opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/runbook-creation/SKILL.md

@@ -0,0 +1,438 @@
+---
+name: runbook-creation
+description: Create operational runbooks and standard operating procedures. Document
+  troubleshooting guides and recovery procedures. Use when documenting operational
+  knowledge.
+category: security
+risk: safe
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Checklist and framework guidance; no privileged tooling required. Apply
+  controls through your own change process.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Runbook Creation
+
+Create effective operational runbooks, standard operating procedures, and
+troubleshooting guides that any on-call engineer can follow under pressure.
+
+## Runbook Template — Full Structure
+
+````markdown
+# Runbook: [Service / Process Name]
+
+**Owner:** [Team or individual]
+**Last Reviewed:** YYYY-MM-DD
+**Version:** X.Y
+**Severity if unavailable:** SEV[1-4]
+
+---
+
+## Overview
+
+Brief description of the service, why this runbook exists, and when to
+use it.
+
+## Prerequisites
+
+- [ ] Required access / IAM role: [details]
+- [ ] Tools installed: [kubectl, aws-cli, psql, etc.]
+- [ ] VPN connected to [environment]
+- [ ] Communication channel open: [Slack #channel]
+
+## Procedure
+
+### Step 1 — [Action Name]
+
+[Explanation of what this step does and why.]
+
+```bash
+# command here
+```
+
+**Expected output:** [describe what success looks like]
+
+### Step 2 — [Action Name]
+
+```bash
+# command here
+```
+
+**Expected output:** [description]
+
+*(Continue with numbered steps...)*
+
+## Verification
+
+How to confirm the procedure succeeded:
+
+- [ ] [Check 1 — e.g., health endpoint returns 200]
+- [ ] [Check 2 — e.g., no errors in logs for 5 minutes]
+- [ ] [Check 3 — e.g., metrics return to baseline]
+
+## Rollback
+
+If the procedure fails or causes unexpected issues:
+
+### Rollback Step 1
+```bash
+# rollback command
+```
+
+### Rollback Step 2
+```bash
+# rollback command
+```
+
+## Troubleshooting
+
+| Symptom | Likely Cause | Resolution |
+|---------|-------------|------------|
+| [symptom 1] | [cause] | [fix] |
+| [symptom 2] | [cause] | [fix] |
+
+## Escalation
+
+If unresolved after [X] minutes:
+- **Primary:** @[team-lead] — [phone/Slack]
+- **Secondary:** @[manager] — [phone/Slack]
+
+## Related Runbooks
+
+- [Link to related runbook 1]
+- [Link to related runbook 2]
+
+## Change Log
+
+| Date | Author | Change |
+|------|--------|--------|
+| YYYY-MM-DD | [Name] | Initial version |
+````
+
+## Overview
+
+Failover the primary PostgreSQL instance to the synchronous replica when
+the primary is unreachable or degraded. This runbook covers both planned
+(maintenance) and unplanned (emergency) failover.
+
+## Prerequisites
+
+- [ ] DBA or SRE-level access to primary and replica hosts
+- [ ] `psql` client installed (v14+)
+- [ ] VPN connected to production network
+- [ ] Slack channel #db-ops open
+- [ ] Confirm replica is in sync: replication lag < 1 MB
+
+## Procedure
+
+### Step 1 — Verify Replica Health
+
+```bash
+psql -h replica.db.internal -U dba -d postgres -c \
+  "SELECT pg_is_in_recovery(), pg_last_wal_replay_lsn();"
+```
+
+**Expected output:** `pg_is_in_recovery = t`, LSN advancing.
+
+### Step 2 — Stop Application Writes
+
+```bash
+kubectl scale deployment api-server --replicas=0 -n production
+kubectl scale deployment worker --replicas=0 -n production
+```
+
+**Expected output:** Deployments scaled to 0 pods.
+
+### Step 3 — Confirm Write Quiesce
+
+```bash
+psql -h primary.db.internal -U dba -d postgres -c \
+  "SELECT count(*) FROM pg_stat_activity WHERE state = 'active' AND query !~ 'pg_stat';"
+```
+
+**Expected output:** Count = 0 (no active queries).
+
+### Step 4 — Promote Replica
+
+```bash
+psql -h replica.db.internal -U dba -d postgres -c "SELECT pg_promote();"
+```
+
+Wait up to 30 seconds, then confirm:
+
+```bash
+psql -h replica.db.internal -U dba -d postgres -c "SELECT pg_is_in_recovery();"
+```
+
+**Expected output:** `pg_is_in_recovery = f` (no longer a replica).
+
+### Step 5 — Update DNS
+
+```bash
+aws route53 change-resource-record-sets \
+  --hosted-zone-id Z1234567890 \
+  --change-batch '{
+    "Changes": [{
+      "Action": "UPSERT",
+      "ResourceRecordSet": {
+        "Name": "db.internal.example.com",
+        "Type": "CNAME",
+        "TTL": 60,
+        "ResourceRecords": [{"Value": "replica.db.internal"}]
+      }
+    }]
+  }'
+```
+
+### Step 6 — Restart Application
+
+```bash
+kubectl scale deployment api-server --replicas=6 -n production
+kubectl scale deployment worker --replicas=4 -n production
+```
+
+## Verification
+
+- [ ] `psql -h db.internal.example.com -c "SELECT 1;"` returns successfully
+- [ ] Application logs show successful DB connections (no errors for 5 min)
+- [ ] Transaction throughput returns to baseline on Grafana dashboard
+- [ ] No replication-lag alerts firing
+
+## Rollback
+
+If the promoted replica has issues, restore from the most recent backup:
+
+```bash
+# Restore latest automated snapshot (RDS example)
+aws rds restore-db-instance-from-db-snapshot \
+  --db-instance-identifier prod-db-restored \
+  --db-snapshot-identifier prod-db-latest-snapshot
+```
+
+## Escalation
+
+If unresolved after 15 minutes:
+- **Primary:** @dba-lead — +1-555-0101
+- **Secondary:** @platform-oncall — +1-555-0102
+````
+
+## Automation Scripts for Common Operations
+
+### Service Health Check
+
+```bash
+#!/usr/bin/env bash
+# health-check.sh — Check health of critical services
+set -euo pipefail
+
+SERVICES=(
+  "https://api.example.com/healthz"
+  "https://app.example.com/healthz"
+  "https://admin.example.com/healthz"
+)
+
+EXIT_CODE=0
+
+for url in "${SERVICES[@]}"; do
+  HTTP_CODE=$(curl -so /dev/null -w '%{http_code}' --max-time 5 "$url" 2>/dev/null || echo "000")
+  if [ "$HTTP_CODE" -eq 200 ]; then
+    printf "  OK    %s\n" "$url"
+  else
+    printf "  FAIL  %s (HTTP %s)\n" "$url" "$HTTP_CODE"
+    EXIT_CODE=1
+  fi
+done
+
+exit $EXIT_CODE
+```
+
+### Log Collection for Incident Investigation
+
+```bash
+#!/usr/bin/env bash
+# collect-logs.sh — Gather logs from multiple sources for incident review
+set -euo pipefail
+
+INCIDENT_ID="${1:?Usage: collect-logs.sh <incident-id>}"
+OUTDIR="/tmp/incident-${INCIDENT_ID}"
+mkdir -p "$OUTDIR"
+
+echo "Collecting logs for incident $INCIDENT_ID..."
+
+# Kubernetes pod logs (last 30 min)
+kubectl logs -l app=api-server -n production --since=30m \
+  > "${OUTDIR}/api-server-pods.log" 2>&1
+
+# CloudWatch Logs (last 30 min)
+aws logs filter-log-events \
+  --log-group-name /ecs/production/api \
+  --start-time "$(date -d '30 minutes ago' +%s)000" \
+  --output text > "${OUTDIR}/cloudwatch-api.log" 2>&1
+
+# Database slow query log
+psql -h db.internal -U dba -d postgres -c \
+  "SELECT * FROM pg_stat_activity WHERE state != 'idle' ORDER BY query_start;" \
+  > "${OUTDIR}/db-active-queries.log" 2>&1
+
+# System resource snapshot
+kubectl top pods -n production > "${OUTDIR}/pod-resources.log" 2>&1
+
+echo "Logs saved to $OUTDIR"
+tar czf "${OUTDIR}.tar.gz" -C /tmp "incident-${INCIDENT_ID}"
+echo "Archive: ${OUTDIR}.tar.gz"
+```
+
+### Certificate Expiry Check
+
+```bash
+#!/usr/bin/env bash
+# cert-check.sh — Warn if TLS certificates expire within 30 days
+set -euo pipefail
+
+DOMAINS=(
+  "api.example.com"
+  "app.example.com"
+  "admin.example.com"
+)
+
+WARN_DAYS=30
+TODAY=$(date +%s)
+EXIT_CODE=0
+
+for domain in "${DOMAINS[@]}"; do
+  EXPIRY=$(echo | openssl s_client -servername "$domain" -connect "${domain}:443" 2>/dev/null \
+    | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
+  EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s 2>/dev/null || echo 0)
+  DAYS_LEFT=$(( (EXPIRY_EPOCH - TODAY) / 86400 ))
+
+  if [ "$DAYS_LEFT" -lt "$WARN_DAYS" ]; then
+    printf "  WARN  %s expires in %d days (%s)\n" "$domain" "$DAYS_LEFT" "$EXPIRY"
+    EXIT_CODE=1
+  else
+    printf "  OK    %s — %d days remaining\n" "$domain" "$DAYS_LEFT"
+  fi
+done
+
+exit $EXIT_CODE
+```
+
+### Disk Space Cleanup
+
+```bash
+#!/usr/bin/env bash
+# disk-cleanup.sh — Free disk space on a host
+set -euo pipefail
+
+echo "=== Disk Usage Before ==="
+df -h /
+
+# Remove old journal logs (> 7 days)
+journalctl --vacuum-time=7d 2>/dev/null || true
+
+# Clean Docker artifacts
+docker system prune -f --volumes 2>/dev/null || true
+
+# Remove old log files
+find /var/log -name "*.gz" -mtime +7 -delete 2>/dev/null || true
+find /tmp -type f -mtime +3 -delete 2>/dev/null || true
+
+echo "=== Disk Usage After ==="
+df -h /
+```
+
+## Runbook Review Checklist
+
+Use this checklist every time a runbook is created or updated.
+
+```yaml
+content_review:
+  - [ ] Title clearly identifies the service and operation
+  - [ ] Overview explains WHEN and WHY to use this runbook
+  - [ ] Prerequisites list all required access, tools, and setup
+  - [ ] Every step has a concrete command (no vague instructions)
+  - [ ] Expected output is documented for each step
+  - [ ] Verification section confirms success with specific checks
+  - [ ] Rollback section exists and has been tested
+  - [ ] Escalation contacts are current (names, phones, Slack handles)
+  - [ ] Troubleshooting table covers the top 3-5 known failure modes
+
+usability_review:
+  - [ ] A new team member can follow the runbook without tribal knowledge
+  - [ ] Steps are numbered and sequential (no branching without clear labels)
+  - [ ] Commands can be copy-pasted (no placeholder values without explanation)
+  - [ ] Time estimates included for long-running steps
+  - [ ] No jargon or acronyms used without definition
+
+maintenance_review:
+  - [ ] Owner and last-reviewed date are set
+  - [ ] Version number incremented
+  - [ ] Change log entry added
+  - [ ] Related runbooks section is up to date
+  - [ ] Links to dashboards and docs are valid (not broken)
+```
+
+## Runbook Testing Procedures
+
+```yaml
+testing_strategy:
+  dry_run:
+    frequency: "Every time a runbook is created or substantially edited"
+    method: "Walk through each step in a staging environment"
+    goal: "Verify commands work and output matches documentation"
+
+  peer_review:
+    frequency: "Every edit"
+    method: "Another engineer follows the runbook in staging without help"
+    goal: "Confirm the runbook is self-contained and unambiguous"
+
+  scheduled_validation:
+    frequency: "Quarterly"
+    method: "SRE team picks 5 runbooks at random, executes in staging"
+    goal: "Catch runbooks that have drifted from production reality"
+
+  incident_triggered:
+    trigger: "Any time a runbook is used in a real incident"
+    method: "Post-mortem includes runbook accuracy assessment"
+    goal: "Capture improvements while the experience is fresh"
+
+  automation_testing:
+    method: "CI pipeline validates bash scripts with shellcheck and dry-run"
+    example: |
+      # .github/workflows/runbook-lint.yml
+      name: Lint Runbook Scripts
+      on: [pull_request]
+      jobs:
+        shellcheck:
+          runs-on: ubuntu-latest
+          steps:
+            - uses: actions/checkout@v4
+            - name: ShellCheck
+              run: |
+                find runbooks/ -name "*.sh" -exec shellcheck {} +
+```
+
+
+
+## When to Use
+
+- Creating or updating operational runbooks, SOPs, on-call procedures, or incident recovery guides.
+
+## Limitations
+
+- Runbooks must be validated in staging; examples use placeholder hostnames and account IDs.
+- Docs-only import: upstream template files are not bundled.
+
+### Example
+
+```markdown
+Draft a SEV2 database failover runbook with prerequisites, verification, and rollback.
+```
+
+> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

package/bundled-skills/runbook-creation/references/details.md

@@ -0,0 +1,71 @@
+# Details (moved from SKILL.md)
+
+> Extended reference content for `runbook-creation`, kept under `references/` so the entrypoint stays within the audit budget.
+
+## Versioning Strategy
+
+```yaml
+versioning:
+  storage: "Git repository — one directory per service, one file per runbook"
+  naming: "runbooks/<service>/<operation>.md"
+  branching: "PRs required for all changes; reviewed by service owner"
+
+  version_scheme:
+    format: "MAJOR.MINOR"
+    major_bump: "Procedure changes that alter the steps or their order"
+    minor_bump: "Clarifications, typo fixes, updated contact info"
+
+  directory_layout: |
+    runbooks/
+      api-server/
+        deploy.md
+        rollback.md
+        scale-up.md
+      database/
+        failover.md
+        backup-restore.md
+        vacuum-maintenance.md
+      infrastructure/
+        dns-update.md
+        certificate-renewal.md
+        disk-cleanup.md
+
+  review_requirements:
+    - PR must be approved by the service owner
+    - CI must pass (shellcheck for scripts, markdown lint)
+    - Reviewer confirms they can follow the steps independently
+
+  retention: "Git history serves as full audit trail — never delete old versions"
+```
+
+
+## Runbook Index Template
+
+Keep a top-level index so engineers can find the right runbook quickly.
+
+```markdown
+# Runbook Index
+
+| Service | Runbook | Severity | Owner | Last Tested |
+|---------|---------|----------|-------|-------------|
+| API Server | [Deploy] (api-server/deploy.md) | — | @platform | 2025-05-01 |
+| API Server | [Rollback] (api-server/rollback.md) | SEV1 | @platform | 2025-05-01 |
+| Database | [Failover] (database/failover.md) | SEV1 | @dba | 2025-04-15 |
+| Database | [Backup Restore] (database/backup-restore.md) | SEV2 | @dba | 2025-04-15 |
+| Infra | [DNS Update] (infrastructure/dns-update.md) | SEV2 | @sre | 2025-06-01 |
+| Infra | [Cert Renewal] (infrastructure/certificate-renewal.md) | SEV3 | @sre | 2025-06-01 |
+```
+
+
+## Best Practices
+
+- Write runbooks for the engineer at 3 AM — clear, sequential, copy-pasteable
+- Include expected output so the operator knows if a step succeeded
+- Always provide a rollback path; every action should be reversible
+- Test runbooks in staging before they are needed in production
+- Keep runbooks in version control alongside the code they support
+- Assign an owner to every runbook; ownerless runbooks rot fast
+- After every incident, update the relevant runbook with lessons learned
+- Automate repetitive runbook steps into scripts, but keep the runbook as
+  the orchestration guide so operators understand the "why"
+

package/bundled-skills/saas-pricing-strategist/SKILL.md

@@ -0,0 +1,169 @@
+---
+name: saas-pricing-strategist
+version: 1.0.0
+description: Design, optimize, and test pricing strategies for SaaS products using
+  data-driven frameworks, competitive analysis, and psychological pricing principles.
+author: yundu-ai
+tags:
+- saas
+- pricing
+- strategy
+- monetization
+- business
+- analytics
+model: claude
+source_repo: demo112/yunqu-ai-skills
+source_type: community
+source: community
+date_added: '2026-09-21'
+risk: unknown
+---
+## When to Use
+- Use when this upstream workflow matches the user's stated goal.
+- Use when the task requires the procedures documented in this skill.
+
+# SaaS Pricing Strategist
+
+You are a pricing strategist who has helped 100+ SaaS companies optimize their pricing. You combine economic theory, behavioral psychology, and real market data to find the price that maximizes revenue.
+
+## Pricing Framework
+
+### Step 1: Understand the Value Metric
+
+The value metric is what you charge for. It must:
+1. **Grow with customer usage** — as they get more value, they pay more
+2. **Be predictable** — customers can forecast their costs
+3. **Be simple to understand** — no calculator needed
+
+**Common Value Metrics:**
+| Business Type | Good Value Metrics | Bad Value Metrics |
+|---|---|---|
+| Project Management | Users, Projects | Features, Storage |
+| Email Marketing | Contacts, Emails sent | Users, Storage |
+| Analytics | Events, Page views | Users, Dashboards |
+| API Service | API calls, Tokens | Users, Endpoints |
+| Storage | GB stored, GB transferred | Users, Files |
+| CRM | Contacts, Revenue managed | Users, Fields |
+
+### Step 2: Determine Price Range
+
+Use the **Van Westendorp Price Sensitivity Meter** — ask 4 questions:
+
+1. At what price would you consider the product so cheap you'd question its quality? (Too Cheap)
+2. At what price would you consider the product a bargain? (Cheap)
+3. At what price would you consider the product expensive but still worth it? (Expensive)
+4. At what price would you consider the product too expensive to consider? (Too Expensive)
+
+Plot the curves to find:
+- **Optimal Price Point**: Where "Too Cheap" and "Too Expensive" intersect
+- **Indifference Price**: Where "Cheap" and "Expensive" intersect
+- **Acceptable Range**: Between these two points
+
+### Step 3: Tier Design
+
+Follow the **Good-Better-Best** framework:
+
+```
+┌─────────────┐  ┌─────────────┐  ┌─────────────┐
+│   Starter   │  │   Growth    │  │   Scale     │
+│   $29/mo    │  │   $79/mo    │  │   $199/mo   │
+│             │  │             │  │             │
+│ • 5 users   │  │ • 25 users  │  │ • Unlimited │
+│ • 1K events │  │ • 10K events│  │ • Unlimited │
+│ • Basic     │  │ • Advanced  │  │ • Everything│
+│   reports   │  │   analytics │  │ + Priority  │
+│             │  │ • API access│  │   support   │
+│             │  │             │  │ + SSO       │
+│             │  │             │  │ + Audit log │
+└─────────────┘  └─────────────┘  └─────────────┘
+    ↑ Anchor        ↑ Target         ↑ Aspiration
+    
+Most popular: Growth (anchor effect drives mid-tier selection)
+```
+
+### Step 4: Psychological Pricing Tactics
+
+| Tactic | Effect | Example |
+|---|---|---|
+| Charm pricing | Left-digit effect | $79 not $80 |
+| Anchoring | High tier makes mid-tier look reasonable | Show Enterprise first |
+| Decoy effect | Make target tier look like best deal | Add "feature gap" to push up |
+| Annual discount | Lock in + lower churn | "Save 20% with annual" |
+| Freemium gate | Drive adoption, convert later | Free up to X, pay above |
+| Per-seat expansion | Natural revenue growth | More users = more revenue |
+
+### Step 5: Competitive Positioning Matrix
+
+```
+Price ↑
+      │
+$200  │                    ● Competitor D
+      │         ● Competitor C
+$100  │                    
+      │    ● You (target)
+$50   │ ● Comp A    ● Comp B
+      │
+$0    └──────────────────────────→ Features
+      Basic     Good     Best
+```
+
+## Pricing Page Copy Template
+
+```
+## [Product Name] Pricing
+
+### Simple, transparent pricing. No hidden fees.
+
+[Toggle: Monthly / Annual (Save 20%)]
+
+| | Starter | Growth | Scale |
+|---|---|---|---|
+| Price | $29/mo | $79/mo | $199/mo |
+| Value Metric | Up to 5 users | Up to 25 users | Unlimited |
+| Core Feature | ✅ | ✅ | ✅ |
+| Advanced Feature | — | ✅ | ✅ |
+| Premium Feature | — | — | ✅ |
+| Support | Community | Email | Priority + Slack |
+| | [Get Started] | [Most Popular] | [Contact Sales] |
+
+All plans include: [Free features everyone gets]
+```
+
+## Pricing Experiment Framework
+
+When testing pricing changes:
+
+1. **Measure**: Revenue per user (not just conversion rate)
+2. **Segment**: New vs. existing users, by source, by company size
+3. **Duration**: Run for at least 2 full billing cycles
+4. **Guard rails**: Set max revenue drop threshold (e.g., 10%) before stopping
+5. **Rollback plan**: Always have a quick way to revert
+
+**Common experiments:**
+- A/B test tier prices (±20%)
+- Test freemium vs. free trial
+- Test annual discount (15% vs. 20% vs. 25%)
+- Test per-seat vs. flat pricing
+- Test add-on pricing vs. all-inclusive
+
+## Red Flags in Pricing
+
+🚩 **"Let's just undercut everyone"** — Race to the bottom, unsustainable
+🚩 **"One price fits all"** — Leaving money on the table from enterprise
+🚩 **"Free forever for everyone"** — No conversion path = no revenue
+🚩 **"We'll figure out pricing later"** — Hard to raise prices after launch
+🚩 **"Price based on our costs"** — Price based on VALUE, not cost
+🚩 **"Too many tiers"** — More than 4 tiers causes decision paralysis
+
+
+## Examples
+
+```text
+User: Apply this skill to my current task.
+Assistant: Follow the workflow in this skill, cite limitations, and ask before risky steps.
+```
+
+## Limitations
+
+- Imported upstream skill; verify credentials, permissions, and safety boundaries before execution.
+- Does not replace environment-specific validation, testing, or maintainer review.