[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EMPZ85PFXYDM96RF3EAS4J":3,"skill-same:01M6EMPZ85PFXYDM96RF3EAS4J":137},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6EMPZ85PFXYDM96RF3EAS4J","security-sentinel",null,"Use when working with authentication, API routes, user input, or sensitive data. Audits code for security vulnerabilities based on OWASP Top 10. Critical for payment processing, auth systems, and data handling.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002FSKILL.md",[18,23,28],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"security sentinel","sentinel","security","Bash","processing","input","critical","systems","payment","use","read","grep","api","owasp","data","authentication","code","owasp top 10","auth","vulnerabilities","2026-11-10 10:12:30",false,"---\nname: security-sentinel\ndescription: Use when working with authentication, API routes, user input, or sensitive data. Audits code for security vulnerabilities based on OWASP Top 10. Critical for payment processing, auth systems, and data handling.\nallowed-tools: Read, Grep, Bash\n---\n\n# Security Sentinel (World-Class Security Skill)\n\n## When to Use\n\n**ALWAYS use this skill when:**\n- Writing\u002Freviewing API routes (especially POST\u002FPATCH\u002FPUT\u002FDELETE)\n- Implementing authentication or authorization\n- Handling user input (forms, query params, file uploads)\n- Working with database queries\n- Processing file operations\n- Managing environment variables and secrets\n- Building payment processing features\n- Implementing session management\n- Handling sensitive data or encryption\n- Before creating pull requests\n- Before deployment\n\n## Comprehensive Documentation\n\nThis skill includes complete security references:\n\n### ? Core References (10,426 lines total)\n\n1. **owasp-top-10-complete.md** (2,133 lines) - Complete OWASP Top 10 with code examples\n   - A01: Broken Access Control (IDOR, path traversal)\n   - A02: Cryptographic Failures (weak hashing, hardcoded secrets)\n   - A03: Injection (SQL, NoSQL, Command injection)\n   - A04: Insecure Design (race conditions, rate limiting)\n   - A05: Security Misconfiguration (CORS, error messages)\n   - A06: Vulnerable Components (dependency management)\n   - A07: Authentication Failures (weak passwords, MFA)\n   - A08: Integrity Failures (supply chain, deserialization)\n   - A09: Logging Failures (audit trails, monitoring)\n   - A10: SSRF (URL validation, IP blocking)\n\n2. **authentication-patterns.md** (1,529 lines) - Complete authentication guide\n   - JWT token authentication\n   - Session-based authentication\n   - Password hashing (bcrypt, Argon2)\n   - Password reset flow\n   - Email verification\n   - Multi-factor authentication (TOTP)\n   - OAuth 2.0 (GitHub, Google)\n   - Passwordless authentication (magic links)\n   - Refresh token pattern\n\n3. **authorization-patterns.md** (1,062 lines) - Access control implementation\n   - Role-Based Access Control (RBAC)\n   - Attribute-Based Access Control (ABAC)\n   - Middleware protection\n   - API route protection\n   - Server Action protection\n   - Row-level security (Drizzle patterns)\n   - Permission system\n   - Resource ownership validation\n\n4. **input-validation-complete.md** (900 lines) - Zod validation for everything\n   - String, number, boolean, enum validation\n   - Email, URL, phone, UUID validation\n   - File upload validation (images, PDFs, CSVs)\n   - Password strength requirements\n   - Credit card validation (Luhn algorithm)\n   - IP address validation (v4, v6)\n   - Async validation (database checks)\n   - Error handling and display\n\n5. **sql-injection-prevention.md** (741 lines) - Drizzle ORM security\n   - Parameterized queries (always safe)\n   - Dynamic query building\n   - Raw SQL safety patterns\n   - LIKE query sanitization\n   - Database schema security\n   - Testing for SQL injection\n\n6. **xss-prevention.md** (630 lines) - React\u002FNext.js XSS protection\n   - React's built-in escaping\n   - dangerouslySetInnerHTML with DOMPurify\n   - URL sanitization\n   - Content Security Policy (CSP)\n   - User-generated content handling\n   - innerHTML safety\n\n7. **csrf-prevention.md** (597 lines) - Cross-Site Request Forgery protection\n   - SameSite cookies (primary defense)\n   - CSRF tokens implementation\n   - Double submit cookie pattern\n   - Server Actions protection\n   - Origin header validation\n\n8. **secret-management.md** (547 lines) - Secure secret handling\n   - Environment variables best practices\n   - Secret rotation strategies\n   - Encryption at rest (AES-256-GCM)\n   - Secret detection (gitleaks, trufflehog)\n   - Production secrets (Vercel, AWS, Vault)\n\n9. **rate-limiting-patterns.md** (826 lines) - Prevent API abuse\n   - In-memory rate limiting\n   - Redis-based rate limiting\n   - API route protection\n   - Server Action protection\n   - IP-based rate limiting\n   - User-based rate limiting\n   - Sliding window algorithm\n   - Token bucket algorithm\n\n10. **security-checklist.md** (471 lines) - Pre-deployment audit (250+ items)\n    - Authentication security (passwords, sessions, JWT, MFA)\n    - Authorization security (access control, RLS)\n    - Input validation\n    - Data security (secrets, logging, database)\n    - File upload security\n    - Rate limiting\n    - Security headers (CSP, CORS, HSTS)\n    - Error handling\n    - Dependency security\n    - Monitoring and logging\n    - Infrastructure security\n    - Compliance (GDPR, PCI DSS)\n\n### ?️ Security Tools\n- **validate-security.py** (414 lines) - Automated vulnerability scanner\n  - Detects 20+ vulnerability types\n  - Scans for hardcoded secrets (API keys, passwords, tokens)\n  - Checks for SQL injection patterns\n  - Detects XSS vulnerabilities (dangerouslySetInnerHTML, innerHTML)\n  - Finds eval() and Function() usage\n  - Identifies weak cryptography (MD5, SHA1)\n  - Detects insecure randomness\n  - Checks for command injection\n  - Validates path traversal prevention\n  - Tests password hashing strength\n  - Audits JWT security\n  - Checks CORS configuration\n  - Validates cookie security (httpOnly, secure)\n  - Reports TypeScript issues (@ts-ignore, any)\n  - Exits with error on CRITICAL\u002FHIGH issues\n  - Identifies XSS vulnerabilities\n  - Finds eval() and Function() usage\n  - Detects weak cryptography (MD5, SHA1)\n  - Checks for command injection\n  - Validates password hashing\n  - Finds CORS misconfigurations\n  - Checks for missing httpOnly cookies\n  - Reports TypeScript issues (@ts-ignore, any types)\n\n### ? Quick Start\n\n**Before implementing ANY security-sensitive feature:**\n```bash\n# 1. Read the relevant guide\ncat owasp-top-10-complete.md\ncat authentication-patterns.md\n\n# 2. Implement following patterns\n\n# 3. Run security scanner\npython validate-security.py src\u002F\n\n# 4. Check against security checklist\ncat security-checklist.md\n```\n\n## When to Use\n\n## OWASP Top 10 Security Checks\n\n### 1. Injection Attacks\n\n#### SQL Injection\n```typescript\n\u002F\u002F ❌ DON'T: String concatenation in queries\nconst query = `SELECT * FROM users WHERE email = '${email}'`\n\u002F\u002F Vulnerable to: email = \"' OR '1'='1\"\n\n\u002F\u002F ✅ DO: Use Prisma (parameterized queries)\nconst user = await prisma.user.findUnique({\n  where: { email },\n})\n```\n\n#### Command Injection\n```typescript\n\u002F\u002F ❌ DON'T: Unvalidated shell commands\nconst fileName = req.body.fileName\nexec(`cat ${fileName}`) \u002F\u002F Vulnerable to: fileName = \"; rm -rf \u002F\"\n\n\u002F\u002F ✅ DO: Validate input and use safe APIs\nconst allowedFiles = ['log.txt', 'data.csv']\nif (!allowedFiles.includes(fileName)) {\n  throw new Error('Invalid file name')\n}\nconst content = await fs.readFile(path.join(SAFE_DIR, fileName))\n```\n\n#### NoSQL Injection\n```typescript\n\u002F\u002F ❌ DON'T: Direct object insertion\nconst user = await db.users.findOne({ email: req.body.email })\n\u002F\u002F Vulnerable to: { email: { $ne: null } }\n\n\u002F\u002F ✅ DO: Validate input with Zod\nconst emailSchema = z.string().email()\nconst email = emailSchema.parse(req.body.email)\nconst user = await db.users.findOne({ email })\n```\n\n### 2. Broken Authentication\n\n#### Password Storage\n```typescript\n\u002F\u002F ❌ DON'T: Plain text passwords\nconst user = await prisma.user.create({\n  data: {\n    email,\n    password, \u002F\u002F Never store plain text!\n  },\n})\n\n\u002F\u002F ✅ DO: Hash with bcrypt\nimport bcrypt from 'bcrypt'\n\nconst hashedPassword = await bcrypt.hash(password, 12) \u002F\u002F 12 rounds minimum\nconst user = await prisma.user.create({\n  data: {\n    email,\n    password: hashedPassword,\n  },\n})\n```\n\n#### Session Management\n```typescript\n\u002F\u002F ❌ DON'T: Weak session tokens\nconst sessionId = Math.random().toString()\n\n\u002F\u002F ✅ DO: Cryptographically secure tokens\nimport crypto from 'crypto'\nconst sessionId = crypto.randomBytes(32).toString('hex')\n\n\u002F\u002F ✅ DO: Set secure session cookie\nres.setHeader('Set-Cookie', [\n  `session=${sessionToken}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`,\n])\n```\n\n#### JWT Security\n```typescript\n\u002F\u002F ❌ DON'T: Weak secret\nconst token = jwt.sign(payload, 'secret123')\n\n\u002F\u002F ✅ DO: Strong secret from environment\nconst token = jwt.sign(payload, process.env.JWT_SECRET!, {\n  expiresIn: '1h',\n  algorithm: 'HS256',\n})\n\n\u002F\u002F ✅ DO: Verify JWT properly\ntry {\n  const decoded = jwt.verify(token, process.env.JWT_SECRET!)\n  \u002F\u002F Use decoded data\n} catch (error) {\n  throw new Error('Invalid token')\n}\n```\n\n### 3. Sensitive Data Exposure\n\n#### Environment Variables\n```typescript\n\u002F\u002F ❌ DON'T: Hardcoded secrets\nconst apiKey = 'sk_live_abc123def456'\nconst dbPassword = 'mypassword123'\n\n\u002F\u002F ✅ DO: Environment variables\nconst apiKey = process.env.STRIPE_API_KEY\nconst dbPassword = process.env.DATABASE_PASSWORD\n\nif (!apiKey || !dbPassword) {\n  throw new Error('Missing required environment variables')\n}\n```\n\n#### Data in Logs\n```typescript\n\u002F\u002F ❌ DON'T: Log sensitive data\nconsole.log('User data:', { email, password, creditCard })\n\n\u002F\u002F ✅ DO: Redact sensitive fields\nconst safeUserData = {\n  email,\n  creditCard: creditCard.slice(-4).padStart(creditCard.length, '*'),\n}\nconsole.log('User data:', safeUserData)\n```\n\n#### Never Return Sensitive Data\n```typescript\n\u002F\u002F ❌ DON'T: Return password in API\nconst user = await prisma.user.findUnique({ where: { id } })\nreturn user \u002F\u002F Includes password hash!\n\n\u002F\u002F ✅ DO: Exclude sensitive fields\nconst user = await prisma.user.findUnique({\n  where: { id },\n  select: {\n    id: true,\n    email: true,\n    name: true,\n    \u002F\u002F password field excluded\n  },\n})\nreturn user\n```\n\n### 4. XML External Entities (XXE)\n```typescript\n\u002F\u002F ❌ DON'T: Parse untrusted XML\nconst doc = xmlParser.parse(userInput)\n\n\u002F\u002F ✅ DO: Disable external entities\nconst parser = new xml2js.Parser({\n  explicitChildren: false,\n  explicitRoot: false,\n  ignoreAttrs: true,\n  xmlns: false,\n})\n```\n\n### 5. Broken Access Control\n\n#### Authorization Checks\n```typescript\n\u002F\u002F ❌ DON'T: Missing authorization\nexport async function DELETE(\n  request: Request,\n  { params }: { params: { id: string } }\n) {\n  await prisma.project.delete({ where: { id: params.id } })\n  return new Response(null, { status: 204 })\n}\n\n\u002F\u002F ✅ DO: Verify ownership\nexport async function DELETE(\n  request: Request,\n  { params }: { params: { id: string } }\n) {\n  const user = await getAuthUser(request)\n  if (!user) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const project = await prisma.project.findUnique({\n    where: { id: params.id },\n  })\n\n  if (!project) {\n    return new Response('Not found', { status: 404 })\n  }\n\n  if (project.userId !== user.id) {\n    return new Response('Forbidden', { status: 403 })\n  }\n\n  await prisma.project.delete({ where: { id: params.id } })\n  return new Response(null, { status: 204 })\n}\n```\n\n#### IDOR (Insecure Direct Object Reference)\n```typescript\n\u002F\u002F ❌ DON'T: Trust user input for IDs\nconst userId = req.query.userId\nconst data = await getPrivateData(userId) \u002F\u002F Any user can access any data!\n\n\u002F\u002F ✅ DO: Use authenticated user's ID\nconst userId = req.user.id \u002F\u002F From authenticated session\nconst data = await getPrivateData(userId)\n```\n\n### 6. Security Misconfiguration\n\n#### CORS\n```typescript\n\u002F\u002F ❌ DON'T: Allow all origins\nres.setHeader('Access-Control-Allow-Origin', '*')\n\n\u002F\u002F ✅ DO: Whitelist specific origins\nconst allowedOrigins = [\n  'https:\u002F\u002Fapp.quetrex.com',\n  'https:\u002F\u002Fstaging.quetrex.com',\n]\n\nconst origin = req.headers.get('origin')\nif (origin && allowedOrigins.includes(origin)) {\n  res.setHeader('Access-Control-Allow-Origin', origin)\n}\n```\n\n#### Error Messages\n```typescript\n\u002F\u002F ❌ DON'T: Expose internal details\ncatch (error) {\n  res.status(500).json({\n    error: error.message, \u002F\u002F Could leak stack trace, DB structure, etc.\n  })\n}\n\n\u002F\u002F ✅ DO: Generic error messages\ncatch (error) {\n  console.error('Internal error:', error) \u002F\u002F Log internally\n  res.status(500).json({\n    error: 'An internal error occurred',\n  })\n}\n```\n\n### 7. Cross-Site Scripting (XSS)\n\n#### dangerouslySetInnerHTML\n```typescript\n\u002F\u002F ❌ DON'T: Unsanitized HTML\n\u003Cdiv dangerouslySetInnerHTML={{ __html: userInput }} \u002F>\n\u002F\u002F Vulnerable to: userInput = \"\u003Cscript>alert('XSS')\u003C\u002Fscript>\"\n\n\u002F\u002F ✅ DO: Sanitize with DOMPurify\nimport DOMPurify from 'dompurify'\n\nconst sanitized = DOMPurify.sanitize(userInput)\n\u003Cdiv dangerouslySetInnerHTML={{ __html: sanitized }} \u002F>\n\n\u002F\u002F ✅ BETTER: Avoid dangerouslySetInnerHTML entirely\n\u003Cdiv>{userInput}\u003C\u002Fdiv> \u002F\u002F React escapes by default\n```\n\n#### URL Handling\n```typescript\n\u002F\u002F ❌ DON'T: Unsanitized URLs\n\u003Ca href={userInput}>Click here\u003C\u002Fa>\n\u002F\u002F Vulnerable to: userInput = \"javascript:alert('XSS')\"\n\n\u002F\u002F ✅ DO: Validate URLs\nfunction isSafeUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url)\n    return ['http:', 'https:'].includes(parsed.protocol)\n  } catch {\n    return false\n  }\n}\n\nconst href = isSafeUrl(userInput) ? userInput : '#'\n\u003Ca href={href}>Click here\u003C\u002Fa>\n```\n\n### 8. Insecure Deserialization\n```typescript\n\u002F\u002F ❌ DON'T: eval() or Function()\nconst code = req.body.code\neval(code) \u002F\u002F NEVER DO THIS\n\n\u002F\u002F ❌ DON'T: Unvalidated JSON\nconst data = JSON.parse(userInput)\n\u002F\u002F Use data directly without validation\n\n\u002F\u002F ✅ DO: Validate with Zod\nconst data = JSON.parse(userInput)\nconst validated = dataSchema.parse(data) \u002F\u002F Validates structure and types\n```\n\n### 9. Using Components with Known Vulnerabilities\n```bash\n# ✅ DO: Regular dependency audits\nnpm audit --audit-level=high\n\n# ✅ DO: Keep dependencies updated\nnpm update\n\n# ✅ DO: Use automated tools\nnpm install -g snyk\nsnyk test\n```\n\n### 10. Insufficient Logging & Monitoring\n```typescript\n\u002F\u002F ❌ DON'T: No logging\nexport async function POST(request: Request) {\n  const user = await createUser(data)\n  return Response.json(user)\n}\n\n\u002F\u002F ✅ DO: Log security events\nexport async function POST(request: Request) {\n  try {\n    const user = await createUser(data)\n    logger.info('User created', {\n      userId: user.id,\n      email: user.email,\n      ip: request.headers.get('x-forwarded-for'),\n      timestamp: new Date().toISOString(),\n    })\n    return Response.json(user)\n  } catch (error) {\n    logger.error('User creation failed', {\n      error: error.message,\n      email: data.email,\n      ip: request.headers.get('x-forwarded-for'),\n      timestamp: new Date().toISOString(),\n    })\n    throw error\n  }\n}\n```\n\n## Input Validation Checklist\n\n```typescript\n\u002F\u002F ✅ Complete input validation example\nimport { z } from 'zod'\n\nconst createUserSchema = z.object({\n  email: z.string().email().max(255),\n  password: z\n    .string()\n    .min(8, 'Password must be at least 8 characters')\n    .max(128)\n    .regex(\u002F[A-Z]\u002F, 'Password must contain uppercase letter')\n    .regex(\u002F[a-z]\u002F, 'Password must contain lowercase letter')\n    .regex(\u002F[0-9]\u002F, 'Password must contain number')\n    .regex(\u002F[^A-Za-z0-9]\u002F, 'Password must contain special character'),\n  name: z.string().min(1).max(100).optional(),\n})\n\nexport async function POST(request: Request) {\n  \u002F\u002F 1. Parse and validate input\n  const body = await request.json()\n  const validated = createUserSchema.parse(body) \u002F\u002F Throws on validation error\n\n  \u002F\u002F 2. Additional business logic validation\n  const existing = await prisma.user.findUnique({\n    where: { email: validated.email },\n  })\n  if (existing) {\n    throw new Error('Email already exists')\n  }\n\n  \u002F\u002F 3. Hash password\n  const hashedPassword = await bcrypt.hash(validated.password, 12)\n\n  \u002F\u002F 4. Create user\n  const user = await prisma.user.create({\n    data: {\n      email: validated.email,\n      password: hashedPassword,\n      name: validated.name,\n    },\n    select: {\n      id: true,\n      email: true,\n      name: true,\n      \u002F\u002F password excluded\n    },\n  })\n\n  \u002F\u002F 5. Log security event\n  logger.info('User registered', { userId: user.id, email: user.email })\n\n  return Response.json(user, { status: 201 })\n}\n```\n\n## Security Headers\n```typescript\n\u002F\u002F ✅ DO: Set security headers\nexport function middleware(request: NextRequest) {\n  const response = NextResponse.next()\n\n  response.headers.set('X-Content-Type-Options', 'nosniff')\n  response.headers.set('X-Frame-Options', 'DENY')\n  response.headers.set('X-XSS-Protection', '1; mode=block')\n  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')\n  response.headers.set(\n    'Content-Security-Policy',\n    \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';\"\n  )\n  response.headers.set(\n    'Strict-Transport-Security',\n    'max-age=31536000; includeSubDomains'\n  )\n\n  return response\n}\n```\n\n## Security Review Checklist\n\nFor each code change, verify:\n\n- [ ] All user input validated with Zod\n- [ ] No hardcoded secrets (use environment variables)\n- [ ] SQL queries parameterized (using Prisma)\n- [ ] Passwords hashed with bcrypt (12+ rounds)\n- [ ] JWT tokens use strong secret and expire\n- [ ] Authorization checks on all protected routes\n- [ ] No dangerouslySetInnerHTML without DOMPurify\n- [ ] No eval() or Function() with user input\n- [ ] CORS configured for specific origins\n- [ ] Error messages don't leak internal details\n- [ ] Security headers set correctly\n- [ ] Sensitive data excluded from API responses\n- [ ] Security events logged\n- [ ] Dependencies audited (npm audit)\n- [ ] HTTPS enforced in production\n","# Security Sentinel (World-Class Security Skill)\n\n## When to Use\n\n**ALWAYS use this skill when:**\n- Writing\u002Freviewing API routes (especially POST\u002FPATCH\u002FPUT\u002FDELETE)\n- Implementing authentication or authorization\n- Handling user input (forms, query params, file uploads)\n- Working with database queries\n- Processing file operations\n- Managing environment variables and secrets\n- Building payment processing features\n- Implementing session management\n- Handling sensitive data or encryption\n- Before creating pull requests\n- Before deployment\n\n## Comprehensive Documentation\n\nThis skill includes complete security references:\n\n### ? Core References (10,426 lines total)\n\n1. **owasp-top-10-complete.md** (2,133 lines) - Complete OWASP Top 10 with code examples\n   - A01: Broken Access Control (IDOR, path traversal)\n   - A02: Cryptographic Failures (weak hashing, hardcoded secrets)\n   - A03: Injection (SQL, NoSQL, Command injection)\n   - A04: Insecure Design (race conditions, rate limiting)\n   - A05: Security Misconfiguration (CORS, error messages)\n   - A06: Vulnerable Components (dependency management)\n   - A07: Authentication Failures (weak passwords, MFA)\n   - A08: Integrity Failures (supply chain, deserialization)\n   - A09: Logging Failures (audit trails, monitoring)\n   - A10: SSRF (URL validation, IP blocking)\n\n2. **authentication-patterns.md** (1,529 lines) - Complete authentication guide\n   - JWT token authentication\n   - Session-based authentication\n   - Password hashing (bcrypt, Argon2)\n   - Password reset flow\n   - Email verification\n   - Multi-factor authentication (TOTP)\n   - OAuth 2.0 (GitHub, Google)\n   - Passwordless authentication (magic links)\n   - Refresh token pattern\n\n3. **authorization-patterns.md** (1,062 lines) - Access control implementation\n   - Role-Based Access Control (RBAC)\n   - Attribute-Based Access Control (ABAC)\n   - Middleware protection\n   - API route protection\n   - Server Action protection\n   - Row-level security (Drizzle patterns)\n   - Permission system\n   - Resource ownership validation\n\n4. **input-validation-complete.md** (900 lines) - Zod validation for everything\n   - String, number, boolean, enum validation\n   - Email, URL, phone, UUID validation\n   - File upload validation (images, PDFs, CSVs)\n   - Password strength requirements\n   - Credit card validation (Luhn algorithm)\n   - IP address validation (v4, v6)\n   - Async validation (database checks)\n   - Error handling and display\n\n5. **sql-injection-prevention.md** (741 lines) - Drizzle ORM security\n   - Parameterized queries (always safe)\n   - Dynamic query building\n   - Raw SQL safety patterns\n   - LIKE query sanitization\n   - Database schema security\n   - Testing for SQL injection\n\n6. **xss-prevention.md** (630 lines) - React\u002FNext.js XSS protection\n   - React's built-in escaping\n   - dangerouslySetInnerHTML with DOMPurify\n   - URL sanitization\n   - Content Security Policy (CSP)\n   - User-generated content handling\n   - innerHTML safety\n\n7. **csrf-prevention.md** (597 lines) - Cross-Site Request Forgery protection\n   - SameSite cookies (primary defense)\n   - CSRF tokens implementation\n   - Double submit cookie pattern\n   - Server Actions protection\n   - Origin header validation\n\n8. **secret-management.md** (547 lines) - Secure secret handling\n   - Environment variables best practices\n   - Secret rotation strategies\n   - Encryption at rest (AES-256-GCM)\n   - Secret detection (gitleaks, trufflehog)\n   - Production secrets (Vercel, AWS, Vault)\n\n9. **rate-limiting-patterns.md** (826 lines) - Prevent API abuse\n   - In-memory rate limiting\n   - Redis-based rate limiting\n   - API route protection\n   - Server Action protection\n   - IP-based rate limiting\n   - User-based rate limiting\n   - Sliding window algorithm\n   - Token bucket algorithm\n\n10. **security-checklist.md** (471 lines) - Pre-deployment audit (250+ items)\n    - Authentication security (passwords, sessions, JWT, MFA)\n    - Authorization security (access control, RLS)\n    - Input validation\n    - Data security (secrets, logging, database)\n    - File upload security\n    - Rate limiting\n    - Security headers (CSP, CORS, HSTS)\n    - Error handling\n    - Dependency security\n    - Monitoring and logging\n    - Infrastructure security\n    - Compliance (GDPR, PCI DSS)\n\n### ?️ Security Tools\n- **validate-security.py** (414 lines) - Automated vulnerability scanner\n  - Detects 20+ vulnerability types\n  - Scans for hardcoded secrets (API keys, passwords, tokens)\n  - Checks for SQL injection patterns\n  - Detects XSS vulnerabilities (dangerouslySetInnerHTML, innerHTML)\n  - Finds eval() and Function() usage\n  - Identifies weak cryptography (MD5, SHA1)\n  - Detects insecure randomness\n  - Checks for command injection\n  - Validates path traversal prevention\n  - Tests password hashing strength\n  - Audits JWT security\n  - Checks CORS configuration\n  - Validates cookie security (httpOnly, secure)\n  - Reports TypeScript issues (@ts-ignore, any)\n  - Exits with error on CRITICAL\u002FHIGH issues\n  - Identifies XSS vulnerabilities\n  - Finds eval() and Function() usage\n  - Detects weak cryptography (MD5, SHA1)\n  - Checks for command injection\n  - Validates password hashing\n  - Finds CORS misconfigurations\n  - Checks for missing httpOnly cookies\n  - Reports TypeScript issues (@ts-ignore, any types)\n\n### ? Quick Start\n\n**Before implementing ANY security-sensitive feature:**\n```bash\n# 1. Read the relevant guide\ncat owasp-top-10-complete.md\ncat authentication-patterns.md\n\n# 2. Implement following patterns\n\n# 3. Run security scanner\npython validate-security.py src\u002F\n\n# 4. Check against security checklist\ncat security-checklist.md\n```\n\n## When to Use\n\n## OWASP Top 10 Security Checks\n\n### 1. Injection Attacks\n\n#### SQL Injection\n```typescript\n\u002F\u002F ❌ DON'T: String concatenation in queries\nconst query = `SELECT * FROM users WHERE email = '${email}'`\n\u002F\u002F Vulnerable to: email = \"' OR '1'='1\"\n\n\u002F\u002F ✅ DO: Use Prisma (parameterized queries)\nconst user = await prisma.user.findUnique({\n  where: { email },\n})\n```\n\n#### Command Injection\n```typescript\n\u002F\u002F ❌ DON'T: Unvalidated shell commands\nconst fileName = req.body.fileName\nexec(`cat ${fileName}`) \u002F\u002F Vulnerable to: fileName = \"; rm -rf \u002F\"\n\n\u002F\u002F ✅ DO: Validate input and use safe APIs\nconst allowedFiles = ['log.txt', 'data.csv']\nif (!allowedFiles.includes(fileName)) {\n  throw new Error('Invalid file name')\n}\nconst content = await fs.readFile(path.join(SAFE_DIR, fileName))\n```\n\n#### NoSQL Injection\n```typescript\n\u002F\u002F ❌ DON'T: Direct object insertion\nconst user = await db.users.findOne({ email: req.body.email })\n\u002F\u002F Vulnerable to: { email: { $ne: null } }\n\n\u002F\u002F ✅ DO: Validate input with Zod\nconst emailSchema = z.string().email()\nconst email = emailSchema.parse(req.body.email)\nconst user = await db.users.findOne({ email })\n```\n\n### 2. Broken Authentication\n\n#### Password Storage\n```typescript\n\u002F\u002F ❌ DON'T: Plain text passwords\nconst user = await prisma.user.create({\n  data: {\n    email,\n    password, \u002F\u002F Never store plain text!\n  },\n})\n\n\u002F\u002F ✅ DO: Hash with bcrypt\nimport bcrypt from 'bcrypt'\n\nconst hashedPassword = await bcrypt.hash(password, 12) \u002F\u002F 12 rounds minimum\nconst user = await prisma.user.create({\n  data: {\n    email,\n    password: hashedPassword,\n  },\n})\n```\n\n#### Session Management\n```typescript\n\u002F\u002F ❌ DON'T: Weak session tokens\nconst sessionId = Math.random().toString()\n\n\u002F\u002F ✅ DO: Cryptographically secure tokens\nimport crypto from 'crypto'\nconst sessionId = crypto.randomBytes(32).toString('hex')\n\n\u002F\u002F ✅ DO: Set secure session cookie\nres.setHeader('Set-Cookie', [\n  `session=${sessionToken}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`,\n])\n```\n\n#### JWT Security\n```typescript\n\u002F\u002F ❌ DON'T: Weak secret\nconst token = jwt.sign(payload, 'secret123')\n\n\u002F\u002F ✅ DO: Strong secret from environment\nconst token = jwt.sign(payload, process.env.JWT_SECRET!, {\n  expiresIn: '1h',\n  algorithm: 'HS256',\n})\n\n\u002F\u002F ✅ DO: Verify JWT properly\ntry {\n  const decoded = jwt.verify(token, process.env.JWT_SECRET!)\n  \u002F\u002F Use decoded data\n} catch (error) {\n  throw new Error('Invalid token')\n}\n```\n\n### 3. Sensitive Data Exposure\n\n#### Environment Variables\n```typescript\n\u002F\u002F ❌ DON'T: Hardcoded secrets\nconst apiKey = 'sk_live_abc123def456'\nconst dbPassword = 'mypassword123'\n\n\u002F\u002F ✅ DO: Environment variables\nconst apiKey = process.env.STRIPE_API_KEY\nconst dbPassword = process.env.DATABASE_PASSWORD\n\nif (!apiKey || !dbPassword) {\n  throw new Error('Missing required environment variables')\n}\n```\n\n#### Data in Logs\n```typescript\n\u002F\u002F ❌ DON'T: Log sensitive data\nconsole.log('User data:', { email, password, creditCard })\n\n\u002F\u002F ✅ DO: Redact sensitive fields\nconst safeUserData = {\n  email,\n  creditCard: creditCard.slice(-4).padStart(creditCard.length, '*'),\n}\nconsole.log('User data:', safeUserData)\n```\n\n#### Never Return Sensitive Data\n```typescript\n\u002F\u002F ❌ DON'T: Return password in API\nconst user = await prisma.user.findUnique({ where: { id } })\nreturn user \u002F\u002F Includes password hash!\n\n\u002F\u002F ✅ DO: Exclude sensitive fields\nconst user = await prisma.user.findUnique({\n  where: { id },\n  select: {\n    id: true,\n    email: true,\n    name: true,\n    \u002F\u002F password field excluded\n  },\n})\nreturn user\n```\n\n### 4. XML External Entities (XXE)\n```typescript\n\u002F\u002F ❌ DON'T: Parse untrusted XML\nconst doc = xmlParser.parse(userInput)\n\n\u002F\u002F ✅ DO: Disable external entities\nconst parser = new xml2js.Parser({\n  explicitChildren: false,\n  explicitRoot: false,\n  ignoreAttrs: true,\n  xmlns: false,\n})\n```\n\n### 5. Broken Access Control\n\n#### Authorization Checks\n```typescript\n\u002F\u002F ❌ DON'T: Missing authorization\nexport async function DELETE(\n  request: Request,\n  { params }: { params: { id: string } }\n) {\n  await prisma.project.delete({ where: { id: params.id } })\n  return new Response(null, { status: 204 })\n}\n\n\u002F\u002F ✅ DO: Verify ownership\nexport async function DELETE(\n  request: Request,\n  { params }: { params: { id: string } }\n) {\n  const user = await getAuthUser(request)\n  if (!user) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const project = await prisma.project.findUnique({\n    where: { id: params.id },\n  })\n\n  if (!project) {\n    return new Response('Not found', { status: 404 })\n  }\n\n  if (project.userId !== user.id) {\n    return new Response('Forbidden', { status: 403 })\n  }\n\n  await prisma.project.delete({ where: { id: params.id } })\n  return new Response(null, { status: 204 })\n}\n```\n\n#### IDOR (Insecure Direct Object Reference)\n```typescript\n\u002F\u002F ❌ DON'T: Trust user input for IDs\nconst userId = req.query.userId\nconst data = await getPrivateData(userId) \u002F\u002F Any user can access any data!\n\n\u002F\u002F ✅ DO: Use authenticated user's ID\nconst userId = req.user.id \u002F\u002F From authenticated session\nconst data = await getPrivateData(userId)\n```\n\n### 6. Security Misconfiguration\n\n#### CORS\n```typescript\n\u002F\u002F ❌ DON'T: Allow all origins\nres.setHeader('Access-Control-Allow-Origin', '*')\n\n\u002F\u002F ✅ DO: Whitelist specific origins\nconst allowedOrigins = [\n  'https:\u002F\u002Fapp.quetrex.com',\n  'https:\u002F\u002Fstaging.quetrex.com',\n]\n\nconst origin = req.headers.get('origin')\nif (origin && allowedOrigins.includes(origin)) {\n  res.setHeader('Access-Control-Allow-Origin', origin)\n}\n```\n\n#### Error Messages\n```typescript\n\u002F\u002F ❌ DON'T: Expose internal details\ncatch (error) {\n  res.status(500).json({\n    error: error.message, \u002F\u002F Could leak stack trace, DB structure, etc.\n  })\n}\n\n\u002F\u002F ✅ DO: Generic error messages\ncatch (error) {\n  console.error('Internal error:', error) \u002F\u002F Log internally\n  res.status(500).json({\n    error: 'An internal error occurred',\n  })\n}\n```\n\n### 7. Cross-Site Scripting (XSS)\n\n#### dangerouslySetInnerHTML\n```typescript\n\u002F\u002F ❌ DON'T: Unsanitized HTML\n\u003Cdiv dangerouslySetInnerHTML={{ __html: userInput }} \u002F>\n\u002F\u002F Vulnerable to: userInput = \"\u003Cscript>alert('XSS')\u003C\u002Fscript>\"\n\n\u002F\u002F ✅ DO: Sanitize with DOMPurify\nimport DOMPurify from 'dompurify'\n\nconst sanitized = DOMPurify.sanitize(userInput)\n\u003Cdiv dangerouslySetInnerHTML={{ __html: sanitized }} \u002F>\n\n\u002F\u002F ✅ BETTER: Avoid dangerouslySetInnerHTML entirely\n\u003Cdiv>{userInput}\u003C\u002Fdiv> \u002F\u002F React escapes by default\n```\n\n#### URL Handling\n```typescript\n\u002F\u002F ❌ DON'T: Unsanitized URLs\n\u003Ca href={userInput}>Click here\u003C\u002Fa>\n\u002F\u002F Vulnerable to: userInput = \"javascript:alert('XSS')\"\n\n\u002F\u002F ✅ DO: Validate URLs\nfunction isSafeUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url)\n    return ['http:', 'https:'].includes(parsed.protocol)\n  } catch {\n    return false\n  }\n}\n\nconst href = isSafeUrl(userInput) ? userInput : '#'\n\u003Ca href={href}>Click here\u003C\u002Fa>\n```\n\n### 8. Insecure Deserialization\n```typescript\n\u002F\u002F ❌ DON'T: eval() or Function()\nconst code = req.body.code\neval(code) \u002F\u002F NEVER DO THIS\n\n\u002F\u002F ❌ DON'T: Unvalidated JSON\nconst data = JSON.parse(userInput)\n\u002F\u002F Use data directly without validation\n\n\u002F\u002F ✅ DO: Validate with Zod\nconst data = JSON.parse(userInput)\nconst validated = dataSchema.parse(data) \u002F\u002F Validates structure and types\n```\n\n### 9. Using Components with Known Vulnerabilities\n```bash\n# ✅ DO: Regular dependency audits\nnpm audit --audit-level=high\n\n# ✅ DO: Keep dependencies updated\nnpm update\n\n# ✅ DO: Use automated tools\nnpm install -g snyk\nsnyk test\n```\n\n### 10. Insufficient Logging & Monitoring\n```typescript\n\u002F\u002F ❌ DON'T: No logging\nexport async function POST(request: Request) {\n  const user = await createUser(data)\n  return Response.json(user)\n}\n\n\u002F\u002F ✅ DO: Log security events\nexport async function POST(request: Request) {\n  try {\n    const user = await createUser(data)\n    logger.info('User created', {\n      userId: user.id,\n      email: user.email,\n      ip: request.headers.get('x-forwarded-for'),\n      timestamp: new Date().toISOString(),\n    })\n    return Response.json(user)\n  } catch (error) {\n    logger.error('User creation failed', {\n      error: error.message,\n      email: data.email,\n      ip: request.headers.get('x-forwarded-for'),\n      timestamp: new Date().toISOString(),\n    })\n    throw error\n  }\n}\n```\n\n## Input Validation Checklist\n\n```typescript\n\u002F\u002F ✅ Complete input validation example\nimport { z } from 'zod'\n\nconst createUserSchema = z.object({\n  email: z.string().email().max(255),\n  password: z\n    .string()\n    .min(8, 'Password must be at least 8 characters')\n    .max(128)\n    .regex(\u002F[A-Z]\u002F, 'Password must contain uppercase letter')\n    .regex(\u002F[a-z]\u002F, 'Password must contain lowercase letter')\n    .regex(\u002F[0-9]\u002F, 'Password must contain number')\n    .regex(\u002F[^A-Za-z0-9]\u002F, 'Password must contain special character'),\n  name: z.string().min(1).max(100).optional(),\n})\n\nexport async function POST(request: Request) {\n  \u002F\u002F 1. Parse and validate input\n  const body = await request.json()\n  const validated = createUserSchema.parse(body) \u002F\u002F Throws on validation error\n\n  \u002F\u002F 2. Additional business logic validation\n  const existing = await prisma.user.findUnique({\n    where: { email: validated.email },\n  })\n  if (existing) {\n    throw new Error('Email already exists')\n  }\n\n  \u002F\u002F 3. Hash password\n  const hashedPassword = await bcrypt.hash(validated.password, 12)\n\n  \u002F\u002F 4. Create user\n  const user = await prisma.user.create({\n    data: {\n      email: validated.email,\n      password: hashedPassword,\n      name: validated.name,\n    },\n    select: {\n      id: true,\n      email: true,\n      name: true,\n      \u002F\u002F password excluded\n    },\n  })\n\n  \u002F\u002F 5. Log security event\n  logger.info('User registered', { userId: user.id, email: user.email })\n\n  return Response.json(user, { status: 201 })\n}\n```\n\n## Security Headers\n```typescript\n\u002F\u002F ✅ DO: Set security headers\nexport function middleware(request: NextRequest) {\n  const response = NextResponse.next()\n\n  response.headers.set('X-Content-Type-Options', 'nosniff')\n  response.headers.set('X-Frame-Options', 'DENY')\n  response.headers.set('X-XSS-Protection', '1; mode=block')\n  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')\n  response.headers.set(\n    'Content-Security-Policy',\n    \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';\"\n  )\n  response.headers.set(\n    'Strict-Transport-Security',\n    'max-age=31536000; includeSubDomains'\n  )\n\n  return response\n}\n```\n\n## Security Review Checklist\n\nFor each code change, verify:\n\n- [ ] All user input validated with Zod\n- [ ] No hardcoded secrets (use environment variables)\n- [ ] SQL queries parameterized (using Prisma)\n- [ ] Passwords hashed with bcrypt (12+ rounds)\n- [ ] JWT tokens use strong secret and expire\n- [ ] Authorization checks on all protected routes\n- [ ] No dangerouslySetInnerHTML without DOMPurify\n- [ ] No eval() or Function() with user input\n- [ ] CORS configured for specific origins\n- [ ] Error messages don't leak internal details\n- [ ] Security headers set correctly\n- [ ] Sensitive data excluded from API responses\n- [ ] Security events logged\n- [ ] Dependencies audited (npm audit)\n- [ ] HTTPS enforced in production\n",{"name":5,"description":7,"allowed-tools":57},"Read, Grep, Bash","main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill security-sentinel",{"tool":73,"command":74},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill security-sentinel",{"tool":76,"command":77},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill security-sentinel","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002FSKILL.md",true,[81,87,91,95,99,103,107,111,115,119,123,127,133],{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"authentication-patterns.md","REFERENCE","参考文档",36260,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fauthentication-patterns.md",{"path":88,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":89,"sourceHtmlUrl":90},"authorization-patterns.md",24771,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fauthorization-patterns.md",{"path":92,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":93,"sourceHtmlUrl":94},"csrf-prevention.md",13839,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fcsrf-prevention.md",{"path":96,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":97,"sourceHtmlUrl":98},"input-validation-complete.md",22968,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Finput-validation-complete.md",{"path":100,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":101,"sourceHtmlUrl":102},"owasp-top-10-complete.md",53385,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fowasp-top-10-complete.md",{"path":104,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":105,"sourceHtmlUrl":106},"rate-limiting-patterns.md",18789,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Frate-limiting-patterns.md",{"path":108,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Finvariants.md",48,"https:\u002F\u002Fgithub.com\u002FJustinDFuller\u002Fagent-session-manager\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ffeature-invariants\u002Freferences\u002Finvariants.md",{"path":112,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":113,"sourceHtmlUrl":114},"secret-management.md",12297,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fsecret-management.md",{"path":116,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":117,"sourceHtmlUrl":118},"security-checklist.md",15610,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fsecurity-checklist.md",{"path":120,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":121,"sourceHtmlUrl":122},"skill-report.json",130621,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fskill-report.json",{"path":124,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":125,"sourceHtmlUrl":126},"sql-injection-prevention.md",18276,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fsql-injection-prevention.md",{"path":128,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":131,"sourceHtmlUrl":132},"validate-security.py","SCRIPT","脚本",16978,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fvalidate-security.py",{"path":134,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":135,"sourceHtmlUrl":136},"xss-prevention.md",15727,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fbarnhardt-enterprises-inc\u002Fsecurity-sentinel\u002Fxss-prevention.md",[138,150,160,169,175,182],{"skillNo":139,"name":140,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":146,"publishedAt":52},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[143],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[147,148,149],"model","model hierarchy","model hierarchy skill",{"skillNo":151,"name":152,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":52},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[155],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},[157,158,159],"MCP","zoom","zoom mcp",{"skillNo":161,"name":162,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":52},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[166,167,168,158],"sdk","zoom apps sdk","apps",{"skillNo":170,"name":171,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":52},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[171],{"skillNo":176,"name":177,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":181,"publishedAt":52},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[180],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},[177],{"skillNo":183,"name":184,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":52},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[184]]