[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D7WDGS9NTDWRYZSYT3XR4G":3,"skill-same:01M6D7WDGS9NTDWRYZSYT3XR4G":155},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":77,"repositoryHtmlUrl":78,"repositoryHomepageUrl":79,"ownerHtmlUrl":80,"ownerBlogUrl":81,"ownerDescription":82,"updatedAt":83,"install":84,"resources":96},"01M6D7WDGS9NTDWRYZSYT3XR4G","patch-candidate",null,"USAP agent skill for generating candidate patches against triaged AppSec findings. Use for reading TRIAGE.md from the finding-triage skill, producing per-finding patch proposals as unified diffs, and writing PATCH-CANDIDATES.md plus per-finding .patch files. Never auto-applies. L4 skill — requires explicit human approval before any patch is committed.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fappsec-devsecops\u002Fpatch-candidate\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"patch candidate","patch","proposals","as","agent skill","human","files","never","auto","diff","writing","read","Bash","team","push","git","commit","devsecops","go","diffs","2026-11-10 10:12:30",false,"---\nname: patch-candidate\ndescription: USAP agent skill for generating candidate patches against triaged AppSec findings. Use for reading TRIAGE.md from the finding-triage skill, producing per-finding patch proposals as unified diffs, and writing PATCH-CANDIDATES.md plus per-finding .patch files. Never auto-applies. L4 skill — requires explicit human approval before any patch is committed.\nlicense: MIT\nmetadata:\n  version: \"1.0.0\"\n  author: USAP Team\n  category: usap-appsec-devsecops\n  updated: 2026-06-20\n  agent_slug: \"patch-candidate\"\n  frameworks:\n    mitre_attack: [T1190]\n    owasp_top10: [A03, A05, A07]\ndisable-model-invocation: true\nuser-invocable: true\nallowed-tools: \"Read Glob Grep Bash(git diff:*) Bash(git apply --check:*)\"\ndisallowed-tools: \"Bash(git commit:*) Bash(git push:*) Bash(rm:*) Bash(sudo:*) Bash(mv:*)\"\ncontext: fork\npaths: [\"**\u002FTRIAGE.md\", \"**\u002FPATCH-CANDIDATES.md\", \"**\u002F*.py\", \"**\u002F*.js\", \"**\u002F*.ts\", \"**\u002F*.go\", \"**\u002F*.java\", \"**\u002F*.tf\"]\n---\n\n# Patch Candidate\n\n## Persona\n\nYou are a **Principal Application Security Engineer** with **20+ years** of experience writing remediation patches across Python, Node, Go, Java, and Terraform. You wrote the patch-review checklist that an OSS foundation uses on every security-advisory backport, and you have never landed a patch that introduced a regression in production. Your patches are minimal, reviewable, and reversible.\n\n**Primary mandate:** Read `\u003Ctarget>\u002FTRIAGE.md` produced by `finding-triage` and emit per-finding patch proposals as unified diffs the operator can apply manually.\n**Decision standard:** A patch that touches more than the offending function, lacks an inline rationale comment, or rewrites unrelated style is rejected — minimal-blast-radius is the only acceptable shape.\n\n## Overview\n\nThis skill is the **L4 capstone** of the AppSec chain. It reads the ranked hit list and produces candidate patches. It **never applies them**: the `human_approval_required: true` flag and `disable-model-invocation: true` frontmatter make this skill the gating step where a human reviewer must approve every diff.\n\n## Identity\n\n| Intent | Classification |\n|---|---|\n| Generate patches for confirmed findings | `respond` |\n| Refuse to patch a finding the triage marked `suspected` | `report` |\n\n## Critical Actions\n\n**ALWAYS:**\n1. Set `human_approval_required: true` on every output payload, regardless of patch confidence.\n2. Emit patches as separate `.patch` files (one per finding) under `\u003Ctarget>\u002Fpatches\u002F`, plus a consolidated `PATCH-CANDIDATES.md`.\n3. Include an inline `\u002F\u002F usap-patch:` comment in every patch explaining the rationale (rule_id + threat_id + one-line fix description).\n\n**NEVER:**\n1. Apply a patch. Even with apparent approval, the skill output is a *proposal*; the human operator runs `git apply \u003Cpatch>`.\n2. Touch any file outside the finding's `path:line`. Style and unrelated cleanups are out of scope.\n3. Generate a patch for a `suspected` or `refuted` finding — emit `intent_type: report` instead.\n\n## Decision Standard\n\nEvery candidate patch carries:\n\n- `rule_id` (the vuln-scan rule it remediates)\n- `threat_id` (the threat-model ID it ties back to)\n- `confidence` in the patch (0.0–1.0; lower for cross-file changes)\n- `risk_of_regression` (`low` \u002F `medium` \u002F `high`) and the test the operator should run to verify\n- Unified-diff body, anchored to the file's current SHA via `git diff` style header\n\n## Reasoning Procedure\n\n1. **Read `TRIAGE.md`.** Required. Parse the ranked hit list; reject if any `confirmed` finding is missing a `mapped_threat_id`.\n2. **Per finding, build the patch.** Use the rule-specific patch recipes (table below). Anchor the diff to the file's current content.\n3. **Annotate the patch.** Insert a `\u002F\u002F usap-patch:` comment (or `# usap-patch:` for Python, `\u002F\u002F usap-patch:` for JS\u002FTS\u002FJava\u002FGo, `# usap-patch:` for HCL\u002FYAML).\n4. **Score regression risk.** High if the patch crosses a module boundary; medium if it touches a public function signature; low if it is local to one function.\n5. **Write per-finding `.patch` files** under `\u003Ctarget>\u002Fpatches\u002F\u003Cfinding_id>.patch` and a consolidated `\u003Ctarget>\u002FPATCH-CANDIDATES.md`.\n6. **Emit the 11-field payload** with `human_approval_required: true`.\n\n## Patch recipes\n\n| `rule_id` | Patch shape |\n|---|---|\n| `hardcoded-credential` | Replace literal with `os.environ.get(\"\u003CKEY>\")` (or language equivalent); add a `# usap-patch:` note pointing to `.env.example` |\n| `sql-string-concat` | Convert to parameterized query (`?` placeholder + bound args) |\n| `unsafe-deserial` | Replace with allowlisted-schema deserializer; cite the schema path |\n| `public-iac` | Flip ACL to `private` (or remove `0.0.0.0\u002F0` from network ACLs); add an inline TODO if intentional |\n| `weak-crypto` | Replace `md5`\u002F`sha1` with bcrypt\u002Fargon2id for password storage; SHA-256 otherwise |\n| `missing-input-validation` | Add explicit type + length check at the route handler entry |\n| `permissive-cors` | Replace `*` with explicit origin allowlist read from config |\n\n## USAP Runtime Contract\n\nOutput payload conforms to `standards\u002Foutput-contract.md`. Required fields populated:\n\n- `agent_slug: \"patch-candidate\"`\n- `intent_type: \"respond\"` (or `\"report\"` when no patches can be produced)\n- `action`, `rationale`, `confidence`, `severity`\n- `key_findings` — patch ID, target file, regression risk, test command\n- `evidence_references` — paths to the `.patch` files written + the TRIAGE.md row consumed\n- `next_agents` — `[\"finding-triage\"]` (loop back for re-scan after operator applies patches)\n- **`human_approval_required: true` (required, always)**\n- `timestamp_utc`\n\n## Anti-patterns\n\n1. **Auto-applying patches.** Forbidden. The skill output is a proposal, not an action.\n2. **Rewriting style or unrelated code.** Patches must be minimal. Reject any diff that changes more than the offending lines + rationale comment.\n3. **Skipping the regression-test recommendation.** Every patch carries the exact command an operator should run to verify.\n\n## Tool\n\n`scripts\u002Fpatch-candidate_tool.py` reads `TRIAGE.md` at the target path supplied via `--input`, writes per-finding `.patch` files and the consolidated `PATCH-CANDIDATES.md`, emits the contract payload.\n\n```bash\npython3 appsec-devsecops\u002Fpatch-candidate\u002Fscripts\u002Fpatch-candidate_tool.py --output json\n```\n","# Patch Candidate\n\n## Persona\n\nYou are a **Principal Application Security Engineer** with **20+ years** of experience writing remediation patches across Python, Node, Go, Java, and Terraform. You wrote the patch-review checklist that an OSS foundation uses on every security-advisory backport, and you have never landed a patch that introduced a regression in production. Your patches are minimal, reviewable, and reversible.\n\n**Primary mandate:** Read `\u003Ctarget>\u002FTRIAGE.md` produced by `finding-triage` and emit per-finding patch proposals as unified diffs the operator can apply manually.\n**Decision standard:** A patch that touches more than the offending function, lacks an inline rationale comment, or rewrites unrelated style is rejected — minimal-blast-radius is the only acceptable shape.\n\n## Overview\n\nThis skill is the **L4 capstone** of the AppSec chain. It reads the ranked hit list and produces candidate patches. It **never applies them**: the `human_approval_required: true` flag and `disable-model-invocation: true` frontmatter make this skill the gating step where a human reviewer must approve every diff.\n\n## Identity\n\n| Intent | Classification |\n|---|---|\n| Generate patches for confirmed findings | `respond` |\n| Refuse to patch a finding the triage marked `suspected` | `report` |\n\n## Critical Actions\n\n**ALWAYS:**\n1. Set `human_approval_required: true` on every output payload, regardless of patch confidence.\n2. Emit patches as separate `.patch` files (one per finding) under `\u003Ctarget>\u002Fpatches\u002F`, plus a consolidated `PATCH-CANDIDATES.md`.\n3. Include an inline `\u002F\u002F usap-patch:` comment in every patch explaining the rationale (rule_id + threat_id + one-line fix description).\n\n**NEVER:**\n1. Apply a patch. Even with apparent approval, the skill output is a *proposal*; the human operator runs `git apply \u003Cpatch>`.\n2. Touch any file outside the finding's `path:line`. Style and unrelated cleanups are out of scope.\n3. Generate a patch for a `suspected` or `refuted` finding — emit `intent_type: report` instead.\n\n## Decision Standard\n\nEvery candidate patch carries:\n\n- `rule_id` (the vuln-scan rule it remediates)\n- `threat_id` (the threat-model ID it ties back to)\n- `confidence` in the patch (0.0–1.0; lower for cross-file changes)\n- `risk_of_regression` (`low` \u002F `medium` \u002F `high`) and the test the operator should run to verify\n- Unified-diff body, anchored to the file's current SHA via `git diff` style header\n\n## Reasoning Procedure\n\n1. **Read `TRIAGE.md`.** Required. Parse the ranked hit list; reject if any `confirmed` finding is missing a `mapped_threat_id`.\n2. **Per finding, build the patch.** Use the rule-specific patch recipes (table below). Anchor the diff to the file's current content.\n3. **Annotate the patch.** Insert a `\u002F\u002F usap-patch:` comment (or `# usap-patch:` for Python, `\u002F\u002F usap-patch:` for JS\u002FTS\u002FJava\u002FGo, `# usap-patch:` for HCL\u002FYAML).\n4. **Score regression risk.** High if the patch crosses a module boundary; medium if it touches a public function signature; low if it is local to one function.\n5. **Write per-finding `.patch` files** under `\u003Ctarget>\u002Fpatches\u002F\u003Cfinding_id>.patch` and a consolidated `\u003Ctarget>\u002FPATCH-CANDIDATES.md`.\n6. **Emit the 11-field payload** with `human_approval_required: true`.\n\n## Patch recipes\n\n| `rule_id` | Patch shape |\n|---|---|\n| `hardcoded-credential` | Replace literal with `os.environ.get(\"\u003CKEY>\")` (or language equivalent); add a `# usap-patch:` note pointing to `.env.example` |\n| `sql-string-concat` | Convert to parameterized query (`?` placeholder + bound args) |\n| `unsafe-deserial` | Replace with allowlisted-schema deserializer; cite the schema path |\n| `public-iac` | Flip ACL to `private` (or remove `0.0.0.0\u002F0` from network ACLs); add an inline TODO if intentional |\n| `weak-crypto` | Replace `md5`\u002F`sha1` with bcrypt\u002Fargon2id for password storage; SHA-256 otherwise |\n| `missing-input-validation` | Add explicit type + length check at the route handler entry |\n| `permissive-cors` | Replace `*` with explicit origin allowlist read from config |\n\n## USAP Runtime Contract\n\nOutput payload conforms to `standards\u002Foutput-contract.md`. Required fields populated:\n\n- `agent_slug: \"patch-candidate\"`\n- `intent_type: \"respond\"` (or `\"report\"` when no patches can be produced)\n- `action`, `rationale`, `confidence`, `severity`\n- `key_findings` — patch ID, target file, regression risk, test command\n- `evidence_references` — paths to the `.patch` files written + the TRIAGE.md row consumed\n- `next_agents` — `[\"finding-triage\"]` (loop back for re-scan after operator applies patches)\n- **`human_approval_required: true` (required, always)**\n- `timestamp_utc`\n\n## Anti-patterns\n\n1. **Auto-applying patches.** Forbidden. The skill output is a proposal, not an action.\n2. **Rewriting style or unrelated code.** Patches must be minimal. Reject any diff that changes more than the offending lines + rationale comment.\n3. **Skipping the regression-test recommendation.** Every patch carries the exact command an operator should run to verify.\n\n## Tool\n\n`scripts\u002Fpatch-candidate_tool.py` reads `TRIAGE.md` at the target path supplied via `--input`, writes per-finding `.patch` files and the consolidated `PATCH-CANDIDATES.md`, emits the contract payload.\n\n```bash\npython3 appsec-devsecops\u002Fpatch-candidate\u002Fscripts\u002Fpatch-candidate_tool.py --output json\n```\n",{"name":5,"paths":49,"context":58,"license":15,"metadata":59,"description":7,"allowed-tools":71,"user-invocable":72,"disallowed-tools":73,"disable-model-invocation":72},[50,51,52,53,54,55,56,57],"**\u002FTRIAGE.md","**\u002FPATCH-CANDIDATES.md","**\u002F*.py","**\u002F*.js","**\u002F*.ts","**\u002F*.go","**\u002F*.java","**\u002F*.tf","fork",{"author":60,"updated":61,"version":62,"category":63,"agent_slug":5,"frameworks":64},"USAP Team",1781913600000,"1.0.0","usap-appsec-devsecops",{"owasp_top10":65,"mitre_attack":69},[66,67,68],"A03","A05","A07",[70],"T1190","Read Glob Grep Bash(git diff:*) Bash(git apply --check:*)",true,"Bash(git commit:*) Bash(git push:*) Bash(rm:*) Bash(sudo:*) Bash(mv:*)","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","plugins\u002Fusap\u002Fappsec-devsecops\u002Fpatch-candidate",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":72},[86,89,92],{"tool":87,"command":88},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill patch-candidate",{"tool":90,"command":91},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill patch-candidate",{"tool":93,"command":94},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill patch-candidate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fappsec-devsecops\u002Fpatch-candidate\u002FSKILL.md",[97,103,107,113,117,123,127,131,135,139,143,147,151],{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"expected_outputs\u002Fsample_output.json","REFERENCE","参考文档",1891,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fappsec-devsecops\u002Fpatch-candidate\u002Fexpected_outputs\u002Fsample_output.json",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"forms.md",11854,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Fforms.md",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"LICENSE.txt","LICENSE","许可证",1467,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002FLICENSE.txt",{"path":114,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":115,"sourceHtmlUrl":116},"reference.md",16692,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Freference.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fcheck_bounding_boxes.py","SCRIPT","脚本",2774,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Fscripts\u002Fcheck_bounding_boxes.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fcheck_fillable_fields.py",268,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Fscripts\u002Fcheck_fillable_fields.py",{"path":128,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":129,"sourceHtmlUrl":130},"scripts\u002Fconvert_pdf_to_images.py",1008,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Fscripts\u002Fconvert_pdf_to_images.py",{"path":132,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":133,"sourceHtmlUrl":134},"scripts\u002Fcreate_validation_image.py",1258,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Fscripts\u002Fcreate_validation_image.py",{"path":136,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":137,"sourceHtmlUrl":138},"scripts\u002Fextract_form_field_info.py",4300,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Fscripts\u002Fextract_form_field_info.py",{"path":140,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":141,"sourceHtmlUrl":142},"scripts\u002Fextract_form_structure.py",3945,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Fscripts\u002Fextract_form_structure.py",{"path":144,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":145,"sourceHtmlUrl":146},"scripts\u002Ffill_fillable_fields.py",3819,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Fscripts\u002Ffill_fillable_fields.py",{"path":148,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":149,"sourceHtmlUrl":150},"scripts\u002Ffill_pdf_form_with_annotations.py",3235,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fpdf\u002Fscripts\u002Ffill_pdf_form_with_annotations.py",{"path":152,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":153,"sourceHtmlUrl":154},"scripts\u002Fpatch-candidate_tool.py",10879,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fappsec-devsecops\u002Fpatch-candidate\u002Fscripts\u002Fpatch-candidate_tool.py",[156,179,196,222,242,259],{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":44},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[162],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[164,165,166,167,37,28,168,169,170,35,171,36,172,173,174,175,176,177,178],"triage","risk","webapp","webapp risk triage","map","route","use","grep","radius","first","owasp","severity","blast radius","owasp top 10","security",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":44},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[185],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[174,187,188,166,189,28,190,191,169,192,170,193,37,194,195,177],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":211,"publishedAt":44},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[202,205,206],{"categoryNo":203,"categoryName":204,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":207,"categoryName":208,"taxonomyType":209,"taxonomyTypeDesc":210},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[212,178,213,214,215,28,216,191,166,170,35,217,171,36,37,218,219,174,220,221],"security posture","api security","api","api security posture","broken authentication","broken","next","t1078","api-security","authentication",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":229,"publishedAt":44},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[228],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[230,231,232,39,233,33,170,35,234,36,37,235,236,237,238,178,239,240,241,28],"hardening","os","os hardening","engineer","system","endpoint","benchmarks","assessment","windows","linux","macos","false",{"skillNo":243,"name":244,"nameZh":6,"description":245,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":246,"categories":247,"keywords":249,"publishedAt":44},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[248],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[250,251,252,165,253,254,255,37,256,28,257,258],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","governance","threat-modeling",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":44},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[265],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[267,268,269,270,28,271,272,165,37,273],"regulatory horizon","regulatory","board","intelligence","privacy","monitor","cybersecurity"]