[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70FKJGFWXYVDASTPMRZ5M7H":3,"skill-same:01M70FKJGFWXYVDASTPMRZ5M7H":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M70FKJGFWXYVDASTPMRZ5M7H","agent-security-hardening",null,"Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building or reviewing an agent runtime, autonomous worker, tool gateway, memory service, or multi-tenant agent deployment. Do not use for general web application security or offensive testing.","mdnaimul22\u002Fhuman-skills","mdnaimul22","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F64520358?v=4","01M70FH95MH2H796Q01TYSFZ03","Naimul","01M70FH96798CQR4YHA13F17GA",3,"MIT","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Faffaan-m_ECC\u002Fagent-security-hardening\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","agent security hardening","hardening","security hardening","agent security","Tools","offensive","application security","agent frameworks","write","credentials","when","invoke","ai agent","autonomous","files","worker","testing","memory","tenant","2026-11-10 10:12:30",false,"---\nname: agent-security-hardening\ndescription: Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building or reviewing an agent runtime, autonomous worker, tool gateway, memory service, or multi-tenant agent deployment. Do not use for general web application security or offensive testing.\nmetadata:\n  origin: ECC\n---\n\n# Agent Security Hardening\n\nHarden the boundaries where an agent turns untrusted data into filesystem, network, memory, or tool actions. Produce concrete controls and tests for the framework being reviewed; a checklist without enforcement evidence is incomplete.\n\n## Important\n\n- Treat model output, retrieved content, tool output, memory, and cross-agent messages as untrusted input.\n- Default external integrations to read-only and grant each write capability separately.\n- Validate at the action boundary even when an upstream prompt or schema already validated the value.\n- Fail closed before a side effect when identity, destination, ownership, or containment cannot be proven.\n- Before a delete, publish, credential rotation, or other irreversible action, the real tool entry point must authorize the authenticated principal for that exact operation and resource scope, then require explicit confirmation or a valid scoped pre-approval. Missing or invalid evidence blocks the action.\n- Use hard bounds defined by the governing requirement and stricter values verified from deployment configuration. When neither defines a value, mark it as a required decision and test that the implementation rejects an unbounded configuration; do not invent a plausible value.\n\n## When to Activate\n\n- Building an autonomous agent, tool gateway, memory service, or agent-to-agent protocol\n- Reviewing code that maps model output into commands, paths, URLs, credentials, or API mutations\n- Isolating tenants, projects, sessions, or workspaces in a long-running agent process\n- Hardening temporary files, logs, tool responses, or external-content ingestion\n\n## Hardening Workflow\n\n### 1. Map Trust Boundaries\n\nList every boundary as `source -> parser -> validator -> side effect`. Include direct user input, model output, retrieved documents, memory, environment variables, tool results, and messages from other agents.\n\nFor each side effect, record:\n\n- the identity and scope authorizing it;\n- the exact validator that runs immediately before it;\n- the maximum input and output size;\n- the audit evidence produced;\n- the recovery path if the operation is interrupted.\n\nThis step is complete when every write, command, network mutation, and credential use has one named authorization boundary.\n\n### 2. Validate Identifiers, Environment Values, and URLs\n\nUse an allowlist for identifiers that become filenames, keys, selectors, or command arguments. Agent IDs have the issue-defined hard maximum of 64 characters; deployment configuration may choose a stricter positive limit but cannot raise that boundary:\n\n```python\nimport re\n\nSAFE_AGENT_ID_CHARS = re.compile(r\"^[A-Za-z0-9_][A-Za-z0-9_-]*$\")\nHARD_MAX_AGENT_ID_LENGTH = 64\n\ndef require_agent_id(value: object, *, max_length: int) -> str:\n    if (\n        isinstance(max_length, bool)\n        or not isinstance(max_length, int)\n        or not 1 \u003C= max_length \u003C= HARD_MAX_AGENT_ID_LENGTH\n    ):\n        raise RuntimeError(\"configured agent ID limit must be between 1 and 64\")\n    if (\n        not isinstance(value, str)\n        or len(value) > max_length\n        or not SAFE_AGENT_ID_CHARS.fullmatch(value)\n    ):\n        raise ValueError(\"invalid agent identifier\")\n    return value\n```\n\nWhen an identifier becomes a CLI argument, pass it through an argv API and place it after the command's end-of-options marker where supported. Character validation is not a substitute for argument separation.\n\nReject missing and whitespace-only environment values before constructing a client:\n\n```python\ndef require_env(name: str, environ: dict[str, str]) -> str:\n    value = environ.get(name)\n    if value is None or not value.strip():\n        raise RuntimeError(f\"{name} is required\")\n    return value\n```\n\nParse URLs, allow only schemes required by the deployment, require a host, reject embedded credentials, and block private-network destinations when the URL is attacker-controlled. For every outbound connection and redirect hop, pin the connection to a validated public address or verify the connected peer address at connection time so DNS rebinding cannot cross the boundary. A credential-bearing request must use HTTPS with certificate verification before credentials are attached. Disable automatic cross-origin credential forwarding; when the scheme or origin changes, strip the credentials and reauthorize the new destination or reject the redirect. Re-run destination, connected-address, and transport validation on every hop.\n\nThis step is complete when tests reject empty, oversized, malformed, traversal-shaped, credential-bearing, and unauthorized-destination values before any side effect, and prove that DNS rebinding and cross-origin redirects cannot carry credentials to an unapproved peer.\n\n### 3. Contain Filesystem Access\n\nReject absolute user-controlled paths and traversal components before joining. Reject Windows-unsafe components on every platform so behavior stays portable: reserved device names (`CON`, `NUL`, `COM1`, `LPT1`, including with an extension such as `nul.txt`), names ending in a dot or space (Win32 strips them), and `:` (drive-relative or NTFS alternate data stream syntax such as `report.txt:ads`). Resolve both the workspace and candidate path, then prove containment:\n\n```python\nimport re\nfrom pathlib import Path\n\nWINDOWS_RESERVED_NAME = re.compile(\n    r\"(CON|PRN|AUX|NUL|COM[1-9¹²³]|LPT[1-9¹²³])(\\..*)?\",\n    re.IGNORECASE,\n)\n\ndef workspace_path(workspace: Path, requested: str) -> Path:\n    # Treat both platform separators consistently before checking components.\n    relative = Path(requested.replace(\"\\\\\", \"\u002F\"))\n    if relative.is_absolute() or \"..\" in relative.parts:\n        raise ValueError(\"path must be workspace-relative\")\n    for part in relative.parts:\n        if \":\" in part or part.endswith((\".\", \" \")) or WINDOWS_RESERVED_NAME.fullmatch(part):\n            raise ValueError(\"path component is not portable\")\n\n    root = workspace.resolve(strict=True)\n    candidate = (root \u002F relative).resolve(strict=False)\n    if not candidate.is_relative_to(root):\n        raise ValueError(\"path escapes workspace\")\n    return candidate\n```\n\nContainment checks do not eliminate symlink races. For sensitive writes, open relative to a trusted directory handle where the platform supports it, reject symlink targets, create files exclusively, and verify ownership and permissions after opening.\n\nThis step is complete when tests cover sibling-prefix paths, nested `..`, absolute paths, symlink escapes, reserved device names, trailing dots or spaces, alternate data stream syntax, and a valid nested workspace path.\n\n### 4. Protect Temporary Data and Credentials\n\n- Create sensitive files with owner-only permissions such as `0o600`; create private directories with `0o700`.\n- Prefer a user-private runtime directory over a shared temporary directory for credentials or tenant data.\n- Create unpredictable names atomically; do not check-then-create.\n- Remove temporary data in `finally`, while preserving a redacted error record when cleanup fails.\n- Keep secrets out of command arguments, model context, logs, traces, exception text, and tool responses.\n- Pass secrets through the platform's secret store or scoped environment injection and rotate exposed credentials.\n- Treat zeroization as best effort: mutable byte buffers can be overwritten, but immutable language strings cannot be reliably erased.\n\nThis step is complete when file-mode checks, forced-error cleanup tests, and log-capture tests show that secret values never persist outside the approved boundary.\n\n### 5. Bound and Sanitize Tool Output\n\nRead tool output with a byte limit rather than collecting an unbounded stream. Preserve structured fields, remove disallowed control characters, and append an explicit truncation marker with the original byte count. Keep a content hash when later forensic comparison matters.\n\nDo not silently turn malformed output into an empty success value. Return a typed failure that names the producing tool, boundary, and validation reason without echoing sensitive content.\n\nThis step is complete when oversized output, invalid encoding, terminal-control sequences, malformed structured data, and a normal response all have deterministic tests.\n\n## Verification Gate\n\nBefore calling the framework hardened, verify all of these behaviors through its real entry point:\n\n1. Untrusted instructions remain data and cannot trigger a tool or write.\n2. An irreversible action without operation-and-resource authorization plus confirmation or scoped pre-approval leaves no side effect.\n3. Cross-tenant and cross-workspace identifiers are rejected at the action boundary.\n4. Traversal and symlink escape attempts leave the filesystem unchanged.\n5. Forced failures leave no credential-bearing temp files or logs.\n6. Oversized or malformed tool output returns an explicit bounded error.\n\nReport the command used, exit status, rejected input, and observed absence of the side effect. Mock-only tests do not prove operating-system permissions, symlink handling, subprocess isolation, or network egress controls.\n\n## Common Issues\n\n### Validation exists only in the prompt\n\nPrompt instructions are advisory. Move the same invariant into deterministic code immediately before the side effect and test a model response that violates it.\n\n### A normalized path still escapes\n\nString prefix checks confuse sibling paths such as `\u002Fwork\u002Fapp` and `\u002Fwork\u002Fapplication`. Resolve paths and use component-aware containment, then test symlinks separately.\n\n### Redaction happens after logging\n\nRedact before values enter the logger, tracer, exception, or model context. Add a capture test using a sentinel secret and assert the sentinel is absent from every emitted channel.\n\n## When NOT to Use\n\n- Use `security-review` for ordinary application authentication, authorization, SQL injection, XSS, CSRF, and API security.\n- Use `security-scan` for repository-wide automated vulnerability scanning.\n- Use infrastructure-specific guidance for host, container, firewall, or cloud hardening.\n- Do not use this skill for penetration testing, exploit development, or unauthorized access.\n\n## Related Skills\n\n- `agent-harness-construction`\n- `security-review`\n- `security-scan`\n","# Agent Security Hardening\n\nHarden the boundaries where an agent turns untrusted data into filesystem, network, memory, or tool actions. Produce concrete controls and tests for the framework being reviewed; a checklist without enforcement evidence is incomplete.\n\n## Important\n\n- Treat model output, retrieved content, tool output, memory, and cross-agent messages as untrusted input.\n- Default external integrations to read-only and grant each write capability separately.\n- Validate at the action boundary even when an upstream prompt or schema already validated the value.\n- Fail closed before a side effect when identity, destination, ownership, or containment cannot be proven.\n- Before a delete, publish, credential rotation, or other irreversible action, the real tool entry point must authorize the authenticated principal for that exact operation and resource scope, then require explicit confirmation or a valid scoped pre-approval. Missing or invalid evidence blocks the action.\n- Use hard bounds defined by the governing requirement and stricter values verified from deployment configuration. When neither defines a value, mark it as a required decision and test that the implementation rejects an unbounded configuration; do not invent a plausible value.\n\n## When to Activate\n\n- Building an autonomous agent, tool gateway, memory service, or agent-to-agent protocol\n- Reviewing code that maps model output into commands, paths, URLs, credentials, or API mutations\n- Isolating tenants, projects, sessions, or workspaces in a long-running agent process\n- Hardening temporary files, logs, tool responses, or external-content ingestion\n\n## Hardening Workflow\n\n### 1. Map Trust Boundaries\n\nList every boundary as `source -> parser -> validator -> side effect`. Include direct user input, model output, retrieved documents, memory, environment variables, tool results, and messages from other agents.\n\nFor each side effect, record:\n\n- the identity and scope authorizing it;\n- the exact validator that runs immediately before it;\n- the maximum input and output size;\n- the audit evidence produced;\n- the recovery path if the operation is interrupted.\n\nThis step is complete when every write, command, network mutation, and credential use has one named authorization boundary.\n\n### 2. Validate Identifiers, Environment Values, and URLs\n\nUse an allowlist for identifiers that become filenames, keys, selectors, or command arguments. Agent IDs have the issue-defined hard maximum of 64 characters; deployment configuration may choose a stricter positive limit but cannot raise that boundary:\n\n```python\nimport re\n\nSAFE_AGENT_ID_CHARS = re.compile(r\"^[A-Za-z0-9_][A-Za-z0-9_-]*$\")\nHARD_MAX_AGENT_ID_LENGTH = 64\n\ndef require_agent_id(value: object, *, max_length: int) -> str:\n    if (\n        isinstance(max_length, bool)\n        or not isinstance(max_length, int)\n        or not 1 \u003C= max_length \u003C= HARD_MAX_AGENT_ID_LENGTH\n    ):\n        raise RuntimeError(\"configured agent ID limit must be between 1 and 64\")\n    if (\n        not isinstance(value, str)\n        or len(value) > max_length\n        or not SAFE_AGENT_ID_CHARS.fullmatch(value)\n    ):\n        raise ValueError(\"invalid agent identifier\")\n    return value\n```\n\nWhen an identifier becomes a CLI argument, pass it through an argv API and place it after the command's end-of-options marker where supported. Character validation is not a substitute for argument separation.\n\nReject missing and whitespace-only environment values before constructing a client:\n\n```python\ndef require_env(name: str, environ: dict[str, str]) -> str:\n    value = environ.get(name)\n    if value is None or not value.strip():\n        raise RuntimeError(f\"{name} is required\")\n    return value\n```\n\nParse URLs, allow only schemes required by the deployment, require a host, reject embedded credentials, and block private-network destinations when the URL is attacker-controlled. For every outbound connection and redirect hop, pin the connection to a validated public address or verify the connected peer address at connection time so DNS rebinding cannot cross the boundary. A credential-bearing request must use HTTPS with certificate verification before credentials are attached. Disable automatic cross-origin credential forwarding; when the scheme or origin changes, strip the credentials and reauthorize the new destination or reject the redirect. Re-run destination, connected-address, and transport validation on every hop.\n\nThis step is complete when tests reject empty, oversized, malformed, traversal-shaped, credential-bearing, and unauthorized-destination values before any side effect, and prove that DNS rebinding and cross-origin redirects cannot carry credentials to an unapproved peer.\n\n### 3. Contain Filesystem Access\n\nReject absolute user-controlled paths and traversal components before joining. Reject Windows-unsafe components on every platform so behavior stays portable: reserved device names (`CON`, `NUL`, `COM1`, `LPT1`, including with an extension such as `nul.txt`), names ending in a dot or space (Win32 strips them), and `:` (drive-relative or NTFS alternate data stream syntax such as `report.txt:ads`). Resolve both the workspace and candidate path, then prove containment:\n\n```python\nimport re\nfrom pathlib import Path\n\nWINDOWS_RESERVED_NAME = re.compile(\n    r\"(CON|PRN|AUX|NUL|COM[1-9¹²³]|LPT[1-9¹²³])(\\..*)?\",\n    re.IGNORECASE,\n)\n\ndef workspace_path(workspace: Path, requested: str) -> Path:\n    # Treat both platform separators consistently before checking components.\n    relative = Path(requested.replace(\"\\\\\", \"\u002F\"))\n    if relative.is_absolute() or \"..\" in relative.parts:\n        raise ValueError(\"path must be workspace-relative\")\n    for part in relative.parts:\n        if \":\" in part or part.endswith((\".\", \" \")) or WINDOWS_RESERVED_NAME.fullmatch(part):\n            raise ValueError(\"path component is not portable\")\n\n    root = workspace.resolve(strict=True)\n    candidate = (root \u002F relative).resolve(strict=False)\n    if not candidate.is_relative_to(root):\n        raise ValueError(\"path escapes workspace\")\n    return candidate\n```\n\nContainment checks do not eliminate symlink races. For sensitive writes, open relative to a trusted directory handle where the platform supports it, reject symlink targets, create files exclusively, and verify ownership and permissions after opening.\n\nThis step is complete when tests cover sibling-prefix paths, nested `..`, absolute paths, symlink escapes, reserved device names, trailing dots or spaces, alternate data stream syntax, and a valid nested workspace path.\n\n### 4. Protect Temporary Data and Credentials\n\n- Create sensitive files with owner-only permissions such as `0o600`; create private directories with `0o700`.\n- Prefer a user-private runtime directory over a shared temporary directory for credentials or tenant data.\n- Create unpredictable names atomically; do not check-then-create.\n- Remove temporary data in `finally`, while preserving a redacted error record when cleanup fails.\n- Keep secrets out of command arguments, model context, logs, traces, exception text, and tool responses.\n- Pass secrets through the platform's secret store or scoped environment injection and rotate exposed credentials.\n- Treat zeroization as best effort: mutable byte buffers can be overwritten, but immutable language strings cannot be reliably erased.\n\nThis step is complete when file-mode checks, forced-error cleanup tests, and log-capture tests show that secret values never persist outside the approved boundary.\n\n### 5. Bound and Sanitize Tool Output\n\nRead tool output with a byte limit rather than collecting an unbounded stream. Preserve structured fields, remove disallowed control characters, and append an explicit truncation marker with the original byte count. Keep a content hash when later forensic comparison matters.\n\nDo not silently turn malformed output into an empty success value. Return a typed failure that names the producing tool, boundary, and validation reason without echoing sensitive content.\n\nThis step is complete when oversized output, invalid encoding, terminal-control sequences, malformed structured data, and a normal response all have deterministic tests.\n\n## Verification Gate\n\nBefore calling the framework hardened, verify all of these behaviors through its real entry point:\n\n1. Untrusted instructions remain data and cannot trigger a tool or write.\n2. An irreversible action without operation-and-resource authorization plus confirmation or scoped pre-approval leaves no side effect.\n3. Cross-tenant and cross-workspace identifiers are rejected at the action boundary.\n4. Traversal and symlink escape attempts leave the filesystem unchanged.\n5. Forced failures leave no credential-bearing temp files or logs.\n6. Oversized or malformed tool output returns an explicit bounded error.\n\nReport the command used, exit status, rejected input, and observed absence of the side effect. Mock-only tests do not prove operating-system permissions, symlink handling, subprocess isolation, or network egress controls.\n\n## Common Issues\n\n### Validation exists only in the prompt\n\nPrompt instructions are advisory. Move the same invariant into deterministic code immediately before the side effect and test a model response that violates it.\n\n### A normalized path still escapes\n\nString prefix checks confuse sibling paths such as `\u002Fwork\u002Fapp` and `\u002Fwork\u002Fapplication`. Resolve paths and use component-aware containment, then test symlinks separately.\n\n### Redaction happens after logging\n\nRedact before values enter the logger, tracer, exception, or model context. Add a capture test using a sentinel secret and assert the sentinel is absent from every emitted channel.\n\n## When NOT to Use\n\n- Use `security-review` for ordinary application authentication, authorization, SQL injection, XSS, CSRF, and API security.\n- Use `security-scan` for repository-wide automated vulnerability scanning.\n- Use infrastructure-specific guidance for host, container, firewall, or cloud hardening.\n- Do not use this skill for penetration testing, exploit development, or unauthorized access.\n\n## Related Skills\n\n- `agent-harness-construction`\n- `security-review`\n- `security-scan`\n",{"name":5,"metadata":49,"description":7},{"origin":50},"ECC","main","74715deacdc69119d739f38916f8ee4f0f979ebf","skills\u002Fstorage\u002Faffaan-m_ECC\u002Fagent-security-hardening",0,"https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills","https:\u002F\u002Fgithub.com\u002Fmdnaimul22","AI Agents Workflows Automation | Specializing in Python, FastAPI, MCP Agents & Custom ERP.","2026-11-11 21:16:57",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add mdnaimul22\u002Fhuman-skills --skill agent-security-hardening",{"tool":65,"command":66},"bunx","bunx skills add mdnaimul22\u002Fhuman-skills --skill agent-security-hardening",{"tool":68,"command":69},"pnpm","pnpm dlx skills add mdnaimul22\u002Fhuman-skills --skill agent-security-hardening","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Faffaan-m_ECC\u002Fagent-security-hardening\u002FSKILL.md",true,[],[74,82,109,131,150,165],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":81},"01M72JT3YP1SQHD0MANGDXQ4RT","higgsfield-websites","Build, edit, and deploy full-stack websites, apps and games via the Higgsfield CLI (`higgsfield website …`). Each is a React 19 + TanStack Start SSR app in one Cloudflare Worker (D1\u002FR2\u002FKV\u002FDO\u002FContainers). THREE product types, picked via `--type` on create: `website` (standalone, no Higgsfield integration — references\u002Fwebsite-flow.md), `app` (Sign in with Higgsfield + fnf SDK, Quanta — references\u002Fapp-flow.md), `game` (realtime multiplayer rooms — references\u002Fgame-flow.md). Routes to the right flow; each carries its own rules and deploy\u002Fpublish gates.\nUse when: \"build me a website\", \"make a landing page\", \"create a web app\", \"build a SaaS dashboard \u002F portfolio\", \"make me a game\", \"deploy this site\", \"publish\". Also owns GAME ART: \"make a spritesheet\", \"tileable texture\", \"animate a 3D character\", game music\u002FSFX — see the game-* references.\nNOT for: single image\u002Fvideo\u002Faudio generation (higgsfield-generate), product photos (higgsfield-product-photoshoot), marketplace cards (higgsfield-marketplace-cards).","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fhiggsfield-ai_skills\u002Fhiggsfield-websites\u002FSKILL.md",[],[],"2026-11-10 22:39:42",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":100,"publishedAt":44},"01M70JPK8HAXXA85P7Q8NKZZYG","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fwriting-skills\u002FSKILL.md",[88,91,96,97],{"categoryNo":89,"categoryName":90,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":98,"categoryName":99,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[101,102,103,104,105,106,107,35,108],"writing","writing skills","editing","deployment","use","Existing","new","work",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":120,"publishedAt":44},"01M70JP4PHBH1CQVVDWZ94W159","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fwriting-plans\u002FSKILL.md",[115,116,117],{"categoryNo":89,"categoryName":90,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},{"categoryNo":118,"categoryName":119,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000030","开发工程师",[101,121,122,123,35,124,125,105,126,127,128,129,130],"writing plans","plans","you","code","for","requirements","task","multi","spec","multi-step task",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":44},"01M70JNTYVGXFZT8PASZ844TH8","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fverification-before-completion\u002FSKILL.md",[],[138,139,140,141,142,143,105,144,145,146,35,147,108,148,149],"verification","verification before completion","complete","about","output","assertions","prs","evidence","claim","claims","commands","running",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":44},"01M70JNGVSQDESWN0Q5BPJ875V","using-superpowers","Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fusing-superpowers\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,159,160,161,105,35,162,163,164],"using superpowers","superpowers","conversation","how to","how","find","questions",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":44},"01M70JN57CE588NPYPYTWH1DWG","using-git-worktrees","Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fusing-git-worktrees\u002FSKILL.md",[],[172,173,174,175,176,177,35,108,178,179,180,29,181,182,183,122,105,184,185],"using git worktrees","Using git","git","worktrees","git worktrees","implementation","git worktree","worktree","native","isolation","fallback","feature","via","workspace"]