[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6X6RB5SVWDD2KXCDTPE4VFB":3,"skill-same:01M6X6RB5SVWDD2KXCDTPE4VFB":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":59,"ownerHtmlUrl":60,"ownerBlogUrl":59,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M6X6RB5SVWDD2KXCDTPE4VFB","frontend-render-security",null,"Writing\u002Freviewing client-side UI (React\u002FVue\u002Fvanilla) — insecure-render + client-trust gaps AI ships: XSS via innerHTML, client secrets, client-only auth, CORS wildcard, token in localStorage","event4u-app\u002Fagent-config","event4u-app","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F199339632?v=4","01M6X5TWBNCQCE1VDKT4E9KF7N","event4u.app","01M6X5TWF4HRM266RG2Q5VVH1X",19,"MIT","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Ffrontend-render-security\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"frontend render security","security","render","frontend","quality","gaps","client","via","token","base","trust","only","cors","secrets","xss","vue","ui","auth","react","writing","2026-11-10 10:12:30",false,"---\nmodel_tier: medium\nname: frontend-render-security\ndescription: \"Writing\u002Freviewing client-side UI (React\u002FVue\u002Fvanilla) — insecure-render + client-trust gaps AI ships: XSS via innerHTML, client secrets, client-only auth, CORS wildcard, token in localStorage\"\ndomain: quality\nworkspaces:\n  - engineering\npacks:\n  - engineering-base\n---\n\n# frontend-render-security\n\nAI optimizes for the shortest code that produces the requested visible behavior and omits the invisible defensive layer — the sanitizer, the origin check, the server-side gate, the security header. Large samples put XSS in a majority of AI frontend code and ~2.74× more XSS than human code; every agent in the Tenzai benchmark shipped client-side flaws. These are high-precision, grep-catchable patterns — stop them at authoring time.\n\n## When to use\n\n- Writing or modifying a component, template, or client-side script that renders data, calls an API, handles auth, or reads the URL \u002F `postMessage`.\n- Reviewing an AI-authored frontend diff.\n- Editing `.tsx` \u002F `.jsx` \u002F `.vue` \u002F `.svelte` \u002F `.html` or client-side `.js` \u002F `.ts`.\n\nDo NOT use when: the change is server-only, CLI, or non-UI — route to `security` \u002F `security-sensitive-stop`.\n\n## The Iron Law\n\n```\nNEVER RENDER NON-CONSTANT INPUT INTO AN HTML\u002FJS SINK WITHOUT ENCODING OR SANITIZING.\nTHE CLIENT IS UNTRUSTED — EVERY CLIENT GATE NEEDS A SERVER-SIDE TWIN.\nNO SECRET, PRIVILEGED KEY, OR SESSION TOKEN LIVES IN CLIENT CODE OR localStorage.\n```\n\n## Procedure\n\n1. Identify the sinks in the diff: HTML\u002FJS render points, API calls, auth\u002Frole checks, URL \u002F `postMessage` reads, secret\u002Ftoken usage.\n2. Run the backstop greps below; for each hit, apply the matching fix from the patterns table.\n3. For every client-side gate, confirm a server-side twin exists (the client is never the security boundary).\n4. Emit the per-diff verdict (Output format); surface any unresolved hit to the user.\n\n## The patterns AI ships by default\n\n| Pattern | Why it's dangerous | Do instead |\n|---|---|---|\n| `dangerouslySetInnerHTML` \u002F `v-html` \u002F `.innerHTML =` on non-constant value | Stored\u002FDOM XSS (CWE-79) | render as text, or sanitize (DOMPurify) if HTML is required |\n| Secret \u002F API key inline or in `NEXT_PUBLIC_*` \u002F `VITE_*` | Bundler inlines it into shipped JS (CWE-798) | call the third party via a backend-for-frontend proxy; only truly-public values get a public prefix |\n| Client-side-only auth \u002F role \u002F validation | Bypassable with dev tools or a proxy (CWE-602) | client gate is UX only; enforce the same check server-side |\n| `location.*` \u002F query param → HTML or JS sink | DOM XSS (CWE-79) | `textContent`; never pass URL data into an HTML\u002Fexec sink |\n| CORS `origin: '*'` (esp. with credentials) | Any site reads authenticated responses (CWE-942) | explicit origin allow-list; never reflect `Origin` on credentialed routes |\n| Token \u002F JWT in `localStorage` \u002F `sessionStorage` | XSS-exfiltratable (CWE-522) | `HttpOnly; Secure; SameSite` cookie |\n| `addEventListener('message', …)` without `event.origin` check | Any embedder drives the handler (CWE-346) | strict-equality check `event.origin` against an allow-list first |\n| `redirect` \u002F `next` param → `location` \u002F `router.push` | Open redirect \u002F phishing (CWE-601) | relative-path or allow-listed-host only; reject external \u002F non-http schemes |\n| `eval` \u002F `new Function` \u002F string-`setTimeout` on input | Eval injection \u002F RCE (CWE-95) | a parser or explicit allow-list |\n| `target=\"_blank\"` without `rel=\"noopener\"` | Reverse tabnabbing (CWE-1022) | add `rel=\"noopener noreferrer\"` |\n| Missing CSP; missing alt\u002Flabel\u002Fcontrast | No XSS second line of defense; a11y failures | strict CSP (no `unsafe-inline`); alt text, labels, AA contrast |\n| Untrusted SVG markup into an HTML sink — `innerHTML` \u002F `v-html` \u002F `dangerouslySetInnerHTML`, or inlined server-side | An inlined SVG is live DOM, not an image: `on*` event attributes, `\u003Cscript>`, `foreignObject`, a `javascript:` href and external references all execute, and a DOCTYPE with entities reads local files (CWE-79, CWE-611) | sanitize with an SVG profile chosen for the **delivery context** — inline DOM runs script and handlers in the host origin; a standalone `.svg` opened directly runs them in its own; `\u003Cimg>` and CSS `background-image` run no script and load no external reference — or deliver through `\u003Cimg>`, with CSP as the second line. Uploads are `threat-modeling`'s `data\u002Fthreats.csv:9`, not this row |\n\n## The server-composed bootstrap payload\n\nA payload assembled **server-side and serialised into the page** for a client\nisland is a data-exposure surface: whatever is put in it is readable by anyone\nwho can load the page — no API call, no auth check, view-source. Several\nmainstream frameworks ship their own named channel for exactly this, so the\npattern is a documented mechanism rather than one project's arrangement.\n\n**Inspect the existing payload before judging any field.** Read what the channel\nalready carries and check current call sites for what the client actually\nconsumes — a field is only defensible against what the page needs, and a review\nthat never opened the payload is a guess. The grep below finds it.\n\n**The per-field question, which is what this section is:**\n\n> Would I return this field from a **public, unauthenticated** endpoint?\n> If not, it does not belong in the payload.\n\nField classes that recur and are almost always wrong there: internal ids that\nenumerate other users' rows · permission and role structures the client only\nneeds a boolean of · feature-flag payloads carrying unreleased product names ·\nanything from an admin-scoped query that was convenient to reuse · a whole\nserialised model where the page needs three of its fields.\n\n**Nothing enforces this, and the split is deliberate.**\n\n| Half | What it does | What it cannot do |\n|---|---|---|\n| the grep below | **locates** a payload a field was added to | tell a privileged field from a public one |\n| this checklist entry | carries the **judgement** | run |\n\nThe question is not decidable by any check: a grep over the framework-named\npayload channels cannot read intent. So the deterministic half is discovery,\nadvisory and non-blocking, and its whole value is putting the question in front\nof a reader who would otherwise never see it. `enforced_by: none` is the honest\nfield here — this section refuses nothing.\n\n**What may NOT be encoded.** The particular channel any one repository uses.\nWhat is encoded is the question and the framework-named channels; a concrete\nin-house payload shape would be one repository's implementation shipped as\nguidance.\n\n## Backstop greps\n\nRun before committing frontend changes; each should return zero (or every hit is read and justified):\n\n```bash\nagent-config code-graph scan --pack frontend   # one file:line:rule-id per hit\n```\n\nRules: `render-sink` (insecure render + eval), `client-secret` (client secrets, token in localStorage), `cors-wildcard`, `postmessage-listener` (confirm each checks `event.origin`), `blank-target` (no `rel=\"noopener\"`), `svg-active-content` (scoped to `*.svg`, where an `on*` attribute is always a defect; in `.jsx`\u002F`.tsx` it is ordinary React, and inline SVG in a host document is DQ4's case. A locator, not a verdict: entity-encoded or tab-split `javascript:`, `\u003Csvg:script>` and SMIL writes into href get past it — `lint_svg_asset` decodes them), `bootstrap-payload` (locates the server-composed payload; the per-field judgement is yours).\n\n## Output format\n\n1. A per-diff verdict listing each pattern class checked and its result (`clean` \u002F `hit at file:line → fixed by \u003Cchange>`).\n2. The backstop greps run, with results.\n3. For any client gate added, the file:line of its **server-side twin** (or an explicit note that the server check already exists and where).\n\n## Gotcha\n\n- Modern browsers default `_blank` to `noopener`, but legacy\u002Fembedded webviews do not — keep the `rel` for portability.\n- `NEXT_PUBLIC_`\u002F`VITE_` on a *genuinely* public value (a publishable analytics ID) is fine; the violation is a *sensitive* name behind that prefix. Read the name, don't blanket-block the prefix.\n- A sanitizer (DOMPurify) is the fix only when HTML output is actually required; if plain text suffices, render text and skip the dependency.\n- Client-side validation is not wrong — it is wrong *as the only* enforcement. Keep it for UX; add the server twin.\n\n## Do NOT\n\n- Do NOT render user\u002FDB HTML through `dangerouslySetInnerHTML`\u002F`v-html`\u002F`innerHTML` without a sanitizer.\n- Do NOT put a secret, privileged key, or session token in client code or web storage.\n- Do NOT treat a client-side role\u002Fauth check as a security boundary.\n- Do NOT set `origin: '*'` on a credentialed endpoint.\n- Do NOT auto-strip a grep hit without reading it — some innerHTML uses are on constant, trusted markup.\n\n## Auto-trigger keywords\n\n- frontend security\n- XSS\n- dangerouslySetInnerHTML\n- client-side secret\n- insecure render\n\n## See also\n\n- [`ai-code-blindspots`](..\u002Fai-code-blindspots\u002FSKILL.md) — the surface→controls checklist that routes here.\n- [`senior-engineering-discipline`](..\u002F..\u002Frules\u002Fsenior-engineering-discipline.md) — anchor rule.\n- [`security`](..\u002Fsecurity\u002FSKILL.md), [`defense-in-depth`](..\u002Fdefense-in-depth\u002FSKILL.md), [`accessibility-auditor`](..\u002Faccessibility-auditor\u002FSKILL.md), [`secrets-management`](..\u002Fsecrets-management\u002FSKILL.md).\n","# frontend-render-security\n\nAI optimizes for the shortest code that produces the requested visible behavior and omits the invisible defensive layer — the sanitizer, the origin check, the server-side gate, the security header. Large samples put XSS in a majority of AI frontend code and ~2.74× more XSS than human code; every agent in the Tenzai benchmark shipped client-side flaws. These are high-precision, grep-catchable patterns — stop them at authoring time.\n\n## When to use\n\n- Writing or modifying a component, template, or client-side script that renders data, calls an API, handles auth, or reads the URL \u002F `postMessage`.\n- Reviewing an AI-authored frontend diff.\n- Editing `.tsx` \u002F `.jsx` \u002F `.vue` \u002F `.svelte` \u002F `.html` or client-side `.js` \u002F `.ts`.\n\nDo NOT use when: the change is server-only, CLI, or non-UI — route to `security` \u002F `security-sensitive-stop`.\n\n## The Iron Law\n\n```\nNEVER RENDER NON-CONSTANT INPUT INTO AN HTML\u002FJS SINK WITHOUT ENCODING OR SANITIZING.\nTHE CLIENT IS UNTRUSTED — EVERY CLIENT GATE NEEDS A SERVER-SIDE TWIN.\nNO SECRET, PRIVILEGED KEY, OR SESSION TOKEN LIVES IN CLIENT CODE OR localStorage.\n```\n\n## Procedure\n\n1. Identify the sinks in the diff: HTML\u002FJS render points, API calls, auth\u002Frole checks, URL \u002F `postMessage` reads, secret\u002Ftoken usage.\n2. Run the backstop greps below; for each hit, apply the matching fix from the patterns table.\n3. For every client-side gate, confirm a server-side twin exists (the client is never the security boundary).\n4. Emit the per-diff verdict (Output format); surface any unresolved hit to the user.\n\n## The patterns AI ships by default\n\n| Pattern | Why it's dangerous | Do instead |\n|---|---|---|\n| `dangerouslySetInnerHTML` \u002F `v-html` \u002F `.innerHTML =` on non-constant value | Stored\u002FDOM XSS (CWE-79) | render as text, or sanitize (DOMPurify) if HTML is required |\n| Secret \u002F API key inline or in `NEXT_PUBLIC_*` \u002F `VITE_*` | Bundler inlines it into shipped JS (CWE-798) | call the third party via a backend-for-frontend proxy; only truly-public values get a public prefix |\n| Client-side-only auth \u002F role \u002F validation | Bypassable with dev tools or a proxy (CWE-602) | client gate is UX only; enforce the same check server-side |\n| `location.*` \u002F query param → HTML or JS sink | DOM XSS (CWE-79) | `textContent`; never pass URL data into an HTML\u002Fexec sink |\n| CORS `origin: '*'` (esp. with credentials) | Any site reads authenticated responses (CWE-942) | explicit origin allow-list; never reflect `Origin` on credentialed routes |\n| Token \u002F JWT in `localStorage` \u002F `sessionStorage` | XSS-exfiltratable (CWE-522) | `HttpOnly; Secure; SameSite` cookie |\n| `addEventListener('message', …)` without `event.origin` check | Any embedder drives the handler (CWE-346) | strict-equality check `event.origin` against an allow-list first |\n| `redirect` \u002F `next` param → `location` \u002F `router.push` | Open redirect \u002F phishing (CWE-601) | relative-path or allow-listed-host only; reject external \u002F non-http schemes |\n| `eval` \u002F `new Function` \u002F string-`setTimeout` on input | Eval injection \u002F RCE (CWE-95) | a parser or explicit allow-list |\n| `target=\"_blank\"` without `rel=\"noopener\"` | Reverse tabnabbing (CWE-1022) | add `rel=\"noopener noreferrer\"` |\n| Missing CSP; missing alt\u002Flabel\u002Fcontrast | No XSS second line of defense; a11y failures | strict CSP (no `unsafe-inline`); alt text, labels, AA contrast |\n| Untrusted SVG markup into an HTML sink — `innerHTML` \u002F `v-html` \u002F `dangerouslySetInnerHTML`, or inlined server-side | An inlined SVG is live DOM, not an image: `on*` event attributes, `\u003Cscript>`, `foreignObject`, a `javascript:` href and external references all execute, and a DOCTYPE with entities reads local files (CWE-79, CWE-611) | sanitize with an SVG profile chosen for the **delivery context** — inline DOM runs script and handlers in the host origin; a standalone `.svg` opened directly runs them in its own; `\u003Cimg>` and CSS `background-image` run no script and load no external reference — or deliver through `\u003Cimg>`, with CSP as the second line. Uploads are `threat-modeling`'s `data\u002Fthreats.csv:9`, not this row |\n\n## The server-composed bootstrap payload\n\nA payload assembled **server-side and serialised into the page** for a client\nisland is a data-exposure surface: whatever is put in it is readable by anyone\nwho can load the page — no API call, no auth check, view-source. Several\nmainstream frameworks ship their own named channel for exactly this, so the\npattern is a documented mechanism rather than one project's arrangement.\n\n**Inspect the existing payload before judging any field.** Read what the channel\nalready carries and check current call sites for what the client actually\nconsumes — a field is only defensible against what the page needs, and a review\nthat never opened the payload is a guess. The grep below finds it.\n\n**The per-field question, which is what this section is:**\n\n> Would I return this field from a **public, unauthenticated** endpoint?\n> If not, it does not belong in the payload.\n\nField classes that recur and are almost always wrong there: internal ids that\nenumerate other users' rows · permission and role structures the client only\nneeds a boolean of · feature-flag payloads carrying unreleased product names ·\nanything from an admin-scoped query that was convenient to reuse · a whole\nserialised model where the page needs three of its fields.\n\n**Nothing enforces this, and the split is deliberate.**\n\n| Half | What it does | What it cannot do |\n|---|---|---|\n| the grep below | **locates** a payload a field was added to | tell a privileged field from a public one |\n| this checklist entry | carries the **judgement** | run |\n\nThe question is not decidable by any check: a grep over the framework-named\npayload channels cannot read intent. So the deterministic half is discovery,\nadvisory and non-blocking, and its whole value is putting the question in front\nof a reader who would otherwise never see it. `enforced_by: none` is the honest\nfield here — this section refuses nothing.\n\n**What may NOT be encoded.** The particular channel any one repository uses.\nWhat is encoded is the question and the framework-named channels; a concrete\nin-house payload shape would be one repository's implementation shipped as\nguidance.\n\n## Backstop greps\n\nRun before committing frontend changes; each should return zero (or every hit is read and justified):\n\n```bash\nagent-config code-graph scan --pack frontend   # one file:line:rule-id per hit\n```\n\nRules: `render-sink` (insecure render + eval), `client-secret` (client secrets, token in localStorage), `cors-wildcard`, `postmessage-listener` (confirm each checks `event.origin`), `blank-target` (no `rel=\"noopener\"`), `svg-active-content` (scoped to `*.svg`, where an `on*` attribute is always a defect; in `.jsx`\u002F`.tsx` it is ordinary React, and inline SVG in a host document is DQ4's case. A locator, not a verdict: entity-encoded or tab-split `javascript:`, `\u003Csvg:script>` and SMIL writes into href get past it — `lint_svg_asset` decodes them), `bootstrap-payload` (locates the server-composed payload; the per-field judgement is yours).\n\n## Output format\n\n1. A per-diff verdict listing each pattern class checked and its result (`clean` \u002F `hit at file:line → fixed by \u003Cchange>`).\n2. The backstop greps run, with results.\n3. For any client gate added, the file:line of its **server-side twin** (or an explicit note that the server check already exists and where).\n\n## Gotcha\n\n- Modern browsers default `_blank` to `noopener`, but legacy\u002Fembedded webviews do not — keep the `rel` for portability.\n- `NEXT_PUBLIC_`\u002F`VITE_` on a *genuinely* public value (a publishable analytics ID) is fine; the violation is a *sensitive* name behind that prefix. Read the name, don't blanket-block the prefix.\n- A sanitizer (DOMPurify) is the fix only when HTML output is actually required; if plain text suffices, render text and skip the dependency.\n- Client-side validation is not wrong — it is wrong *as the only* enforcement. Keep it for UX; add the server twin.\n\n## Do NOT\n\n- Do NOT render user\u002FDB HTML through `dangerouslySetInnerHTML`\u002F`v-html`\u002F`innerHTML` without a sanitizer.\n- Do NOT put a secret, privileged key, or session token in client code or web storage.\n- Do NOT treat a client-side role\u002Fauth check as a security boundary.\n- Do NOT set `origin: '*'` on a credentialed endpoint.\n- Do NOT auto-strip a grep hit without reading it — some innerHTML uses are on constant, trusted markup.\n\n## Auto-trigger keywords\n\n- frontend security\n- XSS\n- dangerouslySetInnerHTML\n- client-side secret\n- insecure render\n\n## See also\n\n- [`ai-code-blindspots`](..\u002Fai-code-blindspots\u002FSKILL.md) — the surface→controls checklist that routes here.\n- [`senior-engineering-discipline`](..\u002F..\u002Frules\u002Fsenior-engineering-discipline.md) — anchor rule.\n- [`security`](..\u002Fsecurity\u002FSKILL.md), [`defense-in-depth`](..\u002Fdefense-in-depth\u002FSKILL.md), [`accessibility-auditor`](..\u002Faccessibility-auditor\u002FSKILL.md), [`secrets-management`](..\u002Fsecrets-management\u002FSKILL.md).\n",{"name":5,"packs":49,"domain":28,"model_tier":51,"workspaces":52,"description":7},[50],"engineering-base","medium",[53],"engineering","main","12bd765ce1d800501d45dfb8232102793af01290","src\u002Fskills\u002Ffrontend-render-security",1,"https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config","https:\u002F\u002Fevent4u.app","https:\u002F\u002Fgithub.com\u002Fevent4u-app","Your events in your hand","2026-11-14 02:29:41",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add event4u-app\u002Fagent-config --skill frontend-render-security",{"tool":69,"command":70},"bunx","bunx skills add event4u-app\u002Fagent-config --skill frontend-render-security",{"tool":72,"command":73},"pnpm","pnpm dlx skills add event4u-app\u002Fagent-config --skill frontend-render-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Ffrontend-render-security\u002FSKILL.md",true,[77],{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"evals\u002Ftriggers.json","REFERENCE","参考文档",2102,"https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Ffrontend-render-security\u002Fevals\u002Ftriggers.json",[84,100,112,124,136,146],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":93,"publishedAt":44},"01M6X84PK96XBPENXH66JCTSD1","unknown-key-fixture","Declares a key the schema does not know.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Fscripts\u002Ffixtures\u002Fbody-portable\u002Funknown-key\u002FSKILL.md",[90],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[94,95,96,97,98,99],"unknown key fixture","Unknown key","fixture","unknown","schema","package",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":107,"publishedAt":44},"01M6X84HW7NAHZ7GZMQ9RXK1XJ","portable-fixture","Declares only semantics the MCP-lite carrier transports whole.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Fscripts\u002Ffixtures\u002Fbody-portable\u002Fportable\u002FSKILL.md",[106],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},[96,108,109,110,35,99,111],"portable","portable fixture","engineer","MCP",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":119,"publishedAt":44},"01M6X84F29FE0RGGZ1ZTFGZTX2","non-portable-fixture","Declares a runtime semantic the carrier drops.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Fscripts\u002Ffixtures\u002Fbody-portable\u002Fnon-portable\u002FSKILL.md",[118],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},[109,120,108,96,121,122,123,99],"non portable fixture","semantic","high","runtime",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":131,"publishedAt":44},"01M6X848F706PT9MDCX75JKJ6B","candidate-zero-width","A candidate whose prose carries an invisible joiner.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskill-scout-candidates\u002Fzero-width-injection\u002FSKILL.md",[130],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},[132,133,134,135],"candidate zero width","candidate","ZeRO","prose",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":44},"01M6X841SSC2T31VDF41SA6DG1","candidate-disclosure-suppression","A candidate whose prose tells the agent to withhold from the user.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskill-scout-candidates\u002Fdisclosure-suppression\u002FSKILL.md",[142],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},[144,133,135,145],"candidate disclosure suppression","user",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":44},"01M6X83TFS5AGPBPVTQNWP0BB3","candidate-dangerous-frontmatter","A candidate claiming an unscoped tool grant and a permission bypass.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskill-scout-candidates\u002Fdangerous-frontmatter\u002FSKILL.md",[152],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},[154,133,155,156,157,158],"candidate dangerous frontmatter","frontmatter","shell","permission","tool"]