[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ER4EGNXCNN8P05RKVCQXHC":3,"skill-same:01M6ER4EGNXCNN8P05RKVCQXHC":69},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":13,"repositoryHtmlUrl":52,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":68},"01M6ER4EGNXCNN8P05RKVCQXHC","security-check",null,"Quick security scan — hardcoded secrets, common vulnerabilities, dependency issues. Use when the user asks to check security, scan for secrets, or audit for vulnerabilities. Manual via \u002Fsecurity-check.","cj-ways\u002Farcana","cj-ways","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F268418145?v=4","01M6ER2722FXTDPCH3119PJ5T3","01M6ER2773VFWAC3D21KGP6N7Q",0,"MIT","https:\u002F\u002Fgithub.com\u002Fcj-ways\u002Farcana\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-check\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"security","security check","check","utility","via","scope","scan","dependency","use","webfetch","read","grep","common","deps","Bash","secrets","audit","security scan","issues","vulnerabilities","2026-11-10 10:12:30",false,"---\nname: security-check\ndescription: 'Quick security scan — hardcoded secrets, common vulnerabilities, dependency issues. Use when the user asks to check security, scan for secrets, or audit for vulnerabilities. Manual via \u002Fsecurity-check.'\nargument-hint: '[scope: secrets|vulns|deps|all]'\nallowed-tools: Grep, Read, Glob, Bash, WebSearch, WebFetch\neffort: medium\nphase: utility\nfeedback-profile: diagnostic\ncatalog-order: 110\ndisable-model-invocation: true\n---\n\n# Security Check\n\nQuick security sanity check. Not a full SAST — catches the most common issues fast.\n\n## Gotchas\n\n1. **Flagging test fixtures as real secrets.** Test files intentionally contain fake API keys, tokens, and passwords for testing. Unless the value matches a known production pattern prefix (`AKIA`, `sk_live_`, `ghp_`), do not flag test file secrets as CRITICAL.\n2. **Flagging environment variable NAMES (not values) as leaks.** Code that references `process.env.STRIPE_SECRET_KEY` is reading a variable name, not leaking a secret. Only flag when an actual secret VALUE is hardcoded (e.g., `const key = \"sk_live_abc123\"`).\n3. **Missing secrets in non-standard locations.** Do not only scan `src\u002F` and `.env`. Also check: `.env.local`, `.env.production`, `docker-compose.yml` (environment sections), CI config files (`.github\u002Fworkflows\u002F*.yml`, `.gitlab-ci.yml`), and `Makefile` \u002F shell scripts.\n4. **Not checking sibling projects for shared secrets.** If the project is in a monorepo or shares a parent directory with other projects, secrets from one project may leak into another via shared config files or symlinks. Flag this as a review item if detected.\n\n## Argument Parsing\n\nParse the argument to determine scope:\n- `all` (default, also when no argument given): run all three checks\n- `secrets`: only scan for hardcoded secrets\n- `vulns`: only scan for common vulnerability patterns\n- `deps`: only check dependency vulnerabilities\n\n## Detection Categories\n\n### 1. Hardcoded Secrets (scope: `secrets`)\n\nUse the Grep tool to scan for these patterns across the codebase:\n\n- **API keys**: `[A-Za-z0-9_]{20,}` near keywords `key`, `token`, `secret`, `password`, `api_key`\n- **AWS keys**: `AKIA[0-9A-Z]{16}`\n- **GitHub tokens**: `ghp_`, `gho_`, `ghs_`, `ghu_`, `gha_`, `github_pat_`\n- **GitLab tokens**: `glpat-`, `gldt-`, `glrt-`\n- **Slack tokens**: `xoxb-` (bot), `xoxp-` (user), `xapp-` (app-level)\n- **Google Cloud \u002F Firebase**: `AIza[0-9A-Za-z_-]{35}`\n- **Twilio**: `SK[a-f0-9]{32}`\n- **SendGrid**: `SG\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9_-]{43}`\n- **Stripe keys**: `sk_live_`, `sk_test_`\n- **JWT secrets**: values assigned to `JWT_SECRET`, `SECRET_KEY`\n- **Private keys**: `-----BEGIN (RSA |EC |)PRIVATE KEY-----`\n- **Connection strings**: `:\u002F\u002Fuser:password@` or `:\u002F\u002F[^:]+:[^@]+@`\n\n**Skip these paths\u002Ffiles entirely:**\n- `.env.example` (template file)\n- `*.test.*`, `*.spec.*` (test files — unless the value looks like a real production secret)\n- `node_modules\u002F`, `dist\u002F`, `build\u002F`, `.git\u002F`\n- Lock files (`package-lock.json`, `yarn.lock`, `go.sum`, `Gemfile.lock`, `poetry.lock`)\n\n### 2. Common Vulnerability Patterns (scope: `vulns`)\n\nScan with language awareness:\n\n**Any language:**\n- `eval()` with variable input (not a static string)\n- `exec()` with string concatenation\n\n**JavaScript\u002FTypeScript:**\n- `innerHTML =` (XSS)\n- `dangerouslySetInnerHTML` (XSS)\n- `new Function(` with variable arguments\n- `document.write(` (XSS)\n\n**SQL (any language):**\n- String interpolation inside SQL queries: `${` near `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `WHERE`\n- String concatenation with SQL keywords: `\"SELECT \" +`, `'SELECT ' +`\n\n**Go:**\n- `fmt.Sprintf` used to build SQL queries\n- `os\u002Fexec` with user-controlled input\n\n**Python:**\n- `pickle.loads` with untrusted data\n- `subprocess` with `shell=True` and variable arguments\n\n**Command injection (any language):**\n- `exec()`, `spawn()`, `system()` with string concatenation from user input\n\n**ORM raw query injection:**\n- Sequelize: `sequelize.query()` or `model.query()` with string interpolation\n- Django: `.raw()` or `.extra()` with string concatenation\n- GORM (Go): `.Raw()` or `.Exec()` with `fmt.Sprintf`\n\n**SSRF (Server-Side Request Forgery):**\n- Unvalidated URL construction from user input passed to HTTP clients\n- `fetch()`, `axios()`, `http.get()`, `requests.get()` with user-controlled URL parts\n\n**Path traversal:**\n- `..\u002F` sequences in file operations with user-controlled input\n- `path.join()` or `os.path.join()` with user input without sanitization\n\n### 3. Dependency Vulnerabilities (scope: `deps`)\n\nAuto-detect the project type and run the appropriate audit command via Bash:\n\n| Project Type | Detection File | Audit Command |\n|---|---|---|\n| Node.js | `package.json` | `npm audit --json` or `yarn audit --json` |\n| Go | `go.mod` | `govulncheck .\u002F...` (if installed) or `go list -m -json all` |\n| Python | `requirements.txt` \u002F `pyproject.toml` | `pip audit` (if installed) or `safety check` |\n| Ruby | `Gemfile` | `bundle audit` |\n\nParse the output and summarize counts: critical \u002F high \u002F moderate \u002F low.\n\n**3b. WebSearch for known CVEs (DO NOT SKIP)**\n\nAfter running local audit commands, use WebSearch to check for vulnerabilities that local tools may miss:\n1. For each direct dependency (not transitive), search: `\"[package-name] CVE 2025 2026\"`\n2. For any dependency flagged by the local audit, search: `\"[package-name] vulnerability\"` for additional context and remediation guidance\n3. Check for recently disclosed vulnerabilities that may not yet be in local advisory databases\n4. Report findings with CVE IDs, severity, affected versions, and links to advisories\n5. If a dependency has no known CVEs, do not report it — only surface actual findings\n\n## Risk Classification\n\n| Level | Examples |\n|---|---|\n| **CRITICAL** | Hardcoded production secrets (AWS keys, Stripe live keys), SQL injection with user input |\n| **HIGH** | `eval` with variables, command injection patterns, critical dependency vulns |\n| **MEDIUM** | XSS patterns (`innerHTML`), test secrets that look real, high dependency vulns |\n| **LOW** | Deprecated patterns, moderate dependency vulns, informational findings |\n\nWhen a finding is ambiguous, classify at the LOWER risk level to reduce false positives.\n\n## Output Format\n\nPresent results in this format:\n\n```\n## Security Check Report\n**Date:** YYYY-MM-DD\n**Scope:** all | secrets | vulns | deps\n\n### Summary\n| Category | Checked | Critical | High | Medium | Low |\n|----------|---------|----------|------|--------|-----|\n| Secrets  | Y\u002FN     | 0        | 0    | 0      | 0   |\n| Vulns    | Y\u002FN     | 0        | 0    | 0      | 0   |\n| Deps     | Y\u002FN     | 0        | 0    | 0      | 0   |\n\n### Findings\n\n#### [CRITICAL] Hardcoded AWS Key\n- **File:** src\u002Fconfig.ts:42\n- **Pattern:** `AKIA****...` (masked)\n- **Recommendation:** Move to environment variable, rotate the exposed key immediately.\n\n#### [HIGH] SQL Injection\n- **File:** src\u002Fdb\u002Fqueries.ts:18\n- **Pattern:** String interpolation in SQL query\n- **Recommendation:** Use parameterized queries instead.\n\n(... per finding ...)\n\n### No Issues Found\nIf a category has zero findings, say so explicitly.\n```\n\n## Rules\n\n- NEVER modify any files — this is a read-only scan, report only.\n- NEVER log or display actual secret values — mask them: show first 4 characters + `****`.\n- Skip test files for secret detection unless the value matches a known production pattern (e.g., `AKIA`, `sk_live_`).\n- Skip `.env.example` — it is a template.\n- Use Grep and Read tools only — no Bash except for dependency audit commands.\n- If no issues are found, say so clearly. Do not invent findings.\n- Run quickly. This is a sanity check, not a penetration test.\n\n## Limitations\n\n- This is a grep-based heuristic scan, not a static analysis tool. For deeper analysis, use specialized tools (Semgrep, CodeQL, Snyk, govulncheck).\n- Secret detection relies on pattern matching. High-entropy random strings without known prefixes will be missed.\n- Vulnerability detection cannot trace data flow across function boundaries. It catches common patterns at the call site only.\n\n## Context-Aware False Positive Guidance\n\nNot all pattern matches are equal. Before reporting a finding, assess its context:\n\n**Severity depends on location:**\n- `eval()` in a build script or dev tool → INFO (safe, not user-facing)\n- `eval()` in a request handler or user input processing → CRITICAL (exploitable)\n- Hardcoded API key in `src\u002F` or `lib\u002F` → CRITICAL (production code)\n- Hardcoded API key in `*.test.*` or `*.spec.*` → INFO (test fixture, usually intentional)\n- Hardcoded API key in `scripts\u002F` or `tools\u002F` → WARNING (dev tooling, still risky if committed)\n\n**Classify findings into tiers:**\n- **CRITICAL**: Actively exploitable in production. Requires immediate action. Examples: real secrets in source, SQL injection in request handlers, eval with user input.\n- **WARNING**: Potentially dangerous depending on deployment context. Requires review. Examples: innerHTML in admin-only UI, eval in build scripts, test secrets that look real.\n- **INFO**: Informational only, not exploitable in current context. Examples: deprecated patterns, test fixtures, dev-only code paths.\n\nWhen unsure, classify at WARNING (not CRITICAL) to avoid alarm fatigue, but do not suppress to INFO.\n","# Security Check\n\nQuick security sanity check. Not a full SAST — catches the most common issues fast.\n\n## Gotchas\n\n1. **Flagging test fixtures as real secrets.** Test files intentionally contain fake API keys, tokens, and passwords for testing. Unless the value matches a known production pattern prefix (`AKIA`, `sk_live_`, `ghp_`), do not flag test file secrets as CRITICAL.\n2. **Flagging environment variable NAMES (not values) as leaks.** Code that references `process.env.STRIPE_SECRET_KEY` is reading a variable name, not leaking a secret. Only flag when an actual secret VALUE is hardcoded (e.g., `const key = \"sk_live_abc123\"`).\n3. **Missing secrets in non-standard locations.** Do not only scan `src\u002F` and `.env`. Also check: `.env.local`, `.env.production`, `docker-compose.yml` (environment sections), CI config files (`.github\u002Fworkflows\u002F*.yml`, `.gitlab-ci.yml`), and `Makefile` \u002F shell scripts.\n4. **Not checking sibling projects for shared secrets.** If the project is in a monorepo or shares a parent directory with other projects, secrets from one project may leak into another via shared config files or symlinks. Flag this as a review item if detected.\n\n## Argument Parsing\n\nParse the argument to determine scope:\n- `all` (default, also when no argument given): run all three checks\n- `secrets`: only scan for hardcoded secrets\n- `vulns`: only scan for common vulnerability patterns\n- `deps`: only check dependency vulnerabilities\n\n## Detection Categories\n\n### 1. Hardcoded Secrets (scope: `secrets`)\n\nUse the Grep tool to scan for these patterns across the codebase:\n\n- **API keys**: `[A-Za-z0-9_]{20,}` near keywords `key`, `token`, `secret`, `password`, `api_key`\n- **AWS keys**: `AKIA[0-9A-Z]{16}`\n- **GitHub tokens**: `ghp_`, `gho_`, `ghs_`, `ghu_`, `gha_`, `github_pat_`\n- **GitLab tokens**: `glpat-`, `gldt-`, `glrt-`\n- **Slack tokens**: `xoxb-` (bot), `xoxp-` (user), `xapp-` (app-level)\n- **Google Cloud \u002F Firebase**: `AIza[0-9A-Za-z_-]{35}`\n- **Twilio**: `SK[a-f0-9]{32}`\n- **SendGrid**: `SG\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9_-]{43}`\n- **Stripe keys**: `sk_live_`, `sk_test_`\n- **JWT secrets**: values assigned to `JWT_SECRET`, `SECRET_KEY`\n- **Private keys**: `-----BEGIN (RSA |EC |)PRIVATE KEY-----`\n- **Connection strings**: `:\u002F\u002Fuser:password@` or `:\u002F\u002F[^:]+:[^@]+@`\n\n**Skip these paths\u002Ffiles entirely:**\n- `.env.example` (template file)\n- `*.test.*`, `*.spec.*` (test files — unless the value looks like a real production secret)\n- `node_modules\u002F`, `dist\u002F`, `build\u002F`, `.git\u002F`\n- Lock files (`package-lock.json`, `yarn.lock`, `go.sum`, `Gemfile.lock`, `poetry.lock`)\n\n### 2. Common Vulnerability Patterns (scope: `vulns`)\n\nScan with language awareness:\n\n**Any language:**\n- `eval()` with variable input (not a static string)\n- `exec()` with string concatenation\n\n**JavaScript\u002FTypeScript:**\n- `innerHTML =` (XSS)\n- `dangerouslySetInnerHTML` (XSS)\n- `new Function(` with variable arguments\n- `document.write(` (XSS)\n\n**SQL (any language):**\n- String interpolation inside SQL queries: `${` near `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `WHERE`\n- String concatenation with SQL keywords: `\"SELECT \" +`, `'SELECT ' +`\n\n**Go:**\n- `fmt.Sprintf` used to build SQL queries\n- `os\u002Fexec` with user-controlled input\n\n**Python:**\n- `pickle.loads` with untrusted data\n- `subprocess` with `shell=True` and variable arguments\n\n**Command injection (any language):**\n- `exec()`, `spawn()`, `system()` with string concatenation from user input\n\n**ORM raw query injection:**\n- Sequelize: `sequelize.query()` or `model.query()` with string interpolation\n- Django: `.raw()` or `.extra()` with string concatenation\n- GORM (Go): `.Raw()` or `.Exec()` with `fmt.Sprintf`\n\n**SSRF (Server-Side Request Forgery):**\n- Unvalidated URL construction from user input passed to HTTP clients\n- `fetch()`, `axios()`, `http.get()`, `requests.get()` with user-controlled URL parts\n\n**Path traversal:**\n- `..\u002F` sequences in file operations with user-controlled input\n- `path.join()` or `os.path.join()` with user input without sanitization\n\n### 3. Dependency Vulnerabilities (scope: `deps`)\n\nAuto-detect the project type and run the appropriate audit command via Bash:\n\n| Project Type | Detection File | Audit Command |\n|---|---|---|\n| Node.js | `package.json` | `npm audit --json` or `yarn audit --json` |\n| Go | `go.mod` | `govulncheck .\u002F...` (if installed) or `go list -m -json all` |\n| Python | `requirements.txt` \u002F `pyproject.toml` | `pip audit` (if installed) or `safety check` |\n| Ruby | `Gemfile` | `bundle audit` |\n\nParse the output and summarize counts: critical \u002F high \u002F moderate \u002F low.\n\n**3b. WebSearch for known CVEs (DO NOT SKIP)**\n\nAfter running local audit commands, use WebSearch to check for vulnerabilities that local tools may miss:\n1. For each direct dependency (not transitive), search: `\"[package-name] CVE 2025 2026\"`\n2. For any dependency flagged by the local audit, search: `\"[package-name] vulnerability\"` for additional context and remediation guidance\n3. Check for recently disclosed vulnerabilities that may not yet be in local advisory databases\n4. Report findings with CVE IDs, severity, affected versions, and links to advisories\n5. If a dependency has no known CVEs, do not report it — only surface actual findings\n\n## Risk Classification\n\n| Level | Examples |\n|---|---|\n| **CRITICAL** | Hardcoded production secrets (AWS keys, Stripe live keys), SQL injection with user input |\n| **HIGH** | `eval` with variables, command injection patterns, critical dependency vulns |\n| **MEDIUM** | XSS patterns (`innerHTML`), test secrets that look real, high dependency vulns |\n| **LOW** | Deprecated patterns, moderate dependency vulns, informational findings |\n\nWhen a finding is ambiguous, classify at the LOWER risk level to reduce false positives.\n\n## Output Format\n\nPresent results in this format:\n\n```\n## Security Check Report\n**Date:** YYYY-MM-DD\n**Scope:** all | secrets | vulns | deps\n\n### Summary\n| Category | Checked | Critical | High | Medium | Low |\n|----------|---------|----------|------|--------|-----|\n| Secrets  | Y\u002FN     | 0        | 0    | 0      | 0   |\n| Vulns    | Y\u002FN     | 0        | 0    | 0      | 0   |\n| Deps     | Y\u002FN     | 0        | 0    | 0      | 0   |\n\n### Findings\n\n#### [CRITICAL] Hardcoded AWS Key\n- **File:** src\u002Fconfig.ts:42\n- **Pattern:** `AKIA****...` (masked)\n- **Recommendation:** Move to environment variable, rotate the exposed key immediately.\n\n#### [HIGH] SQL Injection\n- **File:** src\u002Fdb\u002Fqueries.ts:18\n- **Pattern:** String interpolation in SQL query\n- **Recommendation:** Use parameterized queries instead.\n\n(... per finding ...)\n\n### No Issues Found\nIf a category has zero findings, say so explicitly.\n```\n\n## Rules\n\n- NEVER modify any files — this is a read-only scan, report only.\n- NEVER log or display actual secret values — mask them: show first 4 characters + `****`.\n- Skip test files for secret detection unless the value matches a known production pattern (e.g., `AKIA`, `sk_live_`).\n- Skip `.env.example` — it is a template.\n- Use Grep and Read tools only — no Bash except for dependency audit commands.\n- If no issues are found, say so clearly. Do not invent findings.\n- Run quickly. This is a sanity check, not a penetration test.\n\n## Limitations\n\n- This is a grep-based heuristic scan, not a static analysis tool. For deeper analysis, use specialized tools (Semgrep, CodeQL, Snyk, govulncheck).\n- Secret detection relies on pattern matching. High-entropy random strings without known prefixes will be missed.\n- Vulnerability detection cannot trace data flow across function boundaries. It catches common patterns at the call site only.\n\n## Context-Aware False Positive Guidance\n\nNot all pattern matches are equal. Before reporting a finding, assess its context:\n\n**Severity depends on location:**\n- `eval()` in a build script or dev tool → INFO (safe, not user-facing)\n- `eval()` in a request handler or user input processing → CRITICAL (exploitable)\n- Hardcoded API key in `src\u002F` or `lib\u002F` → CRITICAL (production code)\n- Hardcoded API key in `*.test.*` or `*.spec.*` → INFO (test fixture, usually intentional)\n- Hardcoded API key in `scripts\u002F` or `tools\u002F` → WARNING (dev tooling, still risky if committed)\n\n**Classify findings into tiers:**\n- **CRITICAL**: Actively exploitable in production. Requires immediate action. Examples: real secrets in source, SQL injection in request handlers, eval with user input.\n- **WARNING**: Potentially dangerous depending on deployment context. Requires review. Examples: innerHTML in admin-only UI, eval in build scripts, test secrets that look real.\n- **INFO**: Informational only, not exploitable in current context. Examples: deprecated patterns, test fixtures, dev-only code paths.\n\nWhen unsure, classify at WARNING (not CRITICAL) to avoid alarm fatigue, but do not suppress to INFO.\n",{"name":5,"phase":21,"effort":43,"description":7,"allowed-tools":44,"argument-hint":45,"catalog-order":46,"feedback-profile":47,"disable-model-invocation":48},"medium","Grep, Read, Glob, Bash, WebSearch, WebFetch","[scope: secrets|vulns|deps|all]",110,"diagnostic",true,"main","62a5cbde2da44ccf4660521f0e3b2286f71dcbfd","skills\u002Fsecurity-check","https:\u002F\u002Fgithub.com\u002Fcj-ways\u002Farcana","https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002F@cj-ways\u002Farcana","https:\u002F\u002Fgithub.com\u002Fcj-ways","2026-04-27 15:57:45",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":48},[58,61,64],{"tool":59,"command":60},"npx","npx skills add cj-ways\u002Farcana --skill security-check",{"tool":62,"command":63},"bunx","bunx skills add cj-ways\u002Farcana --skill security-check",{"tool":65,"command":66},"pnpm","pnpm dlx skills add cj-ways\u002Farcana --skill security-check","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcj-ways\u002Farcana\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-check\u002FSKILL.md",[],[70,106,128,150,175,197],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":86,"publishedAt":38},"01M6ER4PGRFCMZ3D11YCEQ7Q9H","v0-design","Generates optimized v0.dev prompts for UI design — full pages, single components, design systems, or redesigns. Analyzes the project, adapts questions to context, researches user-specified design references, and outputs ready-to-copy prompts following Vercel's three-part framework. Manual via \u002Fv0-design.","https:\u002F\u002Fgithub.com\u002Fcj-ways\u002Farcana\u002Fblob\u002Fmain\u002Fskills\u002Fv0-design\u002FSKILL.md",[76,81],{"categoryNo":77,"categoryName":78,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[87,88,89,90,91,92,93,94,28,95,96,97,98,99,100,101,102,103,104,105],"design","v0","v0 design","components","component","design systems","framework","ui","write","context","design-system","ready","ui design","references","three","project","full","feature","app",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":115,"publishedAt":38},"01M6ER4J1MAN09RA7ZVFQP5WC0","skill-scout","Scouts major skill providers for skills that match the current project — fetches catalogs, analyzes the codebase, cross-matches, and recommends with evidence. Critical assessment, not a dump of everything available. Manual via \u002Fskill-scout.","https:\u002F\u002Fgithub.com\u002Fcj-ways\u002Farcana\u002Fblob\u002Fmain\u002Fskills\u002Fskill-scout\u002FSKILL.md",[112],{"categoryNo":113,"categoryName":114,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000023","Skill与智能体开发",[116,117,118,18,119,120,121,32,29,28,27,122,123,124,125,102,126,127,22,21],"skill scout","scout","testing","workflow","assessment","Providers","ops","evidence","focus","advisory","critical","dump",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":38},"01M6ER4A08G4CPT443J7XSHDJQ","release-check","Analyzes branch diff to generate deploy checklists — env vars, migrations, new services, dependencies, schema changes, breaking changes. Works across any tech stack. Manual via \u002Frelease-check [source] [target].","https:\u002F\u002Fgithub.com\u002Fcj-ways\u002Farcana\u002Fblob\u002Fmain\u002Fskills\u002Frelease-check\u002FSKILL.md",[],[135,136,20,137,138,139,140,32,141,29,142,28,143,144,145,146,147,148,22,149],"release","release check","generate","env vars","services","execution","stack","branch","diff","schema","migrations","dependencies","across","env","tech",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":159,"publishedAt":38},"01M6ER45AQCN9RDAXZA5A5W03C","refactor-plan","Plans and executes safe multi-file refactoring — maps dependency graph, batches changes into atomic commits, runs tests between batches. Prevents the cascading-breakage pattern where agents make sweeping changes that fail halfway. Use for renames, extractions, moves, or structural changes across multiple files. Manual via \u002Frefactor-plan.","https:\u002F\u002Fgithub.com\u002Fcj-ways\u002Farcana\u002Fblob\u002Fmain\u002Fskills\u002Frefactor-plan\u002FSKILL.md",[156],{"categoryNo":157,"categoryName":158,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000007","代码审查",[160,161,162,163,164,165,32,166,167,28,95,168,25,169,170,171,172,147,173,174],"refactor plan","refactor","plan","safe","graph","commits","refactoring","atomic commits","edit","dependency graph","files","maps","pattern","structural","make",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":185,"publishedAt":38},"01M6ER41VW96NCAMSQF8SV31J7","quick-review","Fast single-pass code review with strong false-positive suppression. Reviews git diff for runtime errors, data corruption, security breaches, operational incidents. Use for PR reviews and quick change validation. Manual via \u002Fquick-review.","https:\u002F\u002Fgithub.com\u002Fcj-ways\u002Farcana\u002Fblob\u002Fmain\u002Fskills\u002Fquick-review\u002FSKILL.md",[181,182],{"categoryNo":157,"categoryName":158,"taxonomyType":79,"taxonomyTypeDesc":80},{"categoryNo":183,"categoryName":184,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000030","开发工程师",[186,187,188,189,190,191,192,193,194,32,29,142,28,26,143,170,102,195,196,22],"review","quick review","code review","change","pr","code","validation","worktree","false-positive","runtime","false",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":206,"publishedAt":38},"01M6ER3Y97Y3WH1NJ35Q9F7XED","pressure-test","Stress-tests an idea, plan, proposal, claim, or request - finds missing assumptions, weak evidence, and asymmetric tradeoffs without manufacturing low-value objections. Use when the user wants adversarial analysis, wants the strongest case for and against something, or wants to know what is missing before deciding. Manual via \u002Fpressure-test.","https:\u002F\u002Fgithub.com\u002Fcj-ways\u002Farcana\u002Fblob\u002Fmain\u002Fskills\u002Fpressure-test\u002FSKILL.md",[203],{"categoryNo":204,"categoryName":205,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000008","测试与质量",[207,208,209,162,29,28,95,27,26,123,210,125,211,212,22,213,214,21,215,216],"test","pressure test","analysis","claim","tests","missing","proposal","case","manufacturing","stress"]