opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/business-continuity/SKILL.md

@@ -0,0 +1,463 @@
+---
+name: business-continuity
+description: Develop business continuity plans and impact analysis. Implement BCP
+  testing and communication procedures. Use when building organizational resilience.
+category: security
+risk: safe
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Checklist and framework guidance; no privileged tooling required. Apply
+  controls through your own change process.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Business Continuity Planning
+
+Develop and maintain business continuity capabilities including Business Impact Analysis, communication plans, recovery procedures, and testing schedules for organizational resilience.
+
+## When to Use
+
+- Developing a formal Business Continuity Plan (BCP) for the organization
+- Conducting a Business Impact Analysis (BIA) to prioritize recovery efforts
+- Establishing communication plans for crisis scenarios
+- Defining recovery procedures for critical business processes
+- Scheduling and conducting BCP exercises and tests
+- Meeting compliance requirements for continuity planning (SOC 2, ISO 27001, HIPAA, FedRAMP)
+
+## BCP Framework
+
+```yaml
+bcp_phases:
+  1_governance:
+    actions:
+      - Obtain executive sponsorship and funding
+      - Assign BCP coordinator and team
+      - Define BCP scope and policy
+      - Establish BCP committee with cross-functional representation
+    deliverables:
+      - BCP policy statement
+      - BCP team charter and roster
+      - Scope document
+
+  2_analysis:
+    actions:
+      - Conduct Business Impact Analysis (BIA)
+      - Perform risk assessment for continuity threats
+      - Identify critical business processes and dependencies
+      - Determine recovery priorities and resource requirements
+    deliverables:
+      - BIA report
+      - Risk assessment report
+      - Critical process inventory
+
+  3_strategy:
+    actions:
+      - Select recovery strategies for each critical process
+      - Identify alternate work arrangements (remote, alternate site)
+      - Define technology recovery strategies (DR plan)
+      - Establish vendor and supply chain contingencies
+    deliverables:
+      - Recovery strategy document
+      - Technology recovery plan
+      - Alternate site arrangements
+
+  4_plan_development:
+    actions:
+      - Write detailed recovery procedures
+      - Develop communication plans (internal and external)
+      - Create emergency response procedures
+      - Document roles, responsibilities, and contact information
+    deliverables:
+      - Business Continuity Plan document
+      - Communication plan
+      - Emergency response procedures
+      - Contact lists and call trees
+
+  5_testing:
+    actions:
+      - Develop test plan and schedule
+      - Conduct exercises (tabletop, functional, full-scale)
+      - Evaluate results and identify gaps
+      - Update plans based on lessons learned
+    deliverables:
+      - Test plan
+      - Exercise reports
+      - Updated BCP based on findings
+
+  6_maintenance:
+    actions:
+      - Review and update BCP annually (minimum)
+      - Update after significant organizational changes
+      - Refresh BIA when business processes change
+      - Maintain training and awareness program
+    deliverables:
+      - Annual BCP review record
+      - Updated BIA (if changes occurred)
+      - Training completion records
+```
+
+## Business Impact Analysis Template
+
+```yaml
+bia_template:
+  process_assessment:
+    process_name: ""
+    process_owner: ""
+    department: ""
+    description: ""
+
+    criticality_classification:
+      mission_critical:
+        max_tolerable_downtime: "0-4 hours"
+        description: "Failure causes immediate, severe impact to customers or revenue"
+        examples:
+          - Payment processing
+          - Authentication and authorization
+          - Core API serving customer requests
+          - Order fulfillment
+
+      essential:
+        max_tolerable_downtime: "4-24 hours"
+        description: "Failure causes significant degradation but not complete loss"
+        examples:
+          - Customer support systems
+          - Reporting and dashboards
+          - Email and notifications
+          - Billing and invoicing
+
+      important:
+        max_tolerable_downtime: "1-3 days"
+        description: "Failure causes inconvenience and workarounds are available"
+        examples:
+          - Internal collaboration tools
+          - Analytics and BI platforms
+          - HR self-service systems
+          - Knowledge base
+
+      non_essential:
+        max_tolerable_downtime: "3-7 days"
+        description: "Failure has minimal operational impact"
+        examples:
+          - Development and test environments
+          - Training platforms
+          - Archive systems
+
+    impact_categories:
+      financial:
+        revenue_loss_per_hour: ""
+        penalty_or_fine_risk: ""
+        recovery_cost_estimate: ""
+
+      operational:
+        affected_employees: ""
+        affected_customers: ""
+        workaround_available: "yes/no"
+        workaround_description: ""
+
+      reputational:
+        customer_visibility: "high/medium/low"
+        media_attention_risk: "high/medium/low"
+        regulatory_reporting_required: "yes/no"
+
+      legal_regulatory:
+        compliance_impact: ""
+        contractual_sla_breach: "yes/no"
+        sla_penalty_details: ""
+
+    dependencies:
+      technology:
+        - system: ""
+          rto: ""
+          rpo: ""
+          dr_strategy: ""
+      people:
+        - role: ""
+          minimum_staff: ""
+          remote_capable: "yes/no"
+      vendors:
+        - vendor: ""
+          service: ""
+          sla: ""
+          alternative: ""
+      facilities:
+        - location: ""
+          alternative: ""
+
+    recovery_requirements:
+      rto: ""
+      rpo: ""
+      minimum_recovery_level: "Description of minimum acceptable service"
+      full_recovery_target: "Time to full normal operations"
+```
+
+## Communication Plan
+
+```yaml
+communication_plan:
+  activation_criteria:
+    - Event affecting multiple critical systems
+    - Physical facility unavailable
+    - Pandemic or workforce availability crisis
+    - Major vendor/partner outage
+    - Cybersecurity incident with operational impact
+
+  internal_communication:
+    executive_notification:
+      who: "CEO, CTO, CFO, VP Engineering, VP Operations"
+      when: "Within 15 minutes of BCP activation"
+      method: "Phone call (primary), SMS (secondary)"
+      message_template: |
+        BUSINESS CONTINUITY EVENT ACTIVATED
+        Incident: [Brief description]
+        Impact: [Systems/processes affected]
+        Status: [Current state]
+        Next update: [Time]
+        Bridge call: [Number/link]
+
+    team_notification:
+      who: "All affected department leads and their teams"
+      when: "Within 30 minutes of BCP activation"
+      method: "Slack/Teams (primary), Email (secondary), SMS (tertiary)"
+      message_template: |
+        BCP ACTIVATED - [Event Type]
+        What happened: [Description]
+        What is affected: [Systems/services]
+        What to do: [Immediate actions for your team]
+        Status updates: [Channel/frequency]
+        Questions: Contact [BCP coordinator]
+
+    all_staff_notification:
+      who: "All employees"
+      when: "Within 1 hour of BCP activation"
+      method: "Email, Slack/Teams announcement, intranet"
+      content: "Situation summary, impact on work, expectations"
+
+    status_updates:
+      frequency: "Every 2 hours during active event, daily after stabilization"
+      channel: "Dedicated Slack channel, email distribution list"
+      content: "Current status, actions taken, next steps, timeline"
+
+  external_communication:
+    customers:
+      who: "Affected customers"
+      when: "Within 2 hours of BCP activation (if customer-facing impact)"
+      method: "Status page update, email, in-app notification"
+      message_template: |
+        We are currently experiencing [issue description].
+        Impact: [What customers may notice]
+        Status: We are actively working to resolve this.
+        Updates: Follow our status page at status.example.com
+        ETA: [Estimated resolution time or "investigating"]
+
+    regulatory:
+      who: "Applicable regulatory bodies"
+      when: "Per regulatory requirements (e.g., 72 hours for GDPR breach)"
+      method: "Formal notification per regulatory procedure"
+
+    media:
+      who: "Press inquiries"
+      when: "Only if media attention occurs"
+      method: "Prepared statement through communications team"
+      rule: "All media inquiries routed to designated spokesperson"
+
+    vendors_partners:
+      who: "Critical vendors and business partners"
+      when: "Within 4 hours if partner services affected"
+      method: "Direct contact via relationship manager"
+
+  contact_lists:
+    maintenance: "Updated quarterly"
+    storage: "Accessible offline (printed, mobile app, cloud-independent)"
+    includes:
+      - BCP team members (name, role, phone, email, alternate phone)
+      - Executive team
+      - Department leads
+      - Key vendor contacts
+      - Regulatory contacts
+      - Legal counsel
+      - Insurance broker
+      - PR/communications firm
+```
+
+## Recovery Procedures
+
+```yaml
+recovery_procedures:
+  immediate_response:
+    step_1: "Incident commander assesses situation and declares BCP activation"
+    step_2: "Notify BCP team and establish command structure"
+    step_3: "Activate communication plan"
+    step_4: "Assess damage and determine scope of disruption"
+    step_5: "Initiate appropriate recovery procedures based on scenario"
+
+  scenario_specific:
+    data_center_or_region_outage:
+      - Activate DR failover procedures
+      - Redirect traffic to DR region
+      - Verify service restoration
+      - Communicate status to stakeholders
+      - Plan return to primary when available
+
+    cybersecurity_incident:
+      - Engage incident response team
+      - Contain the threat (isolate affected systems)
+      - Assess data impact and potential breach
+      - Activate forensic investigation
+      - Restore from known-good backups if needed
+      - Notify legal and regulatory as required
+
+    pandemic_workforce_disruption:
+      - Activate remote work procedures
+      - Verify VPN and remote access capacity
+      - Redistribute critical functions if staff unavailable
+      - Implement shift rotations to maintain coverage
+      - Assess vendor ability to maintain service levels
+
+    key_vendor_failure:
+      - Assess impact on dependent business processes
+      - Activate vendor contingency plan
+      - Engage alternate vendor if available
+      - Implement manual workarounds as needed
+      - Communicate impact to affected stakeholders
+
+    facility_unavailable:
+      - Account for all personnel safety
+      - Activate alternate work site arrangements
+      - Redirect mail and deliveries
+      - Set up temporary communication channels
+      - Assess timeline for facility restoration
+
+  stabilization:
+    - Monitor recovered services continuously
+    - Address any residual issues
+    - Begin planning return to normal operations
+    - Continue stakeholder communication
+    - Document all actions and decisions
+
+  return_to_normal:
+    - Develop return-to-normal plan
+    - Execute failback procedures (if DR was activated)
+    - Verify data consistency and integrity
+    - Restore standard operating procedures
+    - Conduct post-event review
+    - Update BCP based on lessons learned
+```
+
+## Testing Schedule and Types
+
+```yaml
+testing_schedule:
+  tabletop_exercise:
+    frequency: "Quarterly"
+    duration: "2-3 hours"
+    participants: "BCP team, department leads, executive sponsor"
+    format: "Facilitated discussion of a scenario"
+    scenarios_to_rotate:
+      - Major cloud provider region outage
+      - Ransomware attack on production systems
+      - Key employee unavailability (bus factor scenario)
+      - Critical vendor goes out of business
+      - Office building inaccessible
+    output: "Exercise report with findings and action items"
+
+  functional_exercise:
+    frequency: "Semi-annually"
+    duration: "4-8 hours"
+    participants: "BCP team, IT operations, affected departments"
+    format: "Execute specific recovery procedures without full disruption"
+    examples:
+      - "Activate remote work for one department for a day"
+      - "Failover a non-production database and verify application connectivity"
+      - "Execute communication plan and verify contact list accuracy"
+      - "Restore a critical system from backup in an isolated environment"
+    output: "Functional test report with measured recovery times"
+
+  full_scale_exercise:
+    frequency: "Annually"
+    duration: "1-2 days"
+    participants: "All BCP team members, IT, communications, management"
+    format: "Simulate a major disruption and execute full recovery"
+    includes:
+      - "Activate BCP command structure"
+      - "Execute DR failover for production systems"
+      - "Activate communication plan"
+      - "Operate from alternate arrangements for set period"
+      - "Execute failback and return to normal"
+    output: "Full exercise report with comprehensive metrics and lessons learned"
+
+  testing_metrics:
+    - "Time to activate BCP command structure"
+    - "Time to complete communication notifications"
+    - "Contact list accuracy (% reachable)"
+    - "Actual RTO vs. target RTO per system"
+    - "Actual RPO vs. target RPO per system"
+    - "Number of issues identified"
+    - "Number of runbook corrections needed"
+```
+
+## BCP Maintenance Checklist
+
+```yaml
+bcp_maintenance_checklist:
+  quarterly:
+    - [ ] Contact lists verified and updated
+    - [ ] Tabletop exercise conducted
+    - [ ] BCP team roster reviewed
+    - [ ] Vendor contact information verified
+    - [ ] Communication channels tested
+
+  semi_annually:
+    - [ ] Functional exercise conducted
+    - [ ] Recovery procedures reviewed for accuracy
+    - [ ] Technology dependencies verified
+    - [ ] Vendor continuity capabilities confirmed
+
+  annually:
+    - [ ] Full-scale exercise conducted
+    - [ ] Business Impact Analysis refreshed
+    - [ ] Risk assessment updated
+    - [ ] BCP document fully reviewed and updated
+    - [ ] Executive review and sign-off obtained
+    - [ ] Training completed for all BCP team members
+    - [ ] Lessons learned from all exercises incorporated
+
+  triggered_by_change:
+    - [ ] New critical business process added
+    - [ ] Major organizational restructuring
+    - [ ] Technology platform migration
+    - [ ] New regulatory requirement
+    - [ ] Significant vendor change
+    - [ ] Actual disruption event (post-event update)
+```
+
+## Best Practices
+
+- Secure executive sponsorship: BCP without leadership commitment will not be taken seriously
+- Base recovery priorities on Business Impact Analysis, not assumptions or technical preferences
+- Test the communication plan independently: it fails more often than the technology recovery
+- Maintain contact lists as if your primary systems are unavailable (offline copies, mobile access)
+- Conduct tabletop exercises quarterly at minimum: they are low-cost and high-value for identifying gaps
+- Include non-IT scenarios in planning (pandemic, facility loss, key personnel unavailability)
+- Define clear activation criteria so there is no ambiguity about when to invoke the BCP
+- Keep the BCP document practical and actionable, not a shelf document written for auditors
+- Update the BCP after every significant organizational or technology change
+- Review and incorporate lessons from every exercise and every real event into the plan
+
+## Limitations
+
+- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.
+- Docs-only import: upstream templates and scripts not bundled.
+
+### Example
+
+```markdown
+Map this skill's control checklist to our current evidence and list gaps.
+```
+
+> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

package/bundled-skills/career-ops/SKILL.md

@@ -0,0 +1,186 @@
+---
+name: career-ops
+description: 'Multi-CLI job-search command center: evaluate offers, scan portals,
+  tailor CVs, track applications, prep interviews. Invoke per mode.'
+category: productivity
+risk: safe
+source: https://github.com/career-ops-hq/career-ops
+source_repo: career-ops-hq/career-ops
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/career-ops-hq/career-ops/blob/main/LICENSE
+compatibility: Docs-only; the upstream Node runtime helpers are not bundled. Portal
+  scans need network access and the user's own credentials; never submit applications
+  without explicit approval.
+arguments: mode
+user_invocable: true
+user-invocable: true
+argument-hint: '[scan | discover | deep | pdf | text | latex | latex-tex | cover |
+  email | add | expand | eu-swe | oferta | ofertas | apply | batch | tracker | agent-inbox
+  | pipeline | contacto | training | project | interview-prep | interview | interview/plan
+  | interview/practice | interview/debrief | interview-redflag | patterns | offer-prep
+  | titles | upskill | followup | reply-watch | outcome | update]'
+---
+
+# career-ops -- Router
+
+career-ops is a multi-CLI job-search command center. The routing below is shared across supported agent CLIs even when the invocation surface differs.
+
+## Project Root Resolution
+
+This catalog ships a **docs-only** router. Do not require the upstream `modes/`, `config/`, or `data/` tree. Use the routing table and discovery menu below. For the full Node runtime (PDF, portal scans, Playwright), clone [career-ops-hq/career-ops](https://github.com/career-ops-hq/career-ops).
+
+## Mode Routing
+
+Determine the mode from `$mode`:
+
+| Input | Mode |
+|-------|------|
+| (empty / no args) | `discovery` -- Show command menu |
+| JD text or URL (no sub-command) | **`auto-pipeline`** |
+| `oferta` | `oferta` |
+| `ofertas` | `ofertas` |
+| `contacto` | `contacto` |
+| `deep` | `deep` |
+| `interview-prep` | `interview-prep` |
+| `interview` | `interview` |
+| `eu-swe` | `regional/eu-swe` |
+| `eu-fintech` | `regional/eu-fintech` |
+| `interview/plan` | `interview/plan` |
+| `interview/practice` | `interview/practice` |
+| `interview/debrief` | `interview/debrief` |
+| `pdf` | `pdf` |
+| `text` | `text` |
+| `latex` | `latex` |
+| `latex-tex` | `latex-tex` |
+| `email` | `email` |
+| `add` | `add` |
+| `expand` | `expand` |
+| `training` | `training` |
+| `project` | `project` |
+| `tracker` | `tracker` |
+| `agent-inbox` | `agent-inbox` |
+| `inbox` | `agent-inbox` |
+| `pipeline` | `pipeline` |
+| `apply` | `apply` |
+| `scan` | `scan` |
+| `discover` | `discover` |
+| `batch` | `batch` |
+| `patterns` | `patterns` |
+| `offer-prep` | `offer-prep` |
+| `titles` | `titles` |
+| `upskill` | `upskill` |
+| `followup` | `followup` |
+| `reply-watch` | `reply-watch` |
+| `outcome` | `outcome` |
+| `interview-redflag` | `interview-redflag` |
+| `update` | `update` |
+| `cover` | `cover` |
+
+**Auto-pipeline detection:** If `$mode` is not a known sub-command AND contains JD text (keywords: "responsibilities", "requirements", "qualifications", "about the role", "we're looking for", company name + role) or a URL to a JD, execute `auto-pipeline`.
+
+If `$mode` is not a sub-command AND doesn't look like a JD, show discovery.
+
+---
+
+## Output Language Directive
+
+Before executing any mode, read `config/profile.yml` if it exists and resolve:
+
+- `language.output` → ISO language code for human-facing output. Default: `en`.
+- `language.modes_dir` → optional market-mode directory. This controls market vocabulary and local evaluation rules only.
+
+Inject this directive after loading the mode instructions and before producing any user-visible content:
+
+> Write all human-facing output in `{language.output}` regardless of the language of these instructions or of the job description. This includes reports, tracker notes, PDFs, cover letters, outreach, interview prep, form answers, and summaries. If `language.modes_dir` supplies market-specific vocabulary, keep the market logic but explain terms in `{language.output}` when needed.
+
+`language.output` is authoritative for prose. `modes_dir` is market context; it must not force the prose language.
+
+---
+
+## Discovery Mode (no arguments)
+
+If your CLI supports `/career-ops`, show this menu. In Codex, surface the same options in plain text and map the requested mode the same way.
+
+Concrete equivalents for Codex prompt-driven sessions:
+
+```text
+/career-ops {JD}           ↔ "Evaluate this JD with career-ops auto-pipeline: {JD or URL}"
+/career-ops scan           ↔ "Run the career-ops scan mode and summarize new matches."
+/career-ops pipeline       ↔ "Run the career-ops pipeline mode for data/pipeline.md."
+/career-ops pdf            ↔ "Run the career-ops pdf mode for the latest evaluated role."
+/career-ops email          ↔ "Run the career-ops email mode for the latest evaluated role."
+/career-ops tracker        ↔ "Run the career-ops tracker mode and summarize the current statuses."
+```
+
+Show this menu:
+
+```
+career-ops -- Command Center
+
+Available commands:
+  /career-ops {JD}      → AUTO-PIPELINE: evaluate + report + PDF + tracker (paste text or URL)
+  /career-ops pipeline  → Process pending URLs from inbox (data/pipeline.md)
+  /career-ops oferta    → Evaluation only A-F (no auto PDF)
+  /career-ops ofertas   → Compare and rank multiple offers
+  /career-ops contacto  → LinkedIn power move: find contacts + draft message
+  /career-ops deep      → Deep research prompt about company
+  /career-ops interview-prep → Generate company-specific interview prep doc
+  /career-ops interview    → Interactive profile/CV onboarding interview
+  /career-ops eu-swe    → Calibrate a European SWE application before CV/apply/interview
+  /career-ops eu-fintech → Scan 21 EU fintech portals for Product Manager roles (zero-token)
+  /career-ops interview/plan → Time-blocked prep plan for an upcoming interview
+  /career-ops interview/practice → Practice interview, one question at a time with feedback
+  /career-ops interview/debrief → Post-interview debrief: close gaps, predict next round
+  /career-ops pdf       → PDF only, ATS-optimized CV
+  /career-ops text      → Tailored markdown CV (mirrors cv.md, no PDF)
+  /career-ops latex     → Export CV as LaTeX/Overleaf .tex
+  /career-ops latex-tex → Tailor your own resume.tex in place (opt-in; cv.md stays default)
+  /career-ops cover     → Cover letter: standalone JD paste or /career-ops cover {slug}
+  /career-ops email     → Formal application email draft (draft-only; never sends, submits, or clicks)
+  /career-ops add       → Add a project/paper/role to your CV (fetch + preview + confirm)
+  /career-ops expand    → Auto-discover and add missing competencies from profile links
+  /career-ops training  → Evaluate course/cert against North Star
+  /career-ops project   → Evaluate portfolio project idea
+  /career-ops tracker   → Application status overview
+  /career-ops agent-inbox → Queue/drain requests for the next session (data/agent-inbox.md)
+  /career-ops apply     → Live application assistant (reads form + generates answers)
+  /career-ops scan      → Scan portals and discover new offers
+  /career-ops discover  → Resolve a company list to scannable ATS boards + append to portals.yml (zero-token)
+  /career-ops batch     → Batch processing with parallel workers
+  /career-ops patterns  → Analyze rejection patterns and improve targeting
+  /career-ops offer-prep → Read a received offer/contract with the candidate: clause walk + lawyer questions (not legal advice)
+  /career-ops titles    → Suggest adjacent job titles from your CV to broaden the search
+  /career-ops upskill   → Aggregate skill-gap analysis from your evaluated reports
+  /career-ops followup  → Follow-up cadence tracker: flag overdue, generate drafts
+  /career-ops outcome   → Record application outcome & archive artifacts
+  /career-ops update    → Update career-ops system files with diff preview + compat check
+
+Inbox: add URLs to data/pipeline.md → /career-ops pipeline
+Or paste a JD directly to run the full pipeline.
+```
+
+---
+
+## Context Loading by Mode
+
+Docs-only bundle: do not read `modes/*.md` from disk. Follow the routing table and mode summaries in this skill using general agent capabilities.
+
+## When to Use
+
+- The user pastes a job URL or description, asks to scan portals, tailor a CV, track applications, prep for interviews, or run another career-ops mode.
+
+## Limitations
+
+- Docs-only import: the upstream runtime helpers are not bundled, so modes that depend on them need the user's own installation.
+- Portal scans are read-only; never submit applications, send outreach, or share personal data without explicit per-action approval.
+- Job-market advice is general information, not professional career counseling.
+
+### Example
+
+```markdown
+Evaluate this job description against my profile and list matched and missing requirements.
+```
+
+> Adapted from [career-ops-hq/career-ops](https://github.com/career-ops-hq/career-ops) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: upstream runtime helpers not bundled.