[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6XDNNXM2VAVEMP33DN2RZPY":3,"skill-same:01M6XDNNXM2VAVEMP33DN2RZPY":198},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":14,"repositoryHtmlUrl":74,"repositoryHomepageUrl":6,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6XDNNXM2VAVEMP33DN2RZPY","security-audit",null,"Whole-repository security audit with independent verification of every finding, vendored from cloudflare\u002Fsecurity-audit-skill. Guidance by default; runs the full six-phase audit (parallel hunters, verifiers that did not hunt, coverage ledger, schema-validated findings.json) only on an explicit audit or pen-test request. Triggers on: \"security audit\", \"audit this codebase\", \"pen test the code\", \"full security review\", \"end-to-end security review\", \"security audit report\".","kaiohenricunha\u002Fdotbabel","kaiohenricunha","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F69804490?v=4","01M6XCZD37W0KPCDGEA40Y610V","Kaio Cunha","01M6XCZD7SX714D114H3ZPNW09",0,"MIT","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,5,43,44,45,46,47],"security","audit","security audit","phase","review","request","quick","devex","scope","end","deep","default","only","coverage","repository","cloudflare","verification","code","security review","2026-11-10 10:12:30",false,"---\nid: security-audit\nname: security-audit\ntype: skill\nversion: 1.0.0\ndomain:\n  - devex\n  - security\nplatform:\n  - none\ntask:\n  - review\n  - diagnostics\nmaturity: draft\nowner: \"@kaiohenricunha\"\ncreated: 2026-09-22T00:00:00.000Z\nupdated: 2026-09-22T00:00:00.000Z\ndescription: |\n  Whole-repository security audit with independent verification of every finding, vendored from cloudflare\u002Fsecurity-audit-skill. Guidance by default; runs the full six-phase audit (parallel hunters, verifiers that did not hunt, coverage ledger, schema-validated findings.json) only on an explicit audit or pen-test request. Triggers on: \"security audit\", \"audit this codebase\", \"pen test the code\", \"full security review\", \"end-to-end security review\", \"security audit report\".\nargument-hint: \"[scope path | subsystem | \u003Cbase>..\u003Chead>] [--profile quick|standard|deep]\"\nmodel: opus\ndotbabel:\n  compute:\n    mode: floor\n    requirement: frontier\n    binding: consumer\n---\n\n# Security Audit\n\nThis skill wraps the upstream [cloudflare\u002Fsecurity-audit-skill](https:\u002F\u002Fgithub.com\u002Fcloudflare\u002Fsecurity-audit-skill).\nThe upstream workflow is authoritative. This file only maps it onto dotbabel hosts.\n\n## Read the upstream skill first\n\n1. Read `references\u002Fupstream\u002FUPSTREAM-SKILL.md` in full, then follow it.\n2. Load the other files in `references\u002Fupstream\u002F` only when `UPSTREAM-SKILL.md` or a phase document tells you to.\n\nThe upstream copy is pinned and unchanged. `references\u002FUPSTREAM.json` records the commit.\nDo not edit files in `references\u002Fupstream\u002F`. A maintainer updates them with `scripts\u002Fsync-security-audit.mjs`.\n\n## Path mapping\n\nThe upstream docs assume that the upstream `SKILL.md` sits at the skill root. In this layout:\n\n- **Skill directory** and `\u003Cskill-dir>` mean the absolute path of `references\u002Fupstream\u002F` in this skill, not the folder that contains this file.\n- A bare `SKILL.md` in the upstream docs means `references\u002Fupstream\u002FUPSTREAM-SKILL.md`.\n- The validators run as `node \u003Cskill-dir>\u002Fvalidate-findings.cjs \u003Coutput-dir>\u002Ffindings.json` and `node \u003Cskill-dir>\u002Fvalidate-coverage-ledger.cjs \u003Coutput-dir>\u002Fcoverage-ledger.json`.\n\n## Host mapping\n\nThe upstream roles are agent-neutral (`UPSTREAM-SKILL.md`, \"Platform terminology\").\n\n| Upstream role    | Claude Code                                                                                                                                                              |\n| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| Parent           | The main session. It is the only writer of shared run files.                                                                                                             |\n| Task tool        | The `Agent` tool.                                                                                                                                                        |\n| `research` agent | `subagent_type: general-purpose`, with a prompt that keeps it read-only. Do not use `Explore`: it reads file excerpts, and the upstream verifiers need whole-file reads. |\n| `general` agent  | `subagent_type: general-purpose`.                                                                                                                                        |\n\nOn Codex, Gemini, Copilot, or another host, use the host's sub-agent mechanism only when each agent gets its own context.\n\n- If the host has no isolated parallel sub-agents, do not run full audit mode. The upstream guarantee is that the agent that checks a finding never found it. Say that this host cannot give that guarantee, and offer guidance mode.\n- If the host cannot enforce every OS sandbox control in \"Universal execution safety\", do not execute target code. Keep such leads as `needs_validation`, as the upstream rules require.\n\n## Retaining evidence from a sandboxed check\n\nScratch is target-controlled after a check runs, so the upstream rules let only trusted parent-side code copy a file out of it, following the no-follow, descriptor-relative procedure in `UPSTREAM-SKILL.md` (\"Write isolation\"). Node has no `openat`, so the parent cannot do this itself. `scripts\u002Fpromote-artifact\u002Fpromote-artifact.go` implements that procedure.\n\n```bash\ngo run scripts\u002Fpromote-artifact\u002Fpromote-artifact.go \\\n  --scratch  \u003Coutput-dir>\u002Fagents\u002F\u003Cagent-id>\u002Fscratch \\\n  --artifacts \u003Coutput-dir>\u002Fagents\u002F\u003Cagent-id>\u002Fartifacts \\\n  --manifest \u003Cmanifest.json>\n```\n\nThe manifest is the allowlist the parent recorded **before** the sandbox started:\n\n```json\n{ \"max_file_bytes\": 1048576, \"max_total_bytes\": 8388608, \"files\": [\"report.txt\"] }\n```\n\nIt prints a JSON result — `promoted` with the byte count and sha256 of each file, `refused` with the exact reason for each — and exits 0 when everything was promoted, 1 when anything was refused, 2 on an environment error, 64 on bad usage. Copy a refusal reason verbatim into the ledger; it is the promotion blocker the record needs.\n\nIt refuses a symlinked component or leaf, a non-regular file, a hard-linked file, an over-limit or budget-busting file, an existing destination, and a source whose identity changes during the copy.\n\n**When this is available:** the parent may run target code inside the OS-enforced sandbox and record a `method: \"local\"` check citing `agents\u002F\u003Cagent-id>\u002Fartifacts\u002F\u003Cfile>`. **When it is not** — no Go toolchain, or a platform without `openat` — nothing changes from the rules above: do not use scratch output as evidence, and keep the lead as `needs_validation` with the blocker \"local execution evidence cannot be retained in this run: no parent-side artifact promotion available\".\n\nThe agent never runs the promoter and never writes to `artifacts\u002F`. Only the parent does.\n\n## When to use this skill, and when to use `security-review`\n\n- Use `security-review` for a fast checklist review of one diff (staged changes, a PR, or a path). `pre-pr` runs it.\n- Use this skill for a whole-repository or subsystem audit, a pen-test-style source review, or report artifacts. A standard run takes a long time and launches many agents. Tell the user the profile and any agent budget before you start (`UPSTREAM-SKILL.md`, \"Run profiles and scope\" and \"Cost budget\").\n\n## Optional: feed confirmed findings to `dotbabel quality`\n\n`scripts\u002Ffindings-to-sarif.mjs` converts a finished run into SARIF 2.1.0:\n\n```bash\nnode \u003Cthis-skill>\u002Fscripts\u002Ffindings-to-sarif.mjs --run-dir \u003Coutput-dir> --out .dotbabel\u002Fsecurity-audit.sarif\n```\n\n- It refuses a run whose `run_status` is not `complete`, and a `findings.json` that `validate-findings.cjs` rejects (exit 2).\n- It emits only `confirmed` records. `critical` and `high` map to `security-severity` 9.5 and 8.0, so `dotbabel quality` reports them as `security.high_confidence`.\n\nTo make the `pr` and `deep` quality profiles read the last run, write the run to an output directory that git ignores (the upstream rules allow this only when you select it and git ignores it), then declare the converter as the security tool in `.dotbabel.json`:\n\n```json\n{\n  \"quality\": {\n    \"components\": [\n      {\n        \"root\": \".\",\n        \"languages\": [\"javascript\"],\n        \"tools\": {\n          \"security\": {\n            \"argv\": [\n              \"node\",\n              \".claude\u002Fskills\u002Fsecurity-audit\u002Fscripts\u002Ffindings-to-sarif.mjs\",\n              \"--run-dir\",\n              \".security-audit\u002Frun-1\",\n              \"--out\",\n              \".dotbabel\u002Fsecurity-audit.sarif\"\n            ],\n            \"report\": { \"format\": \"sarif\", \"path\": \".dotbabel\u002Fsecurity-audit.sarif\" }\n          }\n        }\n      }\n    ]\n  }\n}\n```\n\nChange `languages` and the run directory to match the repository. The script path above is the `dotbabel init` install location. A `bootstrap.sh` install uses `~\u002F.claude\u002Fskills\u002Fsecurity-audit\u002F` instead.\n\n## Attribution\n\nThe upstream skill is Copyright Cloudflare, Inc. and ships under the MIT License in `references\u002Fupstream\u002FLICENSE`.\n","# Security Audit\n\nThis skill wraps the upstream [cloudflare\u002Fsecurity-audit-skill](https:\u002F\u002Fgithub.com\u002Fcloudflare\u002Fsecurity-audit-skill).\nThe upstream workflow is authoritative. This file only maps it onto dotbabel hosts.\n\n## Read the upstream skill first\n\n1. Read `references\u002Fupstream\u002FUPSTREAM-SKILL.md` in full, then follow it.\n2. Load the other files in `references\u002Fupstream\u002F` only when `UPSTREAM-SKILL.md` or a phase document tells you to.\n\nThe upstream copy is pinned and unchanged. `references\u002FUPSTREAM.json` records the commit.\nDo not edit files in `references\u002Fupstream\u002F`. A maintainer updates them with `scripts\u002Fsync-security-audit.mjs`.\n\n## Path mapping\n\nThe upstream docs assume that the upstream `SKILL.md` sits at the skill root. In this layout:\n\n- **Skill directory** and `\u003Cskill-dir>` mean the absolute path of `references\u002Fupstream\u002F` in this skill, not the folder that contains this file.\n- A bare `SKILL.md` in the upstream docs means `references\u002Fupstream\u002FUPSTREAM-SKILL.md`.\n- The validators run as `node \u003Cskill-dir>\u002Fvalidate-findings.cjs \u003Coutput-dir>\u002Ffindings.json` and `node \u003Cskill-dir>\u002Fvalidate-coverage-ledger.cjs \u003Coutput-dir>\u002Fcoverage-ledger.json`.\n\n## Host mapping\n\nThe upstream roles are agent-neutral (`UPSTREAM-SKILL.md`, \"Platform terminology\").\n\n| Upstream role    | Claude Code                                                                                                                                                              |\n| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| Parent           | The main session. It is the only writer of shared run files.                                                                                                             |\n| Task tool        | The `Agent` tool.                                                                                                                                                        |\n| `research` agent | `subagent_type: general-purpose`, with a prompt that keeps it read-only. Do not use `Explore`: it reads file excerpts, and the upstream verifiers need whole-file reads. |\n| `general` agent  | `subagent_type: general-purpose`.                                                                                                                                        |\n\nOn Codex, Gemini, Copilot, or another host, use the host's sub-agent mechanism only when each agent gets its own context.\n\n- If the host has no isolated parallel sub-agents, do not run full audit mode. The upstream guarantee is that the agent that checks a finding never found it. Say that this host cannot give that guarantee, and offer guidance mode.\n- If the host cannot enforce every OS sandbox control in \"Universal execution safety\", do not execute target code. Keep such leads as `needs_validation`, as the upstream rules require.\n\n## Retaining evidence from a sandboxed check\n\nScratch is target-controlled after a check runs, so the upstream rules let only trusted parent-side code copy a file out of it, following the no-follow, descriptor-relative procedure in `UPSTREAM-SKILL.md` (\"Write isolation\"). Node has no `openat`, so the parent cannot do this itself. `scripts\u002Fpromote-artifact\u002Fpromote-artifact.go` implements that procedure.\n\n```bash\ngo run scripts\u002Fpromote-artifact\u002Fpromote-artifact.go \\\n  --scratch  \u003Coutput-dir>\u002Fagents\u002F\u003Cagent-id>\u002Fscratch \\\n  --artifacts \u003Coutput-dir>\u002Fagents\u002F\u003Cagent-id>\u002Fartifacts \\\n  --manifest \u003Cmanifest.json>\n```\n\nThe manifest is the allowlist the parent recorded **before** the sandbox started:\n\n```json\n{ \"max_file_bytes\": 1048576, \"max_total_bytes\": 8388608, \"files\": [\"report.txt\"] }\n```\n\nIt prints a JSON result — `promoted` with the byte count and sha256 of each file, `refused` with the exact reason for each — and exits 0 when everything was promoted, 1 when anything was refused, 2 on an environment error, 64 on bad usage. Copy a refusal reason verbatim into the ledger; it is the promotion blocker the record needs.\n\nIt refuses a symlinked component or leaf, a non-regular file, a hard-linked file, an over-limit or budget-busting file, an existing destination, and a source whose identity changes during the copy.\n\n**When this is available:** the parent may run target code inside the OS-enforced sandbox and record a `method: \"local\"` check citing `agents\u002F\u003Cagent-id>\u002Fartifacts\u002F\u003Cfile>`. **When it is not** — no Go toolchain, or a platform without `openat` — nothing changes from the rules above: do not use scratch output as evidence, and keep the lead as `needs_validation` with the blocker \"local execution evidence cannot be retained in this run: no parent-side artifact promotion available\".\n\nThe agent never runs the promoter and never writes to `artifacts\u002F`. Only the parent does.\n\n## When to use this skill, and when to use `security-review`\n\n- Use `security-review` for a fast checklist review of one diff (staged changes, a PR, or a path). `pre-pr` runs it.\n- Use this skill for a whole-repository or subsystem audit, a pen-test-style source review, or report artifacts. A standard run takes a long time and launches many agents. Tell the user the profile and any agent budget before you start (`UPSTREAM-SKILL.md`, \"Run profiles and scope\" and \"Cost budget\").\n\n## Optional: feed confirmed findings to `dotbabel quality`\n\n`scripts\u002Ffindings-to-sarif.mjs` converts a finished run into SARIF 2.1.0:\n\n```bash\nnode \u003Cthis-skill>\u002Fscripts\u002Ffindings-to-sarif.mjs --run-dir \u003Coutput-dir> --out .dotbabel\u002Fsecurity-audit.sarif\n```\n\n- It refuses a run whose `run_status` is not `complete`, and a `findings.json` that `validate-findings.cjs` rejects (exit 2).\n- It emits only `confirmed` records. `critical` and `high` map to `security-severity` 9.5 and 8.0, so `dotbabel quality` reports them as `security.high_confidence`.\n\nTo make the `pr` and `deep` quality profiles read the last run, write the run to an output directory that git ignores (the upstream rules allow this only when you select it and git ignores it), then declare the converter as the security tool in `.dotbabel.json`:\n\n```json\n{\n  \"quality\": {\n    \"components\": [\n      {\n        \"root\": \".\",\n        \"languages\": [\"javascript\"],\n        \"tools\": {\n          \"security\": {\n            \"argv\": [\n              \"node\",\n              \".claude\u002Fskills\u002Fsecurity-audit\u002Fscripts\u002Ffindings-to-sarif.mjs\",\n              \"--run-dir\",\n              \".security-audit\u002Frun-1\",\n              \"--out\",\n              \".dotbabel\u002Fsecurity-audit.sarif\"\n            ],\n            \"report\": { \"format\": \"sarif\", \"path\": \".dotbabel\u002Fsecurity-audit.sarif\" }\n          }\n        }\n      }\n    ]\n  }\n}\n```\n\nChange `languages` and the run directory to match the repository. The script path above is the `dotbabel init` install location. A `bootstrap.sh` install uses `~\u002F.claude\u002Fskills\u002Fsecurity-audit\u002F` instead.\n\n## Attribution\n\nThe upstream skill is Copyright Cloudflare, Inc. and ships under the MIT License in `references\u002Fupstream\u002FLICENSE`.\n",{"id":5,"name":5,"task":53,"type":55,"model":56,"owner":57,"domain":58,"created":59,"updated":59,"version":60,"dotbabel":61,"maturity":66,"platform":67,"description":69,"argument-hint":70},[33,54],"diagnostics","skill","opus","@kaiohenricunha",[36,29],1790035200000,"1.0.0",{"compute":62},{"mode":63,"binding":64,"requirement":65},"floor","consumer","frontier","draft",[68],"none","Whole-repository security audit with independent verification of every finding, vendored from cloudflare\u002Fsecurity-audit-skill. Guidance by default; runs the full six-phase audit (parallel hunters, verifiers that did not hunt, coverage ledger, schema-validated findings.json) only on an explicit audit or pen-test request. Triggers on: \"security audit\", \"audit this codebase\", \"pen test the code\", \"full security review\", \"end-to-end security review\", \"security audit report\".\n","[scope path | subsystem | \u003Cbase>..\u003Chead>] [--profile quick|standard|deep]","main","91c337164997b99943fbcc64e8e362577b67bc81","skills\u002Fsecurity-audit","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha","I'm a Platform\u002FInfra engineer who happens to work in cybersec and write Go code.","2026-10-26 14:12:51",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add kaiohenricunha\u002Fdotbabel --skill security-audit",{"tool":84,"command":85},"bunx","bunx skills add kaiohenricunha\u002Fdotbabel --skill security-audit",{"tool":87,"command":88},"pnpm","pnpm dlx skills add kaiohenricunha\u002Fdotbabel --skill security-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002FSKILL.md",true,[92,98,102,106,110,114,118,122,126,132,136,140,144,148,152,156,160,166,170,174,178,182,186,190,194],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002FUPSTREAM.json","REFERENCE","参考文档",4311,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002FUPSTREAM.json",{"path":99,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fupstream\u002FAI-AND-LLM.md",10617,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FAI-AND-LLM.md",{"path":103,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fupstream\u002FATTACK-CLASSES.md",15695,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FATTACK-CLASSES.md",{"path":107,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fupstream\u002FCLIENT-SIDE.md",8594,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FCLIENT-SIDE.md",{"path":111,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fupstream\u002FCLOUD-AND-DEPLOYMENT.md",8291,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FCLOUD-AND-DEPLOYMENT.md",{"path":115,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fupstream\u002FDATA-ISOLATION-AND-LIFECYCLE.md",7798,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FDATA-ISOLATION-AND-LIFECYCLE.md",{"path":119,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fupstream\u002FDESKTOP-MOBILE-AND-LOCAL-IPC.md",8739,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FDESKTOP-MOBILE-AND-LOCAL-IPC.md",{"path":123,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fupstream\u002FHUNTING.md",22446,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FHUNTING.md",{"path":127,"resourceType":128,"resourceTypeDesc":129,"sizeBytes":130,"sourceHtmlUrl":131},"references\u002Fupstream\u002FLICENSE","LICENSE","许可证",1078,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FLICENSE",{"path":133,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":134,"sourceHtmlUrl":135},"references\u002Fupstream\u002FMEMORY-SAFETY-AND-BINARY.md",10513,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FMEMORY-SAFETY-AND-BINARY.md",{"path":137,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":138,"sourceHtmlUrl":139},"references\u002Fupstream\u002FPROTOCOLS-RPC-AND-MESSAGING.md",7483,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FPROTOCOLS-RPC-AND-MESSAGING.md",{"path":141,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":142,"sourceHtmlUrl":143},"references\u002Fupstream\u002FRECONNAISSANCE.md",15902,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FRECONNAISSANCE.md",{"path":145,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":146,"sourceHtmlUrl":147},"references\u002Fupstream\u002Freport-schema.json",14494,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002Freport-schema.json",{"path":149,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":150,"sourceHtmlUrl":151},"references\u002Fupstream\u002FRESOURCE-EXHAUSTION-AND-AVAILABILITY.md",7476,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FRESOURCE-EXHAUSTION-AND-AVAILABILITY.md",{"path":153,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":154,"sourceHtmlUrl":155},"references\u002Fupstream\u002FSUPPLY-CHAIN-AND-RELEASE.md",7258,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FSUPPLY-CHAIN-AND-RELEASE.md",{"path":157,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":158,"sourceHtmlUrl":159},"references\u002Fupstream\u002FUPSTREAM-SKILL.md",22026,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FUPSTREAM-SKILL.md",{"path":161,"resourceType":162,"resourceTypeDesc":163,"sizeBytes":164,"sourceHtmlUrl":165},"references\u002Fupstream\u002Fvalidate-coverage-ledger.cjs","SCRIPT","脚本",33522,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002Fvalidate-coverage-ledger.cjs",{"path":167,"resourceType":162,"resourceTypeDesc":163,"sizeBytes":168,"sourceHtmlUrl":169},"references\u002Fupstream\u002Fvalidate-coverage-ledger.test.cjs",28483,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002Fvalidate-coverage-ledger.test.cjs",{"path":171,"resourceType":162,"resourceTypeDesc":163,"sizeBytes":172,"sourceHtmlUrl":173},"references\u002Fupstream\u002Fvalidate-findings.cjs",28806,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002Fvalidate-findings.cjs",{"path":175,"resourceType":162,"resourceTypeDesc":163,"sizeBytes":176,"sourceHtmlUrl":177},"references\u002Fupstream\u002Fvalidate-findings.test.cjs",26384,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002Fvalidate-findings.test.cjs",{"path":179,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":180,"sourceHtmlUrl":181},"references\u002Fupstream\u002FVALIDATION-AND-REPORTING.md",17843,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FVALIDATION-AND-REPORTING.md",{"path":183,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":184,"sourceHtmlUrl":185},"references\u002Fupstream\u002FWEB-PROTOCOL-AND-AUTH.md",12300,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Freferences\u002Fupstream\u002FWEB-PROTOCOL-AND-AUTH.md",{"path":187,"resourceType":162,"resourceTypeDesc":163,"sizeBytes":188,"sourceHtmlUrl":189},"scripts\u002Ffindings-to-sarif.mjs",6720,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Fscripts\u002Ffindings-to-sarif.mjs",{"path":191,"resourceType":162,"resourceTypeDesc":163,"sizeBytes":192,"sourceHtmlUrl":193},"scripts\u002Fpromote-artifact\u002Fpromote-artifact_test.go",9316,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Fscripts\u002Fpromote-artifact\u002Fpromote-artifact_test.go",{"path":195,"resourceType":162,"resourceTypeDesc":163,"sizeBytes":196,"sourceHtmlUrl":197},"scripts\u002Fpromote-artifact\u002Fpromote-artifact.go",12971,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-audit\u002Fscripts\u002Fpromote-artifact\u002Fpromote-artifact.go",[199,223,248,270,291,314],{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":48},"01M6XDQ7QMASPFZ355MYKCD06T","yolo","Start temporary autonomy for the current task or an explicit scope with a required --for expiry. Codex permits scoped pushes, merges, deploys, and releases after strict testing and validation; Full access is a separate runtime setting. Claude Code uses a session permission hook with a protected-action denylist.","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fyolo\u002FSKILL.md",[205],{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},[201,207,208,46,209,210,211,212,213,214,215,216,217,37,36,218,219,220,221,222],"testing","merge","start","access","session","ops","autonomy","releases","permission","full","runtime","hook","true","action","for","scoped",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":233,"publishedAt":48},"01M6XDQ1N21VE4KH98JWGZ7GN9","veracity-audit","Audit a data pipeline for Veracity and Value. Dispatches data-scientist, compliance-auditor, and data-engineer agents with project context injected at dispatch time. All source paths are supplied via flags — no defaults, no project assumptions. Subcommands: audit (full pipeline walk), score-check (scoring math only), gate-check (gate coverage only), source-trace \u003Clabel> (single source end-to-end). Invoke when: \"audit pipeline\", \"veracity check\", \"scoring math correct?\", \"check gates\", \"trace source\", \"verify quality gates\", \"formula correct?\".","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fveracity-audit\u002FSKILL.md",[229,230],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":231,"categoryName":232,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务",[30,234,207,33,235,236,237,238,42,41,239,240,241,242,243,244,38,245,246,247],"veracity audit","data pipeline","pipeline","Bash","math","engineer","formula","scoring","time","project","worker","at","invoke","when",{"skillNo":249,"name":250,"nameZh":6,"description":251,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":252,"categories":253,"keywords":254,"publishedAt":48},"01M6XDPVDKBR376C06CEK9BC5S","validate-spec","Audit an already-implemented spec against the codebase. Walks each constraint (ARCH-N, PERF-N, KD-N, etc.) and acceptance criterion, grounds findings in file:line evidence, runs the spec.json acceptance_commands, and writes a single audit doc to docs\u002Faudits\u002F. Use whenever the user asks to \"validate a spec\", \"audit a spec\", \"check if spec is implemented\", \"verify the spec is done\", \"is this spec really done\", or otherwise wants closure on spec-driven work. Read-only against the spec — produces an audit, never modifies the spec itself.","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fvalidate-spec\u002FSKILL.md",[],[255,256,257,207,33,258,259,30,237,260,261,262,41,263,264,265,266,267,268,269],"spec","validate","validate spec","run","acceptance","work","read","never","max","done","arch","line","2025","spec-driven","closure",{"skillNo":271,"name":272,"nameZh":6,"description":273,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":274,"categories":275,"keywords":279,"publishedAt":48},"01M6XDPMMECH82RAW553Y94HDS","terragrunt-specialist","Deep-dive Terragrunt hierarchy review, DRY pattern audits, and run-all orchestration analysis. Use for structured investigations of multi-environment Terragrunt layouts, dependency graphs, remote state config, and hook correctness. Triggers on: \"Terragrunt audit\", \"run-all review\", \"dependency block\", \"DRY pattern review\", \"env hierarchy audit\", \"mock_outputs\", \"terragrunt hooks\".","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fterragrunt-specialist\u002FSKILL.md",[276],{"categoryNo":277,"categoryName":278,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",[280,281,282,33,283,284,258,30,285,237,261,286,287,263,39,288,267,289,245,290],"terragrunt","specialist","terragrunt specialist","orchestration","debugging","analysis","dependency","hooks","dry","remote","hierarchy",{"skillNo":292,"name":293,"nameZh":6,"description":294,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":295,"categories":296,"keywords":304,"publishedAt":48},"01M6XDPFJS2HGSE13RXF1HV8S7","terraform-specialist","Deep-dive Terraform architecture review, module design, state management, and migration. Use for structured investigations of Terraform workspaces, provider configuration, module coupling, import workflows, and test coverage. Triggers on: \"Terraform audit\", \"module review\", \"state management\", \"Terraform import\", \"workspace design\", \"provider config review\", \"Terraform testing\".","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fterraform-specialist\u002FSKILL.md",[297,300,301],{"categoryNo":298,"categoryName":299,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":277,"categoryName":278,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":302,"categoryName":303,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",[305,306,281,207,307,33,308,309,310,284,30,237,261,42,311,312,39,313,267,245],"terraform","terraform specialist","design","workflows","architecture","architecture review","test coverage","workspaces","problem",{"skillNo":315,"name":255,"nameZh":6,"description":316,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":317,"categories":318,"keywords":323,"publishedAt":48},"01M6XDP7V6H8WYPSXVEKYE6HJ6","Create structured engineering specs through interactive pairing. Use when the user wants to create a spec, design doc, technical specification, architecture document, RFC, or engineering plan. Triggers on \"let's spec this out\", \"create a spec\", \"design doc\", \"write a technical plan\", \"plan the architecture\". Works for greenfield and brownfield projects. Outputs to docs\u002Fspecs\u002F.","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fspec\u002FSKILL.md",[319,320],{"categoryNo":302,"categoryName":303,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":321,"categoryName":322,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000032","设计师",[255,307,324,309,325,326,327,328,329,330,331,332,333,56,334,221,335,336,337,65],"component","create","plan","projects","write","interactive","use","document","specification","triggers","technical specification","trade-offs","technical plan","outputs"]