[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FNK72RGKZ5QS2E1NHSGFQJ":3,"skill-same:01M6FNK72RGKZ5QS2E1NHSGFQJ":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M6FNK72RGKZ5QS2E1NHSGFQJ","cso",null,"Security audit skill — systematic OWASP + STRIDE review of a project. Covers attack surface, secrets archaeology, dependency supply chain, OWASP Top 10, threat modeling, and false-positive filtering. Outputs a prioritized findings report.","shenxingy\u002FClade","shenxingy","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F89829751?v=4","01M6CQXHTV3WQZJMG0JXD93MEK","Xingyu (Alex) Shen","01M6CQXHYCTGPJ5HD8Z7MD4Q5P",10,"MIT","https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fcso\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[5,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"dependency","audit skill","top","supply","chain","false","systematic","modeling","project","supply chain","threat","review","filtering","secrets","security audit","false-positive","owasp","audit","owasp top 10","threat modeling","security","2026-11-10 10:12:30",false,"---\nname: cso\ndescription: \"Security audit skill — systematic OWASP + STRIDE review of a project. Covers attack surface, secrets archaeology, dependency supply chain, OWASP Top 10, threat modeling, and false-positive filtering. Outputs a prioritized findings report.\"\n---\n\n# Clade for Codex\n\nThis workflow runs **directly in Codex**. Do not launch the `claude` CLI or\ndelegate the workflow to Clade's MCP bridge.\n\nCodex compatibility rules:\n\n- Plugin skills are namespaced. Invoke this workflow explicitly as\n  `$clade:cso`; a bare `$name` does not select the installed Clade plugin.\n- Read the nearest `AGENTS.md` files for repository instructions. If a project\n  has only `CLAUDE.md`, treat it as legacy project guidance and read it too.\n- Store new Clade working state under `.clade\u002F` (or `~\u002F.clade\u002F` for personal\n  state). Existing legacy Claude state may be read for migration, but do not\n  create new vendor-specific state.\n- A `\u002Fskill-name` reference means the corresponding Codex\n  `$clade:skill-name` plugin skill, or the same workflow invoked naturally when\n  explicit skill invocation is not available.\n- Use Codex web, file, shell, image, and subagent capabilities when the source\n  workflow names a vendor-specific tool. If a capability is unavailable, use\n  the documented fallback instead of spawning another agent CLI.\n- Paths such as `\u003Cplugin-root>\u002F...` are relative to the installed Clade plugin\n  containing this `SKILL.md`; resolve that root before invoking a helper.\n\n## Canonical Clade workflow\n\nYou are the CSO (Chief Security Officer) skill. You perform a systematic security audit of the project.\n\n## Mode\n\n- **Daily mode** (default) — flag findings with confidence ≥ 8\u002F10. Fast, high-signal only.\n- **Comprehensive mode** (`\u002Fcso --full`) — flag findings with confidence ≥ 2\u002F10. Exhaustive, for pre-launch audits.\n\n---\n\n## Weigh findings by whether the layer runs\n\nBefore ranking anything, read `docs\u002Flayers.json`. It declares which surfaces of\nthis repository are actually run and how much a finding in each one is worth:\n\n- **load-bearing** — a defect here is a defect. Rank normally.\n- **dormant** — builds and passes CI but is not run. Report findings, and rank\n  them *below* any load-bearing finding. Do not propose deleting the layer and\n  do not present its gaps as debt; new work there is opt-in.\n- **generated** — never edit directly. The finding belongs in the source surface\n  plus its regen script, not in the copy.\n\nThis exists because an audit of this repository spent most of its effort on the\norchestrator, a layer the owner had switched off months earlier. Nothing in the\ntree said so, so the effort looked well spent right up until it was reported.\n\n---\n\n## Phase 0: Context Gathering\n\n```bash\ngit branch --show-current\nls -la                    # project structure\ncat AGENTS.md 2>\u002Fdev\u002Fnull | head -30   # tech stack\n```\n\nIdentify:\n- Language(s) and framework(s)\n- Entry points (HTTP routes, CLI, cron jobs, webhooks)\n- External integrations (DBs, 3rd party APIs, auth providers)\n- Data sensitivity (PII? financial? health?)\n\n---\n\n## Phase 1: Attack Surface Census\n\nMap all entry points where attacker-controlled data enters the system:\n\n**Code surface:**\n- HTTP routes \u002F API endpoints — enumerate all\n- Form inputs and query parameters\n- File uploads\n- Webhook receivers (does the code verify signatures?)\n- CLI arguments\n\n**Infrastructure surface:**\n- Env vars — which ones hold secrets?\n- Exposed ports (check docker-compose, configs)\n- Public S3 buckets \u002F storage\n- CORS configuration\n\n---\n\n## Phase 2: Secrets Archaeology\n\nSearch for hardcoded secrets and credential exposure:\n\n```bash\n# Hardcoded secrets patterns\ngrep -rn \"sk-\\|api_key\\s*=\\|password\\s*=\\|secret\\s*=\\|token\\s*=\" \\\n     --include=\"*.py\" --include=\"*.ts\" --include=\"*.js\" --include=\"*.env*\" \\\n     . | grep -v \".git\" | grep -v \"__pycache__\" | grep -v \"node_modules\"\n\n# Check for .env files committed to git\ngit log --all --full-history -- \"**\u002F.env\" \"*.env\"\n\n# Check git history for removed secrets (they're still there)\ngit log --all -S \"password\" --oneline | head -10\ngit log --all -S \"sk-\" --oneline | head -10\n```\n\nCheck CI\u002FCD configs for exposed secrets:\n```bash\nfind .github -name \"*.yml\" -o -name \"*.yaml\" 2>\u002Fdev\u002Fnull | xargs grep -l \"secret\\|password\\|key\" 2>\u002Fdev\u002Fnull\n```\n\n---\n\n## Phase 3: Dependency Supply Chain\n\n```bash\n# Python\npip-audit 2>\u002Fdev\u002Fnull || safety check 2>\u002Fdev\u002Fnull || \\\n  pip list --format=json | python3 -c \"import sys,json; pkgs=json.load(sys.stdin); print(f'{len(pkgs)} packages — run pip-audit for vuln scan')\"\n\n# Node.js\nnpm audit --json 2>\u002Fdev\u002Fnull | python3 -c \"\nimport sys, json\ntry:\n    d = json.load(sys.stdin)\n    vulns = d.get('metadata', {}).get('vulnerabilities', {})\n    print(f'Vulnerabilities: critical={vulns.get(\\\"critical\\\",0)}, high={vulns.get(\\\"high\\\",0)}, moderate={vulns.get(\\\"moderate\\\",0)}')\nexcept: pass\n\" 2>\u002Fdev\u002Fnull || true\n```\n\nFlag: unpinned major dependencies (e.g., `requests>=2.0.0` instead of `requests==2.31.0`).\n\n---\n\n## Phase 4: OWASP Top 10 Analysis\n\nLoad `references\u002Fowasp-top10.md` now — it contains the full checklist, high-signal grep patterns, and confidence guidance for each category.\n\nCheck each of the 10 categories using that reference. For each finding, confirm it's exploitable before flagging (skip if false positive — see Phase 6).\n\n---\n\n## Phase 5: STRIDE Threat Model\n\nLoad `references\u002Fstride.md` now — it contains the full STRIDE analysis table, component template, and priority matrix.\n\nFor each major component (web server, database, auth service, background workers), work through S-T-R-I-D-E using that reference. Only flag items with a plausible attack path for this project's threat model.\n\n---\n\n## Phase 6: False Positive Filter\n\nLoad `references\u002Ffalse-positive-filter.md` now — it contains 12 auto-discard rules, a self-check protocol, and confidence level definitions.\n\nApply all 12 rules to every finding. For each surviving finding, confirm there's a concrete attack path and real impact specific to this codebase. Assign a confidence level (HIGH\u002FMEDIUM\u002FLOW) per the reference.\n\n---\n\n## Phase 7: Findings Report\n\nOutput a prioritized report:\n\n```\nSECURITY AUDIT REPORT\n════════════════════════════════════════\nProject: [name]   Branch: [branch]   Date: [date]\nMode: daily | comprehensive\nThreat model: [brief description of attacker profile]\n\nCRITICAL (must fix before ship)\n  [C1] [A03-Injection] SQL injection at routes\u002Fusers.py:87\n       Attack: GET \u002Fusers?id=1 OR 1=1--\n       Impact: Full DB read access\n       Fix: Use parameterized query — `cursor.execute(\"SELECT ... WHERE id = %s\", (id,))`\n\nHIGH (fix in this sprint)\n  [H1] ...\n\nMEDIUM (fix in next sprint)\n  [M1] ...\n\nLOW \u002F Informational\n  [L1] ...\n\nDISCARDED (false positives filtered)\n  - [DoS exclusion] Rate limiting on \u002Fapi\u002Fgenerate — LLM cost risk is LOW (auth required)\n  - [Test-only exclusion] Hardcoded credentials in tests\u002Ffixtures\u002F\n\nSummary: N critical, M high, P medium, Q low\n════════════════════════════════════════\n```\n\nSave report to `.clade\u002Fsecurity-reports\u002FYYYY-MM-DD.md`.\n\n---\n\n## Completion Status\n\n- ✅ **DONE** — audit complete, report saved\n- ⚠ **DONE_WITH_CONCERNS** — audit complete but some phases were skipped (e.g., no package manager detected)\n- ❌ **BLOCKED** — cannot read key files or missing context\n- ❓ **NEEDS_CONTEXT** — need to know threat model or data sensitivity before starting\n\n**Scope note:** This is an AI-assisted audit, not a penetration test. Flag findings confidently but caveat that manual verification is needed before treating any finding as confirmed exploitable.\n\n---\n\n## Deep-Dive Mode (optional)\n\nFor HIGH-confidence findings in critical files, spawn the `security-auditor` subagent for line-by-line analysis:\n\n```\nUse a Codex subagent when available with subagent_type=\"security-auditor\":\n  \"Audit [file path] for [specific vulnerability category]. Context: [what you already know about this component]\"\n```\n\nMerge the subagent's findings into the main report. The subagent has no Write access — it only reads and reports.\n\n---\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| Cannot read key source files (permission denied) | Note in report as \"Partial audit — [file] unreadable\". Continue with what's accessible. |\n| No package manager detected (no requirements.txt, package.json, etc.) | Skip Phase 3, note \"Dependency audit skipped — no package manifest found\" |\n| Git history unavailable | Skip git-based secret archaeology, note it |\n| Project is non-code (docs-only, config-only) | Output \"No attack surface found — this directory contains no executable code\" |\n| Ambiguous tech stack | List what was detected, ask user to confirm before proceeding with OWASP analysis |\n\n## Delivery completion\n\nIf this workflow changes files or external state:\n\n- Inspect the real final state before responding, including `git status` for a\n  repository task.\n- Never report `DONE` while task-owned changes are uncommitted. Use or continue\n  `$clade:delivery` and create a repository-compliant checkpoint or preserve\n  the work when committing is unavailable.\n- When the user request or trusted repository policy makes publication,\n  deployment, or live verification part of the task, do not silently downgrade\n  the result to local-only work.\n- If a required delivery transition lacks authority, credentials, a destination,\n  or reachable external state, report `BLOCKED` or `NEEDS_CONTEXT` rather than\n  appending a \"not committed\u002Fpushed\u002Fdeployed\" caveat after `DONE`.\n","# Clade for Codex\n\nThis workflow runs **directly in Codex**. Do not launch the `claude` CLI or\ndelegate the workflow to Clade's MCP bridge.\n\nCodex compatibility rules:\n\n- Plugin skills are namespaced. Invoke this workflow explicitly as\n  `$clade:cso`; a bare `$name` does not select the installed Clade plugin.\n- Read the nearest `AGENTS.md` files for repository instructions. If a project\n  has only `CLAUDE.md`, treat it as legacy project guidance and read it too.\n- Store new Clade working state under `.clade\u002F` (or `~\u002F.clade\u002F` for personal\n  state). Existing legacy Claude state may be read for migration, but do not\n  create new vendor-specific state.\n- A `\u002Fskill-name` reference means the corresponding Codex\n  `$clade:skill-name` plugin skill, or the same workflow invoked naturally when\n  explicit skill invocation is not available.\n- Use Codex web, file, shell, image, and subagent capabilities when the source\n  workflow names a vendor-specific tool. If a capability is unavailable, use\n  the documented fallback instead of spawning another agent CLI.\n- Paths such as `\u003Cplugin-root>\u002F...` are relative to the installed Clade plugin\n  containing this `SKILL.md`; resolve that root before invoking a helper.\n\n## Canonical Clade workflow\n\nYou are the CSO (Chief Security Officer) skill. You perform a systematic security audit of the project.\n\n## Mode\n\n- **Daily mode** (default) — flag findings with confidence ≥ 8\u002F10. Fast, high-signal only.\n- **Comprehensive mode** (`\u002Fcso --full`) — flag findings with confidence ≥ 2\u002F10. Exhaustive, for pre-launch audits.\n\n---\n\n## Weigh findings by whether the layer runs\n\nBefore ranking anything, read `docs\u002Flayers.json`. It declares which surfaces of\nthis repository are actually run and how much a finding in each one is worth:\n\n- **load-bearing** — a defect here is a defect. Rank normally.\n- **dormant** — builds and passes CI but is not run. Report findings, and rank\n  them *below* any load-bearing finding. Do not propose deleting the layer and\n  do not present its gaps as debt; new work there is opt-in.\n- **generated** — never edit directly. The finding belongs in the source surface\n  plus its regen script, not in the copy.\n\nThis exists because an audit of this repository spent most of its effort on the\norchestrator, a layer the owner had switched off months earlier. Nothing in the\ntree said so, so the effort looked well spent right up until it was reported.\n\n---\n\n## Phase 0: Context Gathering\n\n```bash\ngit branch --show-current\nls -la                    # project structure\ncat AGENTS.md 2>\u002Fdev\u002Fnull | head -30   # tech stack\n```\n\nIdentify:\n- Language(s) and framework(s)\n- Entry points (HTTP routes, CLI, cron jobs, webhooks)\n- External integrations (DBs, 3rd party APIs, auth providers)\n- Data sensitivity (PII? financial? health?)\n\n---\n\n## Phase 1: Attack Surface Census\n\nMap all entry points where attacker-controlled data enters the system:\n\n**Code surface:**\n- HTTP routes \u002F API endpoints — enumerate all\n- Form inputs and query parameters\n- File uploads\n- Webhook receivers (does the code verify signatures?)\n- CLI arguments\n\n**Infrastructure surface:**\n- Env vars — which ones hold secrets?\n- Exposed ports (check docker-compose, configs)\n- Public S3 buckets \u002F storage\n- CORS configuration\n\n---\n\n## Phase 2: Secrets Archaeology\n\nSearch for hardcoded secrets and credential exposure:\n\n```bash\n# Hardcoded secrets patterns\ngrep -rn \"sk-\\|api_key\\s*=\\|password\\s*=\\|secret\\s*=\\|token\\s*=\" \\\n     --include=\"*.py\" --include=\"*.ts\" --include=\"*.js\" --include=\"*.env*\" \\\n     . | grep -v \".git\" | grep -v \"__pycache__\" | grep -v \"node_modules\"\n\n# Check for .env files committed to git\ngit log --all --full-history -- \"**\u002F.env\" \"*.env\"\n\n# Check git history for removed secrets (they're still there)\ngit log --all -S \"password\" --oneline | head -10\ngit log --all -S \"sk-\" --oneline | head -10\n```\n\nCheck CI\u002FCD configs for exposed secrets:\n```bash\nfind .github -name \"*.yml\" -o -name \"*.yaml\" 2>\u002Fdev\u002Fnull | xargs grep -l \"secret\\|password\\|key\" 2>\u002Fdev\u002Fnull\n```\n\n---\n\n## Phase 3: Dependency Supply Chain\n\n```bash\n# Python\npip-audit 2>\u002Fdev\u002Fnull || safety check 2>\u002Fdev\u002Fnull || \\\n  pip list --format=json | python3 -c \"import sys,json; pkgs=json.load(sys.stdin); print(f'{len(pkgs)} packages — run pip-audit for vuln scan')\"\n\n# Node.js\nnpm audit --json 2>\u002Fdev\u002Fnull | python3 -c \"\nimport sys, json\ntry:\n    d = json.load(sys.stdin)\n    vulns = d.get('metadata', {}).get('vulnerabilities', {})\n    print(f'Vulnerabilities: critical={vulns.get(\\\"critical\\\",0)}, high={vulns.get(\\\"high\\\",0)}, moderate={vulns.get(\\\"moderate\\\",0)}')\nexcept: pass\n\" 2>\u002Fdev\u002Fnull || true\n```\n\nFlag: unpinned major dependencies (e.g., `requests>=2.0.0` instead of `requests==2.31.0`).\n\n---\n\n## Phase 4: OWASP Top 10 Analysis\n\nLoad `references\u002Fowasp-top10.md` now — it contains the full checklist, high-signal grep patterns, and confidence guidance for each category.\n\nCheck each of the 10 categories using that reference. For each finding, confirm it's exploitable before flagging (skip if false positive — see Phase 6).\n\n---\n\n## Phase 5: STRIDE Threat Model\n\nLoad `references\u002Fstride.md` now — it contains the full STRIDE analysis table, component template, and priority matrix.\n\nFor each major component (web server, database, auth service, background workers), work through S-T-R-I-D-E using that reference. Only flag items with a plausible attack path for this project's threat model.\n\n---\n\n## Phase 6: False Positive Filter\n\nLoad `references\u002Ffalse-positive-filter.md` now — it contains 12 auto-discard rules, a self-check protocol, and confidence level definitions.\n\nApply all 12 rules to every finding. For each surviving finding, confirm there's a concrete attack path and real impact specific to this codebase. Assign a confidence level (HIGH\u002FMEDIUM\u002FLOW) per the reference.\n\n---\n\n## Phase 7: Findings Report\n\nOutput a prioritized report:\n\n```\nSECURITY AUDIT REPORT\n════════════════════════════════════════\nProject: [name]   Branch: [branch]   Date: [date]\nMode: daily | comprehensive\nThreat model: [brief description of attacker profile]\n\nCRITICAL (must fix before ship)\n  [C1] [A03-Injection] SQL injection at routes\u002Fusers.py:87\n       Attack: GET \u002Fusers?id=1 OR 1=1--\n       Impact: Full DB read access\n       Fix: Use parameterized query — `cursor.execute(\"SELECT ... WHERE id = %s\", (id,))`\n\nHIGH (fix in this sprint)\n  [H1] ...\n\nMEDIUM (fix in next sprint)\n  [M1] ...\n\nLOW \u002F Informational\n  [L1] ...\n\nDISCARDED (false positives filtered)\n  - [DoS exclusion] Rate limiting on \u002Fapi\u002Fgenerate — LLM cost risk is LOW (auth required)\n  - [Test-only exclusion] Hardcoded credentials in tests\u002Ffixtures\u002F\n\nSummary: N critical, M high, P medium, Q low\n════════════════════════════════════════\n```\n\nSave report to `.clade\u002Fsecurity-reports\u002FYYYY-MM-DD.md`.\n\n---\n\n## Completion Status\n\n- ✅ **DONE** — audit complete, report saved\n- ⚠ **DONE_WITH_CONCERNS** — audit complete but some phases were skipped (e.g., no package manager detected)\n- ❌ **BLOCKED** — cannot read key files or missing context\n- ❓ **NEEDS_CONTEXT** — need to know threat model or data sensitivity before starting\n\n**Scope note:** This is an AI-assisted audit, not a penetration test. Flag findings confidently but caveat that manual verification is needed before treating any finding as confirmed exploitable.\n\n---\n\n## Deep-Dive Mode (optional)\n\nFor HIGH-confidence findings in critical files, spawn the `security-auditor` subagent for line-by-line analysis:\n\n```\nUse a Codex subagent when available with subagent_type=\"security-auditor\":\n  \"Audit [file path] for [specific vulnerability category]. Context: [what you already know about this component]\"\n```\n\nMerge the subagent's findings into the main report. The subagent has no Write access — it only reads and reports.\n\n---\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| Cannot read key source files (permission denied) | Note in report as \"Partial audit — [file] unreadable\". Continue with what's accessible. |\n| No package manager detected (no requirements.txt, package.json, etc.) | Skip Phase 3, note \"Dependency audit skipped — no package manifest found\" |\n| Git history unavailable | Skip git-based secret archaeology, note it |\n| Project is non-code (docs-only, config-only) | Output \"No attack surface found — this directory contains no executable code\" |\n| Ambiguous tech stack | List what was detected, ask user to confirm before proceeding with OWASP analysis |\n\n## Delivery completion\n\nIf this workflow changes files or external state:\n\n- Inspect the real final state before responding, including `git status` for a\n  repository task.\n- Never report `DONE` while task-owned changes are uncommitted. Use or continue\n  `$clade:delivery` and create a repository-compliant checkpoint or preserve\n  the work when committing is unavailable.\n- When the user request or trusted repository policy makes publication,\n  deployment, or live verification part of the task, do not silently downgrade\n  the result to local-only work.\n- If a required delivery transition lacks authority, credentials, a destination,\n  or reachable external state, report `BLOCKED` or `NEEDS_CONTEXT` rather than\n  appending a \"not committed\u002Fpushed\u002Fdeployed\" caveat after `DONE`.\n",{"name":5,"description":7},"main","bb20646cb013d2f52f854743fcee83dcc5ccfbd9","plugins\u002Fclade\u002Fskills\u002Fcso",6,"https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade","https:\u002F\u002Falexshen.dev\u002Fen\u002Fblog\u002Fclade","https:\u002F\u002Fgithub.com\u002Fshenxingy","https:\u002F\u002Falexshen.dev\u002F","Founding Engineer @ Scam AI | ECE @ Duke University | Data Science @ Duke Kunshan University","2026-11-11 10:54:30",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add shenxingy\u002FClade --skill cso",{"tool":66,"command":67},"bunx","bunx skills add shenxingy\u002FClade --skill cso",{"tool":69,"command":70},"pnpm","pnpm dlx skills add shenxingy\u002FClade --skill cso","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fcso\u002FSKILL.md",true,[74,80,84],{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Ffalse-positive-filter.md","REFERENCE","参考文档",3352,"https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fcso\u002Freferences\u002Ffalse-positive-filter.md",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fowasp-top10.md",3954,"https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fcso\u002Freferences\u002Fowasp-top10.md",{"path":85,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fstride.md",3075,"https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fcso\u002Freferences\u002Fstride.md",[89,108,141,161,186,203],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":96,"publishedAt":45},"01M6FNPBA3494GF2W7V4MMAKG3","worktree","Create or inspect runtime-adaptive isolated Git workspaces with explicit ownership and delivery routing","https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fworktree\u002FSKILL.md",[95],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[91,97,98,99,100,101,102,103,104,105,106,107],"adaptive","inspect","with","ownership","delivery routing","runtime","delivery","workspaces","git","routing","create",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":120,"publishedAt":45},"01M6FNP75BY8CS006EWGN29FM0","web-search","Route online research and URL reading to native tools or TinyFish MCP\u002FAPI; prepare targeted requests, handle progress and failures, and check returned evidence. Applies to web search, fetching, and bulk collection; excludes repository\u002Ffile search.","https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fweb-search\u002FSKILL.md",[114,115],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140],"web search","search","web","repository","file","research","MCP","requests","collection","reading","URL","native","bulk","progress","file search","route","tinyfish","evidence","check","api",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":45},"01M6FNP2616DRTZRSZJQM3HPHY","verify","Verify project behavior anchors — compilation, tests, and interaction checks after autonomous runs. NOT the Codex built-in \u002Fverify (which runs the app to observe a single change working) — this one walks the AGENTS.md \"Features (Behavior Anchors)\" list.","https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fverify\u002FSKILL.md",[147],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,149,150,151,152,153,154,32,155,156,157,158,159,160],"app","single","features","which","interaction","tests","observe","autonomous","behavior","list","change","codex",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":45},"01M6FNNX95R9H29BNERFY15704","tasks","Coordinate dependency-aware project tasks across independent Codex, Codex, Kimi and human sessions using Beads. Use for shared plans, claiming work, task handoffs, acceptance and agent monitoring snapshots.","https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Ftasks\u002FSKILL.md",[167],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,169,170,171,32,172,173,174,175,176,177,178,179,24,180,181,182,183,184,185,160],"for","plans","work","shared","across","human","task","coordinate","kimi","snapshots","agent monitoring","use","using beads","beads","monitoring","acceptance","sessions",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":45},"01M6FNNTAD1BCZX5Q9TC55MZCH","sync","End-of-session documentation sync — updates TODO.md and PROGRESS.md only (run \u002Fcommit after to commit everything)","https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fsync\u002FSKILL.md",[192],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[188,194,195,196,197,198,199,200,134,201,202],"session","run","documentation","commit","only","documentation sync","updates","end","todo",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":45},"01M6FNNPTR5H23MD3849E66WYA","status","Show a provider-neutral, freshness-aware snapshot of active Agent work, Git delivery, execution identity, and usage limits. Use for “what's going on right now”, what is running, progress updates, active runtime\u002Fprovider\u002Fmodel, or stuck-work checks.","https:\u002F\u002Fgithub.com\u002Fshenxingy\u002FClade\u002Fblob\u002Fmain\u002Fplugins\u002Fclade\u002Fskills\u002Fstatus\u002FSKILL.md",[209],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[205,102,211,212,169,200,213,214,134,215,103,216,217,180,218,171,219,220,105,221],"running","limits","usage","now","active","show","provider","snapshot","model","execution","identity"]