opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/remotion-render/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: remotion-render
+description: Export a Remotion video
+version: 4.0.526
+source_repo: remotion-dev/skills
+source_type: official
+source: remotion-dev
+date_added: '2026-09-21'
+risk: unknown
+---
+## When to Use
+- Use when this upstream workflow matches the user's stated goal.
+- Use when the task requires the procedures documented in this skill.
+
+## General rendering strategy
+
+Render a video using:
+
+```
+npx remotion render
+```
+
+Full list of options: https://www.remotion.dev/docs/cli/render.md
+
+Render a still using:
+
+```
+npx remotion still
+```
+
+Full list of options: https://www.remotion.dev/docs/cli/still.md
+
+## Transparent videos
+
+See [Transparent videos for rendering out a video with transparency.
+
+
+## Examples
+
+```text
+User: Apply this skill to my current task.
+Assistant: Follow the workflow in this skill, cite limitations, and ask before risky steps.
+```
+
+## Limitations
+
+- Imported upstream skill; verify credentials, permissions, and safety boundaries before execution.
+- Does not replace environment-specific validation, testing, or maintainer review.

package/bundled-skills/remotion-render/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: '/remotion-render'
+  short_description: 'Export Remotion videos and stills'
+  icon_small: './assets/remotion-icon.svg'
+  icon_large: './assets/remotion-icon.svg'
+  brand_color: '#0B84F3'
+  default_prompt: '$remotion-render: Render this as transparent ProRes'

package/bundled-skills/remotion-render/assets/remotion-icon.svg

@@ -0,0 +1,4 @@
+<svg width="100" height="100" viewBox="20 30 363 363" xmlns="http://www.w3.org/2000/svg">
+<title>Remotion</title>
+<path d="M148.332 92.9015C143.307 93.1742 139.259 93.9713 135.179 95.5236C133.144 96.2893 129.809 97.957 127.973 99.1108C120.295 103.925 114.443 111.162 111.391 119.584C110.782 121.252 109.136 126.57 108.076 130.23C101.018 154.7 97.0112 181.456 96.1511 209.776C96.0148 214.286 96.0148 225.026 96.1511 229.463C96.728 248.237 98.5216 265.187 101.773 282.472C103.095 289.468 105.213 298.866 106.44 303.135C108.947 311.809 114.065 319.193 121.344 324.605C126.221 328.234 131.759 330.668 137.895 331.863C140.853 332.44 144.755 332.702 147.629 332.514C151.604 332.251 159.491 331.192 165.9 330.049C194.786 324.899 221.469 315.679 245.666 302.485C260.99 294.125 274.09 285.074 286.729 274.092C299.326 263.163 310.066 251.405 319.516 238.21C321.708 235.158 322.81 233.375 323.911 231.131C326.743 225.341 328.075 219.583 328.064 213.143C328.064 207.143 326.932 201.815 324.488 196.361C323.313 193.728 322.191 191.84 319.674 188.253C310.402 175.048 300.112 163.542 287.568 152.361C268.122 135.034 245.026 120.822 219.235 110.302C213.644 108.026 208.138 106.022 201.509 103.851C187.475 99.2681 170.106 95.2929 155.411 93.3105C153.104 92.9959 149.968 92.8176 148.332 92.9015Z" fill="#0B84F3"/>
+</svg>

package/bundled-skills/remotion-render/transparent-videos.md

@@ -0,0 +1,106 @@
+---
+name: transparent-videos
+description: Rendering transparent videos in Remotion
+metadata:
+  tags: transparent, alpha, codec, vp9, prores, webm
+---
+
+# Rendering Transparent Videos
+
+Remotion can render transparent videos in two ways: as a ProRes video or as a WebM video.
+
+## Transparent ProRes
+
+Ideal for when importing into video editing software.
+
+**CLI:**
+
+```bash
+npx remotion render --image-format=png --pixel-format=yuva444p10le --codec=prores --prores-profile=4444 MyComp out.mov
+```
+
+**Default in Studio** (restart Studio after changing):
+
+```ts
+// remotion.config.ts
+import { Config } from "@remotion/cli/config";
+
+Config.setVideoImageFormat("png");
+Config.setPixelFormat("yuva444p10le");
+Config.setCodec("prores");
+Config.setProResProfile("4444");
+```
+
+**Setting it as the default export settings for a composition** (using `calculateMetadata`):
+
+```tsx
+import { CalculateMetadataFunction } from "remotion";
+
+const calculateMetadata: CalculateMetadataFunction<Props> = async ({
+  props,
+}) => {
+  return {
+    defaultCodec: "prores",
+    defaultVideoImageFormat: "png",
+    defaultPixelFormat: "yuva444p10le",
+    defaultProResProfile: "4444",
+  };
+};
+
+<Composition
+  id="my-video"
+  component={MyVideo}
+  durationInFrames={150}
+  fps={30}
+  width={1920}
+  height={1080}
+  calculateMetadata={calculateMetadata}
+/>;
+```
+
+## Transparent WebM (VP9)
+
+Ideal for when playing in a browser.
+
+**CLI:**
+
+```bash
+npx remotion render --image-format=png --pixel-format=yuva420p --codec=vp9 MyComp out.webm
+```
+
+**Default in Studio** (restart Studio after changing):
+
+```ts
+// remotion.config.ts
+import { Config } from "@remotion/cli/config";
+
+Config.setVideoImageFormat("png");
+Config.setPixelFormat("yuva420p");
+Config.setCodec("vp9");
+```
+
+**Setting it as the default export settings for a composition** (using `calculateMetadata`):
+
+```tsx
+import { CalculateMetadataFunction } from "remotion";
+
+const calculateMetadata: CalculateMetadataFunction<Props> = async ({
+  props,
+}) => {
+  return {
+    defaultCodec: "vp8",
+    defaultVideoImageFormat: "png",
+    defaultPixelFormat: "yuva420p",
+  };
+};
+
+<Composition
+  id="my-video"
+  component={MyVideo}
+  durationInFrames={150}
+  fps={30}
+  width={1920}
+  height={1080}
+  calculateMetadata={calculateMetadata}
+/>;
+```

package/bundled-skills/report-writing/SKILL.md

@@ -0,0 +1,426 @@
+---
+name: report-writing
+description: Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi
+category: security
+risk: safe
+source: https://github.com/elementalsouls/Claude-BugHunter
+source_repo: elementalsouls/Claude-BugHunter
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/elementalsouls/Claude-BugHunter/blob/main/LICENSE
+compatibility: Process guidance; no tooling required. Docs-only; upstream templates
+  not bundled.
+sources: community, operator_experience
+---
+
+# REPORT WRITING
+
+Impact-first. Human tone. No theoretical language. Triagers are people.
+
+---
+
+## THE MOST IMPORTANT RULE
+
+> **Never use "could potentially" or "could be used to" or "may allow".**
+> Either it does the thing or it doesn't. If you haven't proved it, don't claim it.
+
+```
+BAD:  "This vulnerability could potentially allow an attacker to access user data."
+GOOD: "An attacker can access any user's order history by changing the user_id
+       parameter to the target user's ID. I confirmed this using two test accounts:
+       attacker@test.com (ID 123) successfully retrieved victim@test.com (ID 456)
+       orders, including their shipping address and payment method last 4 digits."
+```
+
+---
+
+## TITLE FORMULA
+
+```
+[Bug Class] in [Exact Endpoint/Feature] allows [attacker role] to [impact] [victim scope]
+```
+
+**Good titles (specific, impact-first):**
+```
+IDOR in /api/v2/invoices/{id} allows authenticated user to read any customer's invoice data
+Missing auth on POST /api/admin/users allows unauthenticated attacker to create admin accounts
+Stored XSS in profile bio field executes in admin panel — allows privilege escalation
+SSRF via image import URL parameter reaches AWS EC2 metadata service
+Race condition in coupon redemption allows same code to be used unlimited times
+```
+
+**Bad titles (vague, useless to triager):**
+```
+IDOR vulnerability found
+Broken access control
+XSS in user input
+Security issue in API
+Unauthorized access to user data
+```
+
+---
+
+## HACKERONE REPORT TEMPLATE
+
+```markdown
+## Summary
+
+[One paragraph: what the bug is, where it is, what an attacker can do. Be specific.
+Include: endpoint, method, parameter, data exposed, required access level.]
+
+Example: "The `/api/users/{user_id}/orders` endpoint does not verify that the
+authenticated user owns the requested user_id. An attacker can enumerate any
+user's order history, including PII (email, address, phone) and purchase history,
+by incrementing the user_id parameter. No privileges beyond a standard free
+account are required."
+
+## Vulnerability Details
+
+**Vulnerability Type:** IDOR / Broken Object Level Authorization
+**CVSS 3.1 Score:** 6.5 (Medium) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
+**Affected Endpoint:** GET /api/users/{user_id}/orders
+
+## Steps to Reproduce
+
+**Environment:**
+- Attacker account: attacker@test.com, user_id = 123
+- Victim account: victim@test.com, user_id = 456
+- Target: https://target.com
+
+**Steps:**
+
+1. Log in as attacker@test.com, obtain Bearer token
+
+2. Send the following request:
+
+```
+GET /api/users/456/orders HTTP/1.1
+Host: target.com
+Authorization: Bearer ATTACKER_TOKEN_HERE
+```
+
+3. Observe response:
+
+```json
+{
+  "orders": [
+    {"id": 789, "items": [...], "email": "victim@test.com", "address": "123 Main St..."}
+  ]
+}
+```
+
+The response contains victim's full order history and PII despite being requested
+by a different user.
+
+## Impact
+
+An authenticated attacker can enumerate all user orders by iterating user_id values.
+This exposes: full name, email, shipping address, purchase history, and payment
+method (last 4). With ~100K users, this represents a mass PII breach affecting
+all registered users. Exploitation requires only a free account and takes minutes
+with a simple loop.
+
+## Recommended Fix
+
+Add server-side ownership verification:
+```python
+if order.user_id != current_user.id:
+    raise Forbidden()
+```
+
+## Supporting Materials
+
+[Screenshot showing attacker's session returning victim's order data]
+[Video walkthrough if available]
+```
+
+---
+
+## BUGCROWD REPORT TEMPLATE
+
+```markdown
+# [IDOR] User order history accessible without authorization via /api/users/{id}/orders
+
+**VRT Category:** Broken Access Control > IDOR > P2
+
+## Description
+
+[Same impact-first paragraph as HackerOne summary]
+
+## Steps to Reproduce
+
+[Same structured steps — exact HTTP requests, exact responses]
+
+## Proof of Concept
+
+[Screenshot/video showing the actual impact]
+
+## Expected vs Actual Behavior
+
+**Expected:** 403 Forbidden when user_id does not match authenticated user
+**Actual:** 200 OK with victim's full order data
+
+## Severity Justification
+
+P2 (High) — Direct read access to other users' PII. Affects all user accounts.
+No user interaction required. Exploitable by any authenticated user.
+Automated enumeration could exfil all [N] user records in minutes.
+
+## Remediation
+
+Add ownership verification: `if order.user_id != current_user.id: raise 403`
+```
+
+---
+
+## INTIGRITI REPORT TEMPLATE
+
+```markdown
+# [Bug Class]: [Exact Impact] in [Endpoint/Feature]
+
+## Description
+
+[Impact-first paragraph. Start with what an attacker can do, not with how you found it.
+Include: endpoint, method, parameter, data exposed, required privileges.]
+
+## Steps to Reproduce
+
+**Environment:**
+- Attacker: email=attacker@test.com (standard account, no special role)
+- Victim: email=victim@test.com
+- Tested: [date]
+
+**Reproduction steps:**
+
+1. [Login as attacker / visit URL / send request]
+
+2. Send the following HTTP request:
+
+\```http
+METHOD /endpoint HTTP/1.1
+Host: target.com
+Authorization: Bearer ATTACKER_TOKEN
+Content-Type: application/json
+
+{"param": "victim_id_here"}
+\```
+
+3. Observe response contains victim's private data:
+
+\```json
+{"email": "victim@test.com", "address": "123 Main St", ...}
+\```
+
+## Impact
+
+[Specific, quantified impact. What data, how many users, what can attacker do.]
+
+CVSS 3.1 Score: X.X ([Severity]) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
+
+## Remediation
+
+[1-3 sentence concrete fix. Include code if helpful.]
+
+## Attachments
+
+[Screenshot or Loom video showing the impact — Intigriti triagers prefer video for complex bugs]
+```
+
+**Intigriti-specific notes:**
+- Title format: `[Bug Class]: [One-line impact]` (no formula required, but keep it specific)
+- Severity is set by you: Critical/High/Medium/Low/Exceptional
+- CVSS 3.1 is standard (CVSS 4.0 also accepted on newer programs)
+- PoC video is valued much more than screenshot alone — record with Loom
+- Safe harbor: Intigriti enforces it, be comfortable going slightly aggressive with testing
+
+---
+
+## IMMUNEFI REPORT TEMPLATE
+
+```markdown
+# [Bug Class] — [Protocol Name] — [Severity]
+
+## Summary
+
+[One paragraph with: root cause, affected function, economic impact, attack cost.
+Include numbers where possible: "attacker can drain $X in Y transactions."]
+
+## Vulnerability Details
+
+**Contract:** `VulnerableContract.sol`
+**Function:** `claimRedemption()`
+**Bug Class:** Accounting State Desynchronization
+**Severity:** Critical
+
+### Root Cause
+
+[Exact code snippet showing the vulnerable code with comments]
+
+## Proof of Concept
+
+```solidity
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+// Foundry PoC — run: forge test --match-test test_exploit -vvvv
+
+contract ExploitTest is Test {
+    // ... full working exploit
+}
+```
+
+## Impact
+
+[Quantified: "Attacker can drain X% of TVL = $Y at current rates.
+Requires $Z gas. Attack is repeatable."]
+
+## Recommended Fix
+
+[Specific code change with before/after]
+```
+
+---
+
+## CVSS 3.1 QUICK SCORING
+
+### Formula
+```
+CVSS = f(AV, AC, PR, UI, S, C, I, A)
+```
+
+### Metric Quick Picks
+
+| Metric | Value | Weight | When |
+|---|---|---|---|
+| **Attack Vector (AV)** | Network | +0.85 | Via internet |
+| | Local | +0.55 | Local access needed |
+| **Attack Complexity (AC)** | Low | +0.77 | Repeatable |
+| | High | +0.44 | Race/timing needed |
+| **Privileges Required (PR)** | None | +0.85 | No login |
+| | Low | +0.62 | Regular user account |
+| | High | +0.27 | Admin account |
+| **User Interaction (UI)** | None | +0.85 | No victim action |
+| | Required | +0.62 | Victim must click |
+| **Scope (S)** | Changed | higher | Affects browser/OS/other |
+| | Unchanged | lower | Stays in app |
+| **Confidentiality (C)** | High | +0.56 | All data exposed |
+| | Low | +0.22 | Limited data |
+| **Integrity (I)** | High | +0.56 | Can modify any data |
+| **Availability (A)** | High | +0.56 | Crashes service |
+
+### Typical Scores by Bug Class
+
+| Bug | Typical CVSS | Severity |
+|---|---|---|
+| IDOR (read PII) | 6.5 | Medium |
+| IDOR (write/delete) | 7.5 | High |
+| Auth bypass → admin | 9.8 | Critical |
+| Stored XSS (any user) | 5.4–8.8 | Med–High |
+| SQLi (data exfil) | 8.6 | High |
+| SSRF (cloud metadata) | 9.1 | Critical |
+| Race condition (double spend) | 7.5 | High |
+| GraphQL auth bypass | 8.7 | High |
+| JWT none algorithm | 9.1 | Critical |
+
+---
+
+## SEVERITY DECISION GUIDE
+
+### Critical (P1)
+- Full account takeover of any user without interaction
+- Remote code execution
+- SQLi with ability to dump/modify entire DB
+- Auth bypass to admin panel
+- SSRF to cloud metadata → IAM credentials exfil
+
+### High (P2)
+- Mass PII exposure (email, phone, SSN, payment data)
+- Privilege escalation from user to admin
+- SSRF reaching internal services (data returned)
+- Stored XSS executing for all users of sensitive feature
+- Payment bypass / financial loss without limit
+
+### Medium (P3)
+- IDOR on specific user's non-critical data
+- XSS on low-sensitivity page requiring victim interaction
+- CSRF on important but non-critical action
+- Rate limit bypass on OTP (with effort demonstrated)
+
+### Low (P4)
+- Information disclosure (non-sensitive, no PII)
+- Clickjacking on sensitive action WITH working PoC
+- CORS on limited data
+
+---
+
+## SEVERITY SELF-ASSESSMENT
+
+Each YES raises severity:
+```
+1. Exposes PII / health / financial data of other users?        → +1 severity
+2. Allows account takeover or privilege escalation?             → +2 severity
+3. Requires ZERO user interaction from victim?                  → +1 severity
+4. Affects ALL users (not specific condition)?                  → +1 severity
+5. Remotely exploitable with no internal network access?        → baseline for High+
+```
+
+---
+
+## DOWNGRADE COUNTERS
+
+| Program Says | Counter With |
+|---|---|
+| "Requires authentication" | "Attacker needs only a free account — no special role or permission" |
+| "Limited impact" | "Affects [N] users / exposes [PII type] / $[amount] at risk" |
+| "Already known" | "Show me the report number — I searched hacktivity and found none" |
+| "By design" | "Show me the documentation stating this is intended behavior" |
+| "Low CVSS" | "CVSS doesn't capture business impact — attacker can extract [X] in [Y] minutes" |
+| "Not exploitable" | "Here is the exact response showing victim's data returned to attacker session" |
+
+---
+
+## THE 60-SECOND PRE-SUBMIT CHECKLIST
+
+```
+[ ] Title follows formula: [Class] in [endpoint] allows [actor] to [impact]
+[ ] First sentence states exact impact in plain English
+[ ] Steps to Reproduce has exact HTTP request (copy-paste ready)
+[ ] Response showing the bug is included (screenshot or JSON body)
+[ ] Two test accounts used — not just one account testing itself
+[ ] CVSS score calculated and included
+[ ] Recommended fix is 1-2 sentences (not a lecture)
+[ ] No typos in endpoint paths or parameter names
+[ ] Report is < 600 words — triagers skim long reports
+[ ] Severity claimed matches impact described — don't overclaim
+[ ] Never used "could potentially" or "may allow"
+[ ] PoC is reproducible by triager from a fresh state
+```
+
+---
+
+
+## Contents
+
+- [CVSS 4.0 QUICK REFERENCE (newer programs)](references/details.md)
+- [HUMAN TONE GUIDELINES](references/details.md)
+- [STEPS TO REPRODUCE FORMAT (triager-optimized)](references/details.md)
+- [Related Skills & Chains](references/details.md)
+- [Operator Notes (Claude-BugHunter)](references/details.md)
+
+## When to Use
+
+- You need this skill's process guidance (reporting format, evidence handling, detection notes, or scope triage) during an authorized engagement.
+- No active probing is involved in this step.
+
+## Limitations
+
+- Process guidance only; it does not authorize probing or exploitation — those steps need their own authorized skill and confirmation gate.
+- Docs-only import: upstream templates, commands, and research assets are not bundled.
+
+### Example
+
+```markdown
+Apply this skill's checklist to the current engagement notes and report gaps.
+```
+
+> Adapted from [elementalsouls/Claude-BugHunter](https://github.com/elementalsouls/Claude-BugHunter) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.