[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70H5P29CC5CFS9X9WPC1X4Y":3,"skill-same:01M70H5P29CC5CFS9X9WPC1X4Y":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M70H5P29CC5CFS9X9WPC1X4Y","security-assessment",null,"Vulnerability review, OWASP patterns, secure coding practices, and threat modeling approaches. Use when reviewing code security, designing secure systems, performing threat analysis, or validating security implementations.","shengdabai\u002FTony-Claude-Code-Skills","shengdabai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F116417419?v=4","01M70F6D2WY5PQV5A92BKYJQEW","Tony Sheng","01M70F6D3GAAAYZ5H4CC1G8VXM",3,"MIT","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fplugins\u002Fteam\u002Fskills\u002Fquality\u002Fsecurity-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security assessment","security","assessment","Secure Coding","reviewing code","use","code security","coding","threat","threat modeling","patterns","owasp","modeling","secure","review","vulnerability","code","analysis","when","secure coding practices","2026-11-10 10:12:30",false,"---\nname: security-assessment\ndescription: Vulnerability review, OWASP patterns, secure coding practices, and threat modeling approaches. Use when reviewing code security, designing secure systems, performing threat analysis, or validating security implementations.\n---\n\n# Security Assessment\n\nA specialized skill for systematic security evaluation of code, architecture, and infrastructure. Combines threat modeling methodologies with practical code review techniques to identify and remediate security vulnerabilities.\n\n## When to Use\n\n- Reviewing code changes for security vulnerabilities\n- Designing new features with security requirements\n- Performing threat analysis on system architecture\n- Validating security controls in infrastructure\n- Assessing third-party integrations and dependencies\n- Preparing for security audits or compliance reviews\n\n## Threat Modeling with STRIDE\n\nSTRIDE is a threat modeling framework that categorizes threats by their nature. Apply this model during architecture review and feature design.\n\n### Spoofing (Authentication)\n\nThreat: Attacker pretends to be another user or system.\n\nQuestions to ask:\n- How do we verify the identity of users and systems?\n- Can authentication tokens be stolen or forged?\n- Are there any authentication bypass paths?\n\nMitigations:\n- Strong authentication mechanisms (MFA)\n- Secure token generation and validation\n- Session management with proper invalidation\n\n### Tampering (Integrity)\n\nThreat: Attacker modifies data in transit or at rest.\n\nQuestions to ask:\n- Can data be modified between components?\n- Are database records protected from unauthorized changes?\n- Can configuration files be altered?\n\nMitigations:\n- Input validation at all boundaries\n- Cryptographic signatures for critical data\n- Database integrity constraints and audit logs\n\n### Repudiation (Non-repudiation)\n\nThreat: Attacker denies performing an action.\n\nQuestions to ask:\n- Can we prove who performed an action?\n- Are audit logs tamper-resistant?\n- Is there sufficient logging for forensics?\n\nMitigations:\n- Comprehensive audit logging\n- Secure, immutable log storage\n- Digital signatures for critical operations\n\n### Information Disclosure (Confidentiality)\n\nThreat: Attacker gains access to sensitive information.\n\nQuestions to ask:\n- What sensitive data exists in this system?\n- How is data protected at rest and in transit?\n- Are error messages revealing internal details?\n\nMitigations:\n- Encryption for sensitive data (TLS, AES)\n- Proper access controls and authorization\n- Sanitized error messages\n\n### Denial of Service (Availability)\n\nThreat: Attacker makes the system unavailable.\n\nQuestions to ask:\n- What resources can be exhausted?\n- Are there rate limits on expensive operations?\n- How does the system handle malformed input?\n\nMitigations:\n- Rate limiting and throttling\n- Input validation and size limits\n- Resource quotas and timeouts\n\n### Elevation of Privilege (Authorization)\n\nThreat: Attacker gains higher privileges than intended.\n\nQuestions to ask:\n- Can users access resources beyond their role?\n- Are privilege checks performed consistently?\n- Can administrative functions be accessed by regular users?\n\nMitigations:\n- Principle of least privilege\n- Role-based access control (RBAC)\n- Authorization checks at every layer\n\n## OWASP Top 10 Review Patterns\n\nSystematic patterns for identifying the most critical web application security risks.\n\n### A01: Broken Access Control\n\nReview pattern:\n1. Identify all endpoints and their expected access levels\n2. Trace authorization logic from request to resource\n3. Test for horizontal privilege escalation (accessing other users' data)\n4. Test for vertical privilege escalation (accessing admin functions)\n5. Verify CORS configuration restricts origins appropriately\n\nRed flags:\n- Authorization based on client-side state\n- Direct object references without ownership verification\n- Missing authorization checks on API endpoints\n\n### A02: Cryptographic Failures\n\nReview pattern:\n1. Map all sensitive data flows (credentials, PII, financial)\n2. Verify encryption at rest and in transit\n3. Check for hardcoded secrets in code or configuration\n4. Review cryptographic algorithm choices\n5. Verify key management practices\n\nRed flags:\n- Sensitive data in logs or error messages\n- Deprecated algorithms (MD5, SHA1, DES)\n- Secrets in source control\n\n### A03: Injection\n\nReview pattern:\n1. Identify all user input entry points\n2. Trace input flow to database queries, OS commands, LDAP\n3. Verify parameterized queries or proper escaping\n4. Check for dynamic code execution (eval, exec)\n5. Review XML parsing for XXE vulnerabilities\n\nRed flags:\n- String concatenation in queries\n- User input in system commands\n- Disabled XML external entity protection\n\n### A04: Insecure Design\n\nReview pattern:\n1. Verify threat modeling was performed\n2. Check for abuse case handling (rate limits, quantity limits)\n3. Review business logic for security assumptions\n4. Assess multi-tenancy isolation\n5. Verify secure defaults\n\nRed flags:\n- No rate limiting on authentication\n- Trust assumptions without verification\n- Security as an afterthought\n\n### A05: Security Misconfiguration\n\nReview pattern:\n1. Review default configurations for security settings\n2. Check for unnecessary features or services\n3. Verify error handling does not expose details\n4. Review security headers (CSP, HSTS, X-Frame-Options)\n5. Check cloud resource permissions\n\nRed flags:\n- Debug mode in production\n- Default credentials unchanged\n- Overly permissive cloud IAM policies\n\n### A06: Vulnerable Components\n\nReview pattern:\n1. Inventory all dependencies and their versions\n2. Check for known vulnerabilities (CVE databases)\n3. Verify dependencies from trusted sources\n4. Review for unused dependencies\n5. Check for version pinning\n\nRed flags:\n- Unpinned dependencies\n- Known critical vulnerabilities\n- Dependencies from unofficial sources\n\n### A07: Authentication Failures\n\nReview pattern:\n1. Review password policy enforcement\n2. Check session management implementation\n3. Verify brute force protection\n4. Review token generation and validation\n5. Check credential storage mechanisms\n\nRed flags:\n- Weak password requirements\n- Sessions that do not invalidate on logout\n- Predictable session tokens\n\n### A08: Integrity Failures\n\nReview pattern:\n1. Review CI\u002FCD pipeline security\n2. Check for unsigned code or dependencies\n3. Review deserialization of untrusted data\n4. Verify update mechanism security\n5. Check for code review requirements\n\nRed flags:\n- Deserialization without integrity checks\n- Unsigned updates or dependencies\n- No code review before deployment\n\n### A09: Logging and Monitoring Failures\n\nReview pattern:\n1. Verify authentication events are logged\n2. Check for authorization failure logging\n3. Review log content for sensitive data\n4. Verify log integrity protection\n5. Check alerting configuration\n\nRed flags:\n- Missing authentication failure logs\n- Sensitive data in logs\n- No alerting on suspicious patterns\n\n### A10: SSRF\n\nReview pattern:\n1. Identify all server-side URL fetching\n2. Verify URL validation against allowlist\n3. Check for internal network blocking\n4. Review URL scheme restrictions\n5. Verify response handling\n\nRed flags:\n- User-controlled URLs without validation\n- Internal addresses not blocked\n- Raw responses returned to users\n\n## Secure Coding Practices\n\n### Input Validation\n\nAlways validate on the server side, regardless of client validation:\n\n```\nfunction validateInput(input) {\n  \u002F\u002F Type validation\n  if (typeof input !== 'string') {\n    throw new ValidationError('Input must be a string');\n  }\n\n  \u002F\u002F Length validation\n  if (input.length > MAX_LENGTH) {\n    throw new ValidationError('Input exceeds maximum length');\n  }\n\n  \u002F\u002F Format validation (allowlist approach)\n  if (!ALLOWED_PATTERN.test(input)) {\n    throw new ValidationError('Input contains invalid characters');\n  }\n\n  return sanitize(input);\n}\n```\n\n### Output Encoding\n\nContext-appropriate encoding prevents injection:\n\n- HTML context: Encode `\u003C`, `>`, `&`, `\"`, `'`\n- JavaScript context: Use JSON.stringify or hex encoding\n- URL context: Use encodeURIComponent\n- SQL context: Use parameterized queries (never encode manually)\n\n### Secrets Management\n\nNever commit secrets to source control:\n\n```\n\u002F\u002F Bad: Hardcoded secret\nconst apiKey = \"sk-1234567890abcdef\";\n\n\u002F\u002F Good: Environment variable\nconst apiKey = process.env.API_KEY;\nif (!apiKey) {\n  throw new ConfigurationError('API_KEY not configured');\n}\n```\n\n### Error Handling for Security\n\nSeparate internal logging from user-facing errors:\n\n```\ntry {\n  await processRequest(data);\n} catch (error) {\n  \u002F\u002F Log full details internally\n  logger.error('Request processing failed', {\n    error: error.message,\n    stack: error.stack,\n    userId: user.id,\n    requestId: request.id\n  });\n\n  \u002F\u002F Return generic message to user\n  throw new UserError('Unable to process request');\n}\n```\n\n## Infrastructure Security Considerations\n\n### Network Security\n\n- Segment networks to limit blast radius\n- Use private subnets for internal services\n- Implement network policies in Kubernetes\n- Restrict egress traffic to known destinations\n\n### Container Security\n\n- Use minimal base images (distroless, Alpine)\n- Run as non-root user\n- Set read-only root filesystem where possible\n- Scan images for vulnerabilities\n- Limit container capabilities\n\n### Secrets in Infrastructure\n\n- Use secret management services (Vault, AWS Secrets Manager)\n- Inject secrets as environment variables, not files\n- Rotate secrets regularly\n- Audit secret access\n\n### Cloud IAM\n\n- Apply principle of least privilege\n- Use service accounts with minimal permissions\n- Audit IAM policies regularly\n- Avoid using root\u002Fadmin accounts for routine operations\n\n## Code Review Security Focus Areas\n\nPriority areas for security-focused code review:\n\n1. **Authentication and session management** - Token generation, validation, session lifecycle\n2. **Authorization checks** - Access control at all layers\n3. **Input handling** - All user input paths\n4. **Data exposure** - Logs, errors, API responses\n5. **Cryptography usage** - Algorithm selection, key management\n6. **Third-party integrations** - Data sharing, authentication\n7. **Error handling** - Information leakage, fail-secure behavior\n\n## Best Practices\n\n- Perform threat modeling before implementation\n- Apply defense in depth (multiple security layers)\n- Assume breach: design for detection and containment\n- Automate security testing in CI\u002FCD\n- Keep dependencies updated and audited\n- Document security decisions and accepted risks\n- Train developers on secure coding practices\n\n## References\n\n- `checklists\u002Fsecurity-review-checklist.md` - Comprehensive security review checklist\n","# Security Assessment\n\nA specialized skill for systematic security evaluation of code, architecture, and infrastructure. Combines threat modeling methodologies with practical code review techniques to identify and remediate security vulnerabilities.\n\n## When to Use\n\n- Reviewing code changes for security vulnerabilities\n- Designing new features with security requirements\n- Performing threat analysis on system architecture\n- Validating security controls in infrastructure\n- Assessing third-party integrations and dependencies\n- Preparing for security audits or compliance reviews\n\n## Threat Modeling with STRIDE\n\nSTRIDE is a threat modeling framework that categorizes threats by their nature. Apply this model during architecture review and feature design.\n\n### Spoofing (Authentication)\n\nThreat: Attacker pretends to be another user or system.\n\nQuestions to ask:\n- How do we verify the identity of users and systems?\n- Can authentication tokens be stolen or forged?\n- Are there any authentication bypass paths?\n\nMitigations:\n- Strong authentication mechanisms (MFA)\n- Secure token generation and validation\n- Session management with proper invalidation\n\n### Tampering (Integrity)\n\nThreat: Attacker modifies data in transit or at rest.\n\nQuestions to ask:\n- Can data be modified between components?\n- Are database records protected from unauthorized changes?\n- Can configuration files be altered?\n\nMitigations:\n- Input validation at all boundaries\n- Cryptographic signatures for critical data\n- Database integrity constraints and audit logs\n\n### Repudiation (Non-repudiation)\n\nThreat: Attacker denies performing an action.\n\nQuestions to ask:\n- Can we prove who performed an action?\n- Are audit logs tamper-resistant?\n- Is there sufficient logging for forensics?\n\nMitigations:\n- Comprehensive audit logging\n- Secure, immutable log storage\n- Digital signatures for critical operations\n\n### Information Disclosure (Confidentiality)\n\nThreat: Attacker gains access to sensitive information.\n\nQuestions to ask:\n- What sensitive data exists in this system?\n- How is data protected at rest and in transit?\n- Are error messages revealing internal details?\n\nMitigations:\n- Encryption for sensitive data (TLS, AES)\n- Proper access controls and authorization\n- Sanitized error messages\n\n### Denial of Service (Availability)\n\nThreat: Attacker makes the system unavailable.\n\nQuestions to ask:\n- What resources can be exhausted?\n- Are there rate limits on expensive operations?\n- How does the system handle malformed input?\n\nMitigations:\n- Rate limiting and throttling\n- Input validation and size limits\n- Resource quotas and timeouts\n\n### Elevation of Privilege (Authorization)\n\nThreat: Attacker gains higher privileges than intended.\n\nQuestions to ask:\n- Can users access resources beyond their role?\n- Are privilege checks performed consistently?\n- Can administrative functions be accessed by regular users?\n\nMitigations:\n- Principle of least privilege\n- Role-based access control (RBAC)\n- Authorization checks at every layer\n\n## OWASP Top 10 Review Patterns\n\nSystematic patterns for identifying the most critical web application security risks.\n\n### A01: Broken Access Control\n\nReview pattern:\n1. Identify all endpoints and their expected access levels\n2. Trace authorization logic from request to resource\n3. Test for horizontal privilege escalation (accessing other users' data)\n4. Test for vertical privilege escalation (accessing admin functions)\n5. Verify CORS configuration restricts origins appropriately\n\nRed flags:\n- Authorization based on client-side state\n- Direct object references without ownership verification\n- Missing authorization checks on API endpoints\n\n### A02: Cryptographic Failures\n\nReview pattern:\n1. Map all sensitive data flows (credentials, PII, financial)\n2. Verify encryption at rest and in transit\n3. Check for hardcoded secrets in code or configuration\n4. Review cryptographic algorithm choices\n5. Verify key management practices\n\nRed flags:\n- Sensitive data in logs or error messages\n- Deprecated algorithms (MD5, SHA1, DES)\n- Secrets in source control\n\n### A03: Injection\n\nReview pattern:\n1. Identify all user input entry points\n2. Trace input flow to database queries, OS commands, LDAP\n3. Verify parameterized queries or proper escaping\n4. Check for dynamic code execution (eval, exec)\n5. Review XML parsing for XXE vulnerabilities\n\nRed flags:\n- String concatenation in queries\n- User input in system commands\n- Disabled XML external entity protection\n\n### A04: Insecure Design\n\nReview pattern:\n1. Verify threat modeling was performed\n2. Check for abuse case handling (rate limits, quantity limits)\n3. Review business logic for security assumptions\n4. Assess multi-tenancy isolation\n5. Verify secure defaults\n\nRed flags:\n- No rate limiting on authentication\n- Trust assumptions without verification\n- Security as an afterthought\n\n### A05: Security Misconfiguration\n\nReview pattern:\n1. Review default configurations for security settings\n2. Check for unnecessary features or services\n3. Verify error handling does not expose details\n4. Review security headers (CSP, HSTS, X-Frame-Options)\n5. Check cloud resource permissions\n\nRed flags:\n- Debug mode in production\n- Default credentials unchanged\n- Overly permissive cloud IAM policies\n\n### A06: Vulnerable Components\n\nReview pattern:\n1. Inventory all dependencies and their versions\n2. Check for known vulnerabilities (CVE databases)\n3. Verify dependencies from trusted sources\n4. Review for unused dependencies\n5. Check for version pinning\n\nRed flags:\n- Unpinned dependencies\n- Known critical vulnerabilities\n- Dependencies from unofficial sources\n\n### A07: Authentication Failures\n\nReview pattern:\n1. Review password policy enforcement\n2. Check session management implementation\n3. Verify brute force protection\n4. Review token generation and validation\n5. Check credential storage mechanisms\n\nRed flags:\n- Weak password requirements\n- Sessions that do not invalidate on logout\n- Predictable session tokens\n\n### A08: Integrity Failures\n\nReview pattern:\n1. Review CI\u002FCD pipeline security\n2. Check for unsigned code or dependencies\n3. Review deserialization of untrusted data\n4. Verify update mechanism security\n5. Check for code review requirements\n\nRed flags:\n- Deserialization without integrity checks\n- Unsigned updates or dependencies\n- No code review before deployment\n\n### A09: Logging and Monitoring Failures\n\nReview pattern:\n1. Verify authentication events are logged\n2. Check for authorization failure logging\n3. Review log content for sensitive data\n4. Verify log integrity protection\n5. Check alerting configuration\n\nRed flags:\n- Missing authentication failure logs\n- Sensitive data in logs\n- No alerting on suspicious patterns\n\n### A10: SSRF\n\nReview pattern:\n1. Identify all server-side URL fetching\n2. Verify URL validation against allowlist\n3. Check for internal network blocking\n4. Review URL scheme restrictions\n5. Verify response handling\n\nRed flags:\n- User-controlled URLs without validation\n- Internal addresses not blocked\n- Raw responses returned to users\n\n## Secure Coding Practices\n\n### Input Validation\n\nAlways validate on the server side, regardless of client validation:\n\n```\nfunction validateInput(input) {\n  \u002F\u002F Type validation\n  if (typeof input !== 'string') {\n    throw new ValidationError('Input must be a string');\n  }\n\n  \u002F\u002F Length validation\n  if (input.length > MAX_LENGTH) {\n    throw new ValidationError('Input exceeds maximum length');\n  }\n\n  \u002F\u002F Format validation (allowlist approach)\n  if (!ALLOWED_PATTERN.test(input)) {\n    throw new ValidationError('Input contains invalid characters');\n  }\n\n  return sanitize(input);\n}\n```\n\n### Output Encoding\n\nContext-appropriate encoding prevents injection:\n\n- HTML context: Encode `\u003C`, `>`, `&`, `\"`, `'`\n- JavaScript context: Use JSON.stringify or hex encoding\n- URL context: Use encodeURIComponent\n- SQL context: Use parameterized queries (never encode manually)\n\n### Secrets Management\n\nNever commit secrets to source control:\n\n```\n\u002F\u002F Bad: Hardcoded secret\nconst apiKey = \"sk-1234567890abcdef\";\n\n\u002F\u002F Good: Environment variable\nconst apiKey = process.env.API_KEY;\nif (!apiKey) {\n  throw new ConfigurationError('API_KEY not configured');\n}\n```\n\n### Error Handling for Security\n\nSeparate internal logging from user-facing errors:\n\n```\ntry {\n  await processRequest(data);\n} catch (error) {\n  \u002F\u002F Log full details internally\n  logger.error('Request processing failed', {\n    error: error.message,\n    stack: error.stack,\n    userId: user.id,\n    requestId: request.id\n  });\n\n  \u002F\u002F Return generic message to user\n  throw new UserError('Unable to process request');\n}\n```\n\n## Infrastructure Security Considerations\n\n### Network Security\n\n- Segment networks to limit blast radius\n- Use private subnets for internal services\n- Implement network policies in Kubernetes\n- Restrict egress traffic to known destinations\n\n### Container Security\n\n- Use minimal base images (distroless, Alpine)\n- Run as non-root user\n- Set read-only root filesystem where possible\n- Scan images for vulnerabilities\n- Limit container capabilities\n\n### Secrets in Infrastructure\n\n- Use secret management services (Vault, AWS Secrets Manager)\n- Inject secrets as environment variables, not files\n- Rotate secrets regularly\n- Audit secret access\n\n### Cloud IAM\n\n- Apply principle of least privilege\n- Use service accounts with minimal permissions\n- Audit IAM policies regularly\n- Avoid using root\u002Fadmin accounts for routine operations\n\n## Code Review Security Focus Areas\n\nPriority areas for security-focused code review:\n\n1. **Authentication and session management** - Token generation, validation, session lifecycle\n2. **Authorization checks** - Access control at all layers\n3. **Input handling** - All user input paths\n4. **Data exposure** - Logs, errors, API responses\n5. **Cryptography usage** - Algorithm selection, key management\n6. **Third-party integrations** - Data sharing, authentication\n7. **Error handling** - Information leakage, fail-secure behavior\n\n## Best Practices\n\n- Perform threat modeling before implementation\n- Apply defense in depth (multiple security layers)\n- Assume breach: design for detection and containment\n- Automate security testing in CI\u002FCD\n- Keep dependencies updated and audited\n- Document security decisions and accepted risks\n- Train developers on secure coding practices\n\n## References\n\n- `checklists\u002Fsecurity-review-checklist.md` - Comprehensive security review checklist\n",{"name":5,"description":7},"main","7850740bd837adb32f0a109ab2af82482196c6f2","skills\u002F_collections\u002Fplugins\u002Fteam\u002Fskills\u002Fquality\u002Fsecurity-assessment",1,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills","https:\u002F\u002Fzturnsgo.com","https:\u002F\u002Fgithub.com\u002Fshengdabai","https:\u002F\u002Fzturnsgo.com\u002F","AI × education creator — producer, not consumer. Taught 6,000+ learners; shipping learning tools & daily essays with Claude Code, practicing @xiaolai's way 🥋","2026-11-01 21:28:23",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add shengdabai\u002FTony-Claude-Code-Skills --skill security-assessment",{"tool":65,"command":66},"bunx","bunx skills add shengdabai\u002FTony-Claude-Code-Skills --skill security-assessment",{"tool":68,"command":69},"pnpm","pnpm dlx skills add shengdabai\u002FTony-Claude-Code-Skills --skill security-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fplugins\u002Fteam\u002Fskills\u002Fquality\u002Fsecurity-assessment\u002FSKILL.md",true,[73],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"checklists\u002Fsecurity-review-checklist.md","REFERENCE","参考文档",9247,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fplugins\u002Fteam\u002Fskills\u002Fquality\u002Fsecurity-assessment\u002Fchecklists\u002Fsecurity-review-checklist.md",[80,99,128,153,175,195],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":91,"publishedAt":44},"01M70P17DAD4C1C47NPH6A96EM","xiaolai-methodology","以李笑来(Li Xiaolai)的思考方式、方法论与表达风格,为用户做全方位 1-on-1 教练指导,覆盖创业、赚钱、投资、学习、自学、读书写作、用 AI、以及人生心态与自我管理。当用户提到 \"李笑来\"、\"笑来\"、\"笑来老师\"、\"扮演李笑来\"、\"找笑来聊聊\"、\"笑来怎么看\"、\"xiaolai\"、\"把时间当作朋友\"、\"通往财富自由之路\"、\"定投改变命运\"、\"韭菜的自我修养\"、\"自学是门手艺\"、\"让时间陪你慢慢变富\"、\"七年就是一辈子\"、\"元认知\"、\"活在未来\"、\"复利\u002F长期主义\"、\"践行\"、\"痴迷改进\"、\"个人商业模式\u002F出售时间\"、\"睡后收入\"、\"定投\"、\"财富自由\"、\"操作系统升级\"、\"最少必要知识\"、\"北极星提示词\"、\"用 AI 该怎么学\u002F思考\" 等任一触发词,或当用户带着关于创业\u002F赚钱\u002F投资\u002F学习\u002F职业\u002F重大人生决策的困惑、希望被人用笑来式的「逻辑 + 大白话 + 类比 + 重新定义 + 践行导向」来点醒和指导时,自动进入李笑来教练模式。","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fxiaolai-methodology\u002FSKILL.md",[86],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",[92,93,94,95,96,97,98],"methodology","xiaolai","xiaolai methodology","朋友","投资","writing","收入",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":109,"publishedAt":44},"01M70P13NB9YP7ACJR1S861CDS","zread","Produce and consume a wiki-style knowledge base for a code repository via the `zread` CLI and its on-disk output under `.\u002F.zread\u002Fwiki\u002F`. Use this skill whenever the user wants to understand, onboard onto, explore, summarize, map, or get an overview of an unfamiliar codebase; asks for architecture docs, a project wiki, a repo walkthrough, module\u002Fpackage explanations, or \"what does this repo do\"; wants to generate, regenerate, resume, browse, or serve code documentation locally; or mentions zread \u002F zread.ai directly. Also use it proactively before diving into a large unknown repo — if `.\u002F.zread\u002Fwiki\u002Fcurrent` exists, read the generated pages instead of crawling source file-by-file; if it doesn't, consider offering to run `zread generate`. The trigger is the intent (understand a codebase through generated docs), not the literal word \"zread\".","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fzread\u002FSKILL.md",[105,108],{"categoryNo":106,"categoryName":107,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[101,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,40,126,127],"knowledge","wiki","explore","walkthrough","project","get","knowledge base","run","generate","intent","cli","map","documentation","project wiki","disk","architecture","unknown","generated",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":138,"publishedAt":44},"01M70P10S4SWMZQ8BJAFBFDRW3","youtube","Launch the YouTube Creator Agent to auto-generate videos.\nUse when: user types \u002Fyoutube, wants to create YouTube videos,\ngenerate video content, or upload to YouTube.\nKeywords: youtube, video, 视频, 创作视频, 发布视频","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube\u002FSKILL.md",[134,135],{"categoryNo":106,"categoryName":107,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",[130,139,140,141,142,143,144,145,118,146,147,148,42,29,149,150,151,152],"user","content","视频","creator","generate video","videos","launch","video content","create","upload","auto","types","Video","创作",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":44},"01M70P0YE95D8BACZCGV8BK90K","youtube-script-sync","Sync, update, or optimize Tony's GetNote knowledge base `Youtube视频逐字稿` by turning each parent recording or first-person idea note into an idempotent child note containing a directly recordable YouTube long-video or Shorts script. Use when the user says “更新\u002F同步\u002F优化 Youtube视频逐字稿知识库”, or says “更新\u002F同步\u002F优化该知识库” while this knowledge base is the active context.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube-script-sync\u002FSKILL.md",[159],{"categoryNo":106,"categoryName":107,"taxonomyType":89,"taxonomyTypeDesc":90},[161,162,130,163,164,151,165,166,167,168,169,170,171,172,116,173,42,29,110,174],"sync","script","youtube script sync","recording","shorts","first","base","person","update","active","child","optimize","idempotent","long",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":185,"publishedAt":44},"01M70P0WMV5XT0EEC0N445PW07","writing-skills","How to write SKILL.md files that trigger reliably and teach effectively. Use when creating, improving, or reviewing Claude Code skills.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-skills\u002FSKILL.md",[181,182,183,184],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":106,"categoryName":107,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},[186,97,187,188,189,190,40,42,29,191,192,193,194],"writing skills","how","teach","write skill","write","claude code skills","files","how to","trigger",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":203,"publishedAt":44},"01M70P0SJFR4YVJQBGMHKGSKXT","writing-rules","How to write .claude\u002Frules\u002F files that Claude actually follows. Use when creating, improving, or reviewing project rules.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-rules\u002FSKILL.md",[201,202],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},[204,97,205,114,206,192,42,187,190,29,193],"Rules","writing rules","project rules"]