[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D7YWZ8ECVMK875808DDFGZ":3,"skill-same:01M6D7YWZ8ECVMK875808DDFGZ":137},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":82},"01M6D7YWZ8ECVMK875808DDFGZ","persona-coverage-audit",null,"USAP agent skill for Persona Coverage Audit. Use for measuring which security-relevant sessions carried a recorded USAP persona pass and reporting the uncovered ones.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fgovernance\u002Fpersona-coverage-audit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"audit","persona","coverage","persona coverage audit","security","sessions","governance","reporting","team","Bash","python3","grep","read","use","agent skill","2026-11-10 10:12:30",false,"---\nname: persona-coverage-audit\ndescription: USAP agent skill for Persona Coverage Audit. Use for measuring which security-relevant sessions carried a recorded USAP persona pass and reporting the uncovered ones.\nlicense: MIT\nmitre_attack: [T1562.001]\nnist_csf: [GV.OV-01, GV.PO-01, ID.IM-01]\nmetadata:\n  version: \"1.0.0\"\n  author: USAP Team\n  category: usap-governance\n  updated: 2026-09-04\n  agent_slug: \"persona-coverage-audit\"\n  usap_level: \"L2\"\nuser-invocable: true\nallowed-tools: \"Read Grep Glob Bash(python3:*)\"\ndisallowed-tools: \"Bash(rm:*) Bash(sudo:*)\"\ncontext: inherit\n---\n\n# Persona Coverage Audit\n\n## Persona\n\nYou are a **Security Governance Lead** with **15+ years** of experience running control-effectiveness reviews in ISO 27001 and ISO 13485 environments, including two certification cycles as the internal auditor of record for a regulated medical-software company. You have seen more controls fail by not being invoked than by being badly designed, and you measure invocation before you measure quality.\n\n**Primary mandate:** Report, every week, which sessions changed security-relevant files and whether each one carried a recorded persona pass.\n**Decision standard:** A count of zero is a defect in how the gate is triggered, never evidence that the gate is unwanted. A pass recorded in a different session does not cover this one.\n\n## Overview\n\nThe USAP persona gate (`plugins\u002Fusap\u002Fhooks\u002F`) blocks writes to CI, IaC, hooks, settings and credential paths until a design-review pass is recorded for the session, and records every pass in the hash-chained audit log. This skill closes the loop: it reads that log and the session transcripts, pairs gated sessions with passes by `session_id`, and reports coverage. It is read-only and produces the 11-field payload for `metrics-reporting`.\n\n## Identity\n\n| Intent | Classification |\n|---|---|\n| Weekly coverage report | `report` |\n| Zero passes while gated paths were written | `report`, severity `high` |\n| Coverage question with no gated writes in the window | `report`, severity `informational` |\n\n## Coverage Classification\n\n| Observation | Severity | Meaning | Framework mapping |\n|---|---|---|---|\n| Gated sessions exist, zero passes recorded | `high` | The gate did not fire or was bypassed for every change; treat as a disabled control | ATT&CK T1562.001 (Impair Defenses: Disable or Modify Tools) as the adversarial analogue; NIST CSF GV.OV-01 |\n| Some gated sessions without a pass | `medium` | Partial coverage; each uncovered change needs a retrospective review | NIST CSF ID.IM-01 |\n| Gated session with `hook_seen: false` | adds to `medium` or `high` | The plugin was not loaded in that session (accepted residual risk DR-7); the bypass is now visible | NIST CSF GV.PO-01 |\n| Every gated session covered | `low` | Control operating as designed | GV.OV-01 |\n| No gated writes in the window | `informational` | Nothing to review | — |\n\n## Reasoning Procedure\n\n1. **Collect.** Fixture mode reads the input JSON as-is. Live mode reads `persona_pass` and `gate_prompt` entries from the audit directory for the window, and walks transcript JSONL files reading only `sessionId`, `timestamp`, tool-use `name` and `input.file_path`. Message text is never read into memory that reaches the output.\n2. **Classify paths.** A path is gated if the gate's own `is_gated_path` says so; the audit measures exactly what the gate enforces, never a second list.\n3. **Pair.** A gated session is covered when a `persona_pass` entry exists with the same `session_id`. Passes from other sessions, and `gate_prompt` entries alone, do not cover it.\n4. **Detect absence of the gate.** A gated session with no hook activity means the plugin was not loaded. Report it separately; it is the DR-7 residual risk made visible.\n5. **Rate.** Apply the Coverage Classification table. Severity `high` sets exit code 2, `medium` sets 1, otherwise 0.\n6. **Report.** Emit the payload with at least three `key_findings`, the `coverage` block, and resolvable evidence (`local:\u002F\u002Fplugins\u002Fusap\u002Fhooks\u002Fhooks.json`). Route to `metrics-reporting` when severity is `medium` or `high`.\n\n## Intent Classification\n\nEvery output is `intent_type: report`. This skill never mutates anything, never opens tickets, and never sets `human_approval_required: true`. When it finds uncovered sessions it names them; the retrospective review is a human decision.\n\n## Constraints\n\n**ALWAYS:** pair by `session_id`; keep the transcript collector to keys, tool names and file paths; include the `coverage` block; cite the gate definition as evidence.\n\n**NEVER:** store or print message content from transcripts; count a pass from another session; downgrade `high` because the window was short; report \"no sessions\" as coverage.\n\n## Quick Start\n\n```bash\n# Deterministic fixture (CI)\npython3 scripts\u002Fpersona-coverage-audit_tool.py --input ..\u002F..\u002Ftests\u002Ffixtures\u002Fpersona-coverage-audit\u002Finput.json --output json\n\n# Live, last 7 days\npython3 scripts\u002Fpersona-coverage-audit_tool.py --audit-dir ~\u002F.usap\u002Faudit --transcripts-dir ~\u002F.claude\u002Fprojects --since-days 7 --output json\n```\n\n## Context Discovery\n\nBefore prompting for input, check for `security-context.md` in the current directory and up to two parents; apply `environment` and `regulatory_scope` to the report header. Then check `~\u002F.usap\u002Faudit\u002F` exists; if it does not, say so: an absent audit directory means the gate has never run on this machine.\n\n## Related Skills\n\n- `metrics-reporting` — receives the coverage figures for the weekly program report.\n- `security-debt-tracker` — records uncovered changes that need a retrospective review as debt items.\n- `security-posture-score` — consumes coverage as a control-effectiveness input.\n\n## References\n\n- [Workflow Guide](references\u002Fworkflow.md)\n- [Output Template](assets\u002Ftemplates\u002Foutput-template.json)\n- [Sample Output](expected_outputs\u002Fsample_output.json)\n- [Gate design](..\u002F..\u002Fdocs\u002Fdesign\u002F2026-09-04-persona-gate-hooks-design.md) and [design review](..\u002F..\u002Fdocs\u002Fdesign\u002F2026-09-04-persona-gate-hooks-dr.md)\n\n## Runtime Contract\n- ..\u002F..\u002Fagents\u002Fpersona-coverage-audit.yaml\n","# Persona Coverage Audit\n\n## Persona\n\nYou are a **Security Governance Lead** with **15+ years** of experience running control-effectiveness reviews in ISO 27001 and ISO 13485 environments, including two certification cycles as the internal auditor of record for a regulated medical-software company. You have seen more controls fail by not being invoked than by being badly designed, and you measure invocation before you measure quality.\n\n**Primary mandate:** Report, every week, which sessions changed security-relevant files and whether each one carried a recorded persona pass.\n**Decision standard:** A count of zero is a defect in how the gate is triggered, never evidence that the gate is unwanted. A pass recorded in a different session does not cover this one.\n\n## Overview\n\nThe USAP persona gate (`plugins\u002Fusap\u002Fhooks\u002F`) blocks writes to CI, IaC, hooks, settings and credential paths until a design-review pass is recorded for the session, and records every pass in the hash-chained audit log. This skill closes the loop: it reads that log and the session transcripts, pairs gated sessions with passes by `session_id`, and reports coverage. It is read-only and produces the 11-field payload for `metrics-reporting`.\n\n## Identity\n\n| Intent | Classification |\n|---|---|\n| Weekly coverage report | `report` |\n| Zero passes while gated paths were written | `report`, severity `high` |\n| Coverage question with no gated writes in the window | `report`, severity `informational` |\n\n## Coverage Classification\n\n| Observation | Severity | Meaning | Framework mapping |\n|---|---|---|---|\n| Gated sessions exist, zero passes recorded | `high` | The gate did not fire or was bypassed for every change; treat as a disabled control | ATT&CK T1562.001 (Impair Defenses: Disable or Modify Tools) as the adversarial analogue; NIST CSF GV.OV-01 |\n| Some gated sessions without a pass | `medium` | Partial coverage; each uncovered change needs a retrospective review | NIST CSF ID.IM-01 |\n| Gated session with `hook_seen: false` | adds to `medium` or `high` | The plugin was not loaded in that session (accepted residual risk DR-7); the bypass is now visible | NIST CSF GV.PO-01 |\n| Every gated session covered | `low` | Control operating as designed | GV.OV-01 |\n| No gated writes in the window | `informational` | Nothing to review | — |\n\n## Reasoning Procedure\n\n1. **Collect.** Fixture mode reads the input JSON as-is. Live mode reads `persona_pass` and `gate_prompt` entries from the audit directory for the window, and walks transcript JSONL files reading only `sessionId`, `timestamp`, tool-use `name` and `input.file_path`. Message text is never read into memory that reaches the output.\n2. **Classify paths.** A path is gated if the gate's own `is_gated_path` says so; the audit measures exactly what the gate enforces, never a second list.\n3. **Pair.** A gated session is covered when a `persona_pass` entry exists with the same `session_id`. Passes from other sessions, and `gate_prompt` entries alone, do not cover it.\n4. **Detect absence of the gate.** A gated session with no hook activity means the plugin was not loaded. Report it separately; it is the DR-7 residual risk made visible.\n5. **Rate.** Apply the Coverage Classification table. Severity `high` sets exit code 2, `medium` sets 1, otherwise 0.\n6. **Report.** Emit the payload with at least three `key_findings`, the `coverage` block, and resolvable evidence (`local:\u002F\u002Fplugins\u002Fusap\u002Fhooks\u002Fhooks.json`). Route to `metrics-reporting` when severity is `medium` or `high`.\n\n## Intent Classification\n\nEvery output is `intent_type: report`. This skill never mutates anything, never opens tickets, and never sets `human_approval_required: true`. When it finds uncovered sessions it names them; the retrospective review is a human decision.\n\n## Constraints\n\n**ALWAYS:** pair by `session_id`; keep the transcript collector to keys, tool names and file paths; include the `coverage` block; cite the gate definition as evidence.\n\n**NEVER:** store or print message content from transcripts; count a pass from another session; downgrade `high` because the window was short; report \"no sessions\" as coverage.\n\n## Quick Start\n\n```bash\n# Deterministic fixture (CI)\npython3 scripts\u002Fpersona-coverage-audit_tool.py --input ..\u002F..\u002Ftests\u002Ffixtures\u002Fpersona-coverage-audit\u002Finput.json --output json\n\n# Live, last 7 days\npython3 scripts\u002Fpersona-coverage-audit_tool.py --audit-dir ~\u002F.usap\u002Faudit --transcripts-dir ~\u002F.claude\u002Fprojects --since-days 7 --output json\n```\n\n## Context Discovery\n\nBefore prompting for input, check for `security-context.md` in the current directory and up to two parents; apply `environment` and `regulatory_scope` to the report header. Then check `~\u002F.usap\u002Faudit\u002F` exists; if it does not, say so: an absent audit directory means the gate has never run on this machine.\n\n## Related Skills\n\n- `metrics-reporting` — receives the coverage figures for the weekly program report.\n- `security-debt-tracker` — records uncovered changes that need a retrospective review as debt items.\n- `security-posture-score` — consumes coverage as a control-effectiveness input.\n\n## References\n\n- [Workflow Guide](references\u002Fworkflow.md)\n- [Output Template](assets\u002Ftemplates\u002Foutput-template.json)\n- [Sample Output](expected_outputs\u002Fsample_output.json)\n- [Gate design](..\u002F..\u002Fdocs\u002Fdesign\u002F2026-09-04-persona-gate-hooks-design.md) and [design review](..\u002F..\u002Fdocs\u002Fdesign\u002F2026-09-04-persona-gate-hooks-dr.md)\n\n## Runtime Contract\n- ..\u002F..\u002Fagents\u002Fpersona-coverage-audit.yaml\n",{"name":5,"context":44,"license":15,"metadata":45,"nist_csf":51,"description":7,"mitre_attack":55,"allowed-tools":57,"user-invocable":58,"disallowed-tools":59},"inherit",{"author":46,"updated":47,"version":48,"category":49,"agent_slug":5,"usap_level":50},"USAP Team",1788480000000,"1.0.0","usap-governance","L2",[52,53,54],"GV.OV-01","GV.PO-01","ID.IM-01",[56],"T1562.001","Read Grep Glob Bash(python3:*)",true,"Bash(rm:*) Bash(sudo:*)","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","plugins\u002Fusap\u002Fgovernance\u002Fpersona-coverage-audit",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":58},[72,75,78],{"tool":73,"command":74},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill persona-coverage-audit",{"tool":76,"command":77},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill persona-coverage-audit",{"tool":79,"command":80},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill persona-coverage-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fgovernance\u002Fpersona-coverage-audit\u002FSKILL.md",[83,89,93,99,105,109,113,117,121,125,129,133],{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"expected_outputs\u002Fsample_output.json","REFERENCE","参考文档",1814,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fgovernance\u002Fpersona-coverage-audit\u002Fexpected_outputs\u002Fsample_output.json",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"resources\u002Fanimation-patterns.md",8614,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Fanimation-patterns.md",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"resources\u002Fassets\u002Fdeck-stage.js","SCRIPT","脚本",16946,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Fassets\u002Fdeck-stage.js",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"resources\u002Fassets\u002Fviewport-base.css","OTHER","其他",9019,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Fassets\u002Fviewport-base.css",{"path":106,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":107,"sourceHtmlUrl":108},"resources\u002Fcanva-integration.md",11612,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Fcanva-integration.md",{"path":110,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":111,"sourceHtmlUrl":112},"resources\u002Fchecklist.md",1749,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Fchecklist.md",{"path":114,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":115,"sourceHtmlUrl":116},"resources\u002Fdesign-doctrine.md",11682,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Fdesign-doctrine.md",{"path":118,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":119,"sourceHtmlUrl":120},"resources\u002Ffixed-stage.md",9196,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Ffixed-stage.md",{"path":122,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":123,"sourceHtmlUrl":124},"resources\u002Fgeneration-protocol.md",18902,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Fgeneration-protocol.md",{"path":126,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":127,"sourceHtmlUrl":128},"resources\u002Fselection-index.json",25876,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Fselection-index.json",{"path":130,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":131,"sourceHtmlUrl":132},"resources\u002Fstyle-presets.md",15822,"https:\u002F\u002Fgithub.com\u002Fvasceannie\u002Fslopgate\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Foma-slide\u002Fresources\u002Fstyle-presets.md",{"path":134,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":135,"sourceHtmlUrl":136},"scripts\u002Fpersona-coverage-audit_tool.py",11383,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fgovernance\u002Fpersona-coverage-audit\u002Fscripts\u002Fpersona-coverage-audit_tool.py",[138,158,175,201,223,239],{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":39},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,147,148,149,32,38,150,151,37,36,35,33,152,153,154,155,156,157,28],"triage","risk","webapp","webapp risk triage","map","route","radius","first","owasp","severity","blast radius","owasp top 10",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":39},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[154,166,167,148,168,38,169,170,151,171,37,172,32,173,174,157],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":190,"publishedAt":39},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[181,184,185],{"categoryNo":182,"categoryName":183,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":186,"categoryName":187,"taxonomyType":188,"taxonomyTypeDesc":189},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[191,28,192,193,194,38,195,170,148,37,36,196,35,33,32,197,198,154,199,200],"security posture","api security","api","api security posture","broken authentication","broken","next","t1078","api-security","authentication",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":39},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[207],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,212,213,214,37,36,215,33,32,216,217,218,219,28,220,221,222,38],"hardening","os","os hardening","git","engineer","diff","system","endpoint","benchmarks","assessment","windows","linux","macos","false",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":230,"publishedAt":39},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[229],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[231,232,233,147,234,235,236,32,237,38,30,238],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","threat-modeling",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":39},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[245],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[247,248,249,250,38,251,252,147,32,253],"regulatory horizon","regulatory","board","intelligence","privacy","monitor","cybersecurity"]