[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GPFHTMH36A9TD17V3C8T8N":3,"skill-same:01M6GPFHTMH36A9TD17V3C8T8N":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":24,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6GPFHTMH36A9TD17V3C8T8N","data-exposure",null,"Finds sensitive data exposure risks — PII\u002Fsecrets written to logs, over-returning API responses, data at rest without encryption, sensitive data in URLs, test fixtures with real data, secrets in git history, and temporary\u002Fbackup file leaks. Use when auditing how a project handles, stores, logs, or transmits sensitive data.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-data-exposure\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-data-exposure\u002FSKILL.md",[19],{"categoryNo":20,"categoryName":21,"taxonomyType":22,"taxonomyTypeDesc":23},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"data exposure","data","secrets","when","at","with","fixtures","project","use","history","how","test","api","backup","pii","REST","encryption","logs","file","git","2026-11-10 10:12:30",false,"---\nname: data-exposure\ndescription: Finds sensitive data exposure risks — PII\u002Fsecrets written to logs, over-returning API responses, data at rest without encryption, sensitive data in URLs, test fixtures with real data, secrets in git history, and temporary\u002Fbackup file leaks. Use when auditing how a project handles, stores, logs, or transmits sensitive data.\nlicense: MIT\n---\n\n# Data Exposure Review\n\n## 1 — Map sensitive data\n\nFrom recon, identify what the project considers sensitive: PII (names, emails, phones, addresses), auth data (tokens, passwords, SSNs, card numbers), health\u002Ffinancial records, internal identifiers. Check models\u002Fschemas\u002FDTOs for field names to build this list before grepping flows.\n\n## 2 — Logs\n\n```bash\nrg -n \"console\\.(log|error|info)|logger\\.(info|warn|error)|logging\\.|print\\(\" | rg -i \"password|token|secret|ssn|card|authorization|api.?key|session\"\n```\n- Tokens\u002Fpasswords\u002Ffull PII logged → HIGH (logs ship to aggregators with broader access and longer retention than the DB)\n- Full request\u002Fresponse bodies logged (debug middleware like morgan `dev`+body, axios interceptors logging config) → HIGH if auth flows pass through\n- Stack traces with SQL → MEDIUM\n- Recommend structured logging with field-level redaction\u002Fallowlists.\n- Deep A09 checks (audit-event coverage, log forging, verbosity, monitoring): `references\u002Flogging-a09.md`.\n\n## 3 — API responses\n\n```bash\nrg -n \"res\\.(json|send)\\(|JSONResponse|serializer|to_json|to_dict|as_dict|@JsonProperty\"\n```\n- Endpoints returning full ORM objects (`res.json(user)` instead of a DTO) → HIGH when the model has password hashes, tokens, reset codes, or PII beyond need — even if \"unused today\"\n- `to_json`\u002F`__dict__` serialization on models with sensitive fields → same\n- Over-returning list endpoints (100+ records\u002Fpage without pagination) → LOW\n- IDs that are sequential integers for sensitive objects → LOW\u002FMEDIUM (enumeration, see `..\u002Fauth-review\u002FSKILL.md`)\n\n## 4 — Data at rest & in transit\n\n- DB files \u002F SQLite in repo or mounted volumes without encryption → MEDIUM (judged by data class)\n- Backups\u002Fexports (`dump.sql`, `*.csv` exports) committed → HIGH if real data, LOW if synthetic\n- Sensitive data in URLs (GET query params: `?token=`, `?email=`, `?ssn=`) → HIGH (URLs hit logs, proxies, browser history, referrers)\n- Internal service calls over plain HTTP inside the cluster → MEDIUM\n- Sensitive data sent to third parties (analytics\u002Ferror trackers capture request bodies: Sentry `send_default_pii`, loggers to SaaS) → MEDIUM\u002FHIGH\n\n## 5 — Files, history, fixtures\n\n```bash\ngit ls-files | rg -i '\\.(sql|csv|xlsx?|dump|bak|sqlite3?|db)$'\nrg -n -i \"lorem|john.?doe|test@test|555-|4111 ?1111 ?1111 ?1111|0000-0000\" tests\u002F fixtures\u002F 2>\u002Fdev\u002Fnull | head -20\n```\n- Real-looking PII in fixtures\u002Ftests (real emails, real card numbers beyond obvious test patterns) → MEDIUM\n- Git history secrets — already covered by `..\u002Fsecrets-detection\u002FSKILL.md`; here verify large data files aren't in history: `git rev-list --objects --all | head` + look for big blobs\n- Temp files written to shared\u002Fworld-readable locations, `\u002Ftmp` with predictable names → MEDIUM\n- `TODO`\u002F`FIXME` near data handling mentioning \"encrypt\"\u002F\"hash later\" → report as confirmation of known debt\n\n## 6 — Compliance overlays (optional, if project context implies)\n\nIf the stack\u002Fdomain implies a regime, add a short mapping section: GDPR (lawful basis hints, right-to-erasure reachability of PII), HIPAA (PHI at rest\u002Fin transit), PCI-DSS (card data scope). Keep it a checklist of \"likely gaps\" — not legal advice — and recommend expert review.\n\n## Reporting\n\nPer finding: data class involved, where it's exposed (`file:line`), exposure path (logs\u002Fresponse\u002Fhistory), severity by data class, and the fix (redact, DTO-allowlist, encrypt, purge). Include a one-paragraph \"sensitive data inventory\" summary — teams usually don't have one and it's instantly useful.\n","# Data Exposure Review\n\n## 1 — Map sensitive data\n\nFrom recon, identify what the project considers sensitive: PII (names, emails, phones, addresses), auth data (tokens, passwords, SSNs, card numbers), health\u002Ffinancial records, internal identifiers. Check models\u002Fschemas\u002FDTOs for field names to build this list before grepping flows.\n\n## 2 — Logs\n\n```bash\nrg -n \"console\\.(log|error|info)|logger\\.(info|warn|error)|logging\\.|print\\(\" | rg -i \"password|token|secret|ssn|card|authorization|api.?key|session\"\n```\n- Tokens\u002Fpasswords\u002Ffull PII logged → HIGH (logs ship to aggregators with broader access and longer retention than the DB)\n- Full request\u002Fresponse bodies logged (debug middleware like morgan `dev`+body, axios interceptors logging config) → HIGH if auth flows pass through\n- Stack traces with SQL → MEDIUM\n- Recommend structured logging with field-level redaction\u002Fallowlists.\n- Deep A09 checks (audit-event coverage, log forging, verbosity, monitoring): `references\u002Flogging-a09.md`.\n\n## 3 — API responses\n\n```bash\nrg -n \"res\\.(json|send)\\(|JSONResponse|serializer|to_json|to_dict|as_dict|@JsonProperty\"\n```\n- Endpoints returning full ORM objects (`res.json(user)` instead of a DTO) → HIGH when the model has password hashes, tokens, reset codes, or PII beyond need — even if \"unused today\"\n- `to_json`\u002F`__dict__` serialization on models with sensitive fields → same\n- Over-returning list endpoints (100+ records\u002Fpage without pagination) → LOW\n- IDs that are sequential integers for sensitive objects → LOW\u002FMEDIUM (enumeration, see `..\u002Fauth-review\u002FSKILL.md`)\n\n## 4 — Data at rest & in transit\n\n- DB files \u002F SQLite in repo or mounted volumes without encryption → MEDIUM (judged by data class)\n- Backups\u002Fexports (`dump.sql`, `*.csv` exports) committed → HIGH if real data, LOW if synthetic\n- Sensitive data in URLs (GET query params: `?token=`, `?email=`, `?ssn=`) → HIGH (URLs hit logs, proxies, browser history, referrers)\n- Internal service calls over plain HTTP inside the cluster → MEDIUM\n- Sensitive data sent to third parties (analytics\u002Ferror trackers capture request bodies: Sentry `send_default_pii`, loggers to SaaS) → MEDIUM\u002FHIGH\n\n## 5 — Files, history, fixtures\n\n```bash\ngit ls-files | rg -i '\\.(sql|csv|xlsx?|dump|bak|sqlite3?|db)$'\nrg -n -i \"lorem|john.?doe|test@test|555-|4111 ?1111 ?1111 ?1111|0000-0000\" tests\u002F fixtures\u002F 2>\u002Fdev\u002Fnull | head -20\n```\n- Real-looking PII in fixtures\u002Ftests (real emails, real card numbers beyond obvious test patterns) → MEDIUM\n- Git history secrets — already covered by `..\u002Fsecrets-detection\u002FSKILL.md`; here verify large data files aren't in history: `git rev-list --objects --all | head` + look for big blobs\n- Temp files written to shared\u002Fworld-readable locations, `\u002Ftmp` with predictable names → MEDIUM\n- `TODO`\u002F`FIXME` near data handling mentioning \"encrypt\"\u002F\"hash later\" → report as confirmation of known debt\n\n## 6 — Compliance overlays (optional, if project context implies)\n\nIf the stack\u002Fdomain implies a regime, add a short mapping section: GDPR (lawful basis hints, right-to-erasure reachability of PII), HIPAA (PHI at rest\u002Fin transit), PCI-DSS (card data scope). Keep it a checklist of \"likely gaps\" — not legal advice — and recommend expert review.\n\n## Reporting\n\nPer finding: data class involved, where it's exposed (`file:line`), exposure path (logs\u002Fresponse\u002Fhistory), severity by data class, and the fix (redact, DTO-allowlist, encrypt, purge). Include a one-paragraph \"sensitive data inventory\" summary — teams usually don't have one and it's instantly useful.\n",{"name":5,"license":15,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fchains\u002Fashrafiucse-data-exposure",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-14 02:27:51",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill data-exposure",{"tool":65,"command":66},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill data-exposure",{"tool":68,"command":69},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill data-exposure","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-data-exposure\u002FSKILL.md",true,[73,77,83,87],{"path":74,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":16},"LICENSE","许可证",1067,{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Flogging-a09.md","REFERENCE","参考文档",3416,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-data-exposure\u002Freferences\u002Flogging-a09.md",{"path":84,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":85,"sourceHtmlUrl":86},"SOURCE.md",370,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-data-exposure\u002FSOURCE.md",{"path":88,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":89,"sourceHtmlUrl":90},"TRUST.auto.yaml",2197,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-data-exposure\u002FTRUST.auto.yaml",[92,120,142,158,171,181],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":96,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":45},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":124,"licenseFileUrl":125,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":45},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[129,130,131,37,132,133,134,135,136,137,138,139,140,141],"mexc spot websocket","spot","websocket","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":124,"licenseFileUrl":146,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":45},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[150,130,40,151,152,153,154,139,138,137,155,156,26,133,157,132,37],"mexc spot rest","admin","signing","Wallet","requests","actions","secure","orders",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":124,"licenseFileUrl":162,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":45},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[166,167,131,168,169,140,138,170,136,135,133,132],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":172,"name":173,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":174,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":45},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[178,179,180],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":185,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":45},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[189,190,191,192,193,194,195,33,196,197,198],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]