[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M719PXD0FFECCHTQ7RC2X529":3,"skill-same:01M719PXD0FFECCHTQ7RC2X529":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":48,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M719PXD0FFECCHTQ7RC2X529","sast-missing-auth",null,"Detect Missing Authorization vulnerabilities — API endpoints accessible without authentication. Use when reviewing all API routes to ensure every endpoint that accesses user data validates the session. Critical for multi-tenant SaaS like Kalmeron.","dahaliztupe-sketch\u002FKalmeron-Two","dahaliztupe-sketch","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F271085317?v=4","01M719765Q83P08JCQ1SWNQR0N","01M719766HQBGF44W90MPJKTD2",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsast-missing-auth\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"sast missing auth","missing","sast","auth","user","authorization","data","vulnerabilities","detect","endpoints","multi","api","saas","when","critical","use","session","authentication","for","tenant","2026-11-10 10:12:30",false,"---\nname: sast-missing-auth\ndescription: Detect Missing Authorization vulnerabilities — API endpoints accessible without authentication. Use when reviewing all API routes to ensure every endpoint that accesses user data validates the session. Critical for multi-tenant SaaS like Kalmeron.\n---\n\n# SAST: Missing Authorization Detection\n\nScan for unprotected endpoints — OWASP A01:2021 (Broken Access Control).\n\n## What to Look For\n\n### High Risk Patterns\n```typescript\n\u002F\u002F ❌ VULNERABLE: API route with no auth check\nexport async function GET(req: NextRequest) {\n  const users = await db.collection('users').get(); \u002F\u002F no session check!\n  return NextResponse.json(users.docs.map(d => d.data()));\n}\n\n\u002F\u002F ❌ VULNERABLE: only checking presence, not validity\nconst token = req.headers.get('authorization');\nif (!token) return 401; \u002F\u002F but never verifies the token!\n\n\u002F\u002F ❌ VULNERABLE: role check missing for admin operation\nexport async function DELETE(req: NextRequest, { params }) {\n  const session = await getServerSession(); \u002F\u002F authenticated but...\n  await db.collection('users').doc(params.id).delete(); \u002F\u002F no admin check!\n}\n```\n\n### Safe Patterns\n```typescript\n\u002F\u002F ✅ SAFE: session verified at route start\nexport async function GET(req: NextRequest) {\n  const session = await getServerSession();\n  if (!session?.user) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n  }\n  \u002F\u002F proceed with session.user.id\n}\n\n\u002F\u002F ✅ SAFE: role-based check for admin operations\nconst session = await getServerSession();\nif (!session?.user || session.user.role !== 'admin') {\n  return NextResponse.json({ error: 'Forbidden' }, { status: 403 });\n}\n\n\u002F\u002F ✅ SAFE: middleware-level protection\n\u002F\u002F middleware.ts — protect all \u002Fapi\u002F* routes except auth endpoints\n```\n\n## Kalmeron Middleware Analysis\nCheck `middleware.ts` for route protection:\n- `\u002Fapi\u002Fauth\u002F*` — public (login\u002Fregister)\n- `\u002Fapi\u002Fbilling\u002F*` — authenticated\n- `\u002Fapi\u002Fuser\u002F*` — authenticated + self-only\n- `\u002Fadmin\u002F*` — authenticated + admin role\n- `\u002Fapi\u002Fnotifications\u002F*` — authenticated\n\n## Scan Checklist\n\n- [ ] Every `app\u002Fapi\u002F` route that accesses user data calls `getServerSession()` first\n- [ ] `getServerSession()` result checked for null before use\n- [ ] Admin operations check `session.user.role === 'admin'`\n- [ ] `middleware.ts` covers all sensitive route patterns\n- [ ] Public routes (landing, auth) explicitly excluded from auth requirements\n- [ ] Webhook endpoints verify HMAC signature instead of session\n\n## Protected Route Audit Template\n```typescript\n\u002F\u002F Pattern to verify in each API route:\nexport async function [METHOD](req: NextRequest) {\n  \u002F\u002F 1. Get session\n  const session = await getServerSession();\n  \u002F\u002F 2. Verify authentication\n  if (!session?.user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n  \u002F\u002F 3. (for admin routes) Verify authorization\n  if (session.user.role !== 'admin') return NextResponse.json({ error: 'Forbidden' }, { status: 403 });\n  \u002F\u002F 4. Proceed with session.user.id for data scoping\n}\n```\n\n## Severity Matrix\n| Pattern | Severity |\n|---|---|\n| No auth on data-returning endpoint | Critical |\n| No auth on data-modifying endpoint | Critical |\n| Auth present but not verified | Critical |\n| Admin endpoint lacks role check | High |\n| Webhook without signature verification | High |\n\n## Remediation\n1. Add `getServerSession()` + null check at the top of every protected route\n2. Use Next.js middleware to enforce auth at the infrastructure level\n3. Create a helper `requireAuth(req)` that throws on missing\u002Finvalid session\n4. Review all `app\u002Fapi\u002F` routes with a checklist — every endpoint must be classified\n5. Add integration tests that verify 401 on unauthenticated requests\n","# SAST: Missing Authorization Detection\n\nScan for unprotected endpoints — OWASP A01:2021 (Broken Access Control).\n\n## What to Look For\n\n### High Risk Patterns\n```typescript\n\u002F\u002F ❌ VULNERABLE: API route with no auth check\nexport async function GET(req: NextRequest) {\n  const users = await db.collection('users').get(); \u002F\u002F no session check!\n  return NextResponse.json(users.docs.map(d => d.data()));\n}\n\n\u002F\u002F ❌ VULNERABLE: only checking presence, not validity\nconst token = req.headers.get('authorization');\nif (!token) return 401; \u002F\u002F but never verifies the token!\n\n\u002F\u002F ❌ VULNERABLE: role check missing for admin operation\nexport async function DELETE(req: NextRequest, { params }) {\n  const session = await getServerSession(); \u002F\u002F authenticated but...\n  await db.collection('users').doc(params.id).delete(); \u002F\u002F no admin check!\n}\n```\n\n### Safe Patterns\n```typescript\n\u002F\u002F ✅ SAFE: session verified at route start\nexport async function GET(req: NextRequest) {\n  const session = await getServerSession();\n  if (!session?.user) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n  }\n  \u002F\u002F proceed with session.user.id\n}\n\n\u002F\u002F ✅ SAFE: role-based check for admin operations\nconst session = await getServerSession();\nif (!session?.user || session.user.role !== 'admin') {\n  return NextResponse.json({ error: 'Forbidden' }, { status: 403 });\n}\n\n\u002F\u002F ✅ SAFE: middleware-level protection\n\u002F\u002F middleware.ts — protect all \u002Fapi\u002F* routes except auth endpoints\n```\n\n## Kalmeron Middleware Analysis\nCheck `middleware.ts` for route protection:\n- `\u002Fapi\u002Fauth\u002F*` — public (login\u002Fregister)\n- `\u002Fapi\u002Fbilling\u002F*` — authenticated\n- `\u002Fapi\u002Fuser\u002F*` — authenticated + self-only\n- `\u002Fadmin\u002F*` — authenticated + admin role\n- `\u002Fapi\u002Fnotifications\u002F*` — authenticated\n\n## Scan Checklist\n\n- [ ] Every `app\u002Fapi\u002F` route that accesses user data calls `getServerSession()` first\n- [ ] `getServerSession()` result checked for null before use\n- [ ] Admin operations check `session.user.role === 'admin'`\n- [ ] `middleware.ts` covers all sensitive route patterns\n- [ ] Public routes (landing, auth) explicitly excluded from auth requirements\n- [ ] Webhook endpoints verify HMAC signature instead of session\n\n## Protected Route Audit Template\n```typescript\n\u002F\u002F Pattern to verify in each API route:\nexport async function [METHOD](req: NextRequest) {\n  \u002F\u002F 1. Get session\n  const session = await getServerSession();\n  \u002F\u002F 2. Verify authentication\n  if (!session?.user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n  \u002F\u002F 3. (for admin routes) Verify authorization\n  if (session.user.role !== 'admin') return NextResponse.json({ error: 'Forbidden' }, { status: 403 });\n  \u002F\u002F 4. Proceed with session.user.id for data scoping\n}\n```\n\n## Severity Matrix\n| Pattern | Severity |\n|---|---|\n| No auth on data-returning endpoint | Critical |\n| No auth on data-modifying endpoint | Critical |\n| Auth present but not verified | Critical |\n| Admin endpoint lacks role check | High |\n| Webhook without signature verification | High |\n\n## Remediation\n1. Add `getServerSession()` + null check at the top of every protected route\n2. Use Next.js middleware to enforce auth at the infrastructure level\n3. Create a helper `requireAuth(req)` that throws on missing\u002Finvalid session\n4. Review all `app\u002Fapi\u002F` routes with a checklist — every endpoint must be classified\n5. Add integration tests that verify 401 on unauthenticated requests\n",{"name":5,"description":7},"main","13d9afadbb6a87d6209fe4bd6ca2bbe4553119ac",".agents\u002Fskills\u002Fsast-missing-auth",0,"https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two","https:\u002F\u002Fkalmeron-two.vercel.app","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch","2026-10-05 12:24:53",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add dahaliztupe-sketch\u002FKalmeron-Two --skill sast-missing-auth",{"tool":57,"command":58},"bunx","bunx skills add dahaliztupe-sketch\u002FKalmeron-Two --skill sast-missing-auth",{"tool":60,"command":61},"pnpm","pnpm dlx skills add dahaliztupe-sketch\u002FKalmeron-Two --skill sast-missing-auth","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsast-missing-auth\u002FSKILL.md",true,[],[66,83,107,124,153,184],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":70,"sourceHtmlUrl":71,"categories":72,"keywords":78,"publishedAt":38},"01M719SWYD9RGS97HJ69PXWY62","add-new-agent","خطوات تفصيليّة لإضافة وكيل ذكاء اصطناعي جديد إلى منصّة Kalmeron من الفكرة إلى الإنتاج","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002FSKILL.md",[73],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[79,80,81,82],"add","add new agent","new","new agent",{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":100,"publishedAt":38},"01M719SSKNBA7T5NS7V6DP0PX4","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[89,92,95],{"categoryNo":90,"categoryName":91,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":93,"categoryName":94,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[101,102,81,31,103,104,105,33,106],"writing skills","writing","work","editing","deployment","Existing",{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":115,"publishedAt":38},"01M719SRFDNKA3044QD3FYZ05R","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fwriting-plans\u002FSKILL.md",[113,114],{"categoryNo":93,"categoryName":94,"taxonomyType":76,"taxonomyTypeDesc":77},{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},[116,102,117,118,119,120,31,33,36,121,28,122,123],"writing plans","plans","code","requirements","you","task","spec","multi-step task",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":136,"publishedAt":38},"01M719SPN5FM1JYJSR9DGJQPZ0","web-design-guidelines","Review UI code for Web Interface Guidelines compliance. Use when asked to \"review my UI\", \"check accessibility\", \"audit design\", \"review UX\", or \"check my site against best practices\".","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fweb-design-guidelines\u002FSKILL.md",[130,133],{"categoryNo":131,"categoryName":132,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":134,"categoryName":135,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000032","设计师",[137,138,139,140,141,142,143,144,145,146,147,118,36,148,149,150,33,31,151,152],"web design","web design guidelines","web","design","guidelines","review","accessibility","ux","audit","compliance","check","vercel","interface","web interface guidelines","best practices","file",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":157,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":38},"01M719SK11T05QYVPTWWYMYY5B","vitest","Set up Vitest testing in any project — detects project type (Cloudflare Workers, React, Node), generates vitest.config.ts, test setup, utilities, and sample tests. Also covers mocking patterns, coverage config, workspace setup, and Jest migration. Trigger with 'set up vitest', 'add tests', 'configure vitest', 'migrate from jest', 'vitest config', 'add unit tests', or 'testing setup'.","MIT","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fvitest\u002FSKILL.md",[160,161],{"categoryNo":90,"categoryName":91,"taxonomyType":76,"taxonomyTypeDesc":77},{"categoryNo":162,"categoryName":163,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000009","前端开发",[155,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183],"cloudflare","cloudflare workers","config","node","sample","react","jest","migrate","configure","Utilities","up","testing","workspace setup","project","unit","SET","coverage","test setup","patterns",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":38},"01M719SGV9R1N88QWAB7Y925HD","verification-loops","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs. Requires running verification commands and confirming output before making any success claims. Evidence before assertions always.","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fverification-loops\u002FSKILL.md",[],[191,192,193,194,33,195,196,197,198,199,200,201,103,202,203,31],"loops","verification","verification loops","claim","assertions","prs","complete","evidence","running","commands","about","claims","output"]