[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EB6AYPYCBSYBPCYPXH646H":3,"skill-same:01M6EB6AYPYCBSYBPCYPXH646H":153},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":59,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M6EB6AYPYCBSYBPCYPXH646H","common-owasp",null,"OWASP Top 10 audit checklist for Web Applications (2021) and APIs (2023). Load during any security review, PR review, or codebase audit touching web, mobile backend, or API code. (triggers: security review, OWASP, broken access control, IDOR, BOLA, injection, broken auth, API review, authorization, access control)","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FHoangNguyen0403\u002Fagent-skills-standard\u002Fcommon-owasp\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"common owasp","common","owasp","injection","triggers","Access Control","mobile","broken","access","api","applications","review","audit","code","owasp top 10","pr","security review","pr review","auth","security","2026-11-10 10:12:30",false,"---\nname: common-owasp\ndescription: \"OWASP Top 10 audit checklist for Web Applications (2021) and APIs (2023). Load during any security review, PR review, or codebase audit touching web, mobile backend, or API code. (triggers: security review, OWASP, broken access control, IDOR, BOLA, injection, broken auth, API review, authorization, access control)\"\n---\n\n# OWASP Top 10 Security Checklist\n\n## **Priority: P0 (CRITICAL)**\n\n## Implementation Guidelines\n\n- **Check A01\u002FAPI1 first**: IDOR is the #1 finding in real codebases — any `findById(userInput)` without an owner\u002Ftenant filter is an immediate P0.\n- **Mark each item**: ✅ not affected | ⚠️ needs review | ? confirmed finding.\n- **P0 finding caps Security score at 40\u002F100** — do not skip any item.\n- Apply framework-specific security skills alongside this checklist.\n- See [references\u002Fowasp-web.md](references\u002Fowasp-web.md) and [references\u002Fowasp-api.md](references\u002Fowasp-api.md) for full detection signals per item.\n\n## OWASP Web Application Top 10 (2021)\n\n| ID  | Risk | Key Detection Signal |\n| --- | ---- | -------------------- |\n| A01 | Broken Access Control | `findById(params.id)` without owner filter. Route without `@authorize`. |\n| A02 | Cryptographic Failures | Weak hash (MD5\u002FSHA1) for passwords. HTTP URL hardcoded. No TLS. |\n| A03 | Injection | String concat in DB queries. Unsanitized input to templates. XSS. |\n| A04 | Insecure Design | No rate limiting on auth. Missing input validation at entry points. |\n| A05 | Security Misconfiguration | CORS `*`. Debug mode in prod. Missing security headers (CSP, HSTS). |\n| A06 | Vulnerable Components | CVE in dependency audit. Unreviewed new direct dependency. |\n| A07 | Auth Failures | JWT without expiry. No session invalidation on logout. |\n| A08 | Data Integrity Failures | Unverified JWT\u002Fcookie. Deserialization of untrusted input. |\n| A09 | Logging & Monitoring | No audit log on: deletion, password change, privilege escalation. |\n| A10 | SSRF | HTTP client with user-controlled URL and no allowlist. |\n\n## OWASP API Security Top 10 (2023)\n\n| ID    | Risk | Key Detection Signal |\n| ----- | ---- | -------------------- |\n| API1  | Broken Object Level Auth (BOLA) | Resource by user-supplied ID without `AND owner_id = currentUser`. |\n| API2  | Broken Authentication | JWT missing `exp`. Token not revoked on logout. Bearer in URL. |\n| API3  | Broken Property Level Auth | Full ORM entity returned. No DTO projection. Mass assignment. |\n| API4  | Unrestricted Resource Consumption | No server-enforced `limit`\u002F`pageSize`. No throttle on heavy ops. |\n| API5  | Broken Function Level Auth | Admin route reachable without role guard. |\n| API6  | Unrestricted Business Flow | No verification on OTP\u002Fcheckout\u002Fpassword-reset flows. |\n| API8  | Security Misconfiguration | Stack trace in response. CORS `*` on authenticated routes. |\n| API9  | Improper Inventory Management | Deprecated\u002Fundocumented endpoints still reachable. |\n| API10 | Unsafe API Consumption | Third-party response used without schema validation. |\n\n## Anti-Patterns\n\n- **No IDOR**: Filter every resource query by `owner_id` or `tenantId` alongside the user-supplied ID.\n- **No wildcard CORS**: Restrict to explicit, allowlisted origins — never `*` on authenticated routes.\n- **No full entity return**: Always project to a DTO — never serialize raw ORM output to the API response.\n\n## References\n\n- [OWASP Web App — Full Detection Signals](references\u002Fowasp-web.md)\n- [OWASP API — Full Detection Signals](references\u002Fowasp-api.md)\n\n","# OWASP Top 10 Security Checklist\n\n## **Priority: P0 (CRITICAL)**\n\n## Implementation Guidelines\n\n- **Check A01\u002FAPI1 first**: IDOR is the #1 finding in real codebases — any `findById(userInput)` without an owner\u002Ftenant filter is an immediate P0.\n- **Mark each item**: ✅ not affected | ⚠️ needs review | ? confirmed finding.\n- **P0 finding caps Security score at 40\u002F100** — do not skip any item.\n- Apply framework-specific security skills alongside this checklist.\n- See [references\u002Fowasp-web.md](references\u002Fowasp-web.md) and [references\u002Fowasp-api.md](references\u002Fowasp-api.md) for full detection signals per item.\n\n## OWASP Web Application Top 10 (2021)\n\n| ID  | Risk | Key Detection Signal |\n| --- | ---- | -------------------- |\n| A01 | Broken Access Control | `findById(params.id)` without owner filter. Route without `@authorize`. |\n| A02 | Cryptographic Failures | Weak hash (MD5\u002FSHA1) for passwords. HTTP URL hardcoded. No TLS. |\n| A03 | Injection | String concat in DB queries. Unsanitized input to templates. XSS. |\n| A04 | Insecure Design | No rate limiting on auth. Missing input validation at entry points. |\n| A05 | Security Misconfiguration | CORS `*`. Debug mode in prod. Missing security headers (CSP, HSTS). |\n| A06 | Vulnerable Components | CVE in dependency audit. Unreviewed new direct dependency. |\n| A07 | Auth Failures | JWT without expiry. No session invalidation on logout. |\n| A08 | Data Integrity Failures | Unverified JWT\u002Fcookie. Deserialization of untrusted input. |\n| A09 | Logging & Monitoring | No audit log on: deletion, password change, privilege escalation. |\n| A10 | SSRF | HTTP client with user-controlled URL and no allowlist. |\n\n## OWASP API Security Top 10 (2023)\n\n| ID    | Risk | Key Detection Signal |\n| ----- | ---- | -------------------- |\n| API1  | Broken Object Level Auth (BOLA) | Resource by user-supplied ID without `AND owner_id = currentUser`. |\n| API2  | Broken Authentication | JWT missing `exp`. Token not revoked on logout. Bearer in URL. |\n| API3  | Broken Property Level Auth | Full ORM entity returned. No DTO projection. Mass assignment. |\n| API4  | Unrestricted Resource Consumption | No server-enforced `limit`\u002F`pageSize`. No throttle on heavy ops. |\n| API5  | Broken Function Level Auth | Admin route reachable without role guard. |\n| API6  | Unrestricted Business Flow | No verification on OTP\u002Fcheckout\u002Fpassword-reset flows. |\n| API8  | Security Misconfiguration | Stack trace in response. CORS `*` on authenticated routes. |\n| API9  | Improper Inventory Management | Deprecated\u002Fundocumented endpoints still reachable. |\n| API10 | Unsafe API Consumption | Third-party response used without schema validation. |\n\n## Anti-Patterns\n\n- **No IDOR**: Filter every resource query by `owner_id` or `tenantId` alongside the user-supplied ID.\n- **No wildcard CORS**: Restrict to explicit, allowlisted origins — never `*` on authenticated routes.\n- **No full entity return**: Always project to a DTO — never serialize raw ORM output to the API response.\n\n## References\n\n- [OWASP Web App — Full Detection Signals](references\u002Fowasp-web.md)\n- [OWASP API — Full Detection Signals](references\u002Fowasp-api.md)\n\n",{"name":5,"description":7},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002FHoangNguyen0403\u002Fagent-skills-standard\u002Fcommon-owasp",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill common-owasp",{"tool":69,"command":70},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill common-owasp",{"tool":72,"command":73},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill common-owasp","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FHoangNguyen0403\u002Fagent-skills-standard\u002Fcommon-owasp\u002FSKILL.md",true,[77,83,87,91,97,103,107,113,117,121,125,129,133,137,141,145,149],{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"agents\u002Fanalyzer.md","REFERENCE","参考文档",10376,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fagents\u002Fanalyzer.md",{"path":84,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":85,"sourceHtmlUrl":86},"agents\u002Fcomparator.md",7287,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fagents\u002Fcomparator.md",{"path":88,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":89,"sourceHtmlUrl":90},"agents\u002Fgrader.md",9049,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fagents\u002Fgrader.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"assets\u002Feval_review.html","ASSET","资产文件",7058,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fassets\u002Feval_review.html",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"eval-viewer\u002Fgenerate_review.py","SCRIPT","脚本",16365,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Feval-viewer\u002Fgenerate_review.py",{"path":104,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":105,"sourceHtmlUrl":106},"eval-viewer\u002Fviewer.html",44998,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Feval-viewer\u002Fviewer.html",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"LICENSE.txt","LICENSE","许可证",11345,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002FLICENSE.txt",{"path":114,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fschemas.md",12061,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Freferences\u002Fschemas.md",{"path":118,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002F__init__.py",0,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fscripts\u002F__init__.py",{"path":122,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Faggregate_benchmark.py",14386,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fscripts\u002Faggregate_benchmark.py",{"path":126,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fgenerate_report.py",12847,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fscripts\u002Fgenerate_report.py",{"path":130,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":131,"sourceHtmlUrl":132},"scripts\u002Fimprove_description.py",11116,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fscripts\u002Fimprove_description.py",{"path":134,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":135,"sourceHtmlUrl":136},"scripts\u002Fpackage_skill.py",4234,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fscripts\u002Fpackage_skill.py",{"path":138,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":139,"sourceHtmlUrl":140},"scripts\u002Fquick_validate.py",3972,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fscripts\u002Fquick_validate.py",{"path":142,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":143,"sourceHtmlUrl":144},"scripts\u002Frun_eval.py",11464,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fscripts\u002Frun_eval.py",{"path":146,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":147,"sourceHtmlUrl":148},"scripts\u002Frun_loop.py",13605,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fscripts\u002Frun_loop.py",{"path":150,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":151,"sourceHtmlUrl":152},"scripts\u002Futils.py",1661,"https:\u002F\u002Fgithub.com\u002Fa1627418541\u002F-\u002Fblob\u002Fmain\u002F.neovate\u002Fskills\u002Fskill-creator\u002Fscripts\u002Futils.py",[154,166,176,185,191,198],{"skillNo":155,"name":156,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":162,"publishedAt":49},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[159],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[163,164,165],"model","model hierarchy","model hierarchy skill",{"skillNo":167,"name":168,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":49},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[171],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},[173,174,175],"MCP","zoom","zoom mcp",{"skillNo":177,"name":178,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":49},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[182,183,184,174],"sdk","zoom apps sdk","apps",{"skillNo":186,"name":187,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":49},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[187],{"skillNo":192,"name":193,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":49},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[196],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},[193],{"skillNo":199,"name":200,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":49},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[200]]