[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C2G385V620JS4KCFC8GKCE":3,"skill-same:01M6C2G385V620JS4KCFC8GKCE":86},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":54,"linkOnly":55,"markdownContent":56,"markdownBody":57,"frontMatter":58,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":85},"01M6C2G385V620JS4KCFC8GKCE","security-engineering-quickref",null,"AUTO-INVOKE when user mentions cryptography, AEAD, KDF, chain of trust, signing key, auth factor, MFA, secret hygiene, supply chain trust, physical threat, DFIR readiness, or incident evidence handoff. Security-engineering quick reference — decision domains for crypto primitives, chain-of-trust, auth factors, degraded modes, supply-chain trust, physical-threat modeling, and DFIR readiness routing.","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-engineering-quickref\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53],"security","engineering","security engineering quickref","security engineering","modeling","auto-invoke","when","invoke","supply chain trust","factor","domains","incident","chain","quick","user","dfir readiness","mfa","routing","evidence","dfir","handoff","primitives","threat","threat modeling","supply-chain","cryptography","auto","decision","auth","quick reference","2026-11-10 10:12:30",false,"---\nname: security-engineering-quickref\nnamespace: aiwg\nplatforms: [all]\nkernel: true\ndescription: AUTO-INVOKE when user mentions cryptography, AEAD, KDF, chain of trust, signing key, auth factor, MFA, secret hygiene, supply chain trust, physical threat, DFIR readiness, or incident evidence handoff. Security-engineering quick reference — decision domains for crypto primitives, chain-of-trust, auth factors, degraded modes, supply-chain trust, physical-threat modeling, and DFIR readiness routing.\n---\n\n# Security Engineering Framework — Quick Reference\n\nThis is your always-loaded directory for the AIWG **security-engineering** framework. It does **not** list every skill. Instead, it teaches the framework's decision domains and gives you **curated search phrases** that map to `aiwg discover` lookups.\n\n## Canonical access pattern: discover → show\n\nWhen you find a candidate via `aiwg discover`, fetch its body with `aiwg show \u003Ctype> \u003Cname> --body`. **Never** use `find`, `ls`, `Glob`, or direct `Read` on `\u003Cprovider>\u002Fskills\u002F` paths — those reflect the kernel-pivot deploy state, not the full surface.\n\n```bash\naiwg discover \"\u003Cphrase>\"             # find — returns ranked candidates\naiwg show skill \u003Cname> --body               # fetch — streams the SKILL.md body\n```\n\nIf your platform's Skill tool errors on a non-kernel skill (expected — most aren't kernel), the fallback is `aiwg show`, never filesystem browsing. Last-resort if `aiwg` itself is broken: read directly from `$AIWG_ROOT\u002Fagentic\u002Fcode\u002F...` (the canonical corpus, always present).\n\n## How to use this quickref\n\n`aiwg show \u003Ctype> \u003Cname>` returns a metadata card. Inspect its outline, then fetch a needed `--section \"Heading\"` or use `--body` for the full instructions. Fetch required rules with `--rules --with-rule-bodies` before governed work.\n\n1. Identify the **decision domain** the user is working through (this framework is decision-aid, not audit)\n2. Pick a **curated phrase** from that domain\n3. Run `aiwg discover \"\u003Cphrase>\"` and surface the top match to the user\n\n**Do not enumerate skills from memory.** Discovery is the lookup surface.\n\n## What this framework is for\n\n**Decision-aid skills for applied security**, distinct from the SDLC framework's broader security review (`flow-security-review-cycle`). Each skill in this framework forces explicit reasoning about a narrow class of security decisions and identifies anti-patterns the operator should reject before implementation.\n\nThis is **not** a vulnerability scanner or pen-test framework. It is a thinking-discipline framework for cryptographic and trust-boundary decisions that get baked into a system early and become hard to change.\n\n## Decision domains\n\n| Domain | The decision being made |\n|---|---|\n| **Cryptographic primitives** | Choosing AEAD \u002F KDF \u002F MAC \u002F signature algorithms |\n| **Chain of trust** | Designing the boot\u002Fbootstrap verification chain |\n| **Authentication factors** | Architecting have\u002Fknow\u002Fare factor stack |\n| **Degraded modes** | Fail-closed vs fail-open behavior matrices |\n| **Supply chain trust** | Beyond CVE\u002FSBOM — pinning depth, reproducible builds, vendor+hash locks |\n| **Runtime secret hygiene** | fd passing, scratch surface verification, error-path safety |\n| **Physical threats** | Threats STRIDE and OWASP Top 10 don't cover |\n| **DFIR readiness** | Preparing evidence handling, custody expectations, and handoff to forensics-complete |\n\n| **Host hardening** | Read-only host baseline, lockout-safe remediation plans and static published-port binds |\n\n## Curated discovery phrases\n\n### Cryptographic primitives\n\n```bash\naiwg discover \"crypto primitive selection\"     # → crypto-primitive-selection\naiwg discover \"choose AEAD\"                    # → crypto-primitive-selection\naiwg discover \"ad-hoc KDF\"                     # → crypto-primitive-selection\n```\n\n### Chain of trust\n\n```bash\naiwg discover \"chain of trust\"                 # → chain-of-trust-design\naiwg discover \"secure bootstrap\"               # → chain-of-trust-design\naiwg discover \"signed boot\"                    # → chain-of-trust-design\n```\n\n### Authentication factors\n\n```bash\naiwg discover \"auth factor design\"             # → auth-factor-design (score 0.59)\naiwg discover \"FIDO2 PIN UV policy\"            # → auth-factor-design\naiwg discover \"coercion-resistance\"            # → auth-factor-design\n```\n\n### Degraded modes\n\n```bash\naiwg discover \"degraded mode design\"           # → degraded-mode-design\naiwg discover \"fail closed fail open\"          # → degraded-mode-design\n```\n\n### Supply chain trust\n\n```bash\naiwg discover \"supply chain trust\"             # → supply-chain-trust (score 0.67)\naiwg discover \"reproducible build\"             # → supply-chain-trust\naiwg discover \"dependency pinning\"             # → supply-chain-trust\naiwg discover \"npm supply-chain audit\"         # → npm-supply-chain-audit\naiwg discover \"cargo crate supply chain audit\" # → cargo-supply-chain-audit (Rust\u002Fcrates.io)\naiwg discover \"rust dependency audit\"          # → cargo-supply-chain-audit\naiwg discover \"ci workflow audit\"              # → ci-workflow-audit\naiwg discover \"workflow pinning audit\"         # → ci-workflow-audit\naiwg discover \"npm release-age gate\"           # → npm-release-age-gate\naiwg discover \"pnpm release age gate\"          # → pnpm-release-age-gate\naiwg discover \"yarn release age gate\"          # → yarn-release-age-gate\naiwg discover \"bun release age gate\"           # → bun-release-age-gate\naiwg discover \"supply-chain hardening quickstart\" # → supply-chain-hardening-quickstart\n```\n\n### Runtime secret hygiene\n\n```bash\naiwg discover \"secret handling runtime\"        # → secret-handling-runtime\naiwg discover \"fd passing secrets\"             # → secret-handling-runtime\naiwg discover \"scratch surface verification\"   # → secret-handling-runtime\n```\n\n### Physical threats\n\n```bash\naiwg discover \"physical threat modeling\"       # → physical-threat-modeling\naiwg discover \"evil-maid attack\"               # → physical-threat-modeling\naiwg discover \"DMA attack\"                     # → physical-threat-modeling\n```\n\n### DFIR readiness\n\n```bash\naiwg discover \"DFIR readiness\"                 # → dfir-readiness\naiwg discover \"incident response evidence\"     # → dfir-readiness or forensics-quickref\naiwg discover \"chain of custody readiness\"     # → dfir-readiness\n```\n\n### Host hardening and firewall exposure\n\n```bash\naiwg discover \"system hardening\"              # → host-hardening\naiwg discover \"firewall analysis\"             # → forensics exposure-analysis\naiwg discover \"docker published ports\"        # → exposure-analysis \u002F published-port-binding\n```\n\n`host-hardening` reviews SSH key\u002Fconsole access, persistent default-deny,\nDocker\u002FVPN ordering, datastore ACLs, exporter targets and audit retention.\nIt produces dated backup requirements, diff-style plans and named health\nrechecks; it never applies host changes, even with an apply request. The static\nchecker flags missing Compose\u002Fdocker run bind addresses. `published-port-binding`\ngoverns repository changes. For post-deploy\u002Fmonthly checks, consume fresh\nsanitized captures and alert on FAIL or UNKNOWN summaries through existing\noperator scheduling. `exposure-analysis` owns actual firewall reconstruction.\n\n## Anti-patterns each skill rejects\n\n| Skill | Anti-patterns it identifies |\n|---|---|\n| `crypto-primitive-selection` | CBC-without-MAC, ad-hoc KDF, key reuse, PBKDF2 on high-entropy input, openssl enc without explicit flags |\n| `chain-of-trust-design` | Circular trust roots, signing-key custody confusion, missing measured-boot anchors |\n| `auth-factor-design` | Python deps in PRF hot paths, missing coercion-resistance, FIDO2 PIN\u002FUV policy gaps |\n| `degraded-mode-design` | \"Type Y to override\" prompts, missing degraded-mode matrix, fail-open by accident |\n| `supply-chain-trust` | Dependency pinning by version (not hash), reproducible-build gaps, firmware version-not-locked |\n| `npm-supply-chain-audit` | install lifecycle scripts, Git dependency prepare hooks, publish-token exposure, missing verifier docs |\n| `ci-workflow-audit` | tag-pinned actions\u002Fcontainers, bare `:latest`, PR-triggered jobs with `secrets.*`, curl-pipe-shell without hash checks |\n| `npm-release-age-gate` | missing `min-release-age`, npm 10 silently ignoring the gate, permanent bypasses |\n| `pnpm-release-age-gate` | missing `minimumReleaseAge`, missing `blockExoticSubdeps`, Corepack pin \u003C v9.0 silently ignoring the gate |\n| `yarn-release-age-gate` | missing `npmMinimalAgeGate`, Corepack pin \u003C v4.0 silently ignoring the gate, Yarn Classic v1.x lacking gate support |\n| `bun-release-age-gate` | missing `install.minimumReleaseAge`, Bun \u003C v1.1.30 silently ignoring the gate, unit confusion (Bun uses seconds vs pnpm minutes vs npm days vs Yarn duration strings) |\n| `secret-handling-runtime` | SECRETS_ENV aggregation, missing scratch-surface verification, identifier reuse |\n| `physical-threat-modeling` | evil-maid, DMA, hostile peripheral, travel-host, coercion, cold-boot, supply-chain implant, side-channel |\n| `dfir-readiness` | collecting evidence from the security framework, destructive containment by default, missing custody handoff |\n\n## When to use this framework vs the SDLC security flow\n\n| Use this framework | Use `flow-security-review-cycle` (SDLC) |\n|---|---|\n| Deciding the *primitive* (which AEAD?) | Reviewing whether the *implementation* uses any AEAD correctly |\n| Designing the boot chain | Threat-modeling the application boundary |\n| Picking an MFA scheme | Auditing existing auth code |\n| Defining degraded-mode behavior | Vulnerability scan + STRIDE on a feature |\n| Preparing evidence handling and DFIR handoff | Running production incident comms or collecting forensic evidence |\n\nThe SDLC's `flow-security-review-cycle` is the broader periodic audit. The skills here are pinpoint decision aids — invoke them when the decision is being made, not after.\n\nFor active evidence-bearing investigations, use `forensics-complete`. For production incident coordination, severity, communications, and post-incident review, use SDLC incident-response flows. The handoff guide is `docs\u002Fintegrations\u002Fdfir-handoff.md`.\n\n## Rules deployed\n\nThis framework ships 4 applied-cryptography rules into the rules index:\n\n- `no-unauthenticated-encryption`\n- `no-key-reuse-across-purposes`\n- `no-adhoc-kdf`\n- `crypto-flag-verification`\n- `published-port-binding` — explicit Docker publish binds and exposure review\n\nThese deploy via the standard rules-index pipeline.\n\n## When the curated phrases don't fit\n\n```bash\naiwg discover \"\u003Cyour need, paraphrased>\" --limit 5\n```\n\nFor asks outside the seven listed skills (e.g., \"audit a TLS config\", \"review a JWT implementation\"), the SDLC framework's `flow-security-review-cycle` is the right surface.\n\n## Anti-pattern: don't enumerate\n\nIf a user asks \"what security skills are available?\", **do not list from this skill**. Run:\n\n```bash\naiwg discover --type skill --limit 20 \"\u003Ctheir interest area>\"\n```\n","# Security Engineering Framework — Quick Reference\n\nThis is your always-loaded directory for the AIWG **security-engineering** framework. It does **not** list every skill. Instead, it teaches the framework's decision domains and gives you **curated search phrases** that map to `aiwg discover` lookups.\n\n## Canonical access pattern: discover → show\n\nWhen you find a candidate via `aiwg discover`, fetch its body with `aiwg show \u003Ctype> \u003Cname> --body`. **Never** use `find`, `ls`, `Glob`, or direct `Read` on `\u003Cprovider>\u002Fskills\u002F` paths — those reflect the kernel-pivot deploy state, not the full surface.\n\n```bash\naiwg discover \"\u003Cphrase>\"             # find — returns ranked candidates\naiwg show skill \u003Cname> --body               # fetch — streams the SKILL.md body\n```\n\nIf your platform's Skill tool errors on a non-kernel skill (expected — most aren't kernel), the fallback is `aiwg show`, never filesystem browsing. Last-resort if `aiwg` itself is broken: read directly from `$AIWG_ROOT\u002Fagentic\u002Fcode\u002F...` (the canonical corpus, always present).\n\n## How to use this quickref\n\n`aiwg show \u003Ctype> \u003Cname>` returns a metadata card. Inspect its outline, then fetch a needed `--section \"Heading\"` or use `--body` for the full instructions. Fetch required rules with `--rules --with-rule-bodies` before governed work.\n\n1. Identify the **decision domain** the user is working through (this framework is decision-aid, not audit)\n2. Pick a **curated phrase** from that domain\n3. Run `aiwg discover \"\u003Cphrase>\"` and surface the top match to the user\n\n**Do not enumerate skills from memory.** Discovery is the lookup surface.\n\n## What this framework is for\n\n**Decision-aid skills for applied security**, distinct from the SDLC framework's broader security review (`flow-security-review-cycle`). Each skill in this framework forces explicit reasoning about a narrow class of security decisions and identifies anti-patterns the operator should reject before implementation.\n\nThis is **not** a vulnerability scanner or pen-test framework. It is a thinking-discipline framework for cryptographic and trust-boundary decisions that get baked into a system early and become hard to change.\n\n## Decision domains\n\n| Domain | The decision being made |\n|---|---|\n| **Cryptographic primitives** | Choosing AEAD \u002F KDF \u002F MAC \u002F signature algorithms |\n| **Chain of trust** | Designing the boot\u002Fbootstrap verification chain |\n| **Authentication factors** | Architecting have\u002Fknow\u002Fare factor stack |\n| **Degraded modes** | Fail-closed vs fail-open behavior matrices |\n| **Supply chain trust** | Beyond CVE\u002FSBOM — pinning depth, reproducible builds, vendor+hash locks |\n| **Runtime secret hygiene** | fd passing, scratch surface verification, error-path safety |\n| **Physical threats** | Threats STRIDE and OWASP Top 10 don't cover |\n| **DFIR readiness** | Preparing evidence handling, custody expectations, and handoff to forensics-complete |\n\n| **Host hardening** | Read-only host baseline, lockout-safe remediation plans and static published-port binds |\n\n## Curated discovery phrases\n\n### Cryptographic primitives\n\n```bash\naiwg discover \"crypto primitive selection\"     # → crypto-primitive-selection\naiwg discover \"choose AEAD\"                    # → crypto-primitive-selection\naiwg discover \"ad-hoc KDF\"                     # → crypto-primitive-selection\n```\n\n### Chain of trust\n\n```bash\naiwg discover \"chain of trust\"                 # → chain-of-trust-design\naiwg discover \"secure bootstrap\"               # → chain-of-trust-design\naiwg discover \"signed boot\"                    # → chain-of-trust-design\n```\n\n### Authentication factors\n\n```bash\naiwg discover \"auth factor design\"             # → auth-factor-design (score 0.59)\naiwg discover \"FIDO2 PIN UV policy\"            # → auth-factor-design\naiwg discover \"coercion-resistance\"            # → auth-factor-design\n```\n\n### Degraded modes\n\n```bash\naiwg discover \"degraded mode design\"           # → degraded-mode-design\naiwg discover \"fail closed fail open\"          # → degraded-mode-design\n```\n\n### Supply chain trust\n\n```bash\naiwg discover \"supply chain trust\"             # → supply-chain-trust (score 0.67)\naiwg discover \"reproducible build\"             # → supply-chain-trust\naiwg discover \"dependency pinning\"             # → supply-chain-trust\naiwg discover \"npm supply-chain audit\"         # → npm-supply-chain-audit\naiwg discover \"cargo crate supply chain audit\" # → cargo-supply-chain-audit (Rust\u002Fcrates.io)\naiwg discover \"rust dependency audit\"          # → cargo-supply-chain-audit\naiwg discover \"ci workflow audit\"              # → ci-workflow-audit\naiwg discover \"workflow pinning audit\"         # → ci-workflow-audit\naiwg discover \"npm release-age gate\"           # → npm-release-age-gate\naiwg discover \"pnpm release age gate\"          # → pnpm-release-age-gate\naiwg discover \"yarn release age gate\"          # → yarn-release-age-gate\naiwg discover \"bun release age gate\"           # → bun-release-age-gate\naiwg discover \"supply-chain hardening quickstart\" # → supply-chain-hardening-quickstart\n```\n\n### Runtime secret hygiene\n\n```bash\naiwg discover \"secret handling runtime\"        # → secret-handling-runtime\naiwg discover \"fd passing secrets\"             # → secret-handling-runtime\naiwg discover \"scratch surface verification\"   # → secret-handling-runtime\n```\n\n### Physical threats\n\n```bash\naiwg discover \"physical threat modeling\"       # → physical-threat-modeling\naiwg discover \"evil-maid attack\"               # → physical-threat-modeling\naiwg discover \"DMA attack\"                     # → physical-threat-modeling\n```\n\n### DFIR readiness\n\n```bash\naiwg discover \"DFIR readiness\"                 # → dfir-readiness\naiwg discover \"incident response evidence\"     # → dfir-readiness or forensics-quickref\naiwg discover \"chain of custody readiness\"     # → dfir-readiness\n```\n\n### Host hardening and firewall exposure\n\n```bash\naiwg discover \"system hardening\"              # → host-hardening\naiwg discover \"firewall analysis\"             # → forensics exposure-analysis\naiwg discover \"docker published ports\"        # → exposure-analysis \u002F published-port-binding\n```\n\n`host-hardening` reviews SSH key\u002Fconsole access, persistent default-deny,\nDocker\u002FVPN ordering, datastore ACLs, exporter targets and audit retention.\nIt produces dated backup requirements, diff-style plans and named health\nrechecks; it never applies host changes, even with an apply request. The static\nchecker flags missing Compose\u002Fdocker run bind addresses. `published-port-binding`\ngoverns repository changes. For post-deploy\u002Fmonthly checks, consume fresh\nsanitized captures and alert on FAIL or UNKNOWN summaries through existing\noperator scheduling. `exposure-analysis` owns actual firewall reconstruction.\n\n## Anti-patterns each skill rejects\n\n| Skill | Anti-patterns it identifies |\n|---|---|\n| `crypto-primitive-selection` | CBC-without-MAC, ad-hoc KDF, key reuse, PBKDF2 on high-entropy input, openssl enc without explicit flags |\n| `chain-of-trust-design` | Circular trust roots, signing-key custody confusion, missing measured-boot anchors |\n| `auth-factor-design` | Python deps in PRF hot paths, missing coercion-resistance, FIDO2 PIN\u002FUV policy gaps |\n| `degraded-mode-design` | \"Type Y to override\" prompts, missing degraded-mode matrix, fail-open by accident |\n| `supply-chain-trust` | Dependency pinning by version (not hash), reproducible-build gaps, firmware version-not-locked |\n| `npm-supply-chain-audit` | install lifecycle scripts, Git dependency prepare hooks, publish-token exposure, missing verifier docs |\n| `ci-workflow-audit` | tag-pinned actions\u002Fcontainers, bare `:latest`, PR-triggered jobs with `secrets.*`, curl-pipe-shell without hash checks |\n| `npm-release-age-gate` | missing `min-release-age`, npm 10 silently ignoring the gate, permanent bypasses |\n| `pnpm-release-age-gate` | missing `minimumReleaseAge`, missing `blockExoticSubdeps`, Corepack pin \u003C v9.0 silently ignoring the gate |\n| `yarn-release-age-gate` | missing `npmMinimalAgeGate`, Corepack pin \u003C v4.0 silently ignoring the gate, Yarn Classic v1.x lacking gate support |\n| `bun-release-age-gate` | missing `install.minimumReleaseAge`, Bun \u003C v1.1.30 silently ignoring the gate, unit confusion (Bun uses seconds vs pnpm minutes vs npm days vs Yarn duration strings) |\n| `secret-handling-runtime` | SECRETS_ENV aggregation, missing scratch-surface verification, identifier reuse |\n| `physical-threat-modeling` | evil-maid, DMA, hostile peripheral, travel-host, coercion, cold-boot, supply-chain implant, side-channel |\n| `dfir-readiness` | collecting evidence from the security framework, destructive containment by default, missing custody handoff |\n\n## When to use this framework vs the SDLC security flow\n\n| Use this framework | Use `flow-security-review-cycle` (SDLC) |\n|---|---|\n| Deciding the *primitive* (which AEAD?) | Reviewing whether the *implementation* uses any AEAD correctly |\n| Designing the boot chain | Threat-modeling the application boundary |\n| Picking an MFA scheme | Auditing existing auth code |\n| Defining degraded-mode behavior | Vulnerability scan + STRIDE on a feature |\n| Preparing evidence handling and DFIR handoff | Running production incident comms or collecting forensic evidence |\n\nThe SDLC's `flow-security-review-cycle` is the broader periodic audit. The skills here are pinpoint decision aids — invoke them when the decision is being made, not after.\n\nFor active evidence-bearing investigations, use `forensics-complete`. For production incident coordination, severity, communications, and post-incident review, use SDLC incident-response flows. The handoff guide is `docs\u002Fintegrations\u002Fdfir-handoff.md`.\n\n## Rules deployed\n\nThis framework ships 4 applied-cryptography rules into the rules index:\n\n- `no-unauthenticated-encryption`\n- `no-key-reuse-across-purposes`\n- `no-adhoc-kdf`\n- `crypto-flag-verification`\n- `published-port-binding` — explicit Docker publish binds and exposure review\n\nThese deploy via the standard rules-index pipeline.\n\n## When the curated phrases don't fit\n\n```bash\naiwg discover \"\u003Cyour need, paraphrased>\" --limit 5\n```\n\nFor asks outside the seven listed skills (e.g., \"audit a TLS config\", \"review a JWT implementation\"), the SDLC framework's `flow-security-review-cycle` is the right surface.\n\n## Anti-pattern: don't enumerate\n\nIf a user asks \"what security skills are available?\", **do not list from this skill**. Run:\n\n```bash\naiwg discover --type skill --limit 20 \"\u003Ctheir interest area>\"\n```\n",{"name":5,"kernel":59,"namespace":60,"platforms":61,"description":7},true,"aiwg",[62],"all","main","ac56f6a215342ed836e51f1945653968b95edd64","agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-engineering-quickref",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-11 08:11:25",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":59},[75,78,81],{"tool":76,"command":77},"npx","npx skills add jmagly\u002Faiwg --skill security-engineering-quickref",{"tool":79,"command":80},"bunx","bunx skills add jmagly\u002Faiwg --skill security-engineering-quickref",{"tool":82,"command":83},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill security-engineering-quickref","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsecurity-engineering-quickref\u002FSKILL.md",[],[87,115,139,145,152,166],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":94,"publishedAt":54},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[93],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114],"host","host hardening","hardening","read","re","recommendations","remediation","plan","port","verification","Bash","access","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":125,"publishedAt":54},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[121,124],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[126,127,128,98,129,103,130,131,105,132,95,133,107,134,135,110,111,136,137,138],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator","write",{"skillNo":140,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":54},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[143],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[97,95,96,106,98,114,101,100,109,102,103,104,105,113,107,108,99,110,111,112],{"skillNo":146,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":151,"publishedAt":54},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[149,150],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,126,110,129,103,130,105,128,95,133,107,134,135,98,111,132,131,136,137,138],{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":54},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[158],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[160,161,162,163,164,165],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":173,"publishedAt":54},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[172],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[174,175,134,176,161],"pi","pi local","duplicate"]