opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/user-management/SKILL.md

@@ -0,0 +1,383 @@
+---
+name: user-management
+description: Manage users, groups, and permissions on Linux systems. Configure sudo
+  and access controls. Use when managing system access.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# User Management
+
+Manage users, groups, permissions, sudo access, PAM modules, and LDAP integration on Linux systems. Includes practical scripts for bulk user operations and access auditing.
+
+## When to Use
+
+- Creating and managing local user accounts on Linux servers
+- Configuring sudo access with fine-grained privilege controls
+- Setting up group-based access control for teams
+- Integrating Linux hosts with LDAP or Active Directory for centralized auth
+- Auditing user accounts, permissions, and access patterns
+- Automating bulk user provisioning and deprovisioning
+
+## Prerequisites
+
+- Root or sudo access on the target system
+- `shadow-utils` package (provides useradd, usermod, etc.) -- installed by default
+- `libpam-modules` for PAM configuration
+- For LDAP: `sssd`, `realmd`, `libpam-ldapd`, or `nslcd` packages
+- For auditing: `auditd` package
+
+## User Operations
+
+### Creating Users
+
+```bash
+# Create a user with home directory, default shell, and comment
+useradd -m -s /bin/bash -c "Jane Smith" jsmith
+
+# Set the user's password interactively
+passwd jsmith
+
+# Create a user with a specific UID and primary group
+useradd -m -s /bin/bash -u 1500 -g developers -c "Deploy Account" deploy
+
+# Create a system account (no home, no login shell) for running services
+useradd -r -s /usr/sbin/nologin -d /opt/myapp -c "MyApp Service Account" myapp
+
+# Create a user with an expiration date (contractor access)
+useradd -m -s /bin/bash -e 2025-12-31 -c "Contractor - Bob Lee" blee
+
+# Create user and add to multiple supplementary groups at creation time
+useradd -m -s /bin/bash -G docker,developers,ssh-users -c "Dev User" devuser
+```
+
+### Modifying Users
+
+```bash
+# Add a user to a supplementary group (preserving existing groups with -a)
+usermod -aG sudo jsmith
+usermod -aG docker,developers jsmith
+
+# Change the user's login shell
+usermod -s /bin/zsh jsmith
+
+# Change the user's home directory and move existing files
+usermod -d /home/jsmith-new -m jsmith
+
+# Lock a user account (disable login without deleting)
+usermod -L jsmith
+
+# Unlock a user account
+usermod -U jsmith
+
+# Set an account expiration date
+usermod -e 2025-06-30 blee
+
+# Change a user's login name
+usermod -l jsmith-new jsmith
+
+# Force password change on next login
+chage -d 0 jsmith
+
+# Set password aging: min 7 days, max 90 days, warn 14 days before
+chage -m 7 -M 90 -W 14 jsmith
+
+# View password aging info
+chage -l jsmith
+```
+
+### Deleting Users
+
+```bash
+# Remove a user and their home directory
+userdel -r jsmith
+
+# Remove a user but keep their home directory (for auditing)
+userdel jsmith
+
+# Find and reassign files owned by a deleted user (by UID)
+find / -uid 1500 -exec chown newowner:newgroup {} \;
+```
+
+## Group Management
+
+```bash
+# Create a new group
+groupadd developers
+
+# Create a group with a specific GID
+groupadd -g 2000 devops
+
+# Add a user to a group
+usermod -aG developers jsmith
+# Alternative using gpasswd
+gpasswd -a jsmith developers
+
+# Remove a user from a group
+gpasswd -d jsmith developers
+
+# Set group administrators (can add/remove members without root)
+gpasswd -A jsmith developers
+
+# Delete a group
+groupdel developers
+
+# List all groups a user belongs to
+groups jsmith
+id jsmith
+
+# List all members of a group
+getent group developers
+
+# Show all groups on the system
+cat /etc/group | cut -d: -f1 | sort
+```
+
+## Sudo Configuration
+
+```bash
+# Always edit sudoers via visudo (syntax validation prevents lockout)
+visudo
+
+# Better: use drop-in files in /etc/sudoers.d/
+visudo -f /etc/sudoers.d/developers
+```
+
+### /etc/sudoers.d/developers
+
+```text
+# Allow the developers group to restart specific services
+%developers ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart myapp, /usr/bin/systemctl status myapp
+
+# Allow a deploy user full sudo with no password
+deploy ALL=(ALL) NOPASSWD: ALL
+
+# Allow ops team to run docker commands only
+%ops ALL=(ALL) NOPASSWD: /usr/bin/docker, /usr/bin/docker-compose
+
+# Allow a user to run commands as a specific service account
+jsmith ALL=(myapp) NOPASSWD: /opt/myapp/bin/*
+
+# Restrict to specific hosts (useful with centralized sudoers)
+jsmith dbservers=(root) /usr/bin/systemctl restart postgresql
+
+# Log all sudo commands to a dedicated file
+Defaults log_output
+Defaults!/usr/bin/sudoreplay !log_output
+Defaults logfile="/var/log/sudo.log"
+
+# Require password re-entry every 5 minutes (default is 15)
+Defaults timestamp_timeout=5
+
+# Require password for sudo even if user has NOPASSWD elsewhere
+Defaults:jsmith !authenticate
+```
+
+```bash
+# Validate sudoers syntax without applying
+visudo -c
+
+# Check what sudo permissions a user has
+sudo -l -U jsmith
+
+# Test a specific sudo command as a user
+sudo -u myapp /opt/myapp/bin/healthcheck.sh
+```
+
+## File Permissions and ACLs
+
+```bash
+# Standard permissions
+chmod 755 /opt/myapp           # rwxr-xr-x
+chmod 640 /etc/myapp.conf      # rw-r-----
+chmod u+x script.sh            # Add execute for owner
+chmod g+w shared-dir/          # Add write for group
+chmod o-rwx private-file       # Remove all permissions for others
+
+# Change ownership
+chown deploy:developers /opt/myapp
+chown -R deploy:developers /opt/myapp/   # Recursive
+
+# Set the SGID bit (new files inherit group ownership)
+chmod g+s /opt/shared/
+
+# Set the sticky bit (only owner can delete their files)
+chmod +t /tmp/shared/
+
+# Access Control Lists (ACLs) for fine-grained control
+# Grant read-execute to a specific user on a directory
+setfacl -m u:jsmith:rx /opt/myapp/logs/
+
+# Grant read-write to a group
+setfacl -m g:developers:rw /opt/shared/
+
+# Set default ACL (applied to new files created in the directory)
+setfacl -d -m g:developers:rw /opt/shared/
+
+# View ACLs
+getfacl /opt/shared/
+
+# Remove a specific ACL entry
+setfacl -x u:jsmith /opt/myapp/logs/
+
+# Remove all ACLs
+setfacl -b /opt/shared/
+```
+
+## PAM Configuration
+
+```bash
+# PAM config files are in /etc/pam.d/
+# Each file controls auth for a specific service (sshd, login, sudo, etc.)
+
+# Enforce password complexity via pam_pwquality
+# /etc/pam.d/common-password (Debian) or /etc/pam.d/system-auth (RHEL)
+password requisite pam_pwquality.so retry=3 minlen=12 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1
+
+# Configure /etc/security/pwquality.conf
+minlen = 12
+dcredit = -1
+ucredit = -1
+ocredit = -1
+lcredit = -1
+maxrepeat = 3
+dictcheck = 1
+
+# Limit concurrent logins per user
+# /etc/security/limits.conf
+jsmith hard maxlogins 3
+@developers hard maxlogins 5
+
+# Lock account after 5 failed login attempts
+# /etc/pam.d/common-auth (Debian)
+auth required pam_faillock.so preauth silent deny=5 unlock_time=900
+auth required pam_faillock.so authfail deny=5 unlock_time=900
+
+# View failed login attempts
+faillock --user jsmith
+
+# Unlock a locked account
+faillock --user jsmith --reset
+```
+
+## LDAP / Active Directory Integration
+
+```bash
+# Install SSSD and realmd for AD integration (Ubuntu/Debian)
+apt install -y sssd realmd adcli sssd-tools libnss-sss libpam-sss
+
+# Install SSSD and realmd (RHEL/CentOS)
+dnf install -y sssd realmd adcli sssd-tools oddjob oddjob-mkhomedir
+
+# Discover and join an Active Directory domain
+realm discover corp.example.com
+realm join corp.example.com -U admin@CORP.EXAMPLE.COM
+
+# Verify the join
+realm list
+
+# Allow specific AD groups to log in
+realm permit -g "Linux Admins@corp.example.com"
+realm permit -g "Developers@corp.example.com"
+
+# Deny all except permitted groups
+realm deny --all
+realm permit -g "Linux Admins@corp.example.com"
+
+# Restart SSSD after config changes
+systemctl restart sssd
+
+# Test LDAP user lookup
+id jsmith
+getent passwd jsmith
+
+# Grant sudo to an AD group
+echo '%linux\ admins ALL=(ALL) ALL' > /etc/sudoers.d/ad-admins
+```
+
+## Bulk User Management Scripts
+
+### Bulk User Creation from CSV
+
+```bash
+#!/bin/bash
+# bulk-create-users.sh
+# CSV format: username,fullname,groups,shell
+# Example: jsmith,Jane Smith,developers;docker,/bin/bash
+
+CSV_FILE="${1:?Usage: $0 <users.csv>}"
+
+while IFS=',' read -r username fullname groups shell; do
+  # Skip header line
+  [[ "$username" == "username" ]] && continue
+
+  if id "$username" &>/dev/null; then
+    echo "SKIP: User $username already exists"
+    continue
+  fi
+
+  # Replace semicolons with commas for -G flag
+  group_list="${groups//;/,}"
+
+  useradd -m -s "$shell" -c "$fullname" -G "$group_list" "$username"
+  # Generate a random temporary password
+  temp_pass=$(openssl rand -base64 12)
+  echo "$username:$temp_pass" | chpasswd
+  chage -d 0 "$username"   # Force password change at first login
+
+  echo "CREATED: $username (groups: $group_list) temp-pass: $temp_pass"
+done < "$CSV_FILE"
+```
+
+### Quick Access Audit Commands
+
+```bash
+# List non-system users (UID >= 1000)
+awk -F: '$3 >= 1000 && $3 < 65534 { printf "%-20s UID=%-6s Shell=%s\n", $1, $3, $7 }' /etc/passwd
+
+# List users with sudo access
+getent group sudo wheel 2>/dev/null
+
+# Find accounts that have never logged in
+lastlog | awk '$0 ~ /Never logged in/ { print $1 }'
+
+# Find accounts with empty passwords
+awk -F: '($2 == "" || $2 == "!") { print $1 }' /etc/shadow 2>/dev/null
+```
+
+## Troubleshooting
+
+| Symptom | Diagnostic Command | Common Fix |
+|---|---|---|
+| User cannot log in | `passwd -S username`, `faillock --user username` | Unlock account, reset password, check shell |
+| "not in sudoers" error | `sudo -l -U username` | Add user to sudo group or create sudoers.d file |
+| Group membership not applied | `id username`, `groups username` | User must log out and back in for new groups |
+| LDAP/AD user not found | `id aduser`, `sssctl user-show aduser` | Check SSSD status, clear cache: `sss_cache -E` |
+| Permission denied on file | `ls -la file`, `getfacl file` | Fix ownership/permissions, check SELinux context |
+| PAM lockout after failed attempts | `faillock --user username` | `faillock --user username --reset` |
+| Home directory not created | Check `/etc/login.defs` CREATEHOME | Use `useradd -m` or enable `pam_mkhomedir` |
+| Password policy not enforced | Check `/etc/pam.d/common-password` | Install and configure `pam_pwquality` |
+
+## Related Skills
+
+- `linux-administration` -- General Linux server management
+- `ssh-configuration` -- SSH key-based authentication for managed users
+- `systemd-services` -- Service accounts and systemd user instances
+- `performance-tuning` -- Resource limits per user via cgroups and ulimits
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+

package/bundled-skills/using-agent-skills/SKILL.md

@@ -0,0 +1,220 @@
+---
+name: using-agent-skills
+description: Meta-skill for discovering and invoking the right agent skill for the
+  work at hand, applied at session start.
+category: meta
+risk: safe
+source: https://github.com/addyosmani/agent-skills
+source_repo: addyosmani/agent-skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/addyosmani/agent-skills/blob/main/LICENSE
+compatibility: Portable instruction skill; no CLI, MCP server, or network access required.
+---
+
+# Using Agent Skills
+
+## Overview
+
+Agent Skills is a collection of engineering workflow skills organized by development phase. Each skill encodes a specific process that senior engineers follow. This meta-skill helps you discover and apply the right skill for your current task.
+
+## Skill Discovery
+
+When a task arrives, identify the development phase and apply the corresponding skill:
+
+```
+Task arrives
+    │
+    ├── Don't know what you want yet? ──────→ interview-me
+    ├── Have a rough concept, need variants? → idea-refine
+    ├── New project/feature/change? ──→ spec-driven-development
+    ├── No quality bar written down? ──→ constraint-driven-development
+    ├── Have a spec, need tasks? ──────→ planning-and-task-breakdown
+    ├── Implementing code? ────────────→ incremental-implementation
+    │   ├── UI work? ─────────────────→ frontend-ui-engineering
+    │   ├── API work? ────────────────→ api-and-interface-design
+    │   ├── Need better context? ─────→ context-engineering
+    │   ├── Need doc-verified code? ───→ source-driven-development
+    │   └── Stakes high / unfamiliar code? ──→ doubt-driven-development
+    ├── Writing/running tests? ────────→ test-driven-development
+    │   └── Browser-based? ───────────→ browser-testing-with-devtools
+    ├── Something broke? ──────────────→ debugging-and-error-recovery
+    ├── Reviewing code? ───────────────→ code-review-and-quality
+    │   ├── Too complex? ─────────────→ code-simplification
+    │   ├── Security concerns? ───────→ security-and-hardening
+    │   └── Performance concerns? ────→ performance-optimization
+    ├── Committing/branching? ─────────→ git-workflow-and-versioning
+    ├── CI/CD pipeline work? ──────────→ ci-cd-and-automation
+    ├── Deprecating/migrating? ────────→ deprecation-and-migration
+    ├── Writing docs/ADRs? ───────────→ documentation-and-adrs
+    ├── Adding logs/metrics/alerts? ───→ observability-and-instrumentation
+    └── Deploying/launching? ─────────→ shipping-and-launch
+```
+
+## Core Operating Behaviors
+
+These behaviors apply at all times, across all skills. They are non-negotiable.
+
+### 1. Surface Assumptions
+
+Before implementing anything non-trivial, explicitly state your assumptions:
+
+```
+ASSUMPTIONS I'M MAKING:
+1. [assumption about requirements]
+2. [assumption about architecture]
+3. [assumption about scope]
+→ Correct me now or I'll proceed with these.
+```
+
+Don't silently fill in ambiguous requirements. The most common failure mode is making wrong assumptions and running with them unchecked. Surface uncertainty early — it's cheaper than rework.
+
+### 2. Manage Confusion Actively
+
+When you encounter inconsistencies, conflicting requirements, or unclear specifications:
+
+1. **STOP.** Do not proceed with a guess.
+2. Name the specific confusion.
+3. Present the tradeoff or ask the clarifying question.
+4. Wait for resolution before continuing.
+
+**Bad:** Silently picking one interpretation and hoping it's right.
+**Good:** "I see X in the spec but Y in the existing code. Which takes precedence?"
+
+### 3. Push Back When Warranted
+
+You are not a yes-machine. When an approach has clear problems:
+
+- Point out the issue directly
+- Explain the concrete downside (quantify when possible — "this adds ~200ms latency" not "this might be slower")
+- Propose an alternative
+- Accept the human's decision if they override with full information
+
+Sycophancy is a failure mode. "Of course!" followed by implementing a bad idea helps no one. Honest technical disagreement is more valuable than false agreement.
+
+### 4. Enforce Simplicity
+
+Your natural tendency is to overcomplicate. Actively resist it.
+
+Before finishing any implementation, ask:
+- Can this be done in fewer lines?
+- Are these abstractions earning their complexity?
+- Would a staff engineer look at this and say "why didn't you just..."?
+
+If you build 1000 lines and 100 would suffice, you have failed. Prefer the boring, obvious solution. Cleverness is expensive.
+
+### 5. Maintain Scope Discipline
+
+Touch only what you're asked to touch.
+
+Do NOT:
+- Remove comments you don't understand
+- "Clean up" code orthogonal to the task
+- Refactor adjacent systems as a side effect
+- Delete code that seems unused without explicit approval
+- Add features not in the spec because they "seem useful"
+
+Your job is surgical precision, not unsolicited renovation.
+
+### 6. Verify, Don't Assume
+
+Every skill includes a verification step. A task is not complete until verification passes. "Seems right" is never sufficient — there must be evidence (passing tests, build output, runtime data).
+
+Per-skill verification is the local check. The project-wide bar that applies to *every* change, regardless of which skill is active, is the Definition of Done: tests pass, no regressions, behavior verified at runtime, docs updated. See `../../references/definition-of-done.md`. It complements each task's acceptance criteria rather than replacing them.
+
+## Failure Modes to Avoid
+
+These are the subtle errors that look like productivity but create problems:
+
+1. Making wrong assumptions without checking
+2. Not managing your own confusion — plowing ahead when lost
+3. Not surfacing inconsistencies you notice
+4. Not presenting tradeoffs on non-obvious decisions
+5. Being sycophantic ("Of course!") to approaches with clear problems
+6. Overcomplicating code and APIs
+7. Modifying code or comments orthogonal to the task
+8. Removing things you don't fully understand
+9. Building without a spec because "it's obvious"
+10. Skipping verification because "it looks right"
+
+## Skill Rules
+
+1. **Check for an applicable skill before starting work.** Skills encode processes that prevent common mistakes.
+
+2. **Skills are workflows, not suggestions.** Follow the steps in order. Don't skip verification steps.
+
+3. **Multiple skills can apply.** A feature implementation might involve `idea-refine` → `spec-driven-development` → `planning-and-task-breakdown` → `incremental-implementation` → `test-driven-development` → `code-review-and-quality` → `code-simplification` → `shipping-and-launch` in sequence.
+
+4. **When in doubt, start with a spec.** If the task is non-trivial and there's no spec, begin with `spec-driven-development`.
+
+## Lifecycle Sequence
+
+For a complete feature, the typical skill sequence is:
+
+```
+1.  interview-me                → Extract what the user actually wants
+2.  idea-refine                 → Refine vague ideas
+3.  spec-driven-development     → Define what we're building
+4.  planning-and-task-breakdown → Break into verifiable chunks
+5.  context-engineering         → Load the right context
+6.  source-driven-development   → Verify against official docs
+7.  incremental-implementation  → Build slice by slice
+8.  observability-and-instrumentation → Instrument as you build (runs parallel with 7-9, not after)
+9.  doubt-driven-development    → Cross-examine non-trivial decisions in-flight
+10. test-driven-development     → Prove each slice works
+11. code-review-and-quality     → Review before merge
+12. code-simplification         → Reduce unnecessary complexity while preserving behavior
+13. git-workflow-and-versioning → Clean commit history
+14. documentation-and-adrs      → Document decisions
+15. deprecation-and-migration   → Retire old systems and move users safely when needed
+16. shipping-and-launch         → Deploy safely
+```
+
+Not every task needs every skill. A bug fix might only need: `debugging-and-error-recovery` → `test-driven-development` → `code-review-and-quality`.
+
+## Quick Reference
+
+| Phase | Skill | One-Line Summary |
+|-------|-------|-----------------|
+| Define | interview-me | Surface what the user actually wants before any plan, spec, or code exists |
+| Define | idea-refine | Refine ideas through structured divergent and convergent thinking |
+| Define | spec-driven-development | Requirements and acceptance criteria before code |
+| Plan | planning-and-task-breakdown | Decompose into small, verifiable tasks |
+| Build | incremental-implementation | Thin vertical slices, test each before expanding |
+| Build | source-driven-development | Verify against official docs before implementing |
+| Build | doubt-driven-development | Adversarial fresh-context review of every non-trivial decision |
+| Build | context-engineering | Right context at the right time |
+| Build | frontend-ui-engineering | Production-quality UI with accessibility |
+| Build | api-and-interface-design | Stable interfaces with clear contracts |
+| Verify | test-driven-development | Failing test first, then make it pass |
+| Verify | browser-testing-with-devtools | Chrome DevTools MCP for runtime verification |
+| Verify | debugging-and-error-recovery | Reproduce → localize → fix → guard |
+| Review | code-review-and-quality | Five-axis review with quality gates |
+| Review | code-simplification | Preserve behavior while reducing unnecessary complexity |
+| Review | security-and-hardening | OWASP prevention, input validation, least privilege |
+| Review | performance-optimization | Measure first, optimize only what matters |
+| Ship | git-workflow-and-versioning | Atomic commits, clean history |
+| Ship | ci-cd-and-automation | Automated quality gates on every change |
+| Ship | deprecation-and-migration | Remove old systems and migrate users safely |
+| Ship | documentation-and-adrs | Document the why, not just the what |
+| Ship | observability-and-instrumentation | Structured logs, RED metrics, traces, symptom-based alerts |
+| Ship | shipping-and-launch | Pre-launch checklist, monitoring, rollback plan |
+
+## When to Use
+
+- The request matches this skill's engineering workflow (quality constraints, requirements interview, or skill selection).
+- You want portable, tool-agnostic guidance rather than a CLI-specific integration.
+
+## Limitations
+
+- Guidance only: does not replace running the project's own linters, type checkers, formatters, or test suites.
+- Stop and ask when required inputs, permissions, or scope boundaries are missing.
+
+### Example
+
+```markdown
+Follow this skill's workflow step by step and report what you did at each gate.
+```
+
+> Adapted from [addyosmani/agent-skills](https://github.com/addyosmani/agent-skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance.