[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M719Q49H9472FS1854XTS0RX":3,"skill-same:01M719Q49H9472FS1854XTS0RX":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":27,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":58,"ownerHtmlUrl":59,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":60,"install":61,"resources":74},"01M719Q49H9472FS1854XTS0RX","sast-rce",null,"Detect Remote Code Execution (RCE) vulnerabilities in Node.js\u002FPython backend code. Use when reviewing API routes that handle file paths, shell commands, code evaluation, or deserialization. Critical severity — always prioritize.","dahaliztupe-sketch\u002FKalmeron-Two","dahaliztupe-sketch","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F271085317?v=4","01M719765Q83P08JCQ1SWNQR0N","01M719766HQBGF44W90MPJKTD2",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsast-rce\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"rce","sast","sast rce","node","deserialization","shell","backend","detect","api","code","file","when","critical","python backend","use","remote","execution","python","code execution","severity","2026-11-10 10:12:30",false,"---\nname: sast-rce\ndescription: Detect Remote Code Execution (RCE) vulnerabilities in Node.js\u002FPython backend code. Use when reviewing API routes that handle file paths, shell commands, code evaluation, or deserialization. Critical severity — always prioritize.\n---\n\n# SAST: Remote Code Execution (RCE) Detection\n\nScan for RCE vulnerabilities — OWASP A03:2021. **Highest priority — always fix.**\n\n## What to Look For\n\n### Critical Patterns (Node.js)\n```typescript\n\u002F\u002F ❌ CRITICAL: shell command with user input\nimport { exec, execSync } from 'child_process';\nexec(`convert ${userFilename} output.pdf`);       \u002F\u002F command injection\nexecSync(`ffmpeg -i ${req.body.input} ...`);\n\n\u002F\u002F ❌ CRITICAL: eval with user input\neval(req.body.code);\nvm.runInNewContext(userCode);\n\n\u002F\u002F ❌ CRITICAL: require() with user-controlled path\nrequire(req.query.module);\nimport(userPath);\n\n\u002F\u002F ❌ CRITICAL: deserialize untrusted data\nJSON.parse(userInput); \u002F\u002F safe, but:\nserialize.unserialize(cookie); \u002F\u002F node-serialize — CVE-2017-5941\nyaml.load(userYaml); \u002F\u002F js-yaml safeLoad vs load\n```\n\n### Safe Patterns\n```typescript\n\u002F\u002F ✅ SAFE: execFile with argument array (no shell)\nimport { execFile } from 'child_process';\nexecFile('convert', [sanitizedFilename, 'output.pdf']);\n\n\u002F\u002F ✅ SAFE: allowlist validation\nconst ALLOWED_MODULES = ['analytics', 'reports'] as const;\nif (!ALLOWED_MODULES.includes(req.query.module)) throw new Error('Invalid');\n```\n\n## Scan Checklist\n\n- [ ] No `exec()` \u002F `execSync()` \u002F `spawn()` with user-controlled input\n- [ ] No `eval()` \u002F `new Function()` \u002F `vm.runInNewContext()` with user data\n- [ ] No dynamic `require()` \u002F `import()` with user-controlled paths\n- [ ] Deserialization libraries verified (js-yaml uses `safeLoad`, not `load`)\n- [ ] File path operations use `path.resolve()` + `startsWith(allowedDir)` check\n- [ ] No server-side template engines with user-controlled templates\n\n## Next.js \u002F API Route Specific\n- Check `app\u002Fapi\u002F` routes that accept file paths in body\u002Fquery\n- Verify `PDF Worker` (port 8000) and `Embeddings Worker` (port 8099) FastAPI routes\n- Check `src\u002Fai\u002Fagents\u002F` for any dynamic code execution\n\n## Severity Matrix\n| Pattern | Severity |\n|---|---|\n| `exec()` with user input | Critical |\n| `eval()` with user data | Critical |\n| Dynamic `require()` | Critical |\n| Unsafe YAML deserialization | High |\n| Path traversal leading to RCE | Critical |\n\n## Remediation\n1. Use `execFile()` with argument arrays instead of `exec()` with shell strings\n2. Never evaluate user-provided code\n3. Use allowlists for any dynamic module loading\n4. Use `yaml.safeLoad()` not `yaml.load()`\n5. Apply principle of least privilege to process permissions\n","# SAST: Remote Code Execution (RCE) Detection\n\nScan for RCE vulnerabilities — OWASP A03:2021. **Highest priority — always fix.**\n\n## What to Look For\n\n### Critical Patterns (Node.js)\n```typescript\n\u002F\u002F ❌ CRITICAL: shell command with user input\nimport { exec, execSync } from 'child_process';\nexec(`convert ${userFilename} output.pdf`);       \u002F\u002F command injection\nexecSync(`ffmpeg -i ${req.body.input} ...`);\n\n\u002F\u002F ❌ CRITICAL: eval with user input\neval(req.body.code);\nvm.runInNewContext(userCode);\n\n\u002F\u002F ❌ CRITICAL: require() with user-controlled path\nrequire(req.query.module);\nimport(userPath);\n\n\u002F\u002F ❌ CRITICAL: deserialize untrusted data\nJSON.parse(userInput); \u002F\u002F safe, but:\nserialize.unserialize(cookie); \u002F\u002F node-serialize — CVE-2017-5941\nyaml.load(userYaml); \u002F\u002F js-yaml safeLoad vs load\n```\n\n### Safe Patterns\n```typescript\n\u002F\u002F ✅ SAFE: execFile with argument array (no shell)\nimport { execFile } from 'child_process';\nexecFile('convert', [sanitizedFilename, 'output.pdf']);\n\n\u002F\u002F ✅ SAFE: allowlist validation\nconst ALLOWED_MODULES = ['analytics', 'reports'] as const;\nif (!ALLOWED_MODULES.includes(req.query.module)) throw new Error('Invalid');\n```\n\n## Scan Checklist\n\n- [ ] No `exec()` \u002F `execSync()` \u002F `spawn()` with user-controlled input\n- [ ] No `eval()` \u002F `new Function()` \u002F `vm.runInNewContext()` with user data\n- [ ] No dynamic `require()` \u002F `import()` with user-controlled paths\n- [ ] Deserialization libraries verified (js-yaml uses `safeLoad`, not `load`)\n- [ ] File path operations use `path.resolve()` + `startsWith(allowedDir)` check\n- [ ] No server-side template engines with user-controlled templates\n\n## Next.js \u002F API Route Specific\n- Check `app\u002Fapi\u002F` routes that accept file paths in body\u002Fquery\n- Verify `PDF Worker` (port 8000) and `Embeddings Worker` (port 8099) FastAPI routes\n- Check `src\u002Fai\u002Fagents\u002F` for any dynamic code execution\n\n## Severity Matrix\n| Pattern | Severity |\n|---|---|\n| `exec()` with user input | Critical |\n| `eval()` with user data | Critical |\n| Dynamic `require()` | Critical |\n| Unsafe YAML deserialization | High |\n| Path traversal leading to RCE | Critical |\n\n## Remediation\n1. Use `execFile()` with argument arrays instead of `exec()` with shell strings\n2. Never evaluate user-provided code\n3. Use allowlists for any dynamic module loading\n4. Use `yaml.safeLoad()` not `yaml.load()`\n5. Apply principle of least privilege to process permissions\n",{"name":5,"description":7},"main","13d9afadbb6a87d6209fe4bd6ca2bbe4553119ac",".agents\u002Fskills\u002Fsast-rce",0,"https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two","https:\u002F\u002Fkalmeron-two.vercel.app","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch","2026-10-05 12:24:53",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add dahaliztupe-sketch\u002FKalmeron-Two --skill sast-rce",{"tool":67,"command":68},"bunx","bunx skills add dahaliztupe-sketch\u002FKalmeron-Two --skill sast-rce",{"tool":70,"command":71},"pnpm","pnpm dlx skills add dahaliztupe-sketch\u002FKalmeron-Two --skill sast-rce","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsast-rce\u002FSKILL.md",true,[],[76,91,113,131,159,189],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":80,"sourceHtmlUrl":81,"categories":82,"keywords":86,"publishedAt":48},"01M719SWYD9RGS97HJ69PXWY62","add-new-agent","خطوات تفصيليّة لإضافة وكيل ذكاء اصطناعي جديد إلى منصّة Kalmeron من الفكرة إلى الإنتاج","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002FSKILL.md",[83],{"categoryNo":84,"categoryName":85,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[87,88,89,90],"add","add new agent","new","new agent",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":106,"publishedAt":48},"01M719SSKNBA7T5NS7V6DP0PX4","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[97,100,103],{"categoryNo":98,"categoryName":99,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":101,"categoryName":102,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":104,"categoryName":105,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000036","内容创作者",[107,108,89,39,109,110,111,42,112],"writing skills","writing","work","editing","deployment","Existing",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":121,"publishedAt":48},"01M719SRFDNKA3044QD3FYZ05R","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fwriting-plans\u002FSKILL.md",[119,120],{"categoryNo":101,"categoryName":102,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":104,"categoryName":105,"taxonomyType":25,"taxonomyTypeDesc":26},[122,108,123,37,124,125,39,42,126,127,128,129,130],"writing plans","plans","requirements","you","for","task","multi","spec","multi-step task",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":143,"publishedAt":48},"01M719SPN5FM1JYJSR9DGJQPZ0","web-design-guidelines","Review UI code for Web Interface Guidelines compliance. Use when asked to \"review my UI\", \"check accessibility\", \"audit design\", \"review UX\", or \"check my site against best practices\".","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fweb-design-guidelines\u002FSKILL.md",[137,140],{"categoryNo":138,"categoryName":139,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":141,"categoryName":142,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000032","设计师",[144,145,146,147,148,149,150,151,152,153,154,37,126,155,156,157,42,39,158,38],"web design","web design guidelines","web","design","guidelines","review","accessibility","ux","audit","compliance","check","vercel","interface","web interface guidelines","best practices",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":163,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":170,"publishedAt":48},"01M719SK11T05QYVPTWWYMYY5B","vitest","Set up Vitest testing in any project — detects project type (Cloudflare Workers, React, Node), generates vitest.config.ts, test setup, utilities, and sample tests. Also covers mocking patterns, coverage config, workspace setup, and Jest migration. Trigger with 'set up vitest', 'add tests', 'configure vitest', 'migrate from jest', 'vitest config', 'add unit tests', or 'testing setup'.","MIT","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fvitest\u002FSKILL.md",[166,167],{"categoryNo":98,"categoryName":99,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":168,"categoryName":169,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000009","前端开发",[161,171,172,173,31,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"cloudflare","cloudflare workers","config","sample","react","jest","migrate","configure","Utilities","up","testing","workspace setup","project","unit","SET","coverage","test setup","patterns",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":195,"publishedAt":48},"01M719SGV9R1N88QWAB7Y925HD","verification-loops","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs. Requires running verification commands and confirming output before making any success claims. Evidence before assertions always.","https:\u002F\u002Fgithub.com\u002Fdahaliztupe-sketch\u002FKalmeron-Two\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fverification-loops\u002FSKILL.md",[],[196,197,198,199,42,200,201,202,203,204,205,206,109,207,208,39],"loops","verification","verification loops","claim","assertions","prs","complete","evidence","running","commands","about","claims","output"]