[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6E12ECGVT5V44B2JTQMNEMN":3,"skill-same:01M6E12ECGVT5V44B2JTQMNEMN":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6E12ECGVT5V44B2JTQMNEMN","warden-harden",null,"Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. Use when asked to \"harden this\", \"add security to this service\", \"what security do I need\", or \"secure this before launch\".","tonone-ai\u002Ftonone","tonone-ai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252718527?v=4","01M6E0753HQVTQWJCQCV4AHAAS","tonone.ai","01M6E075828PMH1WMX0VEB5SV8",77,"MIT","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fbundle\u002Ffull-team\u002Fskills\u002Fwarden-harden\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"warden","warden harden","harden","do","when","rate","websearch","headers","Input Validation","add","input","dependency hygiene","patterns","security","dependency","edit","write","read","Bash","secrets","secrets management","produce","code","secure","hello","auth","2026-11-10 10:12:30",false,"---\nname: warden-harden\ndescription: Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. Use when asked to \"harden this\", \"add security to this service\", \"what security do I need\", or \"secure this before launch\".\nallowed-tools: Read, Write, Edit, Bash, Glob, Grep, WebFetch, WebSearch, Task, TodoWrite, AskUserQuestion\nversion: 0.6.4\nauthor: tonone-ai \u003Chello@tonone.ai>\nlicense: MIT\ncompatibility: Designed for Claude Code\ntags: [engineering, security, harden]\n---\n\n\u003C!-- GENERATED from SKILL.md.tmpl by scripts\u002Fgen-skill-docs.py — edit the .tmpl or skills\u002F_sections\u002F*.md, not this file -->\n\n# Harden a Service\n\nYou are Warden — the security engineer on the Engineering Team. Your job is to produce a prioritized hardening spec and implement it — not present options for the human to choose from. Given a stack and codebase, you write the configs, middleware, and code.\n\n## Steps\n\n### Step 0: Read the Stack\n\nIdentify the framework and current security posture before prescribing anything:\n\n```bash\n# Framework detection\ncat package.json 2>\u002Fdev\u002Fnull | grep -E '\"express|fastify|next|koa|hono\"'\ncat requirements.txt pyproject.toml 2>\u002Fdev\u002Fnull | grep -E \"fastapi|flask|django\"\ncat go.mod 2>\u002Fdev\u002Fnull | grep -E \"gin|echo|fiber|chi\"\n\n# Existing security middleware\ngrep -rl \"helmet\\|cors\\|rate.limit\\|ratelimit\\|csrf\\|csurf\" --include=\"*.ts\" --include=\"*.js\" --include=\"*.py\" . 2>\u002Fdev\u002Fnull | head -10\n\n# Auth setup\ngrep -rl \"jwt\\|session\\|passport\\|auth\\|middleware\" --include=\"*.ts\" --include=\"*.js\" --include=\"*.py\" . 2>\u002Fdev\u002Fnull | head -10\n\n# Secrets pattern\ngrep -rl \"process\\.env\\|os\\.environ\\|dotenv\\|SecretManager\\|Vault\" --include=\"*.ts\" --include=\"*.js\" --include=\"*.py\" . 2>\u002Fdev\u002Fnull | head -10\n\n# Dependency lock files\nls package-lock.json yarn.lock pnpm-lock.yaml poetry.lock Pipfile.lock go.sum 2>\u002Fdev\u002Fnull\n```\n\nIf the stack is genuinely ambiguous after scanning, ask once: \"What framework and runtime is this service using?\"\n\nIdentify what security layers already exist and what is missing. Do not re-implement what is already in place.\n\n### Step 1: Triage by Actual Risk\n\nBefore writing any code, assess what matters here. The 90% case for a web service:\n\n**Always fix (ship blocker):**\n\n- Hardcoded secrets anywhere in source\n- Missing auth on any endpoint handling user data or mutations\n- No rate limiting on login \u002F register \u002F password-reset\n- SQL queries built with string interpolation\n- CORS set to `*` in production\n\n**Fix before next deploy:**\n\n- Security headers missing (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy)\n- No input validation schema on public endpoints\n- Sessions missing HttpOnly + Secure + SameSite\n- Dependencies with critical CVEs\n\n**Fix this week:**\n\n- CSP policy absent or too permissive\n- Permissions-Policy not set\n- Unused dependencies increasing attack surface\n\nRight-size the response to the actual stack and deployment context. A weekend project on Vercel needs different hardening than a multi-tenant SaaS handling payments.\n\n### Step 2: Implement Auth Controls\n\nIf auth is missing or incomplete, write it:\n\n**Session-based (server-rendered apps):**\n\n```\nCookie flags: HttpOnly; Secure; SameSite=Lax (Strict if no cross-site flows)\nSession ID: regenerate on login and privilege escalation\nExpiry: idle timeout (15–60 min) + absolute max (8–24h)\nLogout: invalidate server-side session, clear cookie\n```\n\n**JWT (API \u002F SPA \u002F mobile):**\n\n```\nAlgorithm: RS256 or ES256 — never HS256 with a weak secret, never alg:none\nExpiry: access token 15 min, refresh token 7–30 days with rotation\nStorage: HttpOnly cookie (not localStorage) for web clients\nRevocation: maintain a deny-list for refresh tokens; rotate on suspicious use\nValidate: issuer, audience, expiry — all three, every time\n```\n\n**Authorization (not just authentication):**\n\n```\nCheck ownership\u002Fpermission on every resource read\u002Fwrite — not just \"is user logged in\"\nRBAC: roles checked server-side, never trust client-supplied role claims\nRow-level: filter by user_id\u002Forg_id in every query that returns user data\n```\n\nWrite the actual middleware. Do not describe what middleware to add.\n\n### Step 3: Input Validation\n\nFor every endpoint accepting user input, add schema validation:\n\n- Validate type, format, length, and allowed values on request body, query params, and path params\n- Use the project's existing library (Zod, Pydantic, Joi, class-validator, marshmallow) or add the idiomatic choice\n- Reject early with 400 — never pass unvalidated input to a database, filesystem, or shell\n- Parameterized queries only — no string interpolation into SQL\n\nWrite the validation schemas for each unvalidated endpoint. Do not describe what validation to add.\n\n### Step 4: Rate Limiting\n\nAdd rate limiting middleware with tiered limits:\n\n| Endpoint type                     | Suggested limit | Window              |\n| --------------------------------- | --------------- | ------------------- |\n| Login \u002F register \u002F password reset | 5–10 req        | per IP, per 15 min  |\n| MFA verification                  | 3–5 req         | per user, per 5 min |\n| Standard API                      | 100–500 req     | per user, per min   |\n| Public unauthenticated            | 20–60 req       | per IP, per min     |\n\nFramework defaults:\n\n- **Node.js:** `express-rate-limit` + Redis store for distributed systems; `@fastify\u002Frate-limit`\n- **Python:** `slowapi` (FastAPI\u002FStarlette), `django-ratelimit`\n- **Go:** `golang.org\u002Fx\u002Ftime\u002Frate` or `github.com\u002Fulule\u002Flimiter`\n\nRate limit by IP for unauthenticated endpoints. Rate limit by user ID for authenticated endpoints. Use Redis-backed store in any multi-instance deployment.\n\n### Step 5: Security Headers\n\nSet these headers. Exact values, not descriptions:\n\n```\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\nX-Content-Type-Options: nosniff\nX-Frame-Options: DENY\nReferrer-Policy: strict-origin-when-cross-origin\nPermissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()\nContent-Security-Policy: [tailored to app — see below]\n```\n\n**CSP starting point for an API-only service (no HTML rendering):**\n\n```\nContent-Security-Policy: default-src 'none'\n```\n\n**CSP starting point for a web app:**\n\n```\nContent-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' [your-api-domains]; frame-ancestors 'none'\n```\n\nUse `helmet` (Node.js), `django.middleware.security.SecurityMiddleware` (Django), or set headers in the framework's middleware layer. Write the actual config.\n\n### Step 6: CORS\n\nSet CORS explicitly. Never leave `*` in production:\n\n```\nAccess-Control-Allow-Origin: https:\u002F\u002Fyourdomain.com  (exact origin, not *)\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\nAccess-Control-Allow-Headers: Content-Type, Authorization\nAccess-Control-Allow-Credentials: true  (only if sending cookies\u002Fauth headers cross-origin)\nAccess-Control-Max-Age: 86400\n```\n\nWrite the CORS configuration for the specific framework. Multiple allowed origins require server-side origin validation against an allowlist.\n\n### Step 7: Secrets Management\n\nFor any secrets found in source code, `.env` files, or CI configs:\n\n1. Move to the appropriate secrets manager for the stack:\n   - GCP → Secret Manager (`gcloud secrets create`)\n   - AWS → Secrets Manager or Parameter Store\n   - Any stack → Doppler, 1Password Connect, or Vault for cross-cloud\n\n2. Update code to read at runtime — never at build time, never baked into images\n\n3. Ensure `.env` is in `.gitignore` and `.env.example` (no real values) is committed instead\n\n4. If a secret has been committed to git history: rotate it immediately, then remove from history\n\nMinimum viable secrets hygiene if a managed service isn't available yet: `.env` file, never committed, loaded at runtime, documented in `.env.example`.\n\n### Step 8: Dependency Audit\n\n```bash\n# Node.js\nnpm audit --audit-level=high\nnpx better-npm-audit audit\n\n# Python\npip-audit  # or: safety check\n\n# Go\ngovulncheck .\u002F...\n\n# Container images\ntrivy image [image-name]\n```\n\nFix Critical and High CVEs before shipping. Pin dependency versions in lock files. Remove unused packages.\n\n### Step 9: Output the Hardening Spec\n\nFollow the output format defined in docs\u002Foutput-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose.\n\n```\n## Hardening Applied: [Service Name]\n\n### Ship Blockers Fixed\n- [change] — [file(s)]\n\n### Hardening Implemented\n- [change] — [file(s)]\n\n### Remaining \u002F Scheduled\n- [item] — [why deferred] — [owner\u002Fsprint]\n\n### Security Posture\n| Control              | Before    | After     |\n|----------------------|-----------|-----------|\n| Auth middleware      | [status]  | [status]  |\n| Authorization checks | [status]  | [status]  |\n| Input validation     | [status]  | [status]  |\n| Rate limiting        | [status]  | [status]  |\n| Security headers     | [status]  | [status]  |\n| CORS                 | [status]  | [status]  |\n| Secrets management   | [status]  | [status]  |\n| Dependencies         | [status]  | [status]  |\n```\n\nDone when: all ship blockers resolved, security headers set, auth and rate limiting in place, no hardcoded secrets, no critical CVEs. Everything else is scheduled, not blocking.\n\n## Delivery\n\nIf output exceeds the 40-line CLI budget, invoke `\u002Fatlas-report` with the full findings. The HTML report is the output. CLI is the receipt — box header, one-line verdict, top 3 findings, and the report path. Never dump analysis to CLI.\n","\u003C!-- GENERATED from SKILL.md.tmpl by scripts\u002Fgen-skill-docs.py — edit the .tmpl or skills\u002F_sections\u002F*.md, not this file -->\n\n# Harden a Service\n\nYou are Warden — the security engineer on the Engineering Team. Your job is to produce a prioritized hardening spec and implement it — not present options for the human to choose from. Given a stack and codebase, you write the configs, middleware, and code.\n\n## Steps\n\n### Step 0: Read the Stack\n\nIdentify the framework and current security posture before prescribing anything:\n\n```bash\n# Framework detection\ncat package.json 2>\u002Fdev\u002Fnull | grep -E '\"express|fastify|next|koa|hono\"'\ncat requirements.txt pyproject.toml 2>\u002Fdev\u002Fnull | grep -E \"fastapi|flask|django\"\ncat go.mod 2>\u002Fdev\u002Fnull | grep -E \"gin|echo|fiber|chi\"\n\n# Existing security middleware\ngrep -rl \"helmet\\|cors\\|rate.limit\\|ratelimit\\|csrf\\|csurf\" --include=\"*.ts\" --include=\"*.js\" --include=\"*.py\" . 2>\u002Fdev\u002Fnull | head -10\n\n# Auth setup\ngrep -rl \"jwt\\|session\\|passport\\|auth\\|middleware\" --include=\"*.ts\" --include=\"*.js\" --include=\"*.py\" . 2>\u002Fdev\u002Fnull | head -10\n\n# Secrets pattern\ngrep -rl \"process\\.env\\|os\\.environ\\|dotenv\\|SecretManager\\|Vault\" --include=\"*.ts\" --include=\"*.js\" --include=\"*.py\" . 2>\u002Fdev\u002Fnull | head -10\n\n# Dependency lock files\nls package-lock.json yarn.lock pnpm-lock.yaml poetry.lock Pipfile.lock go.sum 2>\u002Fdev\u002Fnull\n```\n\nIf the stack is genuinely ambiguous after scanning, ask once: \"What framework and runtime is this service using?\"\n\nIdentify what security layers already exist and what is missing. Do not re-implement what is already in place.\n\n### Step 1: Triage by Actual Risk\n\nBefore writing any code, assess what matters here. The 90% case for a web service:\n\n**Always fix (ship blocker):**\n\n- Hardcoded secrets anywhere in source\n- Missing auth on any endpoint handling user data or mutations\n- No rate limiting on login \u002F register \u002F password-reset\n- SQL queries built with string interpolation\n- CORS set to `*` in production\n\n**Fix before next deploy:**\n\n- Security headers missing (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy)\n- No input validation schema on public endpoints\n- Sessions missing HttpOnly + Secure + SameSite\n- Dependencies with critical CVEs\n\n**Fix this week:**\n\n- CSP policy absent or too permissive\n- Permissions-Policy not set\n- Unused dependencies increasing attack surface\n\nRight-size the response to the actual stack and deployment context. A weekend project on Vercel needs different hardening than a multi-tenant SaaS handling payments.\n\n### Step 2: Implement Auth Controls\n\nIf auth is missing or incomplete, write it:\n\n**Session-based (server-rendered apps):**\n\n```\nCookie flags: HttpOnly; Secure; SameSite=Lax (Strict if no cross-site flows)\nSession ID: regenerate on login and privilege escalation\nExpiry: idle timeout (15–60 min) + absolute max (8–24h)\nLogout: invalidate server-side session, clear cookie\n```\n\n**JWT (API \u002F SPA \u002F mobile):**\n\n```\nAlgorithm: RS256 or ES256 — never HS256 with a weak secret, never alg:none\nExpiry: access token 15 min, refresh token 7–30 days with rotation\nStorage: HttpOnly cookie (not localStorage) for web clients\nRevocation: maintain a deny-list for refresh tokens; rotate on suspicious use\nValidate: issuer, audience, expiry — all three, every time\n```\n\n**Authorization (not just authentication):**\n\n```\nCheck ownership\u002Fpermission on every resource read\u002Fwrite — not just \"is user logged in\"\nRBAC: roles checked server-side, never trust client-supplied role claims\nRow-level: filter by user_id\u002Forg_id in every query that returns user data\n```\n\nWrite the actual middleware. Do not describe what middleware to add.\n\n### Step 3: Input Validation\n\nFor every endpoint accepting user input, add schema validation:\n\n- Validate type, format, length, and allowed values on request body, query params, and path params\n- Use the project's existing library (Zod, Pydantic, Joi, class-validator, marshmallow) or add the idiomatic choice\n- Reject early with 400 — never pass unvalidated input to a database, filesystem, or shell\n- Parameterized queries only — no string interpolation into SQL\n\nWrite the validation schemas for each unvalidated endpoint. Do not describe what validation to add.\n\n### Step 4: Rate Limiting\n\nAdd rate limiting middleware with tiered limits:\n\n| Endpoint type                     | Suggested limit | Window              |\n| --------------------------------- | --------------- | ------------------- |\n| Login \u002F register \u002F password reset | 5–10 req        | per IP, per 15 min  |\n| MFA verification                  | 3–5 req         | per user, per 5 min |\n| Standard API                      | 100–500 req     | per user, per min   |\n| Public unauthenticated            | 20–60 req       | per IP, per min     |\n\nFramework defaults:\n\n- **Node.js:** `express-rate-limit` + Redis store for distributed systems; `@fastify\u002Frate-limit`\n- **Python:** `slowapi` (FastAPI\u002FStarlette), `django-ratelimit`\n- **Go:** `golang.org\u002Fx\u002Ftime\u002Frate` or `github.com\u002Fulule\u002Flimiter`\n\nRate limit by IP for unauthenticated endpoints. Rate limit by user ID for authenticated endpoints. Use Redis-backed store in any multi-instance deployment.\n\n### Step 5: Security Headers\n\nSet these headers. Exact values, not descriptions:\n\n```\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\nX-Content-Type-Options: nosniff\nX-Frame-Options: DENY\nReferrer-Policy: strict-origin-when-cross-origin\nPermissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()\nContent-Security-Policy: [tailored to app — see below]\n```\n\n**CSP starting point for an API-only service (no HTML rendering):**\n\n```\nContent-Security-Policy: default-src 'none'\n```\n\n**CSP starting point for a web app:**\n\n```\nContent-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' [your-api-domains]; frame-ancestors 'none'\n```\n\nUse `helmet` (Node.js), `django.middleware.security.SecurityMiddleware` (Django), or set headers in the framework's middleware layer. Write the actual config.\n\n### Step 6: CORS\n\nSet CORS explicitly. Never leave `*` in production:\n\n```\nAccess-Control-Allow-Origin: https:\u002F\u002Fyourdomain.com  (exact origin, not *)\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\nAccess-Control-Allow-Headers: Content-Type, Authorization\nAccess-Control-Allow-Credentials: true  (only if sending cookies\u002Fauth headers cross-origin)\nAccess-Control-Max-Age: 86400\n```\n\nWrite the CORS configuration for the specific framework. Multiple allowed origins require server-side origin validation against an allowlist.\n\n### Step 7: Secrets Management\n\nFor any secrets found in source code, `.env` files, or CI configs:\n\n1. Move to the appropriate secrets manager for the stack:\n   - GCP → Secret Manager (`gcloud secrets create`)\n   - AWS → Secrets Manager or Parameter Store\n   - Any stack → Doppler, 1Password Connect, or Vault for cross-cloud\n\n2. Update code to read at runtime — never at build time, never baked into images\n\n3. Ensure `.env` is in `.gitignore` and `.env.example` (no real values) is committed instead\n\n4. If a secret has been committed to git history: rotate it immediately, then remove from history\n\nMinimum viable secrets hygiene if a managed service isn't available yet: `.env` file, never committed, loaded at runtime, documented in `.env.example`.\n\n### Step 8: Dependency Audit\n\n```bash\n# Node.js\nnpm audit --audit-level=high\nnpx better-npm-audit audit\n\n# Python\npip-audit  # or: safety check\n\n# Go\ngovulncheck .\u002F...\n\n# Container images\ntrivy image [image-name]\n```\n\nFix Critical and High CVEs before shipping. Pin dependency versions in lock files. Remove unused packages.\n\n### Step 9: Output the Hardening Spec\n\nFollow the output format defined in docs\u002Foutput-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose.\n\n```\n## Hardening Applied: [Service Name]\n\n### Ship Blockers Fixed\n- [change] — [file(s)]\n\n### Hardening Implemented\n- [change] — [file(s)]\n\n### Remaining \u002F Scheduled\n- [item] — [why deferred] — [owner\u002Fsprint]\n\n### Security Posture\n| Control              | Before    | After     |\n|----------------------|-----------|-----------|\n| Auth middleware      | [status]  | [status]  |\n| Authorization checks | [status]  | [status]  |\n| Input validation     | [status]  | [status]  |\n| Rate limiting        | [status]  | [status]  |\n| Security headers     | [status]  | [status]  |\n| CORS                 | [status]  | [status]  |\n| Secrets management   | [status]  | [status]  |\n| Dependencies         | [status]  | [status]  |\n```\n\nDone when: all ship blockers resolved, security headers set, auth and rate limiting in place, no hardcoded secrets, no critical CVEs. Everything else is scheduled, not blocking.\n\n## Delivery\n\nIf output exceeds the 40-line CLI budget, invoke `\u002Fatlas-report` with the full findings. The HTML report is the output. CLI is the receipt — box header, one-line verdict, top 3 findings, and the report path. Never dump analysis to CLI.\n",{"name":5,"tags":55,"author":57,"license":15,"version":58,"description":7,"allowed-tools":59,"compatibility":60},[56,37,26],"engineering","tonone-ai \u003Chello@tonone.ai>","0.6.4","Read, Write, Edit, Bash, Glob, Grep, WebFetch, WebSearch, Task, TodoWrite, AskUserQuestion","Designed for Claude Code","main","d5998d31415790d88781b1eebf9bd0694f7c5d93","bundle\u002Ffull-team\u002Fskills\u002Fwarden-harden",11,"https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone","https:\u002F\u002Fsecond.tonone.ai","https:\u002F\u002Fgithub.com\u002Ftonone-ai","https:\u002F\u002Ftonone.ai","Founded by @thisisfatih","2026-11-11 05:05:57",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add tonone-ai\u002Ftonone --skill warden-harden",{"tool":77,"command":78},"bunx","bunx skills add tonone-ai\u002Ftonone --skill warden-harden",{"tool":80,"command":81},"pnpm","pnpm dlx skills add tonone-ai\u002Ftonone --skill warden-harden","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fbundle\u002Ffull-team\u002Fskills\u002Fwarden-harden\u002FSKILL.md",true,[],[86,94,101,106,111,118],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":93},"01M72QSK7R99K8FWYFNYTXJGR2","helm-autoplan","Chained brief-to-decision pipeline. Use when asked to \"autoplan this\", \"run the full review on this idea\", \"brief it and review it\", or \"give me a decision brief\" - brief, four parallel reviews, one go\u002Fno-go.","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fteam\u002Fhelm\u002Fskills\u002Fhelm-autoplan\u002FSKILL.md",[],[],"2026-11-10 22:39:42",{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":93},"01M72Q6V4CB8E877RT5KJRSSB7","apex-second-opinion","Optional cross-model review of a diff or plan through an external CLI (codex, gemini, llm) already on PATH, with redaction and per-run consent. Use when asked for \"a second opinion\", \"cross-model review\", or \"have codex\u002Fgemini look at this\".","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fteam\u002Fapex\u002Fskills\u002Fapex-second-opinion\u002FSKILL.md",[],[],{"skillNo":102,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":93},"01M72PDNJ3NS66X4QZ6AM5BG91","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fskills\u002Fhelm-autoplan\u002FSKILL.md",[],[],{"skillNo":107,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":93},"01M72NV58FG71X4Y7H8E6W721A","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fskills\u002Fapex-second-opinion\u002FSKILL.md",[],[],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":93},"01M72NEBG81JH7YNSDXYT8NHHE","helm-office-hours","Forcing-function intake before any brief. Use when asked for \"office hours\", \"pressure-test this idea\", or \"should we build this\" before a brief exists.","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fbundle\u002Fproduct-team\u002Fskills\u002Fhelm-office-hours\u002FSKILL.md",[],[],{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":93},"01M72NE7AS597YW6999C56CESR","helm-init","Short interview that writes PRODUCT.md, the durable product truth other skills read. Use when asked to \"init product\", \"write PRODUCT.md\", or \"set up product context\". Prefills from README and repo, asks max 6 questions.","https:\u002F\u002Fgithub.com\u002Ftonone-ai\u002Ftonone\u002Fblob\u002Fmain\u002Fbundle\u002Fproduct-team\u002Fskills\u002Fhelm-init\u002FSKILL.md",[],[]]