[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D87YW4YZVFMS2ZXB09MCNX":3,"skill-same:01M6D87YW4YZVFMS2ZXB09MCNX":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":43,"repositoryHtmlUrl":44,"repositoryHomepageUrl":6,"ownerHtmlUrl":45,"ownerBlogUrl":46,"ownerDescription":47,"updatedAt":48,"install":49,"resources":62},"01M6D87YW4YZVFMS2ZXB09MCNX","springboot-security",null,"Spring Security best practices for authn\u002Fauthz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.","oabdelmaksoud\u002FSuperClaw","oabdelmaksoud","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F50699149?v=4","01M6D5CVVN778ZCDP1WHS816SP","Omar Abdelmaksoud","01M6D5CW1RHNSKCJR85GJACBFT",2,"MIT","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fspringboot-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"security","springboot security","boot","best practices","validation","security best practices","java","spring boot","services","csrf","secrets","spring","dependency","java spring","rate limiting","2026-11-10 10:12:30",false,"---\nname: springboot-security\ndescription: Spring Security best practices for authn\u002Fauthz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.\norigin: ECC\n---\n\n# Spring Boot Security Review\n\nUse when adding auth, handling input, creating endpoints, or dealing with secrets.\n\n## When to Activate\n\n- Adding authentication (JWT, OAuth2, session-based)\n- Implementing authorization (@PreAuthorize, role-based access)\n- Validating user input (Bean Validation, custom validators)\n- Configuring CORS, CSRF, or security headers\n- Managing secrets (Vault, environment variables)\n- Adding rate limiting or brute-force protection\n- Scanning dependencies for CVEs\n\n## Authentication\n\n- Prefer stateless JWT or opaque tokens with revocation list\n- Use `httpOnly`, `Secure`, `SameSite=Strict` cookies for sessions\n- Validate tokens with `OncePerRequestFilter` or resource server\n\n```java\n@Component\npublic class JwtAuthFilter extends OncePerRequestFilter {\n  private final JwtService jwtService;\n\n  public JwtAuthFilter(JwtService jwtService) {\n    this.jwtService = jwtService;\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String header = request.getHeader(HttpHeaders.AUTHORIZATION);\n    if (header != null && header.startsWith(\"Bearer \")) {\n      String token = header.substring(7);\n      Authentication auth = jwtService.authenticate(token);\n      SecurityContextHolder.getContext().setAuthentication(auth);\n    }\n    chain.doFilter(request, response);\n  }\n}\n```\n\n## Authorization\n\n- Enable method security: `@EnableMethodSecurity`\n- Use `@PreAuthorize(\"hasRole('ADMIN')\")` or `@PreAuthorize(\"@authz.canEdit(#id)\")`\n- Deny by default; expose only required scopes\n\n```java\n@RestController\n@RequestMapping(\"\u002Fapi\u002Fadmin\")\npublic class AdminController {\n\n  @PreAuthorize(\"hasRole('ADMIN')\")\n  @GetMapping(\"\u002Fusers\")\n  public List\u003CUserDto> listUsers() {\n    return userService.findAll();\n  }\n\n  @PreAuthorize(\"@authz.isOwner(#id, authentication)\")\n  @DeleteMapping(\"\u002Fusers\u002F{id}\")\n  public ResponseEntity\u003CVoid> deleteUser(@PathVariable Long id) {\n    userService.delete(id);\n    return ResponseEntity.noContent().build();\n  }\n}\n```\n\n## Input Validation\n\n- Use Bean Validation with `@Valid` on controllers\n- Apply constraints on DTOs: `@NotBlank`, `@Email`, `@Size`, custom validators\n- Sanitize any HTML with a whitelist before rendering\n\n```java\n\u002F\u002F BAD: No validation\n@PostMapping(\"\u002Fusers\")\npublic User createUser(@RequestBody UserDto dto) {\n  return userService.create(dto);\n}\n\n\u002F\u002F GOOD: Validated DTO\npublic record CreateUserDto(\n    @NotBlank @Size(max = 100) String name,\n    @NotBlank @Email String email,\n    @NotNull @Min(0) @Max(150) Integer age\n) {}\n\n@PostMapping(\"\u002Fusers\")\npublic ResponseEntity\u003CUserDto> createUser(@Valid @RequestBody CreateUserDto dto) {\n  return ResponseEntity.status(HttpStatus.CREATED)\n      .body(userService.create(dto));\n}\n```\n\n## SQL Injection Prevention\n\n- Use Spring Data repositories or parameterized queries\n- For native queries, use `:param` bindings; never concatenate strings\n\n```java\n\u002F\u002F BAD: String concatenation in native query\n@Query(value = \"SELECT * FROM users WHERE name = '\" + name + \"'\", nativeQuery = true)\n\n\u002F\u002F GOOD: Parameterized native query\n@Query(value = \"SELECT * FROM users WHERE name = :name\", nativeQuery = true)\nList\u003CUser> findByName(@Param(\"name\") String name);\n\n\u002F\u002F GOOD: Spring Data derived query (auto-parameterized)\nList\u003CUser> findByEmailAndActiveTrue(String email);\n```\n\n## Password Encoding\n\n- Always hash passwords with BCrypt or Argon2 — never store plaintext\n- Use `PasswordEncoder` bean, not manual hashing\n\n```java\n@Bean\npublic PasswordEncoder passwordEncoder() {\n  return new BCryptPasswordEncoder(12); \u002F\u002F cost factor 12\n}\n\n\u002F\u002F In service\npublic User register(CreateUserDto dto) {\n  String hashedPassword = passwordEncoder.encode(dto.password());\n  return userRepository.save(new User(dto.email(), hashedPassword));\n}\n```\n\n## CSRF Protection\n\n- For browser session apps, keep CSRF enabled; include token in forms\u002Fheaders\n- For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth\n\n```java\nhttp\n  .csrf(csrf -> csrf.disable())\n  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));\n```\n\n## Secrets Management\n\n- No secrets in source; load from env or vault\n- Keep `application.yml` free of credentials; use placeholders\n- Rotate tokens and DB credentials regularly\n\n```yaml\n# BAD: Hardcoded in application.yml\nspring:\n  datasource:\n    password: mySecretPassword123\n\n# GOOD: Environment variable placeholder\nspring:\n  datasource:\n    password: ${DB_PASSWORD}\n\n# GOOD: Spring Cloud Vault integration\nspring:\n  cloud:\n    vault:\n      uri: https:\u002F\u002Fvault.example.com\n      token: ${VAULT_TOKEN}\n```\n\n## Security Headers\n\n```java\nhttp\n  .headers(headers -> headers\n    .contentSecurityPolicy(csp -> csp\n      .policyDirectives(\"default-src 'self'\"))\n    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)\n    .xssProtection(Customizer.withDefaults())\n    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));\n```\n\n## CORS Configuration\n\n- Configure CORS at the security filter level, not per-controller\n- Restrict allowed origins — never use `*` in production\n\n```java\n@Bean\npublic CorsConfigurationSource corsConfigurationSource() {\n  CorsConfiguration config = new CorsConfiguration();\n  config.setAllowedOrigins(List.of(\"https:\u002F\u002Fapp.example.com\"));\n  config.setAllowedMethods(List.of(\"GET\", \"POST\", \"PUT\", \"DELETE\"));\n  config.setAllowedHeaders(List.of(\"Authorization\", \"Content-Type\"));\n  config.setAllowCredentials(true);\n  config.setMaxAge(3600L);\n\n  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n  source.registerCorsConfiguration(\"\u002Fapi\u002F**\", config);\n  return source;\n}\n\n\u002F\u002F In SecurityFilterChain:\nhttp.cors(cors -> cors.configurationSource(corsConfigurationSource()));\n```\n\n## Rate Limiting\n\n- Apply Bucket4j or gateway-level limits on expensive endpoints\n- Log and alert on bursts; return 429 with retry hints\n\n```java\n\u002F\u002F Using Bucket4j for per-endpoint rate limiting\n@Component\npublic class RateLimitFilter extends OncePerRequestFilter {\n  private final Map\u003CString, Bucket> buckets = new ConcurrentHashMap\u003C>();\n\n  private Bucket createBucket() {\n    return Bucket.builder()\n        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))\n        .build();\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String clientIp = request.getRemoteAddr();\n    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());\n\n    if (bucket.tryConsume(1)) {\n      chain.doFilter(request, response);\n    } else {\n      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());\n      response.getWriter().write(\"{\\\"error\\\": \\\"Rate limit exceeded\\\"}\");\n    }\n  }\n}\n```\n\n## Dependency Security\n\n- Run OWASP Dependency Check \u002F Snyk in CI\n- Keep Spring Boot and Spring Security on supported versions\n- Fail builds on known CVEs\n\n## Logging and PII\n\n- Never log secrets, tokens, passwords, or full PAN data\n- Redact sensitive fields; use structured JSON logging\n\n## File Uploads\n\n- Validate size, content type, and extension\n- Store outside web root; scan if required\n\n## Checklist Before Release\n\n- [ ] Auth tokens validated and expired correctly\n- [ ] Authorization guards on every sensitive path\n- [ ] All inputs validated and sanitized\n- [ ] No string-concatenated SQL\n- [ ] CSRF posture correct for app type\n- [ ] Secrets externalized; none committed\n- [ ] Security headers configured\n- [ ] Rate limiting on APIs\n- [ ] Dependencies scanned and up to date\n- [ ] Logs free of sensitive data\n\n**Remember**: Deny by default, validate inputs, least privilege, and secure-by-configuration first.\n","# Spring Boot Security Review\n\nUse when adding auth, handling input, creating endpoints, or dealing with secrets.\n\n## When to Activate\n\n- Adding authentication (JWT, OAuth2, session-based)\n- Implementing authorization (@PreAuthorize, role-based access)\n- Validating user input (Bean Validation, custom validators)\n- Configuring CORS, CSRF, or security headers\n- Managing secrets (Vault, environment variables)\n- Adding rate limiting or brute-force protection\n- Scanning dependencies for CVEs\n\n## Authentication\n\n- Prefer stateless JWT or opaque tokens with revocation list\n- Use `httpOnly`, `Secure`, `SameSite=Strict` cookies for sessions\n- Validate tokens with `OncePerRequestFilter` or resource server\n\n```java\n@Component\npublic class JwtAuthFilter extends OncePerRequestFilter {\n  private final JwtService jwtService;\n\n  public JwtAuthFilter(JwtService jwtService) {\n    this.jwtService = jwtService;\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String header = request.getHeader(HttpHeaders.AUTHORIZATION);\n    if (header != null && header.startsWith(\"Bearer \")) {\n      String token = header.substring(7);\n      Authentication auth = jwtService.authenticate(token);\n      SecurityContextHolder.getContext().setAuthentication(auth);\n    }\n    chain.doFilter(request, response);\n  }\n}\n```\n\n## Authorization\n\n- Enable method security: `@EnableMethodSecurity`\n- Use `@PreAuthorize(\"hasRole('ADMIN')\")` or `@PreAuthorize(\"@authz.canEdit(#id)\")`\n- Deny by default; expose only required scopes\n\n```java\n@RestController\n@RequestMapping(\"\u002Fapi\u002Fadmin\")\npublic class AdminController {\n\n  @PreAuthorize(\"hasRole('ADMIN')\")\n  @GetMapping(\"\u002Fusers\")\n  public List\u003CUserDto> listUsers() {\n    return userService.findAll();\n  }\n\n  @PreAuthorize(\"@authz.isOwner(#id, authentication)\")\n  @DeleteMapping(\"\u002Fusers\u002F{id}\")\n  public ResponseEntity\u003CVoid> deleteUser(@PathVariable Long id) {\n    userService.delete(id);\n    return ResponseEntity.noContent().build();\n  }\n}\n```\n\n## Input Validation\n\n- Use Bean Validation with `@Valid` on controllers\n- Apply constraints on DTOs: `@NotBlank`, `@Email`, `@Size`, custom validators\n- Sanitize any HTML with a whitelist before rendering\n\n```java\n\u002F\u002F BAD: No validation\n@PostMapping(\"\u002Fusers\")\npublic User createUser(@RequestBody UserDto dto) {\n  return userService.create(dto);\n}\n\n\u002F\u002F GOOD: Validated DTO\npublic record CreateUserDto(\n    @NotBlank @Size(max = 100) String name,\n    @NotBlank @Email String email,\n    @NotNull @Min(0) @Max(150) Integer age\n) {}\n\n@PostMapping(\"\u002Fusers\")\npublic ResponseEntity\u003CUserDto> createUser(@Valid @RequestBody CreateUserDto dto) {\n  return ResponseEntity.status(HttpStatus.CREATED)\n      .body(userService.create(dto));\n}\n```\n\n## SQL Injection Prevention\n\n- Use Spring Data repositories or parameterized queries\n- For native queries, use `:param` bindings; never concatenate strings\n\n```java\n\u002F\u002F BAD: String concatenation in native query\n@Query(value = \"SELECT * FROM users WHERE name = '\" + name + \"'\", nativeQuery = true)\n\n\u002F\u002F GOOD: Parameterized native query\n@Query(value = \"SELECT * FROM users WHERE name = :name\", nativeQuery = true)\nList\u003CUser> findByName(@Param(\"name\") String name);\n\n\u002F\u002F GOOD: Spring Data derived query (auto-parameterized)\nList\u003CUser> findByEmailAndActiveTrue(String email);\n```\n\n## Password Encoding\n\n- Always hash passwords with BCrypt or Argon2 — never store plaintext\n- Use `PasswordEncoder` bean, not manual hashing\n\n```java\n@Bean\npublic PasswordEncoder passwordEncoder() {\n  return new BCryptPasswordEncoder(12); \u002F\u002F cost factor 12\n}\n\n\u002F\u002F In service\npublic User register(CreateUserDto dto) {\n  String hashedPassword = passwordEncoder.encode(dto.password());\n  return userRepository.save(new User(dto.email(), hashedPassword));\n}\n```\n\n## CSRF Protection\n\n- For browser session apps, keep CSRF enabled; include token in forms\u002Fheaders\n- For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth\n\n```java\nhttp\n  .csrf(csrf -> csrf.disable())\n  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));\n```\n\n## Secrets Management\n\n- No secrets in source; load from env or vault\n- Keep `application.yml` free of credentials; use placeholders\n- Rotate tokens and DB credentials regularly\n\n```yaml\n# BAD: Hardcoded in application.yml\nspring:\n  datasource:\n    password: mySecretPassword123\n\n# GOOD: Environment variable placeholder\nspring:\n  datasource:\n    password: ${DB_PASSWORD}\n\n# GOOD: Spring Cloud Vault integration\nspring:\n  cloud:\n    vault:\n      uri: https:\u002F\u002Fvault.example.com\n      token: ${VAULT_TOKEN}\n```\n\n## Security Headers\n\n```java\nhttp\n  .headers(headers -> headers\n    .contentSecurityPolicy(csp -> csp\n      .policyDirectives(\"default-src 'self'\"))\n    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)\n    .xssProtection(Customizer.withDefaults())\n    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));\n```\n\n## CORS Configuration\n\n- Configure CORS at the security filter level, not per-controller\n- Restrict allowed origins — never use `*` in production\n\n```java\n@Bean\npublic CorsConfigurationSource corsConfigurationSource() {\n  CorsConfiguration config = new CorsConfiguration();\n  config.setAllowedOrigins(List.of(\"https:\u002F\u002Fapp.example.com\"));\n  config.setAllowedMethods(List.of(\"GET\", \"POST\", \"PUT\", \"DELETE\"));\n  config.setAllowedHeaders(List.of(\"Authorization\", \"Content-Type\"));\n  config.setAllowCredentials(true);\n  config.setMaxAge(3600L);\n\n  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n  source.registerCorsConfiguration(\"\u002Fapi\u002F**\", config);\n  return source;\n}\n\n\u002F\u002F In SecurityFilterChain:\nhttp.cors(cors -> cors.configurationSource(corsConfigurationSource()));\n```\n\n## Rate Limiting\n\n- Apply Bucket4j or gateway-level limits on expensive endpoints\n- Log and alert on bursts; return 429 with retry hints\n\n```java\n\u002F\u002F Using Bucket4j for per-endpoint rate limiting\n@Component\npublic class RateLimitFilter extends OncePerRequestFilter {\n  private final Map\u003CString, Bucket> buckets = new ConcurrentHashMap\u003C>();\n\n  private Bucket createBucket() {\n    return Bucket.builder()\n        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))\n        .build();\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String clientIp = request.getRemoteAddr();\n    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());\n\n    if (bucket.tryConsume(1)) {\n      chain.doFilter(request, response);\n    } else {\n      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());\n      response.getWriter().write(\"{\\\"error\\\": \\\"Rate limit exceeded\\\"}\");\n    }\n  }\n}\n```\n\n## Dependency Security\n\n- Run OWASP Dependency Check \u002F Snyk in CI\n- Keep Spring Boot and Spring Security on supported versions\n- Fail builds on known CVEs\n\n## Logging and PII\n\n- Never log secrets, tokens, passwords, or full PAN data\n- Redact sensitive fields; use structured JSON logging\n\n## File Uploads\n\n- Validate size, content type, and extension\n- Store outside web root; scan if required\n\n## Checklist Before Release\n\n- [ ] Auth tokens validated and expired correctly\n- [ ] Authorization guards on every sensitive path\n- [ ] All inputs validated and sanitized\n- [ ] No string-concatenated SQL\n- [ ] CSRF posture correct for app type\n- [ ] Secrets externalized; none committed\n- [ ] Security headers configured\n- [ ] Rate limiting on APIs\n- [ ] Dependencies scanned and up to date\n- [ ] Logs free of sensitive data\n\n**Remember**: Deny by default, validate inputs, least privilege, and secure-by-configuration first.\n",{"name":5,"origin":39,"description":7},"ECC","main","7b610356e36623652299fa2acb477ff821b1d920","upstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fspringboot-security",0,"https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fo-abdelmaksoud\u002F","Full-Stack Engineer | AI Systems Architect | Building autonomous multi-agent systems","2026-03-08 21:12:53",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add oabdelmaksoud\u002FSuperClaw --skill springboot-security",{"tool":55,"command":56},"bunx","bunx skills add oabdelmaksoud\u002FSuperClaw --skill springboot-security",{"tool":58,"command":59},"pnpm","pnpm dlx skills add oabdelmaksoud\u002FSuperClaw --skill springboot-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fspringboot-security\u002FSKILL.md",true,[63,69,73,77,81,85,89,93],{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"research.template.md","REFERENCE","参考文档",581,"https:\u002F\u002Fgithub.com\u002FCanVc\u002Fdoc-chat\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbmad-market-research\u002Fresearch.template.md",{"path":70,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":71,"sourceHtmlUrl":72},"steps\u002Fstep-01-init.md",6422,"https:\u002F\u002Fgithub.com\u002FCanVc\u002Fdoc-chat\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbmad-market-research\u002Fsteps\u002Fstep-01-init.md",{"path":74,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":75,"sourceHtmlUrl":76},"steps\u002Fstep-02-customer-behavior.md",9265,"https:\u002F\u002Fgithub.com\u002FCanVc\u002Fdoc-chat\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbmad-market-research\u002Fsteps\u002Fstep-02-customer-behavior.md",{"path":78,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":79,"sourceHtmlUrl":80},"steps\u002Fstep-03-customer-pain-points.md",9581,"https:\u002F\u002Fgithub.com\u002FCanVc\u002Fdoc-chat\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbmad-market-research\u002Fsteps\u002Fstep-03-customer-pain-points.md",{"path":82,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":83,"sourceHtmlUrl":84},"steps\u002Fstep-04-customer-decisions.md",10020,"https:\u002F\u002Fgithub.com\u002FCanVc\u002Fdoc-chat\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbmad-market-research\u002Fsteps\u002Fstep-04-customer-decisions.md",{"path":86,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":87,"sourceHtmlUrl":88},"steps\u002Fstep-05-competitive-analysis.md",5756,"https:\u002F\u002Fgithub.com\u002FCanVc\u002Fdoc-chat\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbmad-market-research\u002Fsteps\u002Fstep-05-competitive-analysis.md",{"path":90,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":91,"sourceHtmlUrl":92},"steps\u002Fstep-06-research-completion.md",19146,"https:\u002F\u002Fgithub.com\u002FCanVc\u002Fdoc-chat\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbmad-market-research\u002Fsteps\u002Fstep-06-research-completion.md",{"path":94,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":95,"sourceHtmlUrl":96},"workflow.md",2348,"https:\u002F\u002Fgithub.com\u002FCanVc\u002Fdoc-chat\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbmad-market-research\u002Fworkflow.md",[98,119,133,164,189,207],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":109,"publishedAt":34},"01M6D88QCPTBZVCRED0NZ1Y8K8","visa-doc-translate","Translate visa application documents (images) to English and create a bilingual PDF with original and translation","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fvisa-doc-translate\u002FSKILL.md",[104],{"categoryNo":105,"categoryName":106,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",[110,111,112,113,114,115,116,117,118],"translate","doc","visa doc translate","translation","application","create","images","PDF","documents",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":34},"01M6D88NBM95T3TFM50CYYAP65","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fverification-loop\u002FSKILL.md",[],[126,127,128,129,130,131,132],"verification","loop","verification loop","sessions","code","claude code sessions","system",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":150,"publishedAt":34},"01M6D88JFZ2P996GVRHJNSZSTM","tdd-workflow","Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Ftdd-workflow\u002FSKILL.md",[139,142,145],{"categoryNo":140,"categoryName":141,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":143,"categoryName":144,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[151,152,153,154,155,156,130,157,158,159,160,161,162,163],"tdd","workflow","tdd workflow","e2e tests","e2e","integration","development","use","test","refactoring","coverage","tests","writing",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":34},"01M6D88FTHRRSVJMXF2G7MQAK3","swiftui-patterns","SwiftUI architecture patterns, state management with @Observable, view composition, navigation, performance optimization, and modern iOS\u002FmacOS UI best practices.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fswiftui-patterns\u002FSKILL.md",[],[171,172,173,174,175,176,177,22,178,179,180,181,182,183,184,185,186,187,188],"patterns","swiftui","swiftui patterns","architecture","macos","performance","state management","state","ui","Optimization","ios","architecture patterns","Composition","performance optimization","view","management","swiftui architecture","navigation",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":34},"01M6D88D527QTQT9DKHTRFN6EA","swift-protocol-di-testing","Protocol-based dependency injection for testable Swift code — mock file system, network, and external APIs using focused protocols and Swift Testing.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fswift-protocol-di-testing\u002FSKILL.md",[195],{"categoryNo":140,"categoryName":141,"taxonomyType":107,"taxonomyTypeDesc":108},[197,198,199,200,130,201,202,203,204,132,31,205,206],"swift protocol di testing","protocol","swift","testing","protocols","file","network","injection","swift testing","dependency injection",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":213,"publishedAt":34},"01M6D88AJW8H2QNWSW5ZY82R43","swift-concurrency-6-2","Swift 6.2 Approachable Concurrency — single-threaded by default, @concurrent for explicit background offloading, isolated conformances for main actor types.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FSuperClaw\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fswift-concurrency-6-2\u002FSKILL.md",[],[214,215,199,216,217,40],"concurrency","swift concurrency","swift concurrency 6 2","default"]