[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C2E2EXDF0NMDT6AHP3NQ8D":3,"skill-same:01M6C2E2EXDF0NMDT6AHP3NQ8D":181},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":66,"linkOnly":67,"markdownContent":68,"markdownBody":69,"frontMatter":70,"refName":103,"commitSha":104,"skillDirectory":105,"forksCount":106,"repositoryHtmlUrl":107,"repositoryHomepageUrl":108,"ownerHtmlUrl":109,"ownerBlogUrl":110,"ownerDescription":111,"updatedAt":112,"install":113,"resources":126},"01M6C2E2EXDF0NMDT6AHP3NQ8D","banned-api-audit",null,"Scan source code for banned APIs\u002Fforbidden functions per project banlist; report violations with paths, line numbers, and recommended replacements","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002FSKILL.md",[18,23,26,31],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",{"categoryNo":32,"categoryName":33,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000034","行政与办公人员",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65],"banned api audit","audit","api","write","command","install","never","scanning","modules","scan","human","project","tests","os","paths","for","inline","read","go","timestamp","node","haiku","annotations","text","Bash","SET","code","cpp","rust","security","python","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: banned-api-audit\nplatforms: [all]\ndescription: Scan source code for banned APIs\u002Fforbidden functions per project banlist; report violations with paths, line numbers, and recommended replacements\nrequires:\n  - banlist: .aiwg\u002Fsecurity\u002Fbanned-apis.yaml (project banlist) OR a bundled starter via --starter \u003Clanguage>\n  - rg: ripgrep installed (used for fast scanning)\nensures:\n  - report: human-readable violation report to stdout\n  - report-json: machine-readable JSON to .aiwg\u002Fsecurity\u002Fbanned-api-audit\u002F{timestamp}.json\n  - exit-code: non-zero when violations found AND --fail-on-violation set\nerrors:\n  - banlist-missing: no .aiwg\u002Fsecurity\u002Fbanned-apis.yaml and no --starter flag — instruct user to seed a banlist\n  - rg-not-installed: ripgrep required; suggest install command for detected OS\ninvariants:\n  - inline AIWG-allow annotations are honored and recorded in the report (never silently dropped)\n  - test\u002F**, tests\u002F**, vendor\u002F**, node_modules\u002F**, .aiwg\u002F** excluded by default\nscript:\n  entrypoint: scripts\u002Faudit.mjs\n  runtime: node\n  cwd: project-root\n  argsHint: \"[--starter c|cpp|python|node|go|rust] [--fail-on-violation] [--paths \u003Cpath>...] [--format text|json|both|sarif]\"\ncommandHint:\n  argumentHint: \"[--starter c|cpp|python|node|go|rust] [--fail-on-violation] [--paths \u003Cglob>...] [--format text|json|both|sarif] [--sarif]\"\n  allowedTools: Read, Write, Bash, Glob, Grep\n  model: haiku\n  category: security\n  orchestration: false\n  modelRole: efficiency\n  modelTier: economy\n---\n\n# Banned API Audit\n\n**You are the Banned API Auditor** — scan source code for prohibited functions and APIs declared in the project banlist, report violations with full context, and exit with a CI-suitable status code.\n\n## Core Philosophy\n\n\"Eliminate CVE classes by construction.\" Banning a dangerous API is cheaper than vigilance. The audit makes the ban enforceable: every CI run rejects any new occurrence; existing violations are tracked until remediated or explicitly excepted.\n\n## Natural Language Triggers\n\n- \"audit banned APIs\"\n- \"scan for forbidden functions\"\n- \"check banned-functions policy\"\n- \"run banlist audit\"\n- \"check for unsafe C functions\"\n\n## Parameters\n\n### `--starter \u003Clanguage>` (optional)\n\nUse a bundled starter banlist instead of (or in addition to) the project banlist. Useful for a first-time audit before the project has its own `banned-apis.yaml`. Valid: `c`, `cpp`, `python`, `node`, `go`, `rust`.\n\n### `--fail-on-violation` (optional)\n\nExit non-zero when ANY violation is found. Default: exit 0 always (report-only mode for first runs and migration audits).\n\n### `--paths \u003Cglob>...` (optional)\n\nLimit the scan to these paths. Overrides `paths:` declarations in the banlist. Useful for scoped PR audits.\n\n### `--format text|json|both|sarif` (default `both`)\n\n`text` to stdout, `json` to `.aiwg\u002Fsecurity\u002Fbanned-api-audit\u002F`, or `both`.\n\n### `--sarif` (optional)\n\nAlso emit SARIF 2.1.0 to `.aiwg\u002Fsecurity\u002Fbanned-api-audit\u002F` for code-scanning ingest.\n\n## Execution Flow\n\n### Phase 1: Resolve banlist\n\n1. Look for `.aiwg\u002Fsecurity\u002Fbanned-apis.yaml`.\n2. If `--starter \u003Clang>` is set, merge the bundled starter into the active banlist (project banlist wins on pattern conflict).\n3. If neither exists, emit a guided message:\n\n   ```\n   No banlist found. Bootstrap with:\n     aiwg run skill banned-api-audit -- --starter c\n   Or seed your own at .aiwg\u002Fsecurity\u002Fbanned-apis.yaml\n   ```\n\n### Phase 2: Resolve paths and exclusions\n\nDefault exclusions (always applied unless `--paths` overrides):\n- `test\u002F**`, `tests\u002F**`, `**\u002F*_test.*`, `**\u002F*.test.*`\n- `vendor\u002F**`, `node_modules\u002F**`, `target\u002F**`, `dist\u002F**`, `build\u002F**`\n- `.git\u002F**`, `.aiwg\u002F**`, `.claude\u002F**`, `.codex\u002F**`, `.factory\u002F**`\n\nProject banlist `paths:` declarations narrow further (e.g., `src\u002F**` only).\n\n### Phase 3: Scan with ripgrep\n\nFor each `(language, pattern)` pair:\n\n```bash\n# Word-boundary literal pattern\nrg -n --type \u003Clang> -w '\u003Cpattern>' \u003Cpaths>\n\n# Regex pattern (when prefixed re:)\nrg -n --type \u003Clang> '\u003Cregex>' \u003Cpaths>\n```\n\nLanguage → ripgrep `--type` mapping:\n- `c` → `c`\n- `cpp` → `cpp`\n- `python` → `py`\n- `node` → `js,ts,tsx,jsx`\n- `go` → `go`\n- `rust` → `rust`\n\n### Phase 4: Honor inline allow annotations\n\nFor each candidate violation, check the source line and the preceding 2 lines for:\n\n```\nAIWG-allow:banned-apis reason=\"...\"\n```\n\nWhen present, classify as **excepted** (not a violation). Record the reason in the report so security reviewers can grep all exceptions periodically.\n\n### Phase 5: Emit report\n\nText report format:\n\n```\nBanned API Audit — 2026-05-21T17:30:00Z\n\nBanlist:    .aiwg\u002Fsecurity\u002Fbanned-apis.yaml (24 patterns across 3 languages)\nPaths:      src\u002F, lib\u002F\nExcluded:   test\u002F, tests\u002F, vendor\u002F, node_modules\u002F\n\nVIOLATIONS (3)\n\nsrc\u002Fauth\u002Ftoken.c:42:    strcpy(buf, user_input);\n  pattern:      strcpy  (language: c)\n  reason:       Unbounded copy — buffer overflow vector\n  replacement:  strncpy_s, strlcpy, or snprintf with bounds\n\nsrc\u002Fparser\u002Fjson.c:118:  sprintf(out, \"%s\u002F%s\", base, path);\n  pattern:      sprintf  (language: c)\n  reason:       Unbounded format expansion — overflow + format-string risk\n  replacement:  snprintf with explicit buffer size\n\nsrc\u002Futil\u002Flegacy.py:7:   user = pickle.loads(payload)\n  pattern:      re:pickle\\.loads?\\b  (language: python)\n  reason:       Arbitrary code execution on untrusted input\n  replacement:  json, msgpack, or signed pickle with integrity check\n\nEXCEPTIONS (1)\n\nsrc\u002Fcompat\u002Fcurses_wrapper.c:33:  char *tok = strtok(buf, \" \");\n  pattern:  strtok\n  reason:   curses interop requires strtok per legacy API contract\n\nSUMMARY\n  Violations:  3\n  Exceptions:  1\n  Patterns:    24\n  Files scanned: 184\n```\n\nJSON report (machine-readable, suitable for SARIF conversion or CI dashboard ingest):\n\n```json\n{\n  \"schemaVersion\": \"1\",\n  \"auditedAt\": \"2026-05-21T17:30:00Z\",\n  \"banlistPath\": \".aiwg\u002Fsecurity\u002Fbanned-apis.yaml\",\n  \"patterns\": 24,\n  \"filesScanned\": 184,\n  \"violations\": [\n    {\n      \"file\": \"src\u002Fauth\u002Ftoken.c\",\n      \"line\": 42,\n      \"column\": 5,\n      \"match\": \"strcpy(buf, user_input);\",\n      \"pattern\": \"strcpy\",\n      \"language\": \"c\",\n      \"reason\": \"Unbounded copy — buffer overflow vector\",\n      \"replacement\": \"strncpy_s, strlcpy, or snprintf with bounds\",\n      \"severity\": \"HIGH\"\n    }\n  ],\n  \"exceptions\": [ \u002F* same shape, plus exceptionReason *\u002F ]\n}\n```\n\n### Phase 6: Exit code\n\n- `0` — no violations, OR violations present but `--fail-on-violation` not set\n- `1` — banlist missing AND no `--starter` flag\n- `2` — violations present AND `--fail-on-violation` set\n- `3` — ripgrep not installed or other tooling failure\n\n## CI Integration\n\nGitea Actions:\n\n```yaml\n- name: Banned-API audit\n  run: aiwg run skill banned-api-audit -- --fail-on-violation\n```\n\nGitHub Actions:\n\n```yaml\n- name: Banned-API audit\n  run: aiwg run skill banned-api-audit -- --fail-on-violation\n```\n\n## Starter Banlists\n\nBundled at `banlists\u002F`:\n\n- `c.yaml` — C dangerous functions (strcpy, sprintf, gets, strtok, atoi)\n- `cpp.yaml` — C++ overlay (auto_ptr, gets, strcpy)\n- `python.yaml` — eval, exec, pickle.loads, subprocess shell=True\n- `node.yaml` — eval, new Function, child_process.exec\n- `go.yaml` — shell-string commands, weak hashes, HTML templating footguns\n- `rust.yaml` — unsafe\u002Ftransmute\u002Funwrap review gates, shell-string commands\n\nUsers seed their project banlist via `--starter \u003Clang>` and customize.\n\n## Composing with Crypto Rules\n\nThe CRITICAL applied-cryptography rules (`no-unauthenticated-encryption`, `no-adhoc-kdf`, `no-key-reuse-across-purposes`) are enforced separately by their own audit paths. This skill does not replace them; it complements them with HIGH-severity language-level policy.\n\n## Implementation\n\nCycle 2 adds:\n\n- `scripts\u002Faudit.sh` \u002F `scripts\u002Faudit.mjs` reference implementation.\n- `schema.json` documenting the banlist YAML shape.\n- Starter banlists for C, C++, Python, Node, Go, and Rust.\n- Text, JSON, and SARIF report output.\n- Exit codes: `0` clean\u002Freport-only, `1` banlist\u002Fschema problem, `2` violations with `--fail-on-violation`, `3` tooling failure.\n\n## References\n\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Frules\u002Fbanned-apis.md — Policy rule\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Frules\u002Fno-unauthenticated-encryption.md — Crypto specialization\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Frules\u002Fno-adhoc-kdf.md — Crypto specialization\n- `.aiwg\u002Fsecurity\u002Fcurl-checklist-gap-analysis.md` row 2 — Audit context\n- curl: https:\u002F\u002Fcurl.se\u002Fdev\u002Fsecure-coding.html\n- ripgrep: https:\u002F\u002Fgithub.com\u002FBurntSushi\u002Fripgrep\n- SARIF: https:\u002F\u002Fdocs.oasis-open.org\u002Fsarif\u002Fsarif\u002Fv2.1.0\u002F\n","# Banned API Audit\n\n**You are the Banned API Auditor** — scan source code for prohibited functions and APIs declared in the project banlist, report violations with full context, and exit with a CI-suitable status code.\n\n## Core Philosophy\n\n\"Eliminate CVE classes by construction.\" Banning a dangerous API is cheaper than vigilance. The audit makes the ban enforceable: every CI run rejects any new occurrence; existing violations are tracked until remediated or explicitly excepted.\n\n## Natural Language Triggers\n\n- \"audit banned APIs\"\n- \"scan for forbidden functions\"\n- \"check banned-functions policy\"\n- \"run banlist audit\"\n- \"check for unsafe C functions\"\n\n## Parameters\n\n### `--starter \u003Clanguage>` (optional)\n\nUse a bundled starter banlist instead of (or in addition to) the project banlist. Useful for a first-time audit before the project has its own `banned-apis.yaml`. Valid: `c`, `cpp`, `python`, `node`, `go`, `rust`.\n\n### `--fail-on-violation` (optional)\n\nExit non-zero when ANY violation is found. Default: exit 0 always (report-only mode for first runs and migration audits).\n\n### `--paths \u003Cglob>...` (optional)\n\nLimit the scan to these paths. Overrides `paths:` declarations in the banlist. Useful for scoped PR audits.\n\n### `--format text|json|both|sarif` (default `both`)\n\n`text` to stdout, `json` to `.aiwg\u002Fsecurity\u002Fbanned-api-audit\u002F`, or `both`.\n\n### `--sarif` (optional)\n\nAlso emit SARIF 2.1.0 to `.aiwg\u002Fsecurity\u002Fbanned-api-audit\u002F` for code-scanning ingest.\n\n## Execution Flow\n\n### Phase 1: Resolve banlist\n\n1. Look for `.aiwg\u002Fsecurity\u002Fbanned-apis.yaml`.\n2. If `--starter \u003Clang>` is set, merge the bundled starter into the active banlist (project banlist wins on pattern conflict).\n3. If neither exists, emit a guided message:\n\n   ```\n   No banlist found. Bootstrap with:\n     aiwg run skill banned-api-audit -- --starter c\n   Or seed your own at .aiwg\u002Fsecurity\u002Fbanned-apis.yaml\n   ```\n\n### Phase 2: Resolve paths and exclusions\n\nDefault exclusions (always applied unless `--paths` overrides):\n- `test\u002F**`, `tests\u002F**`, `**\u002F*_test.*`, `**\u002F*.test.*`\n- `vendor\u002F**`, `node_modules\u002F**`, `target\u002F**`, `dist\u002F**`, `build\u002F**`\n- `.git\u002F**`, `.aiwg\u002F**`, `.claude\u002F**`, `.codex\u002F**`, `.factory\u002F**`\n\nProject banlist `paths:` declarations narrow further (e.g., `src\u002F**` only).\n\n### Phase 3: Scan with ripgrep\n\nFor each `(language, pattern)` pair:\n\n```bash\n# Word-boundary literal pattern\nrg -n --type \u003Clang> -w '\u003Cpattern>' \u003Cpaths>\n\n# Regex pattern (when prefixed re:)\nrg -n --type \u003Clang> '\u003Cregex>' \u003Cpaths>\n```\n\nLanguage → ripgrep `--type` mapping:\n- `c` → `c`\n- `cpp` → `cpp`\n- `python` → `py`\n- `node` → `js,ts,tsx,jsx`\n- `go` → `go`\n- `rust` → `rust`\n\n### Phase 4: Honor inline allow annotations\n\nFor each candidate violation, check the source line and the preceding 2 lines for:\n\n```\nAIWG-allow:banned-apis reason=\"...\"\n```\n\nWhen present, classify as **excepted** (not a violation). Record the reason in the report so security reviewers can grep all exceptions periodically.\n\n### Phase 5: Emit report\n\nText report format:\n\n```\nBanned API Audit — 2026-05-21T17:30:00Z\n\nBanlist:    .aiwg\u002Fsecurity\u002Fbanned-apis.yaml (24 patterns across 3 languages)\nPaths:      src\u002F, lib\u002F\nExcluded:   test\u002F, tests\u002F, vendor\u002F, node_modules\u002F\n\nVIOLATIONS (3)\n\nsrc\u002Fauth\u002Ftoken.c:42:    strcpy(buf, user_input);\n  pattern:      strcpy  (language: c)\n  reason:       Unbounded copy — buffer overflow vector\n  replacement:  strncpy_s, strlcpy, or snprintf with bounds\n\nsrc\u002Fparser\u002Fjson.c:118:  sprintf(out, \"%s\u002F%s\", base, path);\n  pattern:      sprintf  (language: c)\n  reason:       Unbounded format expansion — overflow + format-string risk\n  replacement:  snprintf with explicit buffer size\n\nsrc\u002Futil\u002Flegacy.py:7:   user = pickle.loads(payload)\n  pattern:      re:pickle\\.loads?\\b  (language: python)\n  reason:       Arbitrary code execution on untrusted input\n  replacement:  json, msgpack, or signed pickle with integrity check\n\nEXCEPTIONS (1)\n\nsrc\u002Fcompat\u002Fcurses_wrapper.c:33:  char *tok = strtok(buf, \" \");\n  pattern:  strtok\n  reason:   curses interop requires strtok per legacy API contract\n\nSUMMARY\n  Violations:  3\n  Exceptions:  1\n  Patterns:    24\n  Files scanned: 184\n```\n\nJSON report (machine-readable, suitable for SARIF conversion or CI dashboard ingest):\n\n```json\n{\n  \"schemaVersion\": \"1\",\n  \"auditedAt\": \"2026-05-21T17:30:00Z\",\n  \"banlistPath\": \".aiwg\u002Fsecurity\u002Fbanned-apis.yaml\",\n  \"patterns\": 24,\n  \"filesScanned\": 184,\n  \"violations\": [\n    {\n      \"file\": \"src\u002Fauth\u002Ftoken.c\",\n      \"line\": 42,\n      \"column\": 5,\n      \"match\": \"strcpy(buf, user_input);\",\n      \"pattern\": \"strcpy\",\n      \"language\": \"c\",\n      \"reason\": \"Unbounded copy — buffer overflow vector\",\n      \"replacement\": \"strncpy_s, strlcpy, or snprintf with bounds\",\n      \"severity\": \"HIGH\"\n    }\n  ],\n  \"exceptions\": [ \u002F* same shape, plus exceptionReason *\u002F ]\n}\n```\n\n### Phase 6: Exit code\n\n- `0` — no violations, OR violations present but `--fail-on-violation` not set\n- `1` — banlist missing AND no `--starter` flag\n- `2` — violations present AND `--fail-on-violation` set\n- `3` — ripgrep not installed or other tooling failure\n\n## CI Integration\n\nGitea Actions:\n\n```yaml\n- name: Banned-API audit\n  run: aiwg run skill banned-api-audit -- --fail-on-violation\n```\n\nGitHub Actions:\n\n```yaml\n- name: Banned-API audit\n  run: aiwg run skill banned-api-audit -- --fail-on-violation\n```\n\n## Starter Banlists\n\nBundled at `banlists\u002F`:\n\n- `c.yaml` — C dangerous functions (strcpy, sprintf, gets, strtok, atoi)\n- `cpp.yaml` — C++ overlay (auto_ptr, gets, strcpy)\n- `python.yaml` — eval, exec, pickle.loads, subprocess shell=True\n- `node.yaml` — eval, new Function, child_process.exec\n- `go.yaml` — shell-string commands, weak hashes, HTML templating footguns\n- `rust.yaml` — unsafe\u002Ftransmute\u002Funwrap review gates, shell-string commands\n\nUsers seed their project banlist via `--starter \u003Clang>` and customize.\n\n## Composing with Crypto Rules\n\nThe CRITICAL applied-cryptography rules (`no-unauthenticated-encryption`, `no-adhoc-kdf`, `no-key-reuse-across-purposes`) are enforced separately by their own audit paths. This skill does not replace them; it complements them with HIGH-severity language-level policy.\n\n## Implementation\n\nCycle 2 adds:\n\n- `scripts\u002Faudit.sh` \u002F `scripts\u002Faudit.mjs` reference implementation.\n- `schema.json` documenting the banlist YAML shape.\n- Starter banlists for C, C++, Python, Node, Go, and Rust.\n- Text, JSON, and SARIF report output.\n- Exit codes: `0` clean\u002Freport-only, `1` banlist\u002Fschema problem, `2` violations with `--fail-on-violation`, `3` tooling failure.\n\n## References\n\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Frules\u002Fbanned-apis.md — Policy rule\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Frules\u002Fno-unauthenticated-encryption.md — Crypto specialization\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Frules\u002Fno-adhoc-kdf.md — Crypto specialization\n- `.aiwg\u002Fsecurity\u002Fcurl-checklist-gap-analysis.md` row 2 — Audit context\n- curl: https:\u002F\u002Fcurl.se\u002Fdev\u002Fsecure-coding.html\n- ripgrep: https:\u002F\u002Fgithub.com\u002FBurntSushi\u002Fripgrep\n- SARIF: https:\u002F\u002Fdocs.oasis-open.org\u002Fsarif\u002Fsarif\u002Fv2.1.0\u002F\n",{"name":5,"errors":71,"script":76,"ensures":80,"requires":87,"namespace":92,"platforms":93,"invariants":95,"commandHint":98,"description":7},[72,74],{"banlist-missing":73},"no .aiwg\u002Fsecurity\u002Fbanned-apis.yaml and no --starter flag — instruct user to seed a banlist",{"rg-not-installed":75},"ripgrep required; suggest install command for detected OS",{"cwd":77,"runtime":55,"argsHint":78,"entrypoint":79},"project-root","[--starter c|cpp|python|node|go|rust] [--fail-on-violation] [--paths \u003Cpath>...] [--format text|json|both|sarif]","scripts\u002Faudit.mjs",[81,83,85],{"report":82},"human-readable violation report to stdout",{"report-json":84},"machine-readable JSON to .aiwg\u002Fsecurity\u002Fbanned-api-audit\u002F{timestamp}.json",{"exit-code":86},"non-zero when violations found AND --fail-on-violation set",[88,90],{"banlist":89},".aiwg\u002Fsecurity\u002Fbanned-apis.yaml (project banlist) OR a bundled starter via --starter \u003Clanguage>",{"rg":91},"ripgrep installed (used for fast scanning)","aiwg",[94],"all",[96,97],"inline AIWG-allow annotations are honored and recorded in the report (never silently dropped)","test\u002F**, tests\u002F**, vendor\u002F**, node_modules\u002F**, .aiwg\u002F** excluded by default",{"model":56,"category":64,"modelRole":99,"modelTier":100,"allowedTools":101,"argumentHint":102,"orchestration":67},"efficiency","economy","Read, Write, Bash, Glob, Grep","[--starter c|cpp|python|node|go|rust] [--fail-on-violation] [--paths \u003Cglob>...] [--format text|json|both|sarif] [--sarif]","main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-12 21:57:33",{"source":8,"skillName":5,"commands":114,"prompt":124,"zipAvailable":125},[115,118,121],{"tool":116,"command":117},"npx","npx skills add jmagly\u002Faiwg --skill banned-api-audit",{"tool":119,"command":120},"bunx","bunx skills add jmagly\u002Faiwg --skill banned-api-audit",{"tool":122,"command":123},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill banned-api-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002FSKILL.md",true,[127,133,139,143,147,151,155,159,164,168,173,177],{"path":128,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":131,"sourceHtmlUrl":132},"assets\u002Finvestigation.md","ASSET","资产文件",673,"https:\u002F\u002Fgithub.com\u002FOyadotAI\u002Foya-browser\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fdiagnosing-bugs\u002Fassets\u002Finvestigation.md",{"path":134,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":137,"sourceHtmlUrl":138},"banlists\u002Fc.yaml","REFERENCE","参考文档",2721,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002Fbanlists\u002Fc.yaml",{"path":140,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":141,"sourceHtmlUrl":142},"banlists\u002Fcpp.yaml",1194,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002Fbanlists\u002Fcpp.yaml",{"path":144,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":145,"sourceHtmlUrl":146},"banlists\u002Fgo.yaml",1232,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002Fbanlists\u002Fgo.yaml",{"path":148,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":149,"sourceHtmlUrl":150},"banlists\u002Fnode.yaml",2968,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002Fbanlists\u002Fnode.yaml",{"path":152,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":153,"sourceHtmlUrl":154},"banlists\u002Fpython.yaml",2915,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002Fbanlists\u002Fpython.yaml",{"path":156,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":157,"sourceHtmlUrl":158},"banlists\u002Frust.yaml",1110,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002Fbanlists\u002Frust.yaml",{"path":160,"resourceType":160,"resourceTypeDesc":161,"sizeBytes":162,"sourceHtmlUrl":163},"LICENSE","许可证",1068,"https:\u002F\u002Fgithub.com\u002FOyadotAI\u002Foya-browser\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fdiagnosing-bugs\u002FLICENSE",{"path":165,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":166,"sourceHtmlUrl":167},"schema.json",1258,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002Fschema.json",{"path":79,"resourceType":169,"resourceTypeDesc":170,"sizeBytes":171,"sourceHtmlUrl":172},"SCRIPT","脚本",15460,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002Fscripts\u002Faudit.mjs",{"path":174,"resourceType":169,"resourceTypeDesc":170,"sizeBytes":175,"sourceHtmlUrl":176},"scripts\u002Faudit.sh",137,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbanned-api-audit\u002Fscripts\u002Faudit.sh",{"path":178,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":179,"sourceHtmlUrl":180},"SOURCE.md",969,"https:\u002F\u002Fgithub.com\u002FOyadotAI\u002Foya-browser\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fdiagnosing-bugs\u002FSOURCE.md",[182,206,229,235,242,256],{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":66},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,52,193,194,195,196,197,198,59,199,200,201,36,41,202,203,204,205],"host","host hardening","hardening","re","recommendations","remediation","plan","port","verification","access","only","retention","firewall","bind","secrets","request",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":216,"publishedAt":66},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[212,215],{"categoryNo":213,"categoryName":214,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[217,218,219,52,220,197,221,222,59,223,190,224,200,225,226,41,202,227,228,38],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator",{"skillNo":230,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":66},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[233],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[192,190,191,199,52,205,195,194,36,196,197,198,59,204,200,201,193,41,202,203],{"skillNo":236,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":241,"publishedAt":66},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[239,240],{"categoryNo":213,"categoryName":214,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[218,217,41,220,197,221,59,219,190,224,200,225,226,52,202,223,222,227,228,38],{"skillNo":243,"name":244,"nameZh":6,"description":245,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":246,"categories":247,"keywords":249,"publishedAt":66},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[248],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[250,251,252,253,254,255],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":257,"name":258,"nameZh":6,"description":259,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":260,"categories":261,"keywords":263,"publishedAt":66},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[262],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[264,265,225,266,251],"pi","pi local","duplicate"]