[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CAP9TGHQJT23PQHM1FXFAR":3,"skill-same:01M6CAP9TGHQJT23PQHM1FXFAR":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6CAP9TGHQJT23PQHM1FXFAR","yarn-release-age-gate",null,"Configure Yarn's npmMinimalAgeGate (7-day default, 10-day high-sensitivity) for JavaScript projects on Yarn 4.x or later. Includes Corepack detection and lockfile-caveat warning.","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fyarn-release-age-gate\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"release","yarn","yarn release age gate","gate","age","javascript","lockfile","detection","configure","projects","default","later","sensitivity","warning","high","for","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: yarn-release-age-gate\nplatforms: [all]\ndescription: Configure Yarn's npmMinimalAgeGate (7-day default, 10-day high-sensitivity) for JavaScript projects on Yarn 4.x or later. Includes Corepack detection and lockfile-caveat warning.\n---\n\n# yarn-release-age-gate\n\nUse this skill when a user has chosen Yarn (Berry \u002F v2+, current line\nv4.x) as their package manager and wants release-age-gate hardening\nparallel to what `npm-release-age-gate` and `pnpm-release-age-gate`\nprovide for their respective ecosystems.\n\n## Triggers\n\n- \"yarn release age gate\"\n- \"yarn npmMinimalAgeGate\"\n- \"yarn 4 supply chain\"\n- \"yarn berry hardening\"\n\n## Prerequisites\n\n- Yarn 4.0+ (Berry) installed (`yarn --version`)\n- `package.json` exists at repo root\n- `.yarnrc.yml` exists (or will be created) — Berry's config file\n\nIf Yarn is below v4.0, the skill should refuse to proceed:\n`npmMinimalAgeGate` was introduced in v4.0 and earlier Berry versions\n(v2.x, v3.x) silently ignore the setting. Yarn Classic (v1.x) does\nnot support a release-age gate at all — recommend migration to Berry\nor to pnpm\u002Fnpm.\n\n## Configuration\n\nAdd the gate to `.yarnrc.yml` at repo root:\n\n```yaml\n# Yarn 4.x release-age gate.\n# Uses duration shorthand: 7d, 10d, 14d, 30d.\n# Defends against newly-published malicious versions.\nnpmMinimalAgeGate: 7d\n\n# High-sensitivity profile (use for publish-prep or major version bumps):\n# npmMinimalAgeGate: 10d\n```\n\nYarn accepts the value as a **duration string** (`Nd` for days, `Nh`\nfor hours), which is cleaner than npm's days-as-bare-int and pnpm's\nminutes-as-int. Document the chosen value inline.\n\n## Per-environment override (optional)\n\nFor CI-only enforcement (e.g., tighter gate in publish workflows than\nin local dev):\n\n```yaml\n# .yarnrc.yml — apply 10d gate when running on CI, 7d locally\nnpmMinimalAgeGate:\n  exclude:\n    - pattern: \"@your-scope\u002F*\"  # internal packages — gate doesn't apply\n  default: 7d\n  override:\n    - if: \"$YARN_ENABLE_STRICT_AGE_GATE\"\n      value: 10d\n```\n\nEnvironment-conditional values are a Yarn 4 advantage over npm and\npnpm (which require workflow-level wrapping).\n\n## Lockfile caveat\n\nThe gate is checked at resolution time. If `yarn.lock` was generated\nwithout the gate, the gate applies on the NEXT resolution pass — not\nretroactively.\n\nTo apply the gate retroactively:\n\n```bash\n# Force re-resolution\nrm yarn.lock\nyarn install\n```\n\nThis is destructive to existing pins. Coordinate before running.\n\n## Corepack detection\n\nCheck whether the project pins a Yarn version via Corepack:\n\n```bash\nnode -p \"require('.\u002Fpackage.json').packageManager\"\n```\n\nOutput like `yarn@4.5.0` means Corepack will use that exact version\nin CI. The skill should:\n\n1. Confirm pinned version is ≥ v4.0 (else flag — gate is silently ignored on Berry v2\u002Fv3)\n2. Document the pinned version\n3. Suggest a Corepack pin if the project doesn't have one:\n   ```bash\n   corepack use yarn@stable\n   # writes packageManager to package.json\n   ```\n\n## Override policy\n\nGenuine emergency overrides:\n\n```bash\n# Bypass the gate for a single install (rare)\nYARN_NPM_MINIMAL_AGE_GATE=0 yarn add \u003Cpkg>\n```\n\nDocument every override with reason + sunset date. Add the package\nto the `.yarnrc.yml` `exclude` list if the bypass needs to persist\nacross installs.\n\n## CI integration\n\nAdd a verification step to the publish\u002Fbuild workflow:\n\n```yaml\n- name: Verify Yarn gate active\n  run: |\n    set -euo pipefail\n    GATE=$(yarn config get npmMinimalAgeGate 2>\u002Fdev\u002Fnull || echo \"\")\n    if [ -z \"$GATE\" ]; then\n      echo \"✗ Yarn npmMinimalAgeGate is unset\"\n      exit 1\n    fi\n    echo \"✓ Yarn npmMinimalAgeGate = $GATE\"\n```\n\n## What to inspect during review\n\n- `.yarnrc.yml` for `npmMinimalAgeGate`\n- `package.json` `packageManager` field for Corepack pin\n- CI workflow has the verification step above\n- `yarn.lock` was generated AFTER the gate was committed\n\n## Output format\n\nWhen auditing an existing Yarn project, produce a structured report\nat `.aiwg\u002Fsecurity\u002Fworking\u002Fyarn-release-age-audit.md`:\n\n```markdown\n# Yarn Release-Age Gate Audit\n\n**Yarn version**: \u003Cversion>  (Corepack pinned: yes\u002Fno)\n**Gate active**: yes (7d) \u002F yes (10d) \u002F yes (custom: \u003Cvalue>) \u002F no\n**Exclude list**: \u003Clist of excluded packages>\n\n## Findings\n\n### \u003Cseverity> — \u003Cdescription>\n\n- File: \u003Cpath>\n- Issue: \u003Cwhat's wrong>\n- Fix: \u003Cexact change>\n\n## Clean Checks\n\n- ...\n\n## Recommendations\n\n- ...\n```\n\n## See Also\n\n- [`npm-release-age-gate` skill](..\u002Fnpm-release-age-gate\u002FSKILL.md) — npm equivalent\n- [`pnpm-release-age-gate` skill](..\u002Fpnpm-release-age-gate\u002FSKILL.md) — pnpm equivalent\n- [`bun-release-age-gate` skill](..\u002Fbun-release-age-gate\u002FSKILL.md) — Bun equivalent\n- [`npm-supply-chain-audit` skill](..\u002Fnpm-supply-chain-audit\u002FSKILL.md) — companion audit\n- [`supply-chain-hardening-quickstart` skill](..\u002Fsupply-chain-hardening-quickstart\u002FSKILL.md) — orchestrator\n\n## References\n\n- Yarn `npmMinimalAgeGate`: \u003Chttps:\u002F\u002Fyarnpkg.com\u002Fconfiguration\u002Fyarnrc#npmMinimalAgeGate>\n- Yarn Berry (v4) docs: \u003Chttps:\u002F\u002Fyarnpkg.com\u002Fgetting-started>\n- Corepack: \u003Chttps:\u002F\u002Fgithub.com\u002Fnodejs\u002Fcorepack>\n","# yarn-release-age-gate\n\nUse this skill when a user has chosen Yarn (Berry \u002F v2+, current line\nv4.x) as their package manager and wants release-age-gate hardening\nparallel to what `npm-release-age-gate` and `pnpm-release-age-gate`\nprovide for their respective ecosystems.\n\n## Triggers\n\n- \"yarn release age gate\"\n- \"yarn npmMinimalAgeGate\"\n- \"yarn 4 supply chain\"\n- \"yarn berry hardening\"\n\n## Prerequisites\n\n- Yarn 4.0+ (Berry) installed (`yarn --version`)\n- `package.json` exists at repo root\n- `.yarnrc.yml` exists (or will be created) — Berry's config file\n\nIf Yarn is below v4.0, the skill should refuse to proceed:\n`npmMinimalAgeGate` was introduced in v4.0 and earlier Berry versions\n(v2.x, v3.x) silently ignore the setting. Yarn Classic (v1.x) does\nnot support a release-age gate at all — recommend migration to Berry\nor to pnpm\u002Fnpm.\n\n## Configuration\n\nAdd the gate to `.yarnrc.yml` at repo root:\n\n```yaml\n# Yarn 4.x release-age gate.\n# Uses duration shorthand: 7d, 10d, 14d, 30d.\n# Defends against newly-published malicious versions.\nnpmMinimalAgeGate: 7d\n\n# High-sensitivity profile (use for publish-prep or major version bumps):\n# npmMinimalAgeGate: 10d\n```\n\nYarn accepts the value as a **duration string** (`Nd` for days, `Nh`\nfor hours), which is cleaner than npm's days-as-bare-int and pnpm's\nminutes-as-int. Document the chosen value inline.\n\n## Per-environment override (optional)\n\nFor CI-only enforcement (e.g., tighter gate in publish workflows than\nin local dev):\n\n```yaml\n# .yarnrc.yml — apply 10d gate when running on CI, 7d locally\nnpmMinimalAgeGate:\n  exclude:\n    - pattern: \"@your-scope\u002F*\"  # internal packages — gate doesn't apply\n  default: 7d\n  override:\n    - if: \"$YARN_ENABLE_STRICT_AGE_GATE\"\n      value: 10d\n```\n\nEnvironment-conditional values are a Yarn 4 advantage over npm and\npnpm (which require workflow-level wrapping).\n\n## Lockfile caveat\n\nThe gate is checked at resolution time. If `yarn.lock` was generated\nwithout the gate, the gate applies on the NEXT resolution pass — not\nretroactively.\n\nTo apply the gate retroactively:\n\n```bash\n# Force re-resolution\nrm yarn.lock\nyarn install\n```\n\nThis is destructive to existing pins. Coordinate before running.\n\n## Corepack detection\n\nCheck whether the project pins a Yarn version via Corepack:\n\n```bash\nnode -p \"require('.\u002Fpackage.json').packageManager\"\n```\n\nOutput like `yarn@4.5.0` means Corepack will use that exact version\nin CI. The skill should:\n\n1. Confirm pinned version is ≥ v4.0 (else flag — gate is silently ignored on Berry v2\u002Fv3)\n2. Document the pinned version\n3. Suggest a Corepack pin if the project doesn't have one:\n   ```bash\n   corepack use yarn@stable\n   # writes packageManager to package.json\n   ```\n\n## Override policy\n\nGenuine emergency overrides:\n\n```bash\n# Bypass the gate for a single install (rare)\nYARN_NPM_MINIMAL_AGE_GATE=0 yarn add \u003Cpkg>\n```\n\nDocument every override with reason + sunset date. Add the package\nto the `.yarnrc.yml` `exclude` list if the bypass needs to persist\nacross installs.\n\n## CI integration\n\nAdd a verification step to the publish\u002Fbuild workflow:\n\n```yaml\n- name: Verify Yarn gate active\n  run: |\n    set -euo pipefail\n    GATE=$(yarn config get npmMinimalAgeGate 2>\u002Fdev\u002Fnull || echo \"\")\n    if [ -z \"$GATE\" ]; then\n      echo \"✗ Yarn npmMinimalAgeGate is unset\"\n      exit 1\n    fi\n    echo \"✓ Yarn npmMinimalAgeGate = $GATE\"\n```\n\n## What to inspect during review\n\n- `.yarnrc.yml` for `npmMinimalAgeGate`\n- `package.json` `packageManager` field for Corepack pin\n- CI workflow has the verification step above\n- `yarn.lock` was generated AFTER the gate was committed\n\n## Output format\n\nWhen auditing an existing Yarn project, produce a structured report\nat `.aiwg\u002Fsecurity\u002Fworking\u002Fyarn-release-age-audit.md`:\n\n```markdown\n# Yarn Release-Age Gate Audit\n\n**Yarn version**: \u003Cversion>  (Corepack pinned: yes\u002Fno)\n**Gate active**: yes (7d) \u002F yes (10d) \u002F yes (custom: \u003Cvalue>) \u002F no\n**Exclude list**: \u003Clist of excluded packages>\n\n## Findings\n\n### \u003Cseverity> — \u003Cdescription>\n\n- File: \u003Cpath>\n- Issue: \u003Cwhat's wrong>\n- Fix: \u003Cexact change>\n\n## Clean Checks\n\n- ...\n\n## Recommendations\n\n- ...\n```\n\n## See Also\n\n- [`npm-release-age-gate` skill](..\u002Fnpm-release-age-gate\u002FSKILL.md) — npm equivalent\n- [`pnpm-release-age-gate` skill](..\u002Fpnpm-release-age-gate\u002FSKILL.md) — pnpm equivalent\n- [`bun-release-age-gate` skill](..\u002Fbun-release-age-gate\u002FSKILL.md) — Bun equivalent\n- [`npm-supply-chain-audit` skill](..\u002Fnpm-supply-chain-audit\u002FSKILL.md) — companion audit\n- [`supply-chain-hardening-quickstart` skill](..\u002Fsupply-chain-hardening-quickstart\u002FSKILL.md) — orchestrator\n\n## References\n\n- Yarn `npmMinimalAgeGate`: \u003Chttps:\u002F\u002Fyarnpkg.com\u002Fconfiguration\u002Fyarnrc#npmMinimalAgeGate>\n- Yarn Berry (v4) docs: \u003Chttps:\u002F\u002Fyarnpkg.com\u002Fgetting-started>\n- Corepack: \u003Chttps:\u002F\u002Fgithub.com\u002Fnodejs\u002Fcorepack>\n",{"name":5,"namespace":45,"platforms":46,"description":7},"aiwg",[47],"all","main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fyarn-release-age-gate",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-12 00:33:10",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add jmagly\u002Faiwg --skill yarn-release-age-gate",{"tool":64,"command":65},"bunx","bunx skills add jmagly\u002Faiwg --skill yarn-release-age-gate",{"tool":67,"command":68},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill yarn-release-age-gate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fyarn-release-age-gate\u002FSKILL.md",true,[],[73,101,125,131,138,152],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":80,"publishedAt":40},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[79],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100],"host","host hardening","hardening","read","re","recommendations","remediation","plan","port","verification","Bash","access","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":111,"publishedAt":40},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[107,110],{"categoryNo":108,"categoryName":109,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,114,84,115,89,116,117,91,118,81,119,93,120,121,96,97,122,123,124],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator","write",{"skillNo":126,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":130,"publishedAt":40},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[129],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[83,81,82,92,84,100,87,86,95,88,89,90,91,99,93,94,85,96,97,98],{"skillNo":132,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":137,"publishedAt":40},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[135,136],{"categoryNo":108,"categoryName":109,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[113,112,96,115,89,116,91,114,81,119,93,120,121,84,97,118,117,122,123,124],{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":40},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,147,148,149,150,151],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":40},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[158],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[160,161,120,162,147],"pi","pi local","duplicate"]