive encryption method: XTS-AES 256-bit
+```
+
+
+## Credential Guard
+
+```powershell
+# ============================================
+# Enable Windows Credential Guard
+# ============================================
+
+# Check hardware compatibility
+# Requires: UEFI, Secure Boot, TPM 2.0, VBS-compatible CPU
+systeminfo | findstr /i "Hyper-V"
+
+# Enable via registry
+Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" `
+    -Name "EnableVirtualizationBasedSecurity" -Value 1
+Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" `
+    -Name "RequirePlatformSecurityFeatures" -Value 3  # 3 = Secure Boot + DMA Protection
+Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
+    -Name "LsaCfgFlags" -Value 1  # 1 = Enabled with UEFI lock
+
+# Verify Credential Guard status
+Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
+    Select-Object SecurityServicesRunning, VirtualizationBasedSecurityStatus
+```
+
+
+## AppLocker Configuration
+
+```powershell
+# ============================================
+# Configure AppLocker for application whitelisting
+# ============================================
+
+# Generate default rules
+# Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker
+
+# Create default executable rules via PowerShell
+$ruleCollection = @"
+<AppLockerPolicy Version="1">
+  <RuleCollection Type="Exe" EnforcementMode="AuditOnly">
+    <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="Allow Program Files" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
+      <Conditions>
+        <FilePathCondition Path="%PROGRAMFILES%\*"/>
+      </Conditions>
+    </FilePathRule>
+    <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="Allow Windows" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
+      <Conditions>
+        <FilePathCondition Path="%WINDIR%\*"/>
+      </Conditions>
+    </FilePathRule>
+    <FilePublisherRule Id="b7af7102-efde-4369-8a89-7a6a392d1473" Name="Allow signed by Microsoft" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
+      <Conditions>
+        <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION*" ProductName="*" BinaryName="*">
+          <BinaryVersionRange LowSection="*" HighSection="*"/>
+        </FilePublisherCondition>
+      </Conditions>
+    </FilePublisherRule>
+  </RuleCollection>
+</AppLockerPolicy>
+"@
+
+# Start AppLocker service
+Set-Service -Name AppIDSvc -StartupType Automatic
+Start-Service AppIDSvc
+
+# Set to Audit mode first, then switch to Enforce after tuning
+# Review logs: Event Viewer > Applications and Services Logs > Microsoft > Windows > AppLocker
+```
+
+
+## Security Audit Script
+
+```powershell
+# windows-security-audit.ps1 - Comprehensive security audit
+
+Write-Host "=== Windows Security Audit Report ===" -ForegroundColor Cyan
+Write-Host "Date: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss UTC' -AsUTC)"
+Write-Host "Host: $env:COMPUTERNAME"
+Write-Host ""
+
+# OS Info
+Write-Host "--- OS Information ---" -ForegroundColor Yellow
+Get-CimInstance Win32_OperatingSystem | Format-Table Caption, Version, BuildNumber, OSArchitecture
+
+# Firewall status
+Write-Host "--- Firewall Status ---" -ForegroundColor Yellow
+Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction
+
+# SMBv1 status
+Write-Host "--- SMB Status ---" -ForegroundColor Yellow
+$smb1 = Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
+if ($smb1.EnableSMB1Protocol) { Write-Host "WARNING: SMBv1 is ENABLED" -ForegroundColor Red }
+else { Write-Host "OK: SMBv1 is disabled" -ForegroundColor Green }
+
+# Windows Defender status
+Write-Host "--- Windows Defender ---" -ForegroundColor Yellow
+Get-MpComputerStatus | Format-Table AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
+
+# BitLocker status
+Write-Host "--- BitLocker ---" -ForegroundColor Yellow
+Get-BitLockerVolume | Format-Table MountPoint, ProtectionStatus, EncryptionMethod
+
+# Open ports
+Write-Host "--- Listening Ports ---" -ForegroundColor Yellow
+Get-NetTCPConnection -State Listen | Sort-Object LocalPort |
+    Format-Table LocalAddress, LocalPort, OwningProcess,
+    @{N="Process";E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name}}
+
+# Local administrators
+Write-Host "--- Local Administrators ---" -ForegroundColor Yellow
+Get-LocalGroupMember -Group "Administrators" | Format-Table Name, ObjectClass, PrincipalSource
+
+# Pending updates
+Write-Host "--- Windows Update ---" -ForegroundColor Yellow
+$updateSession = New-Object -ComObject Microsoft.Update.Session
+$updateSearcher = $updateSession.CreateUpdateSearcher()
+$pendingUpdates = $updateSearcher.Search("IsInstalled=0")
+Write-Host "Pending updates: $($pendingUpdates.Updates.Count)"
+
+# Audit policy
+Write-Host "--- Audit Policy ---" -ForegroundColor Yellow
+auditpol /get /category:* | Select-String "Success|Failure|No Auditing"
+
+Write-Host "`n=== Audit Complete ===" -ForegroundColor Cyan
+```
+
+
+## Troubleshooting
+
+| Problem | Cause | Solution |
+|---------|-------|----------|
+| GPO not applying | GPO not linked or filtered | Run `gpresult /r`; check OU linking and security filtering |
+| BitLocker fails to enable | TPM not present or enabled | Check BIOS/UEFI for TPM; run `manage-bde -status` |
+| AppLocker blocks legitimate apps | Rules too restrictive | Start in Audit mode; review AppLocker event logs; add exceptions |
+| Credential Guard breaks apps | Legacy auth protocols blocked | Identify apps using NTLM/CredSSP; migrate to Kerberos/modern auth |
+| SMBv1 removal breaks legacy devices | Old devices require SMBv1 | Isolate legacy devices; plan migration; document risk acceptance |
+| Windows Defender exclusions too broad | Performance tuning added wide paths | Review and narrow exclusions; document business justification |
+| Audit logs filling disk | Too many audit events | Increase log size; configure log forwarding to SIEM; tune audit categories |
+| Firewall rules not persisting | Rules created without -PolicyStore | Use `-PolicyStore PersistentStore`; verify with `Get-NetFirewallRule` |
+
+
+## Best Practices
+
+- Apply Microsoft security baselines as a starting point
+- Disable SMBv1 on all systems (no exceptions without documented risk acceptance)
+- Enable Credential Guard on all compatible hardware
+- Configure AppLocker in audit mode first, then enforce after tuning
+- Enable all recommended audit subcategories and forward to SIEM
+- Enable PowerShell script block and module logging on all servers
+- Implement LAPS for local administrator password management
+- Enable BitLocker on all drives with TPM and recovery key backup
+- Apply Attack Surface Reduction rules in Windows Defender
+- Perform monthly security audits with the audit script
+- Keep Windows fully patched with automated update management
+- Disable unnecessary services and features to reduce attack surface
+- Use Windows Firewall with explicit allow rules per application
+
+
+## Related Skills
+
+- cis-benchmarks (`cis-benchmarks`) - Compliance scanning
+- windows-server (`windows-server`) - Server administration
+- linux-hardening (`linux-hardening`) - Linux security hardening
+

package/bundled-skills/windows-server/SKILL.md

@@ -0,0 +1,318 @@
+---
+name: windows-server
+description: Administer Windows Server systems. Manage IIS, Active Directory, and
+  PowerShell automation. Use when administering Windows infrastructure.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Windows Server Administration
+
+Windows Server management and PowerShell automation for production workloads including IIS web hosting, Active Directory domain services, and system maintenance.
+
+## When to Use
+
+- Provisioning or configuring Windows Server 2019/2022 instances
+- Setting up IIS websites, application pools, and bindings
+- Managing Active Directory users, groups, and Group Policy
+- Automating administrative tasks with PowerShell
+- Reviewing Windows Event Logs for troubleshooting
+- Applying and managing Windows Updates on servers
+
+## Prerequisites
+
+- Administrator account on the target server
+- PowerShell 5.1+ (built-in) or PowerShell 7+ installed
+- Remote Desktop or WinRM access configured
+- Windows Server 2019 or 2022 (Desktop Experience or Server Core)
+
+## PowerShell Administration Essentials
+
+```powershell
+# Check PowerShell version
+$PSVersionTable.PSVersion
+
+# Get system information
+Get-ComputerInfo | Select-Object CsName, OsName, OsVersion, OsArchitecture
+
+# List running processes sorted by CPU
+Get-Process | Sort-Object CPU -Descending | Select-Object -First 20
+
+# List all services and their status
+Get-Service | Where-Object { $_.Status -eq 'Running' }
+
+# Restart a service
+Restart-Service -Name W3SVC -Force
+
+# Get disk space on all drives
+Get-PSDrive -PSProvider FileSystem | Select-Object Name, @{N='Used(GB)';E={[math]::Round($_.Used/1GB,2)}}, @{N='Free(GB)';E={[math]::Round($_.Free/1GB,2)}}
+
+# Check uptime
+(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
+
+# Open firewall port
+New-NetFirewallRule -DisplayName "Allow HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
+
+# List firewall rules
+Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' } | Select-Object DisplayName, Action
+
+# Set DNS client server addresses
+Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("10.0.0.2","10.0.0.3")
+
+# PowerShell remoting to another server
+Enter-PSSession -ComputerName server02 -Credential (Get-Credential)
+
+# Run a command on multiple remote servers
+Invoke-Command -ComputerName server01,server02,server03 -ScriptBlock { Get-Service W3SVC }
+```
+
+## Server Roles and Features
+
+```powershell
+# List all available roles and features
+Get-WindowsFeature
+
+# Install IIS with management tools
+Install-WindowsFeature -Name Web-Server -IncludeManagementTools -IncludeAllSubFeature
+
+# Install Active Directory Domain Services
+Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
+
+# Install DNS Server
+Install-WindowsFeature -Name DNS -IncludeManagementTools
+
+# Install DHCP Server
+Install-WindowsFeature -Name DHCP -IncludeManagementTools
+
+# Install File Server with deduplication
+Install-WindowsFeature -Name FS-FileServer, FS-Data-Deduplication
+
+# List installed features only
+Get-WindowsFeature | Where-Object Installed | Select-Object Name, InstallState
+
+# Remove a feature
+Uninstall-WindowsFeature -Name Telnet-Client
+```
+
+## IIS Web Server Setup
+
+```powershell
+# Import the IIS administration module
+Import-Module WebAdministration
+
+# Create a new application pool
+New-WebAppPool -Name "ProductionPool"
+Set-ItemProperty IIS:\AppPools\ProductionPool -Name processModel.identityType -Value 3  # NetworkService
+Set-ItemProperty IIS:\AppPools\ProductionPool -Name managedRuntimeVersion -Value ""     # No managed code (reverse proxy)
+
+# Create a new website
+New-Website -Name "MyApp" `
+  -Port 443 `
+  -Protocol https `
+  -PhysicalPath "C:\inetpub\myapp" `
+  -ApplicationPool "ProductionPool" `
+  -SslFlags 1
+
+# Add an HTTP binding that redirects to HTTPS
+New-WebBinding -Name "MyApp" -Protocol http -Port 80
+
+# Bind an SSL certificate to the HTTPS site
+$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*example.com*" }
+New-Item IIS:\SslBindings\0.0.0.0!443 -Value $cert
+
+# Create a virtual directory
+New-WebVirtualDirectory -Site "MyApp" -Name "static" -PhysicalPath "C:\inetpub\static"
+
+# Start, stop, and restart a site
+Start-Website -Name "MyApp"
+Stop-Website  -Name "MyApp"
+Restart-WebAppPool -Name "ProductionPool"
+
+# List all websites and their state
+Get-Website | Select-Object Name, State, PhysicalPath, @{N='Bindings';E={$_.Bindings.Collection.bindingInformation}}
+
+# Enable IIS logging with W3C format
+Set-WebConfigurationProperty -PSPath "IIS:\Sites\MyApp" `
+  -Filter "system.webServer/httpLogging" `
+  -Name "dontLog" -Value $false
+
+# URL Rewrite: redirect HTTP to HTTPS (requires URL Rewrite module)
+# web.config rule:
+@'
+<rule name="HTTP to HTTPS" stopProcessing="true">
+  <match url="(.*)" />
+  <conditions>
+    <add input="{HTTPS}" pattern="off" />
+  </conditions>
+  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
+</rule>
+'@
+```
+
+## Active Directory Basics
+
+```powershell
+# Promote server to a new domain controller in a new forest
+Install-ADDSForest `
+  -DomainName "corp.example.com" `
+  -DomainNetBIOSName "CORP" `
+  -InstallDns:$true `
+  -SafeModeAdministratorPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) `
+  -Force:$true
+
+# Create an Organizational Unit
+New-ADOrganizationalUnit -Name "Engineering" -Path "DC=corp,DC=example,DC=com"
+
+# Create a new AD user
+New-ADUser -Name "Jane Smith" `
+  -SamAccountName "jsmith" `
+  -UserPrincipalName "jsmith@corp.example.com" `
+  -Path "OU=Engineering,DC=corp,DC=example,DC=com" `
+  -AccountPassword (ConvertTo-SecureString "TempP@ss1" -AsPlainText -Force) `
+  -Enabled $true `
+  -ChangePasswordAtLogon $true
+
+# Add user to a group
+Add-ADGroupMember -Identity "Domain Admins" -Members "jsmith"
+
+# Search for users in an OU
+Get-ADUser -Filter * -SearchBase "OU=Engineering,DC=corp,DC=example,DC=com" | Select-Object Name, SamAccountName, Enabled
+
+# Disable a user account
+Disable-ADAccount -Identity "jsmith"
+
+# Unlock a locked-out account
+Unlock-ADAccount -Identity "jsmith"
+
+# Reset a user password
+Set-ADAccountPassword -Identity "jsmith" -Reset -NewPassword (ConvertTo-SecureString "NewP@ss1" -AsPlainText -Force)
+
+# List all domain controllers
+Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, Site
+
+# Check AD replication status
+Get-ADReplicationPartnerMetadata -Target "dc01.corp.example.com"
+repadmin /replsummary
+```
+
+## Windows Update Management
+
+```powershell
+# Install the PSWindowsUpdate module (from PowerShell Gallery)
+Install-Module -Name PSWindowsUpdate -Force
+
+# Check for available updates
+Get-WindowsUpdate
+
+# Install all available updates (auto-reboot if needed)
+Install-WindowsUpdate -AcceptAll -AutoReboot
+
+# Install only critical and security updates
+Install-WindowsUpdate -Category "Security Updates","Critical Updates" -AcceptAll
+
+# View update history
+Get-WUHistory | Select-Object -First 20 Title, Date, Result
+
+# Schedule monthly patching via Task Scheduler
+$action  = New-ScheduledTaskAction -Execute "powershell.exe" `
+  -Argument "-NoProfile -Command Install-WindowsUpdate -AcceptAll -AutoReboot"
+$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2am
+Register-ScheduledTask -TaskName "MonthlyPatching" -Action $action -Trigger $trigger -User "SYSTEM" -RunLevel Highest
+
+# WSUS configuration via Group Policy (registry keys)
+# HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
+# WUServer = http://wsus.corp.example.com:8530
+# WUStatusServer = http://wsus.corp.example.com:8530
+```
+
+## Event Log Analysis
+
+```powershell
+# View the 50 most recent System log errors
+Get-EventLog -LogName System -EntryType Error -Newest 50
+
+# Search for specific event IDs (e.g., unexpected shutdowns = 6008)
+Get-EventLog -LogName System -InstanceId 6008
+
+# Use Get-WinEvent for advanced filtering (newer cmdlet)
+Get-WinEvent -FilterHashtable @{
+    LogName   = 'Application'
+    Level     = 2   # Error
+    StartTime = (Get-Date).AddDays(-1)
+} | Select-Object TimeCreated, Id, Message -First 20
+
+# Search Security log for failed logons (Event ID 4625)
+Get-WinEvent -FilterHashtable @{
+    LogName = 'Security'
+    Id      = 4625
+} | Select-Object TimeCreated, @{N='Account';E={$_.Properties[5].Value}}, @{N='Source';E={$_.Properties[19].Value}} -First 30
+
+# Export events to CSV for analysis
+Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1,2 } |
+  Export-Csv -Path C:\Logs\system-errors.csv -NoTypeInformation
+
+# Clear old event log entries (use cautiously)
+Clear-EventLog -LogName Application
+
+# Set maximum log size
+Limit-EventLog -LogName Application -MaximumSize 512MB -OverflowAction OverwriteAsNeeded
+```
+
+## Scheduled Tasks
+
+```powershell
+# Create a scheduled task to run a script daily at 3 AM
+$action  = New-ScheduledTaskAction -Execute "powershell.exe" `
+  -Argument "-NoProfile -File C:\Scripts\daily-maintenance.ps1"
+$trigger = New-ScheduledTaskTrigger -Daily -At 3am
+$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -DontStopOnIdleEnd
+Register-ScheduledTask -TaskName "DailyMaintenance" -Action $action -Trigger $trigger -Settings $settings -User "SYSTEM"
+
+# List all scheduled tasks
+Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' } | Select-Object TaskName, State, TaskPath
+
+# Run a task immediately
+Start-ScheduledTask -TaskName "DailyMaintenance"
+
+# Disable and remove a task
+Disable-ScheduledTask -TaskName "DailyMaintenance"
+Unregister-ScheduledTask -TaskName "DailyMaintenance" -Confirm:$false
+```
+
+## Troubleshooting
+
+| Symptom | Diagnostic Command | Common Fix |
+|---|---|---|
+| IIS site returns 503 | `Get-WebAppPoolState` | Restart the application pool; check Event Log for crash |
+| High CPU on server | `Get-Process \| Sort CPU -Desc` | Identify process; check for runaway w3wp or service |
+| Disk running low | `Get-PSDrive -PSProvider FileSystem` | Clear temp files, IIS logs, Windows Update cache |
+| AD account locked out | `Search-ADAccount -LockedOut` | `Unlock-ADAccount`; find lockout source in Security log |
+| Windows Update fails | `Get-WindowsUpdate -Verbose` | Run `sfc /scannow`, reset update components |
+| Service fails to start | `Get-EventLog -LogName System -Newest 20` | Check dependencies, credentials, and port conflicts |
+| RDP connection refused | `Get-ItemProperty 'HKLM:\System\...\Terminal Server'` | Ensure RDP is enabled and firewall allows port 3389 |
+| DNS resolution fails | `Resolve-DnsName example.com` | Check DNS server settings and forwarder config |
+
+## Related Skills
+
+- `linux-administration` -- Cross-platform comparison and hybrid management
+- `ssh-configuration` -- SSH access for Windows OpenSSH Server
+- `user-management` -- Parallel concepts for Linux user/group management
+- `systemd-services` -- Linux equivalent of Windows Services and Task Scheduler
+- `performance-tuning` -- Performance monitoring and optimization patterns
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+

package/bundled-skills/workflow-yylo/SKILL.md

@@ -0,0 +1,107 @@
+---
+name: workflow-yylo
+description: Create and maintain validated YYLO Ledger workflow Records while keeping
+  storage, execution, and run evidence as separate explicit boundaries.
+category: project-management
+risk: safe
+source: https://github.com/yylo-dev/yylo-skills
+source_repo: yylo-dev/yylo-skills
+source_type: community
+date_added: '2026-09-19'
+license: MIT
+license_source: https://github.com/yylo-dev/yylo-skills/blob/main/LICENSE
+compatibility: Requires the `yy` CLI with the `workflow` record group installed. Ledger
+  stores and validates workflow data; execution needs a separately selected runner
+  plus explicit authority.
+argument-hint: '[workflow to find/create/update or execution question]'
+enable-shell-directives: true
+---
+
+# Use YYLO workflow Records
+
+Treat Ledger as the source of truth for workflow identity, validated definition,
+and revision history. Use `yy ledger` in a YYLO controller or `yylo-ledger`
+standalone. Inspect `COMMAND workflow --help`; if the namespace is absent, do not
+invent it or edit Ledger storage directly.
+
+## Keep three boundaries distinct
+
+1. **Ledger stores and validates workflow data.** It does not execute workflows.
+2. **A separately selected YYLO runner executes reviewed workflow data.** Storage
+   does not grant execution, network, mutation, release, or deployment authority.
+3. **Artifact Records retain run evidence.** Do not overwrite the workflow
+   definition with stdout, logs, model output, reports, or receipts.
+
+The read-only Ledger host also has no workflow execution endpoint.
+
+## Discover and inspect
+
+```bash
+yy ledger workflow search --text "release verification" --projection summary --limit 20 -f json
+yy ledger workflow get RECORD_ID -f json
+yy ledger workflow get RECORD_ID --raw
+yy ledger workflow get RECORD_ID --validated
+```
+
+Prefer immutable IDs after discovery. Use bounded projections and explicit archive
+scope. `--validated` emits normalized YAML only after schema validation.
+
+## Author safe workflow data
+
+A workflow v1 document requires a mapping with `schema_version: v1`, a non-empty
+`workflow_id`, and a `steps` list whose step IDs are non-empty and unique.
+
+```yaml
+schema_version: v1
+workflow_id: focused-validation
+steps:
+  - id: test
+    command: ["npm", "test"]
+```
+
+Create through file/stdin transport:
+
+```bash
+yy ledger workflow create --title "Focused validation" --file workflow.yaml
+```
+
+Ledger rejects unsafe or non-portable YAML, including duplicate keys, aliases,
+anchors, explicit tags, recursive structures, non-string mapping keys, implicit
+date/time values, non-finite numbers, CRLF input, and unsupported values. Never
+weaken validation by storing executable shell as an unvalidated substitute.
+
+## Revise safely
+
+Read the current revision and history, then follow the installed
+`workflow update --help` compare-and-replace contract. Bind updates to the
+expected revision and preimage/digests, validate the result, and read it back.
+On drift, stop and reconcile instead of forcing. Archive is non-destructive.
+
+Before execution, freeze the exact workflow Record ID, revision, payload digest,
+runner identity, inputs, and granted authorities. After execution, store bounded
+outputs under `artifact-yylo` with workflow/run provenance. An execution request
+never implies merge, release, publication, deployment, or production authority.
+
+## Complete request
+
+$ARGUMENTS
+
+## When to Use
+
+- You need to find, create, or revision-safe update validated YYLO Ledger workflow Records.
+- You must keep storage, execution, and run-evidence boundaries explicit.
+
+## Limitations
+
+- Ledger stores and validates workflow data; it never executes workflows and grants no execution, network, mutation, release, or deployment authority.
+- Run evidence belongs in `artifact-yylo` records with workflow/run provenance - never overwrite the workflow definition with outputs.
+- An execution request never implies merge, release, publication, deployment, or production authority. On revision drift, stop and reconcile instead of forcing.
+
+### Example
+
+```bash
+yy ledger workflow search --text "release verification" --projection summary --limit 20 -f json
+yy ledger workflow get RECORD_ID --validated
+```
+
+> Adapted from [yylo-dev/yylo-skills](https://github.com/yylo-dev/yylo-skills) (MIT) - v2.0.1; frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance.