[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6JV5KW1MEV22NDN02NFSR3N":3,"skill-same:01M6JV5KW1MEV22NDN02NFSR3N":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":46,"ownerHtmlUrl":47,"ownerBlogUrl":48,"ownerDescription":49,"updatedAt":50,"install":51,"resources":64},"01M6JV5KW1MEV22NDN02NFSR3N","laravel-security",null,"Laravel security best practices for authn\u002Fauthz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.","hashgraph-online\u002Fawesome-codex-plugins","hashgraph-online","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F160371962?v=4","01M6CNB6NRJVNNGN14TR01Q6D3","HOL (Hashgraph Online)","01M6JT1HSKKG9V68KQAQGBA7XP",1575,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002FColin4k1024\u002Ftsp\u002Fskills\u002Flaravel-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34],"security","laravel","laravel security","secure","deployment","best practices","validation","security best practices","file","csrf","file uploads","secrets","uploads","rate limiting","for","rate","2026-11-10 10:12:30",false,"---\nname: laravel-security\ndescription: Laravel security best practices for authn\u002Fauthz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.\norigin: ECC\n---\n\n# Laravel Security Best Practices\n\nComprehensive security guidance for Laravel applications to protect against common vulnerabilities.\n\n## When to Activate\n\n- Adding authentication or authorization\n- Handling user input and file uploads\n- Building new API endpoints\n- Managing secrets and environment settings\n- Hardening production deployments\n\n## How It Works\n\n- Middleware provides baseline protections (CSRF via `VerifyCsrfToken`, security headers via `SecurityHeaders`).\n- Guards and policies enforce access control (`auth:sanctum`, `$this->authorize`, policy middleware).\n- Form Requests validate and shape input (`UploadInvoiceRequest`) before it reaches services.\n- Rate limiting adds abuse protection (`RateLimiter::for('login')`) alongside auth controls.\n- Data safety comes from encrypted casts, mass-assignment guards, and signed routes (`URL::temporarySignedRoute` + `signed` middleware).\n\n## Core Security Settings\n\n- `APP_DEBUG=false` in production\n- `APP_KEY` must be set and rotated on compromise\n- Set `SESSION_SECURE_COOKIE=true` and `SESSION_SAME_SITE=lax` (or `strict` for sensitive apps)\n- Configure trusted proxies for correct HTTPS detection\n\n## Session and Cookie Hardening\n\n- Set `SESSION_HTTP_ONLY=true` to prevent JavaScript access\n- Use `SESSION_SAME_SITE=strict` for high-risk flows\n- Regenerate sessions on login and privilege changes\n\n## Authentication and Tokens\n\n- Use Laravel Sanctum or Passport for API auth\n- Prefer short-lived tokens with refresh flows for sensitive data\n- Revoke tokens on logout and compromised accounts\n\nExample route protection:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::middleware('auth:sanctum')->get('\u002Fme', function (Request $request) {\n    return $request->user();\n});\n```\n\n## Password Security\n\n- Hash passwords with `Hash::make()` and never store plaintext\n- Use Laravel's password broker for reset flows\n\n```php\nuse Illuminate\\Support\\Facades\\Hash;\nuse Illuminate\\Validation\\Rules\\Password;\n\n$validated = $request->validate([\n    'password' => ['required', 'string', Password::min(12)->letters()->mixedCase()->numbers()->symbols()],\n]);\n\n$user->update(['password' => Hash::make($validated['password'])]);\n```\n\n## Authorization: Policies and Gates\n\n- Use policies for model-level authorization\n- Enforce authorization in controllers and services\n\n```php\n$this->authorize('update', $project);\n```\n\nUse policy middleware for route-level enforcement:\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::put('\u002Fprojects\u002F{project}', [ProjectController::class, 'update'])\n    ->middleware(['auth:sanctum', 'can:update,project']);\n```\n\n## Validation and Data Sanitization\n\n- Always validate inputs with Form Requests\n- Use strict validation rules and type checks\n- Never trust request payloads for derived fields\n\n## Mass Assignment Protection\n\n- Use `$fillable` or `$guarded` and avoid `Model::unguard()`\n- Prefer DTOs or explicit attribute mapping\n\n## SQL Injection Prevention\n\n- Use Eloquent or query builder parameter binding\n- Avoid raw SQL unless strictly necessary\n\n```php\nDB::select('select * from users where email = ?', [$email]);\n```\n\n## XSS Prevention\n\n- Blade escapes output by default (`{{ }}`)\n- Use `{!! !!}` only for trusted, sanitized HTML\n- Sanitize rich text with a dedicated library\n\n## CSRF Protection\n\n- Keep `VerifyCsrfToken` middleware enabled\n- Include `@csrf` in forms and send XSRF tokens for SPA requests\n\nFor SPA authentication with Sanctum, ensure stateful requests are configured:\n\n```php\n\u002F\u002F config\u002Fsanctum.php\n'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost')),\n```\n\n## File Upload Safety\n\n- Validate file size, MIME type, and extension\n- Store uploads outside the public path when possible\n- Scan files for malware if required\n\n```php\nfinal class UploadInvoiceRequest extends FormRequest\n{\n    public function authorize(): bool\n    {\n        return (bool) $this->user()?->can('upload-invoice');\n    }\n\n    public function rules(): array\n    {\n        return [\n            'invoice' => ['required', 'file', 'mimes:pdf', 'max:5120'],\n        ];\n    }\n}\n```\n\n```php\n$path = $request->file('invoice')->store(\n    'invoices',\n    config('filesystems.private_disk', 'local') \u002F\u002F set this to a non-public disk\n);\n```\n\n## Rate Limiting\n\n- Apply `throttle` middleware on auth and write endpoints\n- Use stricter limits for login, password reset, and OTP\n\n```php\nuse Illuminate\\Cache\\RateLimiting\\Limit;\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\RateLimiter;\n\nRateLimiter::for('login', function (Request $request) {\n    return [\n        Limit::perMinute(5)->by($request->ip()),\n        Limit::perMinute(5)->by(strtolower((string) $request->input('email'))),\n    ];\n});\n```\n\n## Secrets and Credentials\n\n- Never commit secrets to source control\n- Use environment variables and secret managers\n- Rotate keys after exposure and invalidate sessions\n\n## Encrypted Attributes\n\nUse encrypted casts for sensitive columns at rest.\n\n```php\nprotected $casts = [\n    'api_token' => 'encrypted',\n];\n```\n\n## Security Headers\n\n- Add CSP, HSTS, and frame protection where appropriate\n- Use trusted proxy configuration to enforce HTTPS redirects\n\nExample middleware to set headers:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Symfony\\Component\\HttpFoundation\\Response;\n\nfinal class SecurityHeaders\n{\n    public function handle(Request $request, \\Closure $next): Response\n    {\n        $response = $next($request);\n\n        $response->headers->add([\n            'Content-Security-Policy' => \"default-src 'self'\",\n            'Strict-Transport-Security' => 'max-age=31536000', \u002F\u002F add includeSubDomains\u002Fpreload only when all subdomains are HTTPS\n            'X-Frame-Options' => 'DENY',\n            'X-Content-Type-Options' => 'nosniff',\n            'Referrer-Policy' => 'no-referrer',\n        ]);\n\n        return $response;\n    }\n}\n```\n\n## CORS and API Exposure\n\n- Restrict origins in `config\u002Fcors.php`\n- Avoid wildcard origins for authenticated routes\n\n```php\n\u002F\u002F config\u002Fcors.php\nreturn [\n    'paths' => ['api\u002F*', 'sanctum\u002Fcsrf-cookie'],\n    'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n    'allowed_origins' => ['https:\u002F\u002Fapp.example.com'],\n    'allowed_headers' => [\n        'Content-Type',\n        'Authorization',\n        'X-Requested-With',\n        'X-XSRF-TOKEN',\n        'X-CSRF-TOKEN',\n    ],\n    'supports_credentials' => true,\n];\n```\n\n## Logging and PII\n\n- Never log passwords, tokens, or full card data\n- Redact sensitive fields in structured logs\n\n```php\nuse Illuminate\\Support\\Facades\\Log;\n\nLog::info('User updated profile', [\n    'user_id' => $user->id,\n    'email' => '[REDACTED]',\n    'token' => '[REDACTED]',\n]);\n```\n\n## Dependency Security\n\n- Run `composer audit` regularly\n- Pin dependencies with care and update promptly on CVEs\n\n## Signed URLs\n\nUse signed routes for temporary, tamper-proof links.\n\n```php\nuse Illuminate\\Support\\Facades\\URL;\n\n$url = URL::temporarySignedRoute(\n    'downloads.invoice',\n    now()->addMinutes(15),\n    ['invoice' => $invoice->id]\n);\n```\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::get('\u002Finvoices\u002F{invoice}\u002Fdownload', [InvoiceController::class, 'download'])\n    ->name('downloads.invoice')\n    ->middleware('signed');\n```\n","# Laravel Security Best Practices\n\nComprehensive security guidance for Laravel applications to protect against common vulnerabilities.\n\n## When to Activate\n\n- Adding authentication or authorization\n- Handling user input and file uploads\n- Building new API endpoints\n- Managing secrets and environment settings\n- Hardening production deployments\n\n## How It Works\n\n- Middleware provides baseline protections (CSRF via `VerifyCsrfToken`, security headers via `SecurityHeaders`).\n- Guards and policies enforce access control (`auth:sanctum`, `$this->authorize`, policy middleware).\n- Form Requests validate and shape input (`UploadInvoiceRequest`) before it reaches services.\n- Rate limiting adds abuse protection (`RateLimiter::for('login')`) alongside auth controls.\n- Data safety comes from encrypted casts, mass-assignment guards, and signed routes (`URL::temporarySignedRoute` + `signed` middleware).\n\n## Core Security Settings\n\n- `APP_DEBUG=false` in production\n- `APP_KEY` must be set and rotated on compromise\n- Set `SESSION_SECURE_COOKIE=true` and `SESSION_SAME_SITE=lax` (or `strict` for sensitive apps)\n- Configure trusted proxies for correct HTTPS detection\n\n## Session and Cookie Hardening\n\n- Set `SESSION_HTTP_ONLY=true` to prevent JavaScript access\n- Use `SESSION_SAME_SITE=strict` for high-risk flows\n- Regenerate sessions on login and privilege changes\n\n## Authentication and Tokens\n\n- Use Laravel Sanctum or Passport for API auth\n- Prefer short-lived tokens with refresh flows for sensitive data\n- Revoke tokens on logout and compromised accounts\n\nExample route protection:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::middleware('auth:sanctum')->get('\u002Fme', function (Request $request) {\n    return $request->user();\n});\n```\n\n## Password Security\n\n- Hash passwords with `Hash::make()` and never store plaintext\n- Use Laravel's password broker for reset flows\n\n```php\nuse Illuminate\\Support\\Facades\\Hash;\nuse Illuminate\\Validation\\Rules\\Password;\n\n$validated = $request->validate([\n    'password' => ['required', 'string', Password::min(12)->letters()->mixedCase()->numbers()->symbols()],\n]);\n\n$user->update(['password' => Hash::make($validated['password'])]);\n```\n\n## Authorization: Policies and Gates\n\n- Use policies for model-level authorization\n- Enforce authorization in controllers and services\n\n```php\n$this->authorize('update', $project);\n```\n\nUse policy middleware for route-level enforcement:\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::put('\u002Fprojects\u002F{project}', [ProjectController::class, 'update'])\n    ->middleware(['auth:sanctum', 'can:update,project']);\n```\n\n## Validation and Data Sanitization\n\n- Always validate inputs with Form Requests\n- Use strict validation rules and type checks\n- Never trust request payloads for derived fields\n\n## Mass Assignment Protection\n\n- Use `$fillable` or `$guarded` and avoid `Model::unguard()`\n- Prefer DTOs or explicit attribute mapping\n\n## SQL Injection Prevention\n\n- Use Eloquent or query builder parameter binding\n- Avoid raw SQL unless strictly necessary\n\n```php\nDB::select('select * from users where email = ?', [$email]);\n```\n\n## XSS Prevention\n\n- Blade escapes output by default (`{{ }}`)\n- Use `{!! !!}` only for trusted, sanitized HTML\n- Sanitize rich text with a dedicated library\n\n## CSRF Protection\n\n- Keep `VerifyCsrfToken` middleware enabled\n- Include `@csrf` in forms and send XSRF tokens for SPA requests\n\nFor SPA authentication with Sanctum, ensure stateful requests are configured:\n\n```php\n\u002F\u002F config\u002Fsanctum.php\n'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost')),\n```\n\n## File Upload Safety\n\n- Validate file size, MIME type, and extension\n- Store uploads outside the public path when possible\n- Scan files for malware if required\n\n```php\nfinal class UploadInvoiceRequest extends FormRequest\n{\n    public function authorize(): bool\n    {\n        return (bool) $this->user()?->can('upload-invoice');\n    }\n\n    public function rules(): array\n    {\n        return [\n            'invoice' => ['required', 'file', 'mimes:pdf', 'max:5120'],\n        ];\n    }\n}\n```\n\n```php\n$path = $request->file('invoice')->store(\n    'invoices',\n    config('filesystems.private_disk', 'local') \u002F\u002F set this to a non-public disk\n);\n```\n\n## Rate Limiting\n\n- Apply `throttle` middleware on auth and write endpoints\n- Use stricter limits for login, password reset, and OTP\n\n```php\nuse Illuminate\\Cache\\RateLimiting\\Limit;\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\RateLimiter;\n\nRateLimiter::for('login', function (Request $request) {\n    return [\n        Limit::perMinute(5)->by($request->ip()),\n        Limit::perMinute(5)->by(strtolower((string) $request->input('email'))),\n    ];\n});\n```\n\n## Secrets and Credentials\n\n- Never commit secrets to source control\n- Use environment variables and secret managers\n- Rotate keys after exposure and invalidate sessions\n\n## Encrypted Attributes\n\nUse encrypted casts for sensitive columns at rest.\n\n```php\nprotected $casts = [\n    'api_token' => 'encrypted',\n];\n```\n\n## Security Headers\n\n- Add CSP, HSTS, and frame protection where appropriate\n- Use trusted proxy configuration to enforce HTTPS redirects\n\nExample middleware to set headers:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Symfony\\Component\\HttpFoundation\\Response;\n\nfinal class SecurityHeaders\n{\n    public function handle(Request $request, \\Closure $next): Response\n    {\n        $response = $next($request);\n\n        $response->headers->add([\n            'Content-Security-Policy' => \"default-src 'self'\",\n            'Strict-Transport-Security' => 'max-age=31536000', \u002F\u002F add includeSubDomains\u002Fpreload only when all subdomains are HTTPS\n            'X-Frame-Options' => 'DENY',\n            'X-Content-Type-Options' => 'nosniff',\n            'Referrer-Policy' => 'no-referrer',\n        ]);\n\n        return $response;\n    }\n}\n```\n\n## CORS and API Exposure\n\n- Restrict origins in `config\u002Fcors.php`\n- Avoid wildcard origins for authenticated routes\n\n```php\n\u002F\u002F config\u002Fcors.php\nreturn [\n    'paths' => ['api\u002F*', 'sanctum\u002Fcsrf-cookie'],\n    'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n    'allowed_origins' => ['https:\u002F\u002Fapp.example.com'],\n    'allowed_headers' => [\n        'Content-Type',\n        'Authorization',\n        'X-Requested-With',\n        'X-XSRF-TOKEN',\n        'X-CSRF-TOKEN',\n    ],\n    'supports_credentials' => true,\n];\n```\n\n## Logging and PII\n\n- Never log passwords, tokens, or full card data\n- Redact sensitive fields in structured logs\n\n```php\nuse Illuminate\\Support\\Facades\\Log;\n\nLog::info('User updated profile', [\n    'user_id' => $user->id,\n    'email' => '[REDACTED]',\n    'token' => '[REDACTED]',\n]);\n```\n\n## Dependency Security\n\n- Run `composer audit` regularly\n- Pin dependencies with care and update promptly on CVEs\n\n## Signed URLs\n\nUse signed routes for temporary, tamper-proof links.\n\n```php\nuse Illuminate\\Support\\Facades\\URL;\n\n$url = URL::temporarySignedRoute(\n    'downloads.invoice',\n    now()->addMinutes(15),\n    ['invoice' => $invoice->id]\n);\n```\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::get('\u002Finvoices\u002F{invoice}\u002Fdownload', [InvoiceController::class, 'download'])\n    ->name('downloads.invoice')\n    ->middleware('signed');\n```\n",{"name":5,"origin":40,"description":7},"ECC","main","b0f0a87593c578a7898eccaf1b363f7f87c1f99b","plugins\u002FColin4k1024\u002Ftsp\u002Fskills\u002Flaravel-security",491,"https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins","https:\u002F\u002Fhol.org\u002Fplugins\u002Fbest-codex-plugins","https:\u002F\u002Fgithub.com\u002Fhashgraph-online","https:\u002F\u002Fhol.org","Open-source standards and developer tools for interoperable AI agents: discovery, identity, communication, payments, privacy and security.","2026-11-14 14:06:13",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add hashgraph-online\u002Fawesome-codex-plugins --skill laravel-security",{"tool":57,"command":58},"bunx","bunx skills add hashgraph-online\u002Fawesome-codex-plugins --skill laravel-security",{"tool":60,"command":61},"pnpm","pnpm dlx skills add hashgraph-online\u002Fawesome-codex-plugins --skill laravel-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002FColin4k1024\u002Ftsp\u002Fskills\u002Flaravel-security\u002FSKILL.md",true,[],[66,74,81,88,115,140],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":73},"01M746ZWACVKMZ1BJXJZHYJSSX","migrate-to-e2e","Moves an existing Playwright, Cypress, Selenium, Appium, Detox, Maestro, or TesterArmy suite to e2e one slice at a time, with the old suite running beside the new one until each ported test is proven. Keeps a MIGRATION.md progress file so any later session resumes where the last stopped. Optionally plants a defect to show both suites catch it. Use for \u002Fmigrate-to-e2e, \"migrate our tests to e2e\", \"port these Maestro flows\", \"move our TesterArmy tests\", or when a project has an e2e config and an older suite still running.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fmigrate-to-e2e\u002FSKILL.md",[],[],"2026-11-11 15:11:14",{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":73},"01M746ZPTAX1Q0FBKAB1CYND7E","e2e","Writes, runs, and debugs end-to-end tests for web and mobile apps with e2e, the agentic test runner, which mixes agent.act goals with exact locator assertions on a Playwright browser or an iOS or Android device. Also drives a project's running app live over the e2e MCP server to look at a screen, check a UI change, take a screenshot or record a video, and try a locator; and runs bug bashes, parallel e2e explore runs with each bug proven by a repro test. Use when a project depends on e2e or has an e2e.config.ts, when asked for end-to-end, browser, mobile, or agentic UI tests, to check a change in the running app, to QA or bug bash an app or branch, or when an e2e run fails.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fe2e\u002FSKILL.md",[],[],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":73},"01M746ZJN784HVHMDP9MQGCSGG","create-verification-skill","Generate a project-local verify-\u003Capp> skill on top of e2e, so any coding agent can launch the app, check it is worth driving, exercise a feature the way a user does, keep evidence, and bug bash it. Writes the skill, a feature map with one explore charter per feature, and proves it once. Use for \u002Fcreate-verification-skill, \"make a verification skill for this repo\", or when a project has no scripted way to prove UI behavior.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fcreate-verification-skill\u002FSKILL.md",[],[],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":35},"01M716A6ETNB9B1SQ3GXZC75VR","deja-search","deja-vu memory — search the user's past AI coding sessions with the deja CLI. Holds what they already settled and never wrote into the repo (naming rules, banned or already-tried tools, required checks before merge, preferred values, who owns what). Use before your first edit in a task, before you call a change done or ready to merge, before you recommend a tool, library, design or reviewer, before re-debugging an error that may already be solved, when they say 'didn't we fix this before', 'what did we decide about X' or 'I already have that', and before telling them something on this machine does not exist.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fvshulcz\u002Fdeja-vu\u002Fskills\u002Fdeja-search\u002FSKILL.md",[],[95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114],"search","deja search","never","error","ready","memory","re","decide","fix","design","debugging","when","you","done","reviewer","io","change","cli","merge","past",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":35},"01M716A3J2W5SENSE9VGMXB375","deja-reflect","End-of-session reflection and memory curation with deja-vu. Review what was decided, what commands broke and what repaired them, and record durable project rules or decisions with deja remember so the next session starts with them.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fvshulcz\u002Fdeja-vu\u002Fskills\u002Fdeja-reflect\u002FSKILL.md",[],[122,123,124,110,125,126,127,128,129,130,131,132,133,134,100,135,136,137,138,139],"deja reflect","reflect","review","with","record","github","next","https","node","Rules","decisions","brew","remember","project rules","project","session","end","reflection",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":157,"publishedAt":35},"01M715T3RR4BAYSR57HPPTJ0PF","revid","Make, edit, export and post AI videos with Revid (revid.ai) through the Revid MCP server. Use whenever the user wants a short-form or long-form video made (from an idea, a script, a URL, an article, a PDF, a tweet, a product page, their own clips, or a song), wants to find what is going viral on TikTok, YouTube, Instagram or X before making something, wants to edit or re-export an existing Revid project, generate a standalone AI image or clip, make a series episode, or publish and schedule a finished video to connected social accounts. Covers setup (hosted MCP with OAuth, or an API key), the 36 tools, credits, polling and the rules for publishing. Routes to the more specific revid-* skills when one fits.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftmakersas\u002Frevid-skills\u002Fskills\u002Frevid\u002FSKILL.md",[146,151,154],{"categoryNo":147,"categoryName":148,"taxonomyType":149,"taxonomyTypeDesc":150},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",{"categoryNo":152,"categoryName":153,"taxonomyType":149,"taxonomyTypeDesc":150},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":155,"categoryName":156,"taxonomyType":149,"taxonomyTypeDesc":150},"01JBSEEDCAT000000000000010","后端与接口",[142,158,159,160,161,162,163,136,164,101,165,166,167,168,106,169,170,171,172,173],"URL","Video","short-form","standalone","PDF","viral","tiktok","short","social","MCP","song","image","mcp server","schedule","api","publish"]