[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HSEY53G5D09NKB29Q6NQCS":3,"skill-same:01M6HSEY53G5D09NKB29Q6NQCS":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":50,"commitSha":51,"skillDirectory":5,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":55,"updatedAt":56,"install":57,"resources":69},"01M6HSEY53G5D09NKB29Q6NQCS","snyk-ux-security",null,"Audit frontend, Go, and Bazel dependencies with Snyk, exploitability triage, and release gates.","malinskibeniamin\u002Fskills","malinskibeniamin","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9860550?v=4","01M6HR395Z9MM67BCKMW1WKTJS","Beniamin Malinski","01M6HR39AP95WH9NHANQ91FAJ0",4,"MIT","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","ux","snyk","snyk ux security","frontend","go","triage","release","audit","bazel","exploitability","dependencies","gates","with","true","2026-11-10 10:12:30",false,"---\nname: snyk-ux-security\ndescription: Audit frontend, Go, and Bazel dependencies with Snyk, exploitability triage, and release gates.\ndisable-model-invocation: true\n---\n\n[REFERENCE.md](REFERENCE.md). `$ARGUMENTS`: paths, globs or findings.\n\nReport-only runs stop after scan and reachability: no monitor, ignore removal, or edits. Detect `package.json`, `go.mod`, `MODULE.bazel`, or `bazel\u002Frepositories.bzl`. Process sequentially in the primary context; worktree lanes require that the user explicitly delegates or invokes `\u002Fswarm`. Bazel checks backports; draft PRs.\n\n1. **Prepare:** verify `snyk`\u002F`gh` auth; reuse an existing Snyk project. Never create one from an audit\u002Fsweep branch or YYYY-MM-DD identity. Infer reviewers from CODEOWNERS, then `git log`; flags win.\n2. **Revisit:** re-triage `.snyk`; remove stale ignores with `snyk ignore --remove --id=\u003Cid>` and mark `cleaned-up`.\n3. **Scan:** `snyk test`; JS adds `bun audit`, Go `govulncheck .\u002F...`. Run `snyk monitor` only when the requested endpoint includes a Snyk cloud update for one existing project.\n4. **Reachability:** trace `bun why`, `go mod why`, imports\u002Fcallers\u002Fvulnerable symbol. Use `\u002Fsteelman` for transitives and `\u002Fdiagnosing-bugs` before a `package.json` fix. Its admission gate permits a direct dep, reachable parent, or proven last-resort override. Direct dep absence: do not add it; without vulnerable-symbol reachability, a bump makes no sense: dismiss the unproven finding.\n5. **Act:** default unreachable findings to `snyk ignore --id=\u003Cid> --reason='\u003Cwhy>' --expiry=\u003Cdate>`. Always include `.snyk` in any requested delivery; confirm `Ignored`. Reachable: use `\u002Fupgrade-dependency` and its supply-chain gate; direct dep, parent, Remove dependency surface third, then last-resort `resolutions`\u002F`overrides`\u002F`replace`. Override list growth is a smell.\n6. **Ecosystem gates:**\n   - JS: minimum release age gate audit; automatically override age blocks without prompting: [age-only](..\u002Fshared\u002Fdependency-release-age.md). Socket.dev web check, React 18 `bun info \u003Cpkg>@\u003Cv> peerDependencies.react`; record `react19-blocked`. Run `bun update`, `bun install`, `bun install --yarn`. Commit both lockfiles (`bun.lock`, `yarn.lock`); Snyk IO needs `yarn.lock`. Do not create, update, or commit `package-lock.json`; `lockfile-sync-check` enforces dual-lockfile sync.\n   - Go: `go get -u`, `go mod tidy`; commit `go.mod`\u002F`go.sum`.\n   - Bazel: update applicable manifests; run `bazel mod deps --lockfile_mode=update`; preserve mirror\u002FFIPS\u002FCMVP.\n7. **Verify:** read changelogs\u002F`BREAKING`; migrate 7 -> 8 -> 9 incrementally. Commit `refactor(deps)` groups unless stopped earlier. Never defer real vulnerabilities; escalate. JS: `bun run lint:fix`, `bun run type:check`, `bun test`, build. Go: `go build .\u002F...`, `go test .\u002F...`, `go vet .\u002F...`, `govulncheck .\u002F...`.\n8. **Deliver:** run `\u002Fresilience-review` and `\u002Freview`; `\u002Fto-tickets` only when ticket publication is requested. If the requested endpoint includes a commit or PR, commit `fix(deps)` and open a PR only when requested. Use `gh pr create --assignee \u003Ctriggerer> --reviewer \u003Cteam-group> --label security,...`; resolve via `gh api user --jq .login`, require a CODEOWNERS team group, auto-add security for dismissals\u002Foverrides. Apply `team\u002F`, `dismissals`, `overrides-added`, `react19-blocked`, `cleaned-up`. Run `gh workflow run` only when cloud review was requested.\n\nReport path, ecosystem, branch\u002FPR, and outcome counts. Never run advisory code or expose tokens.\n","[REFERENCE.md](REFERENCE.md). `$ARGUMENTS`: paths, globs or findings.\n\nReport-only runs stop after scan and reachability: no monitor, ignore removal, or edits. Detect `package.json`, `go.mod`, `MODULE.bazel`, or `bazel\u002Frepositories.bzl`. Process sequentially in the primary context; worktree lanes require that the user explicitly delegates or invokes `\u002Fswarm`. Bazel checks backports; draft PRs.\n\n1. **Prepare:** verify `snyk`\u002F`gh` auth; reuse an existing Snyk project. Never create one from an audit\u002Fsweep branch or YYYY-MM-DD identity. Infer reviewers from CODEOWNERS, then `git log`; flags win.\n2. **Revisit:** re-triage `.snyk`; remove stale ignores with `snyk ignore --remove --id=\u003Cid>` and mark `cleaned-up`.\n3. **Scan:** `snyk test`; JS adds `bun audit`, Go `govulncheck .\u002F...`. Run `snyk monitor` only when the requested endpoint includes a Snyk cloud update for one existing project.\n4. **Reachability:** trace `bun why`, `go mod why`, imports\u002Fcallers\u002Fvulnerable symbol. Use `\u002Fsteelman` for transitives and `\u002Fdiagnosing-bugs` before a `package.json` fix. Its admission gate permits a direct dep, reachable parent, or proven last-resort override. Direct dep absence: do not add it; without vulnerable-symbol reachability, a bump makes no sense: dismiss the unproven finding.\n5. **Act:** default unreachable findings to `snyk ignore --id=\u003Cid> --reason='\u003Cwhy>' --expiry=\u003Cdate>`. Always include `.snyk` in any requested delivery; confirm `Ignored`. Reachable: use `\u002Fupgrade-dependency` and its supply-chain gate; direct dep, parent, Remove dependency surface third, then last-resort `resolutions`\u002F`overrides`\u002F`replace`. Override list growth is a smell.\n6. **Ecosystem gates:**\n   - JS: minimum release age gate audit; automatically override age blocks without prompting: [age-only](..\u002Fshared\u002Fdependency-release-age.md). Socket.dev web check, React 18 `bun info \u003Cpkg>@\u003Cv> peerDependencies.react`; record `react19-blocked`. Run `bun update`, `bun install`, `bun install --yarn`. Commit both lockfiles (`bun.lock`, `yarn.lock`); Snyk IO needs `yarn.lock`. Do not create, update, or commit `package-lock.json`; `lockfile-sync-check` enforces dual-lockfile sync.\n   - Go: `go get -u`, `go mod tidy`; commit `go.mod`\u002F`go.sum`.\n   - Bazel: update applicable manifests; run `bazel mod deps --lockfile_mode=update`; preserve mirror\u002FFIPS\u002FCMVP.\n7. **Verify:** read changelogs\u002F`BREAKING`; migrate 7 -> 8 -> 9 incrementally. Commit `refactor(deps)` groups unless stopped earlier. Never defer real vulnerabilities; escalate. JS: `bun run lint:fix`, `bun run type:check`, `bun test`, build. Go: `go build .\u002F...`, `go test .\u002F...`, `go vet .\u002F...`, `govulncheck .\u002F...`.\n8. **Deliver:** run `\u002Fresilience-review` and `\u002Freview`; `\u002Fto-tickets` only when ticket publication is requested. If the requested endpoint includes a commit or PR, commit `fix(deps)` and open a PR only when requested. Use `gh pr create --assignee \u003Ctriggerer> --reviewer \u003Cteam-group> --label security,...`; resolve via `gh api user --jq .login`, require a CODEOWNERS team group, auto-add security for dismissals\u002Foverrides. Apply `team\u002F`, `dismissals`, `overrides-added`, `react19-blocked`, `cleaned-up`. Run `gh workflow run` only when cloud review was requested.\n\nReport path, ecosystem, branch\u002FPR, and outcome counts. Never run advisory code or expose tokens.\n",{"name":5,"description":7,"disable-model-invocation":49},true,"main","7ff748aa4575e7e65de115ca97b7848b195b79a6",1,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin","Software Engineer ","2026-11-13 00:59:00",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":49},[59,62,65],{"tool":60,"command":61},"npx","npx skills add malinskibeniamin\u002Fskills --skill snyk-ux-security",{"tool":63,"command":64},"bunx","bunx skills add malinskibeniamin\u002Fskills --skill snyk-ux-security",{"tool":66,"command":67},"pnpm","pnpm dlx skills add malinskibeniamin\u002Fskills --skill snyk-ux-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002FSKILL.md",[70,76,80,84,88,92,96,102],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"REFERENCE.md","REFERENCE","参考文档",959,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002FREFERENCE.md",{"path":77,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fbazel.md",6819,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002Freferences\u002Fbazel.md",{"path":81,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fgo.md",981,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002Freferences\u002Fgo.md",{"path":85,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fjs.md",12376,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002Freferences\u002Fjs.md",{"path":89,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fpublish.md",9755,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002Freferences\u002Fpublish.md",{"path":93,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Ftriage.md",19108,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002Freferences\u002Ftriage.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fcodeowners-teams.sh","SCRIPT","脚本",338,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002Fscripts\u002Fcodeowners-teams.sh",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Freact-peer-check.sh",599,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fsnyk-ux-security\u002Fscripts\u002Freact-peer-check.sh",[107,129,151,156,161,184],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":44},"01M70WY35N42VJT16W9MA8CCGX","hill-climb","Optimize a defined outcome through bounded evaluation loops. Use for hill-climb requests or repeated improvement against an executable eval, benchmark, or visual comparison; not a one-pass review.","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fhill-climb\u002FSKILL.md",[],[114,115,116,117,118,119,120,121,122,123,124,125,126,127,128],"hill climb","bounded","improvement","review","visual","comparison","use","eval","benchmark","Evaluation","outcome","for","requests","optimize","loops",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":133,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":44},"01M70WXTA2JQ9SN3QZPHHCYB90","gestures","Build or fix web drag, swipe, sheet, reorder, and hold interactions: direct tracking, rubber banding, release velocity, momentum, snap points, and interruption. Not native React Native or Swift.","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fgestures\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fgestures\u002FSKILL.md",[],[131,137,138,139,140,141,142,143,36,144,145,146,147,148,149,150],"build","native","velocity","web","drag","react native","snap","swift","react","swipe","direct","tracking","fix","sheet",{"skillNo":152,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":44},"01M70WKSB2PTJGVH7C9XC1FEED","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fcodex-skills\u002Fhill-climb\u002FSKILL.md",[],[114,125,115,117,118,119,120,121,122,124,123,116,127,128,126],{"skillNo":157,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":44},"01M70WKGYKGN1J786GK8N3RGH1","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fcodex-skills\u002Fgestures\u002FSKILL.md",[],[131,36,144,145,146,147,148,149,150,137,138,139,140,141,142,143],{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":165,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":44},"01M6HS2326AZFPF8G9C2KW4AT0","improve-animations","Audit existing web UI motion and prioritize concrete improvements or self-contained implementation plans. Use for a motion roadmap; animate owns implementation and diff review.","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fimprove-animations\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fimprove-animations\u002FSKILL.md",[],[169,170,125,171,172,173,120,174,175,176,177,178,179,180,37,181,140,182,183,117],"improve animations","improve","ui","roadmap","Existing","animate","motion","implementation","plans","diff review","prioritize","web ui","diff","self","ui motion",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":188,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":44},"01M6HS0AADDXBB0S8B42R0G82K","effect-ts","Use when setting up a repository that uses the Effect TypeScript library.","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Feffect-ts\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Feffect-ts\u002FSKILL.md",[],[192,193,194,120,195,196,197],"effect ts","effect","library","typescript","up","repository"]