[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6JVCWYRZM8FV1ZHT64VYQFP":3,"skill-same:01M6JVCWYRZM8FV1ZHT64VYQFP":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":52,"ownerHtmlUrl":53,"ownerBlogUrl":54,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M6JVCWYRZM8FV1ZHT64VYQFP","security-scan",null,"Scan your Claude Code configuration (.claude\u002F directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.","hashgraph-online\u002Fawesome-codex-plugins","hashgraph-online","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F160371962?v=4","01M6CNB6NRJVNNGN14TR01Q6D3","HOL (Hashgraph Online)","01M6JT1HSKKG9V68KQAQGBA7XP",1559,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002FColin4k1024\u002Ftsp\u002Fskills\u002Fsecurity-scan\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"security","security scan","scan","json","servers","agentshield","for","configuration","settings.json","hooks","settings","MCP","injection","mcp servers","code","vulnerabilities","directory","2026-11-10 10:12:30",false,"---\nname: security-scan\ndescription: Scan your Claude Code configuration (.claude\u002F directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.\norigin: ECC\n---\n\n# Security Scan Skill\n\nAudit your Claude Code configuration for security issues using [AgentShield](https:\u002F\u002Fgithub.com\u002Faffaan-m\u002Fagentshield).\n\n## When to Activate\n\n- Setting up a new Claude Code project\n- After modifying `.claude\u002Fsettings.json`, `CLAUDE.md`, or MCP configs\n- Before committing configuration changes\n- When onboarding to a new repository with existing Claude Code configs\n- Periodic security hygiene checks\n\n## What It Scans\n\n| File | Checks |\n|------|--------|\n| `CLAUDE.md` | Hardcoded secrets, auto-run instructions, prompt injection patterns |\n| `settings.json` | Overly permissive allow lists, missing deny lists, dangerous bypass flags |\n| `mcp.json` | Risky MCP servers, hardcoded env secrets, npx supply chain risks |\n| `hooks\u002F` | Command injection via interpolation, data exfiltration, silent error suppression |\n| `agents\u002F*.md` | Unrestricted tool access, prompt injection surface, missing model specs |\n\n## Prerequisites\n\nAgentShield must be installed. Check and install if needed:\n\n```bash\n# Check if installed\nnpx ecc-agentshield --version\n\n# Install globally (recommended)\nnpm install -g ecc-agentshield\n\n# Or run directly via npx (no install needed)\nnpx ecc-agentshield scan .\n```\n\n## Usage\n\n### Basic Scan\n\nRun against the current project's `.claude\u002F` directory:\n\n```bash\n# Scan current project\nnpx ecc-agentshield scan\n\n# Scan a specific path\nnpx ecc-agentshield scan --path \u002Fpath\u002Fto\u002F.claude\n\n# Scan with minimum severity filter\nnpx ecc-agentshield scan --min-severity medium\n```\n\n### Output Formats\n\n```bash\n# Terminal output (default) — colored report with grade\nnpx ecc-agentshield scan\n\n# JSON — for CI\u002FCD integration\nnpx ecc-agentshield scan --format json\n\n# Markdown — for documentation\nnpx ecc-agentshield scan --format markdown\n\n# HTML — self-contained dark-theme report\nnpx ecc-agentshield scan --format html > security-report.html\n```\n\n### Auto-Fix\n\nApply safe fixes automatically (only fixes marked as auto-fixable):\n\n```bash\nnpx ecc-agentshield scan --fix\n```\n\nThis will:\n- Replace hardcoded secrets with environment variable references\n- Tighten wildcard permissions to scoped alternatives\n- Never modify manual-only suggestions\n\n### Opus 4.6 Deep Analysis\n\nRun the adversarial three-agent pipeline for deeper analysis:\n\n```bash\n# Requires ANTHROPIC_API_KEY\nexport ANTHROPIC_API_KEY=your-key\nnpx ecc-agentshield scan --opus --stream\n```\n\nThis runs:\n1. **Attacker (Red Team)** — finds attack vectors\n2. **Defender (Blue Team)** — recommends hardening\n3. **Auditor (Final Verdict)** — synthesizes both perspectives\n\n### Initialize Secure Config\n\nScaffold a new secure `.claude\u002F` configuration from scratch:\n\n```bash\nnpx ecc-agentshield init\n```\n\nCreates:\n- `settings.json` with scoped permissions and deny list\n- `CLAUDE.md` with security best practices\n- `mcp.json` placeholder\n\n### GitHub Action\n\nAdd to your CI pipeline:\n\n```yaml\n- uses: affaan-m\u002Fagentshield@v1\n  with:\n    path: '.'\n    min-severity: 'medium'\n    fail-on-findings: true\n```\n\n## Severity Levels\n\n| Grade | Score | Meaning |\n|-------|-------|---------|\n| A | 90-100 | Secure configuration |\n| B | 75-89 | Minor issues |\n| C | 60-74 | Needs attention |\n| D | 40-59 | Significant risks |\n| F | 0-39 | Critical vulnerabilities |\n\n## Interpreting Results\n\n### Critical Findings (fix immediately)\n- Hardcoded API keys or tokens in config files\n- `Bash(*)` in the allow list (unrestricted shell access)\n- Command injection in hooks via `${file}` interpolation\n- Shell-running MCP servers\n\n### High Findings (fix before production)\n- Auto-run instructions in CLAUDE.md (prompt injection vector)\n- Missing deny lists in permissions\n- Agents with unnecessary Bash access\n\n### Medium Findings (recommended)\n- Silent error suppression in hooks (`2>\u002Fdev\u002Fnull`, `|| true`)\n- Missing PreToolUse security hooks\n- `npx -y` auto-install in MCP server configs\n\n### Info Findings (awareness)\n- Missing descriptions on MCP servers\n- Prohibitive instructions correctly flagged as good practice\n\n## Links\n\n- **GitHub**: [github.com\u002Faffaan-m\u002Fagentshield](https:\u002F\u002Fgithub.com\u002Faffaan-m\u002Fagentshield)\n- **npm**: [npmjs.com\u002Fpackage\u002Fecc-agentshield](https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002Fecc-agentshield)\n","# Security Scan Skill\n\nAudit your Claude Code configuration for security issues using [AgentShield](https:\u002F\u002Fgithub.com\u002Faffaan-m\u002Fagentshield).\n\n## When to Activate\n\n- Setting up a new Claude Code project\n- After modifying `.claude\u002Fsettings.json`, `CLAUDE.md`, or MCP configs\n- Before committing configuration changes\n- When onboarding to a new repository with existing Claude Code configs\n- Periodic security hygiene checks\n\n## What It Scans\n\n| File | Checks |\n|------|--------|\n| `CLAUDE.md` | Hardcoded secrets, auto-run instructions, prompt injection patterns |\n| `settings.json` | Overly permissive allow lists, missing deny lists, dangerous bypass flags |\n| `mcp.json` | Risky MCP servers, hardcoded env secrets, npx supply chain risks |\n| `hooks\u002F` | Command injection via interpolation, data exfiltration, silent error suppression |\n| `agents\u002F*.md` | Unrestricted tool access, prompt injection surface, missing model specs |\n\n## Prerequisites\n\nAgentShield must be installed. Check and install if needed:\n\n```bash\n# Check if installed\nnpx ecc-agentshield --version\n\n# Install globally (recommended)\nnpm install -g ecc-agentshield\n\n# Or run directly via npx (no install needed)\nnpx ecc-agentshield scan .\n```\n\n## Usage\n\n### Basic Scan\n\nRun against the current project's `.claude\u002F` directory:\n\n```bash\n# Scan current project\nnpx ecc-agentshield scan\n\n# Scan a specific path\nnpx ecc-agentshield scan --path \u002Fpath\u002Fto\u002F.claude\n\n# Scan with minimum severity filter\nnpx ecc-agentshield scan --min-severity medium\n```\n\n### Output Formats\n\n```bash\n# Terminal output (default) — colored report with grade\nnpx ecc-agentshield scan\n\n# JSON — for CI\u002FCD integration\nnpx ecc-agentshield scan --format json\n\n# Markdown — for documentation\nnpx ecc-agentshield scan --format markdown\n\n# HTML — self-contained dark-theme report\nnpx ecc-agentshield scan --format html > security-report.html\n```\n\n### Auto-Fix\n\nApply safe fixes automatically (only fixes marked as auto-fixable):\n\n```bash\nnpx ecc-agentshield scan --fix\n```\n\nThis will:\n- Replace hardcoded secrets with environment variable references\n- Tighten wildcard permissions to scoped alternatives\n- Never modify manual-only suggestions\n\n### Opus 4.6 Deep Analysis\n\nRun the adversarial three-agent pipeline for deeper analysis:\n\n```bash\n# Requires ANTHROPIC_API_KEY\nexport ANTHROPIC_API_KEY=your-key\nnpx ecc-agentshield scan --opus --stream\n```\n\nThis runs:\n1. **Attacker (Red Team)** — finds attack vectors\n2. **Defender (Blue Team)** — recommends hardening\n3. **Auditor (Final Verdict)** — synthesizes both perspectives\n\n### Initialize Secure Config\n\nScaffold a new secure `.claude\u002F` configuration from scratch:\n\n```bash\nnpx ecc-agentshield init\n```\n\nCreates:\n- `settings.json` with scoped permissions and deny list\n- `CLAUDE.md` with security best practices\n- `mcp.json` placeholder\n\n### GitHub Action\n\nAdd to your CI pipeline:\n\n```yaml\n- uses: affaan-m\u002Fagentshield@v1\n  with:\n    path: '.'\n    min-severity: 'medium'\n    fail-on-findings: true\n```\n\n## Severity Levels\n\n| Grade | Score | Meaning |\n|-------|-------|---------|\n| A | 90-100 | Secure configuration |\n| B | 75-89 | Minor issues |\n| C | 60-74 | Needs attention |\n| D | 40-59 | Significant risks |\n| F | 0-39 | Critical vulnerabilities |\n\n## Interpreting Results\n\n### Critical Findings (fix immediately)\n- Hardcoded API keys or tokens in config files\n- `Bash(*)` in the allow list (unrestricted shell access)\n- Command injection in hooks via `${file}` interpolation\n- Shell-running MCP servers\n\n### High Findings (fix before production)\n- Auto-run instructions in CLAUDE.md (prompt injection vector)\n- Missing deny lists in permissions\n- Agents with unnecessary Bash access\n\n### Medium Findings (recommended)\n- Silent error suppression in hooks (`2>\u002Fdev\u002Fnull`, `|| true`)\n- Missing PreToolUse security hooks\n- `npx -y` auto-install in MCP server configs\n\n### Info Findings (awareness)\n- Missing descriptions on MCP servers\n- Prohibitive instructions correctly flagged as good practice\n\n## Links\n\n- **GitHub**: [github.com\u002Faffaan-m\u002Fagentshield](https:\u002F\u002Fgithub.com\u002Faffaan-m\u002Fagentshield)\n- **npm**: [npmjs.com\u002Fpackage\u002Fecc-agentshield](https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002Fecc-agentshield)\n",{"name":5,"origin":46,"description":7},"ECC","main","b0f0a87593c578a7898eccaf1b363f7f87c1f99b","plugins\u002FColin4k1024\u002Ftsp\u002Fskills\u002Fsecurity-scan",474,"https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins","https:\u002F\u002Fhol.org\u002Fplugins\u002Fbest-codex-plugins","https:\u002F\u002Fgithub.com\u002Fhashgraph-online","https:\u002F\u002Fhol.org","Open-source standards and developer tools for interoperable AI agents: discovery, identity, communication, payments, privacy and security.","2026-11-11 14:40:14",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add hashgraph-online\u002Fawesome-codex-plugins --skill security-scan",{"tool":63,"command":64},"bunx","bunx skills add hashgraph-online\u002Fawesome-codex-plugins --skill security-scan",{"tool":66,"command":67},"pnpm","pnpm dlx skills add hashgraph-online\u002Fawesome-codex-plugins --skill security-scan","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002FColin4k1024\u002Ftsp\u002Fskills\u002Fsecurity-scan\u002FSKILL.md",true,[],[72,80,87,94,121,146],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":79},"01M746ZWACVKMZ1BJXJZHYJSSX","migrate-to-e2e","Moves an existing Playwright, Cypress, Selenium, Appium, Detox, Maestro, or TesterArmy suite to e2e one slice at a time, with the old suite running beside the new one until each ported test is proven. Keeps a MIGRATION.md progress file so any later session resumes where the last stopped. Optionally plants a defect to show both suites catch it. Use for \u002Fmigrate-to-e2e, \"migrate our tests to e2e\", \"port these Maestro flows\", \"move our TesterArmy tests\", or when a project has an e2e config and an older suite still running.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fmigrate-to-e2e\u002FSKILL.md",[],[],"2026-11-11 15:11:14",{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":79},"01M746ZPTAX1Q0FBKAB1CYND7E","e2e","Writes, runs, and debugs end-to-end tests for web and mobile apps with e2e, the agentic test runner, which mixes agent.act goals with exact locator assertions on a Playwright browser or an iOS or Android device. Also drives a project's running app live over the e2e MCP server to look at a screen, check a UI change, take a screenshot or record a video, and try a locator; and runs bug bashes, parallel e2e explore runs with each bug proven by a repro test. Use when a project depends on e2e or has an e2e.config.ts, when asked for end-to-end, browser, mobile, or agentic UI tests, to check a change in the running app, to QA or bug bash an app or branch, or when an e2e run fails.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fe2e\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":79},"01M746ZJN784HVHMDP9MQGCSGG","create-verification-skill","Generate a project-local verify-\u003Capp> skill on top of e2e, so any coding agent can launch the app, check it is worth driving, exercise a feature the way a user does, keep evidence, and bug bash it. Writes the skill, a feature map with one explore charter per feature, and proves it once. Use for \u002Fcreate-verification-skill, \"make a verification skill for this repo\", or when a project has no scripted way to prove UI behavior.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fcreate-verification-skill\u002FSKILL.md",[],[],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":41},"01M716A6ETNB9B1SQ3GXZC75VR","deja-search","deja-vu memory — search the user's past AI coding sessions with the deja CLI. Holds what they already settled and never wrote into the repo (naming rules, banned or already-tried tools, required checks before merge, preferred values, who owns what). Use before your first edit in a task, before you call a change done or ready to merge, before you recommend a tool, library, design or reviewer, before re-debugging an error that may already be solved, when they say 'didn't we fix this before', 'what did we decide about X' or 'I already have that', and before telling them something on this machine does not exist.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fvshulcz\u002Fdeja-vu\u002Fskills\u002Fdeja-search\u002FSKILL.md",[],[101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120],"search","deja search","never","error","ready","memory","re","decide","fix","design","debugging","when","you","done","reviewer","io","change","cli","merge","past",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":41},"01M716A3J2W5SENSE9VGMXB375","deja-reflect","End-of-session reflection and memory curation with deja-vu. Review what was decided, what commands broke and what repaired them, and record durable project rules or decisions with deja remember so the next session starts with them.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fvshulcz\u002Fdeja-vu\u002Fskills\u002Fdeja-reflect\u002FSKILL.md",[],[128,129,130,116,131,132,133,134,135,136,137,138,139,140,106,141,142,143,144,145],"deja reflect","reflect","review","with","record","github","next","https","node","Rules","decisions","brew","remember","project rules","project","session","end","reflection",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":159,"publishedAt":41},"01M715T3RR4BAYSR57HPPTJ0PF","revid","Make, edit, export and post AI videos with Revid (revid.ai) through the Revid MCP server. Use whenever the user wants a short-form or long-form video made (from an idea, a script, a URL, an article, a PDF, a tweet, a product page, their own clips, or a song), wants to find what is going viral on TikTok, YouTube, Instagram or X before making something, wants to edit or re-export an existing Revid project, generate a standalone AI image or clip, make a series episode, or publish and schedule a finished video to connected social accounts. Covers setup (hosted MCP with OAuth, or an API key), the 36 tools, credits, polling and the rules for publishing. Routes to the more specific revid-* skills when one fits.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftmakersas\u002Frevid-skills\u002Fskills\u002Frevid\u002FSKILL.md",[152,155,156],{"categoryNo":153,"categoryName":154,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":157,"categoryName":158,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",[148,160,161,162,163,164,165,142,166,107,167,168,35,169,112,170,171,172,173,174],"URL","Video","short-form","standalone","PDF","viral","tiktok","short","social","song","image","mcp server","schedule","api","publish"]