[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70FT6RQ56H30T3CCEB4GV7H":3,"skill-same:01M70FT6RQ56H30T3CCEB4GV7H":54},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":22,"linkOnly":23,"markdownContent":24,"markdownBody":25,"frontMatter":26,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":33,"repositoryHtmlUrl":34,"repositoryHomepageUrl":35,"ownerHtmlUrl":36,"ownerBlogUrl":37,"ownerDescription":38,"updatedAt":39,"install":40,"resources":53},"01M70FT6RQ56H30T3CCEB4GV7H","audit-security",null,"Is this safe?","dhaupin\u002Fvant","dhaupin","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6352930?v=4","01M70FR23MK9RWZMWEQCWXMJ5Y","01M70FR24ETCQQSC3TGH374C6A",16,"MIT","https:\u002F\u002Fgithub.com\u002Fdhaupin\u002Fvant\u002Fblob\u002Fmain\u002Fmodels\u002Fpublic\u002Fvant\u002Fskills\u002Fvant-skill-audit-security\u002FSKILL.md",[],[18,19,20,21],"security","audit","audit security","safe","2026-11-10 10:12:30",false,"---\nname: audit-security\ndescription: Is this safe?\nlicense: MIT\nmetadata:\n  author: vant\n  version: \"1.0\"\n---\n\n# Security Audit\n\n> Is this safe?\n\n---\n\n## When To Run\n\n- Before deploy\n- After adding auth\u002Fcredentials\n- New endpoints\n- External inputs\n\n---\n\n## What To Check\n\n### 1. Credentials\n\n```bash\n# Hardcoded secrets?\ngrep -rn \"sk-\\|api_key\\|password\\|secret\" . --include=\"*.js\"\ngrep -rn \"Bearer\\|Token\" . --include=\"*.js\"\n```\n\n| Check | Issue | Fix |\n|-------|-------|-----|\n| Hardcoded API key | HIGH | Use env var |\n| Password in code | HIGH | Use env |\n| Token in logs | MEDIUM | Redact |\n\n### 2. Inputs\n\n```javascript\n\u002F\u002F Never trust user input\nreq.params.id\nreq.body.data\nquery.string\n```\n\n| Check | Issue | Fix |\n|-------|-------|-----|\n| SQL from input | HIGH | Parameterize |\n| Eval input | HIGH | Remove eval |\n| Shell from input | HIGH | No shell |\n| File from input | HIGH | Validate path |\n\n### 3. Auth\n\n```javascript\n\u002F\u002F Check auth exists\nfunction protected() {\n  if (!req.user) return error\n  \u002F\u002F Good\n}\n```\n\n| Check | Issue | Fix |\n|-------|-------|-----|\n| No auth check | HIGH | Add auth |\n| Auth bypassed | HIGH | Fix |\n| Weak auth | MEDIUM | Strengthen |\n\n### 4. Network\n\n| Check | Issue |\n|-------|-------|\n| HTTP not HTTPS | Use HTTPS |\n| Credentials in URL | Headers only |\n| No CORS | Set CORS |\n\n### 5. Filesystem\n\n```javascript\n\u002F\u002F Check file access\nfs.readFile(userPath)\n```\n\n| Check | Issue | Fix |\n|-------|-------|-----|\n| Path traversal | HIGH | Sanitize |\n| Read any file | HIGH | Validate |\n| Write anywhere | HIGH | Restrict |\n\n---\n\n## Output\n\n```\n## Security Audit - [file]\n\n### Credentials\n- [PASS\u002FFAIL] Hardcoded keys: [details]\n\n### Inputs  \n- [PASS\u002FFAIL] SQL injection: [details]\n\n### Auth\n- [PASS\u002FFAIL] Protected: [details]\n\n### Summary\n| Severity | Count |\n|----------|-------|\n| HIGH     | 0     |\n| MEDIUM   | 0     |\n| LOW     | 0     |\n```\n\n---\n\n## Severity\n\n| Severity | Meaning |\n|----------|---------|\n| HIGH | Exploit - fix now |\n| MEDIUM | Risk - fix soon |\n| LOW | Note - fix Optional |\n\n---\n\n**Role**: Security Auditor **Input**: Code to review **Output**: Issues found\n","# Security Audit\n\n> Is this safe?\n\n---\n\n## When To Run\n\n- Before deploy\n- After adding auth\u002Fcredentials\n- New endpoints\n- External inputs\n\n---\n\n## What To Check\n\n### 1. Credentials\n\n```bash\n# Hardcoded secrets?\ngrep -rn \"sk-\\|api_key\\|password\\|secret\" . --include=\"*.js\"\ngrep -rn \"Bearer\\|Token\" . --include=\"*.js\"\n```\n\n| Check | Issue | Fix |\n|-------|-------|-----|\n| Hardcoded API key | HIGH | Use env var |\n| Password in code | HIGH | Use env |\n| Token in logs | MEDIUM | Redact |\n\n### 2. Inputs\n\n```javascript\n\u002F\u002F Never trust user input\nreq.params.id\nreq.body.data\nquery.string\n```\n\n| Check | Issue | Fix |\n|-------|-------|-----|\n| SQL from input | HIGH | Parameterize |\n| Eval input | HIGH | Remove eval |\n| Shell from input | HIGH | No shell |\n| File from input | HIGH | Validate path |\n\n### 3. Auth\n\n```javascript\n\u002F\u002F Check auth exists\nfunction protected() {\n  if (!req.user) return error\n  \u002F\u002F Good\n}\n```\n\n| Check | Issue | Fix |\n|-------|-------|-----|\n| No auth check | HIGH | Add auth |\n| Auth bypassed | HIGH | Fix |\n| Weak auth | MEDIUM | Strengthen |\n\n### 4. Network\n\n| Check | Issue |\n|-------|-------|\n| HTTP not HTTPS | Use HTTPS |\n| Credentials in URL | Headers only |\n| No CORS | Set CORS |\n\n### 5. Filesystem\n\n```javascript\n\u002F\u002F Check file access\nfs.readFile(userPath)\n```\n\n| Check | Issue | Fix |\n|-------|-------|-----|\n| Path traversal | HIGH | Sanitize |\n| Read any file | HIGH | Validate |\n| Write anywhere | HIGH | Restrict |\n\n---\n\n## Output\n\n```\n## Security Audit - [file]\n\n### Credentials\n- [PASS\u002FFAIL] Hardcoded keys: [details]\n\n### Inputs  \n- [PASS\u002FFAIL] SQL injection: [details]\n\n### Auth\n- [PASS\u002FFAIL] Protected: [details]\n\n### Summary\n| Severity | Count |\n|----------|-------|\n| HIGH     | 0     |\n| MEDIUM   | 0     |\n| LOW     | 0     |\n```\n\n---\n\n## Severity\n\n| Severity | Meaning |\n|----------|---------|\n| HIGH | Exploit - fix now |\n| MEDIUM | Risk - fix soon |\n| LOW | Note - fix Optional |\n\n---\n\n**Role**: Security Auditor **Input**: Code to review **Output**: Issues found\n",{"name":5,"license":14,"metadata":27,"description":7},{"author":28,"version":29},"vant","1.0","main","8b503d1512c76e22a20a6ec9300fa670b37a79be","models\u002Fpublic\u002Fvant\u002Fskills\u002Fvant-skill-audit-security",1,"https:\u002F\u002Fgithub.com\u002Fdhaupin\u002Fvant","https:\u002F\u002Fvant.creadev.org","https:\u002F\u002Fgithub.com\u002Fdhaupin","https:\u002F\u002Fcreadev.org\u002F","Hi. I make web, app, ecom, enterprise, agent, and orchestration things. Let me know if I can help with your next project. 🤝 Part of the Creadev.org team.","2026-11-13 03:45:30",{"source":8,"skillName":5,"commands":41,"prompt":51,"zipAvailable":52},[42,45,48],{"tool":43,"command":44},"npx","npx skills add dhaupin\u002Fvant --skill audit-security",{"tool":46,"command":47},"bunx","bunx skills add dhaupin\u002Fvant --skill audit-security",{"tool":49,"command":50},"pnpm","pnpm dlx skills add dhaupin\u002Fvant --skill audit-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdhaupin\u002Fvant\u002Fblob\u002Fmain\u002Fmodels\u002Fpublic\u002Fvant\u002Fskills\u002Fvant-skill-audit-security\u002FSKILL.md",true,[],[55,64,80,88,113,138],{"skillNo":56,"name":57,"nameZh":6,"description":58,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":59,"categories":60,"keywords":61,"publishedAt":22},"01M70G0NZMN2E0RPCAH59497C3","yaml","Data serialization.","https:\u002F\u002Fgithub.com\u002Fdhaupin\u002Fvant\u002Fblob\u002Fmain\u002Fmodels\u002Fpublic\u002Fvant\u002Fskills\u002Fvant-skill-yaml\u002FSKILL.md",[],[57,62,63],"serialization","data",{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":75,"publishedAt":22},"01M70G0MV7JGRXJ60VZZ692ZTM","vite","Frontend build tool.","https:\u002F\u002Fgithub.com\u002Fdhaupin\u002Fvant\u002Fblob\u002Fmain\u002Fmodels\u002Fpublic\u002Fvant\u002Fskills\u002Fvant-skill-vite\u002FSKILL.md",[70],{"categoryNo":71,"categoryName":72,"taxonomyType":73,"taxonomyTypeDesc":74},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[66,76,77,78,79],"tool","build tool","build","frontend",{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":22},"01M70G0HAFQC4K6N14B5CWPMQ2","typescript","Typed JavaScript.","https:\u002F\u002Fgithub.com\u002Fdhaupin\u002Fvant\u002Fblob\u002Fmain\u002Fmodels\u002Fpublic\u002Fvant\u002Fskills\u002Fvant-skill-typescript\u002FSKILL.md",[],[82,87],"javascript",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":97,"publishedAt":22},"01M70G0CH5E4PVJ62YBP7WKV44","test-unit","Test individual functions and methods in isolation. Test happy path, edge cases, and error handling. Use when adding new functions, after bug fixes, or before commits.","https:\u002F\u002Fgithub.com\u002Fdhaupin\u002Fvant\u002Fblob\u002Fmain\u002Fmodels\u002Fpublic\u002Fvant\u002Fskills\u002Fvant-skill-test-unit\u002FSKILL.md",[94],{"categoryNo":95,"categoryName":96,"taxonomyType":73,"taxonomyTypeDesc":74},"01JBSEEDCAT000000000000008","测试与质量",[98,99,100,101,102,103,104,105,106,107,108,109,110,111,112],"unit","test","test unit","when","error","commits","fixes","methods","edge","use","error handling","functions","bug","isolation","path",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":22},"01M70G08P5CPCX3B3RJFF9VJC2","test-snapshot","Capture and compare UI\u002Fcomponent snapshots to detect visual changes. Use when testing UI rendering, before visual changes, or for design systems.","https:\u002F\u002Fgithub.com\u002Fdhaupin\u002Fvant\u002Fblob\u002Fmain\u002Fmodels\u002Fpublic\u002Fvant\u002Fskills\u002Fvant-skill-test-snapshot\u002FSKILL.md",[119],{"categoryNo":95,"categoryName":96,"taxonomyType":73,"taxonomyTypeDesc":74},[121,122,99,123,124,125,126,127,128,107,129,130,101,131,132,133,134,135,136,137],"test snapshot","snapshot","capture","ui","for","testing ui","testing","design","design systems","snapshots","visual","compare","component","changes","detect","rendering","systems",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":22},"01M70G03WAR8HYBH7R2AZJRPCZ","test-smoke","Quick sanity check to verify basic functionality works. Run fastest tests first. Use when needing quick verification before deeper testing.","https:\u002F\u002Fgithub.com\u002Fdhaupin\u002Fvant\u002Fblob\u002Fmain\u002Fmodels\u002Fpublic\u002Fvant\u002Fskills\u002Fvant-skill-test-smoke\u002FSKILL.md",[144],{"categoryNo":95,"categoryName":96,"taxonomyType":73,"taxonomyTypeDesc":74},[99,146,147,148,149,150,127,151,107,101,152,153,154,155,156,157],"test smoke","smoke","quick","deeper","basic","tests","check","sanity","verification","first","verify","run"]