[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CSYTMN2MV6HFWMNKT1CEGK":3,"skill-same:01M6CSYTMN2MV6HFWMNKT1CEGK":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":27,"linkOnly":28,"markdownContent":29,"markdownBody":30,"frontMatter":31,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":14,"repositoryHtmlUrl":36,"repositoryHomepageUrl":6,"ownerHtmlUrl":37,"ownerBlogUrl":38,"ownerDescription":6,"updatedAt":39,"install":40,"resources":53},"01M6CSYTMN2MV6HFWMNKT1CEGK","security-auditor",null,"Audits code for security vulnerabilities including OWASP Top 10 and authentication issues.","goffity\u002Fdev-km","goffity","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F778547?v=4","01M6CSW9QQ32YQYTRKQWVKYCAY","Goffity","01M6CSW9VQFVZ3QS6RB4VYJGE6",0,"MIT","https:\u002F\u002Fgithub.com\u002Fgoffity\u002Fdev-km\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-auditor\u002FSKILL.md",[],[19,20,21,22,23,24,25,26],"security","security auditor","vulnerabilities","owasp top 10","code","authentication","issues","owasp","2026-11-10 10:12:30",false,"---\nname: security-auditor\ndescription: Audits code for security vulnerabilities including OWASP Top 10 and authentication issues.\ncontext: fork\nuser-invocable: false\n---\n\n# Security Auditor\n\nAgent สำหรับตรวจสอบ security vulnerabilities ตาม OWASP Top 10 และ best practices\n\n## Purpose\n\n- ตรวจหา security vulnerabilities\n- ตรวจสอบ OWASP Top 10 risks\n- วิเคราะห์ authentication และ authorization\n- ตรวจสอบ data protection\n- หา hardcoded secrets\n\n## When to Use\n\n- ก่อน push code ไป production\n- Periodic security audit\n- เมื่อเพิ่ม feature เกี่ยวกับ auth\u002Fdata\n- หลังจาก code review พบ potential issues\n\n## Instructions\n\n### Step 1: Identify Scope\n\n```bash\nfind . -type f \\( -name \"*.js\" -o -name \"*.ts\" -o -name \"*.py\" -o -name \"*.go\" \\) | head -50\n# Or changed files only\ngit diff --name-only HEAD\n```\n\n### Step 2: OWASP Top 10 Checklist\n\n#### A01: Broken Access Control\n- [ ] Authorization checks on all endpoints\n- [ ] No direct object references exposed\n- [ ] CORS properly configured\n- [ ] Directory traversal prevention\n\n#### A02: Cryptographic Failures\n- [ ] No sensitive data in plain text\n- [ ] Strong encryption algorithms used\n- [ ] Secure key management\n- [ ] HTTPS enforced\n\n#### A03: Injection\n- [ ] SQL injection prevention (parameterized queries)\n- [ ] NoSQL injection prevention\n- [ ] Command injection prevention\n- [ ] LDAP injection prevention\n\n#### A04: Insecure Design\n- [ ] Threat modeling done\n- [ ] Security requirements defined\n- [ ] Fail-safe defaults\n\n#### A05: Security Misconfiguration\n- [ ] Default credentials changed\n- [ ] Unnecessary features disabled\n- [ ] Error messages don't leak info\n- [ ] Security headers present\n\n#### A06: Vulnerable Components\n- [ ] Dependencies up to date\n- [ ] No known vulnerabilities in deps\n- [ ] Minimal dependencies\n\n#### A07: Authentication Failures\n- [ ] Strong password policy\n- [ ] Brute force protection\n- [ ] Secure session management\n- [ ] MFA support (if applicable)\n\n#### A08: Software & Data Integrity\n- [ ] Integrity verification for updates\n- [ ] CI\u002FCD pipeline secured\n- [ ] Unsigned\u002Funtrusted data rejected\n\n#### A09: Logging & Monitoring\n- [ ] Security events logged\n- [ ] No sensitive data in logs\n- [ ] Log injection prevention\n- [ ] Alerting configured\n\n#### A10: Server-Side Request Forgery (SSRF)\n- [ ] URL validation\n- [ ] Allowlist for external requests\n- [ ] No user-controlled redirects\n\n### Step 3: Secrets Detection\n\n```bash\ngrep -r \"password\\|secret\\|api_key\\|token\\|credential\" --include=\"*.js\" --include=\"*.ts\" --include=\"*.py\" --include=\"*.go\" .\n```\n\nLook for:\n- Hardcoded passwords\n- API keys in code\n- Private keys\n- Connection strings with credentials\n\n### Step 4: Risk Assessment\n\n| Risk Level | Criteria |\n|------------|----------|\n| Critical | Exploitable, high impact |\n| High | Exploitable, medium impact |\n| Medium | Requires conditions to exploit |\n| Low | Minimal impact |\n\n## Output Format\n\n```markdown\n## Security Audit Report\n\n**Scope:** [files\u002Fdirectories audited]\n**Date:** YYYY-MM-DD\n**Risk Level:** [CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW]\n\n---\n\n### Executive Summary\n\n| Severity | Count |\n|----------|-------|\n| Critical | X |\n| High | Y |\n| Medium | Z |\n| Low | W |\n\n---\n\n### [VULN-001] [Vulnerability Name]\n- **File:** `path\u002Fto\u002Ffile.js:123`\n- **Type:** [OWASP Category]\n- **Description:** What the vulnerability is\n- **Impact:** What could happen if exploited\n- **Remediation:** How to fix it\n\n---\n\n### Recommendations\n\n1. **Immediate:** [Critical fixes]\n2. **Short-term:** [High priority improvements]\n3. **Long-term:** [Security enhancements]\n```\n","# Security Auditor\n\nAgent สำหรับตรวจสอบ security vulnerabilities ตาม OWASP Top 10 และ best practices\n\n## Purpose\n\n- ตรวจหา security vulnerabilities\n- ตรวจสอบ OWASP Top 10 risks\n- วิเคราะห์ authentication และ authorization\n- ตรวจสอบ data protection\n- หา hardcoded secrets\n\n## When to Use\n\n- ก่อน push code ไป production\n- Periodic security audit\n- เมื่อเพิ่ม feature เกี่ยวกับ auth\u002Fdata\n- หลังจาก code review พบ potential issues\n\n## Instructions\n\n### Step 1: Identify Scope\n\n```bash\nfind . -type f \\( -name \"*.js\" -o -name \"*.ts\" -o -name \"*.py\" -o -name \"*.go\" \\) | head -50\n# Or changed files only\ngit diff --name-only HEAD\n```\n\n### Step 2: OWASP Top 10 Checklist\n\n#### A01: Broken Access Control\n- [ ] Authorization checks on all endpoints\n- [ ] No direct object references exposed\n- [ ] CORS properly configured\n- [ ] Directory traversal prevention\n\n#### A02: Cryptographic Failures\n- [ ] No sensitive data in plain text\n- [ ] Strong encryption algorithms used\n- [ ] Secure key management\n- [ ] HTTPS enforced\n\n#### A03: Injection\n- [ ] SQL injection prevention (parameterized queries)\n- [ ] NoSQL injection prevention\n- [ ] Command injection prevention\n- [ ] LDAP injection prevention\n\n#### A04: Insecure Design\n- [ ] Threat modeling done\n- [ ] Security requirements defined\n- [ ] Fail-safe defaults\n\n#### A05: Security Misconfiguration\n- [ ] Default credentials changed\n- [ ] Unnecessary features disabled\n- [ ] Error messages don't leak info\n- [ ] Security headers present\n\n#### A06: Vulnerable Components\n- [ ] Dependencies up to date\n- [ ] No known vulnerabilities in deps\n- [ ] Minimal dependencies\n\n#### A07: Authentication Failures\n- [ ] Strong password policy\n- [ ] Brute force protection\n- [ ] Secure session management\n- [ ] MFA support (if applicable)\n\n#### A08: Software & Data Integrity\n- [ ] Integrity verification for updates\n- [ ] CI\u002FCD pipeline secured\n- [ ] Unsigned\u002Funtrusted data rejected\n\n#### A09: Logging & Monitoring\n- [ ] Security events logged\n- [ ] No sensitive data in logs\n- [ ] Log injection prevention\n- [ ] Alerting configured\n\n#### A10: Server-Side Request Forgery (SSRF)\n- [ ] URL validation\n- [ ] Allowlist for external requests\n- [ ] No user-controlled redirects\n\n### Step 3: Secrets Detection\n\n```bash\ngrep -r \"password\\|secret\\|api_key\\|token\\|credential\" --include=\"*.js\" --include=\"*.ts\" --include=\"*.py\" --include=\"*.go\" .\n```\n\nLook for:\n- Hardcoded passwords\n- API keys in code\n- Private keys\n- Connection strings with credentials\n\n### Step 4: Risk Assessment\n\n| Risk Level | Criteria |\n|------------|----------|\n| Critical | Exploitable, high impact |\n| High | Exploitable, medium impact |\n| Medium | Requires conditions to exploit |\n| Low | Minimal impact |\n\n## Output Format\n\n```markdown\n## Security Audit Report\n\n**Scope:** [files\u002Fdirectories audited]\n**Date:** YYYY-MM-DD\n**Risk Level:** [CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW]\n\n---\n\n### Executive Summary\n\n| Severity | Count |\n|----------|-------|\n| Critical | X |\n| High | Y |\n| Medium | Z |\n| Low | W |\n\n---\n\n### [VULN-001] [Vulnerability Name]\n- **File:** `path\u002Fto\u002Ffile.js:123`\n- **Type:** [OWASP Category]\n- **Description:** What the vulnerability is\n- **Impact:** What could happen if exploited\n- **Remediation:** How to fix it\n\n---\n\n### Recommendations\n\n1. **Immediate:** [Critical fixes]\n2. **Short-term:** [High priority improvements]\n3. **Long-term:** [Security enhancements]\n```\n",{"name":5,"context":32,"description":7,"user-invocable":28},"fork","main","835c1f754a3eab31c2e7eb408d21431a98c633ee","skills\u002Fsecurity-auditor","https:\u002F\u002Fgithub.com\u002Fgoffity\u002Fdev-km","https:\u002F\u002Fgithub.com\u002Fgoffity","www.narongwate.com","2026-11-10 01:34:18",{"source":8,"skillName":5,"commands":41,"prompt":51,"zipAvailable":52},[42,45,48],{"tool":43,"command":44},"npx","npx skills add goffity\u002Fdev-km --skill security-auditor",{"tool":46,"command":47},"bunx","bunx skills add goffity\u002Fdev-km --skill security-auditor",{"tool":49,"command":50},"pnpm","pnpm dlx skills add goffity\u002Fdev-km --skill security-auditor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoffity\u002Fdev-km\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-auditor\u002FSKILL.md",true,[54,60],{"path":55,"resourceType":56,"resourceTypeDesc":57,"sizeBytes":58,"sourceHtmlUrl":59},"evals\u002Ftriggers.json","REFERENCE","参考文档",4062,"https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fsecurity-audit\u002Fevals\u002Ftriggers.json",{"path":61,"resourceType":56,"resourceTypeDesc":57,"sizeBytes":62,"sourceHtmlUrl":63},"references\u002Fcontrol-section.md",8125,"https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fcontrol-section.md",[65,76,110,122,130,145],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":27},"01M6CSZ9DKT0CG5Y2HE8F5D9KX","wait-what","Stop. That last message did not land: re-pitch it.","https:\u002F\u002Fgithub.com\u002Fgoffity\u002Fdev-km\u002Fblob\u002Fmain\u002Fskills\u002Fwait-what\u002FSKILL.md",[],[72,73,74,75],"wait what","land","stop","message",{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":90,"publishedAt":27},"01M6CSZ6B0GH2N75WNPPESCDHX","tdd","Test-driven development loop (red-green-refactor) with commit-based phase state and Jira traceability. Use when the user wants to build a feature or fix a bug test-first, mentions \"tdd\", \"red-green-refactor\", or \"test-first\". Replaces the tdg plugin — combines its commit\u002Fphase discipline with seam-based test quality rules from kb Testing Standards.","https:\u002F\u002Fgithub.com\u002Fgoffity\u002Fdev-km\u002Fblob\u002Fmain\u002Fskills\u002Ftdd\u002FSKILL.md",[82,87],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",{"categoryNo":88,"categoryName":89,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000008","测试与质量",[78,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109],"discipline","development","state","first","loop","quality","Rules","fix","kb","use","test","standards","red-green-refactor","build","green","jira","testing","commit","plugin",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":27},"01M6CSZ3PNYFR2K5GB197TA7GP","td","Creates post-task retrospectives with Before\u002FAfter context and session documentation.","https:\u002F\u002Fgithub.com\u002Fgoffity\u002Fdev-km\u002Fblob\u002Fmain\u002Fskills\u002Ftd\u002FSKILL.md",[],[112,117,118,119,120,121],"documentation","context","session","task","done",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":27},"01M6CSZ1TZKVNHS07B4EBQEKFQ","summary","Generates weekly or monthly session summaries from retrospectives and activity logs.","https:\u002F\u002Fgithub.com\u002Fgoffity\u002Fdev-km\u002Fblob\u002Fmain\u002Fskills\u002Fsummary\u002FSKILL.md",[],[124,129,119],"logs",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":139,"publishedAt":27},"01M6CSYZQHMHJT9ZV8FYY06XZN","share","Shares knowledge across projects by copying to shared-knowledge directory with cross-project metadata.","https:\u002F\u002Fgithub.com\u002Fgoffity\u002Fdev-km\u002Fblob\u002Fmain\u002Fskills\u002Fshare\u002FSKILL.md",[136],{"categoryNo":137,"categoryName":138,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000021","资料检索与研究",[132,140,141,142,143,144],"directory","metadata","file","knowledge","projects",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":27},"01M6CSYXFZ7D7EKEFXCQE8QW7S","session-analyzer","Analyzes git changes and creates retrospective drafts with Before\u002FAfter context.","https:\u002F\u002Fgithub.com\u002Fgoffity\u002Fdev-km\u002Fblob\u002Fmain\u002Fskills\u002Fsession-analyzer\u002FSKILL.md",[],[119,152,153,118,154],"session analyzer","git","retrospective"]