[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6E0H24TAVN96VC2GASH99HT":3,"skill-same:01M6E0H24TAVN96VC2GASH99HT":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":14,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":52,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6E0H24TAVN96VC2GASH99HT","secure",null,"Shortcut for security review on current change set. Runs layered checks (secret-scan, dep-audit, semgrep, OWASP patterns, prompt-injection review). Use for a security check, to scan for vulns, or to run security review.","LucasSantana-Dev\u002Fforgekit","LucasSantana-Dev","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F98131142?v=4","01M6E038X8H7VE9GCEJP9PT5CA","Lucas Santana","01M6E0391WB0JYZTWXEBR9WSXA",1,"MIT","https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit\u002Fblob\u002Fmain\u002Fpackages\u002Fcatalog\u002Fcatalog\u002Fskills\u002Fadt-secure\u002FSKILL.md",[],[5,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"security review","layered","use","for","shortcut","owasp","injection","semgrep","run","audit","security check","change","check","review","prompt-injection","prompt","DEP","scan","SET","2026-11-10 10:12:30",false,"---\nname: secure\ndescription: Shortcut for security review on current change set. Runs layered checks (secret-scan, dep-audit, semgrep, OWASP patterns, prompt-injection review). Use for a security check, to scan for vulns, or to run security review.\ntriggers:\n  - \"secure this\"\n  - \"security check\"\n  - \"scan for vulns\"\n  - \"run security review\"\n---\n\n# Secure\n\nShortcut for security review on current change set. Runs a layered check: secret-scan (trufflehog), dep-audit, semgrep, OWASP top-10 pattern sweep, and prompt-injection review if agent-touching code.\n\n## Purpose\n\nGate changes for security before shipping. Thin wrapper around existing `security-review` \u002F `security-audit` skills, orchestrated into a single invocation.\n\n## What Gets Scanned\n\n| Layer | Tool | Detects |\n|-------|------|---------|\n| Secrets | trufflehog | API keys, credentials, private keys |\n| Dependencies | npm audit, pip audit | Known vulns in transitive deps |\n| Code patterns | semgrep | OWASP Top 10, injection flaws, unsafe DOM |\n| Prompt injection | Custom rules | Template injection, prompt stuffing, jailbreak patterns |\n\n## Invocation\n\n```bash\nsecure                           # Scan staged changes\nsecure --staged                  # Explicit staged\nsecure --branch \u003Cbranch>         # Scan diff vs main\nsecure --file \u003Cpath>             # Single file\nsecure --fix                     # Attempt auto-fix (secrets rotate, deps upgrade)\n```\n\n## Example Output\n\n```\nRunning secure check...\n\n[OK]  Secrets: 0 findings\n[OK]  Dependencies: 1 high vuln detected in lodash (fixed in v4.17.21, yours: v4.17.20)\n[WARN] Semgrep: 2 findings\n      - CWE-79 (XSS): unsafe innerHTML in auth-form.tsx:42\n      - CWE-89 (SQL Injection): dynamic query in db-service.ts:105\n[OK]  Prompt injection: 0 findings\n\nSummary: 2 warnings, 0 errors\nNext: Fix findings or run `secure --fix` for suggestions\n```\n\n## Interpretation Guide\n\n| Severity | Action |\n|----------|--------|\n| **Error** | Block merge; fix before shipping |\n| **High** | Fix or document exception with JIRA ticket |\n| **Medium** | Plan fix; merge with caution |\n| **Low** | Log for backlog; merge OK |\n\n## AI Agent Code Special Rules\n\nIf changes touch `src\u002Fagents\u002F`, `packages\u002Fcore\u002Fkit\u002Fcore\u002Fagents\u002F`, or prompt-building logic, ALWAYS run extra prompt-injection scan:\n\n```bash\nsecure --agents-mode\n```\n\nDetects:\n- User-controlled input fed directly to LLM prompts\n- Unescaped template variables in agent instructions\n- Jailbreak patterns in example payloads\n\n## References\n\n- Full security audit: `security-audit` skill\n- Best practices: `packages\u002Fcore\u002Fbest-practices\u002Fsecurity.md`\n- Prompt defense: `packages\u002Fcore\u002Fpatterns\u002Fprompt-injection-defense.md`\n- OWASP Top 10: [owasp.org](https:\u002F\u002Fowasp.org)\n","# Secure\n\nShortcut for security review on current change set. Runs a layered check: secret-scan (trufflehog), dep-audit, semgrep, OWASP top-10 pattern sweep, and prompt-injection review if agent-touching code.\n\n## Purpose\n\nGate changes for security before shipping. Thin wrapper around existing `security-review` \u002F `security-audit` skills, orchestrated into a single invocation.\n\n## What Gets Scanned\n\n| Layer | Tool | Detects |\n|-------|------|---------|\n| Secrets | trufflehog | API keys, credentials, private keys |\n| Dependencies | npm audit, pip audit | Known vulns in transitive deps |\n| Code patterns | semgrep | OWASP Top 10, injection flaws, unsafe DOM |\n| Prompt injection | Custom rules | Template injection, prompt stuffing, jailbreak patterns |\n\n## Invocation\n\n```bash\nsecure                           # Scan staged changes\nsecure --staged                  # Explicit staged\nsecure --branch \u003Cbranch>         # Scan diff vs main\nsecure --file \u003Cpath>             # Single file\nsecure --fix                     # Attempt auto-fix (secrets rotate, deps upgrade)\n```\n\n## Example Output\n\n```\nRunning secure check...\n\n[OK]  Secrets: 0 findings\n[OK]  Dependencies: 1 high vuln detected in lodash (fixed in v4.17.21, yours: v4.17.20)\n[WARN] Semgrep: 2 findings\n      - CWE-79 (XSS): unsafe innerHTML in auth-form.tsx:42\n      - CWE-89 (SQL Injection): dynamic query in db-service.ts:105\n[OK]  Prompt injection: 0 findings\n\nSummary: 2 warnings, 0 errors\nNext: Fix findings or run `secure --fix` for suggestions\n```\n\n## Interpretation Guide\n\n| Severity | Action |\n|----------|--------|\n| **Error** | Block merge; fix before shipping |\n| **High** | Fix or document exception with JIRA ticket |\n| **Medium** | Plan fix; merge with caution |\n| **Low** | Log for backlog; merge OK |\n\n## AI Agent Code Special Rules\n\nIf changes touch `src\u002Fagents\u002F`, `packages\u002Fcore\u002Fkit\u002Fcore\u002Fagents\u002F`, or prompt-building logic, ALWAYS run extra prompt-injection scan:\n\n```bash\nsecure --agents-mode\n```\n\nDetects:\n- User-controlled input fed directly to LLM prompts\n- Unescaped template variables in agent instructions\n- Jailbreak patterns in example payloads\n\n## References\n\n- Full security audit: `security-audit` skill\n- Best practices: `packages\u002Fcore\u002Fbest-practices\u002Fsecurity.md`\n- Prompt defense: `packages\u002Fcore\u002Fpatterns\u002Fprompt-injection-defense.md`\n- OWASP Top 10: [owasp.org](https:\u002F\u002Fowasp.org)\n",{"name":5,"triggers":43,"description":7},[44,29,45,46],"secure this","scan for vulns","run security review","main","f2e470f7ead3f9982aee7aadc1aa5bef5d4db833","packages\u002Fcatalog\u002Fcatalog\u002Fskills\u002Fadt-secure","https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit","https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev","https:\u002F\u002Flucassantana.tech","Senior engineer. AI agent tooling and evals on Node\u002FTS backends. Brazil, UTC-3.","2026-11-11 07:05:28",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add LucasSantana-Dev\u002Fforgekit --skill secure",{"tool":61,"command":62},"bunx","bunx skills add LucasSantana-Dev\u002Fforgekit --skill secure",{"tool":64,"command":65},"pnpm","pnpm dlx skills add LucasSantana-Dev\u002Fforgekit --skill secure","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit\u002Fblob\u002Fmain\u002Fpackages\u002Fcatalog\u002Fcatalog\u002Fskills\u002Fadt-secure\u002FSKILL.md",true,[69],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"manifest.json","REFERENCE","参考文档",940,"https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit\u002Fblob\u002Fmain\u002Fpackages\u002Fcatalog\u002Fcatalog\u002Fskills\u002Fadt-secure\u002Fmanifest.json",[76,106,138,159,168,186],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":87,"publishedAt":38},"01M6WR9SQGQ5WDEJY9HH3T93E8","token-audit","Audit historical Claude Code token usage from JSONL session files — shows total spend, cache hit rates, top costly sessions, weekly trends, and where tokens are going. Run after heavy sessions or weekly to measure optimization impact. Answers how many tokens a session used, how expensive was that session, session cost, and token usage report.","https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit\u002Fblob\u002Fmain\u002Fpackages\u002Fcatalog\u002Fcatalog\u002Fskills\u002Fadt-token-audit\u002FSKILL.md",[82],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[28,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,27,105],"token","token audit","session","rate","weekly","top","usage","jsonl","usage report","impact","tokens","files","cost","how","Optimization","cache","code","sessions",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":117,"publishedAt":38},"01M6WR919T3NGWMZ5R5XKWX9KN","smart-model-route","Auto-classify prompt complexity via Haiku (with heuristic fallback) and inject model routing hints for Agent tool calls. Wired as a UserPromptSubmit hook — fires on every prompt, routes low tasks to Haiku, standard to Sonnet, complex to Sonnet with thorough reasoning, and critical (security\u002Farch\u002Fmigrations) to Opus. Handles model selection, for example choose model by task complexity.","https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit\u002Fblob\u002Fmain\u002Fpackages\u002Fcatalog\u002Fcatalog\u002Fskills\u002Fadt-smart-model-route\u002FSKILL.md",[112],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137],"smart model route","route","model route","model","security","model selection","tasks","critical","arch","classify","selection","fallback","complexity","auto","opus","haiku","choose","hook","agent tool","sonnet",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":38},"01M6WR8TMGS9G79DFTX0K1ZA8T","smart-commands","Decision guide for when to proactively use Claude Code slash commands — \u002Fthink, \u002Fmodel, \u002Fcompact, \u002Fclear. Use when choosing whether to invoke a command before or during a task, or when a complexity-classifier hook has flagged a task as high or critical. Pairs with the complexity-classifier UserPromptSubmit hook. Answers when to compact, should I switch models, and whether to use extended thinking. Use to pick the right \u002Fmodel command and switch model.","https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit\u002Fblob\u002Fmain\u002Fpackages\u002Fcatalog\u002Fcatalog\u002Fskills\u002Fadt-smart-commands\u002FSKILL.md",[144],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},[146,147,148,149,21,22,135,125,150,151,152,153,130,154,155,156,157,158,121,104],"smart commands","commands","when","as","compact","thinking","switch","classifier","invoke","guide","command","decision","pick",{"skillNo":160,"name":161,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":38},"01M6E0ZGQ78S4SE6X6RCN1PR9A","spec-ship","https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit\u002Fblob\u002Fmain\u002Fpackages\u002Fcore\u002Fkit\u002Fspecs\u002Fskills\u002Fspec-ship\u002FSKILL.md",[],[165,166,167],"spec","ship","spec ship",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":38},"01M6E0ZD27S87Z954JTHECWG34","spec-new","Create a committed per-feature spec under `docs\u002Fspecs\u002FYYYY-MM-DD-\u003Cslug>\u002F{spec,tasks}.md` with frontmatter (status, created, owner, pr, tags). Promotes an ephemeral `.claude\u002Fplans\u002F\u003Cname>.md` into a persistent, searchable artifact. Use when starting a feature that's larger than a one-shot PR.","https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit\u002Fblob\u002Fmain\u002Fpackages\u002Fcore\u002Fkit\u002Fspecs\u002Fskills\u002Fspec-new\u002FSKILL.md",[],[175,165,176,21,177,178,124,179,180,181,182,183,184,185],"spec new","artifact","dd","create","pr","status","docs","feature","tags","name","plans",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":195,"publishedAt":38},"01M6E0Z9B5YE1G4NM05JPNVWMK","roadmap-refresh","Regenerate `docs\u002Froadmap.md` for a repo from all specs under `docs\u002Fspecs\u002F` + their frontmatter (status, tags, pr). Produces Now\u002FNext\u002FRecently-shipped sections. Run after creating \u002F shipping a spec, or at the start of a new session for orientation.","https:\u002F\u002Fgithub.com\u002FLucasSantana-Dev\u002Fforgekit\u002Fblob\u002Fmain\u002Fpackages\u002Fcore\u002Fkit\u002Fspecs\u002Fskills\u002Froadmap-refresh\u002FSKILL.md",[192],{"categoryNo":193,"categoryName":194,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000031","产品经理",[196,197,198,199,183,200,90,201,202,203,204,27,179,180,181,165],"roadmap refresh","roadmap","refresh","next","now","repo","new session","start","shipping"]