[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EMMFDBTQ037G9KXAJ7ARWD":3,"skill-same:01M6EMMFDBTQ037G9KXAJ7ARWD":69},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":43,"repositoryHtmlUrl":44,"repositoryHomepageUrl":45,"ownerHtmlUrl":46,"ownerBlogUrl":6,"ownerDescription":47,"updatedAt":48,"install":49,"resources":62},"01M6EMMFDBTQ037G9KXAJ7ARWD","pitfalls-security",null,"Security patterns for session keys, caching, logging, and environment variables. Use when implementing authentication, caching sensitive data, or setting up logging. Triggers on: session key, private key, cache, logging, secrets, environment variable.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarissozen\u002Fpitfalls-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34],"security","pitfalls security","authentication","logging","cache","data","secrets","environment","session","use","up","patterns","caching","triggers","environment variables","security patterns","2026-11-10 10:12:30",false,"---\nname: pitfalls-security\ndescription: \"Security patterns for session keys, caching, logging, and environment variables. Use when implementing authentication, caching sensitive data, or setting up logging. Triggers on: session key, private key, cache, logging, secrets, environment variable.\"\n---\n\n# Security Pitfalls\n\nCommon pitfalls and correct patterns for security.\n\n## When to Use\n\n- Implementing session key management\n- Caching data (especially sensitive)\n- Setting up structured logging\n- Handling environment variables\n- Reviewing security-sensitive code\n\n## Workflow\n\n### Step 1: Check Key Storage\n\nVerify no private keys stored in plaintext.\n\n### Step 2: Verify Cache Safety\n\nEnsure sensitive data not cached inappropriately.\n\n### Step 3: Check Logging\n\nConfirm no secrets in logs.\n\n---\n\n## Session Key Security\n\n```typescript\n\u002F\u002F ❌ NEVER store private keys\nlocalStorage.setItem('privateKey', key);  \u002F\u002F CATASTROPHIC\n\n\u002F\u002F ✅ Use session keys with limited permissions\ninterface SessionKey {\n  address: Address;\n  permissions: Permission[];\n  expiresAt: Date;\n  maxPerTrade: bigint;\n}\n\n\u002F\u002F ✅ AES-256-GCM for any stored credentials\nimport { createCipheriv, randomBytes } from 'crypto';\nconst iv = randomBytes(16);\nconst cipher = createCipheriv('aes-256-gcm', key, iv);\n\n\u002F\u002F ✅ Audit logging for all key operations\nawait auditLog.create({\n  action: 'SESSION_KEY_CREATED',\n  userId,\n  metadata: { permissions, expiresAt },\n});\n```\n\n## Environment Variables\n\n```typescript\n\u002F\u002F Frontend (Vite)\nconst apiUrl = import.meta.env.VITE_API_URL;  \u002F\u002F ✅ VITE_ prefix required\n\u002F\u002F ❌ process.env.API_URL won't work in frontend\n\n\u002F\u002F Backend\nconst dbUrl = process.env.DATABASE_URL;\n\n\u002F\u002F ❌ NEVER log secrets\nconsole.log('Config:', config);  \u002F\u002F May contain secrets!\n\u002F\u002F ✅ Log safely\nconsole.log('Config loaded for:', config.environment);\n```\n\n## Caching Strategies\n\n```typescript\n\u002F\u002F ✅ Server-side cache for expensive computations\nconst priceCache = new Map\u003Cstring, { value: number; expires: number }>();\n\nfunction getCachedPrice(token: string): number | null {\n  const cached = priceCache.get(token);\n  if (cached && cached.expires > Date.now()) {\n    return cached.value;\n  }\n  return null;\n}\n\n\u002F\u002F ✅ TTL based on data freshness needs\nconst CACHE_TTL = {\n  tokenPrice: 10_000,      \u002F\u002F 10s - prices change fast\n  poolReserves: 5_000,     \u002F\u002F 5s - critical for swaps\n  gasPrice: 15_000,        \u002F\u002F 15s\n  userBalance: 30_000,     \u002F\u002F 30s\n  tokenMetadata: 3600_000, \u002F\u002F 1 hour - rarely changes\n};\n\n\u002F\u002F ❌ Never cache user-specific sensitive data\ncache.set(`user:${userId}:privateKey`, key);  \u002F\u002F NEVER!\n```\n\n## Structured Logging\n\n```typescript\n\u002F\u002F ✅ Structured logging (JSON format)\nconst logger = {\n  info: (message: string, context?: object) => {\n    console.log(JSON.stringify({\n      level: 'info',\n      message,\n      timestamp: new Date().toISOString(),\n      ...context,\n    }));\n  },\n  error: (message: string, error: Error, context?: object) => {\n    console.error(JSON.stringify({\n      level: 'error',\n      message,\n      error: error.message,\n      stack: error.stack,\n      timestamp: new Date().toISOString(),\n      ...context,\n    }));\n  },\n};\n\n\u002F\u002F ✅ Include context\nlogger.info('Trade executed', {\n  userId: 'user123',\n  txHash: '0x...',\n  chain: 'ethereum',\n  profit: '12.34',\n});\n\n\u002F\u002F ❌ NEVER log secrets\nlogger.info('Config', { apiKey: process.env.API_KEY });  \u002F\u002F NEVER!\n```\n\n## Audit Logging\n\n```typescript\n\u002F\u002F ✅ Audit logging for sensitive operations\nawait auditLog.create({\n  action: 'TRADE_EXECUTED',\n  userId,\n  before: previousState,\n  after: newState,\n  timestamp: new Date(),\n  metadata: { txHash, chain },\n});\n```\n\n## Quick Checklist\n\n- [ ] No private keys in localStorage\n- [ ] Session keys have expiry and limits\n- [ ] AES-256-GCM for stored credentials\n- [ ] Audit logging for sensitive operations\n- [ ] No secrets in console.log\n- [ ] Sensitive data not cached inappropriately\n- [ ] VITE_ prefix for frontend env vars\n","# Security Pitfalls\n\nCommon pitfalls and correct patterns for security.\n\n## When to Use\n\n- Implementing session key management\n- Caching data (especially sensitive)\n- Setting up structured logging\n- Handling environment variables\n- Reviewing security-sensitive code\n\n## Workflow\n\n### Step 1: Check Key Storage\n\nVerify no private keys stored in plaintext.\n\n### Step 2: Verify Cache Safety\n\nEnsure sensitive data not cached inappropriately.\n\n### Step 3: Check Logging\n\nConfirm no secrets in logs.\n\n---\n\n## Session Key Security\n\n```typescript\n\u002F\u002F ❌ NEVER store private keys\nlocalStorage.setItem('privateKey', key);  \u002F\u002F CATASTROPHIC\n\n\u002F\u002F ✅ Use session keys with limited permissions\ninterface SessionKey {\n  address: Address;\n  permissions: Permission[];\n  expiresAt: Date;\n  maxPerTrade: bigint;\n}\n\n\u002F\u002F ✅ AES-256-GCM for any stored credentials\nimport { createCipheriv, randomBytes } from 'crypto';\nconst iv = randomBytes(16);\nconst cipher = createCipheriv('aes-256-gcm', key, iv);\n\n\u002F\u002F ✅ Audit logging for all key operations\nawait auditLog.create({\n  action: 'SESSION_KEY_CREATED',\n  userId,\n  metadata: { permissions, expiresAt },\n});\n```\n\n## Environment Variables\n\n```typescript\n\u002F\u002F Frontend (Vite)\nconst apiUrl = import.meta.env.VITE_API_URL;  \u002F\u002F ✅ VITE_ prefix required\n\u002F\u002F ❌ process.env.API_URL won't work in frontend\n\n\u002F\u002F Backend\nconst dbUrl = process.env.DATABASE_URL;\n\n\u002F\u002F ❌ NEVER log secrets\nconsole.log('Config:', config);  \u002F\u002F May contain secrets!\n\u002F\u002F ✅ Log safely\nconsole.log('Config loaded for:', config.environment);\n```\n\n## Caching Strategies\n\n```typescript\n\u002F\u002F ✅ Server-side cache for expensive computations\nconst priceCache = new Map\u003Cstring, { value: number; expires: number }>();\n\nfunction getCachedPrice(token: string): number | null {\n  const cached = priceCache.get(token);\n  if (cached && cached.expires > Date.now()) {\n    return cached.value;\n  }\n  return null;\n}\n\n\u002F\u002F ✅ TTL based on data freshness needs\nconst CACHE_TTL = {\n  tokenPrice: 10_000,      \u002F\u002F 10s - prices change fast\n  poolReserves: 5_000,     \u002F\u002F 5s - critical for swaps\n  gasPrice: 15_000,        \u002F\u002F 15s\n  userBalance: 30_000,     \u002F\u002F 30s\n  tokenMetadata: 3600_000, \u002F\u002F 1 hour - rarely changes\n};\n\n\u002F\u002F ❌ Never cache user-specific sensitive data\ncache.set(`user:${userId}:privateKey`, key);  \u002F\u002F NEVER!\n```\n\n## Structured Logging\n\n```typescript\n\u002F\u002F ✅ Structured logging (JSON format)\nconst logger = {\n  info: (message: string, context?: object) => {\n    console.log(JSON.stringify({\n      level: 'info',\n      message,\n      timestamp: new Date().toISOString(),\n      ...context,\n    }));\n  },\n  error: (message: string, error: Error, context?: object) => {\n    console.error(JSON.stringify({\n      level: 'error',\n      message,\n      error: error.message,\n      stack: error.stack,\n      timestamp: new Date().toISOString(),\n      ...context,\n    }));\n  },\n};\n\n\u002F\u002F ✅ Include context\nlogger.info('Trade executed', {\n  userId: 'user123',\n  txHash: '0x...',\n  chain: 'ethereum',\n  profit: '12.34',\n});\n\n\u002F\u002F ❌ NEVER log secrets\nlogger.info('Config', { apiKey: process.env.API_KEY });  \u002F\u002F NEVER!\n```\n\n## Audit Logging\n\n```typescript\n\u002F\u002F ✅ Audit logging for sensitive operations\nawait auditLog.create({\n  action: 'TRADE_EXECUTED',\n  userId,\n  before: previousState,\n  after: newState,\n  timestamp: new Date(),\n  metadata: { txHash, chain },\n});\n```\n\n## Quick Checklist\n\n- [ ] No private keys in localStorage\n- [ ] Session keys have expiry and limits\n- [ ] AES-256-GCM for stored credentials\n- [ ] Audit logging for sensitive operations\n- [ ] No secrets in console.log\n- [ ] Sensitive data not cached inappropriately\n- [ ] VITE_ prefix for frontend env vars\n",{"name":5,"description":7},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fbarissozen\u002Fpitfalls-security",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill pitfalls-security",{"tool":55,"command":56},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill pitfalls-security",{"tool":58,"command":59},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill pitfalls-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarissozen\u002Fpitfalls-security\u002FSKILL.md",true,[63],{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"skill-report.json","REFERENCE","参考文档",11650,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarissozen\u002Fpitfalls-security\u002Fskill-report.json",[70,84,94,103,109,116],{"skillNo":71,"name":72,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":80,"publishedAt":35},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[75],{"categoryNo":76,"categoryName":77,"taxonomyType":78,"taxonomyTypeDesc":79},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[81,82,83],"model","model hierarchy","model hierarchy skill",{"skillNo":85,"name":86,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":90,"publishedAt":35},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[89],{"categoryNo":76,"categoryName":77,"taxonomyType":78,"taxonomyTypeDesc":79},[91,92,93],"MCP","zoom","zoom mcp",{"skillNo":95,"name":96,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":35},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[100,101,102,92],"sdk","zoom apps sdk","apps",{"skillNo":104,"name":105,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":35},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[105],{"skillNo":110,"name":111,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":35},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[114],{"categoryNo":76,"categoryName":77,"taxonomyType":78,"taxonomyTypeDesc":79},[111],{"skillNo":117,"name":118,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":35},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[118]]