[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M716KM30CD3XSP0HB0PJCWQW":3,"skill-same:01M716KM30CD3XSP0HB0PJCWQW":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":14,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M716KM30CD3XSP0HB0PJCWQW","mtls-configuration",null,"Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fmtls-configuration\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"mtls","mtls configuration","configuration","community","2026","when","unknown","for","implementing","service","certificate management","communication","trust","use","management","configure","certificate","tls","zero-trust","ZeRO","2026-11-10 10:12:30",false,"---\nname: mtls-configuration\ndescription: \"Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.\"\nrisk: unknown\nsource: community\ndate_added: \"2026-02-27\"\n---\n\n# mTLS Configuration\n\nComprehensive guide to implementing mutual TLS for zero-trust service mesh communication.\n\n## Do not use this skill when\n\n- The task is unrelated to mtls configuration\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Use this skill when\n\n- Implementing zero-trust networking\n- Securing service-to-service communication\n- Certificate rotation and management\n- Debugging TLS handshake issues\n- Compliance requirements (PCI-DSS, HIPAA)\n- Multi-cluster secure communication\n\n## Core Concepts\n\n### 1. mTLS Flow\n\n```\n┌─────────┐                              ┌─────────┐\n│ Service │                              │ Service │\n│    A    │                              │    B    │\n└────┬────┘                              └────┬────┘\n     │                                        │\n┌────┴────┐      TLS Handshake          ┌────┴────┐\n│  Proxy  │◄───────────────────────────►│  Proxy  │\n│(Sidecar)│  1. ClientHello             │(Sidecar)│\n│         │  2. ServerHello + Cert      │         │\n│         │  3. Client Cert             │         │\n│         │  4. Verify Both Certs       │         │\n│         │  5. Encrypted Channel       │         │\n└─────────┘                              └─────────┘\n```\n\n### 2. Certificate Hierarchy\n\n```\nRoot CA (Self-signed, long-lived)\n    │\n    ├── Intermediate CA (Cluster-level)\n    │       │\n    │       ├── Workload Cert (Service A)\n    │       └── Workload Cert (Service B)\n    │\n    └── Intermediate CA (Multi-cluster)\n            │\n            └── Cross-cluster certs\n```\n\n## Templates\n\n### Template 1: Istio mTLS (Strict Mode)\n\n```yaml\n# Enable strict mTLS mesh-wide\napiVersion: security.istio.io\u002Fv1beta1\nkind: PeerAuthentication\nmetadata:\n  name: default\n  namespace: istio-system\nspec:\n  mtls:\n    mode: STRICT\n---\n# Namespace-level override (permissive for migration)\napiVersion: security.istio.io\u002Fv1beta1\nkind: PeerAuthentication\nmetadata:\n  name: default\n  namespace: legacy-namespace\nspec:\n  mtls:\n    mode: PERMISSIVE\n---\n# Workload-specific policy\napiVersion: security.istio.io\u002Fv1beta1\nkind: PeerAuthentication\nmetadata:\n  name: payment-service\n  namespace: production\nspec:\n  selector:\n    matchLabels:\n      app: payment-service\n  mtls:\n    mode: STRICT\n  portLevelMtls:\n    8080:\n      mode: STRICT\n    9090:\n      mode: DISABLE  # Metrics port, no mTLS\n```\n\n### Template 2: Istio Destination Rule for mTLS\n\n```yaml\napiVersion: networking.istio.io\u002Fv1beta1\nkind: DestinationRule\nmetadata:\n  name: default\n  namespace: istio-system\nspec:\n  host: \"*.local\"\n  trafficPolicy:\n    tls:\n      mode: ISTIO_MUTUAL\n---\n# TLS to external service\napiVersion: networking.istio.io\u002Fv1beta1\nkind: DestinationRule\nmetadata:\n  name: external-api\nspec:\n  host: api.external.com\n  trafficPolicy:\n    tls:\n      mode: SIMPLE\n      caCertificates: \u002Fetc\u002Fcerts\u002Fexternal-ca.pem\n---\n# Mutual TLS to external service\napiVersion: networking.istio.io\u002Fv1beta1\nkind: DestinationRule\nmetadata:\n  name: partner-api\nspec:\n  host: api.partner.com\n  trafficPolicy:\n    tls:\n      mode: MUTUAL\n      clientCertificate: \u002Fetc\u002Fcerts\u002Fclient.pem\n      privateKey: \u002Fetc\u002Fcerts\u002Fclient-key.pem\n      caCertificates: \u002Fetc\u002Fcerts\u002Fpartner-ca.pem\n```\n\n### Template 3: Cert-Manager with Istio\n\n```yaml\n# Install cert-manager issuer for Istio\napiVersion: cert-manager.io\u002Fv1\nkind: ClusterIssuer\nmetadata:\n  name: istio-ca\nspec:\n  ca:\n    secretName: istio-ca-secret\n---\n# Create Istio CA secret\napiVersion: v1\nkind: Secret\nmetadata:\n  name: istio-ca-secret\n  namespace: cert-manager\ntype: kubernetes.io\u002Ftls\ndata:\n  tls.crt: \u003Cbase64-encoded-ca-cert>\n  tls.key: \u003Cbase64-encoded-ca-key>\n---\n# Certificate for workload\napiVersion: cert-manager.io\u002Fv1\nkind: Certificate\nmetadata:\n  name: my-service-cert\n  namespace: my-namespace\nspec:\n  secretName: my-service-tls\n  duration: 24h\n  renewBefore: 8h\n  issuerRef:\n    name: istio-ca\n    kind: ClusterIssuer\n  commonName: my-service.my-namespace.svc.cluster.local\n  dnsNames:\n    - my-service\n    - my-service.my-namespace\n    - my-service.my-namespace.svc\n    - my-service.my-namespace.svc.cluster.local\n  usages:\n    - server auth\n    - client auth\n```\n\n### Template 4: SPIFFE\u002FSPIRE Integration\n\n```yaml\n# SPIRE Server configuration\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: spire-server\n  namespace: spire\ndata:\n  server.conf: |\n    server {\n      bind_address = \"0.0.0.0\"\n      bind_port = \"8081\"\n      trust_domain = \"example.org\"\n      data_dir = \"\u002Frun\u002Fspire\u002Fdata\"\n      log_level = \"INFO\"\n      ca_ttl = \"168h\"\n      default_x509_svid_ttl = \"1h\"\n    }\n\n    plugins {\n      DataStore \"sql\" {\n        plugin_data {\n          database_type = \"sqlite3\"\n          connection_string = \"\u002Frun\u002Fspire\u002Fdata\u002Fdatastore.sqlite3\"\n        }\n      }\n\n      NodeAttestor \"k8s_psat\" {\n        plugin_data {\n          clusters = {\n            \"demo-cluster\" = {\n              service_account_allow_list = [\"spire:spire-agent\"]\n            }\n          }\n        }\n      }\n\n      KeyManager \"memory\" {\n        plugin_data {}\n      }\n\n      UpstreamAuthority \"disk\" {\n        plugin_data {\n          key_file_path = \"\u002Frun\u002Fspire\u002Fsecrets\u002Fbootstrap.key\"\n          cert_file_path = \"\u002Frun\u002Fspire\u002Fsecrets\u002Fbootstrap.crt\"\n        }\n      }\n    }\n---\n# SPIRE Agent DaemonSet (abbreviated)\napiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n  name: spire-agent\n  namespace: spire\nspec:\n  selector:\n    matchLabels:\n      app: spire-agent\n  template:\n    spec:\n      containers:\n        - name: spire-agent\n          image: ghcr.io\u002Fspiffe\u002Fspire-agent:1.8.0\n          volumeMounts:\n            - name: spire-agent-socket\n              mountPath: \u002Frun\u002Fspire\u002Fsockets\n      volumes:\n        - name: spire-agent-socket\n          hostPath:\n            path: \u002Frun\u002Fspire\u002Fsockets\n            type: DirectoryOrCreate\n```\n\n### Template 5: Linkerd mTLS (Automatic)\n\n```yaml\n# Linkerd enables mTLS automatically\n# Verify with:\n# linkerd viz edges deployment -n my-namespace\n\n# For external services without mTLS\napiVersion: policy.linkerd.io\u002Fv1beta1\nkind: Server\nmetadata:\n  name: external-api\n  namespace: my-namespace\nspec:\n  podSelector:\n    matchLabels:\n      app: my-app\n  port: external-api\n  proxyProtocol: HTTP\u002F1  # or TLS for passthrough\n---\n# Skip TLS for specific port\napiVersion: v1\nkind: Service\nmetadata:\n  name: my-service\n  annotations:\n    config.linkerd.io\u002Fskip-outbound-ports: \"3306\"  # MySQL\n```\n\n## Certificate Rotation\n\n```bash\n# Istio - Check certificate expiry\nistioctl proxy-config secret deploy\u002Fmy-app -o json | \\\n  jq '.dynamicActiveSecrets[0].secret.tlsCertificate.certificateChain.inlineBytes' | \\\n  tr -d '\"' | base64 -d | openssl x509 -text -noout\n\n# Force certificate rotation\nkubectl rollout restart deployment\u002Fmy-app\n\n# Check Linkerd identity\nlinkerd identity -n my-namespace\n```\n\n## Debugging mTLS Issues\n\n```bash\n# Istio - Check if mTLS is enabled\nistioctl authn tls-check my-service.my-namespace.svc.cluster.local\n\n# Verify peer authentication\nkubectl get peerauthentication --all-namespaces\n\n# Check destination rules\nkubectl get destinationrule --all-namespaces\n\n# Debug TLS handshake\nistioctl proxy-config log deploy\u002Fmy-app --level debug\nkubectl logs deploy\u002Fmy-app -c istio-proxy | grep -i tls\n\n# Linkerd - Check mTLS status\nlinkerd viz edges deployment -n my-namespace\nlinkerd viz tap deploy\u002Fmy-app --to deploy\u002Fmy-backend\n```\n\n## Best Practices\n\n### Do's\n- **Start with PERMISSIVE** - Migrate gradually to STRICT\n- **Monitor certificate expiry** - Set up alerts\n- **Use short-lived certs** - 24h or less for workloads\n- **Rotate CA periodically** - Plan for CA rotation\n- **Log TLS errors** - For debugging and audit\n\n### Don'ts\n- **Don't disable mTLS** - For convenience in production\n- **Don't ignore cert expiry** - Automate rotation\n- **Don't use self-signed certs** - Use proper CA hierarchy\n- **Don't skip verification** - Verify the full chain\n\n## Resources\n\n- [Istio Security](https:\u002F\u002Fistio.io\u002Flatest\u002Fdocs\u002Fconcepts\u002Fsecurity\u002F)\n- [SPIFFE\u002FSPIRE](https:\u002F\u002Fspiffe.io\u002F)\n- [cert-manager](https:\u002F\u002Fcert-manager.io\u002F)\n- [Zero Trust Architecture (NIST)](https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fzero-trust-architecture)\n","# mTLS Configuration\n\nComprehensive guide to implementing mutual TLS for zero-trust service mesh communication.\n\n## Do not use this skill when\n\n- The task is unrelated to mtls configuration\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Use this skill when\n\n- Implementing zero-trust networking\n- Securing service-to-service communication\n- Certificate rotation and management\n- Debugging TLS handshake issues\n- Compliance requirements (PCI-DSS, HIPAA)\n- Multi-cluster secure communication\n\n## Core Concepts\n\n### 1. mTLS Flow\n\n```\n┌─────────┐                              ┌─────────┐\n│ Service │                              │ Service │\n│    A    │                              │    B    │\n└────┬────┘                              └────┬────┘\n     │                                        │\n┌────┴────┐      TLS Handshake          ┌────┴────┐\n│  Proxy  │◄───────────────────────────►│  Proxy  │\n│(Sidecar)│  1. ClientHello             │(Sidecar)│\n│         │  2. ServerHello + Cert      │         │\n│         │  3. Client Cert             │         │\n│         │  4. Verify Both Certs       │         │\n│         │  5. Encrypted Channel       │         │\n└─────────┘                              └─────────┘\n```\n\n### 2. Certificate Hierarchy\n\n```\nRoot CA (Self-signed, long-lived)\n    │\n    ├── Intermediate CA (Cluster-level)\n    │       │\n    │       ├── Workload Cert (Service A)\n    │       └── Workload Cert (Service B)\n    │\n    └── Intermediate CA (Multi-cluster)\n            │\n            └── Cross-cluster certs\n```\n\n## Templates\n\n### Template 1: Istio mTLS (Strict Mode)\n\n```yaml\n# Enable strict mTLS mesh-wide\napiVersion: security.istio.io\u002Fv1beta1\nkind: PeerAuthentication\nmetadata:\n  name: default\n  namespace: istio-system\nspec:\n  mtls:\n    mode: STRICT\n---\n# Namespace-level override (permissive for migration)\napiVersion: security.istio.io\u002Fv1beta1\nkind: PeerAuthentication\nmetadata:\n  name: default\n  namespace: legacy-namespace\nspec:\n  mtls:\n    mode: PERMISSIVE\n---\n# Workload-specific policy\napiVersion: security.istio.io\u002Fv1beta1\nkind: PeerAuthentication\nmetadata:\n  name: payment-service\n  namespace: production\nspec:\n  selector:\n    matchLabels:\n      app: payment-service\n  mtls:\n    mode: STRICT\n  portLevelMtls:\n    8080:\n      mode: STRICT\n    9090:\n      mode: DISABLE  # Metrics port, no mTLS\n```\n\n### Template 2: Istio Destination Rule for mTLS\n\n```yaml\napiVersion: networking.istio.io\u002Fv1beta1\nkind: DestinationRule\nmetadata:\n  name: default\n  namespace: istio-system\nspec:\n  host: \"*.local\"\n  trafficPolicy:\n    tls:\n      mode: ISTIO_MUTUAL\n---\n# TLS to external service\napiVersion: networking.istio.io\u002Fv1beta1\nkind: DestinationRule\nmetadata:\n  name: external-api\nspec:\n  host: api.external.com\n  trafficPolicy:\n    tls:\n      mode: SIMPLE\n      caCertificates: \u002Fetc\u002Fcerts\u002Fexternal-ca.pem\n---\n# Mutual TLS to external service\napiVersion: networking.istio.io\u002Fv1beta1\nkind: DestinationRule\nmetadata:\n  name: partner-api\nspec:\n  host: api.partner.com\n  trafficPolicy:\n    tls:\n      mode: MUTUAL\n      clientCertificate: \u002Fetc\u002Fcerts\u002Fclient.pem\n      privateKey: \u002Fetc\u002Fcerts\u002Fclient-key.pem\n      caCertificates: \u002Fetc\u002Fcerts\u002Fpartner-ca.pem\n```\n\n### Template 3: Cert-Manager with Istio\n\n```yaml\n# Install cert-manager issuer for Istio\napiVersion: cert-manager.io\u002Fv1\nkind: ClusterIssuer\nmetadata:\n  name: istio-ca\nspec:\n  ca:\n    secretName: istio-ca-secret\n---\n# Create Istio CA secret\napiVersion: v1\nkind: Secret\nmetadata:\n  name: istio-ca-secret\n  namespace: cert-manager\ntype: kubernetes.io\u002Ftls\ndata:\n  tls.crt: \u003Cbase64-encoded-ca-cert>\n  tls.key: \u003Cbase64-encoded-ca-key>\n---\n# Certificate for workload\napiVersion: cert-manager.io\u002Fv1\nkind: Certificate\nmetadata:\n  name: my-service-cert\n  namespace: my-namespace\nspec:\n  secretName: my-service-tls\n  duration: 24h\n  renewBefore: 8h\n  issuerRef:\n    name: istio-ca\n    kind: ClusterIssuer\n  commonName: my-service.my-namespace.svc.cluster.local\n  dnsNames:\n    - my-service\n    - my-service.my-namespace\n    - my-service.my-namespace.svc\n    - my-service.my-namespace.svc.cluster.local\n  usages:\n    - server auth\n    - client auth\n```\n\n### Template 4: SPIFFE\u002FSPIRE Integration\n\n```yaml\n# SPIRE Server configuration\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: spire-server\n  namespace: spire\ndata:\n  server.conf: |\n    server {\n      bind_address = \"0.0.0.0\"\n      bind_port = \"8081\"\n      trust_domain = \"example.org\"\n      data_dir = \"\u002Frun\u002Fspire\u002Fdata\"\n      log_level = \"INFO\"\n      ca_ttl = \"168h\"\n      default_x509_svid_ttl = \"1h\"\n    }\n\n    plugins {\n      DataStore \"sql\" {\n        plugin_data {\n          database_type = \"sqlite3\"\n          connection_string = \"\u002Frun\u002Fspire\u002Fdata\u002Fdatastore.sqlite3\"\n        }\n      }\n\n      NodeAttestor \"k8s_psat\" {\n        plugin_data {\n          clusters = {\n            \"demo-cluster\" = {\n              service_account_allow_list = [\"spire:spire-agent\"]\n            }\n          }\n        }\n      }\n\n      KeyManager \"memory\" {\n        plugin_data {}\n      }\n\n      UpstreamAuthority \"disk\" {\n        plugin_data {\n          key_file_path = \"\u002Frun\u002Fspire\u002Fsecrets\u002Fbootstrap.key\"\n          cert_file_path = \"\u002Frun\u002Fspire\u002Fsecrets\u002Fbootstrap.crt\"\n        }\n      }\n    }\n---\n# SPIRE Agent DaemonSet (abbreviated)\napiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n  name: spire-agent\n  namespace: spire\nspec:\n  selector:\n    matchLabels:\n      app: spire-agent\n  template:\n    spec:\n      containers:\n        - name: spire-agent\n          image: ghcr.io\u002Fspiffe\u002Fspire-agent:1.8.0\n          volumeMounts:\n            - name: spire-agent-socket\n              mountPath: \u002Frun\u002Fspire\u002Fsockets\n      volumes:\n        - name: spire-agent-socket\n          hostPath:\n            path: \u002Frun\u002Fspire\u002Fsockets\n            type: DirectoryOrCreate\n```\n\n### Template 5: Linkerd mTLS (Automatic)\n\n```yaml\n# Linkerd enables mTLS automatically\n# Verify with:\n# linkerd viz edges deployment -n my-namespace\n\n# For external services without mTLS\napiVersion: policy.linkerd.io\u002Fv1beta1\nkind: Server\nmetadata:\n  name: external-api\n  namespace: my-namespace\nspec:\n  podSelector:\n    matchLabels:\n      app: my-app\n  port: external-api\n  proxyProtocol: HTTP\u002F1  # or TLS for passthrough\n---\n# Skip TLS for specific port\napiVersion: v1\nkind: Service\nmetadata:\n  name: my-service\n  annotations:\n    config.linkerd.io\u002Fskip-outbound-ports: \"3306\"  # MySQL\n```\n\n## Certificate Rotation\n\n```bash\n# Istio - Check certificate expiry\nistioctl proxy-config secret deploy\u002Fmy-app -o json | \\\n  jq '.dynamicActiveSecrets[0].secret.tlsCertificate.certificateChain.inlineBytes' | \\\n  tr -d '\"' | base64 -d | openssl x509 -text -noout\n\n# Force certificate rotation\nkubectl rollout restart deployment\u002Fmy-app\n\n# Check Linkerd identity\nlinkerd identity -n my-namespace\n```\n\n## Debugging mTLS Issues\n\n```bash\n# Istio - Check if mTLS is enabled\nistioctl authn tls-check my-service.my-namespace.svc.cluster.local\n\n# Verify peer authentication\nkubectl get peerauthentication --all-namespaces\n\n# Check destination rules\nkubectl get destinationrule --all-namespaces\n\n# Debug TLS handshake\nistioctl proxy-config log deploy\u002Fmy-app --level debug\nkubectl logs deploy\u002Fmy-app -c istio-proxy | grep -i tls\n\n# Linkerd - Check mTLS status\nlinkerd viz edges deployment -n my-namespace\nlinkerd viz tap deploy\u002Fmy-app --to deploy\u002Fmy-backend\n```\n\n## Best Practices\n\n### Do's\n- **Start with PERMISSIVE** - Migrate gradually to STRICT\n- **Monitor certificate expiry** - Set up alerts\n- **Use short-lived certs** - 24h or less for workloads\n- **Rotate CA periodically** - Plan for CA rotation\n- **Log TLS errors** - For debugging and audit\n\n### Don'ts\n- **Don't disable mTLS** - For convenience in production\n- **Don't ignore cert expiry** - Automate rotation\n- **Don't use self-signed certs** - Use proper CA hierarchy\n- **Don't skip verification** - Verify the full chain\n\n## Resources\n\n- [Istio Security](https:\u002F\u002Fistio.io\u002Flatest\u002Fdocs\u002Fconcepts\u002Fsecurity\u002F)\n- [SPIFFE\u002FSPIRE](https:\u002F\u002Fspiffe.io\u002F)\n- [cert-manager](https:\u002F\u002Fcert-manager.io\u002F)\n- [Zero Trust Architecture (NIST)](https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fzero-trust-architecture)\n",{"name":5,"risk":25,"source":22,"date_added":44,"description":7},"2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcursor\u002Fmtls-configuration","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill mtls-configuration",{"tool":57,"command":58},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill mtls-configuration",{"tool":60,"command":61},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill mtls-configuration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fmtls-configuration\u002FSKILL.md",true,[],[66,90,115,125,138,157],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":77,"publishedAt":39},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[72],{"categoryNo":73,"categoryName":74,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[78,79,80,81,82,83,84,85,86,87,88,89],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch","with",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":39},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[97,98,99,100,101,102,80,103,104,105,106,24,107,108,109,110,111,112,113,114],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","brew","live","data","google","install","read","across","api",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":39},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[122,123,97,107,108,109,110,101,80,112,124,113,114,24,105,104,103,111,102,100],"trend radar","radar","pulse",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":39},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[132,133,134,135,136,137],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":149,"publishedAt":39},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[144],{"categoryNo":145,"categoryName":146,"taxonomyType":147,"taxonomyTypeDesc":148},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[140,86,150,151,152,89,107,153,154,155,99,156,111],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":39},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[159,164,165,166,111,167,154,168,169,170,171,172],"status","play","go","latest","github","discover","control","cmd","volume"]