[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADMF5B2XRP0P0C2KY5HCZ8":3,"skill-same:01M6ADMF5B2XRP0P0C2KY5HCZ8":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":27,"linkOnly":28,"markdownContent":29,"markdownBody":30,"frontMatter":31,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":40,"ownerHtmlUrl":41,"ownerBlogUrl":42,"ownerDescription":43,"updatedAt":44,"install":45,"resources":58},"01M6ADMF5B2XRP0P0C2KY5HCZ8","security-scan",null,"Scan the codebase for common security issues: hardcoded secrets, SQL injection vectors, XSS, unvalidated inputs, and insecure defaults. Use before deploying, as part of code quality review, or when asked to check for security issues.","davila7\u002Fclaude-with-skills","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHY7XW1NT6J5EJ61Q42B",13,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-with-skills\u002Fblob\u002Fmain\u002Fsrc\u002Fcontent\u002Fdocs\u002F03-advanced\u002Fcapstone\u002Fsolution\u002F.claude\u002Fskills\u002Fsecurity-scan\u002FSKILL.md",[],[19,20,21,22,23,24,25,26],"security","security scan","review","code quality","sql","code","git","issues","2026-11-10 10:12:30",false,"---\ntitle: \"security-scan\"\nname: security-scan\ndescription: \"Scan the codebase for common security issues: hardcoded secrets, SQL injection vectors, XSS, unvalidated inputs, and insecure defaults. Use before deploying, as part of code quality review, or when asked to check for security issues.\"\ncontext: fork\nagent: Explore\nallowed-tools: \"Grep Glob Read Bash(git diff *) Bash(git log *)\"\n---\n\nRun a security scan on this codebase.\n\n## Changed files (focus here first)\n\n!`git diff --name-only HEAD~1 2>\u002Fdev\u002Fnull || git diff --name-only origin\u002Fmain...HEAD 2>\u002Fdev\u002Fnull || echo \"all files — no git diff available\"`\n\nPrioritize scanning the files listed above. If the output says \"all files\", scan the entire codebase.\n\n## Security checks\n\nFor each check, search the changed files first. If changed files is \"all files\", search the entire codebase excluding `node_modules\u002F`, `dist\u002F`, `.git\u002F`, `vendor\u002F`, and `*.min.js`.\n\n### 1. Hardcoded secrets\n\nSearch for patterns like `password=`, `api_key=`, `secret=`, `token=`, `passwd=`, `private_key=` followed by a literal value (not a variable reference or environment variable lookup).\n\nExclude:\n- Files in `test\u002F`, `spec\u002F`, `__tests__\u002F` directories\n- Files ending in `.example`, `.sample`, `.template`\n- Lines that contain `process.env`, `os.environ`, `getenv`, `${`, `$(`, or `config.get`\n\n### 2. SQL injection risk\n\nSearch for SQL keywords (`SELECT`, `INSERT`, `UPDATE`, `DELETE`, `WHERE`, `FROM`) appearing inside f-strings (Python), template literals (JavaScript\u002FTypeScript), or string concatenation patterns where a variable is embedded directly. Look for patterns like:\n- `f\"SELECT ... {variable}`\n- `` `SELECT ... ${variable}` ``\n- `\"SELECT \" + variable`\n\n### 3. XSS vectors\n\nSearch `.js` and `.ts` files for `innerHTML` being assigned a value that includes a variable: `element.innerHTML = `, `.innerHTML +=`. Flag any assignment that does not call a sanitization function (`DOMPurify.sanitize`, `sanitize(`, `escapeHtml(`).\n\n### 4. Unvalidated inputs\n\nSearch for patterns where request body or parameters are passed directly to a database function without an intervening validation step. Look for `req.body.`, `request.data`, `request.form`, `params[` in close proximity (within 5 lines) to database calls (`query(`, `execute(`, `find(`, `.save(`, `.create(`).\n\n### 5. Insecure defaults\n\nSearch for:\n- `DEBUG = True` or `DEBUG=True` (Python)\n- `NODE_ENV` not set to `production` in deployment configuration files\n- `verify=False` in Python requests calls\n- CORS configured to allow all origins: `cors({ origin: '*' })`, `Access-Control-Allow-Origin: *` in non-development config files\n\n## Output format\n\nOutput exactly:\n\n```\nSECURITY FINDINGS:\n- [CRITICAL|HIGH|MEDIUM|LOW] \u003Cfile>:\u003Cline> — \u003Cdescription>\n```\n\nUse these severity levels:\n- CRITICAL: hardcoded secret or SQL injection\n- HIGH: XSS or unvalidated input in an auth path\n- MEDIUM: unvalidated input in a non-auth path, `DEBUG=True` in a deployed config\n- LOW: insecure default that is acceptable in development but not production\n\nIf no findings: output exactly `SECURITY FINDINGS: none`\n\nDo not add any prose before or after the findings block.\n","Run a security scan on this codebase.\n\n## Changed files (focus here first)\n\n!`git diff --name-only HEAD~1 2>\u002Fdev\u002Fnull || git diff --name-only origin\u002Fmain...HEAD 2>\u002Fdev\u002Fnull || echo \"all files — no git diff available\"`\n\nPrioritize scanning the files listed above. If the output says \"all files\", scan the entire codebase.\n\n## Security checks\n\nFor each check, search the changed files first. If changed files is \"all files\", search the entire codebase excluding `node_modules\u002F`, `dist\u002F`, `.git\u002F`, `vendor\u002F`, and `*.min.js`.\n\n### 1. Hardcoded secrets\n\nSearch for patterns like `password=`, `api_key=`, `secret=`, `token=`, `passwd=`, `private_key=` followed by a literal value (not a variable reference or environment variable lookup).\n\nExclude:\n- Files in `test\u002F`, `spec\u002F`, `__tests__\u002F` directories\n- Files ending in `.example`, `.sample`, `.template`\n- Lines that contain `process.env`, `os.environ`, `getenv`, `${`, `$(`, or `config.get`\n\n### 2. SQL injection risk\n\nSearch for SQL keywords (`SELECT`, `INSERT`, `UPDATE`, `DELETE`, `WHERE`, `FROM`) appearing inside f-strings (Python), template literals (JavaScript\u002FTypeScript), or string concatenation patterns where a variable is embedded directly. Look for patterns like:\n- `f\"SELECT ... {variable}`\n- `` `SELECT ... ${variable}` ``\n- `\"SELECT \" + variable`\n\n### 3. XSS vectors\n\nSearch `.js` and `.ts` files for `innerHTML` being assigned a value that includes a variable: `element.innerHTML = `, `.innerHTML +=`. Flag any assignment that does not call a sanitization function (`DOMPurify.sanitize`, `sanitize(`, `escapeHtml(`).\n\n### 4. Unvalidated inputs\n\nSearch for patterns where request body or parameters are passed directly to a database function without an intervening validation step. Look for `req.body.`, `request.data`, `request.form`, `params[` in close proximity (within 5 lines) to database calls (`query(`, `execute(`, `find(`, `.save(`, `.create(`).\n\n### 5. Insecure defaults\n\nSearch for:\n- `DEBUG = True` or `DEBUG=True` (Python)\n- `NODE_ENV` not set to `production` in deployment configuration files\n- `verify=False` in Python requests calls\n- CORS configured to allow all origins: `cors({ origin: '*' })`, `Access-Control-Allow-Origin: *` in non-development config files\n\n## Output format\n\nOutput exactly:\n\n```\nSECURITY FINDINGS:\n- [CRITICAL|HIGH|MEDIUM|LOW] \u003Cfile>:\u003Cline> — \u003Cdescription>\n```\n\nUse these severity levels:\n- CRITICAL: hardcoded secret or SQL injection\n- HIGH: XSS or unvalidated input in an auth path\n- MEDIUM: unvalidated input in a non-auth path, `DEBUG=True` in a deployed config\n- LOW: insecure default that is acceptable in development but not production\n\nIf no findings: output exactly `SECURITY FINDINGS: none`\n\nDo not add any prose before or after the findings block.\n",{"name":5,"agent":32,"title":5,"context":33,"description":7,"allowed-tools":34},"Explore","fork","Grep Glob Read Bash(git diff *) Bash(git log *)","main","55e6468ba43345d07c8a68de983e58403db57c25","src\u002Fcontent\u002Fdocs\u002F03-advanced\u002Fcapstone\u002Fsolution\u002F.claude\u002Fskills\u002Fsecurity-scan",1,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-with-skills","https:\u002F\u002Fclaude-with-skills.vercel.app","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-05-15 21:54:25",{"source":8,"skillName":5,"commands":46,"prompt":56,"zipAvailable":57},[47,50,53],{"tool":48,"command":49},"npx","npx skills add davila7\u002Fclaude-with-skills --skill security-scan",{"tool":51,"command":52},"bunx","bunx skills add davila7\u002Fclaude-with-skills --skill security-scan",{"tool":54,"command":55},"pnpm","pnpm dlx skills add davila7\u002Fclaude-with-skills --skill security-scan","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-with-skills\u002Fblob\u002Fmain\u002Fsrc\u002Fcontent\u002Fdocs\u002F03-advanced\u002Fcapstone\u002Fsolution\u002F.claude\u002Fskills\u002Fsecurity-scan\u002FSKILL.md",true,[59],{"path":60,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":63,"sourceHtmlUrl":64},"SKILL.md.tmpl","OTHER","其他",9293,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fcontext-save\u002FSKILL.md.tmpl",[66,81,92,98,105,114],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":27},"01M6ADNEC991ZW0GD2D4MY6NEP","tag-version","Bump the package version and create an annotated git tag. Accepts a semantic version number (1.2.0) or a bump type (patch, minor, major). Does not push — use the publish skill to push. Use as part of a release workflow.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-with-skills\u002Fblob\u002Fmain\u002Fsrc\u002Fcontent\u002Fdocs\u002F03-advanced\u002Flesson-08-plugins-and-distribution\u002Fexamples\u002Frelease-plugin\u002Fskills\u002Ftag-version\u002FSKILL.md",[],[73,74,75,76,25,77,78,79,80],"tag version","workflow","create","release","push","npm","package","publish",{"skillNo":82,"name":76,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":27},"01M6ADNCNHCXNHVAW43ZV43ZC8","Run the complete release workflow: changelog entry, version bump, git tag, and GitHub release. Invokes changelog-entry, tag-version, and publish in sequence. Use when releasing a new version of the project.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-with-skills\u002Fblob\u002Fmain\u002Fsrc\u002Fcontent\u002Fdocs\u002F03-advanced\u002Flesson-08-plugins-and-distribution\u002Fexamples\u002Frelease-plugin\u002Fskills\u002Frelease\u002FSKILL.md",[],[76,25,87,78,88,89,80,90,91,74],"changelog","changelog entry","run","status","github",{"skillNo":93,"name":80,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":27},"01M6ADNAWDDDDX4CS69E1D496X","Push the current branch and all tags to origin, then create a GitHub release using the latest tag and its CHANGELOG.md entry. Use after tag-version to complete a release.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-with-skills\u002Fblob\u002Fmain\u002Fsrc\u002Fcontent\u002Fdocs\u002F03-advanced\u002Flesson-08-plugins-and-distribution\u002Fexamples\u002Frelease-plugin\u002Fskills\u002Fpublish\u002FSKILL.md",[],[80,77,91,75,76,25,87],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":27},"01M6ADN9MP0ASQ6SX14NEPP5XE","changelog-entry","Draft the changelog entry for all unreleased commits in Keep a Changelog format. Groups commits into Added, Changed, Fixed, Removed, and Security. Use before releasing a new version or when updating CHANGELOG.md.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-with-skills\u002Fblob\u002Fmain\u002Fsrc\u002Fcontent\u002Fdocs\u002F03-advanced\u002Flesson-08-plugins-and-distribution\u002Fexamples\u002Frelease-plugin\u002Fskills\u002Fchangelog-entry\u002FSKILL.md",[],[88,87,19,25],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":27},"01M6ADN8243TD9X8FH7FCQ608R","auto-format-on-edit","Automatically format code files after every edit using Prettier and ESLint. Active in the background whenever Claude edits a file. Formatting is silent — no prompts, no output unless a formatter fails. Use when you want consistent formatting enforced automatically during a coding session.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-with-skills\u002Fblob\u002Fmain\u002Fsrc\u002Fcontent\u002Fdocs\u002F03-advanced\u002Flesson-07-hooks-in-skills\u002Fexamples\u002Fauto-format-on-edit\u002FSKILL.md",[],[112,24,113],"auto format on edit","file",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":125,"publishedAt":27},"01M6ADN5VVNV7Y2WPYQA13M4ZQ","code-quality-audit","Run a comprehensive code quality audit covering security, performance, and maintainability. Use for quarterly audits, pre-release reviews, or when onboarding to a large codebase.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-with-skills\u002Fblob\u002Fmain\u002Fsrc\u002Fcontent\u002Fdocs\u002F03-advanced\u002Flesson-06-context-window-mastery\u002Fexamples\u002Flightweight-orchestrator\u002FSKILL.md",[120],{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[126,127,24,22,128,89,76,129,19],"code quality audit","audit","performance","onboarding"]