[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GXD2Z3TZGMAWEFSQJMK1AE":3,"skill-same:01M6GXD2Z3TZGMAWEFSQJMK1AE":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":47,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M6GXD2Z3TZGMAWEFSQJMK1AE","apply-object-lock-for-immutable-retention",null,"Use when ransomware or a rogue operator could delete backups. Applies WORM object-lock or legal hold so backups cannot be altered or deleted inside a retention window.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-apply-object-lock-for-immutable-retention\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-apply-object-lock-for-immutable-retention\u002FSKILL.md",[],[20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"immutable","retention","lock","object","apply object lock for immutable retention","for","apply","delete","operator","ransomware","object-lock","worm","use","legal","window","when","2026-11-10 10:12:30",false,"---\nname: apply-object-lock-for-immutable-retention\ndescription: Use when ransomware or a rogue operator could delete backups. Applies WORM object-lock or legal hold so backups cannot be altered or deleted inside a retention window.\n---\n\n# Apply Object Lock for Immutable Retention\n\nAn attacker with delete rights owns your backups. Write-once-read-many locking makes objects unchangeable for a fixed window, so the only copy that survives a compromise is one the compromised credentials cannot touch.\n\n## Procedure\n\n1. Decide the failure you are countering: ransomware, disgruntled admin, accidental bulk delete. All require immutability, not just versioning.\n2. Object Lock can only be enabled at bucket creation: `aws s3api create-bucket --bucket acme-vault --object-lock-enabled-for-bucket`.\n3. Set a default retention so every write is locked without per-object work:\n   `aws s3api put-object-lock-configuration --bucket acme-vault --object-lock-configuration '{\"ObjectLockEnabled\":\"Enabled\",\"Rule\":{\"DefaultRetention\":{\"Mode\":\"COMPLIANCE\",\"Days\":90}}}'`.\n4. Choose the mode deliberately. GOVERNANCE can be overridden with `s3:BypassGovernanceRetention`; COMPLIANCE cannot be shortened by anyone, including root — set the window carefully.\n5. For a record under litigation, apply a legal hold instead of or alongside retention; a hold has no expiry and survives until removed.\n6. Keep the write credential separate from the delete\u002Fread credential, in a different account or role with no retention-bypass permission.\n7. Verify a locked object: `aws s3api get-object-retention --bucket acme-vault --key backup.tar` returns the mode and `RetainUntilDate`.\n8. Attempt a delete as the backup role and confirm it is refused: `aws s3api delete-object ...` should return `AccessDenied`.\n\n## Pitfalls\n\n- Trying to enable Object Lock after the bucket exists — it cannot be added retroactively; plan the vault bucket upfront.\n- COMPLIANCE mode with a too-long window set by mistake; nobody, not even support, can shorten it, so bytes are billed for the full term.\n- Relying on GOVERNANCE mode without removing `BypassGovernanceRetention` from the backup role's policy; the lock is then advisory.\n- Assuming the lock protects the IAM and KMS paths; a credential that can delete the customer KMS key can still make the data unreadable.\n- Forgetting that a legal hold blocks deletion even after retention expires, stalling cleanup until someone removes it.\n- Locking the entire bucket including scratch areas you need to rotate, forcing a new bucket and a migration.\n- Not replicating the vault to a second account, so a compromised root on the vault account can still act within what the policy allows.\n\n## Verification\n\n    aws s3api get-object-lock-configuration --bucket acme-vault\n    aws s3api get-object-retention --bucket acme-vault --key backup.tar\n    # deletion as the backup role must fail\n    aws s3api delete-object --bucket acme-vault --key backup.tar   # expect AccessDenied\n\nObject Lock is Enabled with the intended mode and term, a sample object reports its `RetainUntilDate`, and deletion by the write role is refused.\n\nReport: \"Object Lock COMPLIANCE\u002F90d on \u003Cvault>; deletion by backup role returns AccessDenied; lock config id \u003Cid>.\"\n","# Apply Object Lock for Immutable Retention\n\nAn attacker with delete rights owns your backups. Write-once-read-many locking makes objects unchangeable for a fixed window, so the only copy that survives a compromise is one the compromised credentials cannot touch.\n\n## Procedure\n\n1. Decide the failure you are countering: ransomware, disgruntled admin, accidental bulk delete. All require immutability, not just versioning.\n2. Object Lock can only be enabled at bucket creation: `aws s3api create-bucket --bucket acme-vault --object-lock-enabled-for-bucket`.\n3. Set a default retention so every write is locked without per-object work:\n   `aws s3api put-object-lock-configuration --bucket acme-vault --object-lock-configuration '{\"ObjectLockEnabled\":\"Enabled\",\"Rule\":{\"DefaultRetention\":{\"Mode\":\"COMPLIANCE\",\"Days\":90}}}'`.\n4. Choose the mode deliberately. GOVERNANCE can be overridden with `s3:BypassGovernanceRetention`; COMPLIANCE cannot be shortened by anyone, including root — set the window carefully.\n5. For a record under litigation, apply a legal hold instead of or alongside retention; a hold has no expiry and survives until removed.\n6. Keep the write credential separate from the delete\u002Fread credential, in a different account or role with no retention-bypass permission.\n7. Verify a locked object: `aws s3api get-object-retention --bucket acme-vault --key backup.tar` returns the mode and `RetainUntilDate`.\n8. Attempt a delete as the backup role and confirm it is refused: `aws s3api delete-object ...` should return `AccessDenied`.\n\n## Pitfalls\n\n- Trying to enable Object Lock after the bucket exists — it cannot be added retroactively; plan the vault bucket upfront.\n- COMPLIANCE mode with a too-long window set by mistake; nobody, not even support, can shorten it, so bytes are billed for the full term.\n- Relying on GOVERNANCE mode without removing `BypassGovernanceRetention` from the backup role's policy; the lock is then advisory.\n- Assuming the lock protects the IAM and KMS paths; a credential that can delete the customer KMS key can still make the data unreadable.\n- Forgetting that a legal hold blocks deletion even after retention expires, stalling cleanup until someone removes it.\n- Locking the entire bucket including scratch areas you need to rotate, forcing a new bucket and a migration.\n- Not replicating the vault to a second account, so a compromised root on the vault account can still act within what the policy allows.\n\n## Verification\n\n    aws s3api get-object-lock-configuration --bucket acme-vault\n    aws s3api get-object-retention --bucket acme-vault --key backup.tar\n    # deletion as the backup role must fail\n    aws s3api delete-object --bucket acme-vault --key backup.tar   # expect AccessDenied\n\nObject Lock is Enabled with the intended mode and term, a sample object reports its `RetainUntilDate`, and deletion by the write role is refused.\n\nReport: \"Object Lock COMPLIANCE\u002F90d on \u003Cvault>; deletion by backup role returns AccessDenied; lock config id \u003Cid>.\"\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fpayments\u002F0xklen-apply-object-lock-for-immutable-retention",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-14 02:27:51",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill apply-object-lock-for-immutable-retention",{"tool":56,"command":57},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill apply-object-lock-for-immutable-retention",{"tool":59,"command":60},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill apply-object-lock-for-immutable-retention","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-apply-object-lock-for-immutable-retention\u002FSKILL.md",true,[64,68,74],{"path":65,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":16},"LICENSE","许可证",1063,{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"SOURCE.md","REFERENCE","参考文档",367,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-apply-object-lock-for-immutable-retention\u002FSOURCE.md",{"path":75,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":76,"sourceHtmlUrl":77},"TRUST.auto.yaml",2217,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-apply-object-lock-for-immutable-retention\u002FTRUST.auto.yaml",[79,107,129,147,160,170],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":83,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":36},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":112,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":36},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[116,117,118,119,120,121,122,123,124,125,25,126,127,128],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","api keys","maintenance","protobuf",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":133,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":36},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[137,117,138,139,140,141,142,126,25,125,143,144,145,121,146,120,119],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":151,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":36},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[155,156,118,157,158,127,25,159,124,123,121,120],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":161,"name":162,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":163,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":36},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[167,168,169],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":174,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":36},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[178,179,180,181,182,183,184,32,185,186,187],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]