opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/rag-observability-evals/references/details.md

@@ -0,0 +1,92 @@
+# Details (moved from SKILL.md)
+
+> Extended reference content for `rag-observability-evals`, kept under `references/` so the entrypoint stays within the audit budget.
+
+## Alerting Strategy
+
+```yaml
+# rag-alerts.yaml
+groups:
+  - name: rag-quality-alerts
+    rules:
+      - alert: GroundednessDropped
+        expr: rag_groundedness_score < 0.75
+        for: 10m
+        labels:
+          severity: sev2
+        annotations:
+          summary: "Groundedness score dropped below 0.75 for {{ $labels.route }}"
+
+      - alert: HallucinationSpike
+        expr: |
+          rate(rag_hallucination_detected_total[15m])
+          / rate(rag_requests_total[15m]) > 0.10
+        for: 5m
+        labels:
+          severity: sev1
+
+      - alert: IndexStale
+        expr: rag_index_staleness_seconds > 86400
+        for: 5m
+        labels:
+          severity: sev3
+        annotations:
+          summary: "Index {{ $labels.index_name }} not updated in 24h"
+
+      - alert: HighFallbackRate
+        expr: |
+          rate(rag_fallback_triggered_total[10m])
+          / rate(rag_requests_total[10m]) > 0.20
+        for: 10m
+        labels:
+          severity: sev2
+
+      - alert: RetrievalLatencyHigh
+        expr: |
+          histogram_quantile(0.95,
+            rate(rag_retrieval_duration_seconds_bucket[5m])
+          ) > 2.0
+        for: 5m
+        labels:
+          severity: sev2
+```
+
+
+## Practical Guardrails
+
+- Force citations for high-risk domains.
+- Return abstain/fallback when confidence is below threshold.
+- Re-rank retrieved chunks before final generation.
+- Use query rewriting only with strict regression tests.
+
+
+## Incident Triage Checklist
+
+| Symptom | Check First | Check Second |
+|---------|-------------|--------------|
+| Groundedness dropped | Embedding model change? | Chunking/indexing logic change? |
+| Retrieval returning irrelevant docs | Index freshness and document count | Embedding model version mismatch |
+| Latency spike in retrieval | Vector DB connection pool and load | Index size growth beyond threshold |
+| Cost per answer increasing | Token usage per stage breakdown | Cache hit rate decline |
+| Hallucination spike | Model version or temperature change | Context window overflow (truncated docs) |
+
+
+## Troubleshooting
+
+| Issue | Diagnosis | Resolution |
+|-------|-----------|------------|
+| RAGAS eval returns 0 for all metrics | Check dataset format matches expected schema | Ensure contexts are lists, not strings |
+| Groundedness score unreliable | LLM judge inconsistency | Increase judge sample size, set temperature=0 |
+| Index staleness alert firing | Ingestion pipeline failure | Check data source connectivity and ingestion logs |
+| Retrieval recall dropping | Embedding drift after model update | Re-index corpus with current embedding model |
+| High latency in generation | Context too large for model | Reduce top-k or add summarization step |
+
+
+## Related Skills
+
+- rag-infrastructure (`rag-infrastructure`) - Deploy robust RAG backends
+- agent-observability (`agent-observability`) - Instrument requests, traces, and costs
+- agent-evals (`agent-evals`) - Build repeatable eval suites
+- ai-sre-incident-response (`ai-sre-incident-response`) - Incident response for quality regressions
+- opentelemetry (`opentelemetry`) - Distributed tracing for RAG pipelines
+

package/bundled-skills/recon-scope-triage/SKILL.md

@@ -0,0 +1,128 @@
+---
+name: recon-scope-triage
+description: Triage ASM/recon output for ownership before testing
+category: security
+risk: offensive
+source: https://github.com/elementalsouls/Claude-BugHunter
+source_repo: elementalsouls/Claude-BugHunter
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/elementalsouls/Claude-BugHunter/blob/main/LICENSE
+compatibility: Requires explicit written authorization for a target scope plus the
+  relevant testing tools for this technique. Docs-only; helper scripts and commands
+  not bundled.
+sources: authorized-engagement
+report_count: 1
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+## When to use this skill
+
+Trigger when:
+- The target brand is a common/dictionary word or shared term (e.g. `apex`, `summit`, `vertex`, `nova`, `core`, `orbit`, `pulse`, `unity`…)
+- You receive an ASM report, recon export, breach combo, repo list, bucket list, or mobile-app list to act on
+- A "Critical" count looks implausibly high (hundreds) for the org's size
+- Any asset's ownership is asserted by the tool but not *proven*
+
+The two failure modes this skill prevents:
+1. **Wasting the engagement** testing/triaging assets that aren't the target's.
+2. **Attacking an innocent third party** that merely shares the name — out of scope, and real harm.
+
+**Rule: ownership is guilty-until-proven. An asset is the target's only when a concrete ownership signal ties it to the target — never because a scanner's keyword matched.**
+
+---
+
+## The collision sources (where keyword-matching lies)
+
+| Recon source | How it collides | Verify ownership by |
+|---|---|---|
+| **GitHub repos** | Search matched the brand word in repo name / topic / a string | Repo owner is the org's GH org; commits from org emails; code references the org's real domains/infra. A repo named `<word>-backend` by a random user = noise. |
+| **Cloud buckets** (S3/GCS) | Bucket names are a **global namespace**; `<word>-static`, `<word>-data`, `<word>-public` exist for *someone* | Bucket content references the target; bucket name correlates with a *confirmed* target subdomain (`x.target.com` ↔ `x-public`) AND content matches; ACL/owner metadata. Generic content (other-language, other-industry) = not theirs. |
+| **Mobile apps** | Store search matched the brand word in app name / package | Publisher account = the org; package reverse-DNS = an owned domain (`com.<owneddomain>.app`); dev cert; app calls owned API hosts. Mature ASM tools emit an "apps_accepted=0" / ownership-confidence field — read it. |
+| **Breach corpora / combos** | Email local-or-domain contains the brand word | **Exact** owned-domain match only (`@target.com`), not `@<word>group.com` / `@something<word>.com`. A different domain that contains the word is a different org. |
+| **Typosquats** | Generated permutations of the name | These are *defensive*/brand-protection findings, not offensive scope — note and move on. |
+| **Stack/forum/paste hits** | Brand word in body | Body references the target's real domain/subdomain/employee/secret. Ownership-confidence < threshold = drop. |
+
+---
+
+## Web "Critical" triage — the soft-404 control
+
+Automated `.env` / `.git` / `actuator` / admin-panel "Criticals" are overwhelmingly **soft-404s**: SPA/framework catch-alls returning HTTP 200 (or 403) for *every* path. Verify EACH before believing it:
+```bash
+# the "finding"
+curl -s -o /tmp/a -w "%{http_code} %{size_download}\n" https://host.target.com/.env
+# a junk control on the same host
+curl -s -o /tmp/b -w "%{http_code} %{size_download}\n" https://host.target.com/zzz-nonsense-$RANDOM
+# identical byte length / body  →  FALSE POSITIVE (catch-all), discard
+cmp -s /tmp/a /tmp/b && echo "SOFT-404 false positive" || echo "differs — investigate"
+```
+Real exposures have a content-type + signature that differs from the catch-all (`.git/config` starts `[core]`; `.env` has `KEY=value`; phpinfo has the XHTML-transitional doctype + `PHP Version`). A physical `.php`/`phpinfo.php` that returns a *bigger/different* body than the junk control is the real-vs-soft-404 tell.
+
+---
+
+## The triage workflow
+
+1. **Confirm the canonical owned-domain set first** (the SOW/program domain + its verified subdomains + the verified Entra/Okta/Google tenant brand name). This is your ownership anchor.
+2. **For each asset class, apply the verify-by column above.** No signal → quarantine, don't test.
+3. **Re-baseline the severity counts** against only-owned assets. Report the *delta* — "N Criticals → M after ownership + soft-404 triage" is itself a finding about the ASM program.
+4. **Quarantine collisions explicitly** (a `loot/quarantined_<source>.txt`) so it's auditable that you saw them and chose not to target them.
+5. **Surface the meta-finding:** if the supplied ASM/recon feed is mostly false-positive, that misallocates the owner's remediation budget and buries real risk — write it up (Medium/Strategic).
+
+---
+
+## Anti-patterns
+
+- **Trusting the tool's "owned" label.** Tools keyword-match; they don't prove ownership. Verify.
+- **Targeting a same-named third party** because it was "in the report." Out of scope + real harm. A combo line `user@<word>company.com` is a different company's employee.
+- **Reporting soft-404s as exposures.** Always run the junk-path control.
+- **Counting typosquats / missing-headers / brand-collision repos as offensive findings.** They're defensive/hygiene/noise — they pad the report and erode credibility.
+- **Skipping triage "to save time."** Untriaged, you spend the whole engagement on other people's assets and find nothing real.
+
+---
+
+## Why this matters (calibration)
+
+For a target whose brand is a common word, expect the bulk of automated "owned" assets to be collisions:
+- **Repos** that are unrelated open-source projects (ad-block lists, scrapers, student projects, a different company's SDK) merely containing the word.
+- **Mobile apps** published by entirely different companies that share the name — banks, credit unions, dating apps, dispensaries, home-care services are all real-world collision categories. (Good ASM tooling will tell you it accepted *zero* as owned.)
+- **Cloud buckets** in the global namespace holding some unrelated org's content (other-language documents, demo/sample data, another industry's files).
+- **Breach combos** full of emails from sibling-named-but-different companies (`<word>group.com`, `<region><word>.com`).
+
+On a real engagement against a dictionary-word brand, after clearing this noise the only genuinely-owned high-severity finding was discoverable solely by manual tradecraft (a JS-bundle → API discovery, see `hunt-spa-api`) — it was nowhere in the hundreds of scanner "Criticals." Triage-first is what made the engagement productive instead of a goose chase.
+
+---
+
+## Related Skills & Chains
+
+- **`triage-validation`** — asset-ownership triage (this skill) precedes finding-validity triage (the 7-Question Gate). Ownership first, then validity.
+- **`redteam-mindset`** — "aggressive default" means probe every *owned* live surface; this skill defines which surfaces are owned so persistence isn't wasted on collisions.
+- **`hunt-spa-api`** — once an API host passes ownership triage, this is how you test it.
+- **`offensive-osint` / `osint-methodology`** — feed ownership anchors (verified domains, tenant brand, dev accounts) from OSINT into this triage.
+
+## Limitations
+
+- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
+- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
+- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.
+
+### Example
+
+```bash
+# Read-only first step; confirm scope before anything active.
+cat scope.txt  # target list from the authorized engagement brief
+```
+
+> Adapted from [elementalsouls/Claude-BugHunter](https://github.com/elementalsouls/Claude-BugHunter) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.

package/bundled-skills/redis/SKILL.md

@@ -0,0 +1,421 @@
+---
+name: redis
+description: Configure Redis for caching and data storage. Set up clustering, persistence,
+  and Sentinel. Use when implementing Redis caching or queues.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Redis
+
+Configure, operate, and optimize Redis for caching, queues, rate limiting, and real-time data storage.
+
+## When to Use
+
+- You need a low-latency in-memory cache to reduce database load.
+- Your application requires rate limiting, session storage, or leaderboards.
+- You need pub/sub messaging between services.
+- You want a distributed lock or job queue backed by an in-memory store.
+
+## Prerequisites
+
+- Linux server or Docker.
+- Root or sudo access for package installation.
+- Redis 7.x recommended for production.
+
+## Installation and Setup
+
+```bash
+# Debian / Ubuntu
+sudo apt update
+sudo apt install -y redis-server
+
+# RHEL / Amazon Linux
+sudo dnf install -y redis
+
+# Start and enable
+sudo systemctl enable --now redis-server
+
+# Verify
+redis-cli ping
+# Expected output: PONG
+```
+
+## Core Configuration
+
+Edit `/etc/redis/redis.conf`:
+
+```ini
+# Network
+bind 0.0.0.0
+port 6379
+protected-mode yes
+requirepass strong_redis_password
+
+# Memory
+maxmemory 2gb
+maxmemory-policy allkeys-lru
+
+# Connections
+maxclients 10000
+timeout 300
+tcp-keepalive 60
+
+# Logging
+loglevel notice
+logfile /var/log/redis/redis-server.log
+
+# Security — disable dangerous commands in production
+rename-command FLUSHALL ""
+rename-command FLUSHDB ""
+rename-command CONFIG ""
+rename-command DEBUG ""
+```
+
+```bash
+sudo systemctl restart redis-server
+```
+
+## redis-cli Commands Reference
+
+```bash
+# Connect with authentication
+redis-cli -a strong_redis_password
+
+# Connect to a remote host
+redis-cli -h 10.0.0.5 -p 6379 -a strong_redis_password
+```
+
+### String Operations
+
+```
+SET user:1:name "Alice"
+GET user:1:name
+
+# Set with TTL (seconds)
+SETEX session:abc123 3600 '{"userId":1}'
+
+# Set only if key does not exist (distributed lock pattern)
+SET lock:order:42 "worker-1" NX EX 30
+
+# Increment counters
+INCR page:views:/home
+INCRBY api:quota:user:1 -1
+```
+
+### Hash Operations
+
+```
+HSET user:1 name "Alice" email "alice@example.com" plan "pro"
+HGET user:1 email
+HGETALL user:1
+HINCRBY user:1 login_count 1
+```
+
+### List Operations (Queues)
+
+```
+LPUSH queue:emails '{"to":"alice@example.com","subject":"Welcome"}'
+RPOP queue:emails
+LLEN queue:emails
+
+# Blocking pop (worker pattern)
+BRPOP queue:emails 30
+```
+
+### Set and Sorted Set Operations
+
+```
+# Sets — unique tags
+SADD article:1:tags "redis" "database" "caching"
+SMEMBERS article:1:tags
+SISMEMBER article:1:tags "redis"
+
+# Sorted sets — leaderboards
+ZADD leaderboard 1500 "player:1" 2300 "player:2" 1800 "player:3"
+ZREVRANGE leaderboard 0 9 WITHSCORES
+ZINCRBY leaderboard 100 "player:1"
+ZRANK leaderboard "player:2"
+```
+
+### Key Management
+
+```
+KEYS user:*             # avoid in production — use SCAN instead
+SCAN 0 MATCH user:* COUNT 100
+TTL session:abc123
+PERSIST session:abc123
+DEL user:old
+EXPIRE user:1 86400
+TYPE user:1
+```
+
+## Persistence
+
+### RDB Snapshots
+
+```ini
+# redis.conf — save snapshots at intervals
+save 900 1       # snapshot if >= 1 key changed in 900 seconds
+save 300 10      # snapshot if >= 10 keys changed in 300 seconds
+save 60 10000    # snapshot if >= 10000 keys changed in 60 seconds
+
+dbfilename dump.rdb
+dir /var/lib/redis
+rdbcompression yes
+```
+
+### AOF (Append-Only File)
+
+```ini
+appendonly yes
+appendfilename "appendonly.aof"
+appendfsync everysec    # good balance of safety and performance
+# Options: always (safest, slowest), everysec (recommended), no (OS decides)
+
+# AOF rewrite thresholds
+auto-aof-rewrite-percentage 100
+auto-aof-rewrite-min-size 64mb
+```
+
+### Recommended Production Strategy
+
+Use both RDB and AOF together. RDB provides fast restarts and compact backups. AOF provides durability down to 1-second granularity.
+
+```ini
+save 900 1
+save 300 10
+appendonly yes
+appendfsync everysec
+```
+
+## Redis Sentinel (High Availability)
+
+Sentinel monitors Redis instances and performs automatic failover.
+
+### Sentinel Configuration
+
+```ini
+# /etc/redis/sentinel.conf
+port 26379
+sentinel monitor mymaster 10.0.0.1 6379 2
+sentinel auth-pass mymaster strong_redis_password
+sentinel down-after-milliseconds mymaster 5000
+sentinel failover-timeout mymaster 60000
+sentinel parallel-syncs mymaster 1
+```
+
+Run at least three Sentinel instances for quorum.
+
+```bash
+# Start Sentinel
+redis-sentinel /etc/redis/sentinel.conf
+
+# Query Sentinel
+redis-cli -p 26379 SENTINEL masters
+redis-cli -p 26379 SENTINEL get-master-addr-by-name mymaster
+redis-cli -p 26379 SENTINEL replicas mymaster
+```
+
+## Redis Cluster Mode
+
+Cluster mode distributes data across multiple shards automatically.
+
+```bash
+# Create a 6-node cluster (3 masters + 3 replicas)
+redis-cli --cluster create \
+  10.0.0.1:6379 10.0.0.2:6379 10.0.0.3:6379 \
+  10.0.0.4:6379 10.0.0.5:6379 10.0.0.6:6379 \
+  --cluster-replicas 1 -a strong_redis_password
+
+# Check cluster status
+redis-cli -c -a strong_redis_password CLUSTER INFO
+redis-cli -c -a strong_redis_password CLUSTER NODES
+
+# Add a new node
+redis-cli --cluster add-node 10.0.0.7:6379 10.0.0.1:6379
+
+# Rebalance slots
+redis-cli --cluster rebalance 10.0.0.1:6379
+```
+
+```ini
+# redis.conf for cluster nodes
+cluster-enabled yes
+cluster-config-file nodes.conf
+cluster-node-timeout 5000
+```
+
+## Common Patterns
+
+### Caching with TTL
+
+```bash
+# Cache a database query result for 5 minutes
+SET cache:user:42:profile '{"name":"Alice","plan":"pro"}' EX 300
+
+# Cache-aside pattern (pseudocode):
+# 1. GET cache:key -> if hit, return
+# 2. Query database
+# 3. SET cache:key result EX 300
+# 4. Return result
+```
+
+### Rate Limiting (Sliding Window)
+
+```bash
+# Allow 100 requests per minute per user
+# Using a sorted set with timestamps as scores
+ZADD ratelimit:user:42 1700000000.123 "req-uuid-1"
+ZREMRANGEBYSCORE ratelimit:user:42 0 1699999940.000
+ZCARD ratelimit:user:42
+EXPIRE ratelimit:user:42 60
+# If ZCARD >= 100, reject the request
+```
+
+### Pub/Sub Messaging
+
+```bash
+# Terminal 1 — subscriber
+redis-cli -a strong_redis_password
+SUBSCRIBE notifications:order-updates
+
+# Terminal 2 — publisher
+redis-cli -a strong_redis_password
+PUBLISH notifications:order-updates '{"orderId":42,"status":"shipped"}'
+
+# Pattern subscription
+PSUBSCRIBE notifications:*
+```
+
+### Distributed Locking (Redlock Pattern)
+
+```bash
+# Acquire lock
+SET lock:resource:42 "worker-abc" NX EX 30
+# Returns OK if acquired, nil if already held
+
+# Release lock (use Lua script to ensure atomicity)
+redis-cli -a strong_redis_password EVAL "
+  if redis.call('get', KEYS[1]) == ARGV[1] then
+    return redis.call('del', KEYS[1])
+  else
+    return 0
+  end
+" 1 lock:resource:42 "worker-abc"
+```
+
+## Docker Compose Setup
+
+```yaml
+# docker-compose.yml
+version: "3.9"
+
+services:
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis_data:/data
+      - ./redis.conf:/usr/local/etc/redis/redis.conf:ro
+    command: redis-server /usr/local/etc/redis/redis.conf
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "strong_redis_password", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  redis-sentinel:
+    image: redis:7-alpine
+    restart: unless-stopped
+    ports:
+      - "26379:26379"
+    volumes:
+      - ./sentinel.conf:/usr/local/etc/redis/sentinel.conf
+    command: redis-sentinel /usr/local/etc/redis/sentinel.conf
+    depends_on:
+      redis:
+        condition: service_healthy
+
+  redis-commander:
+    image: rediscommander/redis-commander:latest
+    restart: unless-stopped
+    ports:
+      - "8081:8081"
+    environment:
+      REDIS_HOSTS: "local:redis:6379:0:strong_redis_password"
+    depends_on:
+      redis:
+        condition: service_healthy
+
+volumes:
+  redis_data:
+```
+
+```bash
+docker compose up -d
+redis-cli -h 127.0.0.1 -a strong_redis_password ping
+```
+
+## Monitoring
+
+```bash
+# Real-time stats
+redis-cli -a strong_redis_password INFO stats
+redis-cli -a strong_redis_password INFO memory
+redis-cli -a strong_redis_password INFO replication
+
+# Key metrics to watch
+redis-cli -a strong_redis_password INFO stats | grep -E "keyspace_hits|keyspace_misses"
+# Hit ratio = hits / (hits + misses) — aim for > 95%
+
+# Memory usage breakdown
+redis-cli -a strong_redis_password MEMORY STATS
+
+# Slow log (queries > 10ms by default)
+redis-cli -a strong_redis_password SLOWLOG GET 10
+redis-cli -a strong_redis_password SLOWLOG LEN
+
+# Monitor all commands in real time (debugging only — impacts performance)
+redis-cli -a strong_redis_password MONITOR
+
+# Connected clients
+redis-cli -a strong_redis_password CLIENT LIST
+```
+
+## Troubleshooting
+
+| Symptom | Likely Cause | Fix |
+|---|---|---|
+| `OOM command not allowed` | `maxmemory` limit reached | Increase `maxmemory` or set a stricter eviction policy |
+| High latency spikes | RDB save or AOF rewrite forking | Use `save ""` to disable RDB if AOF is enabled; tune `auto-aof-rewrite-min-size` |
+| `LOADING Redis is loading the dataset in memory` | Large dataset being restored on startup | Wait for load to complete; consider smaller dataset or faster disk |
+| Cache hit ratio < 90% | TTLs too short or working set exceeds memory | Increase `maxmemory`; review TTL strategy |
+| Sentinel not failing over | Fewer than quorum Sentinels reachable | Ensure >= 3 Sentinels are running and network-connected |
+| `CROSSSLOT` error in cluster | Multi-key command spans slots | Use hash tags `{user:42}:profile` to colocate related keys |
+
+## Related Skills
+
+- postgresql (`postgresql-devsec`) - Primary database that Redis caches
+- mysql (`mysql`) - Primary database that Redis caches
+- mongodb (`mongodb`) - Document database that Redis can front
+- database-backups (`database-backups`) - Include RDB files in backup strategy
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+