opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/mdm-device-management/references/details.md

@@ -0,0 +1,410 @@
+# Details (moved from SKILL.md)
+
+> Extended reference content for `mdm-device-management`, kept under `references/` so the entrypoint stays within the audit budget.
+
+## 6. Security Policies — Cross-Platform
+
+### 6.1 Password / passcode requirements
+
+```xml
+<!-- macOS configuration profile — password policy -->
+<dict>
+    <key>PayloadType</key>
+    <string>com.apple.mobiledevice.passwordpolicy</string>
+    <key>minLength</key>
+    <integer>12</integer>
+    <key>requireAlphanumeric</key>
+    <true/>
+    <key>maxInactivity</key>
+    <integer>5</integer>
+    <key>maxPINAgeInDays</key>
+    <integer>90</integer>
+</dict>
+```
+
+```json
+// Intune Windows password policy (JSON for Graph API)
+{
+  "@odata.type": "#microsoft.graph.windows10GeneralConfiguration",
+  "passwordRequired": true,
+  "passwordMinimumLength": 12,
+  "passwordRequiredType": "alphanumeric",
+  "passwordMinutesOfInactivityBeforeScreenTimeout": 5,
+  "passwordExpirationDays": 90,
+  "passwordBlockSimple": true
+}
+```
+
+### 6.2 Screen lock enforcement
+
+```bash
+# macOS — require password after sleep/screensaver (via script or profile)
+sudo defaults write /Library/Preferences/com.apple.screensaver askForPassword -int 1
+sudo defaults write /Library/Preferences/com.apple.screensaver askForPasswordDelay -int 0
+sudo defaults write /Library/Preferences/com.apple.screensaver idleTime -int 300
+```
+
+```powershell
+# Windows — lock screen after 5 minutes of inactivity
+powercfg /change monitor-timeout-ac 5
+# Registry-based enforcement
+Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" `
+  -Name "InactivityTimeoutSecs" -Value 300
+```
+
+### 6.3 Encryption enforcement summary
+
+| OS | Tool | Verify Command |
+|----|------|----------------|
+| macOS | FileVault | `fdesetup status` |
+| Windows | BitLocker | `manage-bde -status C:` |
+| Linux | LUKS | `lsblk -o NAME,FSTYPE,MOUNTPOINT \| grep crypt` |
+| iOS | Native (always-on with passcode) | Managed via MDM profile |
+| Android | Native | `adb shell getprop ro.crypto.state` |
+
+---
+
+
+## 7. Software Deployment
+
+### 7.1 macOS — Homebrew Bundle
+
+```ruby
+# Brewfile — deploy via MDM script or Git checkout
+tap "homebrew/bundle"
+
+# Core tools
+brew "git"
+brew "gh"
+brew "jq"
+brew "wget"
+brew "gnupg"
+
+# Security
+brew "1password-cli"
+cask "1password"
+cask "tailscale"
+cask "cloudflare-warp"
+
+# Development
+cask "visual-studio-code"
+cask "iterm2"
+cask "docker"
+brew "node"
+brew "python@3.12"
+
+# Communication
+cask "slack"
+cask "zoom"
+```
+
+```bash
+# Deploy Brewfile on a new Mac
+/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+brew bundle --file=/path/to/Brewfile --no-lock
+```
+
+### 7.2 Windows — winget / Chocolatey
+
+```powershell
+# winget import from a JSON manifest
+# packages.json
+@"
+{
+  "Sources": [{
+    "Packages": [
+      { "PackageIdentifier": "Git.Git" },
+      { "PackageIdentifier": "Microsoft.VisualStudioCode" },
+      { "PackageIdentifier": "Docker.DockerDesktop" },
+      { "PackageIdentifier": "SlackTechnologies.Slack" },
+      { "PackageIdentifier": "Zoom.Zoom" },
+      { "PackageIdentifier": "Tailscale.Tailscale" },
+      { "PackageIdentifier": "AgileBits.1Password" },
+      { "PackageIdentifier": "OpenJS.NodeJS.LTS" },
+      { "PackageIdentifier": "Python.Python.3.12" }
+    ],
+    "SourceDetails": {
+      "Name": "winget",
+      "Type": "Microsoft.Winget.Source.Type.Microsoft"
+    }
+  }]
+}
+"@ | Out-File -FilePath packages.json -Encoding utf8
+
+winget import -i packages.json --accept-package-agreements --accept-source-agreements
+```
+
+### 7.3 Automatic update enforcement
+
+```bash
+# macOS — enable automatic updates via MDM or command
+sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool true
+sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool true
+sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool true
+sudo softwareupdate --schedule on
+```
+
+```powershell
+# Windows — configure Windows Update via registry
+Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" `
+  -Name "NoAutoUpdate" -Value 0
+Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" `
+  -Name "AUOptions" -Value 4  # 4 = Auto download and schedule install
+```
+
+---
+
+
+## 8. Compliance Checks with osquery
+
+These queries work with Fleet, osquery standalone, or any osquery-compatible
+platform.
+
+```sql
+-- Check disk encryption on macOS
+SELECT de.encrypted, de.type, du.username
+FROM disk_encryption de
+JOIN disk_util du ON de.name = du.name
+WHERE du.mountpoint = '/' AND de.encrypted = 1;
+
+-- Check disk encryption on Windows
+SELECT drive_letter, protection_status, conversion_status
+FROM bitlocker_info
+WHERE drive_letter = 'C:' AND protection_status = 1;
+
+-- Verify firewall is enabled (macOS)
+SELECT global_state, stealth_enabled, logging_enabled
+FROM alf;
+
+-- Verify firewall is enabled (Windows)
+SELECT name, enabled FROM windows_firewall_profiles
+WHERE enabled = 1;
+
+-- Check OS version (macOS)
+SELECT name, version, major, minor, patch
+FROM os_version
+WHERE major >= 14;
+
+-- Check OS version (Windows)
+SELECT name, version, build
+FROM os_version
+WHERE build >= '22631';
+
+-- List users with admin privileges (macOS)
+SELECT u.username, u.uid
+FROM users u
+JOIN user_groups ug ON u.uid = ug.uid
+JOIN groups g ON ug.gid = g.gid
+WHERE g.groupname = 'admin';
+
+-- Detect unencrypted removable drives (Windows)
+SELECT device_id, drive_letter, protection_status
+FROM bitlocker_info
+WHERE protection_status = 0;
+
+-- Check screen lock timeout (macOS)
+SELECT domain, key, value FROM preferences
+WHERE domain = 'com.apple.screensaver'
+  AND key = 'idleTime';
+
+-- Verify automatic updates are enabled (macOS)
+SELECT domain, key, value FROM preferences
+WHERE domain = 'com.apple.SoftwareUpdate'
+  AND key = 'AutomaticCheckEnabled';
+```
+
+---
+
+
+## 9. Remote Wipe & Lock
+
+### 9.1 macOS remote wipe (Fleet)
+
+```bash
+# Lock a device immediately with a 6-digit PIN
+fleetctl mdm lock --host "serial=C02X12345678"
+
+# Wipe a device (factory reset) — DESTRUCTIVE
+fleetctl mdm erase --host "serial=C02X12345678"
+
+# Or via the Fleet API
+curl -X POST https://fleet.yourcompany.com/api/v1/fleet/hosts/42/wipe \
+  -H "Authorization: Bearer ${FLEET_API_TOKEN}"
+```
+
+### 9.2 Windows remote wipe (Intune)
+
+```powershell
+# Via Microsoft Graph API
+$body = @{
+    keepEnrollmentData = $false
+    keepUserData       = $false
+} | ConvertTo-Json
+
+Invoke-MgGraphRequest -Method POST `
+  -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{deviceId}/wipe" `
+  -Body $body -ContentType "application/json"
+```
+
+### 9.3 Lost device runbook
+
+```text
+1. Employee reports device lost/stolen via Slack #it-help or PagerDuty.
+2. IT admin verifies identity (video call or manager confirmation).
+3. Immediately issue remote lock command (wipe only if data-sensitive).
+4. Rotate any credentials cached on the device:
+   - Revoke SSO sessions (Okta/Google Workspace admin console)
+   - Rotate API keys stored on the device
+   - Revoke VPN certificates
+5. File a police report if theft is suspected.
+6. Remove device from MDM after 30 days or once replacement is shipped.
+7. Update asset inventory and notify finance for insurance claim.
+```
+
+---
+
+
+## 10. Onboarding Automation — Zero-Touch Enrollment
+
+### 10.1 macOS zero-touch flow
+
+```bash
+#!/usr/bin/env bash
+# onboard-mac.sh — runs as a post-enrollment script via MDM
+set -euo pipefail
+
+LOG="/var/log/onboarding.log"
+exec > >(tee -a "$LOG") 2>&1
+
+echo "=== Starting onboarding $(date) ==="
+
+# 1. Install Rosetta 2 on Apple Silicon
+if [[ "$(uname -m)" == "arm64" ]]; then
+    softwareupdate --install-rosetta --agree-to-license
+fi
+
+# 2. Install Homebrew
+if ! command -v brew &>/dev/null; then
+    NONINTERACTIVE=1 /bin/bash -c \
+      "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+fi
+
+# 3. Install standard tooling from Brewfile
+curl -fsSL https://internal.yourcompany.com/brewfile -o /tmp/Brewfile
+brew bundle --file=/tmp/Brewfile --no-lock
+
+# 4. Configure Git defaults
+git config --global init.defaultBranch main
+git config --global pull.rebase true
+
+# 5. Enable FileVault (will prompt at next login)
+sudo fdesetup enable -defer /var/db/FileVaultDeferred.plist \
+  -forceatlogin 0 -dontaskatlogout
+
+# 6. Enable firewall
+sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
+
+# 7. Set screen lock
+defaults write com.apple.screensaver askForPassword -int 1
+defaults write com.apple.screensaver askForPasswordDelay -int 0
+defaults write com.apple.screensaver idleTime -int 300
+
+# 8. Enroll in Tailscale VPN
+open -a "Tailscale"
+
+echo "=== Onboarding complete $(date) ==="
+```
+
+### 10.2 Windows zero-touch flow (Autopilot + Intune)
+
+```powershell
+# deploy.ps1 — assigned as an Intune PowerShell script
+$ErrorActionPreference = "Stop"
+$logFile = "C:\ProgramData\onboarding.log"
+Start-Transcript -Path $logFile -Append
+
+Write-Host "=== Starting onboarding $(Get-Date) ==="
+
+# 1. Install winget packages
+$packages = @(
+    "Git.Git",
+    "Microsoft.VisualStudioCode",
+    "Docker.DockerDesktop",
+    "SlackTechnologies.Slack",
+    "Tailscale.Tailscale",
+    "AgileBits.1Password"
+)
+
+foreach ($pkg in $packages) {
+    Write-Host "Installing $pkg..."
+    winget install --id $pkg --accept-package-agreements --accept-source-agreements --silent
+}
+
+# 2. Enable BitLocker
+Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -TpmProtector
+Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector
+
+# 3. Configure firewall
+Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
+Set-NetFirewallProfile -Profile Domain,Public,Private `
+  -DefaultInboundAction Block -DefaultOutboundAction Allow
+
+# 4. Set power and lock settings
+powercfg /change monitor-timeout-ac 5
+Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" `
+  -Name "InactivityTimeoutSecs" -Value 300
+
+# 5. Enable automatic updates
+Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" `
+  -Name "AUOptions" -Value 4
+
+Write-Host "=== Onboarding complete $(Get-Date) ==="
+Stop-Transcript
+```
+
+### 10.3 Onboarding checklist (for IT automation)
+
+```yaml
+# onboarding-checklist.yml — track in your ticketing system or Fleet
+new_hire_onboarding:
+  pre_day_one:
+    - Purchase and ship device via CDW/Apple Business Manager
+    - Assign device to MDM server in ABM/Autopilot
+    - Create accounts: Google Workspace / M365, Okta SSO, GitHub, Slack
+    - Generate VPN invite (Tailscale, WireGuard)
+    - Prepare welcome documentation link
+
+  day_one_automated:
+    - Device powers on and auto-enrolls in MDM (zero-touch)
+    - MDM pushes security profiles (encryption, firewall, password policy)
+    - Software bundle installs automatically
+    - User signs into SSO — all apps authenticate via SAML/OIDC
+    - Compliance policies begin evaluation
+
+  day_one_manual:
+    - IT schedules 15-min welcome call to verify setup
+    - Employee confirms disk encryption enabled (fdesetup status / manage-bde)
+    - Employee joins #it-help Slack channel
+    - Employee completes security awareness training link
+
+  week_one_verification:
+    - Fleet/MDM dashboard shows device as compliant
+    - All critical policies passing (encryption, firewall, OS version)
+    - VPN connectivity verified
+    - MFA enrolled on all critical services
+```
+
+---
+
+
+## Quick Reference
+
+| Task | macOS Command | Windows Command |
+|------|---------------|-----------------|
+| Check encryption | `fdesetup status` | `manage-bde -status C:` |
+| Enable firewall | `socketfilterfw --setglobalstate on` | `Set-NetFirewallProfile -Enabled True` |
+| Force OS update | `softwareupdate -ia` | `usoclient StartInstallD` |
+| Lock screen now | `pmset displaysleepnow` | `rundll32.exe user32.dll,LockWorkStation` |
+| List MDM profiles | `profiles show -type enrollment` | `dsregcmd /status` |
+| Check compliance | `fleetctl get hosts --query "..."` | `fleetctl get hosts --query "..."` |
+

package/bundled-skills/meeting-distiller-pro/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: meeting-distiller-pro
+version: 1.0.0
+description: Transform messy meeting notes and transcripts into structured action
+  items, decisions, and follow-ups. Never lose a meeting insight again.
+author: yundu-ai
+tags:
+- meeting
+- productivity
+- notes
+- action-items
+- summary
+- corporate
+model: claude
+source_repo: demo112/yunqu-ai-skills
+source_type: community
+source: community
+date_added: '2026-09-21'
+risk: unknown
+---
+## When to Use
+- Use when this upstream workflow matches the user's stated goal.
+- Use when the task requires the procedures documented in this skill.
+
+# Meeting Distiller Pro
+
+You are a Meeting Distiller — an expert at extracting signal from noise in meetings. You transform raw transcripts, notes, and recollections into crisp, actionable output that drives accountability.
+
+## Core Principles
+
+1. **Signal Over Noise**: 80% of meeting content is filler. Find the 20% that matters.
+2. **Accountability First**: Every action item must have ONE owner and ONE deadline.
+3. **Decision Clarity**: Document what was decided, what was deferred, and what was disagreed on.
+4. **Context Preservation**: Capture the WHY behind decisions, not just the WHAT.
+
+## Input Formats You Handle
+
+- Raw transcript (AI-generated or manual)
+- Bullet point notes
+- Voice memo transcriptions
+- Chat log dumps (Slack/Teams meetings)
+- Sparse recollections ("We talked about X, Y, and Z")
+
+## Output Structure
+
+For every meeting, produce:
+
+### 1. One-Line Summary
+[What was the meeting about in 15 words or less]
+
+### 2. Key Decisions
+| Decision | Context (Why) | Stakeholders Affected |
+|----------|---------------|----------------------|
+| ... | ... | ... |
+
+### 3. Action Items
+| Action | Owner | Deadline | Depends On | Priority |
+|--------|-------|----------|------------|----------|
+| ... | ... | ... | ... | P0/P1/P2 |
+
+### 4. Open Questions
+- [Question] — raised by [person], needs resolution by [date]
+
+### 5. Deferred Items
+- [Topic] — deferred because [reason], revisit on [date]
+
+### 6. Notable Quotes
+> "[Exact quote]" — [Person], if it captures intent that might be revisited
+
+## When Activated
+
+### Task: Distill a Meeting
+
+1. **Ask for the raw input** — transcript, notes, or recollection
+2. **Ask who was there** — helps assign ownership and context
+3. **Ask the meeting purpose** — was this a decision meeting, sync, brainstorm, or status update?
+4. **Process and output** — use the structure above
+5. **Validate action items** — ask: "Are there any action items I missed or owners I got wrong?"
+
+### Task: Distill a Recurring Meeting Series
+
+1. Track patterns: "This topic has been discussed 3 meetings in a row with no decision"
+2. Flag stale items: "This action item has appeared in 2 previous meetings without progress"
+3. Suggest: "Consider removing this from the recurring agenda"
+
+### Task: Create a Meeting Agenda (Pre-Meeting)
+
+1. **Ask**: What decisions need to be made?
+2. **Ask**: What updates are blocking others?
+3. **Ask**: Who must be present for each item?
+4. **Output**: Time-boxed agenda with clear decision points
+
+## Anti-Patterns to Flag
+
+- **Action item without owner**: "We should look into this" → Who? By when?
+- **Decision without documentation**: "We agreed..." → On what exactly? Who was in the room?
+- **Meeting that should have been an email**: No decisions, no blockers, just status updates → Flag it
+- **Circular discussion**: Same topic, different meeting → Surface the pattern
+
+## Quality Checklist
+
+Before delivering your output, verify:
+- [ ] Every action item has exactly one owner
+- [ ] Every decision has the reasoning captured
+- [ ] No action item is vague ("look into", "explore", "consider")
+- [ ] Open questions have a responsible party
+- [ ] The one-line summary is accurate and concise
+
+
+## Examples
+
+```text
+User: Apply this skill to my current task.
+Assistant: Follow the workflow in this skill, cite limitations, and ask before risky steps.
+```
+
+## Limitations
+
+- Imported upstream skill; verify credentials, permissions, and safety boundaries before execution.
+- Does not replace environment-specific validation, testing, or maintainer review.