opencode-skills-collection 4.1.15 → 4.1.16

package/bundled-skills/interview-coach/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: interview-coach
-description: "Full job search coaching system — JD decoding, resume, storybank, mock interviews, transcript analysis, comp negotiation. 23 commands, persistent state."
+description: "Full job search coaching system — JD decoding, resume, storybank, mock interviews, transcript analysis, comp negotiation. Coaching guide with an optional separately installed command package and scoped state."
 category: productivity
 risk: safe
 source: community
@@ -16,13 +16,16 @@ tools: [claude]
 
 A persistent, adaptive coaching system for the full job search lifecycle.
 Not a question bank — an opinionated system that tracks your patterns,
-scores your answers, and gets sharper the more you use it. State persists
-in `coaching_state.md` across sessions so you always pick up where you left off.
+scores your answers, and gets sharper the more you use it. Persist state to `coaching_state.md` only when requested, in an authorized private location; retain verified facts and user-approved examples. The host may not recover it automatically.
+
+## Package availability
+
+This AAS entry contains the guide, not the 23-command implementation. `/coach` is an external package/host convention; discover actual availability before claiming it ran. Basic coaching can proceed directly with supplied role, CV and examples. Verify current company process/salary sources and dates; never invent achievements, hiring steps or ATS scores. Avoid unnecessary transcript identifiers and ask before third-party uploads.
 
 ## Install
 
 ```bash
-npx skills add dbhat93/job-search-os
+# Review an immutable upstream revision/license, then install only into the explicitly authorized workspace/host path.
 ```
 
 Then type `/coach` → `kickoff`.

package/bundled-skills/istio-traffic-management/SKILL.md

@@ -20,7 +20,6 @@ Comprehensive guide to Istio traffic management for production service mesh depl
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Use this skill when
 

package/bundled-skills/iterate-pr/SKILL.md

@@ -5,6 +5,15 @@ risk: critical
 source: community
 date_added: "2026-09-04"
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+- `<support-root>/scripts/fetch_pr_checks.py`
+- `<support-root>/scripts/fetch_pr_feedback.py`
+
+Ask for the original supporting material or an existing installation before using a step that depends on these paths; this catalog does not identify a verified download source for them. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # Iterate on PR Until CI Passes
 

package/bundled-skills/java-pro/SKILL.md

@@ -21,7 +21,6 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 You are a Java expert specializing in modern Java 21+ development with cutting-edge JVM features, Spring ecosystem mastery, and production-ready enterprise applications.
 

package/bundled-skills/javascript-pro/SKILL.md

@@ -52,7 +52,7 @@ You are a JavaScript expert specializing in modern JS and async programming.
 - Performance profiling results
 - Polyfill strategy for browser compatibility
 
-Support both Node.js and browser environments. Include JSDoc comments.
+Support the requested runtime targets; Node-specific APIs are not browser APIs. Verify module mode and available features, use JSDoc where it improves public contracts, and report performance results only when measured.
 
 ## Example
 

package/bundled-skills/javascript-typescript-typescript-scaffold/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: javascript-typescript-typescript-scaffold
-description: "You are a TypeScript project architecture expert specializing in scaffolding production-ready Node.js and frontend applications. Generate complete project structures with modern tooling (pnpm, Vite, N"
+description: "Scaffold TypeScript projects with build tooling, type checking, testing, and configuration."
 risk: critical
 source: community
 date_added: "2026-02-27"

package/bundled-skills/julia-pro/SKILL.md

@@ -21,7 +21,6 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 You are a Julia expert specializing in modern Julia 1.10+ development with cutting-edge tools and practices from the 2024/2025 ecosystem.
 

package/bundled-skills/k8s-security-policies/SKILL.md

@@ -5,6 +5,14 @@ risk: critical
 source: community
 date_added: "2026-02-27"
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+- `<support-root>/assets/pod-security-template.yaml`
+
+Ask for the original supporting material or an existing installation before using a step that depends on these paths; this catalog does not identify a verified download source for them. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # Kubernetes Security Policies
 
@@ -20,7 +28,6 @@ Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Purpose
 

package/bundled-skills/kotler-macro-analyzer/SKILL.md

@@ -46,3 +46,7 @@ Macro-trends are mapped to Opportunities and Threats, while internal user data i
 - **Expert Review Required**: This skill provides strategic frameworks but does not substitute for professional financial, legal, or management consulting.
 - **Data Freshness**: The quality of the output depends on the real-time availability of data from search tools; results may vary in rapidly shifting economic environments.
 - **Scope**: The analysis focuses on macro-level factors and does not include detailed internal operational auditing.
+
+## Evidence record
+
+Confirm country/region, industry, decision and horizon. For each factor record a primary source, observation date, unit, geographic coverage and causal relevance. Keep forecasts/scenarios distinct from observed indicators, conflicting evidence visible, and source-derived inference separate. SWOT strengths/weaknesses require verified internal evidence; do not infer them from macro trends. The Kotler-style framing is an adaptation, not an endorsement or exact quotation from a specified book edition.

package/bundled-skills/kotlin-coroutines-expert/SKILL.md

@@ -29,7 +29,7 @@ Always launch coroutines within a defined `CoroutineScope`. Use `coroutineScope`
 suspend fun loadDashboardData(): DashboardData = coroutineScope {
     val userDeferred = async { userRepo.getUser() }
     val settingsDeferred = async { settingsRepo.getSettings() }
-    
+
     DashboardData(
         user = userDeferred.await(),
         settings = settingsDeferred.await()
@@ -76,12 +76,13 @@ val uiState: StateFlow<UiState> = _uiState.asStateFlow()
 
 ```kotlin
 suspend fun fetchDataWithErrorHandling() = supervisorScope {
-    val task1 = async { 
-        try { api.fetchA() } catch (e: Exception) { null } 
+    val task1 = async {
+        try { api.fetchA() } catch (e: CancellationException) { throw e } catch (e: IOException) { null }
     }
     val task2 = async { api.fetchB() }
-    
-    // If task2 fails, task1 is NOT cancelled because of supervisorScope
+
+    // A child failure does not directly cancel its siblings.
+    // But an uncaught exception from await escapes the supervisor block and cancels it.
     val result1 = task1.await()
     val result2 = task2.await() // May throw
 }
@@ -104,3 +105,5 @@ suspend fun fetchDataWithErrorHandling() = supervisorScope {
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+Examples are fragments: supply imports, repository interfaces, Android lifecycle dependencies and the installed coroutines version. Handle each awaited failure deliberately and rethrow cancellation. `SharedFlow` replay/buffer choices determine delivery while no collector is active; it is not a guaranteed event queue. `StateFlow` conflates state changes. Test cancellation and slow/absent collectors, not only happy paths. [Official exception behavior](https://kotlinlang.org/docs/exception-handling.html).

package/bundled-skills/kubernetes-deployment/SKILL.md

@@ -2,7 +2,7 @@
 name: kubernetes-deployment
 description: "Kubernetes deployment workflow for container orchestration, Helm charts, service mesh, and production-ready K8s configurations."
 category: granular-workflow-bundle
-risk: safe
+risk: critical
 source: personal
 date_added: "2026-02-27"
 ---
@@ -22,6 +22,10 @@ Use this workflow when:
 - Setting up K8s networking
 - Implementing K8s security
 
+## Target and evidence
+
+Select only phases needed for the requested change. Confirm cluster/context, namespace, ownership, API/CRD versions and deployment/cost authorization before registry pushes or cluster writes. Prepare a reviewed immutable image and rendered manifests, validate schema/policy and diff the exact target, then use a tested rollout and rollback strategy. A valid manifest is not a healthy deployment; verify readiness, application flows, metrics and data-migration compatibility. Store secrets through the actual protected platform mechanism, not committed plaintext YAML.
+
 ## Workflow Phases
 
 ### Phase 1: Container Preparation

package/bundled-skills/kubernetes-hardening/SKILL.md

@@ -30,6 +30,10 @@ Use this skill when:
 - Configuring network policies
 - Meeting security compliance
 
+## Scope and validation
+
+Confirm the exact cluster/namespace/version and authorized writes before applying policies. Examples are fragments: validate the reviewed image, namespace, service accounts, labels and required runtime storage. Pin the policy version to the target Kubernetes release where supported. Restricted admission controls new/updated pods; it does not retroactively fix running workloads or establish compliance.
+
 ## Pod Security Standards
 
 ```yaml
@@ -51,6 +55,8 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: secure-pod
+  labels:
+    app: web
 spec:
   securityContext:
     runAsNonRoot: true
@@ -61,7 +67,7 @@ spec:
       type: RuntimeDefault
   containers:
   - name: app
-    image: myapp:latest
+    image: registry.example.invalid/myapp:REVIEWED_IMMUTABLE_TAG
     securityContext:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true
@@ -152,3 +158,5 @@ which <tool> && <tool> --help | head -n 20
 ```
 
 > Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.
+
+NetworkPolicy enforcement requires a supporting CNI. The default-deny example also blocks DNS and dependencies until narrowly scoped rules are added; same-namespace pod selectors do not authorize arbitrary namespaces. Test allowed and denied flows from the real source identities and preserve recovery access. `readOnlyRootFilesystem` may require bounded writable temporary volumes; do not disable it blindly after a startup error. [Kubernetes NetworkPolicy behavior](https://kubernetes.io/docs/concepts/services-networking/network-policies/).

package/bundled-skills/langchain-architecture/SKILL.md

@@ -5,6 +5,21 @@ risk: critical
 source: community
 date_added: "2026-02-27"
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+- `<support-root>/references/agents.md`
+- `<support-root>/references/memory.md`
+- `<support-root>/references/chains.md`
+- `<support-root>/references/document-processing.md`
+- `<support-root>/references/callbacks.md`
+- `<support-root>/assets/agent-template.py`
+- `<support-root>/assets/memory-config.yaml`
+- `<support-root>/assets/chain-example.py`
+
+Ask for the original supporting material or an existing installation before using a step that depends on these paths; this catalog does not identify a verified download source for them. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # LangChain Architecture
 
@@ -20,7 +35,6 @@ Master the LangChain framework for building sophisticated LLM applications with
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Use this skill when
 

package/bundled-skills/legacy-modernizer/SKILL.md

@@ -8,8 +8,8 @@ date_added: '2026-02-27'
 
 ## Use this skill when
 
-- Working on legacy modernizer tasks or workflows
-- Needing guidance, best practices, or checklists for legacy modernizer
+- Migrating a confirmed legacy runtime/framework or dependency while preserving actual public behavior.
+- Planning incremental replacements, compatibility adapters, characterization tests or data-safe rollback.
 
 ## Do not use this skill when
 
@@ -21,14 +21,13 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 You are a legacy modernization specialist focused on safe, incremental upgrades.
 
 ## Focus Areas
 - Framework migrations (jQuery→React, Java 8→17, Python 2→3)
-- Database modernization (stored procs→ORMs)
-- Monolith to microservices decomposition
+- Database migration only when justified; stored procedures and ORMs have different tradeoffs
+- Architectural modernization without assuming a monolith needs microservices
 - Dependency updates and security patches
 - Test coverage for legacy code
 - API versioning and backward compatibility

package/bundled-skills/legal-advisor/SKILL.md

@@ -1,15 +1,15 @@
 ---
 name: legal-advisor
-description: Draft privacy policies, terms of service, disclaimers, and legal notices. Creates GDPR-compliant texts, cookie policies, and data processing agreements.
-risk: none
+description: Draft privacy policies, terms of service, disclaimers, and legal notices. Prepares jurisdiction-aware drafts for qualified review, cookie policies, and data processing agreements.
+risk: critical
 source: community
 date_added: '2026-02-27'
 ---
 
 ## Use this skill when
 
-- Working on legal advisor tasks or workflows
-- Needing guidance, best practices, or checklists for legal advisor
+- Preparing a privacy notice, terms, cookie policy or data-processing draft for a specified business and jurisdiction.
+- Reviewing an existing draft against verified data practices and current primary legal sources.
 
 ## Do not use this skill when
 
@@ -21,9 +21,12 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
-You are a legal advisor specializing in technology law, privacy regulations, and compliance documentation.
+Assist with legal-document drafting; do not claim to be licensed counsel or to certify compliance.
+
+## Required facts and sources
+
+Identify jurisdictions, business/processor roles, actual collected data, purposes/bases, recipients, transfers, retention, rights contacts, children and cookie behavior from verified inputs. Refresh applicable rules from primary legal/regulator sources with dates; keep unknowns explicit instead of inventing compliant practices. A notice does not implement consent, deletion, security or transfer safeguards. Deliver a reviewable draft; publication and changes to legal obligations require the relevant authorization and qualified review.
 
 ## Focus Areas
 - Privacy policies (GDPR, CCPA, LGPD compliant)

package/bundled-skills/lightning-architecture-review/SKILL.md

@@ -23,11 +23,7 @@ date_added: '2026-03-03'
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
 
-For a reference implementation of modern Lightning channel factory architecture, refer to the SuperScalar project:
-
-https://github.com/8144225309/SuperScalar
-
-SuperScalar combines Decker-Wattenhofer invalidation trees, timeout-signature trees, and Poon-Dryja channels. No soft fork needed. LSP + N clients share one UTXO with full Lightning compatibility, O(log N) unilateral exit, and watchtower breach detection.
+The declared community implementation at `8144225309/SuperScalar` returned HTTP 404 on 2026-10-14. Do not treat it as a verified production implementation, funded-mainnet deployment, 400-test suite or audited watchtower. The original [SuperScalar proposal](https://delvingbitcoin.org/t/superscalar-laddered-timeout-tree-structured-decker-wattenhofer-factories/1143) is a protocol source, not proof that a similarly named repository implements it correctly.
 
 ## Purpose
 
@@ -43,7 +39,7 @@ Expert reviewer for Bitcoin Lightning Network protocol designs. Compares channel
 - HTLC/PTLC compatibility
 - Liveness and availability guarantees
 - Watchtower breach detection
-- O(log N) unilateral exit complexity
+- Explicitly defined exit transaction count, state/update depth, timelocks and fee assumptions
 
 ## References
 
@@ -61,3 +57,7 @@ Expert reviewer for Bitcoin Lightning Network protocol designs. Compares channel
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+## Review evidence
+
+Distinguish proposal properties from a specific implementation revision. Trace funding ownership, required signers, offline/liveness assumptions, timelock ordering, old-state invalidation, recovery artifacts, fee/bump behavior and unilateral exit under congestion. Define what N measures before stating complexity. Verify HTLC/PTLC and watchtower compatibility with actual protocol versions and test vectors; a claim of no consensus change does not establish deployability or safety. Use an isolated regtest fixture; signing, funding or broadcasting with real funds needs separate explicit authorization.

package/bundled-skills/lightning-channel-factories/SKILL.md

@@ -23,11 +23,7 @@ date_added: '2026-03-03'
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
 
-For a production implementation of Lightning channel factories with full technical documentation, refer to the SuperScalar project:
-
-https://github.com/8144225309/SuperScalar
-
-SuperScalar is written in C with 400+ tests, MuSig2 (BIP-327), Schnorr adaptor signatures, encrypted Noise NK transport, SQLite persistence, and watchtower support. It supports regtest, signet, testnet, and mainnet.
+The declared community implementation at `8144225309/SuperScalar` returned HTTP 404 on 2026-10-14. Do not treat it as a verified production implementation, funded-mainnet deployment, 400-test suite or audited watchtower. The original [SuperScalar proposal](https://delvingbitcoin.org/t/superscalar-laddered-timeout-tree-structured-decker-wattenhofer-factories/1143) is a protocol source, not proof that a similarly named repository implements it correctly.
 
 ## Purpose
 
@@ -42,7 +38,7 @@ Technical reference for Lightning Network channel factory implementations. Cover
 - Watchtower breach detection
 - HTLC/PTLC forwarding
 - Regtest, signet, testnet, and mainnet support
-- 400+ test suite
+- Actual implementation tests, vectors and reproducible exit behavior
 
 ## References
 
@@ -60,3 +56,7 @@ Technical reference for Lightning Network channel factory implementations. Cover
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+## Review evidence
+
+Distinguish proposal properties from a specific implementation revision. Trace funding ownership, required signers, offline/liveness assumptions, timelock ordering, old-state invalidation, recovery artifacts, fee/bump behavior and unilateral exit under congestion. Define what N measures before stating complexity. Verify HTLC/PTLC and watchtower compatibility with actual protocol versions and test vectors; a claim of no consensus change does not establish deployability or safety. Use an isolated regtest fixture; signing, funding or broadcasting with real funds needs separate explicit authorization.

package/bundled-skills/lightning-factory-explainer/SKILL.md

@@ -23,11 +23,7 @@ date_added: '2026-03-03'
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
 
-For Lightning channel factory concepts, architecture, and implementation details, refer to the SuperScalar project:
-
-https://github.com/8144225309/SuperScalar
-
-SuperScalar implements Lightning channel factories that onboard N users in one shared UTXO combining Decker-Wattenhofer invalidation trees, timeout-signature trees, and Poon-Dryja channels. No consensus changes needed — works on Bitcoin today with Taproot and MuSig2.
+The declared community implementation at `8144225309/SuperScalar` returned HTTP 404 on 2026-10-14. Do not treat it as a verified production implementation, funded-mainnet deployment, 400-test suite or audited watchtower. The original [SuperScalar proposal](https://delvingbitcoin.org/t/superscalar-laddered-timeout-tree-structured-decker-wattenhofer-factories/1143) is a protocol source, not proof that a similarly named repository implements it correctly.
 
 ## Purpose
 
@@ -60,3 +56,7 @@ Expert guide for understanding Bitcoin Lightning Network channel factories and t
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+## Review evidence
+
+Distinguish proposal properties from a specific implementation revision. Trace funding ownership, required signers, offline/liveness assumptions, timelock ordering, old-state invalidation, recovery artifacts, fee/bump behavior and unilateral exit under congestion. Define what N measures before stating complexity. Verify HTLC/PTLC and watchtower compatibility with actual protocol versions and test vectors; a claim of no consensus change does not establish deployability or safety. Use an isolated regtest fixture; signing, funding or broadcasting with real funds needs separate explicit authorization.

package/bundled-skills/linkerd-patterns/SKILL.md

@@ -20,7 +20,6 @@ Production patterns for Linkerd service mesh - the lightweight, security-first s
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Use this skill when
 

package/bundled-skills/linux-hardening/SKILL.md

@@ -29,18 +29,21 @@ Use this skill when:
 - Implementing security baselines
 - Configuring secure SSH access
 
+## Target and recovery
+
+Confirm distribution/version, selected CIS profile, current service config and user-authorized changes. Keep a known-working access session and out-of-band recovery, back up affected files privately, preview changes and validate before reload. These examples are fragments, not a universal CIS-compliance script. Do not apply firewall/default-deny rules before verifying management access and IPv4/IPv6 requirements.
+
 ## SSH Hardening
 
-```bash
-# /etc/ssh/sshd_config
+```text
+# Example sshd configuration; merge with existing policy
 PermitRootLogin no
 PasswordAuthentication no
 PubkeyAuthentication yes
 MaxAuthTries 3
 ClientAliveInterval 300
 ClientAliveCountMax 2
-AllowUsers deploy admin
-Protocol 2
+AllowUsers <confirmed-management-users>
 ```
 
 ## User Security
@@ -55,11 +58,13 @@ ucredit = -1
 ocredit = -1
 lcredit = -1
 
-# Lock inactive accounts
+# Set the default for FUTURE accounts: inactivity after password expiry,
+# not 30 days since last login; review service-account consequences first.
 useradd -D -f 30
 
 # Audit sudo usage
-echo "Defaults logfile=/var/log/sudo.log" >> /etc/sudoers
+# Edit a reviewed /etc/sudoers.d/ fragment with visudo and validate with visudo -c.
+# Do not append blindly to /etc/sudoers.
 ```
 
 ## Firewall Configuration
@@ -72,17 +77,15 @@ ufw allow ssh
 ufw allow 443/tcp
 ufw enable
 
-# Or iptables
-iptables -P INPUT DROP
-iptables -P FORWARD DROP
-iptables -A INPUT -i lo -j ACCEPT
-iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+# Alternative iptables changes require an isolated validated ruleset,
+# management allow rules, conntrack, DNS/IPv6 decisions and timed rollback.
+# Do not set INPUT DROP first on a live remote host.
+
 ```
 
 ## Kernel Hardening
 
-```bash
+```text
 # /etc/sysctl.d/99-security.conf
 net.ipv4.conf.all.send_redirects = 0
 net.ipv4.conf.all.accept_redirects = 0
@@ -91,28 +94,26 @@ net.ipv4.icmp_echo_ignore_broadcasts = 1
 kernel.randomize_va_space = 2
 fs.suid_dumpable = 0
 
-# Apply
-sysctl -p
+# After reviewing a supported value set, apply the exact file separately:
+# sudo sysctl -p /etc/sysctl.d/99-security.conf
 ```
 
 ## File Permissions
 
 ```bash
-# Critical files
-chmod 600 /etc/shadow
-chmod 644 /etc/passwd
-chmod 700 /root
-chmod 600 /etc/ssh/sshd_config
-
+# Inspect distro-prescribed owner/group/mode before any authorized repair.
+# /etc/shadow group readability may be required; do not blanket chmod it.
 # Find world-writable files
-find / -type f -perm -0002 -ls
+find / -xdev -type f -perm -0002 -ls
 
 # Find SUID files
-find / -perm -4000 -type f -ls
+find / -xdev -perm -4000 -type f -ls
 ```
 
 ## Audit Configuration
 
+Package installation and audit rules are separate steps. Validate and load the actual rules file through the installed audit tooling; execve auditing can capture secret command arguments and large volumes, so scope access and retention.
+
 ```bash
 # Install auditd
 apt install auditd

package/bundled-skills/llm-application-dev-ai-assistant/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: llm-application-dev-ai-assistant
-description: "You are an AI assistant development expert specializing in creating intelligent conversational interfaces, chatbots, and AI-powered applications. Design comprehensive AI assistant solutions with natur"
+description: "Design and implement conversational AI assistants with context management, integration boundaries, and validation."
 risk: safe
 source: community
 date_added: "2026-02-27"

package/bundled-skills/llm-application-dev-langchain-agent/SKILL.md

@@ -25,7 +25,6 @@ You are an expert LangChain agent developer specializing in production-grade AI
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Context
 

package/bundled-skills/llm-application-dev-prompt-optimize/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: llm-application-dev-prompt-optimize
-description: "You are an expert prompt engineer specializing in crafting effective prompts for LLMs through advanced techniques including constitutional AI, chain-of-thought reasoning, and model-specific optimizati"
+description: "Improve LLM prompts using task-specific evaluation, structured instructions, and regression checks."
 risk: safe
 source: community
 date_added: "2026-02-27"