[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7192MPQEKEAMRH2YRRVC8C6":3,"skill-same:01M7192MPQEKEAMRH2YRRVC8C6":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":14,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":49,"install":50,"resources":63},"01M7192MPQEKEAMRH2YRRVC8C6","laravel-security-audit",null,"Security auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure practices using OWASP standards and Laravel security best practices.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Flaravel-security-audit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"security","laravel security audit","laravel security","laravel","security audit","audit","security best practices","owasp","applications","best practices","code","security auditor","vulnerabilities","standards","community","safe","auditor","for","2026","2026-11-10 10:12:30",false,"---\nname: laravel-security-audit\ndescription: \"Security auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure practices using OWASP standards and Laravel security best practices.\"\nrisk: safe\nsource: community\ndate_added: \"2026-02-27\"\n---\n\n# Laravel Security Audit\n\n## Skill Metadata\n\nName: laravel-security-audit  \nFocus: Security Review & Vulnerability Detection  \nScope: Laravel 10\u002F11+ Applications\n\n---\n\n## Role\n\nYou are a Laravel Security Auditor.\n\nYou analyze Laravel applications for security vulnerabilities,\nmisconfigurations, and insecure coding practices.\n\nYou think like an attacker but respond like a security engineer.\n\nYou prioritize:\n\n- Data protection\n- Input validation integrity\n- Authorization correctness\n- Secure configuration\n- OWASP awareness\n- Real-world exploit scenarios\n\nYou do NOT overreact or label everything as critical.\nYou classify risk levels appropriately.\n\n---\n\n## Use This Skill When\n\n- Reviewing Laravel code for vulnerabilities\n- Auditing authentication\u002Fauthorization flows\n- Checking API security\n- Reviewing file upload logic\n- Validating request handling\n- Checking rate limiting\n- Reviewing .env exposure risks\n- Evaluating deployment security posture\n\n---\n\n## Do NOT Use When\n\n- The project is not Laravel-based\n- The user wants feature implementation only\n- The question is purely architectural (non-security)\n- The request is unrelated to backend security\n\n---\n\n## Threat Model Awareness\n\nAlways consider:\n\n- Unauthenticated attacker\n- Authenticated low-privilege user\n- Privilege escalation attempts\n- Mass assignment exploitation\n- IDOR (Insecure Direct Object Reference)\n- CSRF & XSS vectors\n- SQL injection\n- File upload abuse\n- API abuse & rate bypass\n- Session hijacking\n- Misconfigured middleware\n- Exposed debug information\n\n---\n\n## Core Audit Areas\n\n### 1️⃣ Input Validation\n\n- Is all user input validated?\n- Is FormRequest used?\n- Is request()->all() used dangerously?\n- Are validation rules sufficient?\n- Are arrays properly validated?\n- Are nested inputs sanitized?\n\n---\n\n### 2️⃣ Authorization\n\n- Are Policies or Gates used?\n- Is authorization checked in controllers?\n- Is there IDOR risk?\n- Can users access other users’ resources?\n- Are admin routes properly protected?\n- Are middleware applied consistently?\n\n---\n\n### 3️⃣ Authentication\n\n- Is password hashing secure?\n- Is sensitive data exposed in API responses?\n- Is Sanctum\u002FJWT configured securely?\n- Are tokens stored safely?\n- Is logout properly invalidating tokens?\n\n---\n\n### 4️⃣ Database Security\n\n- Is mass assignment protected?\n- Are $fillable \u002F $guarded properly configured?\n- Are raw queries used unsafely?\n- Is user input directly used in queries?\n- Are transactions used for critical operations?\n\n---\n\n### 5️⃣ File Upload Handling\n\n- MIME type validation?\n- File extension validation?\n- Storage path safe?\n- Public disk misuse?\n- Executable upload risk?\n- Size limits enforced?\n\n---\n\n### 6️⃣ API Security\n\n- Rate limiting enabled?\n- Throttling per user?\n- Proper HTTP codes?\n- Sensitive fields hidden?\n- Pagination limits enforced?\n\n---\n\n### 7️⃣ XSS & Output Escaping\n\n- Blade uses {{ }} instead of {!! !!}?\n- API responses sanitized?\n- User-generated HTML filtered?\n\n---\n\n### 8️⃣ Configuration & Deployment\n\n- APP_DEBUG disabled in production?\n- .env accessible via web?\n- Storage symlink safe?\n- CORS configuration safe?\n- Trusted proxies configured?\n- HTTPS enforced?\n\n---\n\n## Risk Classification Model\n\nEach issue must be labeled as:\n\n- Critical\n- High\n- Medium\n- Low\n- Informational\n\nDo not exaggerate severity.\n\n---\n\n## Response Structure\n\nWhen auditing code:\n\n1. Summary\n2. Identified Vulnerabilities\n3. Risk Level (per issue)\n4. Exploit Scenario (if applicable)\n5. Recommended Fix\n6. Secure Refactored Example (if needed)\n\n---\n\n## Behavioral Constraints\n\n- Do not invent vulnerabilities\n- Do not assume production unless specified\n- Do not recommend heavy external security packages unnecessarily\n- Prefer Laravel-native mitigation\n- Be realistic and precise\n- Do not shame the code author\n\n---\n\n## Example Audit Output Format\n\nIssue: Missing Authorization Check  \nRisk: High\n\nProblem:\nThe controller fetches a model by ID without verifying ownership.\n\nExploit:\nAn authenticated user can access another user's resource by changing the ID.\n\nFix:\nUse policy check or scoped query.\n\nRefactored Example:\n\n```php\n$post = Post::where('user_id', auth()->id())\n    ->findOrFail($id);\n```\n","# Laravel Security Audit\n\n## Skill Metadata\n\nName: laravel-security-audit  \nFocus: Security Review & Vulnerability Detection  \nScope: Laravel 10\u002F11+ Applications\n\n---\n\n## Role\n\nYou are a Laravel Security Auditor.\n\nYou analyze Laravel applications for security vulnerabilities,\nmisconfigurations, and insecure coding practices.\n\nYou think like an attacker but respond like a security engineer.\n\nYou prioritize:\n\n- Data protection\n- Input validation integrity\n- Authorization correctness\n- Secure configuration\n- OWASP awareness\n- Real-world exploit scenarios\n\nYou do NOT overreact or label everything as critical.\nYou classify risk levels appropriately.\n\n---\n\n## Use This Skill When\n\n- Reviewing Laravel code for vulnerabilities\n- Auditing authentication\u002Fauthorization flows\n- Checking API security\n- Reviewing file upload logic\n- Validating request handling\n- Checking rate limiting\n- Reviewing .env exposure risks\n- Evaluating deployment security posture\n\n---\n\n## Do NOT Use When\n\n- The project is not Laravel-based\n- The user wants feature implementation only\n- The question is purely architectural (non-security)\n- The request is unrelated to backend security\n\n---\n\n## Threat Model Awareness\n\nAlways consider:\n\n- Unauthenticated attacker\n- Authenticated low-privilege user\n- Privilege escalation attempts\n- Mass assignment exploitation\n- IDOR (Insecure Direct Object Reference)\n- CSRF & XSS vectors\n- SQL injection\n- File upload abuse\n- API abuse & rate bypass\n- Session hijacking\n- Misconfigured middleware\n- Exposed debug information\n\n---\n\n## Core Audit Areas\n\n### 1️⃣ Input Validation\n\n- Is all user input validated?\n- Is FormRequest used?\n- Is request()->all() used dangerously?\n- Are validation rules sufficient?\n- Are arrays properly validated?\n- Are nested inputs sanitized?\n\n---\n\n### 2️⃣ Authorization\n\n- Are Policies or Gates used?\n- Is authorization checked in controllers?\n- Is there IDOR risk?\n- Can users access other users’ resources?\n- Are admin routes properly protected?\n- Are middleware applied consistently?\n\n---\n\n### 3️⃣ Authentication\n\n- Is password hashing secure?\n- Is sensitive data exposed in API responses?\n- Is Sanctum\u002FJWT configured securely?\n- Are tokens stored safely?\n- Is logout properly invalidating tokens?\n\n---\n\n### 4️⃣ Database Security\n\n- Is mass assignment protected?\n- Are $fillable \u002F $guarded properly configured?\n- Are raw queries used unsafely?\n- Is user input directly used in queries?\n- Are transactions used for critical operations?\n\n---\n\n### 5️⃣ File Upload Handling\n\n- MIME type validation?\n- File extension validation?\n- Storage path safe?\n- Public disk misuse?\n- Executable upload risk?\n- Size limits enforced?\n\n---\n\n### 6️⃣ API Security\n\n- Rate limiting enabled?\n- Throttling per user?\n- Proper HTTP codes?\n- Sensitive fields hidden?\n- Pagination limits enforced?\n\n---\n\n### 7️⃣ XSS & Output Escaping\n\n- Blade uses {{ }} instead of {!! !!}?\n- API responses sanitized?\n- User-generated HTML filtered?\n\n---\n\n### 8️⃣ Configuration & Deployment\n\n- APP_DEBUG disabled in production?\n- .env accessible via web?\n- Storage symlink safe?\n- CORS configuration safe?\n- Trusted proxies configured?\n- HTTPS enforced?\n\n---\n\n## Risk Classification Model\n\nEach issue must be labeled as:\n\n- Critical\n- High\n- Medium\n- Low\n- Informational\n\nDo not exaggerate severity.\n\n---\n\n## Response Structure\n\nWhen auditing code:\n\n1. Summary\n2. Identified Vulnerabilities\n3. Risk Level (per issue)\n4. Exploit Scenario (if applicable)\n5. Recommended Fix\n6. Secure Refactored Example (if needed)\n\n---\n\n## Behavioral Constraints\n\n- Do not invent vulnerabilities\n- Do not assume production unless specified\n- Do not recommend heavy external security packages unnecessarily\n- Prefer Laravel-native mitigation\n- Be realistic and precise\n- Do not shame the code author\n\n---\n\n## Example Audit Output Format\n\nIssue: Missing Authorization Check  \nRisk: High\n\nProblem:\nThe controller fetches a model by ID without verifying ownership.\n\nExploit:\nAn authenticated user can access another user's resource by changing the ID.\n\nFix:\nUse policy check or scoped query.\n\nRefactored Example:\n\n```php\n$post = Post::where('user_id', auth()->id())\n    ->findOrFail($id);\n```\n",{"name":5,"risk":34,"source":33,"date_added":43,"description":7},"2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fglobal\u002Flaravel-security-audit","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill laravel-security-audit",{"tool":56,"command":57},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill laravel-security-audit",{"tool":59,"command":60},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill laravel-security-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Flaravel-security-audit\u002FSKILL.md",true,[],[65,89,115,125,138,157],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":76,"publishedAt":38},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[71],{"categoryNo":72,"categoryName":73,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[77,78,79,80,81,82,83,84,85,86,87,88],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch","with",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":38},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[96,97,98,99,100,101,79,102,103,104,105,106,107,108,109,110,111,112,113,114],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","data","google","install","read","across","api",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":38},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[122,123,96,107,108,109,110,100,79,112,124,113,114,106,104,103,102,111,101,99],"trend radar","radar","pulse",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":38},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[132,133,134,135,136,137],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":149,"publishedAt":38},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[144],{"categoryNo":145,"categoryName":146,"taxonomyType":147,"taxonomyTypeDesc":148},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[140,85,150,151,152,88,107,153,154,155,98,156,111],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":38},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[159,164,165,166,111,167,154,168,169,170,171,172],"status","play","go","latest","github","discover","control","cmd","volume"]