[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GYD7G3ADBE9DHGSDPPQVRQ":3,"skill-same:01M6GYD7G3ADBE9DHGSDPPQVRQ":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":39,"commitSha":40,"skillDirectory":41,"forksCount":42,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":45,"ownerDescription":46,"updatedAt":47,"install":48,"resources":61},"01M6GYD7G3ADBE9DHGSDPPQVRQ","detect-tool-result-tampering",null,"Use when tool output, downloaded data, or an API response must be proven unmodified before use. Verify a digest or signature against a trusted source, not against the same channel that delivered it.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-detect-tool-result-tampering\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-detect-tool-result-tampering\u002FSKILL.md",[],[20,21,22,23,24,25,26,27,28,29,30,31,32,33],"tool","detect","detect tool result tampering","result","data","api","verify","channel","use","digest","it","output","source","when","2026-11-10 10:12:30",false,"---\nname: detect-tool-result-tampering\ndescription: Use when tool output, downloaded data, or an API response must be proven unmodified before use. Verify a digest or signature against a trusted source, not against the same channel that delivered it.\n---\n\n# Detect tool result tampering\n\nIf an attacker can edit the bytes between a service and your agent, they can rewrite a \"safe\" result into a destructive command or a redirect. This skill binds each result to a value you obtained out of band, so tampering is detectable.\n\n## Procedure\n\n1. Identify what the result should be bound to: a GPG or sigstore signature, a published checksum, a TLS pin, or a content hash you fetched from a second channel.\n\n2. Verify against an independent source. A checksum served by the same host proves only that the host is self-consistent:\n\n       curl -sO https:\u002F\u002Fmirror-a.example\u002Fpack.tar.gz\n       shasum -a 256 pack.tar.gz   # compare to the value in release notes on a different origin\n\n3. For signed artefacts, verify the signature before unpacking: `gpg --verify pack.tar.gz.sig pack.tar.gz` or `cosign verify-blob --signature s.sig --certificate c.pem blob`.\n\n4. For API JSON, check integrity markers if offered (HMAC header, ETag, content hash) and re-derive them locally:\n\n       printf '%s' \"$BODY\" | openssl dgst -sha256 -hmac \"$KEY\"   # compare with X-Signature header\n\n5. Pin TLS where the channel matters: record the leaf certificate SPKI at first contact and alert on change.\n\n       openssl s_client -connect host:443 -showcerts \u003C\u002Fdev\u002Fnull | openssl x509 -pubkey -noout | shasum -a 256\n\n6. Compare the payload against schema and expected range; a signature-less numeric field that suddenly doubles is a tamper smell even without a broken hash.\n\n7. On mismatch, discard the result entirely and re-fetch through a channel you trust; never \"use the good parts\".\n\n## Pitfalls\n\n- A hash fetched over the same TLS session as the file is not independent verification.\n- Mutable tags (`latest`) plus no digest let a compromised upstream swap content silently.\n- Checking only size or mtime catches nothing; attackers preserve both.\n- Trusting a verification step that pulls its public key from the attacker's server fails.\n\n## Verification\n\n    shasum -a 256 -c expected.sha256   # must print OK; any FAIL is tampering until proven otherwise\n\nReport: \"result \u003Cpath> bound to \u003Csource>; signature\u002Fhash verified yes|no; TLS SPKI unchanged; verdict accepted|rejected.\"\n","# Detect tool result tampering\n\nIf an attacker can edit the bytes between a service and your agent, they can rewrite a \"safe\" result into a destructive command or a redirect. This skill binds each result to a value you obtained out of band, so tampering is detectable.\n\n## Procedure\n\n1. Identify what the result should be bound to: a GPG or sigstore signature, a published checksum, a TLS pin, or a content hash you fetched from a second channel.\n\n2. Verify against an independent source. A checksum served by the same host proves only that the host is self-consistent:\n\n       curl -sO https:\u002F\u002Fmirror-a.example\u002Fpack.tar.gz\n       shasum -a 256 pack.tar.gz   # compare to the value in release notes on a different origin\n\n3. For signed artefacts, verify the signature before unpacking: `gpg --verify pack.tar.gz.sig pack.tar.gz` or `cosign verify-blob --signature s.sig --certificate c.pem blob`.\n\n4. For API JSON, check integrity markers if offered (HMAC header, ETag, content hash) and re-derive them locally:\n\n       printf '%s' \"$BODY\" | openssl dgst -sha256 -hmac \"$KEY\"   # compare with X-Signature header\n\n5. Pin TLS where the channel matters: record the leaf certificate SPKI at first contact and alert on change.\n\n       openssl s_client -connect host:443 -showcerts \u003C\u002Fdev\u002Fnull | openssl x509 -pubkey -noout | shasum -a 256\n\n6. Compare the payload against schema and expected range; a signature-less numeric field that suddenly doubles is a tamper smell even without a broken hash.\n\n7. On mismatch, discard the result entirely and re-fetch through a channel you trust; never \"use the good parts\".\n\n## Pitfalls\n\n- A hash fetched over the same TLS session as the file is not independent verification.\n- Mutable tags (`latest`) plus no digest let a compromised upstream swap content silently.\n- Checking only size or mtime catches nothing; attackers preserve both.\n- Trusting a verification step that pulls its public key from the attacker's server fails.\n\n## Verification\n\n    shasum -a 256 -c expected.sha256   # must print OK; any FAIL is tampering until proven otherwise\n\nReport: \"result \u003Cpath> bound to \u003Csource>; signature\u002Fhash verified yes|no; TLS SPKI unchanged; verdict accepted|rejected.\"\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fpayments\u002F0xklen-detect-tool-result-tampering",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-12 02:28:42",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill detect-tool-result-tampering",{"tool":54,"command":55},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill detect-tool-result-tampering",{"tool":57,"command":58},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill detect-tool-result-tampering","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-detect-tool-result-tampering\u002FSKILL.md",true,[62,66,72],{"path":63,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":65,"sourceHtmlUrl":16},"LICENSE","许可证",1063,{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"SOURCE.md","REFERENCE","参考文档",354,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-detect-tool-result-tampering\u002FSOURCE.md",{"path":73,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":75},"TRUST.auto.yaml",2217,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-detect-tool-result-tampering\u002FTRUST.auto.yaml",[77,105,127,144,157,167],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":81,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":34},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":110,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":34},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[114,115,116,25,117,118,119,120,121,122,123,124,125,126],"mexc spot websocket","spot","websocket","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":131,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":34},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[135,115,136,137,138,139,140,124,123,122,141,142,24,118,143,117,25],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","orders",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":148,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":34},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[152,153,116,154,155,125,123,156,121,120,118,117],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":158,"name":159,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":160,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":34},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[164,165,166],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":171,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":34},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[175,176,177,26,178,179,180,28,181,182,183],"tests","cover","verify tests cover changed lines","coverage","pr","exercise","patch","code","share"]