Skill UI

This skill provides comprehensive management for Opencode's permission system. It allows users to review currently always-allowed commands, suggest safe read-only commands, and configure granular access controls using allow/deny/ask patterns. It is essential for optimizing security, performing system audits, and managing the operational scope of the agent.

This meta-skill implements a combinator pattern for deep security analysis. It runs three independent gates—policy governance, secret scanning, and audit logging—over a candidate operation. It enforces a strict arbitration rule (Policy DENY > Scanner WARN > ALLOW) to provide a robust, multi-layered verdict, making it ideal for reviewing critical code changes or environment modifications for safety compliance.

This automated workflow performs a comprehensive review against the AWS Well-Architected Framework (WAF). It scans IaC definitions (Terraform, CloudFormation, CDK) and deployed resources to identify compliance gaps, security risks, and optimization opportunities across six core pillars. Findings are structured and automatically generated as actionable GitHub issues with remediation code examples.

This skill maps engineering changes (code diffs, architecture designs, IaC) to specific financial compliance controls, such as PCI-DSS v4.0 and MAS TRM. It generates an auditable report detailing compliance gaps, required evidence, and concrete remediation steps, helping teams catch violations before formal audits.

Luna serves as the final quality gate, rigorously reviewing code for objective correctness, security vulnerabilities, and overall reliability. It checks for critical flaws such as injection vulnerabilities, authorization bypasses, race conditions, and adherence to the architectural blueprint. It ensures that only high-quality, safe code progresses to QA and deployment.

This skill provides deep security review for GitHub Actions workflow files. It focuses on the unique Actions threat model—identifying vulnerabilities like script injection via ${{ }} interpolation, privilege escalation from triggers (e.g., pull_request_target), and ensuring least-privilege permissions for CI/CD pipelines. Use it to audit, secure, or harden existing workflows, preventing attacks from untrusted inputs and supply chain risks.

This skill generates a highly customized code review checklist for any pull request. Instead of using a generic template, it adapts the review depth and specific checks based on the target language (e.g., Python, TypeScript), the nature of the change (e.g., bug fix, refactor), and the associated risk level (low, medium, high, critical). It ensures comprehensive coverage, guiding reviewers to focus on critical areas like security, correctness, and architectural integrity.

This tool conducts structured reviews of various Infrastructure-as-Code (IaC) tools (e.g., Terraform, Pulumi) across multiple cloud providers. It generates an actionable report that categorizes findings by severity (Critical, High, Medium, Low), providing detailed remediation steps and a reusable best-practice checklist for continuous security, compliance, and operational auditing.

This skill generates a comprehensive, structured threat model for any given service or feature using the STRIDE framework. It guides users through identifying critical assets, defining trust boundaries, enumerating specific threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), assessing risk, and proposing concrete mitigation controls. Ideal for security design reviews and documentation.

An adversarial Quality Assurance (QA) pass designed to deep-dive into any codebase for logic errors, security flaws, and functional bugs. Instead of confirming that code 'looks right,' this skill actively attempts to break the code by simulating hostile inputs, tracing critical data paths, and checking for subtle, real-world correctness issues. Essential for high-stakes, critical code reviews.

This tool automates the OAuth 2.0 scope minimization review process. It identifies over-permissioned third-party application integrations, excessive API scopes, and risky OAuth consent patterns across identity providers. It is crucial for security audits, compliance (GDPR, SOC 2), and enforcing the least-privilege principle for cross-boundary data access.

A comprehensive framework for managing third-party risk (TPRM) throughout the entire vendor lifecycle. This tool guides users through inventory, risk tiering, running due diligence questionnaires (SIG, CAIQ), reviewing security evidence (SOC 2, ISO 27001), codifying requirements in contracts, and establishing continuous monitoring protocols. It is essential for maintaining compliance, managing supply chain risk, and securing data handled by external vendors.