opencode-skills-collection 4.1.14 → 4.1.16

package/bundled-skills/diagram-generator/scripts/render_diagram.py

@@ -0,0 +1,169 @@
+#!/usr/bin/env python3
+"""Render Mermaid, Graphviz DOT, PlantUML, or SVG diagram source to an output file.
+
+The script is intentionally dependency-tolerant. It uses common command-line
+renderers when available and prints actionable hints otherwise.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+
+MERMAID_EXTS = {".mmd", ".mermaid"}
+GRAPHVIZ_EXTS = {".dot", ".gv"}
+PLANTUML_EXTS = {".puml", ".plantuml"}
+SVG_EXTS = {".svg"}
+
+
+def run(cmd: list[str], cwd: Path | None = None) -> None:
+    print("$ " + " ".join(cmd))
+    completed = subprocess.run(cmd, cwd=str(cwd) if cwd else None, text=True, capture_output=True)
+    if completed.stdout:
+        print(completed.stdout, end="")
+    if completed.stderr:
+        print(completed.stderr, end="", file=sys.stderr)
+    if completed.returncode != 0:
+        raise RuntimeError(f"command failed with exit code {completed.returncode}")
+
+
+def infer_kind(path: Path) -> str:
+    ext = path.suffix.lower()
+    if ext in MERMAID_EXTS:
+        return "mermaid"
+    if ext in GRAPHVIZ_EXTS:
+        return "graphviz"
+    if ext in PLANTUML_EXTS:
+        return "plantuml"
+    if ext in SVG_EXTS:
+        return "svg"
+    text = path.read_text(encoding="utf-8", errors="replace").lstrip()
+    if text.startswith("@startuml"):
+        return "plantuml"
+    if text.startswith("digraph") or text.startswith("graph"):
+        return "graphviz"
+    if text.startswith("<svg"):
+        return "svg"
+    return "mermaid"
+
+
+def render_mermaid(src: Path, out: Path, fmt: str) -> None:
+    mmdc = shutil.which("mmdc")
+    if not mmdc:
+        raise RuntimeError(
+            "Mermaid rendering requires the Mermaid CLI executable `mmdc`. "
+            "Install it with `npm install -g @mermaid-js/mermaid-cli`, or return the Mermaid source only."
+        )
+    run([mmdc, "-i", str(src), "-o", str(out)])
+
+
+def render_graphviz(src: Path, out: Path, fmt: str) -> None:
+    dot = shutil.which("dot")
+    if not dot:
+        raise RuntimeError(
+            "Graphviz rendering requires the `dot` executable. Install Graphviz, or return the DOT source only."
+        )
+    run([dot, f"-T{fmt}", str(src), "-o", str(out)])
+
+
+def render_plantuml(src: Path, out: Path, fmt: str) -> None:
+    plantuml = shutil.which("plantuml")
+    java = shutil.which("java")
+    if plantuml:
+        with tempfile.TemporaryDirectory() as tmp:
+            tmp_path = Path(tmp)
+            temp_src = tmp_path / src.name
+            temp_src.write_text(src.read_text(encoding="utf-8"), encoding="utf-8")
+            run([plantuml, f"-t{fmt}", str(temp_src)], cwd=tmp_path)
+            produced = temp_src.with_suffix("." + fmt)
+            if not produced.exists():
+                candidates = list(tmp_path.glob(f"*.{fmt}"))
+                if not candidates:
+                    raise RuntimeError("PlantUML completed but no output file was found")
+                produced = candidates[0]
+            shutil.copyfile(produced, out)
+            return
+    jar = os.environ.get("PLANTUML_JAR")
+    if java and jar and Path(jar).exists():
+        with tempfile.TemporaryDirectory() as tmp:
+            tmp_path = Path(tmp)
+            temp_src = tmp_path / src.name
+            temp_src.write_text(src.read_text(encoding="utf-8"), encoding="utf-8")
+            run([java, "-jar", jar, f"-t{fmt}", str(temp_src)], cwd=tmp_path)
+            produced = temp_src.with_suffix("." + fmt)
+            if not produced.exists():
+                candidates = list(tmp_path.glob(f"*.{fmt}"))
+                if not candidates:
+                    raise RuntimeError("PlantUML completed but no output file was found")
+                produced = candidates[0]
+            shutil.copyfile(produced, out)
+            return
+    raise RuntimeError(
+        "PlantUML rendering requires `plantuml` on PATH, or Java plus PLANTUML_JAR pointing to plantuml.jar. "
+        "Return the PlantUML source only if no renderer is available."
+    )
+
+
+def render_svg_source(src: Path, out: Path, fmt: str) -> None:
+    if fmt == "svg":
+        shutil.copyfile(src, out)
+        return
+    rsvg = shutil.which("rsvg-convert")
+    if rsvg:
+        run([rsvg, "-f", fmt, "-o", str(out), str(src)])
+        return
+    inkscape = shutil.which("inkscape")
+    if inkscape:
+        run([inkscape, str(src), f"--export-type={fmt}", f"--export-filename={out}"])
+        return
+    raise RuntimeError(
+        "SVG conversion requires `rsvg-convert` or `inkscape`. The SVG source itself is usable as an image."
+    )
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Render text diagram source to SVG, PNG, or PDF.")
+    parser.add_argument("input", type=Path, help="Input .mmd, .dot/.gv, .puml, or .svg file")
+    parser.add_argument("--format", choices=["svg", "png", "pdf"], default="svg", help="Output format")
+    parser.add_argument("--out", type=Path, help="Output path. Defaults to input name with the selected extension")
+    parser.add_argument("--kind", choices=["auto", "mermaid", "graphviz", "plantuml", "svg"], default="auto")
+    args = parser.parse_args()
+
+    src = args.input.resolve()
+    if not src.exists():
+        print(f"input file not found: {src}", file=sys.stderr)
+        return 2
+    out = (args.out or src.with_suffix("." + args.format)).resolve()
+    out.parent.mkdir(parents=True, exist_ok=True)
+    kind = infer_kind(src) if args.kind == "auto" else args.kind
+
+    try:
+        if kind == "mermaid":
+            render_mermaid(src, out, args.format)
+        elif kind == "graphviz":
+            render_graphviz(src, out, args.format)
+        elif kind == "plantuml":
+            render_plantuml(src, out, args.format)
+        elif kind == "svg":
+            render_svg_source(src, out, args.format)
+        else:
+            raise RuntimeError(f"unknown diagram kind: {kind}")
+    except Exception as exc:
+        print(f"render failed: {exc}", file=sys.stderr)
+        return 1
+
+    if not out.exists() or out.stat().st_size == 0:
+        print(f"render failed: output missing or empty: {out}", file=sys.stderr)
+        return 1
+    print(f"rendered {kind} diagram to {out}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/bundled-skills/django-access-review/SKILL.md

@@ -1,16 +1,11 @@
 ---
 name: django-access-review
-description: django-access-review
+description: "Use when reviewing Django or DRF access control: trace authorization flows, IDOR risks, object permissions, query scoping and tenant isolation before proposing a verified fix."
 risk: critical
 source: community
 date_added: "2026-09-04"
 ---
 
----
-name: django-access-review
-description: Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant...
---- LICENSE
----
 
 <!--
 Reference material based on OWASP Cheat Sheet Series (CC BY-SA 4.0)
@@ -237,7 +232,7 @@ Only report issues you've confirmed through investigation.
 A comment or docstring does not enforce authorization. Your suggested fix must include actual code that:
 - Validates the user has permission before proceeding
 - Raises an exception or returns an error if unauthorized
-- Makes unauthorized access impossible, not just discouraged
+- Enforces the stated ownership/tenant policy on the shown path, with negative tests; a small helper does not prove every endpoint is protected.
 
 Example of a BAD fix suggestion:
 ```python
@@ -248,13 +243,25 @@ def get_resource(resource_id):
 
 Example of a GOOD fix suggestion:
 ```python
+from django.core.exceptions import PermissionDenied
+from django.shortcuts import get_object_or_404
+from app.models import Resource  # Replace with the project's actual model.
+
+
 def get_resource(resource_id, user):
-    resource = Resource.objects.get(pk=resource_id)
-    if resource.owner_id != user.id:
-        raise PermissionDenied("Access denied")
-    return resource
+    if user is None or not user.is_authenticated:
+        raise PermissionDenied("Authentication required")
+    return get_object_or_404(Resource, pk=resource_id, owner_id=user.pk)
 ```
 
+This example assumes individually owned resources and a `user` supplied by the
+server's authenticated request context, never by a user-controlled request body.
+For organization roles or shared resources, use the actual verified membership
+policy instead of replacing it with a simplistic ownership check. The scoped
+lookup returns 404 for an absent or unowned resource and does not expose its data.
+Test anonymous access, the owner, another user and another tenant, including bulk,
+create and custom-action paths; importing a permission class alone is not proof.
+
 If you can't determine the right enforcement mechanism, say so - but never suggest documentation as the fix.
 
 ### Report Format
@@ -354,4 +361,5 @@ Use this to guide your review, not as a pass/fail checklist:
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+- Review code read-only by default. Exercise negative requests only against authorized disposable/staging resources; do not probe real users’ objects merely to demonstrate an IDOR.
+- Examples are project integration patterns, not a complete Django application; adapt imports, relationships and permission semantics to the actual models.

package/bundled-skills/django-perf-review/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: django-perf-review
+license: Apache-2.0
 description: Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems.
 allowed-tools: Read, Grep, Glob, Bash, Task
-license: LICENSE
 risk: critical
 source: community
 date_added: "2026-09-04"

package/bundled-skills/doc-coauthoring/SKILL.md

@@ -378,7 +378,7 @@ Announce document completion. Provide a few final tips:
 - The goal is a document that actually works for readers
 
 ## When to Use
-This skill is applicable to execute the workflow or actions described in the overview.
+Use when drafting a substantial proposal, specification, RFC or decision document from supplied sources through iterative author feedback.
 
 ## Example
 

package/bundled-skills/doc2math/SKILL.md

@@ -18,7 +18,7 @@ date_added: "2026-05-31"
 
 ## Zero-Inference Protocol (Mandatory)
 
-1. **Closed World** — if it is not stated in the document, it does not exist in output
+1. **Closed World** — do not assert unstated facts or numeric values. Structural notation implied by source phrasing may be proposed only with the explicit inference tag required below
 2. **Grounding Rule** — every element must cite the exact source phrase (`"evidence"` field)
 3. **No Silent Filling** — unknown values use `null`; ambiguous types use `"ambiguous"`
 4. **Inference Tagging** — structural inferences tagged `"inferred": true` with `"inference_basis"`
@@ -69,21 +69,21 @@ Identify what the document implies but doesn't state: `missing_information[]` wi
 
 ## Output Format
 
-Produce the complete MPS as a JSON object:
+Produce an MPS JSON object. The empty schema example below is not a complete formalization; populate only grounded entries and report missing information:
 
 ```json
 {
   "mps_version": "1.0",
   "source_title": "...",
   "problem_class": "optimization",
-  "variables": [...],
-  "operators": [...],
-  "constraints": [...],
-  "objectives": [...],
-  "uncertainty": [...],
-  "missing_information": [...],
+  "variables": [],
+  "operators": [],
+  "constraints": [],
+  "objectives": [],
+  "uncertainty": [],
+  "missing_information": [],
   "validation_flags": {
-    "overall_formalizability": "HIGH"
+    "overall_formalizability": "LOW"
   }
 }
 ```
@@ -97,6 +97,7 @@ Produce the complete MPS as a JSON object:
 
 ## Additional Resources
 
+- External hosted BYOK tools are optional and not bundled; using them may transmit documents/keys and incur costs. Obtain the applicable data/account approval instead of following the link automatically.
 - Repository: [thebrierfox/doc2math-skill](https://github.com/thebrierfox/doc2math-skill)
 - Full BYOK tool: [ace-license-server-production.up.railway.app/byok/doc2math](https://ace-license-server-production.up.railway.app/byok/doc2math)
 - Built by [IntuiTek¹](https://intuitek.ai) (~K¹) — MIT License

package/bundled-skills/docker-compose/SKILL.md

@@ -30,6 +30,10 @@ Use this skill when:
 - Managing application stacks with multiple services
 - Creating reproducible development setups
 
+## Execution Scope
+
+Confirm the selected Docker context and project before any operation. Build instructions execute contributed commands; inspect the Dockerfile, build context, scripts and downloaded dependencies first. Image publication, shared-container stops and volume deletion need authorization for the exact target. Do not expose environment values, image history or logs containing credentials. These examples are independent fragments with project-specific assets, not a complete deployment.
+
 ## Prerequisites
 
 - Docker Engine with Compose plugin (v2)
@@ -42,16 +46,15 @@ Use this skill when:
 
 ```yaml
 # docker-compose.yml
-version: '3.8'
 
 services:
   web:
     build: .
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     environment:
       - NODE_ENV=development
-      - DATABASE_URL=postgres://postgres:secret@db:5432/myapp
+      - DATABASE_URL=postgres://postgres:${POSTGRES_PASSWORD:?set a local fixture password}@db:5432/myapp
     depends_on:
       - db
       - redis
@@ -60,17 +63,17 @@ services:
     image: postgres:15-alpine
     environment:
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: secret
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set a local fixture password}
       POSTGRES_DB: myapp
     volumes:
       - postgres-data:/var/lib/postgresql/data
     ports:
-      - "5432:5432"
+      - "127.0.0.1:5432:5432"
 
   redis:
     image: redis:7-alpine
     ports:
-      - "6379:6379"
+      - "127.0.0.1:6379:6379"
 
 volumes:
   postgres-data:
@@ -113,7 +116,7 @@ services:
 services:
   web:
     ports:
-      - "3000:3000"           # HOST:CONTAINER
+      - "127.0.0.1:3000:3000"           # HOST:CONTAINER
       - "127.0.0.1:9229:9229" # Bind to localhost only
       - "8080-8090:8080-8090" # Port range
     expose:
@@ -227,7 +230,7 @@ services:
   web:
     image: myapp:latest
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
 
 # docker-compose.override.yml (development - auto-loaded)
 services:
@@ -309,7 +312,7 @@ docker compose stop
 # Stop and remove containers
 docker compose down
 
-# Stop and remove everything including volumes
+# Destructive: deletes project data volumes; require exact-scope approval and backups
 docker compose down -v --rmi all
 
 # Restart services
@@ -415,6 +418,8 @@ services:
 
 ### Reverse Proxy
 
+The socket mount below grants access to the Docker daemon API. `:ro` does not make API calls read-only. Use a reviewed restricted socket proxy or static routing configuration for a less privileged design; do not apply this illustration to an untrusted proxy.
+
 ```yaml
 services:
   proxy:
@@ -455,7 +460,7 @@ services:
 - Use named volumes for persistent data
 - Define healthchecks for database dependencies
 - Use profiles to separate optional services
-- Keep secrets in .env files (not committed)
+- Keep local fixture credentials out of Git; for sensitive deployments prefer supported per-service secret files and application-specific readers. Environment files are not a secret vault.
 - Use override files for environment-specific config
 - Pin image versions for reproducibility
 - Use networks to isolate service groups
@@ -476,7 +481,8 @@ services:
 
 ```bash
 git status && git diff --stat
-kubectl diff -f manifest.yaml
+docker context show
+docker compose config --quiet
 ```
 
 > Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

package/bundled-skills/docker-expert/SKILL.md

@@ -11,37 +11,41 @@ date_added: "2026-02-27"
 
 You are an advanced Docker containerization expert with comprehensive, practical knowledge of container optimization, security hardening, multi-stage builds, orchestration patterns, and production deployment strategies based on current industry best practices.
 
+## Execution Scope
+
+Inspect Docker context, build commands, secrets and runtime side effects before execution. Do not start an application or publish an image merely to validate syntax. Record build, scan and runtime results separately; absence of a tool is not a passing check.
+
 ### When invoked:
 
 0. If the issue requires ultra-specific expertise outside Docker, recommend switching and stop:
-   - Kubernetes orchestration, pods, services, ingress → kubernetes-expert (future)
-   - GitHub Actions CI/CD with containers → github-actions-expert
-   - AWS ECS/Fargate or cloud-specific container services → devops-expert
-   - Database containerization with complex persistence → database-expert
+   - Kubernetes orchestration, pods, services, ingress → kubernetes-architect (future)
+   - GitHub Actions CI/CD with containers → github-actions-templates
+   - AWS ECS/Fargate or cloud-specific container services → deployment-engineer
+   - Database containerization with complex persistence → database-admin
 
    Example to output:
-   "This requires Kubernetes orchestration expertise. Please invoke: 'Use the kubernetes-expert subagent.' Stopping here."
+   "This requires Kubernetes orchestration expertise. Consult the available kubernetes-architect skill within the authorized task; do not create a subagent implicitly."
 
 1. Analyze container setup comprehensively:
-   
+
    **Use internal tools first (Read, Grep, Glob) for better performance. Shell commands are fallbacks.**
-   
+
    ```bash
    # Docker environment detection
-   docker --version 2>/dev/null || echo "No Docker installed"
-   docker info | grep -E "Server Version|Storage Driver|Container Runtime" 2>/dev/null
-   docker context ls 2>/dev/null | head -3
-   
+   docker --version  || echo "No Docker installed"
+   docker info | grep -E "Server Version|Storage Driver|Container Runtime"
+   docker context ls  | head -3
+
    # Project structure analysis
    find . -name "Dockerfile*" -type f | head -10
    find . -name "*compose*.yml" -o -name "*compose*.yaml" -type f | head -5
    find . -name ".dockerignore" -type f | head -3
-   
+
    # Container status if running
-   docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}" 2>/dev/null | head -10
-   docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}" 2>/dev/null | head -10
+   docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}"  | head -10
+   docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"  | head -10
    ```
-   
+
    **After detection, adapt approach:**
    - Match existing Dockerfile patterns and base images
    - Respect multi-stage build conventions
@@ -55,17 +59,17 @@ You are an advanced Docker containerization expert with comprehensive, practical
 4. Validate thoroughly:
    ```bash
    # Build and security validation
-   docker build --no-cache -t test-build . 2>/dev/null && echo "Build successful"
-   docker history test-build --no-trunc 2>/dev/null | head -5
-   docker scout quickview test-build 2>/dev/null || echo "No Docker Scout"
-   
+   docker build --no-cache -t test-build .  && echo "Build successful"
+   docker history test-build --no-trunc  | head -5
+   docker scout quickview test-build  || echo "No Docker Scout"
+
    # Runtime validation
-   docker run --rm -d --name validation-test test-build 2>/dev/null
-   docker exec validation-test ps aux 2>/dev/null | head -3
-   docker stop validation-test 2>/dev/null
-   
+   docker run --rm -d --name validation-test test-build
+   docker exec validation-test ps aux  | head -3
+   docker stop validation-test
+
    # Compose validation
-   docker-compose config 2>/dev/null && echo "Compose config valid"
+   docker compose config  && echo "Compose config valid"
    ```
 
 ## Core Expertise Areas
@@ -81,20 +85,20 @@ You are an advanced Docker containerization expert with comprehensive, practical
 **Key techniques:**
 ```dockerfile
 # Optimized multi-stage pattern
-FROM node:18-alpine AS deps
+FROM node:22-alpine AS deps
 WORKDIR /app
 COPY package*.json ./
-RUN npm ci --only=production && npm cache clean --force
+RUN npm ci --omit=dev && npm cache clean --force
 
-FROM node:18-alpine AS build
+FROM node:22-alpine AS build
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci
 COPY . .
-RUN npm run build && npm prune --production
+RUN npm run build && npm prune --omit=dev
 
-FROM node:18-alpine AS runtime
-RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
+FROM node:22-alpine AS runtime
+RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001 -G nodejs
 WORKDIR /app
 COPY --from=deps --chown=nextjs:nodejs /app/node_modules ./node_modules
 COPY --from=build --chown=nextjs:nodejs /app/dist ./dist
@@ -102,7 +106,7 @@ COPY --from=build --chown=nextjs:nodejs /app/package*.json ./
 USER nextjs
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-  CMD curl -f http://localhost:3000/health || exit 1
+  CMD ["node", "-e", "fetch('http://localhost:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
 CMD ["node", "dist/index.js"]
 ```
 
@@ -117,12 +121,12 @@ CMD ["node", "dist/index.js"]
 **Security patterns:**
 ```dockerfile
 # Security-hardened container
-FROM node:18-alpine
+FROM node:22-alpine
 RUN addgroup -g 1001 -S appgroup && \
     adduser -S appuser -u 1001 -G appgroup
 WORKDIR /app
 COPY --chown=appuser:appgroup package*.json ./
-RUN npm ci --only=production
+RUN npm ci --omit=dev
 COPY --chown=appuser:appgroup . .
 USER 1001
 # Drop capabilities, set read-only root filesystem
@@ -136,14 +140,13 @@ USER 1001
 - **Environment management**: Dev/staging/prod configurations
 - **Volume strategies**: Named volumes, bind mounts, data persistence
 
-**Production-ready compose pattern:**
+**Compose illustration (provide private secret files and a real health endpoint):**
 ```yaml
-version: '3.8'
 services:
   app:
     build:
       context: .
-      target: production
+      target: runtime
     depends_on:
       db:
         condition: service_healthy
@@ -151,7 +154,7 @@ services:
       - frontend
       - backend
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
+      test: ["CMD", "node", "-e", "fetch('http://localhost:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -180,7 +183,7 @@ services:
     networks:
       - backend
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      test: ["CMD-SHELL", "pg_isready -U $$(cat /run/secrets/db_user) -d $$(cat /run/secrets/db_name)"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -197,11 +200,11 @@ volumes:
 
 secrets:
   db_name:
-    external: true
+    file: ./secrets/db_name.txt
   db_user:
-    external: true  
+    file: ./secrets/db_user.txt
   db_password:
-    external: true
+    file: ./secrets/db_password.txt
 ```
 
 ### 4. Image Size Optimization
@@ -215,7 +218,7 @@ secrets:
 **Optimization techniques:**
 ```dockerfile
 # Minimal production image
-FROM gcr.io/distroless/nodejs18-debian11
+FROM gcr.io/distroless/nodejs22-debian12
 COPY --from=build /app/dist /app
 COPY --from=build /app/node_modules /app/node_modules
 WORKDIR /app
@@ -247,7 +250,7 @@ services:
       - NODE_ENV=development
       - DEBUG=app:*
     ports:
-      - "9229:9229"  # Debug port
+      - "127.0.0.1:9229:9229"  # Debug port
     command: npm run dev
 ```
 
@@ -291,11 +294,11 @@ docker buildx build --platform linux/amd64,linux/arm64 \
 ### Build Cache Optimization
 ```dockerfile
 # Mount build cache for package managers
-FROM node:18-alpine AS deps
+FROM node:22-alpine AS deps
 WORKDIR /app
 COPY package*.json ./
 RUN --mount=type=cache,target=/root/.npm \
-    npm ci --only=production
+    npm ci --omit=dev
 ```
 
 ### Secrets Management
@@ -303,8 +306,9 @@ RUN --mount=type=cache,target=/root/.npm \
 # Build-time secrets (BuildKit)
 FROM alpine
 RUN --mount=type=secret,id=api_key \
-    API_KEY=$(cat /run/secrets/api_key) && \
-    # Use API_KEY for build process
+    test -s /run/secrets/api_key
+# Replace the size check with the reviewed build command that consumes this secret.
+# Never print or persist the secret in an image layer.
 ```
 
 ### Health Check Strategies
@@ -372,7 +376,7 @@ When reviewing Docker configurations, focus on:
 **Root causes**: Poor layer ordering, large build context, no caching strategy
 **Solutions**: Multi-stage builds, .dockerignore optimization, dependency caching
 
-### Security Vulnerabilities  
+### Security Vulnerabilities
 **Symptoms**: Security scan failures, exposed secrets, root execution
 **Root causes**: Outdated base images, hardcoded secrets, default user
 **Solutions**: Regular base updates, secrets management, non-root configuration
@@ -395,11 +399,11 @@ When reviewing Docker configurations, focus on:
 ## Integration & Handoff Guidelines
 
 **When to recommend other experts:**
-- **Kubernetes orchestration** → kubernetes-expert: Pod management, services, ingress
-- **CI/CD pipeline issues** → github-actions-expert: Build automation, deployment workflows  
-- **Database containerization** → database-expert: Complex persistence, backup strategies
+- **Kubernetes orchestration** → kubernetes-architect: Pod management, services, ingress
+- **CI/CD pipeline issues** → github-actions-templates: Build automation, deployment workflows
+- **Database containerization** → database-admin: Complex persistence, backup strategies
 - **Application-specific optimization** → Language experts: Code-level performance issues
-- **Infrastructure automation** → devops-expert: Terraform, cloud-specific deployments
+- **Infrastructure automation** → deployment-engineer: Terraform, cloud-specific deployments
 
 **Collaboration patterns:**
 - Provide Docker foundation for DevOps deployment automation
@@ -410,7 +414,7 @@ When reviewing Docker configurations, focus on:
 I provide comprehensive Docker containerization expertise with focus on practical optimization, security hardening, and production-ready patterns. My solutions emphasize performance, maintainability, and security best practices for modern container workflows.
 
 ## When to Use
-This skill is applicable to execute the workflow or actions described in the overview.
+Use to diagnose container builds, image size, ownership, healthchecks, networking or Compose configuration from actual project files and observed errors.
 
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.