[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EQMVHJ89987TY2SEFFMM3Z":3,"skill-same:01M6EQMVHJ89987TY2SEFFMM3Z":95},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":33,"repositoryHtmlUrl":34,"repositoryHomepageUrl":35,"ownerHtmlUrl":36,"ownerBlogUrl":6,"ownerDescription":37,"updatedAt":38,"install":39,"resources":52},"01M6EQMVHJ89987TY2SEFFMM3Z","security-gate",null,"Verify security considerations were addressed before shipping. Issues result in WARNINGS that strongly recommend fixing.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fdanielpodolsky\u002Fsecurity-gate\u002FSKILL.md",[],[19,20,21,22,23,24],"security","security gate","gate","shipping","issues","verify","2026-11-10 10:12:30",false,"---\nname: security-gate\ndescription: Verify security considerations were addressed before shipping. Issues result in WARNINGS that strongly recommend fixing.\n---\n\n# Gate 2: Security Review\n\n> \"Security isn't a feature you add later. It's a foundation you build on.\"\n\n## Purpose\n\nThis gate catches common security vulnerabilities before they reach production. Issues don't BLOCK, but generate strong WARNINGS.\n\n## Gate Status\n\n- **PASS** — No security issues found\n- **WARNING** — Issues found that should be fixed before production\n- **CRITICAL WARNING** — Severe issues that really should block\n\n---\n\n## Gate Questions\n\n### Question 1: Input Entry Points\n> \"Where does user input enter this feature?\"\n\n**Looking for:**\n- Awareness of all input sources (forms, URLs, headers, etc.)\n- Understanding that ALL input is untrusted\n- Identification of data flow\n\n**Follow-up if input exists:**\n> \"How is that input validated before it's used?\"\n\n### Question 2: Data Access\n> \"What data does this feature access? Who should be able to access it?\"\n\n**Looking for:**\n- Understanding of data sensitivity\n- Awareness of authorization requirements\n- Knowledge of who can see what\n\n**Follow-up:**\n> \"How do you verify the requesting user is allowed to access this data?\"\n\n### Question 3: Secrets and Exposure\n> \"Are there any secrets, tokens, or sensitive data involved? Where are they stored?\"\n\n**Looking for:**\n- Secrets in environment variables, not code\n- No sensitive data in logs\n- No tokens in URLs or client-side storage (unless necessary)\n\n---\n\n## Security Checklist\n\nReview the code for these common issues:\n\n### Input Handling\n- [ ] All user input validated server-side\n- [ ] Input length limits enforced\n- [ ] Special characters handled (SQL, HTML, shell)\n- [ ] File uploads validated (type, size, content)\n\n### Authentication & Authorization\n- [ ] Protected routes require authentication\n- [ ] Users can only access their own data\n- [ ] Admin routes check admin role\n- [ ] Tokens have reasonable expiration\n\n### Data Exposure\n- [ ] API responses don't include unnecessary fields\n- [ ] Errors don't expose internal details\n- [ ] Logs don't contain passwords\u002Ftokens\n- [ ] No sensitive data in URLs\n\n### Common Vulnerabilities\n- [ ] No SQL string concatenation\n- [ ] No `eval()` or `new Function()` with user input\n- [ ] No `innerHTML` with unsanitized user input\n- [ ] No hardcoded secrets in code\n\n---\n\n## Response Templates\n\n### If PASS\n\n```\n✅ SECURITY GATE: PASSED\n\nSecurity considerations addressed:\n- Input validation: ✓\n- Authorization checks: ✓\n- No exposed secrets: ✓\n\nMoving to the next gate...\n```\n\n### If WARNING\n\n```\n⚠️ SECURITY GATE: WARNING\n\nI found [X] security considerations to address:\n\n**Issue 1: [Title]**\nLocation: `file.ts:42`\nRisk: [What could go wrong]\nQuestion: \"What stops a malicious user from [attack scenario]?\"\n\n**Issue 2: [Title]**\nLocation: `file.ts:88`\nRisk: [What could go wrong]\nSuggestion: [Direction to fix, not the answer]\n\nThese should be fixed before this goes to production.\nWould you like to address them now?\n```\n\n### If CRITICAL WARNING\n\n```\n? SECURITY GATE: CRITICAL WARNING\n\nThis needs attention before proceeding:\n\n**CRITICAL: [Issue]**\nLocation: `file.ts:42`\nRisk: [Severity explanation - data breach, account takeover, etc.]\n\nThis is the kind of vulnerability that makes news headlines.\nLet's fix this before anything else.\n```\n\n---\n\n## Common Vulnerabilities to Check\n\n### SQL Injection\n```\n❌ db.query(`SELECT * FROM users WHERE id = ${userId}`);\n✅ db.query('SELECT * FROM users WHERE id = ?', [userId]);\n```\n\n### Cross-Site Scripting (XSS)\n```\n❌ element.innerHTML = userInput;\n✅ element.textContent = userInput;\n```\n\n### Insecure Direct Object Reference (IDOR)\n```\n❌ \u002F\u002F Anyone can access any user's data\n   app.get('\u002Fusers\u002F:id', (req, res) => {\n     const user = await User.findById(req.params.id);\n     res.json(user);\n   });\n\n✅ \u002F\u002F Check ownership\n   app.get('\u002Fusers\u002F:id', (req, res) => {\n     const user = await User.findById(req.params.id);\n     if (user.id !== req.user.id) throw new ForbiddenError();\n     res.json(user);\n   });\n```\n\n### Hardcoded Secrets\n```\n❌ const apiKey = 'sk-live-abc123';\n✅ const apiKey = process.env.API_KEY;\n```\n\n---\n\n## Socratic Security Questions\n\nInstead of pointing out the fix, ask:\n\n1. \"What stops user A from accessing user B's data by changing the ID?\"\n2. \"If I send `\u003Cscript>alert('XSS')\u003C\u002Fscript>` as my name, what happens?\"\n3. \"What if someone sends 10MB of data to this endpoint?\"\n4. \"If I cloned this repo, what secrets would I see?\"\n5. \"What happens if someone guesses another user's token?\"\n\n---\n\n## Risk Level Guide\n\n| Issue | Risk Level | Action |\n|-------|------------|--------|\n| SQL injection possible | CRITICAL | Must fix |\n| No rate limiting on auth | HIGH | Should fix |\n| Missing authorization check | HIGH | Should fix |\n| XSS possible | HIGH | Should fix |\n| Verbose error messages | MEDIUM | Recommend fix |\n| Missing input validation | MEDIUM | Recommend fix |\n| No CSRF protection | MEDIUM | Recommend fix |\n| CORS too permissive | LOW | Note for review |\n","# Gate 2: Security Review\n\n> \"Security isn't a feature you add later. It's a foundation you build on.\"\n\n## Purpose\n\nThis gate catches common security vulnerabilities before they reach production. Issues don't BLOCK, but generate strong WARNINGS.\n\n## Gate Status\n\n- **PASS** — No security issues found\n- **WARNING** — Issues found that should be fixed before production\n- **CRITICAL WARNING** — Severe issues that really should block\n\n---\n\n## Gate Questions\n\n### Question 1: Input Entry Points\n> \"Where does user input enter this feature?\"\n\n**Looking for:**\n- Awareness of all input sources (forms, URLs, headers, etc.)\n- Understanding that ALL input is untrusted\n- Identification of data flow\n\n**Follow-up if input exists:**\n> \"How is that input validated before it's used?\"\n\n### Question 2: Data Access\n> \"What data does this feature access? Who should be able to access it?\"\n\n**Looking for:**\n- Understanding of data sensitivity\n- Awareness of authorization requirements\n- Knowledge of who can see what\n\n**Follow-up:**\n> \"How do you verify the requesting user is allowed to access this data?\"\n\n### Question 3: Secrets and Exposure\n> \"Are there any secrets, tokens, or sensitive data involved? Where are they stored?\"\n\n**Looking for:**\n- Secrets in environment variables, not code\n- No sensitive data in logs\n- No tokens in URLs or client-side storage (unless necessary)\n\n---\n\n## Security Checklist\n\nReview the code for these common issues:\n\n### Input Handling\n- [ ] All user input validated server-side\n- [ ] Input length limits enforced\n- [ ] Special characters handled (SQL, HTML, shell)\n- [ ] File uploads validated (type, size, content)\n\n### Authentication & Authorization\n- [ ] Protected routes require authentication\n- [ ] Users can only access their own data\n- [ ] Admin routes check admin role\n- [ ] Tokens have reasonable expiration\n\n### Data Exposure\n- [ ] API responses don't include unnecessary fields\n- [ ] Errors don't expose internal details\n- [ ] Logs don't contain passwords\u002Ftokens\n- [ ] No sensitive data in URLs\n\n### Common Vulnerabilities\n- [ ] No SQL string concatenation\n- [ ] No `eval()` or `new Function()` with user input\n- [ ] No `innerHTML` with unsanitized user input\n- [ ] No hardcoded secrets in code\n\n---\n\n## Response Templates\n\n### If PASS\n\n```\n✅ SECURITY GATE: PASSED\n\nSecurity considerations addressed:\n- Input validation: ✓\n- Authorization checks: ✓\n- No exposed secrets: ✓\n\nMoving to the next gate...\n```\n\n### If WARNING\n\n```\n⚠️ SECURITY GATE: WARNING\n\nI found [X] security considerations to address:\n\n**Issue 1: [Title]**\nLocation: `file.ts:42`\nRisk: [What could go wrong]\nQuestion: \"What stops a malicious user from [attack scenario]?\"\n\n**Issue 2: [Title]**\nLocation: `file.ts:88`\nRisk: [What could go wrong]\nSuggestion: [Direction to fix, not the answer]\n\nThese should be fixed before this goes to production.\nWould you like to address them now?\n```\n\n### If CRITICAL WARNING\n\n```\n? SECURITY GATE: CRITICAL WARNING\n\nThis needs attention before proceeding:\n\n**CRITICAL: [Issue]**\nLocation: `file.ts:42`\nRisk: [Severity explanation - data breach, account takeover, etc.]\n\nThis is the kind of vulnerability that makes news headlines.\nLet's fix this before anything else.\n```\n\n---\n\n## Common Vulnerabilities to Check\n\n### SQL Injection\n```\n❌ db.query(`SELECT * FROM users WHERE id = ${userId}`);\n✅ db.query('SELECT * FROM users WHERE id = ?', [userId]);\n```\n\n### Cross-Site Scripting (XSS)\n```\n❌ element.innerHTML = userInput;\n✅ element.textContent = userInput;\n```\n\n### Insecure Direct Object Reference (IDOR)\n```\n❌ \u002F\u002F Anyone can access any user's data\n   app.get('\u002Fusers\u002F:id', (req, res) => {\n     const user = await User.findById(req.params.id);\n     res.json(user);\n   });\n\n✅ \u002F\u002F Check ownership\n   app.get('\u002Fusers\u002F:id', (req, res) => {\n     const user = await User.findById(req.params.id);\n     if (user.id !== req.user.id) throw new ForbiddenError();\n     res.json(user);\n   });\n```\n\n### Hardcoded Secrets\n```\n❌ const apiKey = 'sk-live-abc123';\n✅ const apiKey = process.env.API_KEY;\n```\n\n---\n\n## Socratic Security Questions\n\nInstead of pointing out the fix, ask:\n\n1. \"What stops user A from accessing user B's data by changing the ID?\"\n2. \"If I send `\u003Cscript>alert('XSS')\u003C\u002Fscript>` as my name, what happens?\"\n3. \"What if someone sends 10MB of data to this endpoint?\"\n4. \"If I cloned this repo, what secrets would I see?\"\n5. \"What happens if someone guesses another user's token?\"\n\n---\n\n## Risk Level Guide\n\n| Issue | Risk Level | Action |\n|-------|------------|--------|\n| SQL injection possible | CRITICAL | Must fix |\n| No rate limiting on auth | HIGH | Should fix |\n| Missing authorization check | HIGH | Should fix |\n| XSS possible | HIGH | Should fix |\n| Verbose error messages | MEDIUM | Recommend fix |\n| Missing input validation | MEDIUM | Recommend fix |\n| No CSRF protection | MEDIUM | Recommend fix |\n| CORS too permissive | LOW | Note for review |\n",{"name":5,"description":7},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fdanielpodolsky\u002Fsecurity-gate",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":40,"prompt":50,"zipAvailable":51},[41,44,47],{"tool":42,"command":43},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill security-gate",{"tool":45,"command":46},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill security-gate",{"tool":48,"command":49},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill security-gate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fdanielpodolsky\u002Fsecurity-gate\u002FSKILL.md",true,[53,59,65,69,73,77,81,85,89],{"path":54,"resourceType":55,"resourceTypeDesc":56,"sizeBytes":57,"sourceHtmlUrl":58},"LICENSE.txt","LICENSE","许可证",1099,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T123413Z\u002Fsource\u002Fskills\u002Fwinmd-api-search\u002FLICENSE.txt",{"path":60,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":63,"sourceHtmlUrl":64},"scripts\u002Fcache-generator\u002FCacheGenerator.csproj","SCRIPT","脚本",1450,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T123413Z\u002Fsource\u002Fskills\u002Fwinmd-api-search\u002Fscripts\u002Fcache-generator\u002FCacheGenerator.csproj",{"path":66,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":67,"sourceHtmlUrl":68},"scripts\u002Fcache-generator\u002FDirectory.Build.props",101,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T123413Z\u002Fsource\u002Fskills\u002Fwinmd-api-search\u002Fscripts\u002Fcache-generator\u002FDirectory.Build.props",{"path":70,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":71,"sourceHtmlUrl":72},"scripts\u002Fcache-generator\u002FDirectory.Build.targets",95,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T123413Z\u002Fsource\u002Fskills\u002Fwinmd-api-search\u002Fscripts\u002Fcache-generator\u002FDirectory.Build.targets",{"path":74,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":75,"sourceHtmlUrl":76},"scripts\u002Fcache-generator\u002FDirectory.Packages.props",108,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T123413Z\u002Fsource\u002Fskills\u002Fwinmd-api-search\u002Fscripts\u002Fcache-generator\u002FDirectory.Packages.props",{"path":78,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":79,"sourceHtmlUrl":80},"scripts\u002Fcache-generator\u002FProgram.cs",43942,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T123413Z\u002Fsource\u002Fskills\u002Fwinmd-api-search\u002Fscripts\u002Fcache-generator\u002FProgram.cs",{"path":82,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":83,"sourceHtmlUrl":84},"scripts\u002FInvoke-WinMdQuery.ps1",19226,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T123413Z\u002Fsource\u002Fskills\u002Fwinmd-api-search\u002Fscripts\u002FInvoke-WinMdQuery.ps1",{"path":86,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":87,"sourceHtmlUrl":88},"scripts\u002FUpdate-WinMdCache.ps1",7619,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T123413Z\u002Fsource\u002Fskills\u002Fwinmd-api-search\u002Fscripts\u002FUpdate-WinMdCache.ps1",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"skill-report.json","REFERENCE","参考文档",11900,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fdanielpodolsky\u002Fsecurity-gate\u002Fskill-report.json",[96,110,120,129,135,142],{"skillNo":97,"name":98,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":106,"publishedAt":25},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[101],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[107,108,109],"model","model hierarchy","model hierarchy skill",{"skillNo":111,"name":112,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":25},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[115],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[117,118,119],"MCP","zoom","zoom mcp",{"skillNo":121,"name":122,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":25},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[126,127,128,118],"sdk","zoom apps sdk","apps",{"skillNo":130,"name":131,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":25},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[131],{"skillNo":136,"name":137,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":25},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[140],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[137],{"skillNo":143,"name":144,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":25},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[144]]