[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CSWF4PSCF3FXR95VSNP73E":3,"skill-same:01M6CSWF4PSCF3FXR95VSNP73E":53},{"skillNo":4,"name":5,"nameZh":6,"description":5,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":31,"commitSha":32,"skillDirectory":33,"forksCount":34,"repositoryHtmlUrl":35,"repositoryHomepageUrl":35,"ownerHtmlUrl":36,"ownerBlogUrl":6,"ownerDescription":37,"updatedAt":38,"install":39,"resources":52},"01M6CSWF4PSCF3FXR95VSNP73E","django-access-review",null,"Sam-06060\u002Fjarvis-assistant","Sam-06060","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F208600848?v=4","01M6CRKT7C7FXD21V6HXF293S0","Samson Frank Ganta","01M6CRKTBEKYFD8YX5Z1GT99EE",6,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fdjango-access-review\u002FSKILL.md",[],[18,19,20,21,22,23,24],"review","access","django","access review","django access review","access-review","community","2026-11-10 10:12:30",false,"---\nname: django-access-review\ndescription: django-access-review\nrisk: unknown\nsource: community\n---\n\n---\nname: django-access-review\ndescription: Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python\u002FDjango code handling user authorization. Trigger keywords: \"IDOR\", \"access control\", \"authorization\", \"Django permissions\", \"object permissions\", \"tenant...\n--- LICENSE\n---\n\n\u003C!--\nReference material based on OWASP Cheat Sheet Series (CC BY-SA 4.0)\nhttps:\u002F\u002Fcheatsheetseries.owasp.org\u002F\n-->\n\n# Django Access Control & IDOR Review\n\nFind access control vulnerabilities by investigating how the codebase answers one question:\n\n**Can User A access, modify, or delete User B's data?**\n\n## When to Use\n\n- You need to review Django or DRF code for access control gaps, IDOR risk, or object-level authorization failures.\n- The task involves confirming whether one user can access, modify, or delete another user's data.\n- You want an investigation-driven authorization review instead of generic pattern matching.\n\n## Philosophy: Investigation Over Pattern Matching\n\nDo NOT scan for predefined vulnerable patterns. Instead:\n\n1. **Understand** how authorization works in THIS codebase\n2. **Ask questions** about specific data flows\n3. **Trace code** to find where (or if) access checks happen\n4. **Report** only what you've confirmed through investigation\n\nEvery codebase implements authorization differently. Your job is to understand this specific implementation, then find gaps.\n\n---\n\n## Phase 1: Understand the Authorization Model\n\nBefore looking for bugs, answer these questions about the codebase:\n\n### How is authorization enforced?\n\nResearch the codebase to find:\n\n```\n□ Where are permission checks implemented?\n  - Decorators? (@login_required, @permission_required, custom?)\n  - Middleware? (TenantMiddleware, AuthorizationMiddleware?)\n  - Base classes? (BaseAPIView, TenantScopedViewSet?)\n  - Permission classes? (DRF permission_classes?)\n  - Custom mixins? (OwnershipMixin, TenantMixin?)\n\n□ How are queries scoped?\n  - Custom managers? (TenantManager, UserScopedManager?)\n  - get_queryset() overrides?\n  - Middleware that sets query context?\n\n□ What's the ownership model?\n  - Single user ownership? (document.owner_id)\n  - Organization\u002Ftenant ownership? (document.organization_id)\n  - Hierarchical? (org -> team -> user -> resource)\n  - Role-based within context? (org admin vs member)\n```\n\n### Investigation commands\n\n```bash\n# Find how auth is typically done\ngrep -rn \"permission_classes\\|@login_required\\|@permission_required\" --include=\"*.py\" | head -20\n\n# Find base classes that views inherit from\ngrep -rn \"class Base.*View\\|class.*Mixin.*:\" --include=\"*.py\" | head -20\n\n# Find custom managers\ngrep -rn \"class.*Manager\\|def get_queryset\" --include=\"*.py\" | head -20\n\n# Find ownership fields on models\ngrep -rn \"owner\\|user_id\\|organization\\|tenant\" --include=\"models.py\" | head -30\n```\n\n**Do not proceed until you understand the authorization model.**\n\n---\n\n## Phase 2: Map the Attack Surface\n\nIdentify endpoints that handle user-specific data:\n\n### What resources exist?\n\n```\n□ What models contain user data?\n□ Which have ownership fields (owner_id, user_id, organization_id)?\n□ Which are accessed via ID in URLs or request bodies?\n```\n\n### What operations are exposed?\n\nFor each resource, map:\n- List endpoints - what data is returned?\n- Detail\u002Fretrieve endpoints - how is the object fetched?\n- Create endpoints - who sets the owner?\n- Update endpoints - can users modify others' data?\n- Delete endpoints - can users delete others' data?\n- Custom actions - what do they access?\n\n---\n\n## Phase 3: Ask Questions and Investigate\n\nFor each endpoint that handles user data, ask:\n\n### The Core Question\n\n**\"If I'm User A and I know the ID of User B's resource, can I access it?\"**\n\nTrace the code to answer this:\n\n```\n1. Where does the resource ID enter the system?\n   - URL path: \u002Fapi\u002Fdocuments\u002F{id}\u002F\n   - Query param: ?document_id=123\n   - Request body: {\"document_id\": 123}\n\n2. Where is that ID used to fetch data?\n   - Find the ORM query or database call\n\n3. Between (1) and (2), what checks exist?\n   - Is the query scoped to current user?\n   - Is there an explicit ownership check?\n   - Is there a permission check on the object?\n   - Does a base class or mixin enforce access?\n\n4. If you can't find a check, is there one you missed?\n   - Check parent classes\n   - Check middleware\n   - Check managers\n   - Check decorators at URL level\n```\n\n### Follow-Up Questions\n\n```\n□ For list endpoints: Does the query filter to user's data, or return everything?\n\n□ For create endpoints: Who sets the owner - the server or the request?\n\n□ For bulk operations: Are they scoped to user's data?\n\n□ For related resources: If I can access a document, can I access its comments?\n  What if the document belongs to someone else?\n\n□ For tenant\u002Forg resources: Can User in Org A access Org B's data by changing\n  the org_id in the URL?\n```\n\n---\n\n## Phase 4: Trace Specific Flows\n\nPick a concrete endpoint and trace it completely.\n\n### Example Investigation\n\n```\nEndpoint: GET \u002Fapi\u002Fdocuments\u002F{pk}\u002F\n\n1. Find the view handling this URL\n   → DocumentViewSet.retrieve() in api\u002Fviews.py\n\n2. Check what DocumentViewSet inherits from\n   → class DocumentViewSet(viewsets.ModelViewSet)\n   → No custom base class with authorization\n\n3. Check permission_classes\n   → permission_classes = [IsAuthenticated]\n   → Only checks login, not ownership\n\n4. Check get_queryset()\n   → def get_queryset(self):\n   →     return Document.objects.all()\n   → Returns ALL documents!\n\n5. Check for has_object_permission()\n   → Not implemented\n\n6. Check retrieve() method\n   → Uses default, which calls get_object()\n   → get_object() uses get_queryset(), which returns all\n\n7. Conclusion: IDOR - Any authenticated user can access any document\n```\n\n### What to look for when tracing\n\n```\nPotential gap indicators (investigate further, don't auto-flag):\n- get_queryset() returns .all() or filters without user\n- Direct Model.objects.get(pk=pk) without ownership in query\n- ID comes from request body for sensitive operations\n- Permission class checks auth but not ownership\n- No has_object_permission() and queryset isn't scoped\n\nLikely safe patterns (but verify the implementation):\n- get_queryset() filters by request.user or user's org\n- Custom permission class with has_object_permission()\n- Base class that enforces scoping\n- Manager that auto-filters\n```\n\n---\n\n## Phase 5: Report Findings\n\nOnly report issues you've confirmed through investigation.\n\n### Confidence Levels\n\n| Level | Meaning | Action |\n|-------|---------|--------|\n| **HIGH** | Traced the flow, confirmed no check exists | Report with evidence |\n| **MEDIUM** | Check may exist but couldn't confirm | Note for manual verification |\n| **LOW** | Theoretical, likely mitigated | Do not report |\n\n### Suggested Fixes Must Enforce, Not Document\n\n**Bad fix**: Adding a comment saying \"caller must validate permissions\"\n**Good fix**: Adding code that actually validates permissions\n\nA comment or docstring does not enforce authorization. Your suggested fix must include actual code that:\n- Validates the user has permission before proceeding\n- Raises an exception or returns an error if unauthorized\n- Makes unauthorized access impossible, not just discouraged\n\nExample of a BAD fix suggestion:\n```python\ndef get_resource(resource_id):\n    # IMPORTANT: Caller must ensure user has access to this resource\n    return Resource.objects.get(pk=resource_id)\n```\n\nExample of a GOOD fix suggestion:\n```python\ndef get_resource(resource_id, user):\n    resource = Resource.objects.get(pk=resource_id)\n    if resource.owner_id != user.id:\n        raise PermissionDenied(\"Access denied\")\n    return resource\n```\n\nIf you can't determine the right enforcement mechanism, say so - but never suggest documentation as the fix.\n\n### Report Format\n\n```markdown\n## Access Control Review: [Component]\n\n### Authorization Model\n[Brief description of how this codebase handles authorization]\n\n### Findings\n\n#### [IDOR-001] [Title] (Severity: High\u002FMedium)\n- **Location**: `path\u002Fto\u002Ffile.py:123`\n- **Confidence**: High - confirmed through code tracing\n- **The Question**: Can User A access User B's documents?\n- **Investigation**:\n  1. Traced GET \u002Fapi\u002Fdocuments\u002F{pk}\u002F to DocumentViewSet\n  2. Checked get_queryset() - returns Document.objects.all()\n  3. Checked permission_classes - only IsAuthenticated\n  4. Checked for has_object_permission() - not implemented\n  5. Verified no relevant middleware or base class checks\n- **Evidence**: [Code snippet showing the gap]\n- **Impact**: Any authenticated user can read any document by ID\n- **Suggested Fix**: [Code that enforces authorization - NOT a comment]\n\n### Needs Manual Verification\n[Issues where authorization exists but couldn't confirm effectiveness]\n\n### Areas Not Reviewed\n[Endpoints or flows not covered in this review]\n```\n\n---\n\n## Common Django Authorization Patterns\n\nThese are patterns you might find - not a checklist to match against.\n\n### Query Scoping\n```python\n# Scoped to user\nDocument.objects.filter(owner=request.user)\n\n# Scoped to organization\nDocument.objects.filter(organization=request.user.organization)\n\n# Using a custom manager\nDocument.objects.for_user(request.user)  # Investigate what this does\n```\n\n### Permission Enforcement\n```python\n# DRF permission classes\npermission_classes = [IsAuthenticated, IsOwner]\n\n# Custom has_object_permission\ndef has_object_permission(self, request, view, obj):\n    return obj.owner == request.user\n\n# Django decorators\n@permission_required('app.view_document')\n\n# Manual checks\nif document.owner != request.user:\n    raise PermissionDenied()\n```\n\n### Ownership Assignment\n```python\n# Server-side (safe)\ndef perform_create(self, serializer):\n    serializer.save(owner=self.request.user)\n\n# From request (investigate)\nserializer.save(**request.data)  # Does request.data include owner?\n```\n\n---\n\n## Investigation Checklist\n\nUse this to guide your review, not as a pass\u002Ffail checklist:\n\n```\n□ I understand how authorization is typically implemented in this codebase\n□ I've identified the ownership model (user, org, tenant, etc.)\n□ I've mapped the key endpoints that handle user data\n□ For each sensitive endpoint, I've traced the flow and asked:\n  - Where does the ID come from?\n  - Where is data fetched?\n  - What checks exist between input and data access?\n□ I've verified my findings by checking parent classes and middleware\n□ I've only reported issues I've confirmed through investigation\n```\n","---\nname: django-access-review\ndescription: Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python\u002FDjango code handling user authorization. Trigger keywords: \"IDOR\", \"access control\", \"authorization\", \"Django permissions\", \"object permissions\", \"tenant...\n--- LICENSE\n---\n\n\u003C!--\nReference material based on OWASP Cheat Sheet Series (CC BY-SA 4.0)\nhttps:\u002F\u002Fcheatsheetseries.owasp.org\u002F\n-->\n\n# Django Access Control & IDOR Review\n\nFind access control vulnerabilities by investigating how the codebase answers one question:\n\n**Can User A access, modify, or delete User B's data?**\n\n## When to Use\n\n- You need to review Django or DRF code for access control gaps, IDOR risk, or object-level authorization failures.\n- The task involves confirming whether one user can access, modify, or delete another user's data.\n- You want an investigation-driven authorization review instead of generic pattern matching.\n\n## Philosophy: Investigation Over Pattern Matching\n\nDo NOT scan for predefined vulnerable patterns. Instead:\n\n1. **Understand** how authorization works in THIS codebase\n2. **Ask questions** about specific data flows\n3. **Trace code** to find where (or if) access checks happen\n4. **Report** only what you've confirmed through investigation\n\nEvery codebase implements authorization differently. Your job is to understand this specific implementation, then find gaps.\n\n---\n\n## Phase 1: Understand the Authorization Model\n\nBefore looking for bugs, answer these questions about the codebase:\n\n### How is authorization enforced?\n\nResearch the codebase to find:\n\n```\n□ Where are permission checks implemented?\n  - Decorators? (@login_required, @permission_required, custom?)\n  - Middleware? (TenantMiddleware, AuthorizationMiddleware?)\n  - Base classes? (BaseAPIView, TenantScopedViewSet?)\n  - Permission classes? (DRF permission_classes?)\n  - Custom mixins? (OwnershipMixin, TenantMixin?)\n\n□ How are queries scoped?\n  - Custom managers? (TenantManager, UserScopedManager?)\n  - get_queryset() overrides?\n  - Middleware that sets query context?\n\n□ What's the ownership model?\n  - Single user ownership? (document.owner_id)\n  - Organization\u002Ftenant ownership? (document.organization_id)\n  - Hierarchical? (org -> team -> user -> resource)\n  - Role-based within context? (org admin vs member)\n```\n\n### Investigation commands\n\n```bash\n# Find how auth is typically done\ngrep -rn \"permission_classes\\|@login_required\\|@permission_required\" --include=\"*.py\" | head -20\n\n# Find base classes that views inherit from\ngrep -rn \"class Base.*View\\|class.*Mixin.*:\" --include=\"*.py\" | head -20\n\n# Find custom managers\ngrep -rn \"class.*Manager\\|def get_queryset\" --include=\"*.py\" | head -20\n\n# Find ownership fields on models\ngrep -rn \"owner\\|user_id\\|organization\\|tenant\" --include=\"models.py\" | head -30\n```\n\n**Do not proceed until you understand the authorization model.**\n\n---\n\n## Phase 2: Map the Attack Surface\n\nIdentify endpoints that handle user-specific data:\n\n### What resources exist?\n\n```\n□ What models contain user data?\n□ Which have ownership fields (owner_id, user_id, organization_id)?\n□ Which are accessed via ID in URLs or request bodies?\n```\n\n### What operations are exposed?\n\nFor each resource, map:\n- List endpoints - what data is returned?\n- Detail\u002Fretrieve endpoints - how is the object fetched?\n- Create endpoints - who sets the owner?\n- Update endpoints - can users modify others' data?\n- Delete endpoints - can users delete others' data?\n- Custom actions - what do they access?\n\n---\n\n## Phase 3: Ask Questions and Investigate\n\nFor each endpoint that handles user data, ask:\n\n### The Core Question\n\n**\"If I'm User A and I know the ID of User B's resource, can I access it?\"**\n\nTrace the code to answer this:\n\n```\n1. Where does the resource ID enter the system?\n   - URL path: \u002Fapi\u002Fdocuments\u002F{id}\u002F\n   - Query param: ?document_id=123\n   - Request body: {\"document_id\": 123}\n\n2. Where is that ID used to fetch data?\n   - Find the ORM query or database call\n\n3. Between (1) and (2), what checks exist?\n   - Is the query scoped to current user?\n   - Is there an explicit ownership check?\n   - Is there a permission check on the object?\n   - Does a base class or mixin enforce access?\n\n4. If you can't find a check, is there one you missed?\n   - Check parent classes\n   - Check middleware\n   - Check managers\n   - Check decorators at URL level\n```\n\n### Follow-Up Questions\n\n```\n□ For list endpoints: Does the query filter to user's data, or return everything?\n\n□ For create endpoints: Who sets the owner - the server or the request?\n\n□ For bulk operations: Are they scoped to user's data?\n\n□ For related resources: If I can access a document, can I access its comments?\n  What if the document belongs to someone else?\n\n□ For tenant\u002Forg resources: Can User in Org A access Org B's data by changing\n  the org_id in the URL?\n```\n\n---\n\n## Phase 4: Trace Specific Flows\n\nPick a concrete endpoint and trace it completely.\n\n### Example Investigation\n\n```\nEndpoint: GET \u002Fapi\u002Fdocuments\u002F{pk}\u002F\n\n1. Find the view handling this URL\n   → DocumentViewSet.retrieve() in api\u002Fviews.py\n\n2. Check what DocumentViewSet inherits from\n   → class DocumentViewSet(viewsets.ModelViewSet)\n   → No custom base class with authorization\n\n3. Check permission_classes\n   → permission_classes = [IsAuthenticated]\n   → Only checks login, not ownership\n\n4. Check get_queryset()\n   → def get_queryset(self):\n   →     return Document.objects.all()\n   → Returns ALL documents!\n\n5. Check for has_object_permission()\n   → Not implemented\n\n6. Check retrieve() method\n   → Uses default, which calls get_object()\n   → get_object() uses get_queryset(), which returns all\n\n7. Conclusion: IDOR - Any authenticated user can access any document\n```\n\n### What to look for when tracing\n\n```\nPotential gap indicators (investigate further, don't auto-flag):\n- get_queryset() returns .all() or filters without user\n- Direct Model.objects.get(pk=pk) without ownership in query\n- ID comes from request body for sensitive operations\n- Permission class checks auth but not ownership\n- No has_object_permission() and queryset isn't scoped\n\nLikely safe patterns (but verify the implementation):\n- get_queryset() filters by request.user or user's org\n- Custom permission class with has_object_permission()\n- Base class that enforces scoping\n- Manager that auto-filters\n```\n\n---\n\n## Phase 5: Report Findings\n\nOnly report issues you've confirmed through investigation.\n\n### Confidence Levels\n\n| Level | Meaning | Action |\n|-------|---------|--------|\n| **HIGH** | Traced the flow, confirmed no check exists | Report with evidence |\n| **MEDIUM** | Check may exist but couldn't confirm | Note for manual verification |\n| **LOW** | Theoretical, likely mitigated | Do not report |\n\n### Suggested Fixes Must Enforce, Not Document\n\n**Bad fix**: Adding a comment saying \"caller must validate permissions\"\n**Good fix**: Adding code that actually validates permissions\n\nA comment or docstring does not enforce authorization. Your suggested fix must include actual code that:\n- Validates the user has permission before proceeding\n- Raises an exception or returns an error if unauthorized\n- Makes unauthorized access impossible, not just discouraged\n\nExample of a BAD fix suggestion:\n```python\ndef get_resource(resource_id):\n    # IMPORTANT: Caller must ensure user has access to this resource\n    return Resource.objects.get(pk=resource_id)\n```\n\nExample of a GOOD fix suggestion:\n```python\ndef get_resource(resource_id, user):\n    resource = Resource.objects.get(pk=resource_id)\n    if resource.owner_id != user.id:\n        raise PermissionDenied(\"Access denied\")\n    return resource\n```\n\nIf you can't determine the right enforcement mechanism, say so - but never suggest documentation as the fix.\n\n### Report Format\n\n```markdown\n## Access Control Review: [Component]\n\n### Authorization Model\n[Brief description of how this codebase handles authorization]\n\n### Findings\n\n#### [IDOR-001] [Title] (Severity: High\u002FMedium)\n- **Location**: `path\u002Fto\u002Ffile.py:123`\n- **Confidence**: High - confirmed through code tracing\n- **The Question**: Can User A access User B's documents?\n- **Investigation**:\n  1. Traced GET \u002Fapi\u002Fdocuments\u002F{pk}\u002F to DocumentViewSet\n  2. Checked get_queryset() - returns Document.objects.all()\n  3. Checked permission_classes - only IsAuthenticated\n  4. Checked for has_object_permission() - not implemented\n  5. Verified no relevant middleware or base class checks\n- **Evidence**: [Code snippet showing the gap]\n- **Impact**: Any authenticated user can read any document by ID\n- **Suggested Fix**: [Code that enforces authorization - NOT a comment]\n\n### Needs Manual Verification\n[Issues where authorization exists but couldn't confirm effectiveness]\n\n### Areas Not Reviewed\n[Endpoints or flows not covered in this review]\n```\n\n---\n\n## Common Django Authorization Patterns\n\nThese are patterns you might find - not a checklist to match against.\n\n### Query Scoping\n```python\n# Scoped to user\nDocument.objects.filter(owner=request.user)\n\n# Scoped to organization\nDocument.objects.filter(organization=request.user.organization)\n\n# Using a custom manager\nDocument.objects.for_user(request.user)  # Investigate what this does\n```\n\n### Permission Enforcement\n```python\n# DRF permission classes\npermission_classes = [IsAuthenticated, IsOwner]\n\n# Custom has_object_permission\ndef has_object_permission(self, request, view, obj):\n    return obj.owner == request.user\n\n# Django decorators\n@permission_required('app.view_document')\n\n# Manual checks\nif document.owner != request.user:\n    raise PermissionDenied()\n```\n\n### Ownership Assignment\n```python\n# Server-side (safe)\ndef perform_create(self, serializer):\n    serializer.save(owner=self.request.user)\n\n# From request (investigate)\nserializer.save(**request.data)  # Does request.data include owner?\n```\n\n---\n\n## Investigation Checklist\n\nUse this to guide your review, not as a pass\u002Ffail checklist:\n\n```\n□ I understand how authorization is typically implemented in this codebase\n□ I've identified the ownership model (user, org, tenant, etc.)\n□ I've mapped the key endpoints that handle user data\n□ For each sensitive endpoint, I've traced the flow and asked:\n  - Where does the ID come from?\n  - Where is data fetched?\n  - What checks exist between input and data access?\n□ I've verified my findings by checking parent classes and middleware\n□ I've only reported issues I've confirmed through investigation\n```\n",{"name":5,"risk":30,"source":24,"description":5},"unknown","main","a50a3aa6b39fb0e1b7db88bef1bfc9c93606e126","modules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fdjango-access-review",0,"https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant","https:\u002F\u002Fgithub.com\u002FSam-06060","Mobile Application Developer | Kotlin | Flutter, KMP, Swfit, Android,Swift UI | Building at Saar It Resources | Creator of Jarvis (AI Assistant)","2026-06-23 05:13:38",{"source":7,"skillName":5,"commands":40,"prompt":50,"zipAvailable":51},[41,44,47],{"tool":42,"command":43},"npx","npx skills add Sam-06060\u002Fjarvis-assistant --skill django-access-review",{"tool":45,"command":46},"bunx","bunx skills add Sam-06060\u002Fjarvis-assistant --skill django-access-review",{"tool":48,"command":49},"pnpm","pnpm dlx skills add Sam-06060\u002Fjarvis-assistant --skill django-access-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fdjango-access-review\u002FSKILL.md",true,[],[54,67,83,110,129,156],{"skillNo":55,"name":56,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":57,"categories":58,"keywords":64,"publishedAt":25},"01M6GDRVS6FXX3ESH0C9DW01C0","test_skill","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fscratch\u002Ftest_skill\u002FSKILL.md",[59],{"categoryNo":60,"categoryName":61,"taxonomyType":62,"taxonomyTypeDesc":63},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[65,66],"Test Skill","test",{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":73,"publishedAt":25},"01M6GDRQ40HX22MA6XWC31RHHK","zustand-store-ts","Create Zustand stores following established patterns with proper TypeScript types and middleware.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzustand-store-ts\u002FSKILL.md",[],[74,75,76,77,78,79,80,24,81,82],"zustand store ts","zustand","store","with","types","middleware","patterns","create","typescript",{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":92,"publishedAt":25},"01M6GDRKEA0WE670SPFWX5GKCN","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoom-automation\u002FSKILL.md",[89],{"categoryNo":90,"categoryName":91,"taxonomyType":62,"taxonomyTypeDesc":63},"01JBSEEDCAT000000000000023","Skill与智能体开发",[93,94,95,96,97,98,99,100,101,102,103,104,105,106,24,107,108,109],"automation","zoom automation","zoom","first","Tools","search","MCP","via","meeting","automate","critical","creation","webinars","composio","recordings","management","tracking",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":25},"01M6GDRFS1452PC71JQ38S24HR","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoho-crm-automation\u002FSKILL.md",[116],{"categoryNo":90,"categoryName":91,"taxonomyType":62,"taxonomyTypeDesc":63},[118,93,119,120,121,122,123,24,98,124,106,125,103,102,97,126,81,127,99,128],"crm automation","zoho crm","crm","zoho crm automation","zoho","leads","contacts","records","update","tasks","manage",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":138,"publishedAt":25},"01M6GDRCKQBAVTGHX5XBH26KPZ","zod-validation-expert","Expert in Zod — TypeScript-first schema validation. Covers parsing, custom errors, refinements, type inference, and integration with React Hook Form, Next.js, and tRPC.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzod-validation-expert\u002FSKILL.md",[135],{"categoryNo":136,"categoryName":137,"taxonomyType":62,"taxonomyTypeDesc":63},"01JBSEEDCAT000000000000009","前端开发",[139,140,141,142,143,82,144,145,146,147,148,149,77,150,151,152,153,24,154,155],"expert","zod","zod validation expert","validation","react","safe","parsing","errors","schema validation","react hook form","hook","trpc","form","type","next","schema","Next.js",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":25},"01M6GDR658B08K4MY0RWD4A6EH","zeroize-audit","Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C\u002FC++\u002FRust code handling secrets, keys, passwords, or other sensitive data.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzeroize-audit\u002FSKILL.md",[162],{"categoryNo":90,"categoryName":91,"taxonomyType":62,"taxonomyTypeDesc":63},[164,165,166,167,168,169,170,171,24,172,173,174,175,176,177,178,179,180,181,99],"zeroize audit","audit","write","passwords","get","project","c++","activate","assembly","read","Bash","secrets","analysis","data","flow","verification","code","rust"]