opencode-skills-collection 4.1.15 → 4.1.16

package/bundled-skills/api-testing-observability-api-mock/resources/implementation-playbook.md

@@ -1,6 +1,26 @@
 # API Mocking Implementation Playbook
 
-This file contains detailed patterns, checklists, and code samples referenced by the skill.
+This file contains a complete pure fixture resolver followed by architectural sketches. The larger server classes depend on unbundled route/state/scenario/validation helpers; they are design material, not a runnable mock framework. Do not claim they ran or that their missing helpers passed. Use an existing project-local mocking library or implement and test those dependencies before adapting them.
+
+
+## Complete local fixture example
+
+This standard-library example resolves only declared scenarios, performs no network calls, and returns a copy so a test cannot contaminate another test's fixture. Real provider contract validation remains separate.
+
+```python
+from copy import deepcopy
+
+FIXTURES = {
+    ("GET", "/users/example", "success"): {"status": 200, "body": {"id": "example"}},
+    ("GET", "/users/example", "unavailable"): {"status": 503, "body": {"error": "unavailable"}},
+}
+
+def resolve_fixture(method, path, scenario):
+    key = (method.upper(), path, scenario)
+    if key not in FIXTURES:
+        raise KeyError("Undeclared fixture route/scenario")
+    return deepcopy(FIXTURES[key])
+```
 
 ## Detailed Steps
 
@@ -65,7 +85,7 @@ class MockAPIServer:
             self.state_manager.track_request({
                 'method': request.method,
                 'path': str(request.url.path),
-                'headers': dict(request.headers),
+                'header_names': sorted(k for k in request.headers if k.lower() not in {'authorization', 'cookie', 'x-api-key'}),
                 'timestamp': datetime.now()
             })
             response = await call_next(request)
@@ -101,10 +121,10 @@ class MockAPIServer:
         if mock.get('conditions'):
             for condition in mock['conditions']:
                 if self._evaluate_condition(condition, request):
-                    return await self._generate_response(condition['response'], request)
+                    return self._generate_response(condition['response'], request)
 
         # Use default response
-        return await self._generate_response(mock['response'], request)
+        return self._generate_response(mock['response'], request)
 
     def _generate_response(self, response_template: Dict[str, Any], request: Request):
         """Generate response from template"""
@@ -247,7 +267,7 @@ class DynamicStub:
         request_data = {
             'method': request.method,
             'path': request.url.path,
-            'headers': dict(request.headers),
+            'header_names': sorted(k for k in request.headers if k.lower() not in {'authorization', 'cookie', 'x-api-key'}),
             'query_params': dict(request.query_params),
             'body': await request.json() if request.method in ['POST', 'PUT'] else None
         }
@@ -1147,7 +1167,7 @@ services:
       context: .
       dockerfile: Dockerfile.mock
     ports:
-      - "3001:3001"
+      - "127.0.0.1:3001:3001"
     environment:
       - MOCK_SCENARIO=production
       - MOCK_DATA_PATH=/data/mocks
@@ -1165,7 +1185,7 @@ services:
       context: .
       dockerfile: Dockerfile.admin
     ports:
-      - "3002:3002"
+      - "127.0.0.1:3002:3002"
     environment:
       - MOCK_SERVER_URL=http://mock-api:3001
     depends_on:
@@ -1252,7 +1272,7 @@ class MockDocumentationGenerator:
 **Request**:
 ```json
 {json.dumps(endpoint.get('request_example', {}), indent=2)}
-````
+```
 
 **Response**:
 
@@ -1261,9 +1281,9 @@ class MockDocumentationGenerator:
 ```
 
 **Scenarios**:
-{self.\_format_endpoint_scenarios(endpoint)}
+{self._format_endpoint_scenarios(endpoint)}
 """
-return doc
+        return doc
 
     def create_interactive_docs(self):
         """Create interactive API documentation"""
@@ -1309,7 +1329,7 @@ return doc
 </body>
 </html>
 '''
-```
+````
 
 ## Output Format
 

package/bundled-skills/apk-reverse/SKILL.md

@@ -9,6 +9,20 @@ date_added: "2026-08-25"
 license: "MIT"
 license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"
 ---
+## Bundled upstream support
+
+Supporting files are included at skill-relative paths. See [UPSTREAM-NOTICE.md](UPSTREAM-NOTICE.md) for their pinned sources, licenses, hashes, and import changes.
+
+## Supporting material availability
+
+These paths remain unavailable in this catalog copy:
+
+- `<support-root>/scripts/decode.ps1`
+- `<support-root>/scripts/frida-run.ps1`
+- `<support-root>/scripts/rebuild-sign-install.ps1`
+
+Do not invoke a step that requires one of these files. Obtain the original material and review its dependencies, license, and effects before use. Independent inline steps and the bundled helpers can proceed within the user’s authorized scope.
+
 > **⚠️ AUTHORIZED USE ONLY**
 > This skill is for educational purposes or authorized security assessments only.
 > You must have explicit, written permission from the system owner before using this tool.

package/bundled-skills/apk-reverse/UPSTREAM-LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 zhaoxuya520
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bundled-skills/apk-reverse/UPSTREAM-NOTICE.md

@@ -0,0 +1,11 @@
+# Upstream helpers for apk-reverse
+
+The files listed below were recovered from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) at commit `cab634bd855fc287f6e420c1f36fd1a6b9245960`. The repository ID is `1237819660`.
+
+They retain the upstream **MIT** license reproduced in [UPSTREAM-LICENSE.txt](UPSTREAM-LICENSE.txt). This notice applies to the listed support files; it does not replace the license metadata of other catalog files. Preserve the upstream license and this attribution when redistributing them.
+
+License wording is unchanged; text-only trailing whitespace and EOF blank lines are normalized. Original license: https://github.com/zhaoxuya520/reverse-skill/blob/cab634bd855fc287f6e420c1f36fd1a6b9245960/LICENSE
+
+| Local file | Original upstream path | Original Git blob SHA | Import changes |
+| --- | --- | --- | --- |
+| `scripts/manifest-summary.ps1` | `skills/apk-reverse/scripts/manifest-summary.ps1` | `8fd9d76f42bd4597897ad98980b86bf8280491ab` | content unchanged |

package/bundled-skills/apk-reverse/scripts/manifest-summary.ps1

@@ -0,0 +1,80 @@
+#requires -Version 5
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$ManifestPath
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = [System.Text.UTF8Encoding]::new($false)
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+$OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+
+if (-not (Test-Path -LiteralPath $ManifestPath)) {
+    throw "Manifest not found: $ManifestPath"
+}
+
+$xml = [xml](Get-Content -LiteralPath $ManifestPath -Raw -Encoding UTF8)
+$androidNs = 'http://schemas.android.com/apk/res/android'
+$nsMgr = [System.Xml.XmlNamespaceManager]::new($xml.NameTable)
+$nsMgr.AddNamespace('android', $androidNs)
+
+function Get-AndroidAttr {
+    param(
+        [Parameter(Mandatory = $true)]$Node,
+        [Parameter(Mandatory = $true)][string]$Name
+    )
+
+    return [string]$Node.GetAttribute($Name, $androidNs)
+}
+
+$manifest = $xml.manifest
+$packageName = [string]$manifest.package
+
+"package=$packageName"
+
+$permissions = @($manifest.SelectNodes('uses-permission'))
+"permission_count=$($permissions.Count)"
+foreach ($perm in $permissions) {
+    $name = Get-AndroidAttr -Node $perm -Name 'name'
+    if ($name) {
+        "permission=$name"
+    }
+}
+
+$componentQueries = @(
+    @{ Label = 'activity'; Path = 'application/activity' },
+    @{ Label = 'service'; Path = 'application/service' },
+    @{ Label = 'receiver'; Path = 'application/receiver' },
+    @{ Label = 'provider'; Path = 'application/provider' }
+)
+
+foreach ($query in $componentQueries) {
+    $nodes = @($manifest.SelectNodes($query.Path))
+    ($query.Label + '_count=' + $nodes.Count)
+    foreach ($node in $nodes) {
+        $name = Get-AndroidAttr -Node $node -Name 'name'
+        $exported = Get-AndroidAttr -Node $node -Name 'exported'
+        $enabled = Get-AndroidAttr -Node $node -Name 'enabled'
+        ($query.Label + '=' + $name + "`t" + $exported + "`t" + $enabled)
+    }
+}
+
+$mainActivities = @()
+$activities = @($manifest.SelectNodes('application/activity'))
+foreach ($activity in $activities) {
+    $filters = @($activity.SelectNodes('intent-filter'))
+    foreach ($filter in $filters) {
+        $hasMain = @($filter.SelectNodes('action')).Where({ (Get-AndroidAttr -Node $_ -Name 'name') -eq 'android.intent.action.MAIN' }).Count -gt 0
+        $hasLauncher = @($filter.SelectNodes('category')).Where({ (Get-AndroidAttr -Node $_ -Name 'name') -eq 'android.intent.category.LAUNCHER' }).Count -gt 0
+        if ($hasMain -and $hasLauncher) {
+            $mainActivities += (Get-AndroidAttr -Node $activity -Name 'name')
+        }
+    }
+}
+
+foreach ($entry in ($mainActivities | Select-Object -Unique)) {
+    "main_activity=$entry"
+}

package/bundled-skills/architecture-review/SKILL.md

@@ -30,7 +30,7 @@ Use this skill when the user asks for architecture review using Ontoly evidence.
 
 ## Required Workflow
 
-Follow [the shared Ontoly workflow. Also read [graph evidence rules, [MCP usage, [best practices, and [fallback rules when the task requires detail.
+Follow the [shared Ontoly workflow](reference/workflow.md). Read the [graph evidence rules](reference/graph.md), [MCP usage](reference/mcp.md), [best practices](reference/best-practices.md), and [fallback rules](reference/fallbacks.md) when the task requires detail.
 
 ## Ontoly Capabilities
 
@@ -52,9 +52,9 @@ Do not implement compiler, query, MCP, SDK, or business logic in the skill. Do n
 
 ## Resources
 
-- [Examples
-- [Prompt template
-- [Capability notes
+- [Examples](examples.md)
+- [Prompt template](templates/architecture-review.md)
+- [Capability notes](reference/capabilities.md)
 
 ## Learn more
 

package/bundled-skills/arm-cortex-expert/SKILL.md

@@ -23,7 +23,6 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## 🎯 Role & Objectives
 

package/bundled-skills/arrowspace/SKILL.md

@@ -30,7 +30,7 @@ Spectral vector search that augments nearest-neighbour search with graph Laplaci
 ### Step 1: Install and import
 
 ```bash
-pip install arrowspace
+python3 -m pip install "arrowspace==0.28.1" numpy  # review/pin remaining dependencies in an isolated environment
 ```
 
 ```python
@@ -43,17 +43,16 @@ import numpy as np
 Pass an (N, d) float64 NumPy array of embedding vectors:
 
 ```python
-items = np.array([[0.1, 0.2, 0.3],
-                  [0.0, 0.5, 0.1],
-                  [0.9, 0.1, 0.0]], dtype=np.float64)
+rng = np.random.default_rng(7)
+items = rng.normal(size=(32, 8)).astype(np.float64)
+items /= np.linalg.norm(items, axis=1, keepdims=True)
 ```
 
 ### Step 3: Configure graph parameters
 
 ```python
-graph_params = {"eps": 0.2, "k": 6, "topk": 3, "p": 2.0, "sigma": 1.0}
-builder = ArrowSpaceBuilder(items, graph_params=graph_params)
-aspace = builder.build()
+graph_params = {"eps": 0.5, "k": 6, "topk": 3, "p": 2.0, "sigma": None}
+aspace, graph = ArrowSpaceBuilder().build(graph_params, items)
 ```
 
 ### Step 4: Query
@@ -63,18 +62,19 @@ lambdas = aspace.lambdas()           # array indexed by insertion order
 sorted_res = aspace.lambdas_sorted()  # (score, index) pairs ascending
 ```
 
-Higher λτ values indicate items that are both semantically close and structurally central.
+These are per-item spectral signatures, not graph eigenvalues or query-dependent relevance scores. Sorting them alone is not nearest-neighbor retrieval; do not infer closeness to a query or graph centrality from a large signature.
 
 ## Examples
 
 ### Example 1: Basic spectral retrieval
 
 ```python
-items = np.random.randn(100, 64).astype(np.float64)
-builder = ArrowSpaceBuilder(items, graph_params={"eps": 0.5, "k": 10, "topk": 5, "p": 2.0, "sigma": None})
-aspace = builder.build()
-scores = aspace.lambdas()
-top_indices = np.argsort(scores)[-5:]
+# Reuse the normalized corpus and graph above; verify degenerate scores first.
+if np.any(np.abs(aspace.lambdas()) < 1e-12):
+    raise ValueError("Tune graph parameters for this corpus before searching")
+query = items[0].copy()
+hits = aspace.search(query, graph, tau=0.7, k=5)
+# hits contains query-dependent (item_index, score) pairs, not a lambda-only ranking.
 ```
 
 ### Example 2: Compare spectral vs cosine ranking
@@ -82,28 +82,30 @@ top_indices = np.argsort(scores)[-5:]
 ```python
 from sklearn.metrics.pairwise import cosine_similarity
 cos_sim = cosine_similarity(items)
-cosine_order = np.argsort(cos_sim[0])[::-1]
-spectral_order = np.argsort(aspace.lambdas())[::-1]
+cosine_order = np.argsort(cos_sim[0])[::-1][:5]
+spectral_order = [index for index, score in aspace.search(items[0], graph, tau=0.7, k=5)]
+# For retrieval evaluation, exclude self-matches and use held-out relevance labels.
 ```
 
 ## Best Practices
 
 - ✅ Normalise embeddings to unit norm before passing to ArrowSpace
-- ✅ Start with eps proportional to 1/sqrt(dim) and tune from there
-- ✅ Use k between 3 and 25 depending on dataset size (rule: N/50)
-- ✅ Set sigma=None to auto-select kernel width from distance distribution
-- ❌ Don't use with fewer than 10 items (graph structure is not meaningful)
+- ✅ Treat graph parameters as corpus-dependent; inspect disconnected/degenerate scores and tune using an explicitly selected objective
+- ✅ Choose k relative to the actual corpus and library constraints; N/50 is not a universal quality guarantee
+- ✅ In the reviewed 0.28 API, sigma=None uses the eps-dependent default; it is not automatic distribution fitting
+- ✅ Small corpora can illustrate the API, but retrieval quality requires corpus-appropriate evaluation; ten items is not a mathematical validity threshold
 - ❌ Don't use for real-time streaming data (ArrowSpace is batch-oriented)
 
 ## Limitations
 
-- This skill does not replace environment-specific validation, testing, or expert review.
+- API examples target the reviewed 0.28 interface; [immutable upstream skill](https://github.com/Genefold/arrowspace-skills/blob/8d9e8e30be314292e2ee60b84f0c163963660d41/SKILL.md) documents the builder, graph return value and query-aware search. These examples were checked against source documentation, not executed here.
+- Fit graph parameters and tau on held-out retrieval evidence; λτ signatures alone do not prove better recall or structural importance.
 - ArrowSpace is batch-oriented and not designed for real-time indexing of streaming data.
 
 ## Common Pitfalls
 
 - **Problem:** eps is too small, producing a disconnected graph
-  **Solution:** Increase eps, or set it proportional to 1/sqrt(embedding_dim)
+  **Solution:** Inspect graph connectivity and degenerate scores, then tune eps against the actual data; no dimension-only formula is guaranteed
 
 - **Problem:** k is too large, producing a dense graph with washed-out spectral features
   **Solution:** Keep k ≤ 25 for most datasets

package/bundled-skills/ask-questions-if-underspecified/SKILL.md

@@ -31,7 +31,7 @@ Treat a request as underspecified if after exploring how to perform the work, so
 - Identify environment (language/runtime versions, OS, build/test runner)
 - Clarify safety/reversibility (data migration, rollout/rollback, risk)
 
-If multiple plausible interpretations exist, assume it is underspecified.
+Multiple interpretations justify a question only when they materially change the outcome or risk; resolve routine reversible details from the existing context.
 
 ### 2) Ask must-have questions first (keep it small)
 
@@ -52,9 +52,9 @@ Until must-have answers arrive:
 - Do not run commands, edit files, or produce a detailed plan that depends on unknowns
 - Do perform a clearly labeled, low-risk discovery step only if it does not commit you to a direction (e.g., inspect repo structure, read relevant config files)
 
-If the user explicitly asks you to proceed without answers:
-- State your assumptions as a short numbered list
-- Ask for confirmation; proceed only after they confirm or correct them
+If the user explicitly authorizes proceeding with reasonable assumptions:
+- State the assumptions briefly and continue within that authorized scope; do not ask for the same confirmation again.
+- Keep only genuinely missing consequential authorization or indispensable inputs pending, while completing independent safe work.
 
 ### 4) Confirm interpretation, then proceed
 

package/bundled-skills/audit-logging/SKILL.md

@@ -10,8 +10,8 @@ source_type: community
 date_added: '2026-09-20'
 license: MIT
 license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
-compatibility: Checklist and framework guidance; no privileged tooling required. Apply
-  controls through your own change process.
+compatibility: Linux infrastructure examples require the matching logging services and
+  authorized administrator access. Application examples require a writable approved log destination.
 metadata:
   author: devops-skills
   version: '1.0'
@@ -26,7 +26,7 @@ Implement comprehensive audit logging for compliance, security monitoring, and f
 - Setting up centralized logging for compliance frameworks (SOC 2, HIPAA, PCI DSS)
 - Implementing security event monitoring and alerting
 - Building audit trails for regulatory requirements
-- Configuring log retention and tamper-proof storage
+- Configuring log retention and integrity-protected storage
 - Integrating application logs with SIEM platforms
 
 ## Log Categories
@@ -161,10 +161,10 @@ from datetime import datetime, timezone
 from functools import wraps
 
 class AuditLogger:
-    def __init__(self, service_name, logger_name="audit"):
+    def __init__(self, service_name, log_path, logger_name="audit"):
         self.service = service_name
         self.logger = logging.getLogger(logger_name)
-        handler = logging.FileHandler("/var/log/app/audit.log")
+        handler = logging.FileHandler(log_path)
         handler.setFormatter(logging.Formatter("%(message)s"))
         self.logger.addHandler(handler)
         self.logger.setLevel(logging.INFO)
@@ -239,7 +239,7 @@ def audit_trail(audit_logger, resource_name):
                     resource=resource_name,
                     action=func.__name__,
                     result="failure",
-                    metadata={"error": str(e)},
+                    metadata={"error_code": "operation_failed"},
                 )
                 raise
         return wrapper
@@ -337,80 +337,13 @@ def audit_trail(audit_logger, resource_name):
 }
 ```
 
-## Retention Policy by Compliance Framework
+## Retention and integrity requirements
 
-```yaml
-retention_requirements:
-  soc2:
-    minimum: 1 year
-    recommended: 3 years
-    notes: "Based on audit period and report requirements"
-
-  hipaa:
-    minimum: 6 years
-    notes: "From date of creation or last effective date"
-
-  pci_dss:
-    minimum: 1 year
-    immediately_available: 3 months
-    notes: "Req 10.7 - retain for at least one year, 3 months immediately available"
-
-  gdpr:
-    minimum: "As long as necessary for processing purpose"
-    notes: "Apply data minimization; delete when no longer needed"
-
-  fedramp:
-    minimum: 3 years
-    notes: "AU-11 control requirement"
-
-  iso27001:
-    minimum: "Defined by organization policy"
-    recommended: 3 years
-    notes: "A.12.4.1 - retention period must be defined"
-```
-
-## Log Integrity Verification Script
-
-```bash
-#!/usr/bin/env bash
-# verify-log-integrity.sh - Verify log file checksums against stored hashes
-
-LOG_DIR="/var/log/app"
-HASH_FILE="/var/log/app/.checksums"
-ALERT_WEBHOOK="${ALERT_WEBHOOK_URL}"
-
-verify_logs() {
-  local failures=0
-  while IFS='  ' read -r stored_hash filename; do
-    if [ -f "$filename" ]; then
-      current_hash=$(sha256sum "$filename" | awk '{print $1}')
-      if [ "$stored_hash" != "$current_hash" ]; then
-        echo "TAMPER DETECTED: $filename"
-        failures=$((failures + 1))
-        curl -s -X POST "$ALERT_WEBHOOK" \
-          -H "Content-Type: application/json" \
-          -d "{\"text\":\"ALERT: Audit log tamper detected on $(hostname): $filename\"}"
-      fi
-    else
-      echo "MISSING: $filename"
-      failures=$((failures + 1))
-    fi
-  done < "$HASH_FILE"
-
-  return $failures
-}
+Define a retention register with framework/version, applicable control, data type, purpose, jurisdiction, legal hold, owner, approved period and authoritative evidence. Do not apply a single framework duration to every log type; documentation-retention obligations and operational-log retention differ. Obtain qualified review of legal and contractual requirements before applying deletion or export policies. The 365-day infrastructure examples are capacity-policy illustrations, not minimum compliance requirements.
 
-update_checksums() {
-  find "$LOG_DIR" -name "*.log" -type f -exec sha256sum {} \; > "$HASH_FILE"
-  chmod 440 "$HASH_FILE"
-}
+Checksums and the illustrative in-process hash chain detect some changes only when compared with a separately protected trusted checkpoint. They do not make storage immutable, survive restart without persistence, prevent a privileged actor rewriting both log and hashes, or establish regulatory compliance. Use independently protected append-only storage, authenticated checkpoints and restoration tests appropriate to the threat model.
 
-case "${1:-verify}" in
-  verify)  verify_logs ;;
-  update)  update_checksums ;;
-  *)       echo "Usage: $0 {verify|update}" ;;
-esac
-```
+For local verification, use a project-reviewed manifest with a fixed approved directory, reject traversal/symlinks and missing files, and report failures locally. Do not automatically regenerate the trusted baseline after failure. Uploading audit logs, enabling forwarding and sending webhook alerts require explicit destination/data authorization; no notification is sent by this guide itself.
 
 ## SIEM Integration Checklist
 

package/bundled-skills/automated-triage/SKILL.md

@@ -9,6 +9,9 @@ date_added: 2026-07-01
 license: Apache-2.0
 license_source: https://github.com/monte-carlo-data/mc-agent-toolkit/blob/main/LICENSE
 ---
+## Bundled upstream support
+
+Supporting files are included at skill-relative paths. See [UPSTREAM-NOTICE.md](UPSTREAM-NOTICE.md) for their pinned sources, licenses, hashes, and import changes.
 
 # Monte Carlo Automated Triage