[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ACJSK2MWX4MPVHH4S3FK0V":3,"skill-same:01M6ACJSK2MWX4MPVHH4S3FK0V":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":57,"ownerHtmlUrl":58,"ownerBlogUrl":59,"ownerDescription":6,"updatedAt":60,"install":61,"resources":74},"01M6ACJSK2MWX4MPVHH4S3FK0V","triaging-security-reports",null,"Use when a vulnerability or security report arrives for triage, when assessing a CVE\u002FRCE\u002FOGNL\u002Finjection claim against the code, when deciding whether a finding is the framework's fault or the application's, when drafting a reply to a security researcher, or when a claim that is already public (a Full Disclosure post, a blog, a scanner advisory) needs the project's position stated for users and scanner vendors — to research the claim from source without trusting the reporter and without fabricating your own facts.","apache\u002Fstruts","apache","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4","01M6AC83E6K4FDKK7HZ8WNMQKE","The Apache Software Foundation","01M6ACJC9PH86ZGJ487XPD32BP",1373,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fapache\u002Fstruts\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftriaging-security-reports\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"security","triaging security reports","reports","drafting","users","advisory","framework","full","scanner","when","project","source","injection","facts","vulnerability","use","claim","security report","for","cve","code","2026-11-10 10:12:30",false,"---\nname: agents-sdk-typescript-debugging\ndescription: >\n  Use when troubleshooting an agent built with the Microsoft Agents SDK\n  (@microsoft\u002Fagents-hosting and related packages). Trigger on any of these\n  symptoms: build or TypeScript errors, crashes on startup, 401 or auth errors\n  on incoming requests, the bot not responding to messages, .env configuration\n  problems, Azure AD credential failures (AADSTS errors), port conflicts, or the\n  agent not connecting in Teams or the Agents Playground. Use even if the user\n  doesn't mention the SDK by name — trigger on symptoms like \"my bot won't\n  start\", \"getting 401s\", or \"bot isn't responding.\"\n---\n\n# Debugging Agents Built with Microsoft Agents SDK\n\n## Overview\n\nMost agent failures fall into one of three categories: the code doesn't build or start, the configuration is wrong, or the agent isn't reachable. Work through this checklist in order — each step confirms a prerequisite for the next.\n\n## Checklist\n\nYou MUST create a task for each of these items and complete them in order:\n\n1. Make sure the code builds successfully.\n2. Make sure the application starts and runs without crashing.\n3. Make sure the application opens a port and listens for incoming requests.\n4. Validate the `.env` configuration.\n5. Validate the bot's credentials against Azure AD.\n6. Use the Agents Playground to test the agent end-to-end locally.\n\n---\n\n### 1. Build the code\n\n```bash\nnpm run build\n```\n\nExpected: exits with code 0, no errors. Fix any TypeScript or import errors before continuing.\n\n---\n\n### 2. Start the application\n\nRun with debug logging enabled to get detailed output from the SDK internals:\n\n```bash\nDEBUG=agents:* npm start\n```\n\nOr for anonymous local dev:\n\n```bash\nDEBUG=agents:* node .\u002Fdist\u002Findex.js\n```\n\nThe `DEBUG=agents:*` flag enables verbose logging across all SDK namespaces. Scope down to reduce noise:\n\n```bash\nDEBUG=agents:* npm start                    # everything\nDEBUG=agents:authorization:* npm start      # all auth (most useful starting point)\nDEBUG=agents:msal npm start                 # token acquisition only\n```\n\n\n#### Auth & connections\n\n| Namespace | What it logs |\n|---|---|\n| `agents:authorization:connections` | Auth connections loaded at startup (clientId, tenantId, authType); which connection is selected per request |\n| `agents:authorization:manager` | Auth handlers configured at startup (type, scopes); which handler is invoked per request |\n| `agents:authorization:azurebot` | Azure Bot sign-in flow detail (token exchange, magic code, SSO) |\n| `agents:authorization:agentic` | Agentic auth flow detail (token acquisition, OBO) |\n| `agents:authorization` | High-level authorization middleware decisions |\n| `agents:msal` | MSAL token acquisition (token requests, cache hits, OBO) |\n| `agents:jwt-middleware` | Incoming JWT validation |\n| `agents:authConfiguration` | Auth configuration loading |\n\n#### Adapter & request handling\n\n| Namespace | What it logs |\n|---|---|\n| `agents:cloud-adapter` | Incoming request processing, activity dispatch |\n| `agents:base-adapter` | Base adapter lifecycle |\n| `agents:connector-client` | Outbound calls to the Bot Connector service |\n| `agents:user-token-client` | User token client requests |\n\n#### Application & state\n\n| Namespace | What it logs |\n|---|---|\n| `agents:app` | AgentApplication routing and lifecycle |\n| `agents:activity-handler` | ActivityHandler event dispatch |\n| `agents:state` | State read\u002Fwrite operations |\n| `agents:turnState` | Turn state access |\n| `agents:memory-storage` | MemoryStorage read\u002Fwrite |\n| `agents:middleware` | Middleware pipeline execution |\n\n#### Streaming, attachments & transcripts\n\n| Namespace | What it logs |\n|---|---|\n| `agents:streamingResponse` | Streaming response lifecycle |\n| `agents:attachmentDownloader` | Attachment download requests |\n| `agents:M365AttachmentDownloader` | M365-specific attachment downloads |\n| `agents:file-transcript-logger` | File transcript write operations |\n| `agents:rest-client` | REST client calls (transcript middleware) |\n\n#### Agent-to-agent\n\n| Namespace | What it logs |\n|---|---|\n| `agents:agent-client` | Outbound agent client calls and response handling |\n\nWatch for crash output. Common startup errors:\n\n- **`Cannot find module`** — missing `npm install`, or `dist\u002F` not built yet\n- **`ERR_MODULE_NOT_FOUND`** — check `\"type\": \"module\"` in `package.json` and that imports use `.js` extensions\n- **Port already in use** — another process is on port 3978; kill it or set `PORT` in `.env`\n\nIf the agent starts cleanly, you should see output like:\n\n```\nServer listening on port 3978\n```\n\n---\n\n### 3. Confirm the agent is reachable\n\n```bash\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST http:\u002F\u002Flocalhost:3978\u002Fapi\u002Fmessages \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{}'\n```\n\n| Response | Meaning |\n|---|---|\n| `401` | Agent is running, auth is active — this is correct for a configured agent |\n| `200` | Agent is running with auth disabled (blank `clientId`) — correct for anonymous local dev |\n| `000` or connection refused | Agent is not running, wrong port, or crashed on startup |\n\n---\n\n### 4. Validate `.env` configuration\n\nConfiguration mistakes are the most common source of failures. Check each area below.\n\n#### 4a. Confirm the file is being loaded\n\nThe SDK requires `node --env-file .env` (Node 20+) or a manual `dotenv` call. If you're using `npm start`, check that `package.json` uses `--env-file`:\n\n```json\n\"start\": \"node --env-file .env .\u002Fdist\u002Findex.js\"\n```\n\nWithout `--env-file`, environment variables silently don't load and the agent starts with no auth config.\n\n#### 4b. Check for the correct env var format\n\nThe SDK uses the **modern `connections__` format**. Using the legacy flat format (`clientId=`, `clientSecret=`, `tenantId=`) still works but is only for backwards compatibility. Mixing the two formats causes silent misconfiguration.\n\n**Modern format (use this):**\n```\nconnections__serviceConnection__settings__clientId=\u003Cyour-app-id>\nconnections__serviceConnection__settings__clientSecret=\u003Cyour-secret>\nconnections__serviceConnection__settings__tenantId=\u003Cyour-tenant-id>\nconnectionsMap__0__connection=serviceConnection\nconnectionsMap__0__serviceUrl=*\n```\n\n**Legacy format (avoid for new agents):**\n```\nclientId=\u003Cyour-app-id>\nclientSecret=\u003Cyour-secret>\ntenantId=\u003Cyour-tenant-id>\n```\n\n#### 4c. Check double-underscore separators\n\nA single underscore (`_`) is not the same as a double underscore (`__`). The SDK uses `__` to separate path segments. A typo like `connections_serviceConnection_settings_clientId` will be silently ignored.\n\n#### 4d. Check `connectionsMap` entries\n\nIf you have multiple connections, each must have a `connectionsMap` entry. The first entry whose `serviceUrl` pattern matches the incoming request wins. Always include a `serviceUrl=*` fallback as the last entry.\n\nWith a single connection, `connectionsMap` can be omitted — the SDK defaults to `serviceUrl=*`.\n\n#### 4e. Check OAuth handler variables\n\nIf your agent uses user sign-in (`authorization: { graph: { ... } }`), the OAuth connection name must be set:\n\n```\nAgentApplication__UserAuthorization__Handlers__graph__Settings__azureBotOAuthConnectionName=GraphOAuthConnection\n```\n\nThe handler ID (`graph`) must match the key used in the `authorization` config in your code. A mismatch causes the sign-in flow to fail silently or with a cryptic error.\n\n---\n\n### 5. Validate bot credentials against Azure AD\n\nOnce the `.env` looks correct, confirm the credentials actually work by requesting a token:\n\n```bash\ncurl -s -X POST \\\n  \"https:\u002F\u002Flogin.microsoftonline.com\u002F$tenantId\u002Foauth2\u002Fv2.0\u002Ftoken\" \\\n  -d \"grant_type=client_credentials\\\n&client_id=$clientId\\\n&client_secret=$clientSecret\\\n&scope=https:\u002F\u002Fapi.botframework.com\u002F.default\" \\\n  | jq '{token_type, expires_in, error, error_description}'\n```\n\nA successful response includes `access_token`. Common errors:\n\n| Error code | Cause |\n|---|---|\n| `AADSTS700016` | `clientId` not found in tenant — wrong ID or wrong tenant |\n| `AADSTS7000215` | Invalid `clientSecret` — expired or incorrect |\n| `AADSTS90002` | `tenantId` not found |\n\n---\n\n### 6. Test with Agents Playground\n\nThe Agents Playground acts as a mock connector and channel client. It lets you test the full message flow locally without deploying to Azure or configuring a real Bot resource.\n\n**Install:**\n```bash\nnpm install -g agentsplayground\n```\n\n**Run against an anonymous agent (no `.env` needed):**\n```bash\nnpm test\n```\n\nThis assumes your `package.json` has:\n```json\n\"start:anon\": \"node .\u002Fdist\u002Findex.js\",\n\"test-tool\": \"agentsplayground -c emulator\",\n\"test\": \"npm-run-all -p -r start:anon test-tool\"\n```\n\n**Run against an authenticated agent:**\n```bash\nagentsplayground -c msteams \\\n  --client-id \u003Cyour-app-id> \\\n  --client-secret \u003Cyour-secret> \\\n  --tenant-id \u003Cyour-tenant-id>\n```\n\n**Channel options** (`-c`): `msteams`, `webchat`, `directline`, `emulator`, `agents`\n\nIf the playground connects but messages don't get responses, the agent is running but a message handler may be missing or the route isn't matching. Add a fallback handler to confirm:\n\n```typescript\nthis.onActivity('message', async (ctx: TurnContext) => {\n  await ctx.sendActivity(`Echo: ${ctx.activity.text}`)\n}, [], RouteRank.Last)\n```\n\n---\n\n### Validate an OAuth connection name\n\nOAuth connection names can only be tested end-to-end through a real sign-in flow:\n\n**Azure Portal → Your Bot Resource → Settings → OAuth Connection Settings → [your connection] → Test Connection**\n\nThis confirms the connection name matches, the OAuth app has the right scopes, and the redirect URI (`https:\u002F\u002Ftoken.botframework.com\u002F.auth\u002Fweb\u002Fredirect`) is registered on the app registration.\n\n## Contributing\n\nIf you hit a problem this skill couldn't solve, found a workaround, or noticed something wrong or outdated, that's valuable — please help improve this skill for everyone.\n\nDraft a suggested issue title and body based on the conversation, then ask the user to open it at: https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fagents\u002Fissues\u002Fnew\n\nA good issue includes:\n- What the user was trying to do\n- What went wrong (errors, unexpected behavior)\n- What worked — including any workaround found during this conversation\n- Relevant code or config snippets\n","# Debugging Agents Built with Microsoft Agents SDK\n\n## Overview\n\nMost agent failures fall into one of three categories: the code doesn't build or start, the configuration is wrong, or the agent isn't reachable. Work through this checklist in order — each step confirms a prerequisite for the next.\n\n## Checklist\n\nYou MUST create a task for each of these items and complete them in order:\n\n1. Make sure the code builds successfully.\n2. Make sure the application starts and runs without crashing.\n3. Make sure the application opens a port and listens for incoming requests.\n4. Validate the `.env` configuration.\n5. Validate the bot's credentials against Azure AD.\n6. Use the Agents Playground to test the agent end-to-end locally.\n\n---\n\n### 1. Build the code\n\n```bash\nnpm run build\n```\n\nExpected: exits with code 0, no errors. Fix any TypeScript or import errors before continuing.\n\n---\n\n### 2. Start the application\n\nRun with debug logging enabled to get detailed output from the SDK internals:\n\n```bash\nDEBUG=agents:* npm start\n```\n\nOr for anonymous local dev:\n\n```bash\nDEBUG=agents:* node .\u002Fdist\u002Findex.js\n```\n\nThe `DEBUG=agents:*` flag enables verbose logging across all SDK namespaces. Scope down to reduce noise:\n\n```bash\nDEBUG=agents:* npm start                    # everything\nDEBUG=agents:authorization:* npm start      # all auth (most useful starting point)\nDEBUG=agents:msal npm start                 # token acquisition only\n```\n\n\n#### Auth & connections\n\n| Namespace | What it logs |\n|---|---|\n| `agents:authorization:connections` | Auth connections loaded at startup (clientId, tenantId, authType); which connection is selected per request |\n| `agents:authorization:manager` | Auth handlers configured at startup (type, scopes); which handler is invoked per request |\n| `agents:authorization:azurebot` | Azure Bot sign-in flow detail (token exchange, magic code, SSO) |\n| `agents:authorization:agentic` | Agentic auth flow detail (token acquisition, OBO) |\n| `agents:authorization` | High-level authorization middleware decisions |\n| `agents:msal` | MSAL token acquisition (token requests, cache hits, OBO) |\n| `agents:jwt-middleware` | Incoming JWT validation |\n| `agents:authConfiguration` | Auth configuration loading |\n\n#### Adapter & request handling\n\n| Namespace | What it logs |\n|---|---|\n| `agents:cloud-adapter` | Incoming request processing, activity dispatch |\n| `agents:base-adapter` | Base adapter lifecycle |\n| `agents:connector-client` | Outbound calls to the Bot Connector service |\n| `agents:user-token-client` | User token client requests |\n\n#### Application & state\n\n| Namespace | What it logs |\n|---|---|\n| `agents:app` | AgentApplication routing and lifecycle |\n| `agents:activity-handler` | ActivityHandler event dispatch |\n| `agents:state` | State read\u002Fwrite operations |\n| `agents:turnState` | Turn state access |\n| `agents:memory-storage` | MemoryStorage read\u002Fwrite |\n| `agents:middleware` | Middleware pipeline execution |\n\n#### Streaming, attachments & transcripts\n\n| Namespace | What it logs |\n|---|---|\n| `agents:streamingResponse` | Streaming response lifecycle |\n| `agents:attachmentDownloader` | Attachment download requests |\n| `agents:M365AttachmentDownloader` | M365-specific attachment downloads |\n| `agents:file-transcript-logger` | File transcript write operations |\n| `agents:rest-client` | REST client calls (transcript middleware) |\n\n#### Agent-to-agent\n\n| Namespace | What it logs |\n|---|---|\n| `agents:agent-client` | Outbound agent client calls and response handling |\n\nWatch for crash output. Common startup errors:\n\n- **`Cannot find module`** — missing `npm install`, or `dist\u002F` not built yet\n- **`ERR_MODULE_NOT_FOUND`** — check `\"type\": \"module\"` in `package.json` and that imports use `.js` extensions\n- **Port already in use** — another process is on port 3978; kill it or set `PORT` in `.env`\n\nIf the agent starts cleanly, you should see output like:\n\n```\nServer listening on port 3978\n```\n\n---\n\n### 3. Confirm the agent is reachable\n\n```bash\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST http:\u002F\u002Flocalhost:3978\u002Fapi\u002Fmessages \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{}'\n```\n\n| Response | Meaning |\n|---|---|\n| `401` | Agent is running, auth is active — this is correct for a configured agent |\n| `200` | Agent is running with auth disabled (blank `clientId`) — correct for anonymous local dev |\n| `000` or connection refused | Agent is not running, wrong port, or crashed on startup |\n\n---\n\n### 4. Validate `.env` configuration\n\nConfiguration mistakes are the most common source of failures. Check each area below.\n\n#### 4a. Confirm the file is being loaded\n\nThe SDK requires `node --env-file .env` (Node 20+) or a manual `dotenv` call. If you're using `npm start`, check that `package.json` uses `--env-file`:\n\n```json\n\"start\": \"node --env-file .env .\u002Fdist\u002Findex.js\"\n```\n\nWithout `--env-file`, environment variables silently don't load and the agent starts with no auth config.\n\n#### 4b. Check for the correct env var format\n\nThe SDK uses the **modern `connections__` format**. Using the legacy flat format (`clientId=`, `clientSecret=`, `tenantId=`) still works but is only for backwards compatibility. Mixing the two formats causes silent misconfiguration.\n\n**Modern format (use this):**\n```\nconnections__serviceConnection__settings__clientId=\u003Cyour-app-id>\nconnections__serviceConnection__settings__clientSecret=\u003Cyour-secret>\nconnections__serviceConnection__settings__tenantId=\u003Cyour-tenant-id>\nconnectionsMap__0__connection=serviceConnection\nconnectionsMap__0__serviceUrl=*\n```\n\n**Legacy format (avoid for new agents):**\n```\nclientId=\u003Cyour-app-id>\nclientSecret=\u003Cyour-secret>\ntenantId=\u003Cyour-tenant-id>\n```\n\n#### 4c. Check double-underscore separators\n\nA single underscore (`_`) is not the same as a double underscore (`__`). The SDK uses `__` to separate path segments. A typo like `connections_serviceConnection_settings_clientId` will be silently ignored.\n\n#### 4d. Check `connectionsMap` entries\n\nIf you have multiple connections, each must have a `connectionsMap` entry. The first entry whose `serviceUrl` pattern matches the incoming request wins. Always include a `serviceUrl=*` fallback as the last entry.\n\nWith a single connection, `connectionsMap` can be omitted — the SDK defaults to `serviceUrl=*`.\n\n#### 4e. Check OAuth handler variables\n\nIf your agent uses user sign-in (`authorization: { graph: { ... } }`), the OAuth connection name must be set:\n\n```\nAgentApplication__UserAuthorization__Handlers__graph__Settings__azureBotOAuthConnectionName=GraphOAuthConnection\n```\n\nThe handler ID (`graph`) must match the key used in the `authorization` config in your code. A mismatch causes the sign-in flow to fail silently or with a cryptic error.\n\n---\n\n### 5. Validate bot credentials against Azure AD\n\nOnce the `.env` looks correct, confirm the credentials actually work by requesting a token:\n\n```bash\ncurl -s -X POST \\\n  \"https:\u002F\u002Flogin.microsoftonline.com\u002F$tenantId\u002Foauth2\u002Fv2.0\u002Ftoken\" \\\n  -d \"grant_type=client_credentials\\\n&client_id=$clientId\\\n&client_secret=$clientSecret\\\n&scope=https:\u002F\u002Fapi.botframework.com\u002F.default\" \\\n  | jq '{token_type, expires_in, error, error_description}'\n```\n\nA successful response includes `access_token`. Common errors:\n\n| Error code | Cause |\n|---|---|\n| `AADSTS700016` | `clientId` not found in tenant — wrong ID or wrong tenant |\n| `AADSTS7000215` | Invalid `clientSecret` — expired or incorrect |\n| `AADSTS90002` | `tenantId` not found |\n\n---\n\n### 6. Test with Agents Playground\n\nThe Agents Playground acts as a mock connector and channel client. It lets you test the full message flow locally without deploying to Azure or configuring a real Bot resource.\n\n**Install:**\n```bash\nnpm install -g agentsplayground\n```\n\n**Run against an anonymous agent (no `.env` needed):**\n```bash\nnpm test\n```\n\nThis assumes your `package.json` has:\n```json\n\"start:anon\": \"node .\u002Fdist\u002Findex.js\",\n\"test-tool\": \"agentsplayground -c emulator\",\n\"test\": \"npm-run-all -p -r start:anon test-tool\"\n```\n\n**Run against an authenticated agent:**\n```bash\nagentsplayground -c msteams \\\n  --client-id \u003Cyour-app-id> \\\n  --client-secret \u003Cyour-secret> \\\n  --tenant-id \u003Cyour-tenant-id>\n```\n\n**Channel options** (`-c`): `msteams`, `webchat`, `directline`, `emulator`, `agents`\n\nIf the playground connects but messages don't get responses, the agent is running but a message handler may be missing or the route isn't matching. Add a fallback handler to confirm:\n\n```typescript\nthis.onActivity('message', async (ctx: TurnContext) => {\n  await ctx.sendActivity(`Echo: ${ctx.activity.text}`)\n}, [], RouteRank.Last)\n```\n\n---\n\n### Validate an OAuth connection name\n\nOAuth connection names can only be tested end-to-end through a real sign-in flow:\n\n**Azure Portal → Your Bot Resource → Settings → OAuth Connection Settings → [your connection] → Test Connection**\n\nThis confirms the connection name matches, the OAuth app has the right scopes, and the redirect URI (`https:\u002F\u002Ftoken.botframework.com\u002F.auth\u002Fweb\u002Fredirect`) is registered on the app registration.\n\n## Contributing\n\nIf you hit a problem this skill couldn't solve, found a workaround, or noticed something wrong or outdated, that's valuable — please help improve this skill for everyone.\n\nDraft a suggested issue title and body based on the conversation, then ask the user to open it at: https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fagents\u002Fissues\u002Fnew\n\nA good issue includes:\n- What the user was trying to do\n- What went wrong (errors, unexpected behavior)\n- What worked — including any workaround found during this conversation\n- Relevant code or config snippets\n",{"name":50,"description":51},"agents-sdk-typescript-debugging","Use when troubleshooting an agent built with the Microsoft Agents SDK (@microsoft\u002Fagents-hosting and related packages). Trigger on any of these symptoms: build or TypeScript errors, crashes on startup, 401 or auth errors on incoming requests, the bot not responding to messages, .env configuration problems, Azure AD credential failures (AADSTS errors), port conflicts, or the agent not connecting in Teams or the Agents Playground. Use even if the user doesn't mention the SDK by name — trigger on symptoms like \"my bot won't start\", \"getting 401s\", or \"bot isn't responding.\"","main","8171bc7e0ca3b8defd578a6bb317367c2901983f",".claude\u002Fskills\u002Ftriaging-security-reports",875,"https:\u002F\u002Fgithub.com\u002Fapache\u002Fstruts","https:\u002F\u002Fstruts.apache.org\u002F","https:\u002F\u002Fgithub.com\u002Fapache","https:\u002F\u002Fwww.apache.org\u002F","2026-11-11 16:19:23",{"source":8,"skillName":50,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add apache\u002Fstruts --skill agents-sdk-typescript-debugging",{"tool":67,"command":68},"bunx","bunx skills add apache\u002Fstruts --skill agents-sdk-typescript-debugging",{"tool":70,"command":71},"pnpm","pnpm dlx skills add apache\u002Fstruts --skill agents-sdk-typescript-debugging","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fapache\u002Fstruts\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftriaging-security-reports\u002FSKILL.md",true,[],[76,110,128,148,167,185],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":93,"publishedAt":45},"01M6ACJVHR7YZNC8AZFK987QP0","code-review","Apache Struts pull request review guide. Use when reviewing pull requests in this repository to check test conventions, security-sensitive framework code, PR and commit hygiene, and Struts-specific implementation patterns.","https:\u002F\u002Fgithub.com\u002Fapache\u002Fstruts\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fcode-review\u002FSKILL.md",[82,85,88],{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":86,"categoryName":87,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":89,"categoryName":90,"taxonomyType":91,"taxonomyTypeDesc":92},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[94,95,44,24,96,97,98,99,100,30,101,9,102,103,104,105,39,106,107,108,109,33],"code review","review","test","pull requests","commit","pr","pull request","pull","struts","pull request review","repository","check","review guide","requests","Test Conventions","request",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":45},"01M6ACJQJRMWRPQJ7P796RJZDZ","releasing-struts","Use when running or planning an Apache Struts release on any maintenance line (6.x, 7.x) - cutting the tag, staging artifacts, opening the vote, promoting, updating the site and announcing - or when asked what the next step in a release is.","https:\u002F\u002Fgithub.com\u002Fapache\u002Fstruts\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Freleasing-struts\u002FSKILL.md",[],[102,117,118,119,120,9,121,39,122,123,124,125,126,33,127],"releasing struts","planning","release","artifacts","site","maintenance","what the","next","line","next step","running",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":45},"01M6ACJNFT2MMYBT8WFBJR8HXM","merging-dependabot-prs","Use when triaging, classifying or landing Dependabot pull requests in this repo — clearing the open Dependabot queue, deciding whether a bump needs a WW Jira ticket, or checking whether a bump's build actually passed.","https:\u002F\u002Fgithub.com\u002Fapache\u002Fstruts\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fmerging-dependabot-prs\u002FSKILL.md",[],[135,136,137,97,138,101,139,140,141,39,142,143,144,145,146,147,107,33],"merging dependabot prs","dependabot","prs","jira","open","repo","landing","queue","bump","build","jira ticket","ww","ticket",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":45},"01M6ACJK00H307C0B4HTMM34EB","creating-version-notes","Use when preparing, updating, or reviewing the release documentation for a Struts release or release candidate on any maintenance line (6.x, 7.x) - the Version Notes page on the cwiki, its Migration Guide entry, the GitHub release notes, and the test-build announcement mail.","https:\u002F\u002Fgithub.com\u002Fapache\u002Fstruts\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcreating-version-notes\u002FSKILL.md",[],[155,156,157,158,96,159,160,119,161,102,162,163,164,39,122,165,125,42,166,33],"notes","creating version notes","version","github","documentation","release notes","announcement","github release","page","guide","mail","candidate",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":45},"01M6ACJGZAS1WB8RHDQMC76XFB","creating-security-bulletins","Use when drafting, updating, or reviewing an S2-XXX security bulletin on the Struts cwiki, when preparing bulletin text ahead of a CVE request, when filling a CVE record in the ASF CVE tool (cveprocess.apache.org \u002F Vulnogram), when deciding when to publish, when publishing a bulletin and announcing it to the ASF lists, when wrapping up after the advisory mails, or when deciding how much detail about a fixed vulnerability is safe to publish.","https:\u002F\u002Fgithub.com\u002Fapache\u002Fstruts\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcreating-security-bulletins\u002FSKILL.md",[],[24,174,175,9,102,176,43,177,38,178,179,180,39,181,182,183,184,109,33,27],"creating security bulletins","safe","asf","publish","how","tool","text","up","publishing","detail","org",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":45},"01M6ACJERGEM6AYZGCC6A2ZC27","creating-release-vote-mail","Use when opening the formal release vote for a Struts release candidate on any maintenance line (6.x, 7.x) - composing and drafting the [VOTE] Apache Struts X.Y.Z mail to dev@ once the Version Notes page, GitHub release and staged artifacts are published.","https:\u002F\u002Fgithub.com\u002Fapache\u002Fstruts\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcreating-release-vote-mail\u002FSKILL.md",[],[119,192,165,158,155,120,193,9,102,162,163,39,157,122,125,42,194,166,33,27],"creating release vote mail","dev","staged"]