opencode-skills-collection 4.1.9 → 4.1.11

package/bundled-skills/what-could-break/SKILL.md

@@ -0,0 +1,128 @@
+---
+name: what-could-break
+description: "Find what a change breaks outside its own diff, then prove the one fact that makes it safe by running real code. Use before any multi-file edit or an edit to a shared path."
+category: development
+risk: safe
+source: community
+source_repo: stas4000/what-could-break
+source_type: community
+date_added: "2026-10-08"
+author: stas4000
+tags: [code-review, refactoring, testing, blast-radius, verification]
+tools: [claude, cursor, gemini]
+license: "MIT"
+license_source: "https://github.com/stas4000/what-could-break/blob/main/LICENSE"
+---
+
+# What Could Break
+
+## Overview
+
+Listing callers is not the job. Grep does that in a second. This skill finds the breakage
+grep will not show you, and produces one proof that the change is safe.
+
+Run it before design, not only before merge. Whenever a task asserts something about
+existing code ("X already handles Y", "just make X public"), that assertion is a
+hypothesis, and the census of real consumers decides the design.
+
+## When to Use
+
+- Use before any multi-file edit, or an edit to a shared path: API payload, config, stored data, a client other apps read, a prompt or policy file
+- Use when the user asks "what could this break" or "blast radius of X"
+- Use for a small diff you do not trust
+- Use when a brief asserts something about existing code, before you design against that assertion
+
+## How It Works
+
+### Step 1: Do not trust your own writeup
+
+A risk analysis that sounds right is worthless: it reads as convincing whether or not it
+is true. Find the one or two facts the whole change depends on, and get each one as far
+down this ladder as is cheap. Say where it stopped.
+
+1. **You said so.** Worth nothing on its own.
+2. **You pointed at it.** A real `file:line`, or the library's own source at the pinned version.
+3. **You walked it.** You traced the bad case step by step and it does not reach.
+4. **You ran it.** A script or test calls the real code and fails loud if you are wrong.
+5. **You saw it live.** Reproduced in the running app, service or device.
+
+Rung 4 is usually one small script that imports the same module production runs and calls
+the exact function you are worried about, with the input you are worried about.
+
+### Step 2: Read the change
+
+The diff, the symbols it adds, changes and deletes, and what it now does differently,
+including what the diff does not spell out. `git log -S '<symbol>'` and
+`git log -L :<function>:<file>` show why the old shape exists; a guard that looks
+pointless often has a commit explaining the incident it stopped.
+
+### Step 3: Find the one fact it is safe because of
+
+Most risky-looking changes are safe because of one fact ("this only drops cache entries
+that are already expired", "no client reads this field"). If it holds, most risks clear at
+once. If you cannot find one, the change is not understood yet.
+
+### Step 4: Look where grep stops
+
+Search for the literal value, the field name, the error text and the old behavior, not
+only the symbol you renamed. Then check each of these by hand:
+
+- **The same rule living twice.** A second config file, a fallback path that hardcodes the old default, a copy synced into another repo, a constant duplicated in a migration or test fixture, a feature flag default.
+- **Prompts and agent files that restate the rule.** System prompts, agent and skill files, `AGENTS.md`, `CLAUDE.md`, runbooks. An agent obeys the stale sentence, not your code.
+- **Every other client.** Web, iOS, Android, desktop, CLI, extensions, partner integrations. Mobile clients in users' hands stay on the old version for weeks: what does an old client do with the new shape, and a new client with the old server?
+- **Wire formats.** JSON field names and types, enum values, null versus missing, date formats, pagination shape, error codes, webhook payloads, queue schemas, GraphQL and protobuf contracts.
+- **Stored state.** Columns and their defaults, rows written under the old shape, cache entries, files on disk, append-only logs, session and cookie contents, search indexes. Old data outlives the deploy.
+- **Environment and secrets.** An env var renamed in code but not in the deploy config, CI, the image, or the second service that reads it.
+- **Processes that restart separately.** Web server, workers, cron jobs, serverless functions, the mobile app, a sidecar. During a rollout one runs new code while another runs old code against the same data. Can both coexist for an hour?
+- **Timing and concurrency.** Two writers on the same row or key, a retry that now fires twice, ordering that only held because one step was slow.
+- **Library source at its pinned version.** Read the dependency's code at the lockfile version, not your memory of its docs.
+- **Generated and vendored code.** Clients generated from a schema, vendored copies, committed build artifacts, bundles whose cache-busting key did not change.
+- **Tests and fixtures that encode the old behavior.** A test that passes because its fixture still has the old shape proves nothing about the new one.
+- **Observability.** Dashboards, alerts and log parsers matching a message or metric name you changed.
+
+### Step 5: Prove the one fact
+
+Write the script or test that runs the real code, run it, and paste what happened. If you
+cannot run it, write "unproven" next to the fact. For a wide change, repeat steps 3 to 5
+per subsystem instead of stretching one writeup across everything.
+
+## Examples
+
+### Example 1: A field removed from an API response
+
+The one fact: no client reads `legacy_total`. Rung 2 is a search across every client repo.
+Rung 4 is a script that replays yesterday's real requests against the new serializer and
+asserts no response shrinks a field a stored client build still parses. The report names
+the iOS build still in users' hands and the cleared web and admin clients.
+
+### Example 2: "Just make this helper public"
+
+The brief asserts the helper is already side-effect free. Treat that as a hypothesis:
+read it, then run it twice in one process and compare state. If it caches, the assertion
+is false and the design changes before any code is written.
+
+## Best Practices
+
+- ✅ State the rung each fact reached, and the command that proved it
+- ✅ List cleared risks separately from confirmed ones, with the search you ran
+- ✅ Cite a real `file:line` for every risk
+- ❌ Don't invent a caller, an API or a config key
+- ❌ Don't ship a convincing essay in place of one run script
+
+## Limitations
+
+- A risk needs a real chance and a real cost, or it does not belong on the list.
+- A search that found nothing is still an answer: write the search down rather than claiming the risk does not exist.
+- This skill does not replace environment-specific testing or expert review.
+- Keep secrets and private data out of the report and out of any script left behind.
+
+## Security & Safety Notes
+
+- The proof scripts this skill writes run real production code paths. Run them in a local or authorized test environment, never against production data stores.
+- Read-only by design: it inspects a diff and runs checks. It does not mutate state, and it should not be used to apply fixes.
+
+## Credits
+
+Adapted from [stas4000/what-could-break](https://github.com/stas4000/what-could-break) (MIT).
+Includes material adapted from pstack by Lauren Tan (MIT); its notice ships here in
+[references/LICENSE-pstack.txt](references/LICENSE-pstack.txt).

package/bundled-skills/what-could-break/references/LICENSE-pstack.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lauren Tan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bundled-skills/whatsapp-cloud-api/assets/boilerplate/nodejs/package-lock.json

@@ -1336,9 +1336,9 @@
       }
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -1346,6 +1346,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/proxy-from-env": {

package/bundled-skills/whatsapp-cloud-api/assets/boilerplate/nodejs/package.json

@@ -21,6 +21,7 @@
   },
   "overrides": {
     "brace-expansion": "^1.1.21",
-    "qs": "^6.16.0"
+    "qs": "^6.16.0",
+    "proxy-addr": "^2.0.8"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "4.1.9",
+  "version": "4.1.11",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/skills_index.json

@@ -5294,6 +5294,42 @@
       "prompt"
     ]
   },
+  {
+    "id": "ask-human-expert",
+    "path": "skills/ask-human-expert",
+    "category": "research",
+    "name": "ask-human-expert",
+    "description": "Ask real executives and domain experts a question through Instant Expert for a written answer or short call: practitioner knowledge, customer discovery. Free test mode; live sends need approval.",
+    "risk": "critical",
+    "source": "https://github.com/Instant-Expert/skills",
+    "date_added": "2026-10-08",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "official",
+    "source_repo": "Instant-Expert/skills",
+    "license": "MIT-0",
+    "license_source": "https://github.com/Instant-Expert/skills/blob/main/LICENSE",
+    "tags": [
+      "experts",
+      "expert-network",
+      "human-in-the-loop",
+      "customer-discovery",
+      "user-research",
+      "interviews",
+      "mcp",
+      "paid-api"
+    ]
+  },
   {
     "id": "ask-matt",
     "path": "skills/ask-matt",
@@ -5347,6 +5383,40 @@
       "reasons": []
     }
   },
+  {
+    "id": "assay",
+    "path": "skills/assay",
+    "category": "testing",
+    "name": "assay",
+    "description": "Run assay on a web page you just wrote or changed. It opens the page in a real browser, drives every control, and reports where the page contradicts itself. Deterministic, no API key, no network.",
+    "risk": "safe",
+    "source": "https://github.com/awss1i/assay",
+    "date_added": "2026-10-08",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "awss1i/assay",
+    "license": "MIT",
+    "license_source": "https://github.com/awss1i/assay/blob/main/LICENSE",
+    "tags": [
+      "testing",
+      "qa",
+      "web",
+      "browser",
+      "playwright",
+      "html"
+    ]
+  },
   {
     "id": "asset-inventory",
     "path": "skills/asset-inventory",
@@ -23207,6 +23277,39 @@
       "electrical-engineering"
     ]
   },
+  {
+    "id": "equibles",
+    "path": "skills/equibles",
+    "category": "finance",
+    "name": "equibles",
+    "description": "Query Equibles for US stock market data: SEC filing search, XBRL financial statements, earnings call transcripts, insider and 13F holdings, and daily prices.",
+    "risk": "safe",
+    "source": "self",
+    "date_added": "2026-10-08",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "self",
+    "tags": [
+      "finance",
+      "stocks",
+      "sec-filings",
+      "earnings-calls",
+      "insider-trading",
+      "13f",
+      "rest-api",
+      "mcp"
+    ]
+  },
   {
     "id": "error-debugging-error-analysis",
     "path": "skills/error-debugging-error-analysis",
@@ -34688,6 +34791,40 @@
     "license": "MIT",
     "license_source": "https://github.com/LambdaTest/agent-skills/blob/main/LICENSE"
   },
+  {
+    "id": "jet-browser",
+    "path": "skills/jet-browser",
+    "category": "browser-automation",
+    "name": "jet-browser",
+    "description": "Verify or integrate Jet Browser when a project needs isolated WPE WebKit sessions, native input, screenshots, ordered JSONL automation, or reproducible runtime checks.",
+    "risk": "critical",
+    "source": "https://github.com/masakaai/jet-browser",
+    "date_added": "2026-10-09",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "official",
+    "source_repo": "masakaai/jet-browser",
+    "license": "Apache-2.0",
+    "license_source": "https://github.com/masakaai/jet-browser/blob/v0.6.7/LICENSE",
+    "tags": [
+      "browser",
+      "wpe-webkit",
+      "automation",
+      "docker",
+      "jsonl",
+      "testing"
+    ]
+  },
   {
     "id": "jev-social",
     "path": "skills/jev-social",
@@ -37936,6 +38073,39 @@
       "render-loop"
     ]
   },
+  {
+    "id": "looot",
+    "path": "skills/looot",
+    "category": "data",
+    "name": "looot",
+    "description": "Search, price and run 2,500+ data API endpoints (work emails, company search, SERP, web pages) from one prepaid balance via the looot MCP server.",
+    "risk": "critical",
+    "source": "community",
+    "date_added": "2026-10-08",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "official",
+    "source_repo": "loootai/looot-skills",
+    "license": "MIT",
+    "license_source": "https://github.com/loootai/looot-skills/blob/main/LICENSE",
+    "tags": [
+      "data-api",
+      "enrichment",
+      "email-finder",
+      "seo",
+      "mcp"
+    ]
+  },
   {
     "id": "loop-library",
     "path": "skills/loop-library",
@@ -59344,6 +59514,39 @@
       "orchestration"
     ]
   },
+  {
+    "id": "tastegate",
+    "path": "skills/tastegate",
+    "category": "frontend",
+    "name": "tastegate",
+    "description": "Build or fix a frontend so it looks designed, not AI-generated, then prove it in a real browser: renders at phone and desktop width and fails on overlap, low contrast and AI-slop defaults.",
+    "risk": "safe",
+    "source": "community",
+    "date_added": "2026-10-08",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "stas4000/tastegate",
+    "license": "MIT",
+    "license_source": "https://github.com/stas4000/tastegate/blob/main/LICENSE",
+    "tags": [
+      "frontend",
+      "design",
+      "ui",
+      "browser-testing",
+      "quality-gate"
+    ]
+  },
   {
     "id": "tavily-web",
     "path": "skills/tavily-web",
@@ -59989,6 +60192,37 @@
       "approvals"
     ]
   },
+  {
+    "id": "telegram-channel-ads",
+    "path": "skills/telegram-channel-ads",
+    "category": "marketing",
+    "name": "telegram-channel-ads",
+    "description": "Vet and price ad posts in Telegram channels: reach benchmarks by size, topic and language, ad-network and channel-age checks, CPM and deletion-window math.",
+    "risk": "safe",
+    "source": "self",
+    "date_added": "2026-10-07",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "self",
+    "tags": [
+      "telegram",
+      "advertising",
+      "influencer-marketing",
+      "media-buying",
+      "cpm",
+      "marketing"
+    ]
+  },
   {
     "id": "telegram-mini-app",
     "path": "skills/telegram-mini-app",
@@ -63146,6 +63380,36 @@
       "key-value"
     ]
   },
+  {
+    "id": "url-to-markdown",
+    "path": "skills/url-to-markdown",
+    "category": "web",
+    "name": "url-to-markdown",
+    "description": "Fetch a public webpage as clean Markdown for an agent: read, summarize, quote, or cite the page while preserving its source URL.",
+    "risk": "safe",
+    "source": "official",
+    "date_added": "2026-10-09",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "official",
+    "source_repo": "replynodes/replynodes-agent-skills",
+    "license": "MIT",
+    "tags": [
+      "web",
+      "markdown",
+      "read-only"
+    ]
+  },
   {
     "id": "us-property-data",
     "path": "skills/us-property-data",
@@ -65800,6 +66064,39 @@
       "methodology"
     ]
   },
+  {
+    "id": "what-could-break",
+    "path": "skills/what-could-break",
+    "category": "development",
+    "name": "what-could-break",
+    "description": "Find what a change breaks outside its own diff, then prove the one fact that makes it safe by running real code. Use before any multi-file edit or an edit to a shared path.",
+    "risk": "safe",
+    "source": "community",
+    "date_added": "2026-10-08",
+    "plugin": {
+      "targets": {
+        "codex": "supported",
+        "claude": "supported"
+      },
+      "setup": {
+        "type": "none",
+        "summary": "",
+        "docs": null
+      },
+      "reasons": []
+    },
+    "source_type": "community",
+    "source_repo": "stas4000/what-could-break",
+    "license": "MIT",
+    "license_source": "https://github.com/stas4000/what-could-break/blob/main/LICENSE",
+    "tags": [
+      "code-review",
+      "refactoring",
+      "testing",
+      "blast-radius",
+      "verification"
+    ]
+  },
   {
     "id": "whatsapp-automation",
     "path": "skills/whatsapp-automation",