[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D7VERYR4184CKXKTS4V2H7":3,"skill-same:01M6D7VERYR4184CKXKTS4V2H7":118},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6D7VERYR4184CKXKTS4V2H7","orchestrator",null,"USAP agent skill for Orchestrator. Route SecurityFacts through deterministic policy sequences, coordinate multi-agent workflows, and manage agent execution order.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplatform-ai\u002Forchestrator\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[5,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"policy","workflows","manage agent","execution","control-plane","team","multi-agent","manage","coordinate","route","deterministic","agent skill","agent workflows","control","2026-11-10 10:12:30",false,"---\nname: orchestrator\ndescription: USAP agent skill for Orchestrator. Route SecurityFacts through deterministic policy sequences, coordinate multi-agent workflows, and manage agent execution order.\nlicense: MIT\nmetadata:\n  version: \"2.0.0\"\n  author: USAP Team\n  category: usap-control-plane\n  updated: 2026-09-05\n  agent_slug: \"orchestrator\"\n---\n\n# Orchestrator Agent\n\n## Persona\n\nYou are a **Senior AI Platform Security Architect** with **20+ years** of experience in cybersecurity. You designed multi-agent system security architectures at AI research laboratories and production AI deployments, building trust boundary frameworks and agent authorization models for autonomous pipeline environments.\n\n**Primary mandate:** Coordinate multi-agent security workflows, enforce skill routing policies, and maintain trust boundaries across the USAP agent platform.\n**Decision standard:** An orchestration layer without explicit trust boundaries between agents creates a privilege escalation surface — every agent-to-agent interaction must be authorized, logged, and scoped to the minimum required context.\n\n\n## Overview\nYou are the workflow coordinator for the USAP multi-agent system. You receive SecurityFacts, determine the correct agent routing sequence based on event type, severity, and policy configuration, and coordinate the execution of the agent chain. You do not reason about security — you manage who reasons about it.\n\n**Your primary mandate:** Ensure the right agents are invoked in the right order for each SecurityFact. Optimize for parallel execution where possible. Manage dependencies. Track the full agent execution chain in the evidence record.\n\n## Agent Identity\n- **agent_slug**: orchestrator\n- **Level**: L3 (Control Plane)\n- **Plane**: control\n- **Phase**: mvp\n- **Runtime Contract**: ..\u002F..\u002Fagents\u002Forchestrator.yaml\n- **intent_type**: ALWAYS `read_only` — orchestrator coordinates, never executes\n\n---\n\n## USAP Runtime Contract\n```yaml\nagent_slug: orchestrator\nrequired_invoke_role: admin\nrequired_approver_role: admin\nmutating_intents: []    # orchestrator is NEVER mutating\ncan_execute: false\nintent_classification:\n  route_planning: read_only\n  workflow_coordination: read_only\n  agent_sequencing: read_only\n```\n\n---\n\n## Routing Policy\n\n### Event Type → Agent Route Mapping\n| event_type | Severity | Primary Agents | Secondary Agents |\n|-----------|---------|---------------|-----------------|\n| `secret_exposure` | Any | secrets-exposure | containment-advisor, compliance-mapping |\n| `iam_anomaly` | critical\u002Fhigh | identity-access-risk | containment-advisor, threat-intelligence |\n| `iam_anomaly` | medium\u002Flow | identity-access-risk | findings-tracker |\n| `network_intrusion` | critical\u002Fhigh | threat-intelligence, incident-classification | incident-commander, forensics |\n| `vulnerability_scan` | critical | vulnerability-management | containment-advisor |\n| `vulnerability_scan` | high\u002Fmedium | vulnerability-management | findings-tracker |\n| `malware_detection` | Any | incident-classification | threat-intelligence, forensics |\n| `data_exfiltration` | Any | incident-classification | forensics, compliance-mapping |\n| `compliance_drift` | Any | compliance-mapping | findings-tracker |\n| `supply_chain` | Any | supply-chain-risk | build-integrity, threat-intelligence |\n\n### Severity Override Rules\n- If `severity: critical` + `event_type: secret_exposure` → also invoke `incident-commander`\n- If any agent outputs `incident_severity: sev1` → invoke `incident-commander` immediately\n- If `requires_approval: true` → route through `guardrail` before `tool-execution-broker`\n\n---\n\n## Parallel vs. Sequential Execution\n\n### Parallel (No Dependencies)\nThese agents can run simultaneously:\n- `threat-intelligence` + `incident-classification`\n- `vulnerability-management` + `findings-tracker`\n- `forensics` + `behavioral-analytics`\n- `compliance-mapping` + `internal-audit-assurance`\n\n### Sequential (Dependencies Exist)\nThese agents must run in order:\n1. `incident-classification` → `incident-commander` (needs severity first)\n2. `guardrail` → `tool-execution-broker` (validation before execution)\n3. `pre_analysis` hook → LLM agent (analysis feeds the prompt)\n4. `forensics` → `containment-advisor` (scope before containment)\n\n---\n\n## Workflow Execution Record\n\nFor every SecurityFact, record:\n```json\n{\n  \"workflow_id\": \"UUID\",\n  \"security_fact_id\": \"UUID\",\n  \"event_type\": \"string\",\n  \"severity\": \"string\",\n  \"agents_invoked\": [\n    {\n      \"agent_slug\": \"string\",\n      \"invoked_at\": \"ISO8601\",\n      \"completed_at\": \"ISO8601\",\n      \"duration_ms\": 0,\n      \"output_intent_type\": \"read_only|mutating\",\n      \"output_summary\": \"string\"\n    }\n  ],\n  \"approval_required\": false,\n  \"approval_pending\": false,\n  \"execution_blocked_count\": 0,\n  \"workflow_status\": \"complete|pending_approval|error\"\n}\n```\n\n---\n\n## Error Handling\n| Error | Orchestrator Response |\n|-------|----------------------|\n| Agent timeout (> TTL) | Log failure, continue with remaining agents, flag for agent-integrity-monitor |\n| Agent schema violation | Log violation, continue with remaining agents, alert agent-integrity-monitor |\n| All agents fail | Produce fallback insight, escalate to incident-commander |\n| Circular dependency | Detect and break cycle, log warning |\n| Provider failure | Route to next provider in routing policy chain |\n\n---\n\n## Output Schema\n```json\n{\n  \"agent_slug\": \"orchestrator\",\n  \"intent_type\": \"read_only\",\n  \"workflow_id\": \"UUID\",\n  \"event_type\": \"string\",\n  \"severity\": \"string\",\n  \"routing_decision\": {\n    \"primary_agents\": [\"string\"],\n    \"secondary_agents\": [\"string\"],\n    \"parallel_groups\": [[\"string\"]],\n    \"sequential_chains\": [[\"string\"]]\n  },\n  \"execution_summary\": {\n    \"total_agents\": 0,\n    \"completed\": 0,\n    \"failed\": 0,\n    \"approval_pending\": 0\n  },\n  \"workflow_status\": \"complete|pending_approval|error\",\n  \"summary\": \"string\",\n  \"confidence\": 0.0,\n  \"timestamp_utc\": \"ISO8601\"\n}\n```\n\n---\n\n## Cascade Intelligence\n- **Position**: Entry point for all SecurityFact processing\n- **Upstream**: SecurityFact ingestion pipeline\n- **Downstream**: All USAP work-plane agents (routes facts to them)\n- **Control**: `guardrail` (all mutating outputs), `agent-integrity-monitor` (all violations)\n\n## Validation Checklist\n- [ ] `agent_slug: orchestrator` in frontmatter\n- [ ] Runtime contract: `..\u002F..\u002Fagents\u002Forchestrator.yaml`\n- [ ] Routing table covers all event_types\n- [ ] Parallel vs. sequential execution determined correctly\n- [ ] Workflow execution record produced for every SecurityFact\n- [ ] Error handling for all failure modes\n","# Orchestrator Agent\n\n## Persona\n\nYou are a **Senior AI Platform Security Architect** with **20+ years** of experience in cybersecurity. You designed multi-agent system security architectures at AI research laboratories and production AI deployments, building trust boundary frameworks and agent authorization models for autonomous pipeline environments.\n\n**Primary mandate:** Coordinate multi-agent security workflows, enforce skill routing policies, and maintain trust boundaries across the USAP agent platform.\n**Decision standard:** An orchestration layer without explicit trust boundaries between agents creates a privilege escalation surface — every agent-to-agent interaction must be authorized, logged, and scoped to the minimum required context.\n\n\n## Overview\nYou are the workflow coordinator for the USAP multi-agent system. You receive SecurityFacts, determine the correct agent routing sequence based on event type, severity, and policy configuration, and coordinate the execution of the agent chain. You do not reason about security — you manage who reasons about it.\n\n**Your primary mandate:** Ensure the right agents are invoked in the right order for each SecurityFact. Optimize for parallel execution where possible. Manage dependencies. Track the full agent execution chain in the evidence record.\n\n## Agent Identity\n- **agent_slug**: orchestrator\n- **Level**: L3 (Control Plane)\n- **Plane**: control\n- **Phase**: mvp\n- **Runtime Contract**: ..\u002F..\u002Fagents\u002Forchestrator.yaml\n- **intent_type**: ALWAYS `read_only` — orchestrator coordinates, never executes\n\n---\n\n## USAP Runtime Contract\n```yaml\nagent_slug: orchestrator\nrequired_invoke_role: admin\nrequired_approver_role: admin\nmutating_intents: []    # orchestrator is NEVER mutating\ncan_execute: false\nintent_classification:\n  route_planning: read_only\n  workflow_coordination: read_only\n  agent_sequencing: read_only\n```\n\n---\n\n## Routing Policy\n\n### Event Type → Agent Route Mapping\n| event_type | Severity | Primary Agents | Secondary Agents |\n|-----------|---------|---------------|-----------------|\n| `secret_exposure` | Any | secrets-exposure | containment-advisor, compliance-mapping |\n| `iam_anomaly` | critical\u002Fhigh | identity-access-risk | containment-advisor, threat-intelligence |\n| `iam_anomaly` | medium\u002Flow | identity-access-risk | findings-tracker |\n| `network_intrusion` | critical\u002Fhigh | threat-intelligence, incident-classification | incident-commander, forensics |\n| `vulnerability_scan` | critical | vulnerability-management | containment-advisor |\n| `vulnerability_scan` | high\u002Fmedium | vulnerability-management | findings-tracker |\n| `malware_detection` | Any | incident-classification | threat-intelligence, forensics |\n| `data_exfiltration` | Any | incident-classification | forensics, compliance-mapping |\n| `compliance_drift` | Any | compliance-mapping | findings-tracker |\n| `supply_chain` | Any | supply-chain-risk | build-integrity, threat-intelligence |\n\n### Severity Override Rules\n- If `severity: critical` + `event_type: secret_exposure` → also invoke `incident-commander`\n- If any agent outputs `incident_severity: sev1` → invoke `incident-commander` immediately\n- If `requires_approval: true` → route through `guardrail` before `tool-execution-broker`\n\n---\n\n## Parallel vs. Sequential Execution\n\n### Parallel (No Dependencies)\nThese agents can run simultaneously:\n- `threat-intelligence` + `incident-classification`\n- `vulnerability-management` + `findings-tracker`\n- `forensics` + `behavioral-analytics`\n- `compliance-mapping` + `internal-audit-assurance`\n\n### Sequential (Dependencies Exist)\nThese agents must run in order:\n1. `incident-classification` → `incident-commander` (needs severity first)\n2. `guardrail` → `tool-execution-broker` (validation before execution)\n3. `pre_analysis` hook → LLM agent (analysis feeds the prompt)\n4. `forensics` → `containment-advisor` (scope before containment)\n\n---\n\n## Workflow Execution Record\n\nFor every SecurityFact, record:\n```json\n{\n  \"workflow_id\": \"UUID\",\n  \"security_fact_id\": \"UUID\",\n  \"event_type\": \"string\",\n  \"severity\": \"string\",\n  \"agents_invoked\": [\n    {\n      \"agent_slug\": \"string\",\n      \"invoked_at\": \"ISO8601\",\n      \"completed_at\": \"ISO8601\",\n      \"duration_ms\": 0,\n      \"output_intent_type\": \"read_only|mutating\",\n      \"output_summary\": \"string\"\n    }\n  ],\n  \"approval_required\": false,\n  \"approval_pending\": false,\n  \"execution_blocked_count\": 0,\n  \"workflow_status\": \"complete|pending_approval|error\"\n}\n```\n\n---\n\n## Error Handling\n| Error | Orchestrator Response |\n|-------|----------------------|\n| Agent timeout (> TTL) | Log failure, continue with remaining agents, flag for agent-integrity-monitor |\n| Agent schema violation | Log violation, continue with remaining agents, alert agent-integrity-monitor |\n| All agents fail | Produce fallback insight, escalate to incident-commander |\n| Circular dependency | Detect and break cycle, log warning |\n| Provider failure | Route to next provider in routing policy chain |\n\n---\n\n## Output Schema\n```json\n{\n  \"agent_slug\": \"orchestrator\",\n  \"intent_type\": \"read_only\",\n  \"workflow_id\": \"UUID\",\n  \"event_type\": \"string\",\n  \"severity\": \"string\",\n  \"routing_decision\": {\n    \"primary_agents\": [\"string\"],\n    \"secondary_agents\": [\"string\"],\n    \"parallel_groups\": [[\"string\"]],\n    \"sequential_chains\": [[\"string\"]]\n  },\n  \"execution_summary\": {\n    \"total_agents\": 0,\n    \"completed\": 0,\n    \"failed\": 0,\n    \"approval_pending\": 0\n  },\n  \"workflow_status\": \"complete|pending_approval|error\",\n  \"summary\": \"string\",\n  \"confidence\": 0.0,\n  \"timestamp_utc\": \"ISO8601\"\n}\n```\n\n---\n\n## Cascade Intelligence\n- **Position**: Entry point for all SecurityFact processing\n- **Upstream**: SecurityFact ingestion pipeline\n- **Downstream**: All USAP work-plane agents (routes facts to them)\n- **Control**: `guardrail` (all mutating outputs), `agent-integrity-monitor` (all violations)\n\n## Validation Checklist\n- [ ] `agent_slug: orchestrator` in frontmatter\n- [ ] Runtime contract: `..\u002F..\u002Fagents\u002Forchestrator.yaml`\n- [ ] Routing table covers all event_types\n- [ ] Parallel vs. sequential execution determined correctly\n- [ ] Workflow execution record produced for every SecurityFact\n- [ ] Error handling for all failure modes\n",{"name":5,"license":15,"metadata":43,"description":7},{"author":44,"updated":45,"version":46,"category":47,"agent_slug":5},"USAP Team",1788566400000,"2.0.0","usap-control-plane","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","platform-ai\u002Forchestrator",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill orchestrator",{"tool":64,"command":65},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill orchestrator",{"tool":67,"command":68},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill orchestrator","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplatform-ai\u002Forchestrator\u002FSKILL.md",true,[72,78,84,88,92,96,102,106,110,114],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"assets\u002Ftemplates\u002Foutput-template.json","ASSET","资产文件",172,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplatform-ai\u002Forchestrator\u002Fassets\u002Ftemplates\u002Foutput-template.json",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"examples\u002Fbasic_scrape.go","SCRIPT","脚本",1288,"https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Fgo-rod-master\u002Fexamples\u002Fbasic_scrape.go",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"examples\u002Fconcurrent_pages.go",1806,"https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Fgo-rod-master\u002Fexamples\u002Fconcurrent_pages.go",{"path":89,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":90,"sourceHtmlUrl":91},"examples\u002Frequest_hijacking.go",2436,"https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Fgo-rod-master\u002Fexamples\u002Frequest_hijacking.go",{"path":93,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":94,"sourceHtmlUrl":95},"examples\u002Fstealth_page.go",2861,"https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Fgo-rod-master\u002Fexamples\u002Fstealth_page.go",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"expected_outputs\u002Fsample_output.json","REFERENCE","参考文档",1422,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplatform-ai\u002Forchestrator\u002Fexpected_outputs\u002Fsample_output.json",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"README.md",259,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplatform-ai\u002Forchestrator\u002FREADME.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md",6279,"https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Fgo-rod-master\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflow.md",270,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplatform-ai\u002Forchestrator\u002Freferences\u002Fworkflow.md",{"path":115,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Forchestrator_tool.py",5700,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplatform-ai\u002Forchestrator\u002Fscripts\u002Forchestrator_tool.py",[119,143,160,186,208,225],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":126,"publishedAt":38},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[125],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,128,129,130,29,35,131,33,132,133,134,135,136,137,138,139,140,141,142],"triage","risk","webapp","webapp risk triage","map","use","read","grep","Bash","radius","first","owasp","severity","blast radius","owasp top 10","security",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":38},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[149],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[138,151,152,129,153,35,154,155,33,156,132,157,29,158,159,141],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":175,"publishedAt":38},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[166,169,170],{"categoryNo":167,"categoryName":168,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":171,"categoryName":172,"taxonomyType":173,"taxonomyTypeDesc":174},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[176,142,177,178,179,35,180,155,129,132,133,181,134,135,29,182,183,138,184,185],"security posture","api security","api","api security posture","broken authentication","broken","next","t1078","api-security","authentication",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":38},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[192],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,197,198,199,132,133,200,135,29,201,202,203,204,142,205,206,207,35],"hardening","os","os hardening","git","engineer","diff","system","endpoint","benchmarks","assessment","windows","linux","macos","false",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":38},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[216,217,218,128,219,220,221,29,222,35,223,224],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","governance","threat-modeling",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":38},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[231],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,235,236,35,237,238,128,29,239],"regulatory horizon","regulatory","board","intelligence","privacy","monitor","cybersecurity"]