opencode-skills-collection 4.1.14 → 4.1.16

package/bundled-skills/docker-management/SKILL.md

@@ -31,6 +31,10 @@ Use this skill when:
 - Configuring Docker networking and volumes
 - Implementing container security best practices
 
+## Execution Scope
+
+Confirm the selected Docker context and project before any operation. Build instructions execute contributed commands; inspect the Dockerfile, build context, scripts and downloaded dependencies first. Image publication, shared-container stops and volume deletion need authorization for the exact target. Do not expose environment values, image history or logs containing credentials. These examples are independent fragments with project-specific assets, not a complete deployment.
+
 ## Prerequisites
 
 - Docker Engine installed (20.10+)
@@ -46,15 +50,15 @@ Use this skill when:
 FROM node:20-alpine AS builder
 WORKDIR /app
 COPY package*.json ./
-RUN npm ci --only=production
+RUN npm ci
 COPY . .
-RUN npm run build
+RUN npm run build && npm prune --omit=dev
 
 # Production stage
 FROM node:20-alpine AS production
 WORKDIR /app
 RUN addgroup -g 1001 -S nodejs && \
-    adduser -S nodejs -u 1001
+    adduser -S nodejs -u 1001 -G nodejs
 COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist
 COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
 USER nodejs
@@ -161,7 +165,7 @@ docker volume create mydata
 docker run -v mydata:/app/data myapp:latest
 
 # Bind mount
-docker run -v $(pwd)/config:/app/config:ro myapp:latest
+docker run -v "$(pwd)/config:/app/config:ro" myapp:latest
 
 # tmpfs mount (memory)
 docker run --tmpfs /tmp:rw,noexec,nosuid myapp:latest
@@ -258,7 +262,7 @@ docker export myapp > myapp-fs.tar
 
 ```dockerfile
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-  CMD curl -f http://localhost:3000/health || exit 1
+  CMD ["node", "-e", "fetch('http://localhost:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
 ```
 
 ```bash
@@ -287,7 +291,7 @@ docker pull myregistry.com/myapp:v1.0
 # Remove unused images
 docker image prune -a
 
-# Remove all unused resources
+# Destructive broad cleanup: only after explicit scope approval and verified backups
 docker system prune -a --volumes
 
 # Remove specific image
@@ -314,7 +318,6 @@ docker scout cves myapp:latest
 
 ```yaml
 # docker-compose.yml
-version: '3.8'
 
 services:
   app:
@@ -322,7 +325,7 @@ services:
       context: .
       dockerfile: Dockerfile
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     environment:
       - NODE_ENV=production
     volumes:
@@ -334,7 +337,7 @@ services:
   db:
     image: postgres:15-alpine
     environment:
-      POSTGRES_PASSWORD: secret
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set a local fixture password}
     volumes:
       - db-data:/var/lib/postgresql/data
 
@@ -349,13 +352,13 @@ volumes:
 
 ```dockerfile
 # Use specific version tags
-FROM node:20.10-alpine3.18
+FROM node:22-alpine
 
 # Don't run as root
 USER nobody
 
 # Remove unnecessary packages
-RUN apk del --purge build-dependencies
+RUN apk del --purge .build-deps  # only if this virtual build-dependency group was created earlier
 
 # Use COPY instead of ADD
 COPY . .
@@ -388,7 +391,7 @@ docker run -d \
 
 ### Issue: Out of Disk Space
 **Problem**: Docker using too much disk
-**Solution**: Run `docker system prune -a --volumes`, check for large unused images
+**Solution**: Inspect `docker system df` and named resources first. Remove only explicitly authorized unused targets; broad volume pruning can destroy data
 
 ### Issue: Build Cache Not Working
 **Problem**: Every build downloads dependencies
@@ -420,7 +423,8 @@ docker run -d \
 
 ```bash
 git status && git diff --stat
-kubectl diff -f manifest.yaml
+docker context show
+docker compose config --quiet
 ```
 
 > Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

package/bundled-skills/docs-architect/SKILL.md

@@ -21,7 +21,6 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 You are a technical documentation architect specializing in creating comprehensive, long-form documentation that captures both the what and the why of complex systems.
 

package/bundled-skills/docs-generator/SKILL.md

@@ -9,6 +9,10 @@ date_added: "2026-08-25"
 license: "MIT"
 license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"
 ---
+## Bundled upstream support
+
+Supporting files are included at skill-relative paths. See [UPSTREAM-NOTICE.md](UPSTREAM-NOTICE.md) for their pinned sources, licenses, hashes, and import changes.
+
 # Technical Documentation
 ## When to Use
 
@@ -69,7 +73,9 @@ license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"
 - 敏感信息（真实 token、密码、内部 URL）用占位符替代
 - **MUST** 包含 Evidence → Finding → Path 链（见 `../ops/evidence-finding-path.md` 与模板 §0）
 - **MUST** 读取 `references/vendor-report-rules.md`：选定 `malware` / `apt` 或 `flavor = null`（漏洞任务可叠加 thin `vuln`）；无 flavor 时只输出原任务模板和适用的 Base 元素，不强制 IOC/ATT&CK
-- **SHOULD** 引用 case `scope.md` / `timeline.md`（`../scripts/case-init.ps1`）
+- **SHOULD** 引用 case `scope.md` / `timeline.md`（`scripts/case-init.ps1`）
+
+`case-init.ps1` writes `scope.md`, `timeline.md`, `workitems.md`, and `README.md` under `work/<CaseName>/`. It refuses to run when that case directory already exists; choose a new `-CaseName` to preserve prior case data.
 
 ### 图表集成
 

package/bundled-skills/docs-generator/UPSTREAM-LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 zhaoxuya520
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bundled-skills/docs-generator/UPSTREAM-NOTICE.md

@@ -0,0 +1,15 @@
+# Upstream helpers for docs-generator
+
+The files listed below were recovered from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) at commit `cab634bd855fc287f6e420c1f36fd1a6b9245960`. The repository ID is `1237819660`.
+
+They retain the upstream **MIT** license reproduced in [UPSTREAM-LICENSE.txt](UPSTREAM-LICENSE.txt). This notice applies to the listed support files; it does not replace the license metadata of other catalog files. Preserve the upstream license and this attribution when redistributing them.
+
+License wording is unchanged; text-only trailing whitespace and EOF blank lines are normalized. Original license: https://github.com/zhaoxuya520/reverse-skill/blob/cab634bd855fc287f6e420c1f36fd1a6b9245960/LICENSE
+
+| Local file | Original upstream path | Original Git blob SHA | Import changes |
+| --- | --- | --- | --- |
+| `scripts/case-init.ps1` | `skills/scripts/case-init.ps1` | `413b895521ce2bfcea09be1af703050f7262b79c` | relocated inside this skill |
+| `scripts/lib/HostRuntime.ps1` | `skills/scripts/lib/HostRuntime.ps1` | `59dbece870de7ee5c01fa3597ede581a2b3bcf1b` | relocated inside this skill |
+| `scripts/lib/WorkRoot.ps1` | `skills/scripts/lib/WorkRoot.ps1` | `ceadb65cf459367a404c7f343c33e586b25c6975` | relocated inside this skill |
+
+The case initializer now refuses to reuse an existing case directory before creating its managed output files. Its optional upstream router is not bundled; without it the initializer uses its documented default routing metadata.

package/bundled-skills/docs-generator/scripts/case-init.ps1

@@ -0,0 +1,379 @@
+#Requires -Version 5.1
+# Initialize work/<case>/ with scope, timeline, workitems (reverse-skill ops contract).
+# Bare invocation keeps pending/offline defaults.
+# Ready-to-act example:
+#   powershell -File skills/scripts/case-init.ps1 -Hint "web pentest" -CaseName my-case `
+#     -AuthGranted -TargetUrl "https://app.example/" -NetworkProfile authorized_target_only
+# Offline sample ready-to-act example:
+#   powershell -File skills/scripts/case-init.ps1 -Hint "offline apk" -CaseName my-sample `
+#     -Preset offline-sample -Sample ".\app.apk"
+param(
+    [string] $Hint = '',
+    [string] $CaseName = '',
+    [string] $PackageRoot = '',
+    [AllowEmptyString()]
+    [string] $ProjectRoot = '',
+    [switch] $AuthGranted,
+    [string] $AuthStatus = '',
+    [string] $AuthBasis = 'own_system',
+    [string] $EvidenceOfAuth = '',
+    [string] $TargetUrl = '',
+    [string] $Sample = '',
+    [string] $Preset = '',
+    [string[]] $InScopeAssets = @(),
+    [string] $NetworkProfile = '',
+    [switch] $ReadyForAct
+)
+$ErrorActionPreference = 'Stop'
+
+$scriptDir = $PSScriptRoot
+if (-not $scriptDir) { $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path }
+$skillsRoot = Split-Path -Parent $scriptDir
+if (-not $PackageRoot) { $PackageRoot = Split-Path -Parent $skillsRoot }
+. (Join-Path (Join-Path $scriptDir 'lib') 'WorkRoot.ps1')
+. (Join-Path (Join-Path $scriptDir 'lib') 'HostRuntime.ps1')
+$HostExe = Resolve-ReverseHostExe
+$requestedProjectRoot = if (-not [string]::IsNullOrWhiteSpace($ProjectRoot)) {
+    $ProjectRoot
+} elseif ($PSBoundParameters.ContainsKey('PackageRoot')) {
+    $PackageRoot
+} else {
+    ''
+}
+$projectRoot = Resolve-ReverseProjectRoot -RequestedRoot $requestedProjectRoot
+
+if (-not [string]::IsNullOrWhiteSpace($Sample)) {
+    try {
+        $Sample = [System.IO.Path]::GetFullPath($Sample)
+    } catch {
+        throw "Invalid -Sample path '$Sample': $($_.Exception.Message)"
+    }
+    if (-not (Test-Path -LiteralPath $Sample -PathType Leaf)) {
+        throw "Local -Sample file not found: $Sample"
+    }
+}
+
+# Cross-platform case presets. Keep semantics aligned with case-init.sh.
+$presetNormalized = $Preset.Trim().ToLowerInvariant()
+if ($presetNormalized -in @('offline-sample', 'own-sample', 'local-sample')) {
+    $AuthGranted = $true
+    $AuthStatus = 'granted'
+    $AuthBasis = 'own_system'
+    if ([string]::IsNullOrWhiteSpace($NetworkProfile)) { $NetworkProfile = 'offline' }
+    if ([string]::IsNullOrWhiteSpace($EvidenceOfAuth)) {
+        $EvidenceOfAuth = 'preset:offline-sample (owner-operated local file)'
+    }
+} elseif ($presetNormalized -in @('ctf-public', 'ctf')) {
+    $AuthGranted = $true
+    $AuthStatus = 'granted'
+    $AuthBasis = 'ctf_public'
+    if ([string]::IsNullOrWhiteSpace($NetworkProfile)) { $NetworkProfile = 'authorized_target_only' }
+    if ([string]::IsNullOrWhiteSpace($EvidenceOfAuth)) { $EvidenceOfAuth = 'preset:ctf-public' }
+} elseif ($presetNormalized -in @('own-system', 'lab-only')) {
+    $AuthGranted = $true
+    $AuthStatus = 'granted'
+    $AuthBasis = 'own_system'
+    if ([string]::IsNullOrWhiteSpace($NetworkProfile)) { $NetworkProfile = 'lab_only' }
+    if ([string]::IsNullOrWhiteSpace($EvidenceOfAuth)) { $EvidenceOfAuth = 'preset:own-system/lab' }
+} elseif (-not [string]::IsNullOrWhiteSpace($Preset)) {
+    throw ("Invalid -Preset '{0}'. Allowed: offline-sample|ctf-public|own-system" -f $Preset)
+}
+
+if (-not $CaseName) {
+    $slug = if ($Hint) {
+        ($Hint.ToLowerInvariant() -replace '[^a-z0-9]+', '-').Trim('-')
+    } else { 'case' }
+    if ($slug.Length -gt 32) { $slug = $slug.Substring(0, 32).TrimEnd('-') }
+    $CaseName = '{0}-{1}' -f (Get-Date -Format 'yyyyMMdd-HHmmss'), $slug
+}
+
+# CaseName is a directory name, not a path. Keep every case under projectRoot/work.
+# The pattern allows localized names but excludes Windows path syntax and names that
+# Windows would normalize into a dot segment (for example, '.. ' or 'case.').
+if ([string]::IsNullOrWhiteSpace($CaseName) -or
+    $CaseName -notmatch '^[\p{L}\p{N}][\p{L}\p{N}._ -]{0,79}$' -or
+    $CaseName -match '[.\s]$') {
+    throw "Invalid -CaseName '$CaseName'. Use a 1-80 character directory name beginning with a letter or number; path separators, dot segments, trailing dots/spaces, control characters, and wildcard characters are not allowed."
+}
+if (-not [string]::IsNullOrWhiteSpace($NetworkProfile) -and
+    $NetworkProfile.Trim().ToLowerInvariant() -notin @('offline', 'lab_only', 'authorized_target_only', 'unrestricted_lab', 'lab', 'authorized', 'auth', 'offline_only')) {
+    throw "Invalid -NetworkProfile '$NetworkProfile'. Allowed: offline, lab_only, authorized_target_only, unrestricted_lab (aliases: lab, authorized, auth, offline_only)."
+}
+
+$workRoot = Join-Path $projectRoot 'work'
+$caseRoot = Join-Path $workRoot $CaseName
+$dirs = @('evidence', 'notes', 'report')
+if (Test-Path -LiteralPath $caseRoot) {
+    throw "Case directory already exists; refusing to overwrite existing case files: $caseRoot. Choose a new -CaseName."
+}
+New-Item -ItemType Directory -Path $caseRoot | Out-Null
+foreach ($d in $dirs) {
+    New-Item -ItemType Directory -Path (Join-Path $caseRoot $d) | Out-Null
+}
+
+# Resolve auth / network / assets
+# Priority: explicit -AuthStatus (only if bound) > -AuthGranted > pending.
+# Never let a stray positional string overwrite AuthGranted.
+$authStatusResolved = 'pending'
+if ($AuthGranted) { $authStatusResolved = 'granted' }
+if ($PSBoundParameters.ContainsKey('AuthStatus') -and -not [string]::IsNullOrWhiteSpace($AuthStatus)) {
+    $candidate = $AuthStatus.Trim().ToLowerInvariant()
+    $allowedAuth = @('pending', 'granted', 'denied', 'unknown')
+    if ($allowedAuth -contains $candidate) {
+        $authStatusResolved = $candidate
+    } else {
+        Write-Host ("WARN: ignoring invalid -AuthStatus '{0}' (allowed: pending|granted|denied|unknown)" -f $AuthStatus) -ForegroundColor Yellow
+        # if user also passed AuthGranted, keep granted; else stay pending
+    }
+}
+
+$evidenceAuth = if (-not [string]::IsNullOrWhiteSpace($EvidenceOfAuth)) {
+    $EvidenceOfAuth
+} elseif ($AuthGranted -or $authStatusResolved -eq 'granted') {
+    'cli-flag AuthGranted or AuthStatus=granted'
+} else {
+    'FILL_ME'
+}
+
+$assets = New-Object System.Collections.Generic.List[string]
+if (-not [string]::IsNullOrWhiteSpace($TargetUrl)) { [void]$assets.Add($TargetUrl.Trim()) }
+if (-not [string]::IsNullOrWhiteSpace($Sample) -and -not $assets.Contains($Sample.Trim())) {
+    [void]$assets.Add($Sample.Trim())
+}
+foreach ($a in @($InScopeAssets)) {
+    if (-not [string]::IsNullOrWhiteSpace($a) -and -not $assets.Contains($a.Trim())) {
+        [void]$assets.Add($a.Trim())
+    }
+}
+# Also accept host-only tokens that look like domains/IPs from TargetUrl leftovers
+if ($assets.Count -eq 0 -and $Hint -match 'https?://([^\s/]+)') {
+    [void]$assets.Add(('https://{0}/' -f $Matches[1]))
+}
+
+$networkMode = 'offline'
+if (-not [string]::IsNullOrWhiteSpace($NetworkProfile)) {
+    $networkMode = $NetworkProfile.Trim()
+} elseif ($assets.Count -gt 0 -and $authStatusResolved -eq 'granted' -and [string]::IsNullOrWhiteSpace($Sample)) {
+    # Authorized network targets default to target-only. Explicit local samples remain offline.
+    $networkMode = 'authorized_target_only'
+}
+# normalize common aliases
+$netAliases = @{
+    'lab' = 'lab_only'
+    'authorized' = 'authorized_target_only'
+    'auth' = 'authorized_target_only'
+    'offline_only' = 'offline'
+}
+if ($netAliases.ContainsKey($networkMode.ToLowerInvariant())) {
+    $networkMode = $netAliases[$networkMode.ToLowerInvariant()]
+}
+$allowedNetworkModes = @('offline', 'lab_only', 'authorized_target_only', 'unrestricted_lab')
+if ($networkMode -notin $allowedNetworkModes) {
+    throw "Invalid -NetworkProfile '$NetworkProfile'. Allowed: offline, lab_only, authorized_target_only, unrestricted_lab (aliases: lab, authorized, auth, offline_only)."
+}
+
+# ready_for_act requires auth granted + assets. Network targets need a non-offline
+# profile; an explicit local sample is valid in offline mode. -ReadyForAct never
+# bypasses auth or scope.
+$ready = $false
+$netAllowsAct = ($networkMode -ne 'offline' -and -not [string]::IsNullOrWhiteSpace($networkMode))
+$offlineSampleReady = ($networkMode -eq 'offline' -and -not [string]::IsNullOrWhiteSpace($Sample) -and $assets.Count -gt 0)
+if ($authStatusResolved -eq 'granted' -and $assets.Count -gt 0 -and ($netAllowsAct -or $offlineSampleReady)) {
+    $ready = $true
+} elseif ($ReadyForAct) {
+    if ($authStatusResolved -ne 'granted') {
+        Write-Host 'WARN: -ReadyForAct ignored because auth.status is not granted' -ForegroundColor Yellow
+    } elseif ($assets.Count -eq 0) {
+        Write-Host 'WARN: -ReadyForAct ignored because in_scope.assets is empty' -ForegroundColor Yellow
+    } elseif (-not $netAllowsAct -and -not $offlineSampleReady) {
+        Write-Host 'WARN: -ReadyForAct ignored because offline mode requires an explicit -Sample' -ForegroundColor Yellow
+    }
+}
+
+# Optional master-route for primary skill
+$primary = 'reverse-engineering/SKILL.md'
+$primaryId = 'R0'
+$routeScript = Join-Path $scriptDir 'master-route.ps1'
+if ((Test-Path $routeScript) -and $Hint) {
+    $tmpBase = if ($env:TEMP) { $env:TEMP } else { [System.IO.Path]::GetTempPath() }
+    $tmp = Join-Path $tmpBase ("case-init-route-" + [guid]::NewGuid().ToString('n'))
+    try {
+        & $HostExe -NoProfile -ExecutionPolicy Bypass -File $routeScript -Hint $Hint -OutDir $tmp 2>$null | Out-Null
+        $scopeRoute = Join-Path $tmp 'route-scope.md'
+        if (Test-Path $scopeRoute) {
+            . (Join-Path $scriptDir 'lib/RouteScope.ps1')
+            $rt = Get-Content $scopeRoute -Raw -Encoding UTF8
+            $parsed = Get-ReverseRouteScopeFields -Text $rt
+            if ($parsed.Skill) { $primary = $parsed.Skill }
+            if ($parsed.Id) { $primaryId = $parsed.Id }
+        }
+    } finally {
+        Remove-Item -Recurse -Force $tmp -ErrorAction SilentlyContinue
+    }
+}
+
+$created = Get-Date -Format 'o'
+if ($assets.Count -gt 0) {
+    $assetsBlock = ($assets | ForEach-Object { "  - $_" }) -join [Environment]::NewLine
+} else {
+    $assetsBlock = '  []'
+}
+
+$checkAuth = if ($authStatusResolved -eq 'granted') { '[x]' } else { '[ ]' }
+$checkScope = if ($assets.Count -gt 0) { '[x]' } else { '[ ]' }
+$checkNet = if ($networkMode -and $networkMode -ne '') { '[x]' } else { '[ ]' }
+$readyStr = if ($ready) { 'true' } else { 'false' }
+$timelineNext = if ($ready) {
+    'open PRIMARY SKILL.md and ACT within scope'
+} else {
+    'fill scope auth + in_scope; set ready_for_act'
+}
+$timelineSummary = if ($ready) {
+    'case directory created; scope ready_for_act=true'
+} else {
+    'case directory created; scope pending auth'
+}
+
+$scope = @"
+# Case Scope
+
+## meta
+- case_id: $CaseName
+- created: $created
+- operator: local
+- project_root: $projectRoot
+- primary_skill: $primary
+- primary_id: $primaryId
+- lead_role: lead
+- specialist_roles: []
+- hint: $Hint
+- preset: $(if ([string]::IsNullOrWhiteSpace($Preset)) { 'none' } else { $Preset })
+
+## auth
+- status: $authStatusResolved
+- basis: $AuthBasis
+- evidence_of_auth: $evidenceAuth
+- MUST NOT proceed if status != granted
+
+## in_scope
+- assets:
+$assetsBlock
+- surfaces: []
+- activities: []
+
+## out_of_scope
+- assets: []
+- activities: [dos, phishing_real_users, unrestricted_exfil]
+
+## network_profile
+- mode: $networkMode
+- notes: |
+    offline | lab_only | authorized_target_only | unrestricted_lab
+    Change mode only after auth.status = granted.
+
+## deliverables
+- report: true
+- field_journal: true
+- diagrams: true
+- timeline: true
+
+## constraints
+- timebox: {}
+- stealth: low
+- data_handling: anonymize
+
+## signoff
+- ready_for_act: $readyStr
+- checklist:
+  - $checkAuth auth.status = granted
+  - $checkScope in_scope.assets non-empty OR offline sample path set
+  - $checkNet network_profile.mode chosen
+  - [ ] out_of_scope reviewed
+  - [ ] roles assigned (see skills/ops/role-map.md)
+
+## ops_refs
+- skills/ops/scope-contract.md
+- skills/ops/evidence-finding-path.md
+- skills/ops/role-map.md
+- skills/ops/timeline-workitem.md
+- skills/ops/IDENTITY.md
+"@
+
+$timeline = @"
+# Timeline (append-only)
+
+## $created | lead | init
+- action: case-init
+- command_or_ref: skills/scripts/case-init.ps1
+- result_summary: $timelineSummary
+- artifacts: [scope.md, workitems.md]
+- evidence_ids: []
+- decision_delta: [case_initialized]
+- carry_forward_refs: [scope.md]
+- next: $timelineNext
+"@
+
+$workitems = @"
+# Work Items
+
+| ID | title | role | targets | surface | status | evidence | notes |
+|----|-------|------|---------|---------|--------|----------|-------|
+| WI-001 | Establish scope and auth | lead | case | process | in_progress | | |
+
+## Coverage
+- [ ] Recon/analysis complete for in_scope assets
+- [ ] Critical/High candidates triaged (or N/A for pure RE)
+- [ ] Validated findings have Evidence (E-*)
+- [ ] Path documented (attack/call/solve)
+- [ ] Timeline continuous across major phases
+- [ ] Report via docs-generator
+- [ ] field-journal anonymized
+
+## Refs
+- skills/ops/timeline-workitem.md
+- skills/ops/evidence-finding-path.md
+"@
+
+$utf8 = New-Object System.Text.UTF8Encoding $true
+[System.IO.File]::WriteAllText((Join-Path $caseRoot 'scope.md'), $scope, $utf8)
+[System.IO.File]::WriteAllText((Join-Path $caseRoot 'timeline.md'), $timeline, $utf8)
+[System.IO.File]::WriteAllText((Join-Path $caseRoot 'workitems.md'), $workitems, $utf8)
+
+$readmeNext = if ($ready) {
+    @"
+1. Scope is ready_for_act=true (auth granted + in_scope set)
+2. Open primary skill: skills/$primary
+3. Append ``timeline.md``; update ``workitems.md``
+4. Append Evidence: ``skills/scripts/append-evidence.ps1 -CaseRoot <this dir> ...``
+5. Promote findings with Evidence chain (skills/ops/evidence-finding-path.md)
+6. Report via docs-generator; journal via field-journal
+"@
+} else {
+    @"
+1. Edit ``scope.md`` — set auth.status=granted and in_scope
+   - network target: re-run with ``-AuthGranted -TargetUrl <url>``
+   - local sample: re-run with ``-Preset offline-sample -Sample <path>``
+2. Set ready_for_act when checklist complete
+3. Open primary skill: skills/$primary
+4. Append ``timeline.md``; update ``workitems.md``
+5. Promote findings with Evidence chain (skills/ops/evidence-finding-path.md)
+6. Report via docs-generator; journal via field-journal
+"@
+}
+
+$readme = @"
+# Case $CaseName
+
+$readmeNext
+"@
+[System.IO.File]::WriteAllText((Join-Path $caseRoot 'README.md'), $readme, $utf8)
+
+Write-Host ("CASE -> {0}" -f $caseRoot) -ForegroundColor Green
+Write-Host ("PROJECT -> {0}" -f $projectRoot)
+Write-Host ("PRIMARY skill: skills/{0} ({1})" -f $primary, $primaryId)
+Write-Host ("auth.status={0} network_profile={1} ready_for_act={2}" -f $authStatusResolved, $networkMode, $readyStr)
+if ($ready) {
+    Write-Host 'NEXT: open PRIMARY SKILL.md and ACT within scope' -ForegroundColor Green
+} else {
+    Write-Host 'NEXT: fill scope.md auth + in_scope; then open PRIMARY SKILL.md'
+}

package/bundled-skills/docs-generator/scripts/lib/HostRuntime.ps1

@@ -0,0 +1,58 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+# Resolves the PowerShell executable to use when a script must launch a child
+# PowerShell process (e.g. to run another .ps1 in isolation with -NoProfile).
+#
+# Why not hard-code "powershell":
+#   - Modern Windows machines may install only PowerShell 7+ ("pwsh") and not
+#     ship Windows PowerShell 5.1 ("powershell.exe") on PATH.
+#   - Conversely, bare "powershell" resolves to 5.1, which mis-parses UTF-8
+#     scripts without BOM when nested from pwsh.
+# Resolution order (highest confidence first):
+#   1. Current process executable (the host that launched this script)
+#   2. pwsh on PATH
+#   3. powershell on PATH
+#   4. %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
+# Returns the absolute path to the executable. Throws if nothing usable exists.
+function Resolve-ReverseHostExe {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param()
+
+    $hostExe = $null
+
+    try {
+        $procPath = (Get-Process -Id $PID -ErrorAction Stop).Path
+        if ($procPath -and (Test-Path -LiteralPath $procPath)) {
+            $hostExe = $procPath
+        }
+    } catch { }
+
+    if (-not $hostExe) {
+        $cmd = Get-Command pwsh -ErrorAction SilentlyContinue
+        if ($cmd -and $cmd.Source) {
+            $hostExe = $cmd.Source
+        }
+    }
+
+    if (-not $hostExe) {
+        $cmd = Get-Command powershell -ErrorAction SilentlyContinue
+        if ($cmd -and $cmd.Source) {
+            $hostExe = $cmd.Source
+        }
+    }
+
+    if (-not $hostExe -and $env:SystemRoot) {
+        $fallback = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+        if (Test-Path -LiteralPath $fallback) {
+            $hostExe = $fallback
+        }
+    }
+
+    if (-not $hostExe) {
+        throw 'No usable PowerShell host executable found (tried current process, pwsh, powershell, Windows PowerShell fallback).'
+    }
+
+    return $hostExe
+}

package/bundled-skills/docs-generator/scripts/lib/WorkRoot.ps1

@@ -0,0 +1,33 @@
+Set-StrictMode -Version Latest
+
+function Resolve-ReverseProjectRoot {
+    [CmdletBinding()]
+    param(
+        [AllowEmptyString()]
+        [string]$RequestedRoot = ''
+    )
+
+    $root = if ([string]::IsNullOrWhiteSpace($RequestedRoot)) {
+        (Get-Location).ProviderPath
+    } else {
+        $RequestedRoot
+    }
+
+    if ([string]::IsNullOrWhiteSpace($root)) {
+        throw 'Unable to resolve the analysis project root.'
+    }
+
+    if (-not (Test-Path -LiteralPath $root)) {
+        New-Item -ItemType Directory -Force -Path $root | Out-Null
+    }
+    if (-not (Test-Path -LiteralPath $root -PathType Container)) {
+        throw "Project root is not a directory: $root"
+    }
+
+    $item = Get-Item -LiteralPath $root
+    if ($item.PSProvider.Name -ne 'FileSystem') {
+        throw "Project root must use the FileSystem provider: $root"
+    }
+
+    return $item.FullName
+}

package/bundled-skills/documentation/SKILL.md

@@ -23,6 +23,10 @@ Use this workflow when:
 - Creating user guides
 - Maintaining wikis
 
+## Scope
+
+Select only the phases needed for the request; this bundle does not authorize every referenced skill or external publication. Verify each ID and local prerequisites before invocation. Preserve existing docs, distinguish proposed from accepted decisions, keep private data out of public examples, and run the project's actual documentation checks.
+
 ## Workflow Phases
 
 ### Phase 1: Documentation Planning
@@ -183,7 +187,7 @@ Use @wiki-onboarding to create onboarding docs
 2. Categorize changes
 3. Generate changelog
 4. Create release notes
-5. Publish updates
+5. Prepare updates; publish only to the explicitly authorized destination
 
 #### Copy-Paste Prompts
 ```