[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6JDK3QEQMQFN8WJDBC9RJH6":3,"skill-same:01M6JDK3QEQMQFN8WJDBC9RJH6":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":48,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M6JDK3QEQMQFN8WJDBC9RJH6","springboot-security",null,"Spring Security best practices for authn\u002Fauthz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.","S3YED\u002Fappie-kit","S3YED","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F62743867?v=4","01M6JBKBRRVP6KMS0VWZ27T3R6","01M6JBKBX0KG30284PW1DBYJT1",14,"MIT","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fecc\u002Fspringboot-security\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"springboot security","security","secrets","for","headers","spring security","dependency security","rate limiting","java spring","dependency","spring","csrf","services","spring boot","java","security best practices","validation","best practices","boot","2026-11-10 10:12:30",false,"---\nname: springboot-security\ndescription: Spring Security best practices for authn\u002Fauthz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.\norigin: ECC\n---\n\n# Spring Boot Security Review\n\nUse when adding auth, handling input, creating endpoints, or dealing with secrets.\n\n## When to Activate\n\n- Adding authentication (JWT, OAuth2, session-based)\n- Implementing authorization (@PreAuthorize, role-based access)\n- Validating user input (Bean Validation, custom validators)\n- Configuring CORS, CSRF, or security headers\n- Managing secrets (Vault, environment variables)\n- Adding rate limiting or brute-force protection\n- Scanning dependencies for CVEs\n\n## Authentication\n\n- Prefer stateless JWT or opaque tokens with revocation list\n- Use `httpOnly`, `Secure`, `SameSite=Strict` cookies for sessions\n- Validate tokens with `OncePerRequestFilter` or resource server\n\n```java\n@Component\npublic class JwtAuthFilter extends OncePerRequestFilter {\n  private final JwtService jwtService;\n\n  public JwtAuthFilter(JwtService jwtService) {\n    this.jwtService = jwtService;\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String header = request.getHeader(HttpHeaders.AUTHORIZATION);\n    if (header != null && header.startsWith(\"Bearer \")) {\n      String token = header.substring(7);\n      Authentication auth = jwtService.authenticate(token);\n      SecurityContextHolder.getContext().setAuthentication(auth);\n    }\n    chain.doFilter(request, response);\n  }\n}\n```\n\n## Authorization\n\n- Enable method security: `@EnableMethodSecurity`\n- Use `@PreAuthorize(\"hasRole('ADMIN')\")` or `@PreAuthorize(\"@authz.canEdit(#id)\")`\n- Deny by default; expose only required scopes\n\n```java\n@RestController\n@RequestMapping(\"\u002Fapi\u002Fadmin\")\npublic class AdminController {\n\n  @PreAuthorize(\"hasRole('ADMIN')\")\n  @GetMapping(\"\u002Fusers\")\n  public List\u003CUserDto> listUsers() {\n    return userService.findAll();\n  }\n\n  @PreAuthorize(\"@authz.isOwner(#id, authentication)\")\n  @DeleteMapping(\"\u002Fusers\u002F{id}\")\n  public ResponseEntity\u003CVoid> deleteUser(@PathVariable Long id) {\n    userService.delete(id);\n    return ResponseEntity.noContent().build();\n  }\n}\n```\n\n## Input Validation\n\n- Use Bean Validation with `@Valid` on controllers\n- Apply constraints on DTOs: `@NotBlank`, `@Email`, `@Size`, custom validators\n- Sanitize any HTML with a whitelist before rendering\n\n```java\n\u002F\u002F BAD: No validation\n@PostMapping(\"\u002Fusers\")\npublic User createUser(@RequestBody UserDto dto) {\n  return userService.create(dto);\n}\n\n\u002F\u002F GOOD: Validated DTO\npublic record CreateUserDto(\n    @NotBlank @Size(max = 100) String name,\n    @NotBlank @Email String email,\n    @NotNull @Min(0) @Max(150) Integer age\n) {}\n\n@PostMapping(\"\u002Fusers\")\npublic ResponseEntity\u003CUserDto> createUser(@Valid @RequestBody CreateUserDto dto) {\n  return ResponseEntity.status(HttpStatus.CREATED)\n      .body(userService.create(dto));\n}\n```\n\n## SQL Injection Prevention\n\n- Use Spring Data repositories or parameterized queries\n- For native queries, use `:param` bindings; never concatenate strings\n\n```java\n\u002F\u002F BAD: String concatenation in native query\n@Query(value = \"SELECT * FROM users WHERE name = '\" + name + \"'\", nativeQuery = true)\n\n\u002F\u002F GOOD: Parameterized native query\n@Query(value = \"SELECT * FROM users WHERE name = :name\", nativeQuery = true)\nList\u003CUser> findByName(@Param(\"name\") String name);\n\n\u002F\u002F GOOD: Spring Data derived query (auto-parameterized)\nList\u003CUser> findByEmailAndActiveTrue(String email);\n```\n\n## Password Encoding\n\n- Always hash passwords with BCrypt or Argon2 — never store plaintext\n- Use `PasswordEncoder` bean, not manual hashing\n\n```java\n@Bean\npublic PasswordEncoder passwordEncoder() {\n  return new BCryptPasswordEncoder(12); \u002F\u002F cost factor 12\n}\n\n\u002F\u002F In service\npublic User register(CreateUserDto dto) {\n  String hashedPassword = passwordEncoder.encode(dto.password());\n  return userRepository.save(new User(dto.email(), hashedPassword));\n}\n```\n\n## CSRF Protection\n\n- For browser session apps, keep CSRF enabled; include token in forms\u002Fheaders\n- For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth\n\n```java\nhttp\n  .csrf(csrf -> csrf.disable())\n  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));\n```\n\n## Secrets Management\n\n- No secrets in source; load from env or vault\n- Keep `application.yml` free of credentials; use placeholders\n- Rotate tokens and DB credentials regularly\n\n```yaml\n# BAD: Hardcoded in application.yml\nspring:\n  datasource:\n    password: mySecretPassword123\n\n# GOOD: Environment variable placeholder\nspring:\n  datasource:\n    password: ${DB_PASSWORD}\n\n# GOOD: Spring Cloud Vault integration\nspring:\n  cloud:\n    vault:\n      uri: https:\u002F\u002Fvault.example.com\n      token: ${VAULT_TOKEN}\n```\n\n## Security Headers\n\n```java\nhttp\n  .headers(headers -> headers\n    .contentSecurityPolicy(csp -> csp\n      .policyDirectives(\"default-src 'self'\"))\n    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)\n    .xssProtection(Customizer.withDefaults())\n    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));\n```\n\n## CORS Configuration\n\n- Configure CORS at the security filter level, not per-controller\n- Restrict allowed origins — never use `*` in production\n\n```java\n@Bean\npublic CorsConfigurationSource corsConfigurationSource() {\n  CorsConfiguration config = new CorsConfiguration();\n  config.setAllowedOrigins(List.of(\"https:\u002F\u002Fapp.example.com\"));\n  config.setAllowedMethods(List.of(\"GET\", \"POST\", \"PUT\", \"DELETE\"));\n  config.setAllowedHeaders(List.of(\"Authorization\", \"Content-Type\"));\n  config.setAllowCredentials(true);\n  config.setMaxAge(3600L);\n\n  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n  source.registerCorsConfiguration(\"\u002Fapi\u002F**\", config);\n  return source;\n}\n\n\u002F\u002F In SecurityFilterChain:\nhttp.cors(cors -> cors.configurationSource(corsConfigurationSource()));\n```\n\n## Rate Limiting\n\n- Apply Bucket4j or gateway-level limits on expensive endpoints\n- Log and alert on bursts; return 429 with retry hints\n\n```java\n\u002F\u002F Using Bucket4j for per-endpoint rate limiting\n@Component\npublic class RateLimitFilter extends OncePerRequestFilter {\n  private final Map\u003CString, Bucket> buckets = new ConcurrentHashMap\u003C>();\n\n  private Bucket createBucket() {\n    return Bucket.builder()\n        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))\n        .build();\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String clientIp = request.getRemoteAddr();\n    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());\n\n    if (bucket.tryConsume(1)) {\n      chain.doFilter(request, response);\n    } else {\n      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());\n      response.getWriter().write(\"{\\\"error\\\": \\\"Rate limit exceeded\\\"}\");\n    }\n  }\n}\n```\n\n## Dependency Security\n\n- Run OWASP Dependency Check \u002F Snyk in CI\n- Keep Spring Boot and Spring Security on supported versions\n- Fail builds on known CVEs\n\n## Logging and PII\n\n- Never log secrets, tokens, passwords, or full PAN data\n- Redact sensitive fields; use structured JSON logging\n\n## File Uploads\n\n- Validate size, content type, and extension\n- Store outside web root; scan if required\n\n## Checklist Before Release\n\n- [ ] Auth tokens validated and expired correctly\n- [ ] Authorization guards on every sensitive path\n- [ ] All inputs validated and sanitized\n- [ ] No string-concatenated SQL\n- [ ] CSRF posture correct for app type\n- [ ] Secrets externalized; none committed\n- [ ] Security headers configured\n- [ ] Rate limiting on APIs\n- [ ] Dependencies scanned and up to date\n- [ ] Logs free of sensitive data\n\n**Remember**: Deny by default, validate inputs, least privilege, and secure-by-configuration first.\n","# Spring Boot Security Review\n\nUse when adding auth, handling input, creating endpoints, or dealing with secrets.\n\n## When to Activate\n\n- Adding authentication (JWT, OAuth2, session-based)\n- Implementing authorization (@PreAuthorize, role-based access)\n- Validating user input (Bean Validation, custom validators)\n- Configuring CORS, CSRF, or security headers\n- Managing secrets (Vault, environment variables)\n- Adding rate limiting or brute-force protection\n- Scanning dependencies for CVEs\n\n## Authentication\n\n- Prefer stateless JWT or opaque tokens with revocation list\n- Use `httpOnly`, `Secure`, `SameSite=Strict` cookies for sessions\n- Validate tokens with `OncePerRequestFilter` or resource server\n\n```java\n@Component\npublic class JwtAuthFilter extends OncePerRequestFilter {\n  private final JwtService jwtService;\n\n  public JwtAuthFilter(JwtService jwtService) {\n    this.jwtService = jwtService;\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String header = request.getHeader(HttpHeaders.AUTHORIZATION);\n    if (header != null && header.startsWith(\"Bearer \")) {\n      String token = header.substring(7);\n      Authentication auth = jwtService.authenticate(token);\n      SecurityContextHolder.getContext().setAuthentication(auth);\n    }\n    chain.doFilter(request, response);\n  }\n}\n```\n\n## Authorization\n\n- Enable method security: `@EnableMethodSecurity`\n- Use `@PreAuthorize(\"hasRole('ADMIN')\")` or `@PreAuthorize(\"@authz.canEdit(#id)\")`\n- Deny by default; expose only required scopes\n\n```java\n@RestController\n@RequestMapping(\"\u002Fapi\u002Fadmin\")\npublic class AdminController {\n\n  @PreAuthorize(\"hasRole('ADMIN')\")\n  @GetMapping(\"\u002Fusers\")\n  public List\u003CUserDto> listUsers() {\n    return userService.findAll();\n  }\n\n  @PreAuthorize(\"@authz.isOwner(#id, authentication)\")\n  @DeleteMapping(\"\u002Fusers\u002F{id}\")\n  public ResponseEntity\u003CVoid> deleteUser(@PathVariable Long id) {\n    userService.delete(id);\n    return ResponseEntity.noContent().build();\n  }\n}\n```\n\n## Input Validation\n\n- Use Bean Validation with `@Valid` on controllers\n- Apply constraints on DTOs: `@NotBlank`, `@Email`, `@Size`, custom validators\n- Sanitize any HTML with a whitelist before rendering\n\n```java\n\u002F\u002F BAD: No validation\n@PostMapping(\"\u002Fusers\")\npublic User createUser(@RequestBody UserDto dto) {\n  return userService.create(dto);\n}\n\n\u002F\u002F GOOD: Validated DTO\npublic record CreateUserDto(\n    @NotBlank @Size(max = 100) String name,\n    @NotBlank @Email String email,\n    @NotNull @Min(0) @Max(150) Integer age\n) {}\n\n@PostMapping(\"\u002Fusers\")\npublic ResponseEntity\u003CUserDto> createUser(@Valid @RequestBody CreateUserDto dto) {\n  return ResponseEntity.status(HttpStatus.CREATED)\n      .body(userService.create(dto));\n}\n```\n\n## SQL Injection Prevention\n\n- Use Spring Data repositories or parameterized queries\n- For native queries, use `:param` bindings; never concatenate strings\n\n```java\n\u002F\u002F BAD: String concatenation in native query\n@Query(value = \"SELECT * FROM users WHERE name = '\" + name + \"'\", nativeQuery = true)\n\n\u002F\u002F GOOD: Parameterized native query\n@Query(value = \"SELECT * FROM users WHERE name = :name\", nativeQuery = true)\nList\u003CUser> findByName(@Param(\"name\") String name);\n\n\u002F\u002F GOOD: Spring Data derived query (auto-parameterized)\nList\u003CUser> findByEmailAndActiveTrue(String email);\n```\n\n## Password Encoding\n\n- Always hash passwords with BCrypt or Argon2 — never store plaintext\n- Use `PasswordEncoder` bean, not manual hashing\n\n```java\n@Bean\npublic PasswordEncoder passwordEncoder() {\n  return new BCryptPasswordEncoder(12); \u002F\u002F cost factor 12\n}\n\n\u002F\u002F In service\npublic User register(CreateUserDto dto) {\n  String hashedPassword = passwordEncoder.encode(dto.password());\n  return userRepository.save(new User(dto.email(), hashedPassword));\n}\n```\n\n## CSRF Protection\n\n- For browser session apps, keep CSRF enabled; include token in forms\u002Fheaders\n- For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth\n\n```java\nhttp\n  .csrf(csrf -> csrf.disable())\n  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));\n```\n\n## Secrets Management\n\n- No secrets in source; load from env or vault\n- Keep `application.yml` free of credentials; use placeholders\n- Rotate tokens and DB credentials regularly\n\n```yaml\n# BAD: Hardcoded in application.yml\nspring:\n  datasource:\n    password: mySecretPassword123\n\n# GOOD: Environment variable placeholder\nspring:\n  datasource:\n    password: ${DB_PASSWORD}\n\n# GOOD: Spring Cloud Vault integration\nspring:\n  cloud:\n    vault:\n      uri: https:\u002F\u002Fvault.example.com\n      token: ${VAULT_TOKEN}\n```\n\n## Security Headers\n\n```java\nhttp\n  .headers(headers -> headers\n    .contentSecurityPolicy(csp -> csp\n      .policyDirectives(\"default-src 'self'\"))\n    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)\n    .xssProtection(Customizer.withDefaults())\n    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));\n```\n\n## CORS Configuration\n\n- Configure CORS at the security filter level, not per-controller\n- Restrict allowed origins — never use `*` in production\n\n```java\n@Bean\npublic CorsConfigurationSource corsConfigurationSource() {\n  CorsConfiguration config = new CorsConfiguration();\n  config.setAllowedOrigins(List.of(\"https:\u002F\u002Fapp.example.com\"));\n  config.setAllowedMethods(List.of(\"GET\", \"POST\", \"PUT\", \"DELETE\"));\n  config.setAllowedHeaders(List.of(\"Authorization\", \"Content-Type\"));\n  config.setAllowCredentials(true);\n  config.setMaxAge(3600L);\n\n  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n  source.registerCorsConfiguration(\"\u002Fapi\u002F**\", config);\n  return source;\n}\n\n\u002F\u002F In SecurityFilterChain:\nhttp.cors(cors -> cors.configurationSource(corsConfigurationSource()));\n```\n\n## Rate Limiting\n\n- Apply Bucket4j or gateway-level limits on expensive endpoints\n- Log and alert on bursts; return 429 with retry hints\n\n```java\n\u002F\u002F Using Bucket4j for per-endpoint rate limiting\n@Component\npublic class RateLimitFilter extends OncePerRequestFilter {\n  private final Map\u003CString, Bucket> buckets = new ConcurrentHashMap\u003C>();\n\n  private Bucket createBucket() {\n    return Bucket.builder()\n        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))\n        .build();\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String clientIp = request.getRemoteAddr();\n    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());\n\n    if (bucket.tryConsume(1)) {\n      chain.doFilter(request, response);\n    } else {\n      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());\n      response.getWriter().write(\"{\\\"error\\\": \\\"Rate limit exceeded\\\"}\");\n    }\n  }\n}\n```\n\n## Dependency Security\n\n- Run OWASP Dependency Check \u002F Snyk in CI\n- Keep Spring Boot and Spring Security on supported versions\n- Fail builds on known CVEs\n\n## Logging and PII\n\n- Never log secrets, tokens, passwords, or full PAN data\n- Redact sensitive fields; use structured JSON logging\n\n## File Uploads\n\n- Validate size, content type, and extension\n- Store outside web root; scan if required\n\n## Checklist Before Release\n\n- [ ] Auth tokens validated and expired correctly\n- [ ] Authorization guards on every sensitive path\n- [ ] All inputs validated and sanitized\n- [ ] No string-concatenated SQL\n- [ ] CSRF posture correct for app type\n- [ ] Secrets externalized; none committed\n- [ ] Security headers configured\n- [ ] Rate limiting on APIs\n- [ ] Dependencies scanned and up to date\n- [ ] Logs free of sensitive data\n\n**Remember**: Deny by default, validate inputs, least privilege, and secure-by-configuration first.\n",{"name":5,"origin":42,"description":7},"ECC","master","8ec37df6d71fb664ea19d32c079e7d3ff931a8e0","skills\u002Fecc\u002Fspringboot-security",3,"https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit","https:\u002F\u002Fweblyfe.ai","https:\u002F\u002Fgithub.com\u002FS3YED","2026-08-27 01:54:02",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add S3YED\u002Fappie-kit --skill springboot-security",{"tool":57,"command":58},"bunx","bunx skills add S3YED\u002Fappie-kit --skill springboot-security",{"tool":60,"command":61},"pnpm","pnpm dlx skills add S3YED\u002Fappie-kit --skill springboot-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fecc\u002Fspringboot-security\u002FSKILL.md",true,[],[66,102,137,163,194,218],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":83,"publishedAt":37},"01M6JFD4M6N4DSGC7TXEJ5R3J2","ai-music","AI music generation and audio tools: HeartMuLa lyrics-to-music generation, songwriting craft (+ Suno prompts), and audio spectrogram\u002Ffeature visualization.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fwethlete\u002Fai-music\u002FSKILL.md",[72,77,80],{"categoryNo":73,"categoryName":74,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",{"categoryNo":78,"categoryName":79,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":81,"categoryName":82,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000023","Skill与智能体开发",[84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101],"music","ai music","humanizer","visualization","Tools","Audio","hermes","hermes agent","songwriting","suno","lyrics","prompts","heartmula","craft","generation","feature","ai music generation","music generation",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":116,"publishedAt":37},"01M6JFCZE4XNFQFMNZDHKHT5V5","agentic-webdesign-design-system-ingestion","Use v0 Design Systems 2.0, Bolt Design System Agents, or Lovable to generate production UI from a client's real design system components — not generic Tailwind. Use when building a client website where brand consistency matters.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fweb-design\u002Fagentic-webdesign-design-system-ingestion\u002FSKILL.md",[108,111],{"categoryNo":109,"categoryName":110,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136],"design","agentic","design system","system","ingestion","webdesign","agentic webdesign design system ingestion","components","generate","design systems","website","ui","Tailwind","bolt","lovable","v0","design-system","wed","design system components","appie",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":145,"publishedAt":37},"01M6JFCVPX3913CFAS6QQJ33ZB","agentic-webdesign-agent-elements","Use 21st.dev Agent Elements — 25 shadcn\u002Fui components purpose-built for AI agent UIs. Tool cards (Bash, Edit, Search, Plan, Subagent, MCP), chat, input, streaming. Open source, shadcn-registry install, no runtime lock-in.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fweb-design\u002Fagentic-webdesign-agent-elements\u002FSKILL.md",[143,144],{"categoryNo":81,"categoryName":82,"taxonomyType":75,"taxonomyTypeDesc":76},{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},[118,146,122,147,148,149,124,150,151,152,153,154,155,156,157,158,159,160,161,162],"elements","agentic webdesign agent elements","MCP","ai agent","registry","search","streaming","open source","open","Bash","plan","subagent","edit","install","input","lock","source",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":173,"publishedAt":37},"01M6JFCQC7H65M9QJ6TRE71BS1","vercel-deployment","Deploy static sites and frontends to Vercel — handles both CLI and REST API paths, including the CLI token sanitization workaround.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fsoftware-development\u002Fvercel-deployment\u002FSKILL.md",[169,172],{"categoryNo":170,"categoryName":171,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":81,"categoryName":82,"taxonomyType":75,"taxonomyTypeDesc":76},[174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193],"deployment","vercel deployment","vercel","macos","cli","linux","windows","deploy","vercel deploy","REST","api","site","deploy to vercel","token","rest api","host","sites","paths","sanitization","static site",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":37},"01M6JFCM4SMTXBM5A01BK2YQG1","software-quality-workflows","Umbrella workflow for TDD, debugging, code simplification, spikes, pre-commit review, and debugger-assisted investigation.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fsoftware-development\u002Fsoftware-quality-workflows\u002FSKILL.md",[200],{"categoryNo":81,"categoryName":82,"taxonomyType":75,"taxonomyTypeDesc":76},[202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,21],"workflows","quality","software","software quality workflows","review","tdd","workflow","commit","debugging","code","debugger","pre-commit","investigation","code simplification","user","simplification",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":231,"publishedAt":37},"01M6JFCGD0M6CEATY01W7YN6DB","react-component-refactoring","Safely refactor large React components into smaller, maintainable pieces using proven patterns","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fsoftware-development\u002Freact-component-refactoring\u002FSKILL.md",[224,227,230],{"categoryNo":225,"categoryName":226,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":228,"categoryName":229,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":81,"categoryName":82,"taxonomyType":75,"taxonomyTypeDesc":76},[232,233,234,235,236,237,238,239,177,240,241,124,242,180,243,211,244,245,246,247],"react","component","refactoring","component refactoring","react component","react component refactoring","frontend","writing","safe","typescript","react components","modular","refactor","simplify","patterns","test-driven-development"]