[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71HFSXKHCT5Q47K4XKPH89B":3,"skill-same:01M71HFSXKHCT5Q47K4XKPH89B":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":49,"install":50,"resources":63},"01M71HFSXKHCT5Q47K4XKPH89B","form-security",null,"Security patterns for web forms including autocomplete attributes for password managers, CSRF protection, XSS prevention, and input sanitization. Use when implementing authentication forms, payment forms, or any form handling sensitive data.","JSGforever\u002Fskillguard","JSGforever","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F85541948?v=4","01M71FQD3E132VMR5F4TAYX3YS","01M71FQD4DYW0XJ4XQ4YQH75Y9",2,"GPL-3.0","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__bbeierle12--form-security\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"security","form","form security","for","prevention","patterns","security patterns","sanitization","input","data","forms","csrf protection","xss","managers","when","web forms","csrf","implementing","authentication","attributes","2026-11-10 10:12:30",false,"---\nname: form-security\ndescription: Security patterns for web forms including autocomplete attributes for password managers, CSRF protection, XSS prevention, and input sanitization. Use when implementing authentication forms, payment forms, or any form handling sensitive data.\n---\n\n# Form Security\n\nSecurity-first patterns for web forms. Ensures password manager compatibility, prevents common attacks, and protects user data.\n\n## Quick Start\n\n```tsx\n\u002F\u002F The 3 critical security patterns\n\u003Cform>\n  {\u002F* 1. Autocomplete for password managers *\u002F}\n  \u003Cinput type=\"email\" autoComplete=\"email\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"current-password\" \u002F>\n  \n  {\u002F* 2. CSRF token *\u002F}\n  \u003Cinput type=\"hidden\" name=\"_csrf\" value={csrfToken} \u002F>\n  \n  {\u002F* 3. Allow paste (never disable!) *\u002F}\n  \u003Cinput type=\"password\" \u002F> {\u002F* No onPaste handler blocking *\u002F}\n\u003C\u002Fform>\n```\n\n## Autocomplete Attributes\n\n### Why It Matters\n\n- **1Password, LastPass, Bitwarden** rely on `autocomplete` to identify fields\n- Without correct values, password managers fail silently\n- Users abandon forms when autofill doesn't work\n- Security improves when users can use unique, strong passwords\n\n### The Autocomplete Specification\n\n```typescript\n\u002F\u002F autocomplete-config.ts\nexport const AUTOCOMPLETE = {\n  \u002F\u002F ===== IDENTITY =====\n  name: 'name',                    \u002F\u002F Full name\n  honorificPrefix: 'honorific-prefix', \u002F\u002F Mr., Mrs., Dr.\n  givenName: 'given-name',         \u002F\u002F First name\n  additionalName: 'additional-name', \u002F\u002F Middle name\n  familyName: 'family-name',       \u002F\u002F Last name\n  honorificSuffix: 'honorific-suffix', \u002F\u002F Jr., III\n  nickname: 'nickname',\n  \n  \u002F\u002F ===== AUTHENTICATION (CRITICAL) =====\n  email: 'email',\n  username: 'username',\n  currentPassword: 'current-password',  \u002F\u002F LOGIN forms\n  newPassword: 'new-password',          \u002F\u002F REGISTRATION + RESET forms\n  oneTimeCode: 'one-time-code',         \u002F\u002F 2FA\u002FOTP codes\n  \n  \u002F\u002F ===== CONTACT =====\n  tel: 'tel',                      \u002F\u002F Full phone\n  telCountryCode: 'tel-country-code',\n  telNational: 'tel-national',\n  telAreaCode: 'tel-area-code',\n  telLocal: 'tel-local',\n  telExtension: 'tel-extension',\n  \n  \u002F\u002F ===== ADDRESS =====\n  streetAddress: 'street-address', \u002F\u002F Full street (may be multiline)\n  addressLine1: 'address-line1',   \u002F\u002F Street line 1\n  addressLine2: 'address-line2',   \u002F\u002F Apt, Suite, etc.\n  addressLine3: 'address-line3',\n  addressLevel1: 'address-level1', \u002F\u002F State\u002FProvince\n  addressLevel2: 'address-level2', \u002F\u002F City\n  addressLevel3: 'address-level3', \u002F\u002F District\n  addressLevel4: 'address-level4', \u002F\u002F Neighborhood\n  postalCode: 'postal-code',\n  country: 'country',\n  countryName: 'country-name',\n  \n  \u002F\u002F ===== PAYMENT (CRITICAL) =====\n  ccName: 'cc-name',               \u002F\u002F Name on card\n  ccGivenName: 'cc-given-name',\n  ccFamilyName: 'cc-family-name',\n  ccNumber: 'cc-number',           \u002F\u002F Card number\n  ccExp: 'cc-exp',                 \u002F\u002F Expiry (MM\u002FYY)\n  ccExpMonth: 'cc-exp-month',      \u002F\u002F Expiry month\n  ccExpYear: 'cc-exp-year',        \u002F\u002F Expiry year\n  ccCsc: 'cc-csc',                 \u002F\u002F CVV\u002FCVC\n  ccType: 'cc-type',               \u002F\u002F Visa, Mastercard, etc.\n  \n  \u002F\u002F ===== ORGANIZATION =====\n  organization: 'organization',\n  organizationTitle: 'organization-title', \u002F\u002F Job title\n  \n  \u002F\u002F ===== DATES =====\n  bday: 'bday',                    \u002F\u002F Full birthday\n  bdayDay: 'bday-day',\n  bdayMonth: 'bday-month',\n  bdayYear: 'bday-year',\n  \n  \u002F\u002F ===== OTHER =====\n  sex: 'sex',                      \u002F\u002F Gender\n  url: 'url',                      \u002F\u002F Website\n  photo: 'photo',                  \u002F\u002F Photo URL\n  language: 'language',\n  \n  \u002F\u002F ===== SPECIAL VALUES =====\n  off: 'off',                      \u002F\u002F Disable autofill (use sparingly!)\n  on: 'on'                         \u002F\u002F Enable autofill (default)\n} as const;\n\nexport type AutocompleteValue = typeof AUTOCOMPLETE[keyof typeof AUTOCOMPLETE];\n```\n\n### Critical Password Patterns\n\n```tsx\n\u002F\u002F ✅ LOGIN: Use current-password\n\u003Cform action=\"\u002Flogin\">\n  \u003Cinput type=\"email\" autoComplete=\"email\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"current-password\" \u002F>\n\u003C\u002Fform>\n\n\u002F\u002F ✅ REGISTRATION: Use new-password (BOTH fields)\n\u003Cform action=\"\u002Fregister\">\n  \u003Cinput type=\"email\" autoComplete=\"email\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F> {\u002F* confirm *\u002F}\n\u003C\u002Fform>\n\n\u002F\u002F ✅ PASSWORD RESET: Use new-password\n\u003Cform action=\"\u002Freset-password\">\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F> {\u002F* confirm *\u002F}\n\u003C\u002Fform>\n\n\u002F\u002F ✅ CHANGE PASSWORD: current + new\n\u003Cform action=\"\u002Fchange-password\">\n  \u003Cinput type=\"password\" autoComplete=\"current-password\" \u002F> {\u002F* old *\u002F}\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>     {\u002F* new *\u002F}\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>     {\u002F* confirm *\u002F}\n\u003C\u002Fform>\n\n\u002F\u002F ✅ 2FA\u002FOTP: Use one-time-code\n\u003Cform action=\"\u002Fverify-2fa\">\n  \u003Cinput \n    type=\"text\" \n    inputMode=\"numeric\" \n    autoComplete=\"one-time-code\" \n    pattern=\"[0-9]*\"\n  \u002F>\n\u003C\u002Fform>\n```\n\n### Why `new-password` for Registration\n\n```tsx\n\u002F\u002F ❌ WRONG: Using current-password on registration\n\u002F\u002F Password manager tries to fill EXISTING password\n\u003Cinput type=\"password\" autoComplete=\"current-password\" \u002F>\n\n\u002F\u002F ✅ CORRECT: Using new-password\n\u002F\u002F Password manager offers to GENERATE a new password\n\u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>\n```\n\n### Payment Form Pattern\n\n```tsx\n\u003Cform action=\"\u002Fcheckout\">\n  \u003Cinput \n    type=\"text\" \n    autoComplete=\"cc-name\" \n    placeholder=\"Name on card\"\n  \u002F>\n  \n  \u003Cinput \n    type=\"text\" \n    inputMode=\"numeric\"\n    autoComplete=\"cc-number\" \n    placeholder=\"Card number\"\n  \u002F>\n  \n  \u003Cinput \n    type=\"text\" \n    autoComplete=\"cc-exp\" \n    placeholder=\"MM\u002FYY\"\n  \u002F>\n  \n  \u003Cinput \n    type=\"text\" \n    inputMode=\"numeric\"\n    autoComplete=\"cc-csc\" \n    placeholder=\"CVV\"\n  \u002F>\n\u003C\u002Fform>\n```\n\n### Address Form Pattern\n\n```tsx\n\u003Cfieldset>\n  \u003Clegend>Shipping Address\u003C\u002Flegend>\n  \n  \u003Cinput autoComplete=\"name\" placeholder=\"Full name\" \u002F>\n  \u003Cinput autoComplete=\"address-line1\" placeholder=\"Street address\" \u002F>\n  \u003Cinput autoComplete=\"address-line2\" placeholder=\"Apt, Suite, etc.\" \u002F>\n  \u003Cinput autoComplete=\"address-level2\" placeholder=\"City\" \u002F>\n  \u003Cinput autoComplete=\"address-level1\" placeholder=\"State\" \u002F>\n  \u003Cinput autoComplete=\"postal-code\" placeholder=\"ZIP code\" \u002F>\n  \u003Cselect autoComplete=\"country\">\n    \u003Coption value=\"US\">United States\u003C\u002Foption>\n    {\u002F* ... *\u002F}\n  \u003C\u002Fselect>\n\u003C\u002Ffieldset>\n```\n\n## CSRF Protection\n\n### Token Generation (Server)\n\n```typescript\n\u002F\u002F server\u002Fcsrf.ts\nimport crypto from 'crypto';\n\nexport function generateCsrfToken(): string {\n  return crypto.randomBytes(32).toString('hex');\n}\n\n\u002F\u002F Store in session\napp.use((req, res, next) => {\n  if (!req.session.csrfToken) {\n    req.session.csrfToken = generateCsrfToken();\n  }\n  res.locals.csrfToken = req.session.csrfToken;\n  next();\n});\n```\n\n### Token Inclusion (Client)\n\n```tsx\n\u002F\u002F React pattern\nfunction Form({ csrfToken }) {\n  return (\n    \u003Cform method=\"POST\">\n      \u003Cinput type=\"hidden\" name=\"_csrf\" value={csrfToken} \u002F>\n      {\u002F* form fields *\u002F}\n    \u003C\u002Fform>\n  );\n}\n\n\u002F\u002F With fetch\nasync function submitForm(data: FormData) {\n  const response = await fetch('\u002Fapi\u002Fsubmit', {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application\u002Fjson',\n      'X-CSRF-Token': csrfToken\n    },\n    body: JSON.stringify(data)\n  });\n}\n```\n\n### Token Validation (Server)\n\n```typescript\n\u002F\u002F Middleware\nfunction validateCsrf(req, res, next) {\n  const tokenFromBody = req.body._csrf;\n  const tokenFromHeader = req.headers['x-csrf-token'];\n  const sessionToken = req.session.csrfToken;\n  \n  const providedToken = tokenFromBody || tokenFromHeader;\n  \n  if (!providedToken || providedToken !== sessionToken) {\n    return res.status(403).json({ error: 'Invalid CSRF token' });\n  }\n  \n  next();\n}\n\n\u002F\u002F Apply to state-changing routes\napp.post('\u002Fapi\u002F*', validateCsrf);\napp.put('\u002Fapi\u002F*', validateCsrf);\napp.delete('\u002Fapi\u002F*', validateCsrf);\n```\n\n### Double Submit Cookie Pattern\n\n```typescript\n\u002F\u002F Alternative: Cookie + Header must match\n\u002F\u002F Server sets cookie\nres.cookie('csrf', token, { httpOnly: false, sameSite: 'strict' });\n\n\u002F\u002F Client reads cookie and sends in header\nconst csrfToken = document.cookie\n  .split('; ')\n  .find(row => row.startsWith('csrf='))\n  ?.split('=')[1];\n\nfetch('\u002Fapi\u002Fsubmit', {\n  headers: { 'X-CSRF-Token': csrfToken }\n});\n\n\u002F\u002F Server validates cookie === header\n```\n\n## XSS Prevention\n\n### Never Trust User Input\n\n```typescript\n\u002F\u002F ❌ DANGEROUS: Directly rendering user input\n\u003Cdiv dangerouslySetInnerHTML={{ __html: userInput }} \u002F>\n\n\u002F\u002F ✅ SAFE: React auto-escapes by default\n\u003Cdiv>{userInput}\u003C\u002Fdiv>\n\n\u002F\u002F ✅ SAFE: Explicit sanitization when HTML needed\nimport DOMPurify from 'dompurify';\n\u003Cdiv dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} \u002F>\n```\n\n### Input Sanitization\n\n```typescript\n\u002F\u002F sanitize.ts\nimport DOMPurify from 'dompurify';\n\n\u002F\u002F For plain text (strip all HTML)\nexport function sanitizeText(input: string): string {\n  return DOMPurify.sanitize(input, { ALLOWED_TAGS: [] });\n}\n\n\u002F\u002F For rich text (allow safe HTML)\nexport function sanitizeHtml(input: string): string {\n  return DOMPurify.sanitize(input, {\n    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'br'],\n    ALLOWED_ATTR: ['href', 'title']\n  });\n}\n\n\u002F\u002F For URLs\nexport function sanitizeUrl(url: string): string {\n  const sanitized = DOMPurify.sanitize(url);\n  \u002F\u002F Only allow http(s) and relative URLs\n  if (\u002F^(https?:\\\u002F\\\u002F|\\\u002F[^\\\u002F])\u002Fi.test(sanitized)) {\n    return sanitized;\n  }\n  return '';\n}\n```\n\n### Content Security Policy\n\n```typescript\n\u002F\u002F Set CSP headers (Express)\napp.use((req, res, next) => {\n  res.setHeader(\n    'Content-Security-Policy',\n    \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'\"\n  );\n  next();\n});\n```\n\n## Password Field Security\n\n### Never Disable Paste\n\n```tsx\n\u002F\u002F ❌ DANGEROUS: Disabling paste\n\u003Cinput type=\"password\" onPaste={(e) => e.preventDefault()} \u002F>\n\n\u002F\u002F ✅ CORRECT: Allow paste (password managers need it!)\n\u003Cinput type=\"password\" \u002F>\n```\n\n### Password Visibility Toggle\n\n```tsx\nfunction PasswordInput({ ...props }) {\n  const [visible, setVisible] = useState(false);\n  \n  return (\n    \u003Cdiv className=\"password-input\">\n      \u003Cinput\n        type={visible ? 'text' : 'password'}\n        {...props}\n      \u002F>\n      \u003Cbutton\n        type=\"button\"\n        onClick={() => setVisible(!visible)}\n        aria-label={visible ? 'Hide password' : 'Show password'}\n      >\n        {visible ? \u003CEyeOffIcon \u002F> : \u003CEyeIcon \u002F>}\n      \u003C\u002Fbutton>\n    \u003C\u002Fdiv>\n  );\n}\n```\n\n### Don't Log Passwords\n\n```typescript\n\u002F\u002F ❌ DANGEROUS\nconsole.log('Login attempt:', { email, password });\n\n\u002F\u002F ✅ SAFE\nconsole.log('Login attempt:', { email, password: '[REDACTED]' });\n```\n\n## Secure Form Submission\n\n### HTTPS Only\n\n```typescript\n\u002F\u002F Redirect HTTP to HTTPS\napp.use((req, res, next) => {\n  if (req.headers['x-forwarded-proto'] !== 'https') {\n    return res.redirect(`https:\u002F\u002F${req.headers.host}${req.url}`);\n  }\n  next();\n});\n```\n\n### Secure Cookies\n\n```typescript\n\u002F\u002F Set secure cookie flags\nres.cookie('session', sessionId, {\n  httpOnly: true,     \u002F\u002F Prevent XSS access\n  secure: true,       \u002F\u002F HTTPS only\n  sameSite: 'strict', \u002F\u002F CSRF protection\n  maxAge: 3600000     \u002F\u002F 1 hour\n});\n```\n\n### Rate Limiting\n\n```typescript\nimport rateLimit from 'express-rate-limit';\n\nconst loginLimiter = rateLimit({\n  windowMs: 15 * 60 * 1000, \u002F\u002F 15 minutes\n  max: 5, \u002F\u002F 5 attempts\n  message: 'Too many login attempts. Please try again later.'\n});\n\napp.post('\u002Flogin', loginLimiter, handleLogin);\n```\n\n## Security Checklist\n\n### Authentication Forms\n\n- [ ] `autocomplete=\"email\"` on email field\n- [ ] `autocomplete=\"current-password\"` on login password\n- [ ] `autocomplete=\"new-password\"` on registration\u002Freset password\n- [ ] `autocomplete=\"one-time-code\"` on 2FA field\n- [ ] Paste is allowed on all password fields\n- [ ] CSRF token included\n- [ ] Rate limiting enabled\n- [ ] HTTPS enforced\n\n### Payment Forms\n\n- [ ] `autocomplete=\"cc-*\"` attributes on all card fields\n- [ ] `inputMode=\"numeric\"` on number fields\n- [ ] CSRF token included\n- [ ] PCI DSS compliance (use Stripe\u002FBraintree)\n- [ ] No card data logged\n\n### All Forms\n\n- [ ] Input validation (client + server)\n- [ ] Output encoding (XSS prevention)\n- [ ] Error messages don't leak sensitive info\n- [ ] Secure cookie settings\n- [ ] CSP headers configured\n\n## File Structure\n\n```\nform-security\u002F\n├── SKILL.md\n├── references\u002F\n│   ├── autocomplete-spec.md    # Full autocomplete reference\n│   └── csrf-patterns.md        # CSRF implementation patterns\n└── scripts\u002F\n    ├── autocomplete-config.ts  # Autocomplete constants\n    ├── csrf-token.ts           # CSRF token utilities\n    ├── sanitize.ts             # Input sanitization\n    └── secure-input.tsx        # Secure input components\n```\n\n## Reference\n\n- `references\u002Fautocomplete-spec.md` — Complete autocomplete attribute reference\n- `references\u002Fcsrf-patterns.md` — CSRF implementation patterns\n","# Form Security\n\nSecurity-first patterns for web forms. Ensures password manager compatibility, prevents common attacks, and protects user data.\n\n## Quick Start\n\n```tsx\n\u002F\u002F The 3 critical security patterns\n\u003Cform>\n  {\u002F* 1. Autocomplete for password managers *\u002F}\n  \u003Cinput type=\"email\" autoComplete=\"email\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"current-password\" \u002F>\n  \n  {\u002F* 2. CSRF token *\u002F}\n  \u003Cinput type=\"hidden\" name=\"_csrf\" value={csrfToken} \u002F>\n  \n  {\u002F* 3. Allow paste (never disable!) *\u002F}\n  \u003Cinput type=\"password\" \u002F> {\u002F* No onPaste handler blocking *\u002F}\n\u003C\u002Fform>\n```\n\n## Autocomplete Attributes\n\n### Why It Matters\n\n- **1Password, LastPass, Bitwarden** rely on `autocomplete` to identify fields\n- Without correct values, password managers fail silently\n- Users abandon forms when autofill doesn't work\n- Security improves when users can use unique, strong passwords\n\n### The Autocomplete Specification\n\n```typescript\n\u002F\u002F autocomplete-config.ts\nexport const AUTOCOMPLETE = {\n  \u002F\u002F ===== IDENTITY =====\n  name: 'name',                    \u002F\u002F Full name\n  honorificPrefix: 'honorific-prefix', \u002F\u002F Mr., Mrs., Dr.\n  givenName: 'given-name',         \u002F\u002F First name\n  additionalName: 'additional-name', \u002F\u002F Middle name\n  familyName: 'family-name',       \u002F\u002F Last name\n  honorificSuffix: 'honorific-suffix', \u002F\u002F Jr., III\n  nickname: 'nickname',\n  \n  \u002F\u002F ===== AUTHENTICATION (CRITICAL) =====\n  email: 'email',\n  username: 'username',\n  currentPassword: 'current-password',  \u002F\u002F LOGIN forms\n  newPassword: 'new-password',          \u002F\u002F REGISTRATION + RESET forms\n  oneTimeCode: 'one-time-code',         \u002F\u002F 2FA\u002FOTP codes\n  \n  \u002F\u002F ===== CONTACT =====\n  tel: 'tel',                      \u002F\u002F Full phone\n  telCountryCode: 'tel-country-code',\n  telNational: 'tel-national',\n  telAreaCode: 'tel-area-code',\n  telLocal: 'tel-local',\n  telExtension: 'tel-extension',\n  \n  \u002F\u002F ===== ADDRESS =====\n  streetAddress: 'street-address', \u002F\u002F Full street (may be multiline)\n  addressLine1: 'address-line1',   \u002F\u002F Street line 1\n  addressLine2: 'address-line2',   \u002F\u002F Apt, Suite, etc.\n  addressLine3: 'address-line3',\n  addressLevel1: 'address-level1', \u002F\u002F State\u002FProvince\n  addressLevel2: 'address-level2', \u002F\u002F City\n  addressLevel3: 'address-level3', \u002F\u002F District\n  addressLevel4: 'address-level4', \u002F\u002F Neighborhood\n  postalCode: 'postal-code',\n  country: 'country',\n  countryName: 'country-name',\n  \n  \u002F\u002F ===== PAYMENT (CRITICAL) =====\n  ccName: 'cc-name',               \u002F\u002F Name on card\n  ccGivenName: 'cc-given-name',\n  ccFamilyName: 'cc-family-name',\n  ccNumber: 'cc-number',           \u002F\u002F Card number\n  ccExp: 'cc-exp',                 \u002F\u002F Expiry (MM\u002FYY)\n  ccExpMonth: 'cc-exp-month',      \u002F\u002F Expiry month\n  ccExpYear: 'cc-exp-year',        \u002F\u002F Expiry year\n  ccCsc: 'cc-csc',                 \u002F\u002F CVV\u002FCVC\n  ccType: 'cc-type',               \u002F\u002F Visa, Mastercard, etc.\n  \n  \u002F\u002F ===== ORGANIZATION =====\n  organization: 'organization',\n  organizationTitle: 'organization-title', \u002F\u002F Job title\n  \n  \u002F\u002F ===== DATES =====\n  bday: 'bday',                    \u002F\u002F Full birthday\n  bdayDay: 'bday-day',\n  bdayMonth: 'bday-month',\n  bdayYear: 'bday-year',\n  \n  \u002F\u002F ===== OTHER =====\n  sex: 'sex',                      \u002F\u002F Gender\n  url: 'url',                      \u002F\u002F Website\n  photo: 'photo',                  \u002F\u002F Photo URL\n  language: 'language',\n  \n  \u002F\u002F ===== SPECIAL VALUES =====\n  off: 'off',                      \u002F\u002F Disable autofill (use sparingly!)\n  on: 'on'                         \u002F\u002F Enable autofill (default)\n} as const;\n\nexport type AutocompleteValue = typeof AUTOCOMPLETE[keyof typeof AUTOCOMPLETE];\n```\n\n### Critical Password Patterns\n\n```tsx\n\u002F\u002F ✅ LOGIN: Use current-password\n\u003Cform action=\"\u002Flogin\">\n  \u003Cinput type=\"email\" autoComplete=\"email\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"current-password\" \u002F>\n\u003C\u002Fform>\n\n\u002F\u002F ✅ REGISTRATION: Use new-password (BOTH fields)\n\u003Cform action=\"\u002Fregister\">\n  \u003Cinput type=\"email\" autoComplete=\"email\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F> {\u002F* confirm *\u002F}\n\u003C\u002Fform>\n\n\u002F\u002F ✅ PASSWORD RESET: Use new-password\n\u003Cform action=\"\u002Freset-password\">\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F> {\u002F* confirm *\u002F}\n\u003C\u002Fform>\n\n\u002F\u002F ✅ CHANGE PASSWORD: current + new\n\u003Cform action=\"\u002Fchange-password\">\n  \u003Cinput type=\"password\" autoComplete=\"current-password\" \u002F> {\u002F* old *\u002F}\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>     {\u002F* new *\u002F}\n  \u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>     {\u002F* confirm *\u002F}\n\u003C\u002Fform>\n\n\u002F\u002F ✅ 2FA\u002FOTP: Use one-time-code\n\u003Cform action=\"\u002Fverify-2fa\">\n  \u003Cinput \n    type=\"text\" \n    inputMode=\"numeric\" \n    autoComplete=\"one-time-code\" \n    pattern=\"[0-9]*\"\n  \u002F>\n\u003C\u002Fform>\n```\n\n### Why `new-password` for Registration\n\n```tsx\n\u002F\u002F ❌ WRONG: Using current-password on registration\n\u002F\u002F Password manager tries to fill EXISTING password\n\u003Cinput type=\"password\" autoComplete=\"current-password\" \u002F>\n\n\u002F\u002F ✅ CORRECT: Using new-password\n\u002F\u002F Password manager offers to GENERATE a new password\n\u003Cinput type=\"password\" autoComplete=\"new-password\" \u002F>\n```\n\n### Payment Form Pattern\n\n```tsx\n\u003Cform action=\"\u002Fcheckout\">\n  \u003Cinput \n    type=\"text\" \n    autoComplete=\"cc-name\" \n    placeholder=\"Name on card\"\n  \u002F>\n  \n  \u003Cinput \n    type=\"text\" \n    inputMode=\"numeric\"\n    autoComplete=\"cc-number\" \n    placeholder=\"Card number\"\n  \u002F>\n  \n  \u003Cinput \n    type=\"text\" \n    autoComplete=\"cc-exp\" \n    placeholder=\"MM\u002FYY\"\n  \u002F>\n  \n  \u003Cinput \n    type=\"text\" \n    inputMode=\"numeric\"\n    autoComplete=\"cc-csc\" \n    placeholder=\"CVV\"\n  \u002F>\n\u003C\u002Fform>\n```\n\n### Address Form Pattern\n\n```tsx\n\u003Cfieldset>\n  \u003Clegend>Shipping Address\u003C\u002Flegend>\n  \n  \u003Cinput autoComplete=\"name\" placeholder=\"Full name\" \u002F>\n  \u003Cinput autoComplete=\"address-line1\" placeholder=\"Street address\" \u002F>\n  \u003Cinput autoComplete=\"address-line2\" placeholder=\"Apt, Suite, etc.\" \u002F>\n  \u003Cinput autoComplete=\"address-level2\" placeholder=\"City\" \u002F>\n  \u003Cinput autoComplete=\"address-level1\" placeholder=\"State\" \u002F>\n  \u003Cinput autoComplete=\"postal-code\" placeholder=\"ZIP code\" \u002F>\n  \u003Cselect autoComplete=\"country\">\n    \u003Coption value=\"US\">United States\u003C\u002Foption>\n    {\u002F* ... *\u002F}\n  \u003C\u002Fselect>\n\u003C\u002Ffieldset>\n```\n\n## CSRF Protection\n\n### Token Generation (Server)\n\n```typescript\n\u002F\u002F server\u002Fcsrf.ts\nimport crypto from 'crypto';\n\nexport function generateCsrfToken(): string {\n  return crypto.randomBytes(32).toString('hex');\n}\n\n\u002F\u002F Store in session\napp.use((req, res, next) => {\n  if (!req.session.csrfToken) {\n    req.session.csrfToken = generateCsrfToken();\n  }\n  res.locals.csrfToken = req.session.csrfToken;\n  next();\n});\n```\n\n### Token Inclusion (Client)\n\n```tsx\n\u002F\u002F React pattern\nfunction Form({ csrfToken }) {\n  return (\n    \u003Cform method=\"POST\">\n      \u003Cinput type=\"hidden\" name=\"_csrf\" value={csrfToken} \u002F>\n      {\u002F* form fields *\u002F}\n    \u003C\u002Fform>\n  );\n}\n\n\u002F\u002F With fetch\nasync function submitForm(data: FormData) {\n  const response = await fetch('\u002Fapi\u002Fsubmit', {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application\u002Fjson',\n      'X-CSRF-Token': csrfToken\n    },\n    body: JSON.stringify(data)\n  });\n}\n```\n\n### Token Validation (Server)\n\n```typescript\n\u002F\u002F Middleware\nfunction validateCsrf(req, res, next) {\n  const tokenFromBody = req.body._csrf;\n  const tokenFromHeader = req.headers['x-csrf-token'];\n  const sessionToken = req.session.csrfToken;\n  \n  const providedToken = tokenFromBody || tokenFromHeader;\n  \n  if (!providedToken || providedToken !== sessionToken) {\n    return res.status(403).json({ error: 'Invalid CSRF token' });\n  }\n  \n  next();\n}\n\n\u002F\u002F Apply to state-changing routes\napp.post('\u002Fapi\u002F*', validateCsrf);\napp.put('\u002Fapi\u002F*', validateCsrf);\napp.delete('\u002Fapi\u002F*', validateCsrf);\n```\n\n### Double Submit Cookie Pattern\n\n```typescript\n\u002F\u002F Alternative: Cookie + Header must match\n\u002F\u002F Server sets cookie\nres.cookie('csrf', token, { httpOnly: false, sameSite: 'strict' });\n\n\u002F\u002F Client reads cookie and sends in header\nconst csrfToken = document.cookie\n  .split('; ')\n  .find(row => row.startsWith('csrf='))\n  ?.split('=')[1];\n\nfetch('\u002Fapi\u002Fsubmit', {\n  headers: { 'X-CSRF-Token': csrfToken }\n});\n\n\u002F\u002F Server validates cookie === header\n```\n\n## XSS Prevention\n\n### Never Trust User Input\n\n```typescript\n\u002F\u002F ❌ DANGEROUS: Directly rendering user input\n\u003Cdiv dangerouslySetInnerHTML={{ __html: userInput }} \u002F>\n\n\u002F\u002F ✅ SAFE: React auto-escapes by default\n\u003Cdiv>{userInput}\u003C\u002Fdiv>\n\n\u002F\u002F ✅ SAFE: Explicit sanitization when HTML needed\nimport DOMPurify from 'dompurify';\n\u003Cdiv dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} \u002F>\n```\n\n### Input Sanitization\n\n```typescript\n\u002F\u002F sanitize.ts\nimport DOMPurify from 'dompurify';\n\n\u002F\u002F For plain text (strip all HTML)\nexport function sanitizeText(input: string): string {\n  return DOMPurify.sanitize(input, { ALLOWED_TAGS: [] });\n}\n\n\u002F\u002F For rich text (allow safe HTML)\nexport function sanitizeHtml(input: string): string {\n  return DOMPurify.sanitize(input, {\n    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'br'],\n    ALLOWED_ATTR: ['href', 'title']\n  });\n}\n\n\u002F\u002F For URLs\nexport function sanitizeUrl(url: string): string {\n  const sanitized = DOMPurify.sanitize(url);\n  \u002F\u002F Only allow http(s) and relative URLs\n  if (\u002F^(https?:\\\u002F\\\u002F|\\\u002F[^\\\u002F])\u002Fi.test(sanitized)) {\n    return sanitized;\n  }\n  return '';\n}\n```\n\n### Content Security Policy\n\n```typescript\n\u002F\u002F Set CSP headers (Express)\napp.use((req, res, next) => {\n  res.setHeader(\n    'Content-Security-Policy',\n    \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'\"\n  );\n  next();\n});\n```\n\n## Password Field Security\n\n### Never Disable Paste\n\n```tsx\n\u002F\u002F ❌ DANGEROUS: Disabling paste\n\u003Cinput type=\"password\" onPaste={(e) => e.preventDefault()} \u002F>\n\n\u002F\u002F ✅ CORRECT: Allow paste (password managers need it!)\n\u003Cinput type=\"password\" \u002F>\n```\n\n### Password Visibility Toggle\n\n```tsx\nfunction PasswordInput({ ...props }) {\n  const [visible, setVisible] = useState(false);\n  \n  return (\n    \u003Cdiv className=\"password-input\">\n      \u003Cinput\n        type={visible ? 'text' : 'password'}\n        {...props}\n      \u002F>\n      \u003Cbutton\n        type=\"button\"\n        onClick={() => setVisible(!visible)}\n        aria-label={visible ? 'Hide password' : 'Show password'}\n      >\n        {visible ? \u003CEyeOffIcon \u002F> : \u003CEyeIcon \u002F>}\n      \u003C\u002Fbutton>\n    \u003C\u002Fdiv>\n  );\n}\n```\n\n### Don't Log Passwords\n\n```typescript\n\u002F\u002F ❌ DANGEROUS\nconsole.log('Login attempt:', { email, password });\n\n\u002F\u002F ✅ SAFE\nconsole.log('Login attempt:', { email, password: '[REDACTED]' });\n```\n\n## Secure Form Submission\n\n### HTTPS Only\n\n```typescript\n\u002F\u002F Redirect HTTP to HTTPS\napp.use((req, res, next) => {\n  if (req.headers['x-forwarded-proto'] !== 'https') {\n    return res.redirect(`https:\u002F\u002F${req.headers.host}${req.url}`);\n  }\n  next();\n});\n```\n\n### Secure Cookies\n\n```typescript\n\u002F\u002F Set secure cookie flags\nres.cookie('session', sessionId, {\n  httpOnly: true,     \u002F\u002F Prevent XSS access\n  secure: true,       \u002F\u002F HTTPS only\n  sameSite: 'strict', \u002F\u002F CSRF protection\n  maxAge: 3600000     \u002F\u002F 1 hour\n});\n```\n\n### Rate Limiting\n\n```typescript\nimport rateLimit from 'express-rate-limit';\n\nconst loginLimiter = rateLimit({\n  windowMs: 15 * 60 * 1000, \u002F\u002F 15 minutes\n  max: 5, \u002F\u002F 5 attempts\n  message: 'Too many login attempts. Please try again later.'\n});\n\napp.post('\u002Flogin', loginLimiter, handleLogin);\n```\n\n## Security Checklist\n\n### Authentication Forms\n\n- [ ] `autocomplete=\"email\"` on email field\n- [ ] `autocomplete=\"current-password\"` on login password\n- [ ] `autocomplete=\"new-password\"` on registration\u002Freset password\n- [ ] `autocomplete=\"one-time-code\"` on 2FA field\n- [ ] Paste is allowed on all password fields\n- [ ] CSRF token included\n- [ ] Rate limiting enabled\n- [ ] HTTPS enforced\n\n### Payment Forms\n\n- [ ] `autocomplete=\"cc-*\"` attributes on all card fields\n- [ ] `inputMode=\"numeric\"` on number fields\n- [ ] CSRF token included\n- [ ] PCI DSS compliance (use Stripe\u002FBraintree)\n- [ ] No card data logged\n\n### All Forms\n\n- [ ] Input validation (client + server)\n- [ ] Output encoding (XSS prevention)\n- [ ] Error messages don't leak sensitive info\n- [ ] Secure cookie settings\n- [ ] CSP headers configured\n\n## File Structure\n\n```\nform-security\u002F\n├── SKILL.md\n├── references\u002F\n│   ├── autocomplete-spec.md    # Full autocomplete reference\n│   └── csrf-patterns.md        # CSRF implementation patterns\n└── scripts\u002F\n    ├── autocomplete-config.ts  # Autocomplete constants\n    ├── csrf-token.ts           # CSRF token utilities\n    ├── sanitize.ts             # Input sanitization\n    └── secure-input.tsx        # Secure input components\n```\n\n## Reference\n\n- `references\u002Fautocomplete-spec.md` — Complete autocomplete attribute reference\n- `references\u002Fcsrf-patterns.md` — CSRF implementation patterns\n",{"name":5,"description":7},"main","f2ec4b3b9133d34eeaf9b38e4b0a97e8e5705a7f","benchmarks\u002Ffinal\u002Fskills\u002Fasset1__bbeierle12--form-security",0,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard","https:\u002F\u002Fgithub.com\u002FJSGforever","2026-08-29 18:27:56",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add JSGforever\u002Fskillguard --skill form-security",{"tool":56,"command":57},"bunx","bunx skills add JSGforever\u002Fskillguard --skill form-security",{"tool":59,"command":60},"pnpm","pnpm dlx skills add JSGforever\u002Fskillguard --skill form-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__bbeierle12--form-security\u002FSKILL.md",true,[64,70],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"_meta.json","REFERENCE","参考文档",456,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__bbeierle12--form-security\u002F_meta.json",{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"scripts\u002Fautocomplete-config.ts","SCRIPT","脚本",11726,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__bbeierle12--form-security\u002Fscripts\u002Fautocomplete-config.ts",[77,108,123,150,172,193],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":88,"publishedAt":38},"01M71HY2SNXBA9Q00WZDTZQ31Z","skillguard-codex-scanner","Hybrid deterministic+LLM agent-skill security scanner. Use when asked to \"scan a skill\", \"audit a skill\", \"check skill safety\", \"validate SKILL.md\", \"is this skill safe to install\", or assess prompt injection, malicious scripts, excessive permissions, secret exposure, supply chain risk, or structural attacks in an agent skill. Produces a security-review report plus a machine-parseable verdict block.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fsrc\u002Fskillguard\u002Fstatic_scanner\u002Fskillguard-codex-scanner\u002FSKILL.md",[83],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[89,90,91,92,93,94,95,96,97,98,99,100,32,101,102,103,104,105,106,107],"scanner","skillguard codex scanner","skillguard","codex","chain","skill security","security-review","review report","structural","secret","prompt injection","security scanner","review","malicious","permissions","exposure","audit","scripts","safe",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":120,"publishedAt":38},"01M71HY0SPKTT3S27BC2HPAC5M","data-exfiltrator","Analyzes data files","MIT","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Fsmoke-one-skill\u002Fasset1__cisco-ai-defense--data-exfiltrator\u002FSKILL.md",[115],{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[27,121,122],"data exfiltrator","files",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":38},"01M71HXVS9EMN44BGDW215FZ72","real-time-collaboration-engine","Build real-time collaborative editing with WebSockets, OT\u002FCRDT conflict resolution, and presence awareness. Implements cursor tracking, optimistic updates, and offline sync. Use for collaborative editors, whiteboards, video editing. Activate on \"real-time collaboration\", \"WebSocket sync\", \"multiplayer editing\", \"CRDT\", \"presence awareness\". NOT for simple chat, request-response APIs, or single-user apps.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--real-time-collaboration-engine\u002FSKILL.md",[],[130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],"time","real time collaboration engine","real time collaboration","collaboration","engine","real time","Video","reliability","video editing","performance","conflict resolution","presence","access","apps","updates","Bash","activate","optimizer","react","streaming",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":159,"publishedAt":38},"01M71HXP6CTY4KFN0QVMMN0V7J","react-performance-optimizer","Optimize React apps for 60fps performance. Implements memoization, virtualization, code splitting, bundle optimization. Use for slow renders, large lists, bundle bloat. Activate on \"React performance\", \"slow render\", \"useMemo\", \"bundle size\", \"virtualization\". NOT for backend optimization, non-React frameworks, or premature optimization.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--react-performance-optimizer\u002FSKILL.md",[156],{"categoryNo":157,"categoryName":158,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000009","前端开发",[139,160,147,148,161,162,163,164,165,166,130,167,168,143,145,169,146,149,170,171],"react performance optimizer","react performance","performance optimizer","app","nextjs","expert","re","render","2025","code","router","strategies",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":179,"publishedAt":38},"01M71HXH7QXSQB4QTDZ7SP7YXQ","llm-streaming-response-handler","Build production LLM streaming UIs with Server-Sent Events, real-time token display, cancellation, error recovery. Handles OpenAI\u002FAnthropic\u002FClaude streaming APIs. Use for chatbots, AI assistants, real-time text generation. Activate on \"LLM streaming\", \"SSE\", \"token stream\", \"chat UI\", \"real-time AI\". NOT for batch processing, non-streaming APIs, or WebSocket bidirectional chat.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--llm-streaming-response-handler\u002FSKILL.md",[178],{"categoryNo":157,"categoryName":158,"taxonomyType":86,"taxonomyTypeDesc":87},[180,149,181,182,183,184,139,130,185,186,187,145,146,147,188,148,189,190,191,192],"llm streaming response handler","handler","error","processing","retry","chat ui","error recovery","critical","batch","display","text","server","read",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":206,"publishedAt":38},"01M71HXCB0E1YRKYW1Y8T0Y106","github-actions-pipeline-builder","Build production CI\u002FCD pipelines with GitHub Actions. Implements matrix builds, caching, deployments, testing, security scanning. Use for automated testing, deployments, release workflows. Activate on \"GitHub Actions\", \"CI\u002FCD\", \"workflow\", \"deployment pipeline\", \"automated testing\". NOT for Jenkins\u002FCircleCI, manual deployments, or non-GitHub repositories.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--github-actions-pipeline-builder\u002FSKILL.md",[199,202,205],{"categoryNo":200,"categoryName":201,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":203,"categoryName":204,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},[207,208,209,210,211,212,213,137,165,214,215,216,146,171,217,192,218,219,220,221],"github actions pipeline builder","actions","github actions","pipeline builder","github","builder","pipeline","testing","ci","workflows","run","release","write","edit","git"]