[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6H9HWHJ2D701PTFDPBYG5YR":3,"skill-same:01M6H9HWHJ2D701PTFDPBYG5YR":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":53,"install":54,"resources":67},"01M6H9HWHJ2D701PTFDPBYG5YR","validating-cors-policies",null,"Validate CORS policies for security issues and misconfigurations. Use when reviewing cross-origin resource sharing. Trigger with 'validate CORS', 'check CORS policy', or 'review cross-origin'.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsecurity\u002Fcors-policy-validator\u002Fskills\u002Fvalidating-cors-policies\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"cors","Validating CORS Policies","read","for","cross-origin","websearch","with","trigger","io","use","webfetch","review","check","grep","sharing","issues","code","validate","policy","codex","2026-11-10 10:12:30",false,"---\nname: validating-cors-policies\ndescription: Validate CORS policies for security issues and misconfigurations. Use when reviewing cross-origin resource sharing. Trigger with 'validate CORS', 'check CORS policy', or 'review cross-origin'.\nversion: 1.0.0\nallowed-tools: \"Read, WebFetch, WebSearch, Grep\"\nlicense: MIT\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\ncompatible-with: claude-code, codex, openclaw\n---\n# Validating CORS Policies\n\n## Overview\n\nValidate Cross-Origin Resource Sharing configurations in web applications and\nAPIs for security misconfigurations that enable unauthorized cross-origin access.\nThis skill analyzes CORS headers, middleware configurations, and server response\nbehavior to detect wildcard origins, reflected origins, credential leakage, and\noverly permissive header\u002Fmethod exposure.\n\n## Prerequisites\n\n- Access to the target codebase and configuration files in `${CLAUDE_SKILL_DIR}\u002F`\n- For live endpoint testing: WebFetch tool available and target URLs accessible\n- Familiarity with the web framework in use (Express, Django, Flask, Spring, ASP.NET, etc.)\n- Reference: `${CLAUDE_SKILL_DIR}\u002Freferences\u002FREADME.md` for CORS specification details, common vulnerability patterns, and example policies\n\n## Instructions\n\n1. Locate all CORS configuration points by scanning for `Access-Control-Allow-Origin`, `cors()` middleware, `@CrossOrigin` annotations, CORS policy builders, and server config directives (nginx `add_header`, Apache `Header set`) using Grep.\n2. Check for wildcard origin (`Access-Control-Allow-Origin: *`) -- flag as severity high when combined with `Access-Control-Allow-Credentials: true`, which browsers reject but indicates a misunderstanding of the security model.\n3. Detect origin reflection patterns where the server echoes back the `Origin` request header without validation -- search for code that reads the `Origin` header and sets it directly in the response. Flag as CWE-942 (Permissive Cross-domain Policy), severity critical.\n4. Validate the origin allowlist: check that allowed origins use exact string matching rather than substring or regex patterns vulnerable to bypass (e.g., `example.com.evil.com` matching a check for `example.com`).\n5. Assess `Access-Control-Allow-Methods` -- flag if dangerous methods (`PUT`, `DELETE`, `PATCH`) are exposed without necessity. Verify that preflight (`OPTIONS`) responses include appropriate method restrictions.\n6. Evaluate `Access-Control-Allow-Headers` -- flag wildcard header allowance or exposure of sensitive headers like `Authorization`, `Cookie`, or custom auth headers to broader origins than necessary.\n7. Check `Access-Control-Expose-Headers` for leakage of internal headers (e.g., `X-Request-Id`, `X-Internal-Trace`) to cross-origin consumers.\n8. Verify `Access-Control-Max-Age` is set to a reasonable value (600-86400 seconds) to balance security with performance -- missing or excessively long max-age values deserve a low-severity note.\n9. For live endpoints, issue preflight requests via WebFetch with various `Origin` values (legitimate, malicious, null) and analyze the response headers to confirm server behavior matches the codebase configuration.\n10. Compile findings with severity ratings, map to OWASP Testing Guide OTG-CLIENT-007, and provide remediation with correct CORS middleware configuration examples.\n\n## Output\n\n- **CORS configuration inventory**: Table of all CORS-enabled endpoints, their allowed origins, methods, headers, and credentials settings\n- **Findings report**: Each finding includes severity, affected endpoint\u002Ffile, CWE reference (CWE-942, CWE-346), observed behavior, and remediation code\n- **Preflight test results**: For live endpoints, a table of Origin values tested and the corresponding server responses\n- **Remediation examples**: Framework-specific CORS configuration snippets (Express `cors()`, Django `django-cors-headers`, Spring `@CrossOrigin`, nginx headers)\n\n## Error Handling\n\n| Error | Cause | Solution |\n|-------|-------|----------|\n| No CORS configuration found | CORS handled at infrastructure layer (CDN, API gateway) | Check CDN\u002Fgateway configs (Cloudflare, AWS API Gateway, nginx) for CORS header injection |\n| WebFetch blocked or timed out | Target endpoint unreachable or rate-limited | Verify URL accessibility; fall back to static codebase analysis of CORS middleware configuration |\n| Inconsistent CORS behavior across endpoints | Multiple CORS configurations at different layers | Map each layer (application, reverse proxy, CDN) and document the effective policy per endpoint |\n| Origin reflection false positive | Dynamic origin validation with a secure allowlist | Verify the allowlist logic uses exact matching; mark as informational if the implementation is secure |\n| Preflight not triggering | Request classified as \"simple request\" by the browser | Note that simple GET\u002FPOST requests bypass preflight; test with custom headers to force preflight |\n\n## Examples\n\n### Express.js CORS Middleware Audit\n\nScan `${CLAUDE_SKILL_DIR}\u002Fsrc\u002Fapp.js` and `${CLAUDE_SKILL_DIR}\u002Fsrc\u002Fmiddleware\u002F` for `cors()`\nconfiguration. Flag `origin: true` (reflects any origin) as CWE-942, severity\ncritical. Recommend replacing with an explicit allowlist:\n`origin: ['https:\u002F\u002Fapp.example.com', 'https:\u002F\u002Fadmin.example.com']`.\n\n### Nginx CORS Header Review\n\nGrep `${CLAUDE_SKILL_DIR}\u002Fnginx\u002F` for `add_header Access-Control-Allow-Origin`. Flag any\n`$http_origin` variable usage that reflects the origin without validation. Verify\nthat `Access-Control-Allow-Credentials` is only set for origins in the allowlist\nusing an `if` block or `map` directive.\n\n### API Gateway CORS Configuration\n\nReview `${CLAUDE_SKILL_DIR}\u002Finfra\u002Fapi-gateway.yaml` or equivalent IaC definitions for\nCORS settings. Flag wildcard `*` in allowed origins when credentials are enabled.\nVerify that `Access-Control-Allow-Methods` is scoped to only the HTTP methods\neach endpoint actually supports.\n\n## Resources\n\n- [MDN: Cross-Origin Resource Sharing](https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FCORS)\n- [OWASP Testing for CORS (OTG-CLIENT-007)](https:\u002F\u002Fowasp.org\u002Fwww-project-web-security-testing-guide\u002Flatest\u002F4-Web_Application_Security_Testing\u002F11-Client-side_Testing\u002F07-Testing_Cross_Origin_Resource_Sharing)\n- [CWE-942: Permissive Cross-domain Policy](https:\u002F\u002Fcwe.mitre.org\u002Fdata\u002Fdefinitions\u002F942.html)\n- [CWE-346: Origin Validation Error](https:\u002F\u002Fcwe.mitre.org\u002Fdata\u002Fdefinitions\u002F346.html)\n- [Fetch Standard: CORS Protocol](https:\u002F\u002Ffetch.spec.whatwg.org\u002F#http-cors-protocol)","# Validating CORS Policies\n\n## Overview\n\nValidate Cross-Origin Resource Sharing configurations in web applications and\nAPIs for security misconfigurations that enable unauthorized cross-origin access.\nThis skill analyzes CORS headers, middleware configurations, and server response\nbehavior to detect wildcard origins, reflected origins, credential leakage, and\noverly permissive header\u002Fmethod exposure.\n\n## Prerequisites\n\n- Access to the target codebase and configuration files in `${CLAUDE_SKILL_DIR}\u002F`\n- For live endpoint testing: WebFetch tool available and target URLs accessible\n- Familiarity with the web framework in use (Express, Django, Flask, Spring, ASP.NET, etc.)\n- Reference: `${CLAUDE_SKILL_DIR}\u002Freferences\u002FREADME.md` for CORS specification details, common vulnerability patterns, and example policies\n\n## Instructions\n\n1. Locate all CORS configuration points by scanning for `Access-Control-Allow-Origin`, `cors()` middleware, `@CrossOrigin` annotations, CORS policy builders, and server config directives (nginx `add_header`, Apache `Header set`) using Grep.\n2. Check for wildcard origin (`Access-Control-Allow-Origin: *`) -- flag as severity high when combined with `Access-Control-Allow-Credentials: true`, which browsers reject but indicates a misunderstanding of the security model.\n3. Detect origin reflection patterns where the server echoes back the `Origin` request header without validation -- search for code that reads the `Origin` header and sets it directly in the response. Flag as CWE-942 (Permissive Cross-domain Policy), severity critical.\n4. Validate the origin allowlist: check that allowed origins use exact string matching rather than substring or regex patterns vulnerable to bypass (e.g., `example.com.evil.com` matching a check for `example.com`).\n5. Assess `Access-Control-Allow-Methods` -- flag if dangerous methods (`PUT`, `DELETE`, `PATCH`) are exposed without necessity. Verify that preflight (`OPTIONS`) responses include appropriate method restrictions.\n6. Evaluate `Access-Control-Allow-Headers` -- flag wildcard header allowance or exposure of sensitive headers like `Authorization`, `Cookie`, or custom auth headers to broader origins than necessary.\n7. Check `Access-Control-Expose-Headers` for leakage of internal headers (e.g., `X-Request-Id`, `X-Internal-Trace`) to cross-origin consumers.\n8. Verify `Access-Control-Max-Age` is set to a reasonable value (600-86400 seconds) to balance security with performance -- missing or excessively long max-age values deserve a low-severity note.\n9. For live endpoints, issue preflight requests via WebFetch with various `Origin` values (legitimate, malicious, null) and analyze the response headers to confirm server behavior matches the codebase configuration.\n10. Compile findings with severity ratings, map to OWASP Testing Guide OTG-CLIENT-007, and provide remediation with correct CORS middleware configuration examples.\n\n## Output\n\n- **CORS configuration inventory**: Table of all CORS-enabled endpoints, their allowed origins, methods, headers, and credentials settings\n- **Findings report**: Each finding includes severity, affected endpoint\u002Ffile, CWE reference (CWE-942, CWE-346), observed behavior, and remediation code\n- **Preflight test results**: For live endpoints, a table of Origin values tested and the corresponding server responses\n- **Remediation examples**: Framework-specific CORS configuration snippets (Express `cors()`, Django `django-cors-headers`, Spring `@CrossOrigin`, nginx headers)\n\n## Error Handling\n\n| Error | Cause | Solution |\n|-------|-------|----------|\n| No CORS configuration found | CORS handled at infrastructure layer (CDN, API gateway) | Check CDN\u002Fgateway configs (Cloudflare, AWS API Gateway, nginx) for CORS header injection |\n| WebFetch blocked or timed out | Target endpoint unreachable or rate-limited | Verify URL accessibility; fall back to static codebase analysis of CORS middleware configuration |\n| Inconsistent CORS behavior across endpoints | Multiple CORS configurations at different layers | Map each layer (application, reverse proxy, CDN) and document the effective policy per endpoint |\n| Origin reflection false positive | Dynamic origin validation with a secure allowlist | Verify the allowlist logic uses exact matching; mark as informational if the implementation is secure |\n| Preflight not triggering | Request classified as \"simple request\" by the browser | Note that simple GET\u002FPOST requests bypass preflight; test with custom headers to force preflight |\n\n## Examples\n\n### Express.js CORS Middleware Audit\n\nScan `${CLAUDE_SKILL_DIR}\u002Fsrc\u002Fapp.js` and `${CLAUDE_SKILL_DIR}\u002Fsrc\u002Fmiddleware\u002F` for `cors()`\nconfiguration. Flag `origin: true` (reflects any origin) as CWE-942, severity\ncritical. Recommend replacing with an explicit allowlist:\n`origin: ['https:\u002F\u002Fapp.example.com', 'https:\u002F\u002Fadmin.example.com']`.\n\n### Nginx CORS Header Review\n\nGrep `${CLAUDE_SKILL_DIR}\u002Fnginx\u002F` for `add_header Access-Control-Allow-Origin`. Flag any\n`$http_origin` variable usage that reflects the origin without validation. Verify\nthat `Access-Control-Allow-Credentials` is only set for origins in the allowlist\nusing an `if` block or `map` directive.\n\n### API Gateway CORS Configuration\n\nReview `${CLAUDE_SKILL_DIR}\u002Finfra\u002Fapi-gateway.yaml` or equivalent IaC definitions for\nCORS settings. Flag wildcard `*` in allowed origins when credentials are enabled.\nVerify that `Access-Control-Allow-Methods` is scoped to only the HTTP methods\neach endpoint actually supports.\n\n## Resources\n\n- [MDN: Cross-Origin Resource Sharing](https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FCORS)\n- [OWASP Testing for CORS (OTG-CLIENT-007)](https:\u002F\u002Fowasp.org\u002Fwww-project-web-security-testing-guide\u002Flatest\u002F4-Web_Application_Security_Testing\u002F11-Client-side_Testing\u002F07-Testing_Cross_Origin_Resource_Sharing)\n- [CWE-942: Permissive Cross-domain Policy](https:\u002F\u002Fcwe.mitre.org\u002Fdata\u002Fdefinitions\u002F942.html)\n- [CWE-346: Origin Validation Error](https:\u002F\u002Fcwe.mitre.org\u002Fdata\u002Fdefinitions\u002F346.html)\n- [Fetch Standard: CORS Protocol](https:\u002F\u002Ffetch.spec.whatwg.org\u002F#http-cors-protocol)",{"name":5,"author":43,"license":14,"version":44,"description":7,"allowed-tools":45,"compatible-with":46},"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Read, WebFetch, WebSearch, Grep","claude-code, codex, openclaw","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","claude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsecurity\u002Fcors-policy-validator\u002Fskills\u002Fvalidating-cors-policies",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add micsapp\u002Fmicstec-skills --skill validating-cors-policies",{"tool":60,"command":61},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill validating-cors-policies",{"tool":63,"command":64},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill validating-cors-policies","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsecurity\u002Fcors-policy-validator\u002Fskills\u002Fvalidating-cors-policies\u002FSKILL.md",true,[68,74,80,86,90],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"assets\u002FREADME.md","ASSET","资产文件",197,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsecurity\u002Fcors-policy-validator\u002Fskills\u002Fvalidating-cors-policies\u002Fassets\u002FREADME.md",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002FREADME.md","REFERENCE","参考文档",65,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsecurity\u002Fcors-policy-validator\u002Fskills\u002Fvalidating-cors-policies\u002Freferences\u002FREADME.md",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"scripts\u002Fgenerate_test_cases.py","SCRIPT","脚本",17297,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsecurity\u002Fcors-policy-validator\u002Fskills\u002Fvalidating-cors-policies\u002Fscripts\u002Fgenerate_test_cases.py",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002FREADME.md",470,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsecurity\u002Fcors-policy-validator\u002Fskills\u002Fvalidating-cors-policies\u002Fscripts\u002FREADME.md",{"path":91,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fvalidate_cors.py",12596,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsecurity\u002Fcors-policy-validator\u002Fskills\u002Fvalidating-cors-policies\u002Fscripts\u002Fvalidate_cors.py",[95,131,160,179,198,222],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":111,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[101,106],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":107,"categoryName":108,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,21],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":145,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[137,138,141,144],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},{"categoryNo":139,"categoryName":140,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":142,"categoryName":143,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":107,"categoryName":108,"taxonomyType":109,"taxonomyTypeDesc":110},[146,147,148,149,113,150,34,151,152,153,154,155,121,122,128,156,157,129,158,159],"deployment","apiops deployment","workflows","azure devops","infrastructure","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[166],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[36,168,169,170,113,116,121,122,171,27,172,173,174,175,176,129,177,178,159,21],"authoring","apim policy authoring","security","access","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":187,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[185,186],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},{"categoryNo":107,"categoryName":108,"taxonomyType":109,"taxonomyTypeDesc":110},[29,170,188,121,173,189,113,146,190,191,192,193,122,194,129,195,196,197,130,21],"security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[205,206,207,148,208,209,210,33,121,211,212,213,214,215,216,217,218,219,220,221],"cli","jira","jira cli","init","tasks","create","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":228,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[224,229,230,231,232,233,234,27,235,236],"npm","js","calculate","node","math","user","compute","errors"]