[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6H46MQF7SBWHG5EEAX44V33":3,"skill-same:01M6H46MQF7SBWHG5EEAX44V33":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6H46MQF7SBWHG5EEAX44V33","dx-security",null,"Security audit — OWASP Top 10, secrets scan, dependency audit, input validation, auth review. Use before a PR or when code handles user input, auth or external integrations.","easingthemes\u002Fdx-aem-flow","easingthemes","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F2750284?v=4","01M6H3XYGJY8QCX9ES36P2WF4H","Dragan Filipović","01M6H3XYMN1XVSGKN7N79SW3RH",7,"MIT","https:\u002F\u002Fgithub.com\u002Feasingthemes\u002Fdx-aem-flow\u002Fblob\u002Fmain\u002Fplugins\u002Fdx-core\u002Fskills\u002Fdx-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"dx security","dx","security","edit","write","secrets","read","dependency","audit","dependency audit","owasp top 10","top","review","code","Input Validation","default","search","auth","security audit","scope","2026-11-10 10:12:30",false,"---\nname: dx-security\ndescription: \"Security audit — OWASP Top 10, secrets scan, dependency audit, input validation, auth review. Use before a PR or when code handles user input, auth or external integrations.\"\nargument-hint: \"[scope: 'changes' | 'full' (default: changes)]\"\nmodel: opus\neffort: high\nallowed-tools: [\"read\", \"edit\", \"search\", \"write\", \"agent\"]\n---\n\nYou perform a security audit of the codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, dependency vulnerabilities, and hardening gaps.\n\n## 1. Determine Scope\n\n- **`changes`** (default) — audit only files changed since base branch\n- **`full`** — audit the entire codebase\n\nGet the file list:\n\n```bash\n# changes mode\nBASE=$(git merge-base $(git symbolic-ref refs\u002Fremotes\u002Forigin\u002FHEAD --short 2>\u002Fdev\u002Fnull || echo origin\u002Fmain) HEAD)\ngit diff --name-only $BASE..HEAD\n\n# full mode\nfind . -type f \\( -name '*.js' -o -name '*.ts' -o -name '*.java' -o -name '*.py' -o -name '*.jsx' -o -name '*.tsx' -o -name '*.xml' -o -name '*.yaml' -o -name '*.yml' -o -name '*.json' \\) | grep -v node_modules | grep -v target\n```\n\nRead `..\u002F..\u002Fshared\u002Fsecurity-checklist.md` for the full checklist reference.\n\n## 2. Three-Tier Boundary System\n\n### ALWAYS DO (Non-negotiable)\n\nThese must be present in every project. Flag if missing:\n\n- [ ] All external input validated at system boundaries (API endpoints, form handlers)\n- [ ] Database queries parameterized — no string concatenation with user data\n- [ ] Output encoded to prevent XSS (framework auto-escaping enabled)\n- [ ] HTTPS for all external communication\n- [ ] Passwords hashed with bcrypt\u002Fscrypt\u002Fargon2 (not MD5\u002FSHA-1)\n- [ ] Security headers set: CSP, HSTS, X-Frame-Options, X-Content-Type-Options\n- [ ] Session cookies: httpOnly, secure, sameSite\n- [ ] Dependency audit clean (`npm audit` \u002F `mvn dependency-check`)\n\n### ASK FIRST (Flag for team review)\n\nThese require explicit team decision:\n\n- New authentication flows or authorization logic changes\n- Storage of additional sensitive data categories\n- New third-party service integrations\n- CORS configuration changes\n- File upload functionality additions\n- Rate limiting or throttling changes\n- Permission or role elevation logic\n\n### NEVER DO (Hard blocks)\n\nFlag these as **Critical** — merge-blocking:\n\n- Secrets committed to version control\n- Sensitive data in logs (passwords, tokens, card numbers, PII)\n- Client-side validation as the only security boundary\n- `eval()` or `innerHTML` with untrusted data\n- Auth tokens in localStorage (use httpOnly cookies)\n- Stack traces exposed to users in production\n- Security headers disabled \"for convenience\"\n\n## 3. OWASP Top 10 Checks\n\n### A01: Broken Access Control\n```\nGrep: @PreAuthorize|@Secured|authorize|isAuthenticated|hasRole — check auth exists on protected endpoints\n```\nFlag endpoints without authorization checks. \"Always check authorization, not just authentication.\"\n\n### A02: Cryptographic Failures\n```\nGrep: MD5|SHA1|sha1|md5|DES|RC4 — weak cryptography\nGrep: http:\u002F\u002F — unencrypted communication (should be https)\n```\n\n### A03: Injection\n```\nGrep: \\+ .*\\.(query|execute|sql|raw) — string concatenation in queries\nGrep: innerHTML|outerHTML|document\\.write|\\.html\\( — DOM injection\nGrep: eval\\(|Function\\(|setTimeout\\([\"'] — code injection\n```\n\n### A04: Insecure Design\nCheck for missing rate limiting on auth endpoints, missing CSRF tokens on state-changing operations.\n\n### A05: Security Misconfiguration\n```\nGrep: Access-Control-Allow-Origin.*\\* — overly permissive CORS\nGrep: debug.*=.*true|DEBUG.*=.*1 — debug mode in production config\n```\n\n### A06: Vulnerable Components\n```bash\nnpm audit --json 2>\u002Fdev\u002Fnull | head -100\nmvn dependency-check:check 2>\u002Fdev\u002Fnull | tail -50\n```\n\n### A07: Authentication Failures\n```\nGrep: password.*=.*[\"']|token.*=.*[\"']|secret.*=.*[\"'] — hardcoded credentials\nGrep: bcrypt|argon2|scrypt|pbkdf2 — verify proper password hashing exists\n```\n\n### A08: Software & Data Integrity\nCheck for unsigned\u002Funverified downloads, missing SRI attributes on CDN scripts.\n\n### A09: Logging Failures\n```\nGrep: console\\.log.*password|console\\.log.*token|log\\.(info|debug).*secret — sensitive data in logs\n```\nVerify security events ARE logged: failed logins, permission denials, input validation failures.\n\n### A10: SSRF\n```\nGrep: fetch\\(|axios\\(|http\\.get\\(|request\\( — check if user input flows into URLs\n```\n\n## 4. Secrets Scan\n\nGo beyond basic grep — check comprehensively:\n\n```bash\n# Check git history for secrets\ngit log --all --diff-filter=A -- '*.env' '*.pem' '*.key' '*credentials*' '*secret*' 2>\u002Fdev\u002Fnull | head -20\n\n# Check current files\ngrep -rn 'AKIA[0-9A-Z]\\{16\\}' . --include='*.{js,ts,java,py,yaml,json,xml}' 2>\u002Fdev\u002Fnull  # AWS keys\ngrep -rn 'password\\s*=\\s*[\"\\x27][^\"\\x27]\\{8,\\}' . --include='*.{js,ts,java,py,yaml,json,properties}' 2>\u002Fdev\u002Fnull  # Hardcoded passwords\ngrep -rn 'Bearer [a-zA-Z0-9._-]\\{20,\\}' . --include='*.{js,ts,java,py}' 2>\u002Fdev\u002Fnull  # Bearer tokens\n```\n\nVerify `.env` is in `.gitignore`. Verify `.env.example` has placeholder values only.\n\n## 5. Input Validation Check\n\nFor every endpoint or form handler in changed files:\n1. Is input validated at the boundary? (schema validation, type checking)\n2. Is file upload restricted by MIME type and size?\n3. Are SQL\u002FNoSQL queries parameterized?\n4. Is HTML output encoded?\n\n## 6. Report\n\n```markdown\n## Security Audit: \u003Cscope>\n\n**Files scanned:** \u003CN>\n**Issues found:** \u003CN critical> \u002F \u003CN important> \u002F \u003CN advisory>\n\n### Critical Issues (merge-blocking)\n\n| # | Category | File | Line | Issue | Fix |\n|---|----------|------|------|-------|-----|\n| 1 | A03 Injection | `file.js` | L42 | innerHTML with user input | Use textContent or sanitize with DOMPurify |\n\n### Important Issues (should fix before merge)\n\n| # | Category | File | Line | Issue | Fix |\n|---|----------|------|------|-------|-----|\n\n### Advisory (team should review)\n\n| # | Category | File | Line | Issue |\n|---|----------|------|------|-------|\n\n### Checks Passed\n- [ ] No secrets in source or git history\n- [ ] Dependencies clean (no critical\u002Fhigh vulnerabilities)\n- [ ] Input validated at all entry points\n- [ ] Output encoded (XSS prevention)\n- [ ] Auth + authz on protected endpoints\n- [ ] Security headers present\n- [ ] Error messages don't expose internals\n```\n\n## Anti-Rationalization\n\n| False Logic | Reality Check |\n|---|---|\n| \"It's an internal tool, security doesn't matter\" | Internal systems are primary attack targets — they have the most access and least scrutiny. |\n| \"We'll add security later\" | Retrofitting security costs 10x more than building it in. And \"later\" means \"after the breach.\" |\n| \"Nobody would think to try that\" | Automated scanners try everything. Your obscure endpoint is in somebody's wordlist. |\n| \"The framework handles security\" | Frameworks provide tools, not guarantees. One `dangerouslySetInnerHTML` undoes all of React's XSS protection. |\n| \"It's just a prototype\" | Prototypes become production. Security debt in prototypes becomes production vulnerabilities. |\n| \"We have a WAF, it'll catch it\" | Defense in depth. The WAF catches known patterns; your custom logic creates unknown ones. |\n\n## Success Criteria\n\n- [ ] All critical issues resolved or explicitly accepted with justification\n- [ ] No secrets in source or git history\n- [ ] Dependency audit shows no critical\u002Fhigh vulnerabilities\n- [ ] User input validated at all entry points in changed files\n- [ ] Every protected endpoint enforces auth + authz\n- [ ] Security headers present in responses\n- [ ] Error messages omit internal details\n\n## Examples\n\n### Audit changed files only\n```\n\u002Fdx-security\n```\nScans files changed since base branch for OWASP Top 10 issues, secrets, and dependency vulnerabilities.\n\n### Full codebase audit\n```\n\u002Fdx-security full\n```\nComprehensive scan of all source files.\n\n## Troubleshooting\n\n### \"npm audit shows 50+ vulnerabilities\"\n**Cause:** Transitive dependencies with known CVEs.\n**Fix:** Run `npm audit fix`. For unfixable ones, check if they're dev-only dependencies (lower risk). Document accepted risks.\n\n### False positive on test fixture\n**Cause:** Test files contain dummy passwords\u002Ftokens for testing.\n**Fix:** Verify the flagged content is not a real secret. If it's a test fixture, add a comment explaining it's intentional.\n\n## Rules\n\n- **Boundary validation** — validate at system boundaries, trust internal code\n- **Defense in depth** — never rely on a single layer of security\n- **Secrets never in code** — environment variables or secret managers only\n- **Parameterize everything** — never concatenate user input into queries or commands\n- **Encode output** — prevent XSS at the rendering layer\n- **Minimal permissions** — request the least privilege needed\n- **Log security events** — failed auth, permission denials, validation failures\n- **Don't suppress** — fix the vulnerability, don't add `@SuppressWarnings` or `\u002F\u002F nosec`\n","You perform a security audit of the codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, dependency vulnerabilities, and hardening gaps.\n\n## 1. Determine Scope\n\n- **`changes`** (default) — audit only files changed since base branch\n- **`full`** — audit the entire codebase\n\nGet the file list:\n\n```bash\n# changes mode\nBASE=$(git merge-base $(git symbolic-ref refs\u002Fremotes\u002Forigin\u002FHEAD --short 2>\u002Fdev\u002Fnull || echo origin\u002Fmain) HEAD)\ngit diff --name-only $BASE..HEAD\n\n# full mode\nfind . -type f \\( -name '*.js' -o -name '*.ts' -o -name '*.java' -o -name '*.py' -o -name '*.jsx' -o -name '*.tsx' -o -name '*.xml' -o -name '*.yaml' -o -name '*.yml' -o -name '*.json' \\) | grep -v node_modules | grep -v target\n```\n\nRead `..\u002F..\u002Fshared\u002Fsecurity-checklist.md` for the full checklist reference.\n\n## 2. Three-Tier Boundary System\n\n### ALWAYS DO (Non-negotiable)\n\nThese must be present in every project. Flag if missing:\n\n- [ ] All external input validated at system boundaries (API endpoints, form handlers)\n- [ ] Database queries parameterized — no string concatenation with user data\n- [ ] Output encoded to prevent XSS (framework auto-escaping enabled)\n- [ ] HTTPS for all external communication\n- [ ] Passwords hashed with bcrypt\u002Fscrypt\u002Fargon2 (not MD5\u002FSHA-1)\n- [ ] Security headers set: CSP, HSTS, X-Frame-Options, X-Content-Type-Options\n- [ ] Session cookies: httpOnly, secure, sameSite\n- [ ] Dependency audit clean (`npm audit` \u002F `mvn dependency-check`)\n\n### ASK FIRST (Flag for team review)\n\nThese require explicit team decision:\n\n- New authentication flows or authorization logic changes\n- Storage of additional sensitive data categories\n- New third-party service integrations\n- CORS configuration changes\n- File upload functionality additions\n- Rate limiting or throttling changes\n- Permission or role elevation logic\n\n### NEVER DO (Hard blocks)\n\nFlag these as **Critical** — merge-blocking:\n\n- Secrets committed to version control\n- Sensitive data in logs (passwords, tokens, card numbers, PII)\n- Client-side validation as the only security boundary\n- `eval()` or `innerHTML` with untrusted data\n- Auth tokens in localStorage (use httpOnly cookies)\n- Stack traces exposed to users in production\n- Security headers disabled \"for convenience\"\n\n## 3. OWASP Top 10 Checks\n\n### A01: Broken Access Control\n```\nGrep: @PreAuthorize|@Secured|authorize|isAuthenticated|hasRole — check auth exists on protected endpoints\n```\nFlag endpoints without authorization checks. \"Always check authorization, not just authentication.\"\n\n### A02: Cryptographic Failures\n```\nGrep: MD5|SHA1|sha1|md5|DES|RC4 — weak cryptography\nGrep: http:\u002F\u002F — unencrypted communication (should be https)\n```\n\n### A03: Injection\n```\nGrep: \\+ .*\\.(query|execute|sql|raw) — string concatenation in queries\nGrep: innerHTML|outerHTML|document\\.write|\\.html\\( — DOM injection\nGrep: eval\\(|Function\\(|setTimeout\\([\"'] — code injection\n```\n\n### A04: Insecure Design\nCheck for missing rate limiting on auth endpoints, missing CSRF tokens on state-changing operations.\n\n### A05: Security Misconfiguration\n```\nGrep: Access-Control-Allow-Origin.*\\* — overly permissive CORS\nGrep: debug.*=.*true|DEBUG.*=.*1 — debug mode in production config\n```\n\n### A06: Vulnerable Components\n```bash\nnpm audit --json 2>\u002Fdev\u002Fnull | head -100\nmvn dependency-check:check 2>\u002Fdev\u002Fnull | tail -50\n```\n\n### A07: Authentication Failures\n```\nGrep: password.*=.*[\"']|token.*=.*[\"']|secret.*=.*[\"'] — hardcoded credentials\nGrep: bcrypt|argon2|scrypt|pbkdf2 — verify proper password hashing exists\n```\n\n### A08: Software & Data Integrity\nCheck for unsigned\u002Funverified downloads, missing SRI attributes on CDN scripts.\n\n### A09: Logging Failures\n```\nGrep: console\\.log.*password|console\\.log.*token|log\\.(info|debug).*secret — sensitive data in logs\n```\nVerify security events ARE logged: failed logins, permission denials, input validation failures.\n\n### A10: SSRF\n```\nGrep: fetch\\(|axios\\(|http\\.get\\(|request\\( — check if user input flows into URLs\n```\n\n## 4. Secrets Scan\n\nGo beyond basic grep — check comprehensively:\n\n```bash\n# Check git history for secrets\ngit log --all --diff-filter=A -- '*.env' '*.pem' '*.key' '*credentials*' '*secret*' 2>\u002Fdev\u002Fnull | head -20\n\n# Check current files\ngrep -rn 'AKIA[0-9A-Z]\\{16\\}' . --include='*.{js,ts,java,py,yaml,json,xml}' 2>\u002Fdev\u002Fnull  # AWS keys\ngrep -rn 'password\\s*=\\s*[\"\\x27][^\"\\x27]\\{8,\\}' . --include='*.{js,ts,java,py,yaml,json,properties}' 2>\u002Fdev\u002Fnull  # Hardcoded passwords\ngrep -rn 'Bearer [a-zA-Z0-9._-]\\{20,\\}' . --include='*.{js,ts,java,py}' 2>\u002Fdev\u002Fnull  # Bearer tokens\n```\n\nVerify `.env` is in `.gitignore`. Verify `.env.example` has placeholder values only.\n\n## 5. Input Validation Check\n\nFor every endpoint or form handler in changed files:\n1. Is input validated at the boundary? (schema validation, type checking)\n2. Is file upload restricted by MIME type and size?\n3. Are SQL\u002FNoSQL queries parameterized?\n4. Is HTML output encoded?\n\n## 6. Report\n\n```markdown\n## Security Audit: \u003Cscope>\n\n**Files scanned:** \u003CN>\n**Issues found:** \u003CN critical> \u002F \u003CN important> \u002F \u003CN advisory>\n\n### Critical Issues (merge-blocking)\n\n| # | Category | File | Line | Issue | Fix |\n|---|----------|------|------|-------|-----|\n| 1 | A03 Injection | `file.js` | L42 | innerHTML with user input | Use textContent or sanitize with DOMPurify |\n\n### Important Issues (should fix before merge)\n\n| # | Category | File | Line | Issue | Fix |\n|---|----------|------|------|-------|-----|\n\n### Advisory (team should review)\n\n| # | Category | File | Line | Issue |\n|---|----------|------|------|-------|\n\n### Checks Passed\n- [ ] No secrets in source or git history\n- [ ] Dependencies clean (no critical\u002Fhigh vulnerabilities)\n- [ ] Input validated at all entry points\n- [ ] Output encoded (XSS prevention)\n- [ ] Auth + authz on protected endpoints\n- [ ] Security headers present\n- [ ] Error messages don't expose internals\n```\n\n## Anti-Rationalization\n\n| False Logic | Reality Check |\n|---|---|\n| \"It's an internal tool, security doesn't matter\" | Internal systems are primary attack targets — they have the most access and least scrutiny. |\n| \"We'll add security later\" | Retrofitting security costs 10x more than building it in. And \"later\" means \"after the breach.\" |\n| \"Nobody would think to try that\" | Automated scanners try everything. Your obscure endpoint is in somebody's wordlist. |\n| \"The framework handles security\" | Frameworks provide tools, not guarantees. One `dangerouslySetInnerHTML` undoes all of React's XSS protection. |\n| \"It's just a prototype\" | Prototypes become production. Security debt in prototypes becomes production vulnerabilities. |\n| \"We have a WAF, it'll catch it\" | Defense in depth. The WAF catches known patterns; your custom logic creates unknown ones. |\n\n## Success Criteria\n\n- [ ] All critical issues resolved or explicitly accepted with justification\n- [ ] No secrets in source or git history\n- [ ] Dependency audit shows no critical\u002Fhigh vulnerabilities\n- [ ] User input validated at all entry points in changed files\n- [ ] Every protected endpoint enforces auth + authz\n- [ ] Security headers present in responses\n- [ ] Error messages omit internal details\n\n## Examples\n\n### Audit changed files only\n```\n\u002Fdx-security\n```\nScans files changed since base branch for OWASP Top 10 issues, secrets, and dependency vulnerabilities.\n\n### Full codebase audit\n```\n\u002Fdx-security full\n```\nComprehensive scan of all source files.\n\n## Troubleshooting\n\n### \"npm audit shows 50+ vulnerabilities\"\n**Cause:** Transitive dependencies with known CVEs.\n**Fix:** Run `npm audit fix`. For unfixable ones, check if they're dev-only dependencies (lower risk). Document accepted risks.\n\n### False positive on test fixture\n**Cause:** Test files contain dummy passwords\u002Ftokens for testing.\n**Fix:** Verify the flagged content is not a real secret. If it's a test fixture, add a comment explaining it's intentional.\n\n## Rules\n\n- **Boundary validation** — validate at system boundaries, trust internal code\n- **Defense in depth** — never rely on a single layer of security\n- **Secrets never in code** — environment variables or secret managers only\n- **Parameterize everything** — never concatenate user input into queries or commands\n- **Encode output** — prevent XSS at the rendering layer\n- **Minimal permissions** — request the least privilege needed\n- **Log security events** — failed auth, permission denials, validation failures\n- **Don't suppress** — fix the vulnerability, don't add `@SuppressWarnings` or `\u002F\u002F nosec`\n",{"name":5,"model":44,"effort":45,"description":7,"allowed-tools":46,"argument-hint":48},"opus","high",[25,22,35,23,47],"agent","[scope: 'changes' | 'full' (default: changes)]","main","5c642842a92100dc7561ae0682a152a74846e186","plugins\u002Fdx-core\u002Fskills\u002Fdx-security",3,"https:\u002F\u002Fgithub.com\u002Feasingthemes\u002Fdx-aem-flow","https:\u002F\u002Fgithub.com\u002Feasingthemes","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fdraganfilipovic\u002F","Agentic SDLC platform in production. I build agent-ready codebases. AEM MCP Server author.","2026-11-11 09:59:48",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add easingthemes\u002Fdx-aem-flow --skill dx-security",{"tool":64,"command":65},"bunx","bunx skills add easingthemes\u002Fdx-aem-flow --skill dx-security",{"tool":67,"command":68},"pnpm","pnpm dlx skills add easingthemes\u002Fdx-aem-flow --skill dx-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Feasingthemes\u002Fdx-aem-flow\u002Fblob\u002Fmain\u002Fplugins\u002Fdx-core\u002Fskills\u002Fdx-security\u002FSKILL.md",true,[],[73,96,116,139,155,170],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":39},"01M6H48W19F46A7B7TSSQAMYRW","dx-hub-status","Show hub dispatch status — which repos are running, done, blocked or failed. Use for 'hub status', 'what's running'.","https:\u002F\u002Fgithub.com\u002Feasingthemes\u002Fdx-aem-flow\u002Fblob\u002Fmain\u002Fplugins\u002Fdx-hub\u002Fskills\u002Fdx-hub-status\u002FSKILL.md",[],[20,80,81,82,83,84,85,86,87,88,89,90,91,92,93,25,23,94,95],"dx hub status","hub","status","hub status","which","show","for","ticket","clean","use","done","Bash","id","dispatch","repos","grep",{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":39},"01M6H48R6ZH7YMVPMVWMMWT3RA","dx-hub-init","Initialize a hub directory for multi-repo orchestration. Discovers sibling repos, merges configs, validates CLI compatibility. Use when setting up hub mode for the first time. Trigger on \"init hub\", \"set up hub\", \"multi-repo setup\".","https:\u002F\u002Fgithub.com\u002Feasingthemes\u002Fdx-aem-flow\u002Fblob\u002Fmain\u002Fplugins\u002Fdx-hub\u002Fskills\u002Fdx-hub-init\u002FSKILL.md",[],[103,104,20,105,81,106,107,108,34,109,110,111,112,113,91,114,115,25,23,22],"init","hub init","dx hub init","SET","time","mode","up","repo setup","orchestration","configure","multi-repo","cli","directory",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":127,"publishedAt":39},"01M6H48K267CWEF8YNN3Y49BVT","dx-hub-dispatch","Dispatch a ticket to several repos — open an independent Claude session per repo in VS Code terminals. Use for 'hub dispatch', 'work on ticket across repos'.","https:\u002F\u002Fgithub.com\u002Feasingthemes\u002Fdx-aem-flow\u002Fblob\u002Fmain\u002Fplugins\u002Fdx-hub\u002Fskills\u002Fdx-hub-dispatch\u002FSKILL.md",[122],{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[20,128,93,81,129,86,130,131,132,87,133,134,89,135,91,136,32,137,92,138],"dx hub dispatch","ado","repo","work on","session","open","MCP","URL","vscode","across","work",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":39},"01M6H48FAWKTT6AAWT3H80ZKE0","dx-hub-config","View and edit hub configuration — add repos, adjust terminal delay. Use to manage hub settings. Trigger on \"hub config\", \"add repo to hub\", \"terminal delay\".","https:\u002F\u002Fgithub.com\u002Feasingthemes\u002Fdx-aem-flow\u002Fblob\u002Fmain\u002Fplugins\u002Fdx-hub\u002Fskills\u002Fdx-hub-config\u002FSKILL.md",[],[20,146,81,147,85,148,130,149,150,151,152,89,112,91,153,25,154,23,22,94],"dx hub config","config","view","manage","trigger","true","adjust","terminal","settings",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":39},"01M6H48BNMYEJY6CCWPYHNQDAT","dx-discover-repos","Resolve which repos a work item touches (explicit directive → simple block → cross-repo table → LLM). Used by the KAI-HUB router to fan an agent out across repos; 'which repos'.","https:\u002F\u002Fgithub.com\u002Feasingthemes\u002Fdx-aem-flow\u002Fblob\u002Fmain\u002Fplugins\u002Fdx-hub\u002Fskills\u002Fdx-discover-repos\u002FSKILL.md",[],[162,20,163,94,84,130,137,164,92,165,138,166,81,167,168,169],"discover","dx discover repos","router","directive","simple","block","sonnet","table",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":177,"publishedAt":39},"01M6H487QA1FDSBT1HTZGW4HAQ","dx-upgrade","Upgrade a consumer project to the installed plugin versions — run dx-doctor, fix stale and missing files, list manual actions. Use after upgrading plugins.","https:\u002F\u002Fgithub.com\u002Feasingthemes\u002Fdx-aem-flow\u002Fblob\u002Fmain\u002Fplugins\u002Fdx-core\u002Fskills\u002Fdx-upgrade\u002FSKILL.md",[176],{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},[178,20,179,180,181,35,182,183,184,185,25,23,22,186,187,188,189,89,190,191],"upgrade","dx upgrade","project","actions","fix","files","auto","run","list","doctor","manual","missing","plugin","plugins"]