[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6PEYGS8AM7F4PVNZK12SDEG":3,"skill-same:01M6PEYGS8AM7F4PVNZK12SDEG":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":51,"install":52,"resources":65},"01M6PEYGS8AM7F4PVNZK12SDEG","security-scan",null,"Rapid security scanning workflow for code changes. Activates a focused security sweep. Activate when: security scan, scan for vulnerabilities, check for secrets, security check, run security audit, check deps.","r3dlex\u002Foh-my-githubcopilot","r3dlex","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F291373160?v=4","01M6PEFNGGBVB7SHAPWXFFX933","01M6PEFNMNKPP8K3C881MDS722",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fr3dlex\u002Foh-my-githubcopilot\u002Fblob\u002Fmain\u002Fvscode-omg\u002Fresources\u002Ftemplates\u002Fskills\u002Fsecurity-scan\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"security scan","scan","security","check","changes","for","security sweep","scope","security scanning","activate","security check","scanning","sweep","deps","secrets","security audit","audit","code","run","workflow","2026-11-10 10:12:30",false,"---\nname: security-scan\ndescription: >\n  Rapid security scanning workflow for code changes. Activates a focused security sweep.\n  Activate when: security scan, scan for vulnerabilities, check for secrets,\n  security check, run security audit, check deps.\nargument-hint: \"[path or scope to scan — defaults to recent git changes]\"\n---\n\n# Security Scan\n\nRapid security sweep for code changes. Faster than a full `\u002Freview` — focused on security only.\n\n## When to Use\n- Before committing code that touches auth, user input, data storage, or external APIs\n- After adding new dependencies\n- Quick pre-PR security gate\n\n## Scan Protocol\n\n### Step 1: Determine Scope\n```bash\n# Default: scan recent changes\ngit diff --name-only HEAD~1\n\n# Or use provided path\n```\n\n### Step 2: Secrets Scan\n```bash\n# Scan for common secret patterns\ngrep -rn --include=\"*.{ts,js,py,go,rs,java,cs,yaml,json,env,sh,toml}\" \\\n  -e \"sk-[A-Za-z0-9]\\{32,\\}\" \\\n  -e \"ghp_[A-Za-z0-9]\\{36\\}\" \\\n  -e \"AKIA[0-9A-Z]\\{16\\}\" \\\n  -e \"api.key\\s*=\\s*['\\\"][^'\\\"]\\{8,\\}\" \\\n  -e \"password\\s*=\\s*['\\\"][^'\\\"]\\{4,\\}\" \\\n  -e \"secret\\s*=\\s*['\\\"][^'\\\"]\\{8,\\}\" \\\n  .\n\n# Check .env is in .gitignore\ncat .gitignore | grep -E \"\\.env$|\\.env\\.\"\n```\n\n**CRITICAL:** Any match in committed code = immediate blocker.\n\n### Step 3: Dependency Audit\nRun language-appropriate audit:\n```bash\n# Node.js\nnpm audit --audit-level=high\n\n# Python\npip-audit  # or: safety check\n\n# Rust\ncargo audit\n\n# Go\ngovulncheck .\u002F...\n\n# Java\u002FMaven\nmvn dependency-check:check\n```\n\n**Report:** Count of critical\u002Fhigh severity CVEs and their package names.\n\n### Step 4: Input Validation Spot-Check\nFor changed files that handle user input (API endpoints, form handlers, CLI args):\n- Is input validated\u002Fsanitized before use?\n- Are SQL queries parameterized (no string concatenation)?\n- Is HTML output escaped before rendering?\n- Are file paths sanitized (no `..\u002F` traversal)?\n\n### Step 5: Auth\u002FAuthz Quick Check\nFor changed files touching auth:\n- Is authentication checked BEFORE authorization?\n- Are authorization checks on EVERY relevant endpoint?\n- Are JWT tokens validated (algorithm + signature + expiry)?\n- Are session cookies `HttpOnly; Secure; SameSite=Strict`?\n\n---\n\n## Output Format\n\n```\n## Security Scan Report\n\n**Scope:** [files scanned]\n**Date:** [timestamp]\n\n### Secrets\n- [ ] No hardcoded secrets found\n- ⚠ Found: [file:line — description]\n\n### Dependencies\n- Critical CVEs: X\n- High CVEs: Y\n- Packages: [list if any]\n\n### Input Validation\n- [ ] User inputs sanitized in changed files\n- ⚠ Risk: [file:line — description]\n\n### Auth\n- [ ] Auth\u002Fauthz checks present on relevant routes\n- ⚠ Risk: [file:line — description]\n\n### Verdict\nCLEAN \u002F NEEDS ATTENTION \u002F BLOCKER\n\n### Next Steps\n- [Action items with file:line references]\n```\n\n## Severity Quick Reference\n\n| Finding | Severity | Action |\n|---------|----------|--------|\n| Hardcoded secret in committed file | CRITICAL | Rotate key + remove from history |\n| Critical CVE in direct dependency | HIGH | Update package immediately |\n| SQL injection risk | CRITICAL | Parameterize query before PR |\n| Missing auth check on endpoint | HIGH | Add before PR |\n| High CVE in transitive dependency | MEDIUM | Track in backlog |\n| HTTP instead of HTTPS | MEDIUM | Enforce HTTPS redirect |\n\n## See Also\n\n- `@security-reviewer` — comprehensive OWASP Top 10 security review\n- `\u002Freview` — full code review including security\n- `\u002Fcoding-standards` — baseline code quality rules\n","# Security Scan\n\nRapid security sweep for code changes. Faster than a full `\u002Freview` — focused on security only.\n\n## When to Use\n- Before committing code that touches auth, user input, data storage, or external APIs\n- After adding new dependencies\n- Quick pre-PR security gate\n\n## Scan Protocol\n\n### Step 1: Determine Scope\n```bash\n# Default: scan recent changes\ngit diff --name-only HEAD~1\n\n# Or use provided path\n```\n\n### Step 2: Secrets Scan\n```bash\n# Scan for common secret patterns\ngrep -rn --include=\"*.{ts,js,py,go,rs,java,cs,yaml,json,env,sh,toml}\" \\\n  -e \"sk-[A-Za-z0-9]\\{32,\\}\" \\\n  -e \"ghp_[A-Za-z0-9]\\{36\\}\" \\\n  -e \"AKIA[0-9A-Z]\\{16\\}\" \\\n  -e \"api.key\\s*=\\s*['\\\"][^'\\\"]\\{8,\\}\" \\\n  -e \"password\\s*=\\s*['\\\"][^'\\\"]\\{4,\\}\" \\\n  -e \"secret\\s*=\\s*['\\\"][^'\\\"]\\{8,\\}\" \\\n  .\n\n# Check .env is in .gitignore\ncat .gitignore | grep -E \"\\.env$|\\.env\\.\"\n```\n\n**CRITICAL:** Any match in committed code = immediate blocker.\n\n### Step 3: Dependency Audit\nRun language-appropriate audit:\n```bash\n# Node.js\nnpm audit --audit-level=high\n\n# Python\npip-audit  # or: safety check\n\n# Rust\ncargo audit\n\n# Go\ngovulncheck .\u002F...\n\n# Java\u002FMaven\nmvn dependency-check:check\n```\n\n**Report:** Count of critical\u002Fhigh severity CVEs and their package names.\n\n### Step 4: Input Validation Spot-Check\nFor changed files that handle user input (API endpoints, form handlers, CLI args):\n- Is input validated\u002Fsanitized before use?\n- Are SQL queries parameterized (no string concatenation)?\n- Is HTML output escaped before rendering?\n- Are file paths sanitized (no `..\u002F` traversal)?\n\n### Step 5: Auth\u002FAuthz Quick Check\nFor changed files touching auth:\n- Is authentication checked BEFORE authorization?\n- Are authorization checks on EVERY relevant endpoint?\n- Are JWT tokens validated (algorithm + signature + expiry)?\n- Are session cookies `HttpOnly; Secure; SameSite=Strict`?\n\n---\n\n## Output Format\n\n```\n## Security Scan Report\n\n**Scope:** [files scanned]\n**Date:** [timestamp]\n\n### Secrets\n- [ ] No hardcoded secrets found\n- ⚠ Found: [file:line — description]\n\n### Dependencies\n- Critical CVEs: X\n- High CVEs: Y\n- Packages: [list if any]\n\n### Input Validation\n- [ ] User inputs sanitized in changed files\n- ⚠ Risk: [file:line — description]\n\n### Auth\n- [ ] Auth\u002Fauthz checks present on relevant routes\n- ⚠ Risk: [file:line — description]\n\n### Verdict\nCLEAN \u002F NEEDS ATTENTION \u002F BLOCKER\n\n### Next Steps\n- [Action items with file:line references]\n```\n\n## Severity Quick Reference\n\n| Finding | Severity | Action |\n|---------|----------|--------|\n| Hardcoded secret in committed file | CRITICAL | Rotate key + remove from history |\n| Critical CVE in direct dependency | HIGH | Update package immediately |\n| SQL injection risk | CRITICAL | Parameterize query before PR |\n| Missing auth check on endpoint | HIGH | Add before PR |\n| High CVE in transitive dependency | MEDIUM | Track in backlog |\n| HTTP instead of HTTPS | MEDIUM | Enforce HTTPS redirect |\n\n## See Also\n\n- `@security-reviewer` — comprehensive OWASP Top 10 security review\n- `\u002Freview` — full code review including security\n- `\u002Fcoding-standards` — baseline code quality rules\n",{"name":5,"description":43,"argument-hint":44},"Rapid security scanning workflow for code changes. Activates a focused security sweep. Activate when: security scan, scan for vulnerabilities, check for secrets, security check, run security audit, check deps.\n","[path or scope to scan — defaults to recent git changes]","main","55294682936bc69473eba70e93ffa88ede018e81","vscode-omg\u002Fresources\u002Ftemplates\u002Fskills\u002Fsecurity-scan",0,"https:\u002F\u002Fgithub.com\u002Fr3dlex\u002Foh-my-githubcopilot","https:\u002F\u002Fgithub.com\u002Fr3dlex","2026-10-31 18:57:35",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add r3dlex\u002Foh-my-githubcopilot --skill security-scan",{"tool":58,"command":59},"bunx","bunx skills add r3dlex\u002Foh-my-githubcopilot --skill security-scan",{"tool":61,"command":62},"pnpm","pnpm dlx skills add r3dlex\u002Foh-my-githubcopilot --skill security-scan","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fr3dlex\u002Foh-my-githubcopilot\u002Fblob\u002Fmain\u002Fvscode-omg\u002Fresources\u002Ftemplates\u002Fskills\u002Fsecurity-scan\u002FSKILL.md",true,[],[67,73,79,85,91,99],{"skillNo":68,"name":69,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":38},"01M6PF2CTFS0AEXQXF2NFYT8J2","wiki","https:\u002F\u002Fgithub.com\u002Fr3dlex\u002Foh-my-githubcopilot\u002Fblob\u002Fmain\u002Fvscode-omp\u002Fresources\u002Ftemplates\u002F.copilot\u002Fskills\u002Fwiki\u002FSKILL.md",[],[69],{"skillNo":74,"name":75,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":38},"01M6PF2BFXJ97M6NKH7N42XZVZ","ultrawork","https:\u002F\u002Fgithub.com\u002Fr3dlex\u002Foh-my-githubcopilot\u002Fblob\u002Fmain\u002Fvscode-omp\u002Fresources\u002Ftemplates\u002F.copilot\u002Fskills\u002Fultrawork\u002FSKILL.md",[],[75],{"skillNo":80,"name":81,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":38},"01M6PF2A38Y1CE5BVJ5HMTMBP6","trace","https:\u002F\u002Fgithub.com\u002Fr3dlex\u002Foh-my-githubcopilot\u002Fblob\u002Fmain\u002Fvscode-omp\u002Fresources\u002Ftemplates\u002F.copilot\u002Fskills\u002Ftrace\u002FSKILL.md",[],[81],{"skillNo":86,"name":87,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":38},"01M6PF28P7S19AK5XJA41WS9V8","team","https:\u002F\u002Fgithub.com\u002Fr3dlex\u002Foh-my-githubcopilot\u002Fblob\u002Fmain\u002Fvscode-omp\u002Fresources\u002Ftemplates\u002F.copilot\u002Fskills\u002Fteam\u002FSKILL.md",[],[87],{"skillNo":92,"name":93,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":38},"01M6PF278EADT8W3EWDYA3C2H0","swe-bench","https:\u002F\u002Fgithub.com\u002Fr3dlex\u002Foh-my-githubcopilot\u002Fblob\u002Fmain\u002Fvscode-omp\u002Fresources\u002Ftemplates\u002F.copilot\u002Fskills\u002Fswe-bench\u002FSKILL.md",[],[97,98],"SWE","swe bench",{"skillNo":100,"name":101,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":38},"01M6PF25XW1TMP5Z1N89ZVJQDY","swarm","https:\u002F\u002Fgithub.com\u002Fr3dlex\u002Foh-my-githubcopilot\u002Fblob\u002Fmain\u002Fvscode-omp\u002Fresources\u002Ftemplates\u002F.copilot\u002Fskills\u002Fswarm\u002FSKILL.md",[],[101]]