[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6MMGEJFM9VRZG924G8SJAXT":3,"skill-same:01M6MMGEJFM9VRZG924G8SJAXT":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6MMGEJFM9VRZG924G8SJAXT","river-review-security",null,"セキュリティ観点の通常レビューエージェント。\n基本的なセキュリティチェック、認証・認可設計、プライバシー設計の個別スキルへルーティングする。\nrepository \u002F subsystem の明示的な security audit は river-review-security-audit へ委譲する。","hashgraph-online\u002Fawesome-codex-plugins","hashgraph-online","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F160371962?v=4","01M6CNB6NRJVNNGN14TR01Q6D3","HOL (Hashgraph Online)","01M6JT1HSKKG9V68KQAQGBA7XP",1571,"MIT","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fs977043\u002Friver-review\u002Fskills\u002Fagent-skills\u002Friver-review-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"security","river review","river review security","river","review security","review","audit","auth","entry","jsx","routing","middleware","env","critical","repository","tsx","diff","src","js","security audit","security-audit","actions","2026-11-10 10:12:30",false,"---\nid: river-review-security\nname: river-review-security\ndescription: |\n  セキュリティ観点の通常レビューエージェント。\n  基本的なセキュリティチェック、認証・認可設計、プライバシー設計の個別スキルへルーティングする。\n  repository \u002F subsystem の明示的な security audit は river-review-security-audit へ委譲する。\ncategory: midstream\nphase: [midstream]\nseverity: critical\napplyTo:\n  - 'src\u002F**\u002F*.{ts,tsx,js,jsx,mjs}'\n  - '**\u002F*.env*'\n  - '**\u002Fauth\u002F**\u002F*'\n  - '**\u002Fmiddleware\u002F**\u002F*'\ninputContext: [diff, fullFile]\noutputKind: [findings, actions]\ntags: [security, entry, routing]\nversion: 0.2.0\nlicense: MIT\n---\n\n# Security Review（セキュリティレビュー）\n\nセキュリティに影響する変更を検出し、適切な個別スキルで検証する。\n\n## When to Use \u002F いつ使うか\n\n- 認証・認可に関わるコード変更時\n- 外部入力の処理ロジック変更時\n- 機密データの取り扱い変更時\n- セキュリティ関連の設定変更時\n- 通常の PR \u002F diff に対するセキュリティレビュー時\n\n## Security Audit Handoff\n\nこの skill は通常の diff-oriented security review を担当する。\nユーザーが repository-wide audit、subsystem audit、full security audit など、現在の diff を越える明示的な監査を要求した場合は `river-review-security-audit` へ委譲する。\n\n```text\nPR \u002F diff security review\n  -> river-review-security\n\nrepository \u002F subsystem security audit\n  -> river-review-security-audit\n```\n\n単に「セキュリティ観点でレビュー」と指定された場合は本 skill を継続する。\n`security audit` という語だけで full repository audit を推測しない。対象範囲が repository \u002F subsystem \u002F bounded source surface として明示されている場合だけ handoff する。\n\n## Routing \u002F ルーティング\n\n| キーワード                          | スキルID                  | 説明                     |\n| ----------------------------------- | ------------------------- | ------------------------ |\n| 脆弱性, XSS, SQLi, インジェクション | `security-basic`          | 基本セキュリティチェック |\n| プライバシー, 個人情報, GDPR        | `security-privacy-design` | プライバシー設計         |\n| 認可, 権限, アクセス制御            | `trust-boundaries-authz`  | 信頼境界・認可設計       |\n\n### デフォルト動作\n\n- キーワード指定なし → `security-basic` を実行\n- セキュリティ関連ファイル（auth\u002F, middleware\u002F）→ 全スキル実行\n\n## Execution Flow \u002F 実行フロー\n\n```text\n0. 監査要求の判定\n   ├─ 明示的な repository\u002Fsubsystem audit → river-review-security-audit へ委譲\n   └─ 通常 PR\u002Fdiff review → 以下を継続\n\n1. 変更内容の分類\n   ├─ 認証・認可コード → trust-boundaries-authz を優先\n   ├─ データ処理コード → security-privacy-design を優先\n   └─ 一般コード → security-basic を実行\n\n2. 各スキルの実行\n   ├─ security-basic: OWASP Top 10チェック\n   ├─ security-privacy-design: プライバシー影響分析\n   └─ trust-boundaries-authz: 認可モデル検証\n\n3. 統合サマリの生成\n```\n\n## Output Format \u002F 出力形式\n\n```text\n\u003Cfile>:\u003Cline>: \u003Cmessage>\n```\n\n- **Finding**: 何が問題か（1文）\n- **Severity**: critical \u002F major \u002F minor\n- **Impact**: 何が困るか（短く）\n- **Fix**: 次の一手（最小の修正案）\n\n## 他スキルとの関係\n\n`river-review-security-audit` は通常 diff review ではなく、明示的な repository \u002F subsystem audit を担当する委譲先である。\n\n| スキル                          | 関係 | 棲み分け                                                   |\n| ------------------------------- | ---- | ---------------------------------------------------------- |\n| `adversarial-review` (War Game) | 補完 | security は既知パターン検出、War Game は未知の攻撃経路発見 |\n| `river-review-architecture`     | 補完 | security は「脆弱性」、architecture は「構造的安全性」     |\n\n## References\n\n- [ROUTING.md](.\u002Freferences\u002FROUTING.md): 詳細なルーティングルール\n","# Security Review（セキュリティレビュー）\n\nセキュリティに影響する変更を検出し、適切な個別スキルで検証する。\n\n## When to Use \u002F いつ使うか\n\n- 認証・認可に関わるコード変更時\n- 外部入力の処理ロジック変更時\n- 機密データの取り扱い変更時\n- セキュリティ関連の設定変更時\n- 通常の PR \u002F diff に対するセキュリティレビュー時\n\n## Security Audit Handoff\n\nこの skill は通常の diff-oriented security review を担当する。\nユーザーが repository-wide audit、subsystem audit、full security audit など、現在の diff を越える明示的な監査を要求した場合は `river-review-security-audit` へ委譲する。\n\n```text\nPR \u002F diff security review\n  -> river-review-security\n\nrepository \u002F subsystem security audit\n  -> river-review-security-audit\n```\n\n単に「セキュリティ観点でレビュー」と指定された場合は本 skill を継続する。\n`security audit` という語だけで full repository audit を推測しない。対象範囲が repository \u002F subsystem \u002F bounded source surface として明示されている場合だけ handoff する。\n\n## Routing \u002F ルーティング\n\n| キーワード                          | スキルID                  | 説明                     |\n| ----------------------------------- | ------------------------- | ------------------------ |\n| 脆弱性, XSS, SQLi, インジェクション | `security-basic`          | 基本セキュリティチェック |\n| プライバシー, 個人情報, GDPR        | `security-privacy-design` | プライバシー設計         |\n| 認可, 権限, アクセス制御            | `trust-boundaries-authz`  | 信頼境界・認可設計       |\n\n### デフォルト動作\n\n- キーワード指定なし → `security-basic` を実行\n- セキュリティ関連ファイル（auth\u002F, middleware\u002F）→ 全スキル実行\n\n## Execution Flow \u002F 実行フロー\n\n```text\n0. 監査要求の判定\n   ├─ 明示的な repository\u002Fsubsystem audit → river-review-security-audit へ委譲\n   └─ 通常 PR\u002Fdiff review → 以下を継続\n\n1. 変更内容の分類\n   ├─ 認証・認可コード → trust-boundaries-authz を優先\n   ├─ データ処理コード → security-privacy-design を優先\n   └─ 一般コード → security-basic を実行\n\n2. 各スキルの実行\n   ├─ security-basic: OWASP Top 10チェック\n   ├─ security-privacy-design: プライバシー影響分析\n   └─ trust-boundaries-authz: 認可モデル検証\n\n3. 統合サマリの生成\n```\n\n## Output Format \u002F 出力形式\n\n```text\n\u003Cfile>:\u003Cline>: \u003Cmessage>\n```\n\n- **Finding**: 何が問題か（1文）\n- **Severity**: critical \u002F major \u002F minor\n- **Impact**: 何が困るか（短く）\n- **Fix**: 次の一手（最小の修正案）\n\n## 他スキルとの関係\n\n`river-review-security-audit` は通常 diff review ではなく、明示的な repository \u002F subsystem audit を担当する委譲先である。\n\n| スキル                          | 関係 | 棲み分け                                                   |\n| ------------------------------- | ---- | ---------------------------------------------------------- |\n| `adversarial-review` (War Game) | 補完 | security は既知パターン検出、War Game は未知の攻撃経路発見 |\n| `river-review-architecture`     | 補完 | security は「脆弱性」、architecture は「構造的安全性」     |\n\n## References\n\n- [ROUTING.md](.\u002Freferences\u002FROUTING.md): 詳細なルーティングルール\n",{"id":5,"name":5,"tags":46,"phase":47,"applyTo":49,"license":15,"version":54,"category":48,"severity":32,"outputKind":55,"description":57,"inputContext":58},[19,27,29],[48],"midstream",[50,51,52,53],"src\u002F**\u002F*.{ts,tsx,js,jsx,mjs}","**\u002F*.env*","**\u002Fauth\u002F**\u002F*","**\u002Fmiddleware\u002F**\u002F*","0.2.0",[56,40],"findings","セキュリティ観点の通常レビューエージェント。\n基本的なセキュリティチェック、認証・認可設計、プライバシー設計の個別スキルへルーティングする。\nrepository \u002F subsystem の明示的な security audit は river-review-security-audit へ委譲する。\n",[35,59],"fullFile","main","2b63f856ce19c2a797929cacabd9e0fc936812fa","plugins\u002Fs977043\u002Friver-review\u002Fskills\u002Fagent-skills\u002Friver-review-security",490,"https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins","https:\u002F\u002Fhol.org\u002Fplugins\u002Fbest-codex-plugins","https:\u002F\u002Fgithub.com\u002Fhashgraph-online","https:\u002F\u002Fhol.org","Open-source standards and developer tools for interoperable AI agents: discovery, identity, communication, payments, privacy and security.","2026-11-14 02:12:02",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add hashgraph-online\u002Fawesome-codex-plugins --skill river-review-security",{"tool":76,"command":77},"bunx","bunx skills add hashgraph-online\u002Fawesome-codex-plugins --skill river-review-security",{"tool":79,"command":80},"pnpm","pnpm dlx skills add hashgraph-online\u002Fawesome-codex-plugins --skill river-review-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fs977043\u002Friver-review\u002Fskills\u002Fagent-skills\u002Friver-review-security\u002FSKILL.md",true,[84],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002FROUTING.md","REFERENCE","参考文档",2052,"https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fs977043\u002Friver-review\u002Fskills\u002Fagent-skills\u002Friver-review-security\u002Freferences\u002FROUTING.md",[91,100,107,114,141,165],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":99},"01M746ZWACVKMZ1BJXJZHYJSSX","migrate-to-e2e","Moves an existing Playwright, Cypress, Selenium, Appium, Detox, Maestro, or TesterArmy suite to e2e one slice at a time, with the old suite running beside the new one until each ported test is proven. Keeps a MIGRATION.md progress file so any later session resumes where the last stopped. Optionally plants a defect to show both suites catch it. Use for \u002Fmigrate-to-e2e, \"migrate our tests to e2e\", \"port these Maestro flows\", \"move our TesterArmy tests\", or when a project has an e2e config and an older suite still running.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fmigrate-to-e2e\u002FSKILL.md",[],[],"2026-11-11 15:11:14",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":99},"01M746ZPTAX1Q0FBKAB1CYND7E","e2e","Writes, runs, and debugs end-to-end tests for web and mobile apps with e2e, the agentic test runner, which mixes agent.act goals with exact locator assertions on a Playwright browser or an iOS or Android device. Also drives a project's running app live over the e2e MCP server to look at a screen, check a UI change, take a screenshot or record a video, and try a locator; and runs bug bashes, parallel e2e explore runs with each bug proven by a repro test. Use when a project depends on e2e or has an e2e.config.ts, when asked for end-to-end, browser, mobile, or agentic UI tests, to check a change in the running app, to QA or bug bash an app or branch, or when an e2e run fails.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fe2e\u002FSKILL.md",[],[],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":99},"01M746ZJN784HVHMDP9MQGCSGG","create-verification-skill","Generate a project-local verify-\u003Capp> skill on top of e2e, so any coding agent can launch the app, check it is worth driving, exercise a feature the way a user does, keep evidence, and bug bash it. Writes the skill, a feature map with one explore charter per feature, and proves it once. Use for \u002Fcreate-verification-skill, \"make a verification skill for this repo\", or when a project has no scripted way to prove UI behavior.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fcreate-verification-skill\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":41},"01M716A6ETNB9B1SQ3GXZC75VR","deja-search","deja-vu memory — search the user's past AI coding sessions with the deja CLI. Holds what they already settled and never wrote into the repo (naming rules, banned or already-tried tools, required checks before merge, preferred values, who owns what). Use before your first edit in a task, before you call a change done or ready to merge, before you recommend a tool, library, design or reviewer, before re-debugging an error that may already be solved, when they say 'didn't we fix this before', 'what did we decide about X' or 'I already have that', and before telling them something on this machine does not exist.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fvshulcz\u002Fdeja-vu\u002Fskills\u002Fdeja-search\u002FSKILL.md",[],[121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140],"search","deja search","never","error","ready","memory","re","decide","fix","design","debugging","when","you","done","reviewer","io","change","cli","merge","past",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":41},"01M716A3J2W5SENSE9VGMXB375","deja-reflect","End-of-session reflection and memory curation with deja-vu. Review what was decided, what commands broke and what repaired them, and record durable project rules or decisions with deja remember so the next session starts with them.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fvshulcz\u002Fdeja-vu\u002Fskills\u002Fdeja-reflect\u002FSKILL.md",[],[148,149,24,136,150,151,152,153,154,155,156,157,158,159,126,160,161,162,163,164],"deja reflect","reflect","with","record","github","next","https","node","Rules","decisions","brew","remember","project rules","project","session","end","reflection",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":182,"publishedAt":41},"01M715T3RR4BAYSR57HPPTJ0PF","revid","Make, edit, export and post AI videos with Revid (revid.ai) through the Revid MCP server. Use whenever the user wants a short-form or long-form video made (from an idea, a script, a URL, an article, a PDF, a tweet, a product page, their own clips, or a song), wants to find what is going viral on TikTok, YouTube, Instagram or X before making something, wants to edit or re-export an existing Revid project, generate a standalone AI image or clip, make a series episode, or publish and schedule a finished video to connected social accounts. Covers setup (hosted MCP with OAuth, or an API key), the 36 tools, credits, polling and the rules for publishing. Routes to the more specific revid-* skills when one fits.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftmakersas\u002Frevid-skills\u002Fskills\u002Frevid\u002FSKILL.md",[171,176,179],{"categoryNo":172,"categoryName":173,"taxonomyType":174,"taxonomyTypeDesc":175},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",{"categoryNo":177,"categoryName":178,"taxonomyType":174,"taxonomyTypeDesc":175},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":180,"categoryName":181,"taxonomyType":174,"taxonomyTypeDesc":175},"01JBSEEDCAT000000000000010","后端与接口",[167,183,184,185,186,187,188,161,189,127,190,191,192,193,132,194,195,196,197,198],"URL","Video","short-form","standalone","PDF","viral","tiktok","short","social","MCP","song","image","mcp server","schedule","api","publish"]