opencode-skills-collection 4.1.15 → 4.1.16

package/bundled-skills/claude-speed-reader/SKILL.md

@@ -14,13 +14,23 @@ date_added: "2026-02-27"
 
 ## When to Use This Skill
 
-Use this skill when you need to work with -speed read claude's responses at 600+ wpm using rsvp with spritz-style orp highlighting.
+Use when the user wants an RSVP reader for an existing response or supplied text and a compatible upstream reader is available.
 
 ## Instructions
 
-This skill provides guidance and patterns for -speed read claude's responses at 600+ wpm using rsvp with spritz-style orp highlighting.
+This AAS entrypoint is a guide to the upstream reader, not the bundled reader itself.
+Verify an installed, reviewed upstream copy before invoking its command. In Claude
+Code, upstream documents `/speed` for the last response and `/speed "text"` for
+custom text. Other hosts may not implement that slash command.
 
-For more information, see the [source repository](https://github.com/SeanZoR/claude-speed-reader).
+1. Confirm the text the user wants displayed; exclude sensitive response history
+   from external tools unless sharing is authorized.
+2. Use the reader's adjustable speed and pause controls; start at a comfortable rate.
+3. Check that the actual reader opens and displays the intended text. Do not claim
+   it ran merely because the command was printed.
+
+RSVP presentation rate is not proof of comprehension. This skill does not guarantee
+600 WPM reading ability and does not install browser assets automatically.
 
 ## Example
 

package/bundled-skills/claude-win11-speckit-update-skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: claude-win11-speckit-update-skill
-description: "Windows 11 system management"
-risk: safe
+description: "Review updates to GitHub SpecKit on Windows 11 with PowerShell, preserving local templates and customizations"
+risk: critical
 source: "https://github.com/NotMyself/claude-win11-speckit-update-skill"
 date_added: "2026-02-27"
 ---
@@ -10,7 +10,7 @@ date_added: "2026-02-27"
 
 ## Overview
 
-Windows 11 system management
+Review updates to GitHub SpecKit on Windows 11 with PowerShell, preserving local templates and customizations
 
 ## When to Use This Skill
 
@@ -18,15 +18,21 @@ Use this skill when you need to work with windows 11 system management.
 
 ## Instructions
 
-This skill provides guidance and patterns for windows 11 system management.
-
-For more information, see the [source repository](https://github.com/NotMyself/claude-win11-speckit-update-skill).
+This is a guide to an archived upstream SpecKit updater, not Windows system
+administration. No updater scripts are bundled in AAS. Confirm Windows, PowerShell,
+Git and the project's existing SpecKit installation before selecting a supported
+update path. Record the installed version, current file diff and intended upstream
+revision. Preserve a separate copy of local customizations, review the proposed
+three-way changes, and apply only the accepted changes within the project scope.
+Do not run `specify init --force` as a shortcut or claim preservation before inspecting
+the result. If the legacy updater is absent, produce a reviewable migration plan;
+do not invent its slash command or execute unreviewed scripts.
 
 ## Example
 
 **User request:**
 
-> Use @claude-win11-speckit-update-skill for this task: Windows 11 system management.
+> Use @claude-win11-speckit-update-skill for this task: Review updates to GitHub SpecKit on Windows 11 with PowerShell, preserving local templates and customizations.
 
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.

package/bundled-skills/cline-pilot/SKILL.md

@@ -21,6 +21,16 @@ compatibility: Requires the `cline` CLI (v3.x) installed with an LLM endpoint co
 metadata:
   version: 0.3.9
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+- `<support-root>/references/local-config.md`
+- `<support-root>/references/project-profiles.md`
+- `<support-root>/references/decision-log.md`
+
+Obtain the required material from the [declared upstream source](https://github.com/gongdear/cline-pilot), or from a user-provided installation of that source. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # Cline Pilot — 代用户调度 Cline 的"领航员"
 

package/bundled-skills/closed-loop-delivery/SKILL.md

@@ -31,17 +31,17 @@ Before execution, define these once:
 - task goal
 - acceptance criteria (DoD)
 - target environment (`dev` by default)
-- max iteration rounds (default `2`)
+- review cadence/budget when requested; a default review cadence is not a task-completion limit
 
 If acceptance criteria are missing, request them once. If user does not provide, propose a concrete default and proceed.
 
 ## Issue Gate Dependency
 
-Before execution, prefer using `create-issue-gate`.
+If the project already uses create-issue-gate, respect its current contract; otherwise derive acceptance criteria from the authorized task without inventing a mandatory issue.
 
 - If issue status is `ready` and execution gate is `allowed`, continue.
-- If issue status is `draft`, do not execute implementation/deploy/review loops.
-- Require user-provided, testable acceptance criteria before starting execution.
+- A real project-required draft gate can block dependent actions; it does not forbid independent discovery or already-authorized work under a different applicable workflow.
+- Use available task context to formulate testable criteria; clarify only when a missing decision materially changes the outcome.
 
 ## Default Workflow
 
@@ -61,7 +61,7 @@ Before execution, prefer using `create-issue-gate`.
    - Fix valid items, re-run verification.
 
 5. **Dev deploy + runtime verification**
-   - Deploy to `dev` when runtime behavior matters.
+   - Deploy only to an already-authorized dev target when runtime behavior matters; otherwise prepare and verify the concrete candidate locally.
    - Verify via real API/Lambda/log evidence against DoD.
 
 6. **Completion decision**
@@ -85,7 +85,7 @@ If CI is still running, align polling to check completion boundaries instead of
 
 ## Human Gate Rules (Must Ask)
 
-Require explicit user confirmation for:
+Require missing consequential authorization for the following; do not request it again when the user has already granted the exact scope:
 - production/staging deploy beyond agreed scope
 - destructive operations (history rewrite, force push, data-destructive ops)
 - actions with billing/security posture changes
@@ -95,7 +95,7 @@ Require explicit user confirmation for:
 ## Iteration/Stop Conditions
 
 Stop and escalate with a concise blocker report when:
-- DoD still fails after max rounds (`2` default)
+- The same verified external blocker leaves no meaningful authorized next step; two failed iterations alone are not a reason to stop when useful repair work remains
 - external dependency blocks progress (provider outage, missing creds, account permission)
 - conflicting review instructions cannot both be satisfied
 

package/bundled-skills/cloud-architect/SKILL.md

@@ -21,7 +21,6 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 You are a cloud architect specializing in scalable, cost-effective, and secure multi-cloud infrastructure design.
 

package/bundled-skills/cloudflare-workers-expert/SKILL.md

@@ -24,10 +24,10 @@ You are a senior Cloudflare Workers Engineer specializing in edge computing arch
 
 ## Instructions
 
-1. **Wrangler Ecosystem**: Use `wrangler.toml` for configuration and `npx wrangler dev` for local testing.
+1. **Wrangler Ecosystem**: Use the project’s wrangler.jsonc or wrangler.toml configuration and `npx wrangler dev` for local testing.
 2. **Fetch API**: Remember that Workers use the Web standard Fetch API, not Node.js globals.
 3. **Bindings**: Define all bindings (KV, D1, secrets) in `wrangler.toml` and access them through the `env` parameter in the `fetch` handler.
-4. **Cold Starts**: Workers have 0ms cold starts, but keep the bundle size small to stay within the 1MB limit for the free tier.
+4. **Cold Starts**: Do not promise zero latency or hardcode an old size limit. Check [current plan limits](https://developers.cloudflare.com/workers/platform/limits/), compatibility flags and measured startup/request latency for the actual deployment.
 5. **Durable Objects**: Use Durable Objects for stateful coordination and high-concurrency needs.
 6. **Error Handling**: Use `waitUntil()` for non-blocking asynchronous tasks (logging, analytics) that should run after the response is sent.
 
@@ -47,7 +47,7 @@ export default {
     ctx: ExecutionContext,
   ): Promise<Response> {
     const value = await env.MY_KV_NAMESPACE.get("my-key");
-    if (!value) {
+    if (value === null) {
       return new Response("Not Found", { status: 404 });
     }
     return new Response(`Stored Value: ${value}`);
@@ -86,9 +86,10 @@ export default {
 ## Troubleshooting
 
 **Problem:** Request exceeded CPU time limit.
-**Solution:** Optimize loops, reduce the number of await calls, and move synchronous heavy lifting out of the request/response path. Use `ctx.waitUntil()` for tasks that don't block the response.
+**Solution:** Optimize loops, profile synchronous CPU work and reduce it. Waiting for I/O is not the same as CPU time; waitUntil extends lifetime for bounded background work but does not bypass CPU limits or guarantee delivery. Use a reviewed queue for durable jobs.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
+- Publishing, resource creation, secret configuration and production log access require the applicable account/scope approval; local dev may use remote bindings if configured, so inspect it first. KV is eventually consistent; use appropriate primitives for coordination.
+- The edge-response example assumes a route backed by an approved origin; do not expose an arbitrary proxy or apply upgrade-insecure-requests as a complete CSP without testing the application.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

package/bundled-skills/cloudformation-best-practices/SKILL.md

@@ -34,7 +34,7 @@ You are an expert in AWS CloudFormation specializing in template optimization, s
 
 ```yaml
 AWSTemplateFormatVersion: "2010-09-09"
-Description: Production VPC with public and private subnets
+Description: Minimal VPC skeleton; subnet/routing/security resources are not included
 
 Parameters:
   Environment:
@@ -76,9 +76,10 @@ Outputs:
 ## Troubleshooting
 
 **Problem:** Stack stuck in `UPDATE_ROLLBACK_FAILED`
-**Solution:** Use `continue-update-rollback` with `--resources-to-skip` for the failing resource, then fix the root cause.
+**Solution:** Inspect the exact stack events and failed-resource state first. Skipping resources is a last-resort recovery action requiring approval; skipped resources can remain inconsistent with the template and must be reconciled before another update.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
+- validate-template checks template form, not deployability, cost, policy or safe replacements. Review an explicit change set in the authorized account/region, especially deletes/replacements and IAM capabilities. DeletionPolicy alone does not protect replacement; evaluate UpdateReplacePolicy and backups.
+- Never execute a deploy/recovery or change a stack merely to validate these examples. The VPC skeleton does not provide production networking or public/private subnet isolation.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

package/bundled-skills/cmux/SKILL.md

@@ -13,6 +13,14 @@ tools: [claude, codex]
 license: "MIT"
 license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+- `<support-root>/references/socket-api.md`
+
+Obtain the required material from the [declared upstream source](https://github.com/davidondrej/skills), or from a user-provided installation of that source. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # cmux Control
 

package/bundled-skills/code-refactoring-context-restore/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: code-refactoring-context-restore
-description: "Use when working with code refactoring context restore"
+description: "Resume interrupted project work from a handoff and current checkout evidence; reconcile completed work, pending changes and existing user constraints."
 risk: critical
 source: community
 date_added: "2026-02-27"

package/bundled-skills/code-review-ai-ai-review/SKILL.md

@@ -5,6 +5,14 @@ risk: critical
 source: community
 date_added: "2026-02-27"
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+- `<support-root>/scripts/ai_review.py`
+
+Ask for the original supporting material or an existing installation before using a step that depends on these paths; this catalog does not identify a verified download source for them. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # AI-Powered Code Review Specialist
 
@@ -25,7 +33,6 @@ You are an expert AI-powered code review specialist combining automated static a
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Context
 

package/bundled-skills/code-review-and-quality/SKILL.md

@@ -9,6 +9,15 @@ date_added: 2026-07-01
 license: MIT
 license_source: https://github.com/addyosmani/agent-skills/blob/main/LICENSE
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+- `<support-root>/references/security-checklist.md`
+- `<support-root>/references/performance-checklist.md`
+
+Obtain the required material from the [declared upstream source](https://github.com/addyosmani/agent-skills), or from a user-provided installation of that source. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # Code Review and Quality
 

package/bundled-skills/code-reviewer/SKILL.md

@@ -21,7 +21,6 @@ date_added: "2026-02-27"
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 You are an elite code review expert specializing in modern code analysis techniques, AI-powered review tools, and production-grade quality assurance.
 

package/bundled-skills/codex-review/SKILL.md

@@ -22,9 +22,9 @@ npx skills add -g BenedictKing/codex-review
 ```
 
 ## Step-by-Step Guide
-1. Install the skill using the command above
+1. This entrypoint does not bundle the upstream integration. Inspect a selected upstream revision and authorize installation scope before using the installation option above.
 2. Ensure Codex CLI is installed
-3. Use `/codex-review` or natural language triggers
+3. Use `/codex-review` only when the installed host exposes it. Pin repository/base/head and inspect the net diff directly; return findings with exact trigger, location and evidence. A generated CHANGELOG must match the actual diff and must not rewrite unrelated release history.
 
 ## Examples
 See [GitHub Repository](https://github.com/BenedictKing/codex-review) for examples.
@@ -40,6 +40,7 @@ See the GitHub repository for troubleshooting guides.
 - context7-auto-research, tavily-web, exa-search, firecrawl-scraper
 
 ## Limitations
+- An automated reviewer is advisory, not merge approval. Confirm provider/data/cost scope before sending private source externally; no implicit commit, push or publication.
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

package/bundled-skills/commit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: commit
-description: ALWAYS use this skill when committing code changes — never commit directly without it. Creates commits following Sentry conventions with proper conventional commit format and issue references. Trigger on any commit, git commit, save changes, or commit message task.
+description: "Prepare or create commits using Sentry-style message conventions when the repository requests them; inspect staged scope and honor its protected branch workflow."
 risk: critical
 source: community
 date_added: "2026-09-04"
@@ -23,15 +23,16 @@ Before committing, always check the current branch:
 git branch --show-current
 ```
 
-**If you're on `main` or `master`, you MUST create a feature branch first** — unless the user explicitly asked to commit to main and the server permits direct pushes. A user request does not bypass protected-branch rules; when the remote rejects direct updates, use the repository's required pull-request path. Do not ask the user whether to create a branch; just proceed with branch creation. The `create-branch` skill will still propose a branch name for the user to confirm.
+Read repository policy before creating a commit. If the default branch is PR-only,
+create an authorized topic branch and use the repository's native maintainer flow,
+even when an administrator could bypass server checks. AAS requires
+`antigravity-maintainer-batch-release` and protected source PRs.
 
-Use the `create-branch` skill to create the branch. After `create-branch` completes, verify the current branch has changed before proceeding:
-
-```bash
-git branch --show-current
-```
-
-If still on `main` or `master` (e.g., the user aborted branch creation), stop — do not commit.
+Inspect `git status --short`, `git diff --cached`, and the intended changed paths;
+preserve unrelated staged/dirty work. Use an installed `create-branch` helper only
+if available and appropriate, otherwise create the topic branch through the
+repository workflow. Verify the actual branch before proceeding. A request for a
+message alone does not authorize staging, committing or pushing.
 
 ## Format
 
@@ -92,13 +93,13 @@ Refs LINEAR-ABC-123
 
 ## AI-Generated Changes
 
-When changes were primarily generated by a coding agent (like Claude Code), include the Co-Authored-By attribution in the commit footer:
+Follow the repository's attribution policy and identify the actual contributor. The following is an example for Claude; do not attach it to work produced by a different agent or invent a person's contribution:
 
 ```
 Co-Authored-By: Claude <noreply@anthropic.com>
 ```
 
-This is the only indicator of AI involvement that should appear in commits. Do not add phrases like "Generated by AI", "Written with Claude", or similar markers in the subject, body, or anywhere else in the commit message.
+Repository attribution and disclosure rules take precedence. Do not add phrases like "Generated by AI", "Written with Claude", or similar markers in the subject, body, or anywhere else in the commit message.
 
 ## Examples
 

package/bundled-skills/comprehensive-review-full-review/SKILL.md

@@ -21,7 +21,6 @@ date_added: "2026-02-27"
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 Orchestrate comprehensive multi-dimensional code review using specialized review agents
 

package/bundled-skills/computer-vision-expert/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: computer-vision-expert
-description: "SOTA Computer Vision Expert (2026). Specialized in YOLO26, Segment Anything 3 (SAM 3), Vision Language Models, and real-time spatial analysis."
+description: "Computer vision pipeline design and evaluation. Specialized in YOLO26, Segment Anything 3 (SAM 3), Vision Language Models, and real-time spatial analysis."
 risk: critical
 source: community
 date_added: "2026-02-27"
 ---
 
-# Computer Vision Expert (SOTA 2026)
+# Computer Vision Pipeline Review
 
 **Role**: Advanced Vision Systems Architect & Spatial Intelligence Expert
 
@@ -29,8 +29,8 @@ To provide expert guidance on designing, implementing, and optimizing state-of-t
 
 ### 2. Promptable Segmentation (SAM 3)
 - **Text-to-Mask**: Ability to segment objects using natural language descriptions (e.g., "the blue container on the right").
-- **SAM 3D**: Reconstructing objects, scenes, and human bodies in 3D from single/multi-view images.
-- **Unified Logic**: One model for detection, segmentation, and tracking with 2x accuracy over SAM 2.
+- **SAM 3D**: separate Objects/Body repositories and checkpoints address 3D reconstruction; they are not an automatic SAM 3 segmentation capability. See [SAM 3D Body](https://github.com/facebookresearch/sam-3d-body).
+- **Unified Logic**: Use [SAM 3’s documented task interfaces](https://github.com/facebookresearch/sam3) and task-specific benchmark conditions; do not generalize an upstream metric into “2x accuracy” for every dataset.
 
 ### 3. Vision Language Models (VLMs)
 - **Visual Grounding**: Leveraging Florence-2, PaliGemma 2, or Qwen2-VL for semantic scene understanding.
@@ -49,10 +49,10 @@ To provide expert guidance on designing, implementing, and optimizing state-of-t
 
 ### 2. Deployment-First Design
 - Leverage YOLO26's simplified ONNX/TensorRT exports (NMS-free).
-- Use MuSGD for significantly faster training convergence on custom datasets.
+- Evaluate MuSGD against a fixed baseline on the actual dataset; convergence improvements are empirical, not guaranteed. [Official YOLO26 guide](https://docs.ultralytics.com/models/yolo26) documents architecture/training choices.
 
 ### 3. Progressive 3D Scene Reconstruction
-- Integrate monocular depth maps with geometric homographies to build accurate 2.5D/3D representations of scenes.
+- Monocular depth has scale/domain ambiguity; homographies model planar geometry, not arbitrary metric 3D scenes. Calibrate and use camera geometry/multiple views when measurement accuracy matters.
 
 ## Anti-Patterns
 
@@ -67,7 +67,7 @@ To provide expert guidance on designing, implementing, and optimizing state-of-t
 | SAM 3 VRAM Usage | Medium | Use quantized/distilled versions for local GPU inference. |
 | Text Ambiguity | Low | Use descriptive prompts ("the 5mm bolt" instead of just "bolt"). |
 | Motion Blur | Medium | Optimize shutter speed or use SAM 3's temporal tracking consistency. |
-| Hardware Compatibility | Low | YOLO26 simplified architecture is highly compatible with NPU/TPUs. |
+| Hardware Compatibility | Low | Verify the exact exporter, operators, precision and device runtime; a simplified architecture does not guarantee NPU/TPU support. |
 
 ## Related Skills
 `ai-engineer`, `robotics-expert`, `research-engineer`, `embedded-systems`
@@ -79,6 +79,7 @@ To provide expert guidance on designing, implementing, and optimizing state-of-t
 > Design high-performance real-time detection systems (YOLO26).
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
+- Model names are choices to evaluate, not a universal SOTA claim. Preserve dataset splits, version/checkpoint, preprocessing, latency hardware/precision and measured task metrics. Review each model/code/data license before distribution or deployment; do not infer commercial permission from a public repository.
+- No models/checkpoints are bundled or downloaded here. Image/person data and safety-critical/medical uses require approved processing, consent and appropriate validation; model output is not guaranteed ground truth.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

package/bundled-skills/concise-planning/SKILL.md

@@ -30,7 +30,7 @@ Use the following structure:
 
 - **Approach**: 1-3 sentences on what and why.
 - **Scope**: Bullet points for "In" and "Out".
-- **Action Items**: A list of 6-10 atomic, ordered tasks (Verb-first).
+- **Action Items**: A list sized to the actual task, with atomic, ordered actions (Verb-first).
 - **Validation**: At least one item for testing.
 
 ## Plan Template
@@ -47,11 +47,11 @@ Use the following structure:
 
 ## Action Items
 
-[ ] <Step 1: Discovery>
-[ ] <Step 2: Implementation>
-[ ] <Step 3: Implementation>
-[ ] <Step 4: Validation/Testing>
-[ ] <Step 5: Rollout/Commit>
+- [ ] <Step 1: Discovery>
+- [ ] <Step 2: Implementation>
+- [ ] <Step 3: Implementation>
+- [ ] <Step 4: Validation/Testing>
+- [ ] <Step 5: Rollout/Commit>
 
 ## Open Questions
 
@@ -65,7 +65,7 @@ Use the following structure:
 - **Concrete**: Name specific files or modules when possible.
 
 ## When to Use
-This skill is applicable to execute the workflow or actions described in the overview.
+Use when the user asks for a coding plan and the outcome, scope, dependencies and verification should become a short ordered checklist.
 
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.

package/bundled-skills/conductor-implement/SKILL.md

@@ -25,7 +25,6 @@ Execute tasks from a track's implementation plan, following the workflow rules d
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Pre-flight Checks
 

package/bundled-skills/conductor-new-track/SKILL.md

@@ -25,7 +25,6 @@ Create a new track (feature, bug fix, chore, or refactor) with a detailed specif
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Pre-flight Checks
 

package/bundled-skills/conductor-revert/SKILL.md

@@ -25,7 +25,6 @@ Revert changes by logical work unit with full git awareness. Supports reverting
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Pre-flight Checks
 

package/bundled-skills/conductor-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: conductor-setup
 description: Configure a Rails project to work with Conductor (parallel coding agents)
-allowed-tools: Bash(chmod *), Bash(bundle *), Bash(npm *), Bash(script/server)
+allowed-tools: Read, Write, Edit, Bash(chmod *), Bash(bundle *), Bash(npm *), Bash(script/server)
 context: fork
 risk: critical
 source: community
@@ -11,7 +11,7 @@ metadata:
   version: "1.0"
 ---
 
-Set up this Rails project for Conductor, the Mac app for parallel coding agents.
+Set up the explicitly selected Rails development project for the Conductor app. Frontmatter tool/context hints are host-specific, not authorization to delegate, alter secrets or broaden permissions. Review existing scripts and lockfiles before running installs; preserve unrelated settings.
 
 ## When to Use
 - You need to configure a Rails project so it runs correctly inside Conductor workspaces.
@@ -38,18 +38,31 @@ Create `conductor.json` in the project root if it doesn't already exist:
 Create `bin/conductor-setup` if it doesn't already exist:
 
 ```bash
-#!/bin/bash
-set -e
-
-# Symlink .env from repo root (where secrets live, outside worktrees)
-[ -f "$CONDUCTOR_ROOT_PATH/.env" ] && ln -sf "$CONDUCTOR_ROOT_PATH/.env" .env
-
-# Symlink Rails master key
-[ -f "$CONDUCTOR_ROOT_PATH/config/master.key" ] && ln -sf "$CONDUCTOR_ROOT_PATH/config/master.key" config/master.key
+#!/usr/bin/env bash
+set -euo pipefail
+: "${CONDUCTOR_ROOT_PATH:?Set the reviewed repository root first}"
+
+# Link only an explicitly approved local development secret source.
+# Preserve any existing destination, including dangling symlinks; never use ln -sf.
+link_if_absent() {
+  local source_path="$1" destination="$2"
+  if [[ -f "$source_path" && ! -e "$destination" && ! -L "$destination" ]]; then
+    ln -s -- "$source_path" "$destination"
+  fi
+}
+link_if_absent "$CONDUCTOR_ROOT_PATH/.env" .env
+mkdir -p config
+link_if_absent "$CONDUCTOR_ROOT_PATH/config/master.key" config/master.key
 
-# Install dependencies
+# Dependency installation may execute trusted project code and access the network.
+# Review Gemfile.lock/package-lock.json and lifecycle behavior before this step.
 bundle install
-npm install
+if [[ -f package-lock.json ]]; then
+  npm ci --ignore-scripts
+elif [[ -f package.json ]]; then
+  printf '%s\n' 'A reviewed npm lockfile is required; no silent npm install.' >&2
+  exit 1
+fi
 ```
 
 Make it executable with `chmod +x bin/conductor-setup`.
@@ -59,19 +72,21 @@ Make it executable with `chmod +x bin/conductor-setup`.
 Create the `script` directory if needed, then create `script/server` if it doesn't already exist:
 
 ```bash
-#!/bin/bash
-
-# === Port Configuration ===
-export PORT=${CONDUCTOR_PORT:-3000}
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Reserve distinct ports through the workspace manager, not by assuming uniqueness.
+PORT="${CONDUCTOR_PORT:-3000}"
+[[ "$PORT" =~ ^[0-9]{1,5}$ ]] || { printf '%s\n' 'Invalid port' >&2; exit 1; }
+PORT=$((10#$PORT))
+(( PORT >= 1024 && PORT <= 64535 )) || { printf '%s\n' 'Port outside safe range' >&2; exit 1; }
+export PORT
 export VITE_RUBY_PORT=$((PORT + 1000))
 
-# === Redis Isolation ===
-if [ -n "$CONDUCTOR_WORKSPACE_NAME" ]; then
-  HASH=$(printf '%s' "$CONDUCTOR_WORKSPACE_NAME" | cksum | cut -d' ' -f1)
-  REDIS_DB=$((HASH % 16))
-  export REDIS_URL="redis://localhost:6379/${REDIS_DB}"
-fi
-
+# Supply a dedicated disposable Redis instance/namespace explicitly.
+# Hashing a workspace name modulo 16 causes collisions and is not isolation.
+: "${REDIS_URL:?Set an approved workspace-specific development Redis URL}"
+export REDIS_URL
 exec bin/dev
 ```
 
@@ -117,10 +132,12 @@ Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(url: ENV.fe
 
 After creating the files:
 1. Confirm all Conductor files exist and scripts are executable
-2. Run `script/server` to verify it starts without errors
+2. Validate script syntax first, then start the owned development server with a bounded observation window and a defined shutdown method; verify actual port/Redis separation across workspaces
 3. Check that Rails configs properly reference `ENV['REDIS_URL']` or `ENV.fetch('REDIS_URL', ...)`
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
+- Secret symlinks share the same sensitive values across workspaces; use only approved development credentials, preserve owner-only source permissions, exclude secrets from Git and do not imply worktrees are a secret sandbox.
+- Sharing one Redis URL across Sidekiq, Cable and cache may still need service namespaces; dedicated instances or explicitly assigned namespaces are safer than modulo hashes. Never flush shared Redis as cleanup.
+- npm/Gem installation and bin/dev execute project dependencies/scripts. Review them first; explicitly required lifecycle steps should be run individually after approval, not re-enabled silently.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

package/bundled-skills/conductor-status/SKILL.md

@@ -25,7 +25,6 @@ Display the current status of the Conductor project, including overall progress,
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Pre-flight Checks