[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70P8QATMPKA78E4FT5D2TNA":3,"skill-same:01M70P8QATMPKA78E4FT5D2TNA":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M70P8QATMPKA78E4FT5D2TNA","host-hardening",null,"Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"host hardening","hardening","host","never","request","re","port","retention","bind","recommendations","only","verification","read","access","plan","Bash","secrets","firewall","remediation","audit","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: host-hardening\nplatforms: [all]\ndescription: Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.\ntriggers:\n  - \"system hardening\"\n  - \"host hardening baseline\"\n  - \"plan host remediation\"\n  - \"check compose port bindings\"\ntools: Read, Bash, Write\nrequires:\n  - sanitized host baseline and operator-defined service health checks\nensures:\n  - baseline report with diff-style recommendations, backup plan, access gates and re-verification checklist\ninvariants:\n  - never changes host firewall rules or services, even with an apply request\n  - never collects secrets, SSH key material or datastore passwords\n---\n\n# Host Hardening\n\n## Purpose\n\nReview a Linux host after exposure reconstruction or as a recurring baseline.\nExtend `security-assessment` with concrete host checks, using existing\n`sys-host-audit` inventory and `exposure-analysis` findings. Recommendations\nare plan-first and read-only under `ops-safety`: this skill never applies a\nfirewall, SSH, datastore or service change. `--apply` is rejected.\n\n## Triggers\n\n- \"system hardening\"\n- \"host hardening baseline\"\n- \"lockout-safe SSH remediation plan\"\n- \"compose ports without bind address\"\n\n## Behavior\n\n1. Identify the operator-authorized host, timestamp, role and service owners.\n   Resolve report destination with `aiwg artifacts path --json --check-write`.\n   Apply `ops-information-governance` to collected metadata before emission.\n   Reuse sanitized inventory and exposure reports. Missing or restricted data\n   means UNKNOWN, never PASS. Do not read auth\u002Ftoken files, authorized_keys,\n   datastore passwords or environment values; operators provide safe boolean\n   assessments for sensitive controls.\n2. Assess the baseline below, recording evidence references and exceptions.\n   Confirm effective sshd settings in relevant Match contexts, including\n   included files; checking one config line cannot establish effective policy.\n3. Prepare a reviewable diff-style recommendation per failed control. Map\n   stale\u002Fover-broad firewall rule removal candidates to exact rule identifiers,\n   listeners, container publishing and named service owners. Specify public,\n   private or VPN binds for proposed Compose changes. Do not assume a standby\n   rule is disposable because the listener is currently absent.\n4. Include dated backup requirements, pre-change SHA-256, verified restore\n   procedure and rollback deadline for every affected file\u002Fruleset. Backups\n   stay in operator-controlled restricted storage, not in reports. The helper\n   produces backup instructions only; it never creates host backups.\n5. Gate any separately performed SSH change on verified key-based access\n   (second session with intended account) AND verified console break-glass\n   access. A key file existing is insufficient. Require explicit operator\n   authorization for exact changes, `sshd -t` and effective Match review,\n   an open recovery session and timed rollback before password\u002Froot restriction.\n   Network, boot and authentication changes have at least HIGH blast radius.\n6. Hand the plan to the operator for a separate authorized operational change.\n   Even explicit apply authorization does not make this read-only skill a\n   mutation tool. Do not run reload\u002Frestart, firewall writes or datastore DDL.\n7. After the operator reports application, obtain fresh captures. Re-run\n   exposure analysis, SSH checks and the baseline. Re-verify listeners,\n   IPv4\u002FIPv6 firewall, Docker forwarding\u002Fbinds, a new key-based session and\n   every named health check (queue ready, monitoring targets still up, CDN\n   origin HTTP\u002FHTTPS). Record failures and recommend rollback; never claim\n   verification from the pre-change snapshot. Missing results remain UNKNOWN.\n\n## Baseline\n\n| Area | Checks and safe metadata fields under `baseline` |\n|---|---|\n| SSH | `ssh.passwordAuthentication: no`, `permitRootLogin: no`, `maxAuthTries \u003C= 3`, `caTrustReviewed`, `authorizedKeysFromRestricted` (from= review) |\n| Firewall | `firewall.defaultDeny4`, `defaultDeny6`, `persistent` across reboot; compare runtime\u002Fpersistent rules and default policy |\n| Docker | `docker.userGuard`, `afterVpn` (readiness + startup\u002Frestart dependency), `liveRestore`, `explicitBinds` |\n| Datastores | `datastores.authAcl`, `redisDangerousCommandsRestricted`, `postgresConnectionLogging`, `appRolesNotSuperuser` |\n| Exporters | `exporters.privateBind`, `fixedTargets` (no caller-chosen multi-target scrapes) |\n| Audit | `audit.rulesLoaded`, `retentionReviewed` (auditd rules, journal\u002Frotation capacity and preservation) |\n\nBoolean controls require `true` for PASS. Use `null`\u002Fomission for unknown,\nnot an assumed value; mark non-applicable controls with a documented operator\nexception in the report. The helper leaves omitted controls UNKNOWN. Redis ACL\nrestrictions should deny dangerous commands for application users; do not\nblindly rename commands or lock out maintenance\u002Freplication. Review SSH CA\nprincipals and role privileges without exposing key or credential values.\n\n## Offline helper and static check\n\n```bash\nnode \"$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002Fscripts\u002Fcheck.mjs\" --snapshot baseline.json --compose compose.yaml\nnode \"$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002Fscripts\u002Fcheck.mjs\" --snapshot baseline.json --docker-run reviewed-commands.txt\n```\n\nSnapshot requires `host`, `capturedAt`, optional `baseline` and `healthChecks`\n(array of safe named checks). Compose parsing uses the existing YAML dependency.\nShort and long syntax require explicit literal `host_ip`\u002Fbind addresses;\nwildcards receive a separate review finding. Render interpolation and merged\nCompose files through an operator-approved process before static checking;\nnever execute shell substitutions from files. `expose:` alone does not publish\nhost ports. Host networking and publish-all require explicit listener review.\nThe docker-run checker covers literal `-p`, `--publish`, `-P`; shell-generated,\nmultiline or computed commands require manual review.\n\n## Examples\n\nInput: `PasswordAuthentication yes`, `PermitRootLogin yes`, six auth tries.\nOutput: failed SSH controls with `-PasswordAuthentication yes` \u002F\n`+PasswordAuthentication no`, dated operator-backup requirements, key and\nconsole gates, explicit authorization and fresh-capture rechecks. Nothing is\nchanged. `--apply` fails with the read-only boundary explanation.\n\nInput: Compose `ports: [\"6379:6379\"]` or long syntax without `host_ip`.\nOutput: `missing-bind`. `\"10.8.0.2:6379:6379\"` names the VPN bind;\n`\"[::1]:6379:6379\"` names IPv6 loopback. `0.0.0.0` and `::` require public\nservice justification. An explicit address alone does not establish safety.\n\n## Output and recurring checks\n\nWrite the sanitized report beneath resolved\n`.aiwg\u002Fsecurity-engineering\u002Freviews\u002F`. The helper emits JSON to stdout with\nchecks, findings, plan and `summary: {status, passed, failed, unknown}`.\nExit codes: 0 PASS, 2 FAIL, 3 UNKNOWN, 1 invalid input or prohibited apply.\nUse existing operator scheduling for post-deploy and monthly checks; emit\n`host, capturedAt, status, failed, unknown, report reference` to the operations\nlog and alert on nonzero status. This skill installs no schedules or services.\n\n## Tool selection and limits\n\nSuggested default: existing `ss`, Docker metadata and native firewall read\ncommands, with offline helper for reproducible narrow checks. Use nftables or\nfirewalld's native views when those own the host; review hook order manually\nwhen the exposure helper reports unsupported semantics. Existing benchmark\nreports may supply baseline evidence, with their scope and capture time.\nFor newer backend versions evaluate read-only behavior, both address families,\nDocker integration and lockout recovery against sanitized fixtures before\ntrusting their results. No package vulnerability scanner is added here.\n\n## References\n\n- ..\u002F..\u002Frules\u002Fpublished-port-binding.md\n- ..\u002F..\u002F..\u002Fops-complete\u002Frules\u002Fops-safety.md\n- ..\u002F..\u002F..\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md\n- ..\u002Fdfir-readiness\u002FSKILL.md\n- ..\u002F..\u002Fdocs\u002Fnetwork-control-review.md\n","# Host Hardening\n\n## Purpose\n\nReview a Linux host after exposure reconstruction or as a recurring baseline.\nExtend `security-assessment` with concrete host checks, using existing\n`sys-host-audit` inventory and `exposure-analysis` findings. Recommendations\nare plan-first and read-only under `ops-safety`: this skill never applies a\nfirewall, SSH, datastore or service change. `--apply` is rejected.\n\n## Triggers\n\n- \"system hardening\"\n- \"host hardening baseline\"\n- \"lockout-safe SSH remediation plan\"\n- \"compose ports without bind address\"\n\n## Behavior\n\n1. Identify the operator-authorized host, timestamp, role and service owners.\n   Resolve report destination with `aiwg artifacts path --json --check-write`.\n   Apply `ops-information-governance` to collected metadata before emission.\n   Reuse sanitized inventory and exposure reports. Missing or restricted data\n   means UNKNOWN, never PASS. Do not read auth\u002Ftoken files, authorized_keys,\n   datastore passwords or environment values; operators provide safe boolean\n   assessments for sensitive controls.\n2. Assess the baseline below, recording evidence references and exceptions.\n   Confirm effective sshd settings in relevant Match contexts, including\n   included files; checking one config line cannot establish effective policy.\n3. Prepare a reviewable diff-style recommendation per failed control. Map\n   stale\u002Fover-broad firewall rule removal candidates to exact rule identifiers,\n   listeners, container publishing and named service owners. Specify public,\n   private or VPN binds for proposed Compose changes. Do not assume a standby\n   rule is disposable because the listener is currently absent.\n4. Include dated backup requirements, pre-change SHA-256, verified restore\n   procedure and rollback deadline for every affected file\u002Fruleset. Backups\n   stay in operator-controlled restricted storage, not in reports. The helper\n   produces backup instructions only; it never creates host backups.\n5. Gate any separately performed SSH change on verified key-based access\n   (second session with intended account) AND verified console break-glass\n   access. A key file existing is insufficient. Require explicit operator\n   authorization for exact changes, `sshd -t` and effective Match review,\n   an open recovery session and timed rollback before password\u002Froot restriction.\n   Network, boot and authentication changes have at least HIGH blast radius.\n6. Hand the plan to the operator for a separate authorized operational change.\n   Even explicit apply authorization does not make this read-only skill a\n   mutation tool. Do not run reload\u002Frestart, firewall writes or datastore DDL.\n7. After the operator reports application, obtain fresh captures. Re-run\n   exposure analysis, SSH checks and the baseline. Re-verify listeners,\n   IPv4\u002FIPv6 firewall, Docker forwarding\u002Fbinds, a new key-based session and\n   every named health check (queue ready, monitoring targets still up, CDN\n   origin HTTP\u002FHTTPS). Record failures and recommend rollback; never claim\n   verification from the pre-change snapshot. Missing results remain UNKNOWN.\n\n## Baseline\n\n| Area | Checks and safe metadata fields under `baseline` |\n|---|---|\n| SSH | `ssh.passwordAuthentication: no`, `permitRootLogin: no`, `maxAuthTries \u003C= 3`, `caTrustReviewed`, `authorizedKeysFromRestricted` (from= review) |\n| Firewall | `firewall.defaultDeny4`, `defaultDeny6`, `persistent` across reboot; compare runtime\u002Fpersistent rules and default policy |\n| Docker | `docker.userGuard`, `afterVpn` (readiness + startup\u002Frestart dependency), `liveRestore`, `explicitBinds` |\n| Datastores | `datastores.authAcl`, `redisDangerousCommandsRestricted`, `postgresConnectionLogging`, `appRolesNotSuperuser` |\n| Exporters | `exporters.privateBind`, `fixedTargets` (no caller-chosen multi-target scrapes) |\n| Audit | `audit.rulesLoaded`, `retentionReviewed` (auditd rules, journal\u002Frotation capacity and preservation) |\n\nBoolean controls require `true` for PASS. Use `null`\u002Fomission for unknown,\nnot an assumed value; mark non-applicable controls with a documented operator\nexception in the report. The helper leaves omitted controls UNKNOWN. Redis ACL\nrestrictions should deny dangerous commands for application users; do not\nblindly rename commands or lock out maintenance\u002Freplication. Review SSH CA\nprincipals and role privileges without exposing key or credential values.\n\n## Offline helper and static check\n\n```bash\nnode \"$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002Fscripts\u002Fcheck.mjs\" --snapshot baseline.json --compose compose.yaml\nnode \"$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002Fscripts\u002Fcheck.mjs\" --snapshot baseline.json --docker-run reviewed-commands.txt\n```\n\nSnapshot requires `host`, `capturedAt`, optional `baseline` and `healthChecks`\n(array of safe named checks). Compose parsing uses the existing YAML dependency.\nShort and long syntax require explicit literal `host_ip`\u002Fbind addresses;\nwildcards receive a separate review finding. Render interpolation and merged\nCompose files through an operator-approved process before static checking;\nnever execute shell substitutions from files. `expose:` alone does not publish\nhost ports. Host networking and publish-all require explicit listener review.\nThe docker-run checker covers literal `-p`, `--publish`, `-P`; shell-generated,\nmultiline or computed commands require manual review.\n\n## Examples\n\nInput: `PasswordAuthentication yes`, `PermitRootLogin yes`, six auth tries.\nOutput: failed SSH controls with `-PasswordAuthentication yes` \u002F\n`+PasswordAuthentication no`, dated operator-backup requirements, key and\nconsole gates, explicit authorization and fresh-capture rechecks. Nothing is\nchanged. `--apply` fails with the read-only boundary explanation.\n\nInput: Compose `ports: [\"6379:6379\"]` or long syntax without `host_ip`.\nOutput: `missing-bind`. `\"10.8.0.2:6379:6379\"` names the VPN bind;\n`\"[::1]:6379:6379\"` names IPv6 loopback. `0.0.0.0` and `::` require public\nservice justification. An explicit address alone does not establish safety.\n\n## Output and recurring checks\n\nWrite the sanitized report beneath resolved\n`.aiwg\u002Fsecurity-engineering\u002Freviews\u002F`. The helper emits JSON to stdout with\nchecks, findings, plan and `summary: {status, passed, failed, unknown}`.\nExit codes: 0 PASS, 2 FAIL, 3 UNKNOWN, 1 invalid input or prohibited apply.\nUse existing operator scheduling for post-deploy and monthly checks; emit\n`host, capturedAt, status, failed, unknown, report reference` to the operations\nlog and alert on nonzero status. This skill installs no schedules or services.\n\n## Tool selection and limits\n\nSuggested default: existing `ss`, Docker metadata and native firewall read\ncommands, with offline helper for reproducible narrow checks. Use nftables or\nfirewalld's native views when those own the host; review hook order manually\nwhen the exposure helper reports unsupported semantics. Existing benchmark\nreports may supply baseline evidence, with their scope and capture time.\nFor newer backend versions evaluate read-only behavior, both address families,\nDocker integration and lockout recovery against sanitized fixtures before\ntrusting their results. No package vulnerability scanner is added here.\n\n## References\n\n- ..\u002F..\u002Frules\u002Fpublished-port-binding.md\n- ..\u002F..\u002F..\u002Fops-complete\u002Frules\u002Fops-safety.md\n- ..\u002F..\u002F..\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md\n- ..\u002Fdfir-readiness\u002FSKILL.md\n- ..\u002F..\u002Fdocs\u002Fnetwork-control-review.md\n",{"name":5,"tools":49,"ensures":50,"requires":52,"triggers":54,"namespace":59,"platforms":60,"invariants":62,"description":7},"Read, Bash, Write",[51],"baseline report with diff-style recommendations, backup plan, access gates and re-verification checklist",[53],"sanitized host baseline and operator-defined service health checks",[55,56,57,58],"system hardening","host hardening baseline","plan host remediation","check compose port bindings","aiwg",[61],"all",[63,64],"never changes host firewall rules or services, even with an apply request","never collects secrets, SSH key material or datastore passwords","main","ac56f6a215342ed836e51f1945653968b95edd64","agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-12 00:33:10",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add jmagly\u002Faiwg --skill host-hardening",{"tool":81,"command":82},"bunx","bunx skills add jmagly\u002Faiwg --skill host-hardening",{"tool":84,"command":85},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill host-hardening","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",true,[89,95],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"scripts\u002Fbindings.mjs","SCRIPT","脚本",2488,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002Fscripts\u002Fbindings.mjs",{"path":96,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Fcheck.mjs",6950,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002Fscripts\u002Fcheck.mjs",[100,106,130,137,151,162],{"skillNo":101,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":105,"publishedAt":44},"01M70QA0BSYJ49EES9V4RE8QH1","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[104],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[25,26,24,29,35,40,36,28,42,33,43,38,30,32,39,37,34,31,27,41],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":116,"publishedAt":44},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[112,115],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,118,30,34,119,26,120,121,122,36,123,124,125,39,126,127,128,41,27,129],"exposure analysis","analysis","internet","reconstruction","operator","write","credentials","collection","unknown","ufw","local","ports","scope",{"skillNo":131,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":136,"publishedAt":44},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[134,135],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118,117,34,126,128,41,27,129,127,119,26,125,39,124,30,123,36,122,121,120],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":44},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[143],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,146,147,148,149,150],"fixture","fixture skill","exercise","true","delivery","rule",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":44},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[157],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,159,160,145,161],"pi","pi local","duplicate",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":169,"publishedAt":44},"01M6CB48DP2T1Z0PCDV85X1CYR","example","Shared Agent Skills duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.agents\u002Fskills\u002Fexample\u002FSKILL.md",[168],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[164,170,145,161],"shared"]