opencode-skills-collection 4.1.14 → 4.1.16

package/bundled-skills/security-compliance-compliance-check/resources/implementation-playbook.md

@@ -1,6 +1,6 @@
 # Regulatory Compliance Check Implementation Playbook
 
-This file contains detailed patterns, checklists, and code samples referenced by the skill.
+This is a control-design scaffold, not a compliance implementation or certification. Methods such as storage, authorization, applicability checks and cryptographic operations are project dependencies and are not bundled. Do not run these class sketches or report a control implemented without independent evidence. Bind the framework/version, jurisdiction, scope, accountable reviewer and evidence before any consequential assessment.
 
 # Regulatory Compliance Check
 
@@ -100,12 +100,7 @@ class ComplianceAnalyzer:
                     'Store card data',
                     'Transmit card data'
                 ],
-                'compliance_levels': {
-                    'Level 1': '>6M transactions/year',
-                    'Level 2': '1M-6M transactions/year',
-                    'Level 3': '20K-1M transactions/year',
-                    'Level 4': '<20K transactions/year'
-                }
+                'assessment_scope': 'Confirm merchant/provider category, payment-brand/acquirer rules and current edition with a qualified reviewer'
             }
         }
     
@@ -183,50 +178,13 @@ class ConsentManager:
 '''
 
         # 2. Right to Erasure (Right to be Forgotten)
-        controls['right_to_erasure'] = '''
-class DataErasureService:
-    def process_erasure_request(self, user_id, verification_token):
-        """
-        Process GDPR Article 17 erasure request
-        """
-        # Verify request authenticity
-        if not self.verify_erasure_token(user_id, verification_token):
-            raise ValueError("Invalid erasure request")
-        
-        erasure_log = {
-            'user_id': user_id,
-            'requested_at': datetime.utcnow(),
-            'data_categories': []
-        }
-        
-        # 1. Personal data
-        self.erase_user_profile(user_id)
-        erasure_log['data_categories'].append('profile')
-        
-        # 2. User-generated content (anonymize instead of delete)
-        self.anonymize_user_content(user_id)
-        erasure_log['data_categories'].append('content_anonymized')
-        
-        # 3. Analytics data
-        self.remove_from_analytics(user_id)
-        erasure_log['data_categories'].append('analytics')
-        
-        # 4. Backup data (schedule deletion)
-        self.schedule_backup_deletion(user_id)
-        erasure_log['data_categories'].append('backups_scheduled')
-        
-        # 5. Notify third parties
-        self.notify_processors_of_erasure(user_id)
-        
-        # Keep minimal record for legal compliance
-        self.store_erasure_record(erasure_log)
-        
-        return {
-            'status': 'completed',
-            'erasure_id': erasure_log['id'],
-            'categories_erased': erasure_log['data_categories']
-        }
-'''
+        controls['right_to_erasure'] = """
+Verify the requester and exact tenant/user scope, assess applicable exceptions and
+legal holds, then create a reviewed erasure plan across primary data, processors
+and backups. Record each destination's actual result; scheduled backup expiry is
+pending, not completed erasure. Retain minimal authorized audit evidence and report
+partial failures explicitly. Identity, retention and processor adapters are not bundled.
+"""
 
         # 3. Data Portability
         controls['data_portability'] = '''
@@ -347,6 +305,8 @@ class MFAEnforcement:
         elif user.mfa_method == 'sms':
             factors.append(self.verify_sms_code(user))
             
+        else:
+            return False  # Missing/unsupported second factor must not pass MFA
         # Factor 3: Biometric (something you are) - optional
         if user.biometric_enabled:
             factors.append(self.verify_biometric(user))
@@ -456,7 +416,7 @@ class ComplianceAuditLogger:
     
     def log_event(self, event_type, details):
         """
-        Create tamper-proof audit log entry
+        Construct an illustrative audit entry; storage integrity remains unimplemented
         """
         log_entry = {
             'id': str(uuid.uuid4()),
@@ -466,33 +426,32 @@ class ComplianceAuditLogger:
             'ip_address': self._get_ip_address(),
             'user_agent': request.headers.get('User-Agent'),
             'session_id': session.get('id'),
-            'details': details,
+            'details': {key: details[key] for key in ('event_code', 'correlation_id') if key in details},
             'compliance_flags': self._get_compliance_flags(event_type)
         }
         
         # Add integrity check
         log_entry['checksum'] = self._calculate_checksum(log_entry)
         
-        # Store in immutable log
+        # Store via a separately verified, access-controlled append-only implementation
         self._store_audit_log(log_entry)
         
         # Real-time alerting for critical events
-        if self._is_critical_event(event_type):
-            self._send_security_alert(log_entry)
+        # Notifications require an authorized destination and separately reviewed
+        # sanitized payload. This scaffold does not send external alerts.
         
         return log_entry
     
     def _calculate_checksum(self, entry):
         """
-        Create tamper-evident checksum
+        Compute an illustrative digest; this does not create immutable storage
         """
         # Include previous entry hash for blockchain-like integrity
         previous_hash = self._get_previous_entry_hash()
         
         content = json.dumps(entry, sort_keys=True)
-        return hashlib.sha256(
-            f"{previous_hash}{content}{SECRET_KEY}".encode()
-        ).hexdigest()
+        # A digest does not bind a trusted checkpoint or prevent rewriting.
+        return hashlib.sha256(f"{previous_hash}:{content}".encode()).hexdigest()
 ```
 
 **Compliance Reporting**
@@ -585,14 +544,14 @@ class PHIAccessControl:
 class PHIEncryption:
     def encrypt_phi_at_rest(self, phi_data):
         """
-        HIPAA-compliant encryption for PHI
+        Illustrative PHI encryption design; validate the actual module and policy
         """
         # Use FIPS 140-2 validated encryption
         encryption_config = {
             'algorithm': 'AES-256-CBC',
             'key_derivation': 'PBKDF2',
             'iterations': 100000,
-            'validation': 'FIPS-140-2-Level-2'
+            'validation': None  # Requires a real validated module/certificate and configuration
         }
         
         # Encrypt PHI fields
@@ -680,7 +639,7 @@ class CardDataProtection:
         
     def handle_card_data(self, card_info):
         """
-        PCI-DSS compliant card data handling
+        Illustrative card-data minimization; assessment still required
         """
         # Immediately tokenize
         token = self.tokenize_card(card_info)
@@ -769,12 +728,7 @@ class PCIVulnerabilityManagement:
                 'scope': 'All external-facing IP addresses',
                 'passing_criteria': 'Clean scan with no failures'
             },
-            'remediation_timeline': {
-                'critical': '24 hours',
-                'high': '7 days',
-                'medium': '30 days',
-                'low': '90 days'
-            }
+            'remediation_policy': 'Verify exact applicable requirements and approved risk policy; no universal illustrative deadlines'
         }
         
         return scan_config
@@ -788,116 +742,27 @@ class PCIVulnerabilityManagement:
 
 Set up automated compliance monitoring:
 
-**Compliance Dashboard**
+**Evidence register rather than fictional dashboard metrics**
+
 ```python
-class ComplianceDashboard:
-    def generate_realtime_dashboard(self):
-        """
-        Real-time compliance status dashboard
-        """
-        dashboard = {
-            'timestamp': datetime.utcnow(),
-            'overall_compliance_score': 0,
-            'regulations': {}
-        }
-        
-        # GDPR Compliance Metrics
-        dashboard['regulations']['GDPR'] = {
-            'score': self.calculate_gdpr_score(),
-            'status': 'COMPLIANT',
-            'metrics': {
-                'consent_rate': '87%',
-                'data_requests_sla': '98% within 30 days',
-                'privacy_policy_version': '2.1',
-                'last_dpia': '2025-06-15',
-                'encryption_coverage': '100%',
-                'third_party_agreements': '12/12 signed'
-            },
-            'issues': [
-                {
-                    'severity': 'medium',
-                    'issue': 'Cookie consent banner update needed',
-                    'due_date': '2025-08-01'
-                }
-            ]
-        }
-        
-        # HIPAA Compliance Metrics
-        dashboard['regulations']['HIPAA'] = {
-            'score': self.calculate_hipaa_score(),
-            'status': 'NEEDS_ATTENTION',
-            'metrics': {
-                'risk_assessment_current': True,
-                'workforce_training_compliance': '94%',
-                'baa_agreements': '8/8 current',
-                'encryption_status': 'All PHI encrypted',
-                'access_reviews': 'Completed 2025-06-30',
-                'incident_response_tested': '2025-05-15'
-            },
-            'issues': [
-                {
-                    'severity': 'high',
-                    'issue': '3 employees overdue for training',
-                    'due_date': '2025-07-25'
-                }
-            ]
-        }
-        
-        return dashboard
+def build_control_register(control_ids, evidence_by_id):
+    rows = []
+    for control_id in control_ids:
+        evidence = evidence_by_id.get(control_id)
+        rows.append({
+            "control_id": control_id,
+            "status": "evidence_recorded" if evidence else "unknown",
+            "evidence": evidence,
+            "assessment": "requires_qualified_review",
+        })
+    return rows
 ```
 
+Missing evidence is unknown, never zero or compliant. Validate evidence provenance, freshness, scope and control applicability before assessment. A record merely points to evidence; neither a numeric score nor successful code execution certifies compliance.
+
 **Automated Compliance Checks**
-```yaml
-# .github/workflows/compliance-check.yml
-name: Compliance Checks
-
-on:
-  push:
-    branches: [main, develop]
-  pull_request:
-  schedule:
-    - cron: '0 0 * * *'  # Daily compliance check
-
-jobs:
-  compliance-scan:
-    runs-on: ubuntu-latest
-    
-    steps:
-    - uses: actions/checkout@v3
-    
-    - name: GDPR Compliance Check
-      run: |
-        python scripts/compliance/gdpr_checker.py
-        
-    - name: Security Headers Check
-      run: |
-        python scripts/compliance/security_headers.py
-        
-    - name: Dependency License Check
-      run: |
-        license-checker --onlyAllow 'MIT;Apache-2.0;BSD-3-Clause;ISC'
-        
-    - name: PII Detection Scan
-      run: |
-        # Scan for hardcoded PII
-        python scripts/compliance/pii_scanner.py
-        
-    - name: Encryption Verification
-      run: |
-        # Verify all sensitive data is encrypted
-        python scripts/compliance/encryption_checker.py
-        
-    - name: Generate Compliance Report
-      if: always()
-      run: |
-        python scripts/compliance/generate_report.py > compliance-report.json
-        
-    - name: Upload Compliance Report
-      uses: actions/upload-artifact@v3
-      with:
-        name: compliance-report
-        path: compliance-report.json
-```
+Use the project's existing locked scanners and protected CI, validate report coverage and execution status, and retain results only in an authorized evidence store. The guide does not bundle compliance scripts or a certification workflow. Approval, notifications and artifact uploads require their actual configured scope.
+
 
 ### 8. Compliance Documentation
 
@@ -907,7 +772,7 @@ Generate required documentation:
 ```python
 def generate_privacy_policy(company_info, data_practices):
     """
-    Generate GDPR-compliant privacy policy
+    Draft privacy-policy inputs for qualified review
     """
     policy = f"""
 # Privacy Policy
@@ -918,7 +783,7 @@ def generate_privacy_policy(company_info, data_practices):
 {company_info['name']}
 {company_info['address']}
 Email: {company_info['privacy_email']}
-DPO: {company_info.get('dpo_contact', 'privacy@company.com')}
+DPO: {company_info.get('dpo_contact', 'Not established; verify applicability and actual contact')}
 
 ## 2. Data We Collect
 {generate_data_collection_section(data_practices['data_types'])}
@@ -961,3 +826,7 @@ To exercise your rights, contact: {company_info['privacy_email']}
 8. **Training Materials**: Workforce compliance training resources
 
 Focus on practical implementation that balances compliance requirements with business operations and user experience.
+
+## Evidence and legal boundaries
+
+Regulatory mapping examples are prompts for applicability review, not a complete statement of obligations. [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) requires contextual purpose, legal basis, storage limitation and rights handling. [HHS Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html) distinguishes required documentation retention from a universal operational-log period. Identify the exact applicable PCI/SOC/ISO scope with a qualified reviewer; do not infer certification from software controls. Hashes need independently protected checkpoints, durable append-only storage and recovery tests; the sketch provides none of these. Do not describe its storage as tamper-proof or a fictional dashboard as measured evidence.

package/bundled-skills/security-requirement-extraction/resources/implementation-playbook.md

@@ -1,6 +1,6 @@
 # Security Requirement Extraction Implementation Playbook
 
-This file contains detailed patterns, checklists, and code samples referenced by the skill.
+These are candidate-requirement and traceability templates, not evidence that controls are implemented or a compliance assessment. Framework control IDs are historical illustrations: verify the exact framework edition, applicability and authoritative control text before reuse. More mapped requirements do not prove stronger coverage; evaluate implementation evidence and tests with the control owner.
 
 # Security Requirement Extraction
 
@@ -333,8 +333,10 @@ class RequirementExtractor:
     def _calculate_priority(self, impact: str, likelihood: str) -> Priority:
         """Calculate requirement priority from threat attributes."""
         score_map = {"LOW": 1, "MEDIUM": 2, "HIGH": 3, "CRITICAL": 4}
-        impact_score = score_map.get(impact.upper(), 2)
-        likelihood_score = score_map.get(likelihood.upper(), 2)
+        if impact.upper() not in score_map or likelihood.upper() not in score_map:
+            raise ValueError("Unknown impact/likelihood; obtain an assessment")
+        impact_score = score_map[impact.upper()]
+        likelihood_score = score_map[likelihood.upper()]
 
         combined = impact_score * likelihood_score
 
@@ -524,7 +526,7 @@ class ComplianceMapper:
         framework: ComplianceFramework
     ) -> Dict[str, List[str]]:
         """Identify compliance gaps."""
-        gaps = {"missing_controls": [], "weak_coverage": []}
+        gaps = {"missing_controls": [], "assessment_required": []}
         framework_controls = self.FRAMEWORK_CONTROLS.get(framework, {})
 
         for domain, controls in framework_controls.items():
@@ -535,8 +537,8 @@ class ComplianceMapper:
                 )
                 if not matching:
                     gaps["missing_controls"].append(f"{framework.value}:{control}")
-                elif len(matching) < 2:
-                    gaps["weak_coverage"].append(f"{framework.value}:{control}")
+                else:
+                    gaps["assessment_required"].append(f"{framework.value}:{control}")
 
         return gaps
 ```

package/bundled-skills/senior-fullstack/SKILL.md

@@ -1,220 +1,44 @@
 ---
 name: senior-fullstack
-description: "Complete toolkit for senior fullstack with modern tools and best practices."
+description: "Coordinate full-stack implementation across interface, service, database and delivery boundaries using the existing project stack and verified checks."
 risk: critical
 source: community
 date_added: "2026-02-27"
 ---
 
-# Senior Fullstack
+# Full-Stack Implementation Review
 
-Complete toolkit for senior fullstack with modern tools and best practices.
-
-## Quick Start
-
-### Main Capabilities
-
-This skill provides three core capabilities through automated scripts:
-
-```bash
-# Script 1: Fullstack Scaffolder
-python scripts/fullstack_scaffolder.py [options]
-
-# Script 2: Project Scaffolder
-python scripts/project_scaffolder.py [options]
-
-# Script 3: Code Quality Analyzer
-python scripts/code_quality_analyzer.py [options]
-```
-
-## Core Capabilities
-
-### 1. Fullstack Scaffolder
-
-Automated tool for fullstack scaffolder tasks.
-
-**Features:**
-- Automated scaffolding
-- Best practices built-in
-- Configurable templates
-- Quality checks
-
-**Usage:**
-```bash
-python scripts/fullstack_scaffolder.py <project-path> [options]
-```
-
-### 2. Project Scaffolder
-
-Comprehensive analysis and optimization tool.
-
-**Features:**
-- Deep analysis
-- Performance metrics
-- Recommendations
-- Automated fixes
-
-**Usage:**
-```bash
-python scripts/project_scaffolder.py <target-path> [--verbose]
-```
-
-### 3. Code Quality Analyzer
-
-Advanced tooling for specialized tasks.
-
-**Features:**
-- Expert-level automation
-- Custom configurations
-- Integration ready
-- Production-grade output
-
-**Usage:**
-```bash
-python scripts/code_quality_analyzer.py [arguments] [options]
-```
-
-## Reference Documentation
-
-### Tech Stack Guide
-
-Comprehensive guide available in `references/tech_stack_guide.md`:
-
-- Detailed patterns and practices
-- Code examples
-- Best practices
-- Anti-patterns to avoid
-- Real-world scenarios
-
-### Architecture Patterns
-
-Complete workflow documentation in `references/architecture_patterns.md`:
-
-- Step-by-step processes
-- Optimization strategies
-- Tool integrations
-- Performance tuning
-- Troubleshooting guide
-
-### Development Workflows
-
-Technical reference guide in `references/development_workflows.md`:
-
-- Technology stack details
-- Configuration examples
-- Integration patterns
-- Security considerations
-- Scalability guidelines
-
-## Tech Stack
-
-**Languages:** TypeScript, JavaScript, Python, Go, Swift, Kotlin
-**Frontend:** React, Next.js, React Native, Flutter
-**Backend:** Node.js, Express, GraphQL, REST APIs
-**Database:** PostgreSQL, Prisma, NeonDB, Supabase
-**DevOps:** Docker, Kubernetes, Terraform, GitHub Actions, CircleCI
-**Cloud:** AWS, GCP, Azure
-
-## Development Workflow
-
-### 1. Setup and Configuration
-
-```bash
-# Install dependencies
-npm install
-# or
-pip install -r requirements.txt
-
-# Configure environment
-cp .env.example .env
-```
-
-### 2. Run Quality Checks
-
-```bash
-# Use the analyzer script
-python scripts/project_scaffolder.py .
-
-# Review recommendations
-# Apply fixes
-```
-
-### 3. Implement Best Practices
-
-Follow the patterns and practices documented in:
-- `references/tech_stack_guide.md`
-- `references/architecture_patterns.md`
-- `references/development_workflows.md`
-
-## Best Practices Summary
-
-### Code Quality
-- Follow established patterns
-- Write comprehensive tests
-- Document decisions
-- Review regularly
-
-### Performance
-- Measure before optimizing
-- Use appropriate caching
-- Optimize critical paths
-- Monitor in production
-
-### Security
-- Validate all inputs
-- Use parameterized queries
-- Implement proper authentication
-- Keep dependencies updated
-
-### Maintainability
-- Write clear code
-- Use consistent naming
-- Add helpful comments
-- Keep it simple
-
-## Common Commands
-
-```bash
-# Development
-npm run dev
-npm run build
-npm run test
-npm run lint
+## When to Use
 
-# Analysis
-python scripts/project_scaffolder.py .
-python scripts/code_quality_analyzer.py --analyze
+Use when a feature spans the browser, backend service and database, or when reviewing an existing full-stack implementation for integration gaps.
 
-# Deployment
-docker build -t app:latest .
-docker-compose up -d
-kubectl apply -f k8s/
-```
+## Workflow
 
-## Troubleshooting
+1. Inspect the project's actual stack, build commands and conventions. Trace one user journey through interface state, API request, authorization, data access and response handling.
+2. Define the request/response contract, permission checks, input validation and failure states before changing code. Keep database migrations and external side effects explicit.
+3. Implement the smallest coherent slice using existing dependencies. Separate interface presentation, domain logic and persistence; use parameterized queries and server-side authorization.
+4. Run project-owned checks for the changed behavior: unit tests for rules, integration tests for permissions and persistence, and browser tests for the complete journey. Record which checks actually ran and any missing environments.
+5. Prepare a migration, rollback and release plan where needed. Dependency installation, destructive data changes, external notifications and deployments require authorization appropriate to that action.
 
-### Common Issues
+## Example
 
-Check the comprehensive troubleshooting section in `references/development_workflows.md`.
+User: "Add a billing settings page."
 
-### Getting Help
+Assistant: Inspect the existing billing integration and account permissions, define the settings API, implement loading/empty/error states, and test that one account cannot modify another account's settings. Prepare provider writes and deployment separately from local implementation; do not create a paid subscription merely to test the interface.
 
-- Review reference documentation
-- Check script output messages
-- Consult tech stack documentation
-- Review error logs
+## Bundled references
 
-## Resources
+- [Stack inspection checklist](references/tech_stack_guide.md)
+- [Boundary and contract review](references/architecture_patterns.md)
+- [Implementation and verification workflow](references/development_workflows.md)
 
-- Pattern Reference: `references/tech_stack_guide.md`
-- Workflow Guide: `references/architecture_patterns.md`
-- Technical Guide: `references/development_workflows.md`
-- Tool Scripts: `scripts/` directory
+## Helper status
 
-## When to Use
-This skill is applicable to execute the workflow or actions described in the overview.
+The three retained Python helpers are unimplemented historical skeletons. They intentionally fail with a nonzero exit and do not scaffold, analyze quality or certify a project. Use the project's real tools; do not report an empty findings list as a clean audit. No executable installation or production deployment is supplied by this skill.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
-- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+- Stack and provider compatibility must be checked in the actual project.
+- The references are review checklists, not complete application templates.
+- Passing a subset of tests does not prove security, performance or deployment readiness.
+- Do not infer permission to change accounts, billing or production resources from a request for a code review.