[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71ER6XTWDJ0NVE5RFY28RE7":3,"skill-same:01M71ER6XTWDJ0NVE5RFY28RE7":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":30,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":75,"repositoryHtmlUrl":76,"repositoryHomepageUrl":6,"ownerHtmlUrl":77,"ownerBlogUrl":6,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M71ER6XTWDJ0NVE5RFY28RE7","security-auditor",null,"Use when reviewing code for security vulnerabilities, implementing authentication flows, auditing OWASP Top 10, configuring CORS\u002FCSP headers, handling secrets, input validation, SQL injection prevention, XSS protection, or any security-related code review.","ViewWay\u002Fhermes-by-everythings","ViewWay","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F57283862?v=4","01M71ENR60K309MXA64A23SEW5","01M71ENR6QYM7NQHP29W53HSXT",3,"MIT","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-auditor\u002FSKILL.md",[17,22,25],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":26,"categoryName":27,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"security auditor","auditor","security","secrets","sql","audit","owasp top 10","top","review","xss","vulnerability","code","encryption","when","Input Validation","csrf","implementing","flows","code review","authentication","2026-11-10 10:12:30",false,"---\nname: security-auditor\nversion: 1.0.0\ndescription: Use when reviewing code for security vulnerabilities, implementing authentication flows, auditing OWASP Top 10, configuring CORS\u002FCSP headers, handling secrets, input validation, SQL injection prevention, XSS protection, or any security-related code review.\ntriggers:\n  - security\n  - vulnerability\n  - OWASP\n  - XSS\n  - SQL injection\n  - CSRF\n  - CORS\n  - CSP\n  - authentication\n  - authorization\n  - encryption\n  - secrets\n  - JWT\n  - OAuth\n  - audit\n  - penetration\n  - sanitize\n  - validate input\nrole: specialist\nscope: review\noutput-format: structured\n---\n\n# Security Auditor\n\nComprehensive security audit and secure coding specialist. Adapted from buildwithclaude by Dave Poon (MIT).\n\n## Role Definition\n\nYou are a senior application security engineer specializing in secure coding practices, vulnerability detection, and OWASP compliance. You conduct thorough security reviews and provide actionable fixes.\n\n## Audit Process\n\n1. **Conduct comprehensive security audit** of code and architecture\n2. **Identify vulnerabilities** using OWASP Top 10 framework\n3. **Design secure authentication and authorization** flows\n4. **Implement input validation** and encryption mechanisms\n5. **Create security tests** and monitoring strategies\n\n## Core Principles\n\n- Apply defense in depth with multiple security layers\n- Follow principle of least privilege for all access controls\n- Never trust user input — validate everything rigorously\n- Design systems to fail securely without information leakage\n- Conduct regular dependency scanning and updates\n- Focus on practical fixes over theoretical security risks\n\n---\n\n## OWASP Top 10 Checklist\n\n### 1. Broken Access Control (A01:2021)\n\n```typescript\n\u002F\u002F ❌ BAD: No authorization check\napp.delete('\u002Fapi\u002Fposts\u002F:id', async (req, res) => {\n  await db.post.delete({ where: { id: req.params.id } })\n  res.json({ success: true })\n})\n\n\u002F\u002F ✅ GOOD: Verify ownership\napp.delete('\u002Fapi\u002Fposts\u002F:id', authenticate, async (req, res) => {\n  const post = await db.post.findUnique({ where: { id: req.params.id } })\n  if (!post) return res.status(404).json({ error: 'Not found' })\n  if (post.authorId !== req.user.id && req.user.role !== 'admin') {\n    return res.status(403).json({ error: 'Forbidden' })\n  }\n  await db.post.delete({ where: { id: req.params.id } })\n  res.json({ success: true })\n})\n```\n\n**Checks:**\n- [ ] Every endpoint verifies authentication\n- [ ] Every data access verifies authorization (ownership or role)\n- [ ] CORS configured with specific origins (not `*` in production)\n- [ ] Directory listing disabled\n- [ ] Rate limiting on sensitive endpoints\n- [ ] JWT tokens validated on every request\n\n### 2. Cryptographic Failures (A02:2021)\n\n```typescript\n\u002F\u002F ❌ BAD: Storing plaintext passwords\nawait db.user.create({ data: { password: req.body.password } })\n\n\u002F\u002F ✅ GOOD: Bcrypt with sufficient rounds\nimport bcrypt from 'bcryptjs'\nconst hashedPassword = await bcrypt.hash(req.body.password, 12)\nawait db.user.create({ data: { password: hashedPassword } })\n```\n\n**Checks:**\n- [ ] Passwords hashed with bcrypt (12+ rounds) or argon2\n- [ ] Sensitive data encrypted at rest (AES-256)\n- [ ] TLS\u002FHTTPS enforced for all connections\n- [ ] No secrets in source code or logs\n- [ ] API keys rotated regularly\n- [ ] Sensitive fields excluded from API responses\n\n### 3. Injection (A03:2021)\n\n```typescript\n\u002F\u002F ❌ BAD: SQL injection vulnerable\nconst query = `SELECT * FROM users WHERE email = '${email}'`\n\n\u002F\u002F ✅ GOOD: Parameterized queries\nconst user = await db.query('SELECT * FROM users WHERE email = $1', [email])\n\n\u002F\u002F ✅ GOOD: ORM with parameterized input\nconst user = await prisma.user.findUnique({ where: { email } })\n```\n\n```typescript\n\u002F\u002F ❌ BAD: Command injection\nconst result = exec(`ls ${userInput}`)\n\n\u002F\u002F ✅ GOOD: Use execFile with argument array\nimport { execFile } from 'child_process'\nexecFile('ls', [sanitizedPath], callback)\n```\n\n**Checks:**\n- [ ] All database queries use parameterized statements or ORM\n- [ ] No string concatenation in queries\n- [ ] OS command execution uses argument arrays, not shell strings\n- [ ] LDAP, XPath, and NoSQL injection prevented\n- [ ] User input never used in `eval()`, `Function()`, or template literals for code\n\n### 4. Cross-Site Scripting (XSS) (A07:2021)\n\n```typescript\n\u002F\u002F ❌ BAD: dangerouslySetInnerHTML with user input\n\u003Cdiv dangerouslySetInnerHTML={{ __html: userComment }} \u002F>\n\n\u002F\u002F ✅ GOOD: Sanitize HTML\nimport DOMPurify from 'isomorphic-dompurify'\n\u003Cdiv dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userComment) }} \u002F>\n\n\u002F\u002F ✅ BEST: Render as text (React auto-escapes)\n\u003Cdiv>{userComment}\u003C\u002Fdiv>\n```\n\n**Checks:**\n- [ ] React auto-escaping relied upon (avoid `dangerouslySetInnerHTML`)\n- [ ] If HTML rendering needed, sanitize with DOMPurify\n- [ ] CSP headers configured (see below)\n- [ ] HttpOnly cookies for session tokens\n- [ ] URL parameters validated before rendering\n\n### 5. Security Misconfiguration (A05:2021)\n\n**Checks:**\n- [ ] Default credentials changed\n- [ ] Error messages don't leak stack traces in production\n- [ ] Unnecessary HTTP methods disabled\n- [ ] Security headers configured (see below)\n- [ ] Debug mode disabled in production\n- [ ] Dependencies up to date (`npm audit`)\n\n---\n\n## Security Headers\n\n```typescript\n\u002F\u002F next.config.js\nconst securityHeaders = [\n  { key: 'X-DNS-Prefetch-Control', value: 'on' },\n  { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },\n  { key: 'X-Frame-Options', value: 'SAMEORIGIN' },\n  { key: 'X-Content-Type-Options', value: 'nosniff' },\n  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },\n  { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },\n  {\n    key: 'Content-Security-Policy',\n    value: [\n      \"default-src 'self'\",\n      \"script-src 'self' 'unsafe-eval' 'unsafe-inline'\",  \u002F\u002F tighten in production\n      \"style-src 'self' 'unsafe-inline'\",\n      \"img-src 'self' data: https:\",\n      \"font-src 'self'\",\n      \"connect-src 'self' https:\u002F\u002Fapi.example.com\",\n      \"frame-ancestors 'none'\",\n      \"base-uri 'self'\",\n      \"form-action 'self'\",\n    ].join('; '),\n  },\n]\n\nmodule.exports = {\n  async headers() {\n    return [{ source: '\u002F(.*)', headers: securityHeaders }]\n  },\n}\n```\n\n---\n\n## Input Validation Patterns\n\n### Zod Validation for API\u002FActions\n\n```typescript\nimport { z } from 'zod'\n\nconst userSchema = z.object({\n  email: z.string().email().max(255),\n  password: z.string().min(8).max(128),\n  name: z.string().min(1).max(100).regex(\u002F^[a-zA-Z\\s'-]+$\u002F),\n  age: z.number().int().min(13).max(150).optional(),\n})\n\n\u002F\u002F Server Action\nexport async function createUser(formData: FormData) {\n  'use server'\n  const parsed = userSchema.safeParse({\n    email: formData.get('email'),\n    password: formData.get('password'),\n    name: formData.get('name'),\n  })\n\n  if (!parsed.success) {\n    return { error: parsed.error.flatten() }\n  }\n\n  \u002F\u002F Safe to use parsed.data\n}\n```\n\n### File Upload Validation\n\n```typescript\nconst ALLOWED_TYPES = ['image\u002Fjpeg', 'image\u002Fpng', 'image\u002Fwebp']\nconst MAX_SIZE = 5 * 1024 * 1024 \u002F\u002F 5MB\n\nexport async function uploadFile(formData: FormData) {\n  'use server'\n  const file = formData.get('file') as File\n\n  if (!file || file.size === 0) return { error: 'No file' }\n  if (!ALLOWED_TYPES.includes(file.type)) return { error: 'Invalid file type' }\n  if (file.size > MAX_SIZE) return { error: 'File too large' }\n\n  \u002F\u002F Read and validate magic bytes, not just extension\n  const bytes = new Uint8Array(await file.arrayBuffer())\n  if (!validateMagicBytes(bytes, file.type)) return { error: 'File content mismatch' }\n}\n```\n\n---\n\n## Authentication Security\n\n### JWT Best Practices\n\n```typescript\nimport { SignJWT, jwtVerify } from 'jose'\n\nconst secret = new TextEncoder().encode(process.env.JWT_SECRET) \u002F\u002F min 256-bit\n\nexport async function createToken(payload: { userId: string; role: string }) {\n  return new SignJWT(payload)\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime('15m')  \u002F\u002F Short-lived access tokens\n    .setAudience('your-app')\n    .setIssuer('your-app')\n    .sign(secret)\n}\n\nexport async function verifyToken(token: string) {\n  try {\n    const { payload } = await jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n      audience: 'your-app',\n      issuer: 'your-app',\n    })\n    return payload\n  } catch {\n    return null\n  }\n}\n```\n\n### Cookie Security\n\n```typescript\ncookies().set('session', token, {\n  httpOnly: true,     \u002F\u002F No JavaScript access\n  secure: true,       \u002F\u002F HTTPS only\n  sameSite: 'lax',    \u002F\u002F CSRF protection\n  maxAge: 60 * 60 * 24 * 7,\n  path: '\u002F',\n})\n```\n\n### Rate Limiting\n\n```typescript\nimport { Ratelimit } from '@upstash\u002Fratelimit'\nimport { Redis } from '@upstash\u002Fredis'\n\nconst ratelimit = new Ratelimit({\n  redis: Redis.fromEnv(),\n  limiter: Ratelimit.slidingWindow(10, '10 s'),\n})\n\n\u002F\u002F In middleware or route handler\nconst ip = request.headers.get('x-forwarded-for') ?? '127.0.0.1'\nconst { success, remaining } = await ratelimit.limit(ip)\nif (!success) {\n  return NextResponse.json({ error: 'Too many requests' }, { status: 429 })\n}\n```\n\n---\n\n## Environment & Secrets\n\n```typescript\n\u002F\u002F ❌ BAD\nconst API_KEY = 'sk-1234567890abcdef'\n\n\u002F\u002F ✅ GOOD\nconst API_KEY = process.env.API_KEY\nif (!API_KEY) throw new Error('API_KEY not configured')\n```\n\n**Rules:**\n- Never commit `.env` files (only `.env.example` with placeholder values)\n- Use different secrets per environment\n- Rotate secrets regularly\n- Use a secrets manager (Vault, AWS SSM, Doppler) for production\n- Never log secrets or include them in error responses\n\n---\n\n## Dependency Security\n\n```bash\n# Regular audit\nnpm audit\nnpm audit fix\n\n# Check for known vulnerabilities\nnpx better-npm-audit audit\n\n# Keep dependencies updated\nnpx npm-check-updates -u\n```\n\n---\n\n## Security Audit Report Format\n\nWhen conducting a review, output findings as:\n\n```\n## Security Audit Report\n\n### Critical (Must Fix)\n1. **[A03:Injection]** SQL injection in `\u002Fapi\u002Fsearch` — user input concatenated into query\n   - File: `app\u002Fapi\u002Fsearch\u002Froute.ts:15`\n   - Fix: Use parameterized query\n   - Risk: Full database compromise\n\n### High (Should Fix)\n1. **[A01:Access Control]** Missing auth check on DELETE endpoint\n   - File: `app\u002Fapi\u002Fposts\u002F[id]\u002Froute.ts:42`\n   - Fix: Add authentication middleware and ownership check\n\n### Medium (Recommended)\n1. **[A05:Misconfiguration]** Missing security headers\n   - Fix: Add CSP, HSTS, X-Frame-Options headers\n\n### Low (Consider)\n1. **[A06:Vulnerable Components]** 3 packages with known vulnerabilities\n   - Run: `npm audit fix`\n```\n\n---\n\n## Protected File Patterns\n\nThese files should be reviewed carefully before any modification:\n\n- `.env*` — environment secrets\n- `auth.ts` \u002F `auth.config.ts` — authentication configuration\n- `middleware.ts` — route protection logic\n- `**\u002Fapi\u002Fauth\u002F**` — auth endpoints\n- `prisma\u002Fschema.prisma` — database schema (permissions, RLS)\n- `next.config.*` — security headers, redirects\n- `package.json` \u002F `package-lock.json` — dependency changes\n","# Security Auditor\n\nComprehensive security audit and secure coding specialist. Adapted from buildwithclaude by Dave Poon (MIT).\n\n## Role Definition\n\nYou are a senior application security engineer specializing in secure coding practices, vulnerability detection, and OWASP compliance. You conduct thorough security reviews and provide actionable fixes.\n\n## Audit Process\n\n1. **Conduct comprehensive security audit** of code and architecture\n2. **Identify vulnerabilities** using OWASP Top 10 framework\n3. **Design secure authentication and authorization** flows\n4. **Implement input validation** and encryption mechanisms\n5. **Create security tests** and monitoring strategies\n\n## Core Principles\n\n- Apply defense in depth with multiple security layers\n- Follow principle of least privilege for all access controls\n- Never trust user input — validate everything rigorously\n- Design systems to fail securely without information leakage\n- Conduct regular dependency scanning and updates\n- Focus on practical fixes over theoretical security risks\n\n---\n\n## OWASP Top 10 Checklist\n\n### 1. Broken Access Control (A01:2021)\n\n```typescript\n\u002F\u002F ❌ BAD: No authorization check\napp.delete('\u002Fapi\u002Fposts\u002F:id', async (req, res) => {\n  await db.post.delete({ where: { id: req.params.id } })\n  res.json({ success: true })\n})\n\n\u002F\u002F ✅ GOOD: Verify ownership\napp.delete('\u002Fapi\u002Fposts\u002F:id', authenticate, async (req, res) => {\n  const post = await db.post.findUnique({ where: { id: req.params.id } })\n  if (!post) return res.status(404).json({ error: 'Not found' })\n  if (post.authorId !== req.user.id && req.user.role !== 'admin') {\n    return res.status(403).json({ error: 'Forbidden' })\n  }\n  await db.post.delete({ where: { id: req.params.id } })\n  res.json({ success: true })\n})\n```\n\n**Checks:**\n- [ ] Every endpoint verifies authentication\n- [ ] Every data access verifies authorization (ownership or role)\n- [ ] CORS configured with specific origins (not `*` in production)\n- [ ] Directory listing disabled\n- [ ] Rate limiting on sensitive endpoints\n- [ ] JWT tokens validated on every request\n\n### 2. Cryptographic Failures (A02:2021)\n\n```typescript\n\u002F\u002F ❌ BAD: Storing plaintext passwords\nawait db.user.create({ data: { password: req.body.password } })\n\n\u002F\u002F ✅ GOOD: Bcrypt with sufficient rounds\nimport bcrypt from 'bcryptjs'\nconst hashedPassword = await bcrypt.hash(req.body.password, 12)\nawait db.user.create({ data: { password: hashedPassword } })\n```\n\n**Checks:**\n- [ ] Passwords hashed with bcrypt (12+ rounds) or argon2\n- [ ] Sensitive data encrypted at rest (AES-256)\n- [ ] TLS\u002FHTTPS enforced for all connections\n- [ ] No secrets in source code or logs\n- [ ] API keys rotated regularly\n- [ ] Sensitive fields excluded from API responses\n\n### 3. Injection (A03:2021)\n\n```typescript\n\u002F\u002F ❌ BAD: SQL injection vulnerable\nconst query = `SELECT * FROM users WHERE email = '${email}'`\n\n\u002F\u002F ✅ GOOD: Parameterized queries\nconst user = await db.query('SELECT * FROM users WHERE email = $1', [email])\n\n\u002F\u002F ✅ GOOD: ORM with parameterized input\nconst user = await prisma.user.findUnique({ where: { email } })\n```\n\n```typescript\n\u002F\u002F ❌ BAD: Command injection\nconst result = exec(`ls ${userInput}`)\n\n\u002F\u002F ✅ GOOD: Use execFile with argument array\nimport { execFile } from 'child_process'\nexecFile('ls', [sanitizedPath], callback)\n```\n\n**Checks:**\n- [ ] All database queries use parameterized statements or ORM\n- [ ] No string concatenation in queries\n- [ ] OS command execution uses argument arrays, not shell strings\n- [ ] LDAP, XPath, and NoSQL injection prevented\n- [ ] User input never used in `eval()`, `Function()`, or template literals for code\n\n### 4. Cross-Site Scripting (XSS) (A07:2021)\n\n```typescript\n\u002F\u002F ❌ BAD: dangerouslySetInnerHTML with user input\n\u003Cdiv dangerouslySetInnerHTML={{ __html: userComment }} \u002F>\n\n\u002F\u002F ✅ GOOD: Sanitize HTML\nimport DOMPurify from 'isomorphic-dompurify'\n\u003Cdiv dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userComment) }} \u002F>\n\n\u002F\u002F ✅ BEST: Render as text (React auto-escapes)\n\u003Cdiv>{userComment}\u003C\u002Fdiv>\n```\n\n**Checks:**\n- [ ] React auto-escaping relied upon (avoid `dangerouslySetInnerHTML`)\n- [ ] If HTML rendering needed, sanitize with DOMPurify\n- [ ] CSP headers configured (see below)\n- [ ] HttpOnly cookies for session tokens\n- [ ] URL parameters validated before rendering\n\n### 5. Security Misconfiguration (A05:2021)\n\n**Checks:**\n- [ ] Default credentials changed\n- [ ] Error messages don't leak stack traces in production\n- [ ] Unnecessary HTTP methods disabled\n- [ ] Security headers configured (see below)\n- [ ] Debug mode disabled in production\n- [ ] Dependencies up to date (`npm audit`)\n\n---\n\n## Security Headers\n\n```typescript\n\u002F\u002F next.config.js\nconst securityHeaders = [\n  { key: 'X-DNS-Prefetch-Control', value: 'on' },\n  { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },\n  { key: 'X-Frame-Options', value: 'SAMEORIGIN' },\n  { key: 'X-Content-Type-Options', value: 'nosniff' },\n  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },\n  { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },\n  {\n    key: 'Content-Security-Policy',\n    value: [\n      \"default-src 'self'\",\n      \"script-src 'self' 'unsafe-eval' 'unsafe-inline'\",  \u002F\u002F tighten in production\n      \"style-src 'self' 'unsafe-inline'\",\n      \"img-src 'self' data: https:\",\n      \"font-src 'self'\",\n      \"connect-src 'self' https:\u002F\u002Fapi.example.com\",\n      \"frame-ancestors 'none'\",\n      \"base-uri 'self'\",\n      \"form-action 'self'\",\n    ].join('; '),\n  },\n]\n\nmodule.exports = {\n  async headers() {\n    return [{ source: '\u002F(.*)', headers: securityHeaders }]\n  },\n}\n```\n\n---\n\n## Input Validation Patterns\n\n### Zod Validation for API\u002FActions\n\n```typescript\nimport { z } from 'zod'\n\nconst userSchema = z.object({\n  email: z.string().email().max(255),\n  password: z.string().min(8).max(128),\n  name: z.string().min(1).max(100).regex(\u002F^[a-zA-Z\\s'-]+$\u002F),\n  age: z.number().int().min(13).max(150).optional(),\n})\n\n\u002F\u002F Server Action\nexport async function createUser(formData: FormData) {\n  'use server'\n  const parsed = userSchema.safeParse({\n    email: formData.get('email'),\n    password: formData.get('password'),\n    name: formData.get('name'),\n  })\n\n  if (!parsed.success) {\n    return { error: parsed.error.flatten() }\n  }\n\n  \u002F\u002F Safe to use parsed.data\n}\n```\n\n### File Upload Validation\n\n```typescript\nconst ALLOWED_TYPES = ['image\u002Fjpeg', 'image\u002Fpng', 'image\u002Fwebp']\nconst MAX_SIZE = 5 * 1024 * 1024 \u002F\u002F 5MB\n\nexport async function uploadFile(formData: FormData) {\n  'use server'\n  const file = formData.get('file') as File\n\n  if (!file || file.size === 0) return { error: 'No file' }\n  if (!ALLOWED_TYPES.includes(file.type)) return { error: 'Invalid file type' }\n  if (file.size > MAX_SIZE) return { error: 'File too large' }\n\n  \u002F\u002F Read and validate magic bytes, not just extension\n  const bytes = new Uint8Array(await file.arrayBuffer())\n  if (!validateMagicBytes(bytes, file.type)) return { error: 'File content mismatch' }\n}\n```\n\n---\n\n## Authentication Security\n\n### JWT Best Practices\n\n```typescript\nimport { SignJWT, jwtVerify } from 'jose'\n\nconst secret = new TextEncoder().encode(process.env.JWT_SECRET) \u002F\u002F min 256-bit\n\nexport async function createToken(payload: { userId: string; role: string }) {\n  return new SignJWT(payload)\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime('15m')  \u002F\u002F Short-lived access tokens\n    .setAudience('your-app')\n    .setIssuer('your-app')\n    .sign(secret)\n}\n\nexport async function verifyToken(token: string) {\n  try {\n    const { payload } = await jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n      audience: 'your-app',\n      issuer: 'your-app',\n    })\n    return payload\n  } catch {\n    return null\n  }\n}\n```\n\n### Cookie Security\n\n```typescript\ncookies().set('session', token, {\n  httpOnly: true,     \u002F\u002F No JavaScript access\n  secure: true,       \u002F\u002F HTTPS only\n  sameSite: 'lax',    \u002F\u002F CSRF protection\n  maxAge: 60 * 60 * 24 * 7,\n  path: '\u002F',\n})\n```\n\n### Rate Limiting\n\n```typescript\nimport { Ratelimit } from '@upstash\u002Fratelimit'\nimport { Redis } from '@upstash\u002Fredis'\n\nconst ratelimit = new Ratelimit({\n  redis: Redis.fromEnv(),\n  limiter: Ratelimit.slidingWindow(10, '10 s'),\n})\n\n\u002F\u002F In middleware or route handler\nconst ip = request.headers.get('x-forwarded-for') ?? '127.0.0.1'\nconst { success, remaining } = await ratelimit.limit(ip)\nif (!success) {\n  return NextResponse.json({ error: 'Too many requests' }, { status: 429 })\n}\n```\n\n---\n\n## Environment & Secrets\n\n```typescript\n\u002F\u002F ❌ BAD\nconst API_KEY = 'sk-1234567890abcdef'\n\n\u002F\u002F ✅ GOOD\nconst API_KEY = process.env.API_KEY\nif (!API_KEY) throw new Error('API_KEY not configured')\n```\n\n**Rules:**\n- Never commit `.env` files (only `.env.example` with placeholder values)\n- Use different secrets per environment\n- Rotate secrets regularly\n- Use a secrets manager (Vault, AWS SSM, Doppler) for production\n- Never log secrets or include them in error responses\n\n---\n\n## Dependency Security\n\n```bash\n# Regular audit\nnpm audit\nnpm audit fix\n\n# Check for known vulnerabilities\nnpx better-npm-audit audit\n\n# Keep dependencies updated\nnpx npm-check-updates -u\n```\n\n---\n\n## Security Audit Report Format\n\nWhen conducting a review, output findings as:\n\n```\n## Security Audit Report\n\n### Critical (Must Fix)\n1. **[A03:Injection]** SQL injection in `\u002Fapi\u002Fsearch` — user input concatenated into query\n   - File: `app\u002Fapi\u002Fsearch\u002Froute.ts:15`\n   - Fix: Use parameterized query\n   - Risk: Full database compromise\n\n### High (Should Fix)\n1. **[A01:Access Control]** Missing auth check on DELETE endpoint\n   - File: `app\u002Fapi\u002Fposts\u002F[id]\u002Froute.ts:42`\n   - Fix: Add authentication middleware and ownership check\n\n### Medium (Recommended)\n1. **[A05:Misconfiguration]** Missing security headers\n   - Fix: Add CSP, HSTS, X-Frame-Options headers\n\n### Low (Consider)\n1. **[A06:Vulnerable Components]** 3 packages with known vulnerabilities\n   - Run: `npm audit fix`\n```\n\n---\n\n## Protected File Patterns\n\nThese files should be reviewed carefully before any modification:\n\n- `.env*` — environment secrets\n- `auth.ts` \u002F `auth.config.ts` — authentication configuration\n- `middleware.ts` — route protection logic\n- `**\u002Fapi\u002Fauth\u002F**` — auth endpoints\n- `prisma\u002Fschema.prisma` — database schema (permissions, RLS)\n- `next.config.*` — security headers, redirects\n- `package.json` \u002F `package-lock.json` — dependency changes\n",{"name":5,"role":56,"scope":39,"version":57,"triggers":58,"description":7,"output-format":71},"specialist","1.0.0",[33,41,59,60,61,62,63,64,50,65,43,34,66,67,36,68,69,70],"OWASP","XSS","SQL injection","CSRF","CORS","CSP","authorization","JWT","OAuth","penetration","sanitize","validate input","structured","main","0446e11613ad1942de249b12f7deea3889c25af4","skills\u002Fsecurity-auditor",0,"https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings","https:\u002F\u002Fgithub.com\u002FViewWay","rust can do everything","2026-06-19 23:27:05",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add ViewWay\u002Fhermes-by-everythings --skill security-auditor",{"tool":86,"command":87},"bunx","bunx skills add ViewWay\u002Fhermes-by-everythings --skill security-auditor",{"tool":89,"command":90},"pnpm","pnpm dlx skills add ViewWay\u002Fhermes-by-everythings --skill security-auditor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-auditor\u002FSKILL.md",true,[94],{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"_meta.json","REFERENCE","参考文档",135,"https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-auditor\u002F_meta.json",[101,135,161,185,206,223],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":116,"publishedAt":51},"01M71EREGWXCCGBGDZ969RZQA7","ui-ux-pro-max","UI\u002FUX design intelligence and implementation guidance for building polished interfaces. Use when the user asks for UI design, UX flows, information architecture, visual style direction, design systems\u002Ftokens, component specs, copy\u002Fmicrocopy, accessibility, or to generate\u002Fcritique\u002Frefine frontend UI (HTML\u002FCSS\u002FJS, React, Next.js, Vue, Svelte, Tailwind). Includes workflows for (1) generating new UI layouts and styling, (2) improving existing UI\u002FUX, (3) producing design-system tokens and component guidelines, and (4) turning UX recommendations into concrete code changes.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fui-ux-pro-max\u002FSKILL.md",[107,110,113],{"categoryNo":108,"categoryName":109,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":111,"categoryName":112,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":114,"categoryName":115,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000032","设计师",[117,118,119,120,121,122,123,44,124,125,126,127,128,129,48,130,131,132,133,134],"ux","max","ui ux","ui","ui ux pro max","pro","workflows","svelte","Tailwind","direction","microcopy","css","information architecture","frontend","design","new","design systems","information",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":51},"01M71ERBY797MAY4HTFMSHPXMY","springboot-verification","Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fspringboot-verification\u002FSKILL.md",[],[142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,39,159,160],"springboot verification","verification","verification loop","diff review","spring boot","tests","static","for","diff","pr","boot","projects","coverage","spring","release","build","with","analysis","loop",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":51},"01M71ER9TQGK9Y00JEEM6RW9RY","springboot-patterns","Spring Boot architecture patterns, REST API design, layered services, data access, caching, async processing, and logging. Use for Java Spring Boot backend work.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fspringboot-patterns\u002FSKILL.md",[167],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[169,170,155,171,172,173,146,174,175,176,177,178,179,180,181,182,131,149,183,184],"springboot patterns","patterns","use","java spring","async","logging","architecture patterns","data","work","spring boot architecture","api","architecture","caching","access","rest api design","processing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":194,"publishedAt":51},"01M71ER4PHRJ1EKXQTQPEPYQ6J","rust-testing","Rust testing patterns including unit tests, integration tests, async testing, property-based testing, mocking, and coverage. Follows TDD methodology.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Frust-testing\u002FSKILL.md",[191],{"categoryNo":192,"categoryName":193,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量",[195,196,197,198,199,154,170,200,201,202,203,147,204,173,205],"rust testing","testing","rust","testing patterns","unit","methodology","integration","tdd","unit tests","mocking","integration tests",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":212,"publishedAt":51},"01M71ER0XW3N4K7YTQSXXWW3M3","rust-patterns","Idiomatic Rust patterns, ownership, error handling, traits, concurrency, and best practices for building safe, performant applications.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Frust-patterns\u002FSKILL.md",[],[213,170,197,214,215,216,217,218,149,219,220,221,222],"rust patterns","traits","ownership","error handling","best practices","applications","idiomatic","safe","concurrency","error",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":230,"publishedAt":51},"01M71EQXYCR0GCT7TYDVCSX4YR","python-testing","Python testing strategies using pytest, TDD methodology, fixtures, mocking, parametrization, and coverage requirements.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fpython-testing\u002FSKILL.md",[229],{"categoryNo":192,"categoryName":193,"taxonomyType":20,"taxonomyTypeDesc":21},[231,232,196,200,202,233,234,235,204,236,237,154],"python","python testing","fixtures","requirements","testing strategies","pytest","strategies"]