[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DFAC1BSPEMQ2XXRN6EBCJJ":3,"skill-same:01M6DFAC1BSPEMQ2XXRN6EBCJJ":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6DFAC1BSPEMQ2XXRN6EBCJJ","dependabot-security-updates",null,"Standard procedure for responding to Dependabot security alerts and running weekly security audits (Dependabot + pip-audit + npm audit + Go + code patterns + config hardening) in the Hermes Agent fork (zapabob\u002Fhermes-agent). Cron-safe read-only scan mode available.","zapabob\u002FSkills","zapabob","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130830376?v=4","01M6DBMYZAGRTFQDSQYW3W764P","峯岸 亮","01M6DBMZ3GKDSJ01NZ9XTZD7JD",2,"MIT","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Farchive\u002Fskill-md-reviewed\u002Fsha256\u002F49\u002F49c4ab1be6a64115189dd44fcb6ce56f68308b87438c1700fa28badd6ceca2a9\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"dependabot security updates","security","dependabot","cron","alerts","scan","patterns","only","read","hermes agent","hermes","pip-audit","safe","hardening","audit","npm","code","config","security alerts","go","2026-11-10 10:12:30",false,"---\r\nname: dependabot-security-updates\r\ndescription: Standard procedure for responding to Dependabot security alerts and running weekly security audits (Dependabot + pip-audit + npm audit + Go + code patterns + config hardening) in the Hermes Agent fork (zapabob\u002Fhermes-agent). Cron-safe read-only scan mode available.\r\nversion: 1.0.0\r\nauthor: Hermes Agent\r\nlicense: MIT\r\n---\r\n\r\n# Dependabot Security Updates Response Skill\r\n\r\n## Purpose\r\nStandard procedure for responding to Dependabot security alerts in the Hermes Agent fork (zapabob\u002Fhermes-agent). This skill ensures CVEs are addressed promptly by updating dependencies in lockfiles and configuration files, then verifying the alert count decreases.\r\n\r\n## When to Use\r\n- When Dependabot alerts appear for the repository\r\n- After a security scan reveals new CVEs in dependencies\r\n- As part of routine security maintenance\r\n\r\n## Steps\r\n\r\n### 1. Check Current Alerts\r\n```bash\r\ngh api repos\u002Fzapabob\u002Fhermes-agent\u002Fdependabot\u002Falerts --jq '[.[] | select(.state == \"open\")] | length'\r\n```\r\n*Note the count and details of open alerts.*\r\n\r\n### 2. Examine Specific Alerts (Optional)\r\nTo get details on a specific alert number:\r\n```bash\r\ngh api repos\u002Fzapabob\u002Fhermes-agent\u002Fdependabot\u002Falerts\u002F\u003CNUMBER> --jq '{number:.number, package:.dependency.package.name, severity:.security_advisory.severity, summary:.security_advisory.summary}'\r\n```\r\n\r\n### 3. Update Python Dependencies (if any alerts involve pip packages)\r\n- Edit `pyproject.toml`:\r\n  - For packages in `[project.dependencies]`: bump version directly.\r\n  - For packages in `[tool.uv] override-dependencies`: change to exact patched version (e.g., `\"pillow==12.3.0\"`).\r\n- Run `uv lock` to update `uv.lock`.\r\n- Commit changes:\r\n  ```bash\r\n  git add pyproject.toml uv.lock\r\n  git commit -m \"chore(deps): fix CVE-XXXX-XXXX by updating \u003Cpackage> to \u003Cversion>\"\r\n  ```\r\n\r\n### 4. Update JavaScript\u002FTypeScript Dependencies (if any alerts involve npm packages)\r\n- Identify which workspace\u002Fpackage.json contains the vulnerable package (commonly `apps\u002F`, `web\u002F`, `ui-tui\u002F`, or plugins).\r\n- Update the version in the appropriate `package.json`.\r\n- Run `npm install --workspace \u003Cworkspace>` or `npm install` at the workspace root.\r\n- Commit `package.json` and `package-lock.json` (or relevant lockfile).\r\n  ```bash\r\n  git add \u003Cpath>\u002Fpackage.json \u003Cpath>\u002Fpackage-lock.json\r\n  git commit -m \"chore(deps): fix CVE-XXXX-XXXX by updating \u003Cpackage> to \u003Cversion>\"\r\n  ```\r\n\r\n### 5. Update Go Dependencies (if any alerts involve Go modules)\r\n- Locate the affected `go.mod` (often in `scripts\u002Fwindows\u002Fwatchdog-go\u002F` or similar).\r\n- Run `go get \u003Cpackage>@\u003Cversion>` or `go mod tidy`.\r\n- Commit `go.mod` and `go.sum`.\r\n  ```bash\r\n  git add go.mod go.sum\r\n  git commit -m \"chore(deps): fix CVE-XXXX-XXXX by updating \u003Cmodule> to \u003Cversion>\"\r\n  ```\r\n\r\n### 6. Update Other Lockfiles (as needed)\r\n- For any other lockfiles (e.g., `poetry.lock`, `yarn.lock`), follow the ecosystem's standard update procedure.\r\n- Commit changes.\r\n\r\n### 7. Push Changes\r\n```bash\r\ngit push origin main\r\n```\r\n\r\n### 8. Verify Alert Reduction\r\nAfter GitHub processes the push (may take a few minutes), re-check open alerts:\r\n```bash\r\ngh api repos\u002Fzapabob\u002Fhermes-agent\u002Fdependabot\u002Falerts --jq '[.[] | select(.state == \"open\")] | length'\r\n```\r\n- If count decreased, proceed.\r\n- If not, verify the updated version actually resolves the CVE and possibly open a pull request for review.\r\n\r\n### 9. Commit Message Convention\r\nUse `chore(deps): \u003Cdescription>` for dependency security updates.\r\nInclude CVE ID or GHSA ID in the commit body if helpful.\r\n\r\n## Verification\r\n- Ensure the project still builds and passes basic tests after updates.\r\n- For UI-related changes, run relevant lint\u002Ftest scripts if time permits.\r\n- Confirm no new alerts were introduced by the update (re-check after push).\r\n\r\n## Pitfalls\r\n- Forgetting to update lockfiles after changing version specs -> run appropriate lock command.\r\n- Updating only in one workspace when the dependency is duplicated -> check all workspaces.\r\n- Using version ranges that don't actually include the fix -> use exact version when possible for security patches.\r\n- Not pushing to the correct branch -> ensure you're on `main` unless working on a feature branch that will be merged soon.\r\n\r\n## Example\r\nAfter discovering a high-severity CVE in Pillow:\r\n1. Edited `pyproject.toml` under `tool.uv.override-dependencies`: changed `\"pillow>=12.2.0\",` to `\"pillow==12.3.0\",`.\r\n2. Ran `uv lock`.\r\n3. Committed and pushed.\r\n4. Verified the specific alert for GHSA-9hw9-ch79-4vh6 closed.\r\n\r\n## Weekly Audit Scan (Read-Only, Cron-Safe)\r\n\r\nFor scheduled cron jobs or manual audit-only runs — no fixes applied, just scan\r\nall ecosystems and produce a severity-grouped report. This is safe to run\r\nautonomously: read-only, no git changes, no approval needed.\r\n\r\n### Multi-Ecosystem Scan Sequence\r\n\r\n1. **Dependabot alerts** (GraphQL\u002FREST via `gh api`) — grouped by ecosystem+severity\r\n2. **pip-audit** — local Python package CVEs not tracked by GitHub Dependabot\r\n3. **npm audit** — root + each workspace (apps\u002F*, web, ui-tui, website, plugins)\r\n4. **Go** — `go build` verification on watchdog-go module\r\n5. **Code patterns** — `shell=True`, `eval()`, `exec()`, `subprocess` usage\r\n6. **Secret scanning** — regex for API keys\u002Ftokens in source files\r\n7. **Config hardening** — review `.hermes\u002Fconfig.yaml` security-relevant settings\r\n\r\n### pip-audit JSON Parsing (Windows\u002FMSYS)\r\n\r\n`jq` is often unavailable on Windows MSYS. Use `py -3 -m pip_audit --desc --format=json`\r\nand parse with Python's `json.loads` instead of `--jq`:\r\n\r\n```python\r\nimport json, subprocess\r\nresult = subprocess.run(\r\n    [\"py\", \"-3\", \"-m\", \"pip_audit\", \"--desc\", \"--format=json\"],\r\n    capture_output=True, text=True\r\n)\r\n# pip_audit prints a WARNING line before the JSON — find the first '{'\r\nlines = result.stdout.strip().split('\\n')\r\njson_start = next(i for i, l in enumerate(lines) if l.strip().startswith('{'))\r\ndata = json.loads('\\n'.join(lines[json_start:]))\r\n\r\n# Deduplicate by vuln ID (same vuln hits multiple packages)\r\nfrom collections import defaultdict\r\nby_pkg = defaultdict(list)\r\nfor dep in data.get(\"dependencies\", []):\r\n    seen_ids = set()\r\n    for v in dep.get(\"vulns\", []):\r\n        if v[\"id\"] not in seen_ids:\r\n            seen_ids.add(v[\"id\"])\r\n            by_pkg[dep[\"name\"]].append({\r\n                \"id\": v[\"id\"], \"fix\": \", \".join(v.get(\"fix_versions\", [])) or \"NO FIX\",\r\n                \"aliases\": \", \".join(v.get(\"aliases\", []))\r\n            })\r\n```\r\n\r\nKey: use `py -3` (not `python` or `pip-audit` directly) on Windows — the\r\n`python` entry in PATH is the WindowsApps store stub.\r\n\r\n### Stale Go Dependabot Alerts\r\n\r\nGo Dependabot alerts can persist even when `go.mod` already exceeds the fix\r\nfloor (e.g., `golang.org\u002Fx\u002Fcrypto v0.54.0` fixes all `\u003C 0.52.0` alerts but\r\nDependabot still shows 23 open). For fork-only Go modules (e.g.,\r\n`scripts\u002Fwindows\u002Fwatchdog-go\u002F` which is not part of the upstream dependency\r\nsurface), these alerts should be dismissed or ignored — they are not actionable.\r\n\r\nVerify with:\r\n```sh\r\ncd scripts\u002Fwindows\u002Fwatchdog-go && go build . 2>&1  # should exit 0\r\n```\r\n\r\n### System venv vs pyproject.toml Pins\r\n\r\n`pyproject.toml` pins may be correct (e.g., `Pillow==12.3.0`, `starlette==1.3.1`)\r\nwhile the system venv still has older versions installed. pip-audit scans the\r\n**installed** environment, not the lockfile. A `uv sync` is needed to propagate\r\nlockfile pins into the active venv. Don't confuse pip-audit findings with\r\npyproject.toml pin correctness — check both.\r\n\r\n### Report Format (for cron delivery)\r\n\r\nStructure the report as:\r\n1. **Summary table** — ecosystem × severity matrix\r\n2. **CRITICAL** — package, CVE, fix version, one-line risk description\r\n3. **HIGH** — same, tabular\r\n4. **Actions taken** — what was fixed this run (npm audit fix, uv lock --upgrade, etc.)\r\n5. **Remediation priorities** — immediate \u002F short-term \u002F monitoring\r\n\r\nKeep it concise — critical\u002Fhigh only for the body; medium\u002Flow counts in the summary.\r\n\r\n## References\r\n- Hermes dependency management: see `pyproject.toml` and workspace `package.json` files.\r\n- GitHub Dependabot documentation: https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fdependabot\u002Fdependabot-alerts\u002Fabout-dependabot-alerts\r\n- See `references\u002Ffork-workflow.md` in the bundled `dependabot-security-fix` skill for the exact fork PR command sequence and alert-grouping recipes.\r\n- See `references\u002Fdaily-vuln-scan-recipe.md` in the bundled `dependabot-security-fix` skill for the read-only multi-repo scanning recipe.\r\n- See `references\u002Fweekly-audit-cron-recipe.md` in this skill for the step-by-step Windows\u002FMSYS weekly audit cron recipe (pip-audit JSON parsing, npm workspace scan, Go build verification, code pattern checks, config hardening review).","# Dependabot Security Updates Response Skill\r\n\r\n## Purpose\r\nStandard procedure for responding to Dependabot security alerts in the Hermes Agent fork (zapabob\u002Fhermes-agent). This skill ensures CVEs are addressed promptly by updating dependencies in lockfiles and configuration files, then verifying the alert count decreases.\r\n\r\n## When to Use\r\n- When Dependabot alerts appear for the repository\r\n- After a security scan reveals new CVEs in dependencies\r\n- As part of routine security maintenance\r\n\r\n## Steps\r\n\r\n### 1. Check Current Alerts\r\n```bash\r\ngh api repos\u002Fzapabob\u002Fhermes-agent\u002Fdependabot\u002Falerts --jq '[.[] | select(.state == \"open\")] | length'\r\n```\r\n*Note the count and details of open alerts.*\r\n\r\n### 2. Examine Specific Alerts (Optional)\r\nTo get details on a specific alert number:\r\n```bash\r\ngh api repos\u002Fzapabob\u002Fhermes-agent\u002Fdependabot\u002Falerts\u002F\u003CNUMBER> --jq '{number:.number, package:.dependency.package.name, severity:.security_advisory.severity, summary:.security_advisory.summary}'\r\n```\r\n\r\n### 3. Update Python Dependencies (if any alerts involve pip packages)\r\n- Edit `pyproject.toml`:\r\n  - For packages in `[project.dependencies]`: bump version directly.\r\n  - For packages in `[tool.uv] override-dependencies`: change to exact patched version (e.g., `\"pillow==12.3.0\"`).\r\n- Run `uv lock` to update `uv.lock`.\r\n- Commit changes:\r\n  ```bash\r\n  git add pyproject.toml uv.lock\r\n  git commit -m \"chore(deps): fix CVE-XXXX-XXXX by updating \u003Cpackage> to \u003Cversion>\"\r\n  ```\r\n\r\n### 4. Update JavaScript\u002FTypeScript Dependencies (if any alerts involve npm packages)\r\n- Identify which workspace\u002Fpackage.json contains the vulnerable package (commonly `apps\u002F`, `web\u002F`, `ui-tui\u002F`, or plugins).\r\n- Update the version in the appropriate `package.json`.\r\n- Run `npm install --workspace \u003Cworkspace>` or `npm install` at the workspace root.\r\n- Commit `package.json` and `package-lock.json` (or relevant lockfile).\r\n  ```bash\r\n  git add \u003Cpath>\u002Fpackage.json \u003Cpath>\u002Fpackage-lock.json\r\n  git commit -m \"chore(deps): fix CVE-XXXX-XXXX by updating \u003Cpackage> to \u003Cversion>\"\r\n  ```\r\n\r\n### 5. Update Go Dependencies (if any alerts involve Go modules)\r\n- Locate the affected `go.mod` (often in `scripts\u002Fwindows\u002Fwatchdog-go\u002F` or similar).\r\n- Run `go get \u003Cpackage>@\u003Cversion>` or `go mod tidy`.\r\n- Commit `go.mod` and `go.sum`.\r\n  ```bash\r\n  git add go.mod go.sum\r\n  git commit -m \"chore(deps): fix CVE-XXXX-XXXX by updating \u003Cmodule> to \u003Cversion>\"\r\n  ```\r\n\r\n### 6. Update Other Lockfiles (as needed)\r\n- For any other lockfiles (e.g., `poetry.lock`, `yarn.lock`), follow the ecosystem's standard update procedure.\r\n- Commit changes.\r\n\r\n### 7. Push Changes\r\n```bash\r\ngit push origin main\r\n```\r\n\r\n### 8. Verify Alert Reduction\r\nAfter GitHub processes the push (may take a few minutes), re-check open alerts:\r\n```bash\r\ngh api repos\u002Fzapabob\u002Fhermes-agent\u002Fdependabot\u002Falerts --jq '[.[] | select(.state == \"open\")] | length'\r\n```\r\n- If count decreased, proceed.\r\n- If not, verify the updated version actually resolves the CVE and possibly open a pull request for review.\r\n\r\n### 9. Commit Message Convention\r\nUse `chore(deps): \u003Cdescription>` for dependency security updates.\r\nInclude CVE ID or GHSA ID in the commit body if helpful.\r\n\r\n## Verification\r\n- Ensure the project still builds and passes basic tests after updates.\r\n- For UI-related changes, run relevant lint\u002Ftest scripts if time permits.\r\n- Confirm no new alerts were introduced by the update (re-check after push).\r\n\r\n## Pitfalls\r\n- Forgetting to update lockfiles after changing version specs -> run appropriate lock command.\r\n- Updating only in one workspace when the dependency is duplicated -> check all workspaces.\r\n- Using version ranges that don't actually include the fix -> use exact version when possible for security patches.\r\n- Not pushing to the correct branch -> ensure you're on `main` unless working on a feature branch that will be merged soon.\r\n\r\n## Example\r\nAfter discovering a high-severity CVE in Pillow:\r\n1. Edited `pyproject.toml` under `tool.uv.override-dependencies`: changed `\"pillow>=12.2.0\",` to `\"pillow==12.3.0\",`.\r\n2. Ran `uv lock`.\r\n3. Committed and pushed.\r\n4. Verified the specific alert for GHSA-9hw9-ch79-4vh6 closed.\r\n\r\n## Weekly Audit Scan (Read-Only, Cron-Safe)\r\n\r\nFor scheduled cron jobs or manual audit-only runs — no fixes applied, just scan\r\nall ecosystems and produce a severity-grouped report. This is safe to run\r\nautonomously: read-only, no git changes, no approval needed.\r\n\r\n### Multi-Ecosystem Scan Sequence\r\n\r\n1. **Dependabot alerts** (GraphQL\u002FREST via `gh api`) — grouped by ecosystem+severity\r\n2. **pip-audit** — local Python package CVEs not tracked by GitHub Dependabot\r\n3. **npm audit** — root + each workspace (apps\u002F*, web, ui-tui, website, plugins)\r\n4. **Go** — `go build` verification on watchdog-go module\r\n5. **Code patterns** — `shell=True`, `eval()`, `exec()`, `subprocess` usage\r\n6. **Secret scanning** — regex for API keys\u002Ftokens in source files\r\n7. **Config hardening** — review `.hermes\u002Fconfig.yaml` security-relevant settings\r\n\r\n### pip-audit JSON Parsing (Windows\u002FMSYS)\r\n\r\n`jq` is often unavailable on Windows MSYS. Use `py -3 -m pip_audit --desc --format=json`\r\nand parse with Python's `json.loads` instead of `--jq`:\r\n\r\n```python\r\nimport json, subprocess\r\nresult = subprocess.run(\r\n    [\"py\", \"-3\", \"-m\", \"pip_audit\", \"--desc\", \"--format=json\"],\r\n    capture_output=True, text=True\r\n)\r\n# pip_audit prints a WARNING line before the JSON — find the first '{'\r\nlines = result.stdout.strip().split('\\n')\r\njson_start = next(i for i, l in enumerate(lines) if l.strip().startswith('{'))\r\ndata = json.loads('\\n'.join(lines[json_start:]))\r\n\r\n# Deduplicate by vuln ID (same vuln hits multiple packages)\r\nfrom collections import defaultdict\r\nby_pkg = defaultdict(list)\r\nfor dep in data.get(\"dependencies\", []):\r\n    seen_ids = set()\r\n    for v in dep.get(\"vulns\", []):\r\n        if v[\"id\"] not in seen_ids:\r\n            seen_ids.add(v[\"id\"])\r\n            by_pkg[dep[\"name\"]].append({\r\n                \"id\": v[\"id\"], \"fix\": \", \".join(v.get(\"fix_versions\", [])) or \"NO FIX\",\r\n                \"aliases\": \", \".join(v.get(\"aliases\", []))\r\n            })\r\n```\r\n\r\nKey: use `py -3` (not `python` or `pip-audit` directly) on Windows — the\r\n`python` entry in PATH is the WindowsApps store stub.\r\n\r\n### Stale Go Dependabot Alerts\r\n\r\nGo Dependabot alerts can persist even when `go.mod` already exceeds the fix\r\nfloor (e.g., `golang.org\u002Fx\u002Fcrypto v0.54.0` fixes all `\u003C 0.52.0` alerts but\r\nDependabot still shows 23 open). For fork-only Go modules (e.g.,\r\n`scripts\u002Fwindows\u002Fwatchdog-go\u002F` which is not part of the upstream dependency\r\nsurface), these alerts should be dismissed or ignored — they are not actionable.\r\n\r\nVerify with:\r\n```sh\r\ncd scripts\u002Fwindows\u002Fwatchdog-go && go build . 2>&1  # should exit 0\r\n```\r\n\r\n### System venv vs pyproject.toml Pins\r\n\r\n`pyproject.toml` pins may be correct (e.g., `Pillow==12.3.0`, `starlette==1.3.1`)\r\nwhile the system venv still has older versions installed. pip-audit scans the\r\n**installed** environment, not the lockfile. A `uv sync` is needed to propagate\r\nlockfile pins into the active venv. Don't confuse pip-audit findings with\r\npyproject.toml pin correctness — check both.\r\n\r\n### Report Format (for cron delivery)\r\n\r\nStructure the report as:\r\n1. **Summary table** — ecosystem × severity matrix\r\n2. **CRITICAL** — package, CVE, fix version, one-line risk description\r\n3. **HIGH** — same, tabular\r\n4. **Actions taken** — what was fixed this run (npm audit fix, uv lock --upgrade, etc.)\r\n5. **Remediation priorities** — immediate \u002F short-term \u002F monitoring\r\n\r\nKeep it concise — critical\u002Fhigh only for the body; medium\u002Flow counts in the summary.\r\n\r\n## References\r\n- Hermes dependency management: see `pyproject.toml` and workspace `package.json` files.\r\n- GitHub Dependabot documentation: https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fdependabot\u002Fdependabot-alerts\u002Fabout-dependabot-alerts\r\n- See `references\u002Ffork-workflow.md` in the bundled `dependabot-security-fix` skill for the exact fork PR command sequence and alert-grouping recipes.\r\n- See `references\u002Fdaily-vuln-scan-recipe.md` in the bundled `dependabot-security-fix` skill for the read-only multi-repo scanning recipe.\r\n- See `references\u002Fweekly-audit-cron-recipe.md` in this skill for the step-by-step Windows\u002FMSYS weekly audit cron recipe (pip-audit JSON parsing, npm workspace scan, Go build verification, code pattern checks, config hardening review).",{"name":5,"author":49,"license":15,"version":50,"description":7},"Hermes Agent","1.0.0","main","0d1434f89f4bc6b07e9d272accd8c1013768820f","archive\u002Fskill-md-reviewed\u002Fsha256\u002F49\u002F49c4ab1be6a64115189dd44fcb6ce56f68308b87438c1700fa28badd6ceca2a9",0,"https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills","https:\u002F\u002Fgithub.com\u002Fzapabob","The Open University of JAPAN　2019-now\r\n\r\nTokyo University of Science　2007-2010","2026-10-26 16:29:01",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add zapabob\u002FSkills --skill dependabot-security-updates",{"tool":65,"command":66},"bunx","bunx skills add zapabob\u002FSkills --skill dependabot-security-updates",{"tool":68,"command":69},"pnpm","pnpm dlx skills add zapabob\u002FSkills --skill dependabot-security-updates","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Farchive\u002Fskill-md-reviewed\u002Fsha256\u002F49\u002F49c4ab1be6a64115189dd44fcb6ce56f68308b87438c1700fa28badd6ceca2a9\u002FSKILL.md",true,[],[74,106,140,167,194,210],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":89,"publishedAt":44},"01M6GJTE1GESGGF9K028Y7753E","xurl","X\u002FTwitter via xurl CLI: post, search, DM, media, v2 API.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fxurl\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[80,83,84],{"categoryNo":81,"categoryName":82,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[76,90,91,92,93,94,95,96,97,98,99,100,101,34,33,102,51,103,104,105],"openclaw","macos","cli","github","linux","windows","official","search","https","social-media","api","Media","twitter","social","via","post",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":123,"publishedAt":44},"01M6GJT8S1PXQ8WPXT1HSNBWH2","writing-plans","Write implementation plans: bite-sized tasks, paths, code.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fwriting-plans\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[112,115,118,119,120],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},{"categoryNo":121,"categoryName":122,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000036","内容创作者",[124,125,126,127,91,128,94,129,95,130,131,132,40,133,134,135,136,137,138,139],"writing","writing plans","plans","design","review","workflow","documentation","tasks","development","planning","code-review","subagent","write","superpowers","paths","test-driven-development",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":149,"publishedAt":44},"01M6GJST0H5X7WHBJ3BZK0DVKH","whisper","OpenAI's general-purpose speech recognition model. Supports 99 languages, transcription, translation to English, and language identification. Six model sizes from tiny (39M params) to large (1550M params). Use for speech-to-text, podcast transcription, or multilingual audio processing. Best for robust, multilingual ASR.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fwhisper\u002Fvariants\u002Fhermes-agent-optional\u002FSKILL.md",[146],{"categoryNo":147,"categoryName":148,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[142,91,94,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],"openai","speech","multimodal","Transformers","ASR","Audio","text","model","speech recognition","use","general","multilingual","translation","english","identification","processing","Audio Processing",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":176,"publishedAt":44},"01M6GJSMRQ8EETZTYMG72P70EA","weights-and-biases","W&B: log ML experiments, sweeps, model registry, dashboards.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fweights-and-biases\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[173],{"categoryNo":174,"categoryName":175,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化",[177,91,178,179,95,180,181,182,183,184,185,157,186,187,188,189,190,191,192,193],"weights and biases","tensorflow","experiments","pytorch","visualization","registry","real-time","tuning","dashboards","experiment","log","time","Experiment Tracking","Model Registry","Hyperparameter Tuning","WandB","Real-Time Visualization",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":44},"01M6GJS19KDPRY112JTR326S06","watchers","Poll RSS, JSON APIs, and GitHub with watermark dedup.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fwatchers\u002Fvariants\u002Fhermes-agent-optional\u002FSKILL.md",[200],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[196,91,202,93,94,203,204,205,27,206,207,34,33,208,209],"terminal","automation","http","monitoring","json","rss","devops","with",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":218,"publishedAt":44},"01M6GJRHJD2A6Q830SWF9W48BC","serving-llms-vllm","vLLM: high-throughput LLM serving, OpenAI API, quantization.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fvllm\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[216,217],{"categoryNo":81,"categoryName":82,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},[219,220,221,94,222,150,223,224,225,153,226,100,227,228,229,230,231,232,233,234],"llms","vLLM","serving llms vllm","research","openai api","tensor","Inference Serving","Production","llm serving","High Throughput","PagedAttention","Continuous Batching","Quantization","Tensor Parallelism","high-throughput","throughput"]