[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DSNFARTCYQPSR1AB0K3Y4F":3,"skill-same:01M6DSNFARTCYQPSR1AB0K3Y4F":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6DSNFARTCYQPSR1AB0K3Y4F","constant-time-analysis",null,"Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"time","constant time analysis","analysis","ruby","c++","branches","crypto","use","channel","programming","kotlin","typescript","secrets","java","code","javascript","vulnerabilities","rust","python","go","2026-11-10 10:12:30",false,"---\nname: constant-time-analysis\ndescription: Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.\n---\n\n# Constant-Time Analysis\n\nAnalyze cryptographic code to detect operations that leak secret data through execution timing variations.\n\n## When to Use\n\n```text\nUser writing crypto code? ──yes──> Use this skill\n         │\n         no\n         │\n         v\nUser asking about timing attacks? ──yes──> Use this skill\n         │\n         no\n         │\n         v\nCode handles secret keys\u002Ftokens? ──yes──> Use this skill\n         │\n         no\n         │\n         v\nSkip this skill\n```\n\n**Concrete triggers:**\n\n- User implements signature, encryption, or key derivation\n- Code contains `\u002F` or `%` operators on secret-derived values\n- User mentions \"constant-time\", \"timing attack\", \"side-channel\", \"KyberSlash\"\n- Reviewing functions named `sign`, `verify`, `encrypt`, `decrypt`, `derive_key`\n\n## When NOT to Use\n\n- Non-cryptographic code (business logic, UI, etc.)\n- Public data processing where timing leaks don't matter\n- Code that doesn't handle secrets, keys, or authentication tokens\n- High-level API usage where timing is handled by the library\n\n## Language Selection\n\nBased on the file extension or language context, refer to the appropriate guide:\n\n| Language   | File Extensions                   | Guide                                                    |\n| ---------- | --------------------------------- | -------------------------------------------------------- |\n| C, C++     | `.c`, `.h`, `.cpp`, `.cc`, `.hpp` | [references\u002Fcompiled.md](references\u002Fcompiled.md)         |\n| Go         | `.go`                             | [references\u002Fcompiled.md](references\u002Fcompiled.md)         |\n| Rust       | `.rs`                             | [references\u002Fcompiled.md](references\u002Fcompiled.md)         |\n| Swift      | `.swift`                          | [references\u002Fswift.md](references\u002Fswift.md)               |\n| Java       | `.java`                           | [references\u002Fvm-compiled.md](references\u002Fvm-compiled.md)   |\n| Kotlin     | `.kt`, `.kts`                     | [references\u002Fkotlin.md](references\u002Fkotlin.md)             |\n| C#         | `.cs`                             | [references\u002Fvm-compiled.md](references\u002Fvm-compiled.md)   |\n| PHP        | `.php`                            | [references\u002Fphp.md](references\u002Fphp.md)                   |\n| JavaScript | `.js`, `.mjs`, `.cjs`             | [references\u002Fjavascript.md](references\u002Fjavascript.md)     |\n| TypeScript | `.ts`, `.tsx`                     | [references\u002Fjavascript.md](references\u002Fjavascript.md)     |\n| Python     | `.py`                             | [references\u002Fpython.md](references\u002Fpython.md)             |\n| Ruby       | `.rb`                             | [references\u002Fruby.md](references\u002Fruby.md)                 |\n\n## Quick Start\n\n```bash\n# Analyze any supported file type\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py \u003Csource_file>\n\n# Include conditional branch warnings\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --warnings \u003Csource_file>\n\n# Filter to specific functions\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --func 'sign|verify' \u003Csource_file>\n\n# JSON output for CI\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --json \u003Csource_file>\n```\n\n### Native Compiled Languages Only (C, C++, Go, Rust)\n\n```bash\n# Cross-architecture testing (RECOMMENDED)\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --arch x86_64 crypto.c\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --arch arm64 crypto.c\n\n# Multiple optimization levels\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --opt-level O0 crypto.c\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --opt-level O3 crypto.c\n```\n\n### VM-Compiled Languages (Java, Kotlin, C#)\n\n```bash\n# Analyze Java bytecode\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py CryptoUtils.java\n\n# Analyze Kotlin bytecode (Android\u002FJVM)\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py CryptoUtils.kt\n\n# Analyze C# IL\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py CryptoUtils.cs\n```\n\nNote: Java, Kotlin, and C# compile to bytecode (JVM\u002FCIL) that runs on a virtual machine with JIT compilation. The analyzer examines the bytecode directly, not the JIT-compiled native code. The `--arch` and `--opt-level` flags do not apply to these languages.\n\n### Swift (iOS\u002FmacOS)\n\n```bash\n# Analyze Swift for native architecture\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py crypto.swift\n\n# Analyze for specific architecture (iOS devices)\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --arch arm64 crypto.swift\n\n# Analyze with different optimization levels\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --opt-level O0 crypto.swift\n```\n\nNote: Swift compiles to native code like C\u002FC++\u002FGo\u002FRust, so it uses assembly-level analysis and supports `--arch` and `--opt-level` flags.\n\n### Prerequisites\n\n| Language               | Requirements                                              |\n| ---------------------- | --------------------------------------------------------- |\n| C, C++, Go, Rust       | Compiler in PATH (`gcc`\u002F`clang`, `go`, `rustc`)           |\n| Swift                  | Xcode or Swift toolchain (`swiftc` in PATH)               |\n| Java                   | JDK with `javac` and `javap` in PATH                      |\n| Kotlin                 | Kotlin compiler (`kotlinc`) + JDK (`javap`) in PATH       |\n| C#                     | .NET SDK + `ilspycmd` (`dotnet tool install -g ilspycmd`) |\n| PHP                    | PHP with VLD extension or OPcache                         |\n| JavaScript\u002FTypeScript  | Node.js in PATH                                           |\n| Python                 | Python 3.x in PATH                                        |\n| Ruby                   | Ruby with `--dump=insns` support                          |\n\n**macOS users**: Homebrew installs Java and .NET as \"keg-only\". You must add them to your PATH:\n\n```bash\n# For Java (add to ~\u002F.zshrc)\nexport PATH=\"\u002Fopt\u002Fhomebrew\u002Fopt\u002Fopenjdk@21\u002Fbin:$PATH\"\n\n# For .NET tools (add to ~\u002F.zshrc)\nexport PATH=\"$HOME\u002F.dotnet\u002Ftools:$PATH\"\n```\n\nSee [references\u002Fvm-compiled.md](references\u002Fvm-compiled.md) for detailed setup instructions and troubleshooting.\n\n## Quick Reference\n\n| Problem                | Detection                       | Fix                                          |\n| ---------------------- | ------------------------------- | -------------------------------------------- |\n| Division on secrets    | DIV, IDIV, SDIV, UDIV           | Barrett reduction or multiply-by-inverse     |\n| Branch on secrets      | JE, JNE, BEQ, BNE               | Constant-time selection (cmov, bit masking)  |\n| Secret comparison      | Early-exit memcmp               | Use `crypto\u002Fsubtle` or constant-time compare |\n| Weak RNG               | rand(), mt_rand, Math.random    | Use crypto-secure RNG                        |\n| Table lookup by secret | Array subscript on secret index | Bit-sliced lookups                           |\n\n## Interpreting Results\n\n**PASSED** - No variable-time operations detected.\n\n**FAILED** - Dangerous instructions found. Example:\n\n```text\n[ERROR] SDIV\n  Function: decompose_vulnerable\n  Reason: SDIV has early termination optimization; execution time depends on operand values\n```\n\n## Verifying Results (Avoiding False Positives)\n\n**CRITICAL**: Not every flagged operation is a vulnerability. The tool has no data flow analysis - it flags ALL potentially dangerous operations regardless of whether they involve secrets.\n\nFor each flagged violation, ask: **Does this operation's input depend on secret data?**\n\n1. **Identify the secret inputs** to the function (private keys, plaintext, signatures, tokens)\n\n2. **Trace data flow** from the flagged instruction back to inputs\n\n3. **Common false positive patterns**:\n\n   ```c\n   \u002F\u002F FALSE POSITIVE: Division uses public constant, not secret\n   int num_blocks = data_len \u002F 16;  \u002F\u002F data_len is length, not content\n\n   \u002F\u002F TRUE POSITIVE: Division involves secret-derived value\n   int32_t q = secret_coef \u002F GAMMA2;  \u002F\u002F secret_coef from private key\n   ```\n\n4. **Document your analysis** for each flagged item\n\n### Quick Triage Questions\n\n| Question                                          | If Yes                | If No                 |\n| ------------------------------------------------- | --------------------- | --------------------- |\n| Is the operand a compile-time constant?           | Likely false positive | Continue              |\n| Is the operand a public parameter (length, count)?| Likely false positive | Continue              |\n| Is the operand derived from key\u002Fplaintext\u002Fsecret? | **TRUE POSITIVE**     | Likely false positive |\n| Can an attacker influence the operand value?      | **TRUE POSITIVE**     | Likely false positive |\n\n## Limitations\n\n1. **Static Analysis Only**: Analyzes assembly\u002Fbytecode, not runtime behavior. Cannot detect cache timing or microarchitectural side-channels.\n\n2. **No Data Flow Analysis**: Flags all dangerous operations regardless of whether they process secrets. Manual review required.\n\n3. **Compiler\u002FRuntime Variations**: Different compilers, optimization levels, and runtime versions may produce different output.\n\n## Real-World Impact\n\n- **KyberSlash (2023)**: Division instructions in post-quantum ML-KEM implementations allowed key recovery\n- **Lucky Thirteen (2013)**: Timing differences in CBC padding validation enabled plaintext recovery\n- **RSA Timing Attacks**: Early implementations leaked private key bits through division timing\n\n## References\n\n- [Cryptocoding Guidelines](https:\u002F\u002Fgithub.com\u002Fveorq\u002Fcryptocoding) - Defensive coding for crypto\n- [KyberSlash](https:\u002F\u002Fkyberslash.cr.yp.to\u002F) - Division timing in post-quantum crypto\n- [BearSSL Constant-Time](https:\u002F\u002Fwww.bearssl.org\u002Fconstanttime.html) - Practical constant-time techniques\n","# Constant-Time Analysis\n\nAnalyze cryptographic code to detect operations that leak secret data through execution timing variations.\n\n## When to Use\n\n```text\nUser writing crypto code? ──yes──> Use this skill\n         │\n         no\n         │\n         v\nUser asking about timing attacks? ──yes──> Use this skill\n         │\n         no\n         │\n         v\nCode handles secret keys\u002Ftokens? ──yes──> Use this skill\n         │\n         no\n         │\n         v\nSkip this skill\n```\n\n**Concrete triggers:**\n\n- User implements signature, encryption, or key derivation\n- Code contains `\u002F` or `%` operators on secret-derived values\n- User mentions \"constant-time\", \"timing attack\", \"side-channel\", \"KyberSlash\"\n- Reviewing functions named `sign`, `verify`, `encrypt`, `decrypt`, `derive_key`\n\n## When NOT to Use\n\n- Non-cryptographic code (business logic, UI, etc.)\n- Public data processing where timing leaks don't matter\n- Code that doesn't handle secrets, keys, or authentication tokens\n- High-level API usage where timing is handled by the library\n\n## Language Selection\n\nBased on the file extension or language context, refer to the appropriate guide:\n\n| Language   | File Extensions                   | Guide                                                    |\n| ---------- | --------------------------------- | -------------------------------------------------------- |\n| C, C++     | `.c`, `.h`, `.cpp`, `.cc`, `.hpp` | [references\u002Fcompiled.md](references\u002Fcompiled.md)         |\n| Go         | `.go`                             | [references\u002Fcompiled.md](references\u002Fcompiled.md)         |\n| Rust       | `.rs`                             | [references\u002Fcompiled.md](references\u002Fcompiled.md)         |\n| Swift      | `.swift`                          | [references\u002Fswift.md](references\u002Fswift.md)               |\n| Java       | `.java`                           | [references\u002Fvm-compiled.md](references\u002Fvm-compiled.md)   |\n| Kotlin     | `.kt`, `.kts`                     | [references\u002Fkotlin.md](references\u002Fkotlin.md)             |\n| C#         | `.cs`                             | [references\u002Fvm-compiled.md](references\u002Fvm-compiled.md)   |\n| PHP        | `.php`                            | [references\u002Fphp.md](references\u002Fphp.md)                   |\n| JavaScript | `.js`, `.mjs`, `.cjs`             | [references\u002Fjavascript.md](references\u002Fjavascript.md)     |\n| TypeScript | `.ts`, `.tsx`                     | [references\u002Fjavascript.md](references\u002Fjavascript.md)     |\n| Python     | `.py`                             | [references\u002Fpython.md](references\u002Fpython.md)             |\n| Ruby       | `.rb`                             | [references\u002Fruby.md](references\u002Fruby.md)                 |\n\n## Quick Start\n\n```bash\n# Analyze any supported file type\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py \u003Csource_file>\n\n# Include conditional branch warnings\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --warnings \u003Csource_file>\n\n# Filter to specific functions\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --func 'sign|verify' \u003Csource_file>\n\n# JSON output for CI\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --json \u003Csource_file>\n```\n\n### Native Compiled Languages Only (C, C++, Go, Rust)\n\n```bash\n# Cross-architecture testing (RECOMMENDED)\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --arch x86_64 crypto.c\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --arch arm64 crypto.c\n\n# Multiple optimization levels\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --opt-level O0 crypto.c\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --opt-level O3 crypto.c\n```\n\n### VM-Compiled Languages (Java, Kotlin, C#)\n\n```bash\n# Analyze Java bytecode\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py CryptoUtils.java\n\n# Analyze Kotlin bytecode (Android\u002FJVM)\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py CryptoUtils.kt\n\n# Analyze C# IL\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py CryptoUtils.cs\n```\n\nNote: Java, Kotlin, and C# compile to bytecode (JVM\u002FCIL) that runs on a virtual machine with JIT compilation. The analyzer examines the bytecode directly, not the JIT-compiled native code. The `--arch` and `--opt-level` flags do not apply to these languages.\n\n### Swift (iOS\u002FmacOS)\n\n```bash\n# Analyze Swift for native architecture\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py crypto.swift\n\n# Analyze for specific architecture (iOS devices)\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --arch arm64 crypto.swift\n\n# Analyze with different optimization levels\nuv run {baseDir}\u002Fct_analyzer\u002Fanalyzer.py --opt-level O0 crypto.swift\n```\n\nNote: Swift compiles to native code like C\u002FC++\u002FGo\u002FRust, so it uses assembly-level analysis and supports `--arch` and `--opt-level` flags.\n\n### Prerequisites\n\n| Language               | Requirements                                              |\n| ---------------------- | --------------------------------------------------------- |\n| C, C++, Go, Rust       | Compiler in PATH (`gcc`\u002F`clang`, `go`, `rustc`)           |\n| Swift                  | Xcode or Swift toolchain (`swiftc` in PATH)               |\n| Java                   | JDK with `javac` and `javap` in PATH                      |\n| Kotlin                 | Kotlin compiler (`kotlinc`) + JDK (`javap`) in PATH       |\n| C#                     | .NET SDK + `ilspycmd` (`dotnet tool install -g ilspycmd`) |\n| PHP                    | PHP with VLD extension or OPcache                         |\n| JavaScript\u002FTypeScript  | Node.js in PATH                                           |\n| Python                 | Python 3.x in PATH                                        |\n| Ruby                   | Ruby with `--dump=insns` support                          |\n\n**macOS users**: Homebrew installs Java and .NET as \"keg-only\". You must add them to your PATH:\n\n```bash\n# For Java (add to ~\u002F.zshrc)\nexport PATH=\"\u002Fopt\u002Fhomebrew\u002Fopt\u002Fopenjdk@21\u002Fbin:$PATH\"\n\n# For .NET tools (add to ~\u002F.zshrc)\nexport PATH=\"$HOME\u002F.dotnet\u002Ftools:$PATH\"\n```\n\nSee [references\u002Fvm-compiled.md](references\u002Fvm-compiled.md) for detailed setup instructions and troubleshooting.\n\n## Quick Reference\n\n| Problem                | Detection                       | Fix                                          |\n| ---------------------- | ------------------------------- | -------------------------------------------- |\n| Division on secrets    | DIV, IDIV, SDIV, UDIV           | Barrett reduction or multiply-by-inverse     |\n| Branch on secrets      | JE, JNE, BEQ, BNE               | Constant-time selection (cmov, bit masking)  |\n| Secret comparison      | Early-exit memcmp               | Use `crypto\u002Fsubtle` or constant-time compare |\n| Weak RNG               | rand(), mt_rand, Math.random    | Use crypto-secure RNG                        |\n| Table lookup by secret | Array subscript on secret index | Bit-sliced lookups                           |\n\n## Interpreting Results\n\n**PASSED** - No variable-time operations detected.\n\n**FAILED** - Dangerous instructions found. Example:\n\n```text\n[ERROR] SDIV\n  Function: decompose_vulnerable\n  Reason: SDIV has early termination optimization; execution time depends on operand values\n```\n\n## Verifying Results (Avoiding False Positives)\n\n**CRITICAL**: Not every flagged operation is a vulnerability. The tool has no data flow analysis - it flags ALL potentially dangerous operations regardless of whether they involve secrets.\n\nFor each flagged violation, ask: **Does this operation's input depend on secret data?**\n\n1. **Identify the secret inputs** to the function (private keys, plaintext, signatures, tokens)\n\n2. **Trace data flow** from the flagged instruction back to inputs\n\n3. **Common false positive patterns**:\n\n   ```c\n   \u002F\u002F FALSE POSITIVE: Division uses public constant, not secret\n   int num_blocks = data_len \u002F 16;  \u002F\u002F data_len is length, not content\n\n   \u002F\u002F TRUE POSITIVE: Division involves secret-derived value\n   int32_t q = secret_coef \u002F GAMMA2;  \u002F\u002F secret_coef from private key\n   ```\n\n4. **Document your analysis** for each flagged item\n\n### Quick Triage Questions\n\n| Question                                          | If Yes                | If No                 |\n| ------------------------------------------------- | --------------------- | --------------------- |\n| Is the operand a compile-time constant?           | Likely false positive | Continue              |\n| Is the operand a public parameter (length, count)?| Likely false positive | Continue              |\n| Is the operand derived from key\u002Fplaintext\u002Fsecret? | **TRUE POSITIVE**     | Likely false positive |\n| Can an attacker influence the operand value?      | **TRUE POSITIVE**     | Likely false positive |\n\n## Limitations\n\n1. **Static Analysis Only**: Analyzes assembly\u002Fbytecode, not runtime behavior. Cannot detect cache timing or microarchitectural side-channels.\n\n2. **No Data Flow Analysis**: Flags all dangerous operations regardless of whether they process secrets. Manual review required.\n\n3. **Compiler\u002FRuntime Variations**: Different compilers, optimization levels, and runtime versions may produce different output.\n\n## Real-World Impact\n\n- **KyberSlash (2023)**: Division instructions in post-quantum ML-KEM implementations allowed key recovery\n- **Lucky Thirteen (2013)**: Timing differences in CBC padding validation enabled plaintext recovery\n- **RSA Timing Attacks**: Early implementations leaked private key bits through division timing\n\n## References\n\n- [Cryptocoding Guidelines](https:\u002F\u002Fgithub.com\u002Fveorq\u002Fcryptocoding) - Defensive coding for crypto\n- [KyberSlash](https:\u002F\u002Fkyberslash.cr.yp.to\u002F) - Division timing in post-quantum crypto\n- [BearSSL Constant-Time](https:\u002F\u002Fwww.bearssl.org\u002Fconstanttime.html) - Practical constant-time techniques\n",{"name":5,"description":7},"master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill constant-time-analysis",{"tool":61,"command":62},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill constant-time-analysis",{"tool":64,"command":65},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill constant-time-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002FSKILL.md",true,[69,75,79,83,87,91,95,99,103],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"README.md","REFERENCE","参考文档",3893,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002FREADME.md",{"path":76,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fcompiled.md",4108,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002Freferences\u002Fcompiled.md",{"path":80,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fjavascript.md",4449,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002Freferences\u002Fjavascript.md",{"path":84,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fkotlin.md",6784,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002Freferences\u002Fkotlin.md",{"path":88,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fphp.md",4831,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002Freferences\u002Fphp.md",{"path":92,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fpython.md",5261,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002Freferences\u002Fpython.md",{"path":96,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fruby.md",5391,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002Freferences\u002Fruby.md",{"path":100,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fswift.md",8194,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002Freferences\u002Fswift.md",{"path":104,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fvm-compiled.md",10409,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fconstant-time-analysis\u002Freferences\u002Fvm-compiled.md",[108,131,145,160,172,185],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":125,"publishedAt":43},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[114,119,122],{"categoryNo":115,"categoryName":116,"taxonomyType":117,"taxonomyTypeDesc":118},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":120,"categoryName":121,"taxonomyType":117,"taxonomyTypeDesc":118},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":123,"categoryName":124,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000036","内容创作者",[126,127,30,128,129,130],"writing skills","writing","editing","work","deployment",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":139,"publishedAt":43},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[137,138],{"categoryNo":120,"categoryName":121,"taxonomyType":117,"taxonomyTypeDesc":118},{"categoryNo":123,"categoryName":124,"taxonomyType":20,"taxonomyTypeDesc":21},[140,141,127,142,143,30,37,144],"plans","writing plans","requirements","task","spec",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":153,"publishedAt":43},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[151,152],{"categoryNo":120,"categoryName":121,"taxonomyType":117,"taxonomyTypeDesc":118},{"categoryNo":123,"categoryName":124,"taxonomyType":20,"taxonomyTypeDesc":21},[154,155,156,157,158,159,127],"docs:write concisely","write","docs","read","Rules","documentation",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":43},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[162,167,168,169,170,25,171],"why","kaizen","issue","five whys","root cause analysis",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":43},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[179,180,181,182,37,183,184],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":43},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[192,180,193,129,30,194,195,196],"verification before completion","commands","evidence","claim","complete"]