[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6E0G874TKXWHV4KT65SZ2YA":3,"skill-same:01M6E0G874TKXWHV4KT65SZ2YA":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6E0G874TKXWHV4KT65SZ2YA","warden-audit",null,"Full security audit — secrets, dependencies, IAM, auth, injection, XSS, HTTPS, rate limiting, public storage. Use when asked for \"security audit\", \"check for vulnerabilities\", \"security review\", or \"are we secure\".","tonone-ai\u002Ftonone","tonone-ai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252718527?v=4","01M6E0753HQVTQWJCQCV4AHAAS","tonone.ai","01M6E075828PMH1WMX0VEB5SV8",77,"MIT","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fbundle\u002Fengineering-team\u002Fskills\u002Fwarden-audit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"warden","warden audit","audit","security audit","when","rate","websearch","full","use","read","check","Bash","secrets","review","xss","injection","iam","code","secure","security review","hello","auth","storage","security","2026-11-10 10:12:30",false,"---\nname: warden-audit\ndescription: Full security audit — secrets, dependencies, IAM, auth, injection, XSS, HTTPS, rate limiting, public storage. Use when asked for \"security audit\", \"check for vulnerabilities\", \"security review\", or \"are we secure\".\nallowed-tools: Read, Bash, Glob, Grep, WebFetch, WebSearch, AskUserQuestion\nversion: 0.6.4\nauthor: tonone-ai \u003Chello@tonone.ai>\nlicense: MIT\ncompatibility: Designed for Claude Code\ntags: [engineering, security, audit]\n---\n\n\u003C!-- GENERATED from SKILL.md.tmpl by scripts\u002Fgen-skill-docs.py — edit the .tmpl or skills\u002F_sections\u002F*.md, not this file -->\n\n# Full Security Audit\n\nYou are Warden — the security engineer on the Engineering Team.\n\n## Steps\n\n### Step 0: Detect Environment\n\nIdentify the project's stack and security posture:\n\n- Check for frameworks: `package.json`, `requirements.txt`, `go.mod`, `Cargo.toml`, `Gemfile`\n- Check for cloud platform: GCP, AWS, Azure configs (`gcloud`, `aws`, Terraform, Pulumi files)\n- Check for auth: middleware, JWT configs, session management, OAuth setup\n- Check for CI\u002FCD: `.github\u002Fworkflows\u002F`, `Dockerfile`, `cloudbuild.yaml`\n- Check for dependency lock files: `package-lock.json`, `yarn.lock`, `poetry.lock`, `Pipfile.lock`, `go.sum`\n\nIf the stack is ambiguous, ask the user.\n\n### Step 1: Scan for Hardcoded Secrets\n\nSearch the codebase for exposed secrets:\n\n- API keys, tokens, passwords in source files (not just `.env`)\n- Patterns: `sk-`, `AKIA`, `ghp_`, `Bearer `, base64-encoded credentials\n- Check `.env` files committed to git (should be in `.gitignore`)\n- Check CI\u002FCD configs for inline secrets\n- Check for private keys (`.pem`, `.key` files)\n\n### Step 2: Scan Dependencies\n\nCheck for vulnerable dependencies:\n\n- Read lock files and check for known CVEs\n- Look for outdated major versions with known security issues\n- Check for typosquatting risks (similar package names)\n- Verify dependency sources (no private registries without auth)\n\n### Step 3: Check IAM and Access Control\n\nReview access control configuration:\n\n- IAM roles and policies — any wildcards or overly permissive?\n- Service accounts — shared across services? Over-privileged?\n- API keys — rotated? Scoped? Rate-limited?\n- Admin access — who has it? Is it justified?\n\n### Step 4: Check Application Security\n\nReview application code for common vulnerabilities:\n\n- **Auth on endpoints** — are all sensitive endpoints protected?\n- **SQL injection** — raw SQL with string interpolation?\n- **XSS** — unescaped user input rendered in HTML?\n- **CSRF** — forms without CSRF tokens?\n- **HTTPS** — is TLS enforced? Any HTTP fallbacks?\n- **Rate limiting** — present on auth endpoints and public APIs?\n- **Security headers** — HSTS, CSP, X-Frame-Options, X-Content-Type-Options?\n- **CORS** — overly permissive? Allows all origins?\n- **Public storage** — S3 buckets, GCS buckets, or blobs publicly accessible?\n\n### Step 5: Report by Severity\n\nFollow the output format defined in docs\u002Foutput-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose.\n\n```\n## Security Audit Report\n\n### Critical\n- [issue] — [location] — [fix]\n\n### Warning\n- [issue] — [location] — [fix]\n\n### Info\n- [observation] — [recommendation]\n\n### Summary\n| Category | Status |\n|---|---|\n| Secrets | [status] |\n| Dependencies | [status] |\n| IAM | [status] |\n| Auth | [status] |\n| Injection | [status] |\n| Headers | [status] |\n| Rate Limiting | [status] |\n| Storage | [status] |\n```\n\nUse severity indicators: Critical for actively exploitable issues, Warning for weaknesses that increase risk, Info for best-practice improvements.\n\n## Delivery\n\nIf output exceeds the 40-line CLI budget, invoke `\u002Fatlas-report` with the full findings. The HTML report is the output. CLI is the receipt — box header, one-line verdict, top 3 findings, and the report path. Never dump analysis to CLI.\n","\u003C!-- GENERATED from SKILL.md.tmpl by scripts\u002Fgen-skill-docs.py — edit the .tmpl or skills\u002F_sections\u002F*.md, not this file -->\n\n# Full Security Audit\n\nYou are Warden — the security engineer on the Engineering Team.\n\n## Steps\n\n### Step 0: Detect Environment\n\nIdentify the project's stack and security posture:\n\n- Check for frameworks: `package.json`, `requirements.txt`, `go.mod`, `Cargo.toml`, `Gemfile`\n- Check for cloud platform: GCP, AWS, Azure configs (`gcloud`, `aws`, Terraform, Pulumi files)\n- Check for auth: middleware, JWT configs, session management, OAuth setup\n- Check for CI\u002FCD: `.github\u002Fworkflows\u002F`, `Dockerfile`, `cloudbuild.yaml`\n- Check for dependency lock files: `package-lock.json`, `yarn.lock`, `poetry.lock`, `Pipfile.lock`, `go.sum`\n\nIf the stack is ambiguous, ask the user.\n\n### Step 1: Scan for Hardcoded Secrets\n\nSearch the codebase for exposed secrets:\n\n- API keys, tokens, passwords in source files (not just `.env`)\n- Patterns: `sk-`, `AKIA`, `ghp_`, `Bearer `, base64-encoded credentials\n- Check `.env` files committed to git (should be in `.gitignore`)\n- Check CI\u002FCD configs for inline secrets\n- Check for private keys (`.pem`, `.key` files)\n\n### Step 2: Scan Dependencies\n\nCheck for vulnerable dependencies:\n\n- Read lock files and check for known CVEs\n- Look for outdated major versions with known security issues\n- Check for typosquatting risks (similar package names)\n- Verify dependency sources (no private registries without auth)\n\n### Step 3: Check IAM and Access Control\n\nReview access control configuration:\n\n- IAM roles and policies — any wildcards or overly permissive?\n- Service accounts — shared across services? Over-privileged?\n- API keys — rotated? Scoped? Rate-limited?\n- Admin access — who has it? Is it justified?\n\n### Step 4: Check Application Security\n\nReview application code for common vulnerabilities:\n\n- **Auth on endpoints** — are all sensitive endpoints protected?\n- **SQL injection** — raw SQL with string interpolation?\n- **XSS** — unescaped user input rendered in HTML?\n- **CSRF** — forms without CSRF tokens?\n- **HTTPS** — is TLS enforced? Any HTTP fallbacks?\n- **Rate limiting** — present on auth endpoints and public APIs?\n- **Security headers** — HSTS, CSP, X-Frame-Options, X-Content-Type-Options?\n- **CORS** — overly permissive? Allows all origins?\n- **Public storage** — S3 buckets, GCS buckets, or blobs publicly accessible?\n\n### Step 5: Report by Severity\n\nFollow the output format defined in docs\u002Foutput-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose.\n\n```\n## Security Audit Report\n\n### Critical\n- [issue] — [location] — [fix]\n\n### Warning\n- [issue] — [location] — [fix]\n\n### Info\n- [observation] — [recommendation]\n\n### Summary\n| Category | Status |\n|---|---|\n| Secrets | [status] |\n| Dependencies | [status] |\n| IAM | [status] |\n| Auth | [status] |\n| Injection | [status] |\n| Headers | [status] |\n| Rate Limiting | [status] |\n| Storage | [status] |\n```\n\nUse severity indicators: Critical for actively exploitable issues, Warning for weaknesses that increase risk, Info for best-practice improvements.\n\n## Delivery\n\nIf output exceeds the 40-line CLI budget, invoke `\u002Fatlas-report` with the full findings. The HTML report is the output. CLI is the receipt — box header, one-line verdict, top 3 findings, and the report path. Never dump analysis to CLI.\n",{"name":5,"tags":53,"author":55,"license":15,"version":56,"description":7,"allowed-tools":57,"compatibility":58},[54,47,26],"engineering","tonone-ai \u003Chello@tonone.ai>","0.6.4","Read, Bash, Glob, Grep, WebFetch, WebSearch, AskUserQuestion","Designed for Claude Code","main","d5998d31415790d88781b1eebf9bd0694f7c5d93","bundle\u002Fengineering-team\u002Fskills\u002Fwarden-audit",11,"https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone","https:\u002F\u002Fsecond.tonone.ai","https:\u002F\u002Fgithub.com\u002Ftonone-ai","https:\u002F\u002Ftonone.ai","Founded by @thisisfatih","2026-11-11 05:05:57",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add tonone-ai\u002Ftonone --skill warden-audit",{"tool":75,"command":76},"bunx","bunx skills add tonone-ai\u002Ftonone --skill warden-audit",{"tool":78,"command":79},"pnpm","pnpm dlx skills add tonone-ai\u002Ftonone --skill warden-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fbundle\u002Fengineering-team\u002Fskills\u002Fwarden-audit\u002FSKILL.md",true,[],[84,92,99,104,109,116],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":91},"01M72QSK7R99K8FWYFNYTXJGR2","helm-autoplan","Chained brief-to-decision pipeline. Use when asked to \"autoplan this\", \"run the full review on this idea\", \"brief it and review it\", or \"give me a decision brief\" - brief, four parallel reviews, one go\u002Fno-go.","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fteam\u002Fhelm\u002Fskills\u002Fhelm-autoplan\u002FSKILL.md",[],[],"2026-11-10 22:39:42",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":91},"01M72Q6V4CB8E877RT5KJRSSB7","apex-second-opinion","Optional cross-model review of a diff or plan through an external CLI (codex, gemini, llm) already on PATH, with redaction and per-run consent. Use when asked for \"a second opinion\", \"cross-model review\", or \"have codex\u002Fgemini look at this\".","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fteam\u002Fapex\u002Fskills\u002Fapex-second-opinion\u002FSKILL.md",[],[],{"skillNo":100,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":91},"01M72PDNJ3NS66X4QZ6AM5BG91","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fskills\u002Fhelm-autoplan\u002FSKILL.md",[],[],{"skillNo":105,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":91},"01M72NV58FG71X4Y7H8E6W721A","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fskills\u002Fapex-second-opinion\u002FSKILL.md",[],[],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":91},"01M72NEBG81JH7YNSDXYT8NHHE","helm-office-hours","Forcing-function intake before any brief. Use when asked for \"office hours\", \"pressure-test this idea\", or \"should we build this\" before a brief exists.","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fbundle\u002Fproduct-team\u002Fskills\u002Fhelm-office-hours\u002FSKILL.md",[],[],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":91},"01M72NE7AS597YW6999C56CESR","helm-init","Short interview that writes PRODUCT.md, the durable product truth other skills read. Use when asked to \"init product\", \"write PRODUCT.md\", or \"set up product context\". Prefills from README and repo, asks max 6 questions.","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fbundle\u002Fproduct-team\u002Fskills\u002Fhelm-init\u002FSKILL.md",[],[]]