[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FTGF61MNQRR95X629K8GD":3,"skill-same:01M71FTGF61MNQRR95X629K8GD":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":63,"install":64,"resources":77},"01M71FTGF61MNQRR95X629K8GD","gh-actions-validator",null,"Use when validating GitHub Actions workflows for Google Cloud and Vertex AI deployments. Trigger with phrases like \"validate github actions\", \"setup workload identity federation\", \"github actions security\", \"deploy agent with ci\u002Fcd\", or \"automate vertex ai deployment\". Enforces Workload Identity Federation (WIF), validates OIDC permissions, ensures least privilege IAM, and implements security best practices.","JSGforever\u002Fskillguard","JSGforever","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F85541948?v=4","01M71FQD3E132VMR5F4TAYX3YS","01M71FQD4DYW0XJ4XQ4YQH75Y9",2,"MIT","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__BbgnsurfTech--gh-actions-validator\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"actions","gh actions validator","gh","validator","security","google","git","workload","edit","write","CI\u002FCD","read","permissions","iam","Bash","when","workflows","github actions","ci","google cloud","2026-11-10 10:12:30",false,"---\ndescription: Use when validating GitHub Actions workflows for Google Cloud and Vertex AI deployments. Trigger with phrases like \"validate github actions\", \"setup workload identity federation\", \"github actions security\", \"deploy agent with ci\u002Fcd\", or \"automate vertex ai deployment\". Enforces Workload Identity Federation (WIF), validates OIDC permissions, ensures least privilege IAM, and implements security best practices.\nallowed-tools:\n- Read\n- Write\n- Edit\n- Grep\n- Glob\n- Bash(git:*)\n- Bash(gcloud:*)\nname: gh-actions-validator\nlicense: MIT\nversion: 1.0.0\n---\n\n## Prerequisites\n\nBefore using this skill, ensure:\n- GitHub repository with Actions enabled\n- Google Cloud project with billing enabled\n- gcloud CLI authenticated with admin permissions\n- Understanding of Workload Identity Federation concepts\n- GitHub repository secrets configured\n- Appropriate IAM roles for CI\u002FCD automation\n\n## Instructions\n\n1. **Audit Existing Workflows**: Scan .github\u002Fworkflows\u002F for security issues\n2. **Validate WIF Usage**: Ensure no JSON service account keys are used\n3. **Check OIDC Permissions**: Verify id-token: write is present\n4. **Review IAM Roles**: Confirm least privilege (no owner\u002Feditor roles)\n5. **Add Security Scans**: Include secret detection and vulnerability scanning\n6. **Validate Deployments**: Add post-deployment health checks\n7. **Configure Monitoring**: Set up alerts for deployment failures\n8. **Document WIF Setup**: Provide one-time WIF configuration commands\n\n## Output\n\n**Secure Workflow Template:**\n```yaml\n# {baseDir}\u002F.github\u002Fworkflows\u002Fdeploy-vertex-ai.yml\nname: Deploy Vertex AI Agent\n\non:\n  push:\n    branches: [main]\n    paths: ['agent\u002F**']\n\npermissions:\n  contents: read\n  id-token: write  # REQUIRED for WIF\n\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Authenticate to GCP (WIF)\n        uses: google-github-actions\u002Fauth@v2\n        with:\n          workload_identity_provider: ${{ secrets.WIF_PROVIDER }}\n          service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}\n\n      - name: Deploy to Vertex AI\n        run: |\n          gcloud ai agents deploy \\\n            --project=${{ secrets.GCP_PROJECT_ID }} \\\n            --region=us-central1\n\n      - name: Validate Deployment\n        run: |\n          python scripts\u002Fvalidate-deployment.py\n```\n\n**WIF Setup Commands:**\n```bash\n# One-time WIF configuration\ngcloud iam workload-identity-pools create github-pool \\\n  --location=global \\\n  --display-name=\"GitHub Actions Pool\"\n\ngcloud iam workload-identity-pools providers create-oidc github-provider \\\n  --location=global \\\n  --workload-identity-pool=github-pool \\\n  --issuer-uri=\"https:\u002F\u002Ftoken.actions.githubusercontent.com\" \\\n  --attribute-mapping=\"google.subject=assertion.sub,attribute.repository=assertion.repository\"\n```\n\n**Security Validation Checks:**\n```yaml\n# {baseDir}\u002F.github\u002Fworkflows\u002Fsecurity-check.yml\nname: Security Validation\n\non: [pull_request, push]\n\npermissions:\n  contents: read\n  security-events: write\n\njobs:\n  security:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Scan for secrets\n        uses: trufflesecurity\u002Ftrufflehog@main\n\n      - name: Vulnerability scan\n        uses: aquasecurity\u002Ftrivy-action@master\n\n      - name: Validate no JSON keys\n        run: |\n          if find . -name \"*service-account*.json\"; then\n            echo \"ERROR: Service account keys detected\"\n            exit 1\n          fi\n\n      - name: Validate WIF usage\n        run: |\n          if grep -r \"credentials_json\" .github\u002Fworkflows\u002F; then\n            echo \"ERROR: Use WIF instead of JSON keys\"\n            exit 1\n          fi\n```\n\n## Error Handling\n\n**WIF Authentication Failed**\n- Error: \"Failed to generate Google Cloud access token\"\n- Solution: Verify WIF provider and service account email are correct\n\n**OIDC Token Error**\n- Error: \"Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable\"\n- Solution: Add `id-token: write` permission to workflow\n\n**IAM Permission Denied**\n- Error: \"does not have required permission\"\n- Solution: Grant service account minimum required roles (run.admin, aiplatform.user)\n\n**Attribute Condition Failed**\n- Error: \"Token does not match attribute condition\"\n- Solution: Update attribute mapping to include repository restriction\n\n**Deployment Validation Failed**\n- Error: \"Agent not in RUNNING state\"\n- Solution: Check agent configuration and deployment logs\n\n## Resources\n\n- Workload Identity Federation: https:\u002F\u002Fcloud.google.com\u002Fiam\u002Fdocs\u002Fworkload-identity-federation\n- GitHub OIDC: https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fdeployment\u002Fsecurity-hardening-your-deployments\n- Vertex AI Agent Engine: https:\u002F\u002Fcloud.google.com\u002Fvertex-ai\u002Fdocs\u002Fagent-engine\n- google-github-actions\u002Fauth: https:\u002F\u002Fgithub.com\u002Fgoogle-github-actions\u002Fauth\n- WIF setup guide in {baseDir}\u002Fdocs\u002Fwif-setup.md\n","## Prerequisites\n\nBefore using this skill, ensure:\n- GitHub repository with Actions enabled\n- Google Cloud project with billing enabled\n- gcloud CLI authenticated with admin permissions\n- Understanding of Workload Identity Federation concepts\n- GitHub repository secrets configured\n- Appropriate IAM roles for CI\u002FCD automation\n\n## Instructions\n\n1. **Audit Existing Workflows**: Scan .github\u002Fworkflows\u002F for security issues\n2. **Validate WIF Usage**: Ensure no JSON service account keys are used\n3. **Check OIDC Permissions**: Verify id-token: write is present\n4. **Review IAM Roles**: Confirm least privilege (no owner\u002Feditor roles)\n5. **Add Security Scans**: Include secret detection and vulnerability scanning\n6. **Validate Deployments**: Add post-deployment health checks\n7. **Configure Monitoring**: Set up alerts for deployment failures\n8. **Document WIF Setup**: Provide one-time WIF configuration commands\n\n## Output\n\n**Secure Workflow Template:**\n```yaml\n# {baseDir}\u002F.github\u002Fworkflows\u002Fdeploy-vertex-ai.yml\nname: Deploy Vertex AI Agent\n\non:\n  push:\n    branches: [main]\n    paths: ['agent\u002F**']\n\npermissions:\n  contents: read\n  id-token: write  # REQUIRED for WIF\n\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Authenticate to GCP (WIF)\n        uses: google-github-actions\u002Fauth@v2\n        with:\n          workload_identity_provider: ${{ secrets.WIF_PROVIDER }}\n          service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}\n\n      - name: Deploy to Vertex AI\n        run: |\n          gcloud ai agents deploy \\\n            --project=${{ secrets.GCP_PROJECT_ID }} \\\n            --region=us-central1\n\n      - name: Validate Deployment\n        run: |\n          python scripts\u002Fvalidate-deployment.py\n```\n\n**WIF Setup Commands:**\n```bash\n# One-time WIF configuration\ngcloud iam workload-identity-pools create github-pool \\\n  --location=global \\\n  --display-name=\"GitHub Actions Pool\"\n\ngcloud iam workload-identity-pools providers create-oidc github-provider \\\n  --location=global \\\n  --workload-identity-pool=github-pool \\\n  --issuer-uri=\"https:\u002F\u002Ftoken.actions.githubusercontent.com\" \\\n  --attribute-mapping=\"google.subject=assertion.sub,attribute.repository=assertion.repository\"\n```\n\n**Security Validation Checks:**\n```yaml\n# {baseDir}\u002F.github\u002Fworkflows\u002Fsecurity-check.yml\nname: Security Validation\n\non: [pull_request, push]\n\npermissions:\n  contents: read\n  security-events: write\n\njobs:\n  security:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Scan for secrets\n        uses: trufflesecurity\u002Ftrufflehog@main\n\n      - name: Vulnerability scan\n        uses: aquasecurity\u002Ftrivy-action@master\n\n      - name: Validate no JSON keys\n        run: |\n          if find . -name \"*service-account*.json\"; then\n            echo \"ERROR: Service account keys detected\"\n            exit 1\n          fi\n\n      - name: Validate WIF usage\n        run: |\n          if grep -r \"credentials_json\" .github\u002Fworkflows\u002F; then\n            echo \"ERROR: Use WIF instead of JSON keys\"\n            exit 1\n          fi\n```\n\n## Error Handling\n\n**WIF Authentication Failed**\n- Error: \"Failed to generate Google Cloud access token\"\n- Solution: Verify WIF provider and service account email are correct\n\n**OIDC Token Error**\n- Error: \"Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable\"\n- Solution: Add `id-token: write` permission to workflow\n\n**IAM Permission Denied**\n- Error: \"does not have required permission\"\n- Solution: Grant service account minimum required roles (run.admin, aiplatform.user)\n\n**Attribute Condition Failed**\n- Error: \"Token does not match attribute condition\"\n- Solution: Update attribute mapping to include repository restriction\n\n**Deployment Validation Failed**\n- Error: \"Agent not in RUNNING state\"\n- Solution: Check agent configuration and deployment logs\n\n## Resources\n\n- Workload Identity Federation: https:\u002F\u002Fcloud.google.com\u002Fiam\u002Fdocs\u002Fworkload-identity-federation\n- GitHub OIDC: https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fdeployment\u002Fsecurity-hardening-your-deployments\n- Vertex AI Agent Engine: https:\u002F\u002Fcloud.google.com\u002Fvertex-ai\u002Fdocs\u002Fagent-engine\n- google-github-actions\u002Fauth: https:\u002F\u002Fgithub.com\u002Fgoogle-github-actions\u002Fauth\n- WIF setup guide in {baseDir}\u002Fdocs\u002Fwif-setup.md\n",{"name":5,"license":14,"version":48,"description":7,"allowed-tools":49},"1.0.0",[50,51,52,53,54,55,56],"Read","Write","Edit","Grep","Glob","Bash(git:*)","Bash(gcloud:*)","main","f2ec4b3b9133d34eeaf9b38e4b0a97e8e5705a7f","benchmarks\u002Ffinal\u002Fskills\u002Fasset1__BbgnsurfTech--gh-actions-validator",0,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard","https:\u002F\u002Fgithub.com\u002FJSGforever","2026-08-29 18:27:56",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add JSGforever\u002Fskillguard --skill gh-actions-validator",{"tool":70,"command":71},"bunx","bunx skills add JSGforever\u002Fskillguard --skill gh-actions-validator",{"tool":73,"command":74},"pnpm","pnpm dlx skills add JSGforever\u002Fskillguard --skill gh-actions-validator","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__BbgnsurfTech--gh-actions-validator\u002FSKILL.md",true,[78,84],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"scripts\u002Fsetup-wif.sh","SCRIPT","脚本",2172,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__BbgnsurfTech--gh-actions-validator\u002Fscripts\u002Fsetup-wif.sh",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"scripts\u002Fvalidate-workflow.sh",1487,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__BbgnsurfTech--gh-actions-validator\u002Fscripts\u002Fvalidate-workflow.sh",[89,118,133,159,181,201],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":99,"publishedAt":43},"01M71HY2SNXBA9Q00WZDTZQ31Z","skillguard-codex-scanner","Hybrid deterministic+LLM agent-skill security scanner. Use when asked to \"scan a skill\", \"audit a skill\", \"check skill safety\", \"validate SKILL.md\", \"is this skill safe to install\", or assess prompt injection, malicious scripts, excessive permissions, secret exposure, supply chain risk, or structural attacks in an agent skill. Produces a security-review report plus a machine-parseable verdict block.","GPL-3.0","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fsrc\u002Fskillguard\u002Fstatic_scanner\u002Fskillguard-codex-scanner\u002FSKILL.md",[96],{"categoryNo":97,"categoryName":98,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[100,101,102,103,104,105,106,107,108,109,110,111,38,112,113,35,114,115,116,117],"scanner","skillguard codex scanner","skillguard","codex","chain","skill security","security-review","review report","structural","secret","prompt injection","security scanner","review","malicious","exposure","audit","scripts","safe",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":129,"publishedAt":43},"01M71HY0SPKTT3S27BC2HPAC5M","data-exfiltrator","Analyzes data files","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Fsmoke-one-skill\u002Fasset1__cisco-ai-defense--data-exfiltrator\u002FSKILL.md",[124],{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[130,131,132],"data","data exfiltrator","files",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":43},"01M71HXVS9EMN44BGDW215FZ72","real-time-collaboration-engine","Build real-time collaborative editing with WebSockets, OT\u002FCRDT conflict resolution, and presence awareness. Implements cursor tracking, optimistic updates, and offline sync. Use for collaborative editors, whiteboards, video editing. Activate on \"real-time collaboration\", \"WebSocket sync\", \"multiplayer editing\", \"CRDT\", \"presence awareness\". NOT for simple chat, request-response APIs, or single-user apps.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--real-time-collaboration-engine\u002FSKILL.md",[],[140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,37,155,156,157,158],"time","real time collaboration engine","real time collaboration","collaboration","engine","real time","Video","reliability","video editing","performance","conflict resolution","presence","access","apps","updates","activate","optimizer","react","streaming",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":168,"publishedAt":43},"01M71HXP6CTY4KFN0QVMMN0V7J","react-performance-optimizer","Optimize React apps for 60fps performance. Implements memoization, virtualization, code splitting, bundle optimization. Use for slow renders, large lists, bundle bloat. Activate on \"React performance\", \"slow render\", \"useMemo\", \"bundle size\", \"virtualization\". NOT for backend optimization, non-React frameworks, or premature optimization.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--react-performance-optimizer\u002FSKILL.md",[165],{"categoryNo":166,"categoryName":167,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000009","前端开发",[149,169,156,157,170,171,172,173,174,175,140,176,177,153,37,178,155,158,179,180],"react performance optimizer","react performance","performance optimizer","app","nextjs","expert","re","render","2025","code","router","strategies",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":43},"01M71HXH7QXSQB4QTDZ7SP7YXQ","llm-streaming-response-handler","Build production LLM streaming UIs with Server-Sent Events, real-time token display, cancellation, error recovery. Handles OpenAI\u002FAnthropic\u002FClaude streaming APIs. Use for chatbots, AI assistants, real-time text generation. Activate on \"LLM streaming\", \"SSE\", \"token stream\", \"chat UI\", \"real-time AI\". NOT for batch processing, non-streaming APIs, or WebSocket bidirectional chat.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--llm-streaming-response-handler\u002FSKILL.md",[187],{"categoryNo":166,"categoryName":167,"taxonomyType":20,"taxonomyTypeDesc":21},[189,158,190,191,192,193,149,140,194,195,196,37,155,156,197,157,198,199,200,34],"llm streaming response handler","handler","error","processing","retry","chat ui","error recovery","critical","batch","display","text","server",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":212,"publishedAt":43},"01M71HXCB0E1YRKYW1Y8T0Y106","github-actions-pipeline-builder","Build production CI\u002FCD pipelines with GitHub Actions. Implements matrix builds, caching, deployments, testing, security scanning. Use for automated testing, deployments, release workflows. Activate on \"GitHub Actions\", \"CI\u002FCD\", \"workflow\", \"deployment pipeline\", \"automated testing\". NOT for Jenkins\u002FCircleCI, manual deployments, or non-GitHub repositories.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--github-actions-pipeline-builder\u002FSKILL.md",[207,210,211],{"categoryNo":208,"categoryName":209,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":97,"categoryName":98,"taxonomyType":20,"taxonomyTypeDesc":21},[213,23,40,214,215,216,217,147,174,218,41,39,155,180,219,34,220,32,31,29],"github actions pipeline builder","pipeline builder","github","builder","pipeline","testing","run","release"]