opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/cloudformation/SKILL.md

@@ -0,0 +1,461 @@
+---
+name: cloudformation
+description: Deploy AWS resources with CloudFormation templates. Create stacks, use
+  nested stacks, and implement drift detection. Use when deploying AWS-native IaC.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# CloudFormation
+
+Deploy AWS infrastructure with native CloudFormation templates, change sets, nested stacks, and drift detection.
+
+## When to Use This Skill
+
+- Deploying AWS resources using AWS-native Infrastructure as Code
+- Creating repeatable, parameterized infrastructure templates
+- Managing multi-environment deployments (dev, staging, prod) with the same template
+- Implementing safe deployments with change sets and rollback protection
+- Detecting and remediating configuration drift
+- Organizing large infrastructure into nested stacks
+- Exporting/importing values between stacks
+
+## Prerequisites
+
+- AWS CLI v2 installed and configured
+- IAM permissions: `cloudformation:*`, plus permissions for all resources in the template
+- (Optional) `cfn-lint` installed for template validation (`pip install cfn-lint`)
+- S3 bucket for storing templates larger than 51,200 bytes
+
+## Template Structure
+
+```yaml
+AWSTemplateFormatVersion: '2010-09-09'
+Description: Production web application infrastructure
+
+Metadata:
+  AWS::CloudFormation::Interface:
+    ParameterGroups:
+      - Label: { default: "Environment" }
+        Parameters: [Environment, InstanceType]
+      - Label: { default: "Network" }
+        Parameters: [VpcId, SubnetIds]
+
+Parameters:
+  Environment:
+    Type: String
+    AllowedValues: [dev, staging, prod]
+    Default: dev
+
+  InstanceType:
+    Type: String
+    Default: t3.micro
+    AllowedValues: [t3.micro, t3.small, t3.medium, t3.large]
+
+  VpcId:
+    Type: AWS::EC2::VPC::Id
+    Description: VPC to deploy into
+
+  SubnetIds:
+    Type: List<AWS::EC2::Subnet::Id>
+    Description: Subnets for the application
+
+Conditions:
+  IsProd: !Equals [!Ref Environment, prod]
+  CreateReadReplica: !Equals [!Ref Environment, prod]
+
+Mappings:
+  RegionAMI:
+    us-east-1:
+      AL2023: ami-0abcdef1234567890
+    us-west-2:
+      AL2023: ami-0fedcba9876543210
+
+Resources:
+  SecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: !Sub '${Environment}-web-sg'
+      VpcId: !Ref VpcId
+      SecurityGroupIngress:
+        - IpProtocol: tcp
+          FromPort: 443
+          ToPort: 443
+          CidrIp: 0.0.0.0/0
+      Tags:
+        - Key: Name
+          Value: !Sub '${Environment}-web-sg'
+
+  LaunchTemplate:
+    Type: AWS::EC2::LaunchTemplate
+    Properties:
+      LaunchTemplateName: !Sub '${Environment}-web'
+      LaunchTemplateData:
+        ImageId: !FindInMap [RegionAMI, !Ref 'AWS::Region', AL2023]
+        InstanceType: !If [IsProd, t3.large, !Ref InstanceType]
+        MetadataOptions:
+          HttpTokens: required
+        SecurityGroupIds:
+          - !Ref SecurityGroup
+
+  AutoScalingGroup:
+    Type: AWS::AutoScaling::AutoScalingGroup
+    Properties:
+      AutoScalingGroupName: !Sub '${Environment}-web-asg'
+      LaunchTemplate:
+        LaunchTemplateId: !Ref LaunchTemplate
+        Version: !GetAtt LaunchTemplate.LatestVersionNumber
+      MinSize: !If [IsProd, 2, 1]
+      MaxSize: !If [IsProd, 10, 3]
+      DesiredCapacity: !If [IsProd, 4, 1]
+      VPCZoneIdentifier: !Ref SubnetIds
+      TargetGroupARNs:
+        - !Ref TargetGroup
+      HealthCheckType: ELB
+      HealthCheckGracePeriod: 300
+      Tags:
+        - Key: Name
+          Value: !Sub '${Environment}-web'
+          PropagateAtLaunch: true
+    UpdatePolicy:
+      AutoScalingRollingUpdate:
+        MinInstancesInService: !If [IsProd, 2, 0]
+        MaxBatchSize: 1
+        PauseTime: PT5M
+        WaitOnResourceSignals: true
+        SuspendProcesses:
+          - HealthCheck
+          - ReplaceUnhealthy
+          - AZRebalance
+          - AlarmNotification
+          - ScheduledActions
+
+  TargetGroup:
+    Type: AWS::ElasticLoadBalancingV2::TargetGroup
+    Properties:
+      Name: !Sub '${Environment}-web-tg'
+      Port: 8080
+      Protocol: HTTP
+      VpcId: !Ref VpcId
+      TargetType: instance
+      HealthCheckPath: /health
+      HealthCheckIntervalSeconds: 30
+      HealthyThresholdCount: 2
+      UnhealthyThresholdCount: 3
+
+Outputs:
+  SecurityGroupId:
+    Description: Web security group ID
+    Value: !Ref SecurityGroup
+    Export:
+      Name: !Sub '${Environment}-WebSecurityGroup'
+
+  AutoScalingGroupName:
+    Description: ASG name
+    Value: !Ref AutoScalingGroup
+    Export:
+      Name: !Sub '${Environment}-WebASG'
+```
+
+## Stack Operations
+
+```bash
+# Validate a template
+aws cloudformation validate-template --template-body file://template.yaml
+
+# Lint with cfn-lint (catches more issues)
+cfn-lint template.yaml
+
+# Create a stack
+aws cloudformation create-stack \
+  --stack-name production-web \
+  --template-body file://template.yaml \
+  --parameters \
+    ParameterKey=Environment,ParameterValue=prod \
+    ParameterKey=VpcId,ParameterValue=vpc-abc123 \
+    ParameterKey=SubnetIds,ParameterValue="subnet-aaa\\,subnet-bbb" \
+  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
+  --tags Key=Environment,Value=production Key=Team,Value=platform \
+  --enable-termination-protection \
+  --on-failure ROLLBACK
+
+# Wait for stack creation
+aws cloudformation wait stack-create-complete --stack-name production-web
+
+# Describe stack status and outputs
+aws cloudformation describe-stacks \
+  --stack-name production-web \
+  --query "Stacks[0].{Status:StackStatus,Outputs:Outputs}" \
+  --output table
+
+# List stack resources
+aws cloudformation list-stack-resources --stack-name production-web \
+  --query "StackResourceSummaries[].{Logical:LogicalResourceId,Physical:PhysicalResourceId,Type:ResourceType,Status:ResourceStatus}" \
+  --output table
+
+# Delete a stack
+aws cloudformation delete-stack --stack-name dev-web
+aws cloudformation wait stack-delete-complete --stack-name dev-web
+```
+
+## Change Sets (Safe Updates)
+
+```bash
+# Create a change set to preview changes before applying
+aws cloudformation create-change-set \
+  --stack-name production-web \
+  --change-set-name update-instance-type \
+  --template-body file://template.yaml \
+  --parameters \
+    ParameterKey=Environment,ParameterValue=prod \
+    ParameterKey=InstanceType,ParameterValue=t3.large \
+    ParameterKey=VpcId,UsePreviousValue=true \
+    ParameterKey=SubnetIds,UsePreviousValue=true \
+  --capabilities CAPABILITY_IAM
+
+# Describe the change set to review planned changes
+aws cloudformation describe-change-set \
+  --stack-name production-web \
+  --change-set-name update-instance-type \
+  --query "Changes[].{Action:ResourceChange.Action,Resource:ResourceChange.LogicalResourceId,Type:ResourceChange.ResourceType,Replacement:ResourceChange.Replacement}" \
+  --output table
+
+# Execute the change set (apply changes)
+aws cloudformation execute-change-set \
+  --stack-name production-web \
+  --change-set-name update-instance-type
+
+# Wait for update
+aws cloudformation wait stack-update-complete --stack-name production-web
+
+# Delete a change set without applying
+aws cloudformation delete-change-set \
+  --stack-name production-web \
+  --change-set-name update-instance-type
+```
+
+## Drift Detection
+
+```bash
+# Start drift detection
+DRIFT_ID=$(aws cloudformation detect-stack-drift \
+  --stack-name production-web \
+  --query 'StackDriftDetectionId' --output text)
+
+# Check drift detection status
+aws cloudformation describe-stack-drift-detection-status \
+  --stack-drift-detection-id $DRIFT_ID
+
+# View drifted resources
+aws cloudformation describe-stack-resource-drifts \
+  --stack-name production-web \
+  --stack-resource-drift-status-filters MODIFIED DELETED \
+  --query "StackResourceDrifts[].{Resource:LogicalResourceId,Status:StackResourceDriftStatus,Differences:PropertyDifferences}" \
+  --output table
+
+# Detect drift on a specific resource
+aws cloudformation detect-stack-resource-drift \
+  --stack-name production-web \
+  --logical-resource-id SecurityGroup
+```
+
+## Nested Stacks
+
+Parent template:
+
+```yaml
+AWSTemplateFormatVersion: '2010-09-09'
+Description: Parent stack - full application
+
+Parameters:
+  Environment:
+    Type: String
+    AllowedValues: [dev, staging, prod]
+
+Resources:
+  NetworkStack:
+    Type: AWS::CloudFormation::Stack
+    Properties:
+      TemplateURL: https://s3.amazonaws.com/my-cfn-templates/network.yaml
+      Parameters:
+        Environment: !Ref Environment
+        VpcCidr: "10.0.0.0/16"
+      Tags:
+        - Key: Environment
+          Value: !Ref Environment
+
+  DatabaseStack:
+    Type: AWS::CloudFormation::Stack
+    DependsOn: NetworkStack
+    Properties:
+      TemplateURL: https://s3.amazonaws.com/my-cfn-templates/database.yaml
+      Parameters:
+        Environment: !Ref Environment
+        VpcId: !GetAtt NetworkStack.Outputs.VpcId
+        SubnetIds: !GetAtt NetworkStack.Outputs.PrivateSubnetIds
+
+  AppStack:
+    Type: AWS::CloudFormation::Stack
+    DependsOn: [NetworkStack, DatabaseStack]
+    Properties:
+      TemplateURL: https://s3.amazonaws.com/my-cfn-templates/app.yaml
+      Parameters:
+        Environment: !Ref Environment
+        VpcId: !GetAtt NetworkStack.Outputs.VpcId
+        SubnetIds: !GetAtt NetworkStack.Outputs.PrivateSubnetIds
+        DbEndpoint: !GetAtt DatabaseStack.Outputs.Endpoint
+
+Outputs:
+  VpcId:
+    Value: !GetAtt NetworkStack.Outputs.VpcId
+  AppUrl:
+    Value: !GetAtt AppStack.Outputs.LoadBalancerDNS
+```
+
+```bash
+# Package nested templates (uploads local references to S3)
+aws cloudformation package \
+  --template-file parent.yaml \
+  --s3-bucket my-cfn-templates \
+  --output-template-file packaged.yaml
+
+# Deploy the packaged template
+aws cloudformation deploy \
+  --template-file packaged.yaml \
+  --stack-name production-app \
+  --parameter-overrides Environment=prod \
+  --capabilities CAPABILITY_IAM CAPABILITY_AUTO_EXPAND \
+  --tags Environment=production
+```
+
+## Intrinsic Functions Reference
+
+```yaml
+# Ref - reference a parameter or resource
+SecurityGroupId: !Ref SecurityGroup
+
+# GetAtt - get an attribute of a resource
+SecurityGroupArn: !GetAtt SecurityGroup.GroupId
+
+# Sub - string substitution
+BucketName: !Sub '${Environment}-${AWS::AccountId}-data'
+
+# Join - concatenate strings
+PolicyArn: !Join ['', ['arn:aws:iam::', !Ref 'AWS::AccountId', ':policy/MyPolicy']]
+
+# Select - pick from a list
+FirstSubnet: !Select [0, !Ref SubnetIds]
+
+# Split - split a string
+FirstPart: !Select [0, !Split ['-', !Ref 'AWS::StackName']]
+
+# If - conditional value
+InstanceSize: !If [IsProd, t3.large, t3.micro]
+
+# Equals - condition definition
+Conditions:
+  IsProd: !Equals [!Ref Environment, prod]
+
+# ImportValue - cross-stack reference
+VpcId: !ImportValue production-VpcId
+
+# Cidr - generate CIDR blocks
+Subnets: !Cidr [!GetAtt VPC.CidrBlock, 6, 8]
+
+# GetAZs - list availability zones
+AZ: !Select [0, !GetAZs '']
+```
+
+## Stack Policy (Prevent Accidental Replacements)
+
+```bash
+# Apply a stack policy that prevents replacement of the database
+aws cloudformation set-stack-policy \
+  --stack-name production-web \
+  --stack-policy-body '{
+    "Statement": [
+      {
+        "Effect": "Allow",
+        "Action": "Update:*",
+        "Principal": "*",
+        "Resource": "*"
+      },
+      {
+        "Effect": "Deny",
+        "Action": "Update:Replace",
+        "Principal": "*",
+        "Resource": "LogicalResourceId/Database"
+      },
+      {
+        "Effect": "Deny",
+        "Action": "Update:Delete",
+        "Principal": "*",
+        "Resource": "LogicalResourceId/Database"
+      }
+    ]
+  }'
+```
+
+## Stack Events and Debugging
+
+```bash
+# View stack events (most recent first)
+aws cloudformation describe-stack-events \
+  --stack-name production-web \
+  --query "StackEvents[?ResourceStatus=='CREATE_FAILED' || ResourceStatus=='UPDATE_FAILED'].{Time:Timestamp,Resource:LogicalResourceId,Status:ResourceStatus,Reason:ResourceStatusReason}" \
+  --output table
+
+# Continue a rollback that is stuck
+aws cloudformation continue-update-rollback \
+  --stack-name production-web \
+  --resources-to-skip SecurityGroup
+
+# Cancel an in-progress update
+aws cloudformation cancel-update-stack --stack-name production-web
+
+# Get template from an existing stack
+aws cloudformation get-template \
+  --stack-name production-web \
+  --template-stage Processed \
+  --query TemplateBody \
+  --output text > current-template.yaml
+```
+
+## Troubleshooting
+
+| Problem | Cause | Fix |
+|---|---|---|
+| CREATE_FAILED on IAM resource | Missing CAPABILITY_IAM | Add `--capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM` |
+| Stack stuck in UPDATE_ROLLBACK_FAILED | Resource cannot be rolled back | Use `continue-update-rollback` with `--resources-to-skip` |
+| Nested stack fails | Template URL wrong or S3 access denied | Use `aws cloudformation package` to upload; check bucket policy |
+| Circular dependency error | Two resources reference each other | Break the cycle with a third resource or use `DependsOn` |
+| Drift detected | Manual changes made outside CloudFormation | Re-apply the template or update template to match current state |
+| Change set shows no changes | Template and parameters identical | Verify the diff; check if the change is parameter-only |
+| Template validation error | YAML syntax or invalid resource property | Run `cfn-lint`; check property names against docs |
+| Export name already exists | Another stack uses the same export name | Use unique export names with `!Sub '${AWS::StackName}-Name'` |
+| Delete fails - resource in use | Dependent resource outside the stack | Remove the dependency first; check for SG references |
+
+## Related Skills
+
+- terraform-aws (`terraform-aws`) - Alternative IaC with Terraform
+- aws-iam (`aws-iam`) - IAM resources in templates
+- aws-vpc (`aws-vpc`) - Network infrastructure templates
+- aws-ec2 (`aws-ec2`) - Compute resources in templates
+- aws-s3 (`aws-s3`) - Storage resources in templates
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+

package/bundled-skills/code-review-sensei/SKILL.md

@@ -0,0 +1,177 @@
+---
+name: code-review-sensei
+version: 1.0.0
+description: Expert code reviewer that catches bugs, security issues, performance
+  problems, and design flaws with actionable fix suggestions.
+author: yundu-ai
+tags:
+- code-review
+- security
+- performance
+- quality
+- debugging
+model: claude
+source_repo: demo112/yunqu-ai-skills
+source_type: community
+source: community
+date_added: '2026-09-21'
+risk: unknown
+---
+## When to Use
+- Use when this upstream workflow matches the user's stated goal.
+- Use when the task requires the procedures documented in this skill.
+
+# Code Review Sensei
+
+You are a senior code reviewer with 15+ years of experience across multiple languages and domains. You review code like a mentor — firm on quality, clear in feedback, and always educational.
+
+## Review Framework
+
+For every code review, evaluate across 5 dimensions:
+
+### 1. 🐛 Correctness
+- Logic errors
+- Off-by-one errors
+- Null/undefined handling
+- Race conditions
+- State management bugs
+- Error handling completeness
+
+### 2. 🔒 Security
+- Input validation and sanitization
+- SQL injection / XSS / CSRF risks
+- Authentication/authorization gaps
+- Secret exposure (hardcoded keys, tokens in logs)
+- Dependency vulnerabilities
+- Data exposure (over-fetching, missing field-level auth)
+
+### 3. ⚡ Performance
+- Algorithmic complexity (O(n²) where O(n) suffices?)
+- Unnecessary allocations/copies
+- Missing indexes or N+1 queries
+- Blocking I/O in async contexts
+- Memory leaks (unclosed connections, event listeners)
+- Caching opportunities
+
+### 4. 🏗️ Design
+- Single Responsibility Principle
+- Coupling between components
+- API contract clarity
+- Error propagation strategy
+- Testability
+- Extensibility without modification
+
+### 5. 📖 Readability
+- Naming clarity
+- Function/method length
+- Nesting depth
+- Comment quality (why, not what)
+- Consistent style
+
+## Review Output Format
+
+```
+## Code Review: [File/Component Name]
+
+### Summary
+[1-2 sentence overall assessment]
+
+### Critical Issues 🔴
+[Issues that MUST be fixed before merge]
+
+**Issue 1: [Title]**
+- **Dimension**: Security / Correctness / Performance
+- **Location**: Line X-Y
+- **Problem**: [What's wrong]
+- **Impact**: [What could go wrong]
+- **Fix**: 
+```language
+// Fixed code here
+```
+
+### Warnings 🟡
+[Issues that should be addressed soon]
+
+**Issue 2: [Title]**
+- **Dimension**: Performance / Design
+- **Location**: Line X-Y  
+- **Problem**: [What's suboptimal]
+- **Suggestion**: [How to improve]
+
+### Suggestions 🟢
+[Nice-to-have improvements]
+
+### Positive Notes ✅
+[What's done well — always include at least one]
+
+### Metrics
+| Dimension | Score (1-5) | Notes |
+|-----------|-------------|-------|
+| Correctness | | |
+| Security | | |
+| Performance | | |
+| Design | | |
+| Readability | | |
+```
+
+## Language-Specific Checks
+
+### Python
+- Use `pathlib` over `os.path`
+- Check for mutable default arguments (`def foo(x=[])`)
+- Verify proper resource cleanup (`with` statements)
+- Check for type annotation completeness
+- Look for proper use of `async/await`
+
+### JavaScript/TypeScript
+- Check for `==` vs `===`
+- Verify proper promise handling (no unhandled rejections)
+- Look for memory leaks in event listeners / subscriptions
+- Check TypeScript `any` usage
+- Verify proper error boundaries in React
+
+### Go
+- Check error handling (no swallowed errors)
+- Verify goroutine cleanup
+- Look for unbuffered channels that could deadlock
+- Check for proper context propagation
+- Verify mutex usage and potential deadlocks
+
+### Rust
+- Check for unnecessary `.clone()`
+- Verify lifetime annotations
+- Look for potential panics (`unwrap()` in production)
+- Check for proper error propagation with `?`
+- Verify unsafe block justification
+
+## Anti-Patterns to Always Flag
+
+1. **God Function**: >50 lines doing too many things → Extract functions
+2. **Magic Numbers**: Unnamed constants → Named constants or config
+3. **Copy-Paste Code**: Duplicated logic → Extract shared function
+4. **Premature Optimization**: Complex code for theoretical speedup → Benchmark first
+5. **Over-Engineering**: Abstract factory for 2 implementations → Simplify
+6. **Swallowed Errors**: `except: pass` or `.catch(() => {})` → At minimum, log it
+7. **Global Mutable State**: Module-level mutable variables → Dependency injection
+
+## Review Behavior Rules
+
+1. **Always read the FULL diff before commenting** — partial reviews miss context
+2. **Never suggest a rewrite** — suggest incremental improvements
+3. **Always explain WHY** — "This is wrong" is not useful; "This causes X because Y" is
+4. **Prioritize by impact** — Security > Correctness > Performance > Design > Style
+5. **Be specific** — Point to exact lines, give exact fixes
+6. **Acknowledge good code** — Reviews aren't just for finding problems
+
+
+## Examples
+
+```text
+User: Apply this skill to my current task.
+Assistant: Follow the workflow in this skill, cite limitations, and ask before risky steps.
+```
+
+## Limitations
+
+- Imported upstream skill; verify credentials, permissions, and safety boundaries before execution.
+- Does not replace environment-specific validation, testing, or maintainer review.

package/bundled-skills/codebase-onboarding/README.md

@@ -0,0 +1,42 @@
+# Codebase Onboarding
+
+This is an official Ontoly Agent Skill. It is independently installable and teaches an agent how to use Ontoly for codebase onboarding.
+
+## Version
+
+- Skill version: 1.0.0
+- Minimum Ontoly version: 1.0.0
+- Required capabilities: `ExplainArchitecture`, `FindEntrypoints`, `GraphStatistics`, `FindFeatureOwner`, `EvidencePack`
+- Enhancement: LLM Enhancement
+- Deprecated: no
+
+## Install
+
+Install this skill with any Agent Skills compatible installer that supports `SKILL.md` directories, or copy this folder into your agent skills directory.
+
+## Use
+
+Ask the agent a task such as:
+
+> What does this repository do?
+
+The agent should build or verify the Ontoly graph, use MCP capabilities, cite evidence, and only inspect files as a fallback.
+
+## Public Docs
+
+- [Agent Skills](https://ontoly.xyz/docs/agent-skills)
+- [Skills Overview](https://ontoly.xyz/docs/skills-overview)
+- [MCP](https://ontoly.xyz/docs/mcp)
+- [Capabilities](https://ontoly.xyz/docs/capabilities)
+- [Skills Validation](https://ontoly.xyz/docs/skills-validation)
+
+## Shared References
+
+This skill depends on the shared Ontoly workflow in [reference/workflow.md](reference/workflow.md).
+
+## Learn more
+
+- Documentation: https://ontoly.xyz/docs
+- This skill on the web: https://ontoly.xyz/skills#codebase-onboarding
+- All Ontoly Agent Skills: https://ontoly.xyz/skills
+- Install via skills.sh: https://www.skills.sh/?q=0xsarwagya/ontoly