[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71HNMC1S58QEXDF3RWNTNKM":3,"skill-same:01M71HNMC1S58QEXDF3RWNTNKM":278},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":27,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":61,"install":62,"resources":75},"01M71HNMC1S58QEXDF3RWNTNKM","code-quality-audit",null,"Use when checking code quality, running security audits, testing coverage, finding violations, or setting up quality tools - supports Drupal (PHPStan, PHPMD, PHPCPD, Psalm, Semgrep, Trivy, Gitleaks via DDEV) and Next.js (ESLint, Jest, jscpd, madge, Semgrep, Trivy, Gitleaks) projects with TDD, SOLID, DRY, and OWASP security checks","JSGforever\u002Fskillguard","JSGforever","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F85541948?v=4","01M71FQD3E132VMR5F4TAYX3YS","01M71FQD4DYW0XJ4XQ4YQH75Y9",2,"GPL-3.0","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"audit","code quality audit","code quality","quality","quality audit","code","Tools","owasp security","security","owasp","gitleaks","semgrep","next","dry","jest","when","up","testing","projects","coverage","2026-11-10 10:12:30",false,"---\nname: code-quality-audit\ndescription: Use when checking code quality, running security audits, testing coverage, finding violations, or setting up quality tools - supports Drupal (PHPStan, PHPMD, PHPCPD, Psalm, Semgrep, Trivy, Gitleaks via DDEV) and Next.js (ESLint, Jest, jscpd, madge, Semgrep, Trivy, Gitleaks) projects with TDD, SOLID, DRY, and OWASP security checks\nversion: 2.5.0\nmodel: sonnet\n---\n\n# Code Quality Audit\n\nRun quality and security audits for **Drupal** and **Next.js** projects with consistent tooling and reporting.\n\n## Quick Commands\n\n**For direct access, use these commands:**\n- `\u002Fcode-quality:setup` - First-time setup wizard (install and configure tools)\n- `\u002Fcode-quality:audit` - Run full audit (all 22 operations)\n- `\u002Fcode-quality:coverage` - Check test coverage\n- `\u002Fcode-quality:security` - Security scan (10 layers for Drupal, 7 for Next.js)\n- `\u002Fcode-quality:lint` - Code standards check\n- `\u002Fcode-quality:solid` - Architecture and SOLID principles check\n- `\u002Fcode-quality:dry` - Find code duplication\n- `\u002Fcode-quality:tdd` - Start TDD workflow (test watcher mode)\n\n**For conversational workflows, continue reading...**\n\n## When to Use\n\n**Drupal projects:**\n- \"Setup quality tools\" \u002F \"Install PHPStan\"\n- \"Run code audit\" \u002F \"Check code quality\"\n- \"Check coverage\" \u002F \"What's my coverage?\"\n- \"Find SOLID violations\" \u002F \"Check complexity\"\n- \"Check duplication\" \u002F \"DRY check\"\n- \"Lint code\" \u002F \"Check coding standards\"\n- \"Fix deprecations\" \u002F \"Run rector\"\n- \"Start TDD\" \u002F \"RED-GREEN-REFACTOR\"\n- \"Check security\" \u002F \"Find vulnerabilities\" \u002F \"OWASP audit\"\n\n**Next.js projects:**\n- \"Setup quality tools\" \u002F \"Install ESLint\"\n- \"Run code audit\" \u002F \"Check code quality\"\n- \"Check coverage\" \u002F \"Run Jest coverage\"\n- \"Find SOLID violations\" \u002F \"Check complexity\" \u002F \"Check circular deps\"\n- \"Lint code\" \u002F \"Run ESLint\"\n- \"Check duplication\" \u002F \"DRY check\"\n- \"Start TDD\" \u002F \"Jest watch mode\"\n- \"Check security\" \u002F \"Find vulnerabilities\" \u002F \"OWASP audit\"\n\n## Quick Reference\n\n### Drupal Scripts\n| Task | Script | Details |\n|------|--------|---------|\n| Setup tools | `scripts\u002Fcore\u002Finstall-tools.sh` | See [Drupal Setup](references\u002Foperations\u002Fdrupal-setup.md#operation-1-setup-tools) |\n| Full audit | `scripts\u002Fcore\u002Ffull-audit.sh` | See [Full Audit](references\u002Foperations\u002Fdrupal-audits.md#operation-2-full-audit) |\n| Coverage | `scripts\u002Fdrupal\u002Fcoverage-report.sh` | See [Coverage Check](references\u002Foperations\u002Fdrupal-audits.md#operation-3-coverage-check) |\n| SOLID check | `scripts\u002Fdrupal\u002Fsolid-check.sh` | See [SOLID Check](references\u002Foperations\u002Fdrupal-audits.md#operation-4-solid-check) |\n| DRY check | `scripts\u002Fdrupal\u002Fdry-check.sh` | See [DRY Check](references\u002Foperations\u002Fdrupal-audits.md#operation-5-dry-check) |\n| Lint check | `scripts\u002Fdrupal\u002Flint-check.sh` | See [Lint Check](references\u002Foperations\u002Fdrupal-audits.md#operation-11-lint-check) |\n| Fix deprecations | `scripts\u002Fdrupal\u002Frector-fix.sh` | See [Rector Fix](references\u002Foperations\u002Fdrupal-audits.md#operation-12-rector-fix) |\n| TDD cycle | `scripts\u002Fdrupal\u002Ftdd-workflow.sh` | See [TDD Workflow](references\u002Foperations\u002Fdrupal-tdd.md) |\n| Security audit | `scripts\u002Fdrupal\u002Fsecurity-check.sh` | See [Security Audit](references\u002Foperations\u002Fdrupal-security.md) (10 layers) |\n\n### Next.js Scripts\n| Task | Script | Details |\n|------|--------|---------|\n| Setup tools | `scripts\u002Fcore\u002Finstall-tools.sh` | See [Next.js Setup](references\u002Foperations\u002Fnextjs-setup.md) |\n| Full audit | `scripts\u002Fcore\u002Ffull-audit.sh` | See [Full Audit](references\u002Foperations\u002Fnextjs-audits.md#operation-14-full-audit) |\n| Coverage | `scripts\u002Fnextjs\u002Fcoverage-report.sh` | See [Coverage Check](references\u002Foperations\u002Fnextjs-audits.md#operation-16-coverage-check) |\n| SOLID check | `scripts\u002Fnextjs\u002Fsolid-check.sh` | See [SOLID Check](references\u002Foperations\u002Fnextjs-audits.md#operation-19-solid-check) |\n| Lint check | `scripts\u002Fnextjs\u002Flint-check.sh` | See [Lint Check](references\u002Foperations\u002Fnextjs-audits.md#operation-15-lint-check) |\n| DRY check | `scripts\u002Fnextjs\u002Fdry-check.sh` | See [DRY Check](references\u002Foperations\u002Fnextjs-audits.md#operation-17-dry-check) |\n| TDD cycle | `scripts\u002Fnextjs\u002Ftdd-workflow.sh` | See [TDD Workflow](references\u002Foperations\u002Fnextjs-tdd.md) |\n| Security audit | `scripts\u002Fnextjs\u002Fsecurity-check.sh` | See [Security Audit](references\u002Foperations\u002Fnextjs-security.md) (7 layers) |\n\n## Before Any Operation\n\n**Drupal:**\n1. Locate Drupal root: check `web\u002Fcore\u002Flib\u002FDrupal.php` or `docroot\u002Fcore\u002Flib\u002FDrupal.php`\n2. Verify DDEV: `ddev describe`\n3. Create reports directory: `mkdir -p .reports && echo \".reports\u002F\" >> .gitignore`\n\n**Next.js:**\n1. Verify npm: `npm --version`\n2. Create reports directory: `mkdir -p .reports && echo \".reports\u002F\" >> .gitignore`\n\n## When to Run What\n\nRead `decision-guides\u002Fquality-audit-checklist.md` for detailed guidance.\n\n| Context | What to Run | Time |\n|---------|-------------|------|\n| Pre-commit | `quality:cs` only | ~5s |\n| Pre-push | PHPStan + Unit\u002FKernel tests | ~2min |\n| Pre-merge | Full audit | ~10min |\n| Weekly | Full audit + HTML reports | ~15min |\n\n## Scope Targeting\n\nTo audit specific modules or components instead of the entire project:\n\n**See [Scope Targeting](references\u002Fscope-targeting.md)** for three approaches:\n1. **Change directory** (recommended) - `cd web\u002Fmodules\u002Fcustom\u002Fmy_module`\n2. **Environment variables** - `DRUPAL_MODULES_PATH=path\u002Fto\u002Fmodule`\n3. **Full scan** (default) - Run from project root\n\nIntelligent detection: Claude detects current directory and user intent.\n\n---\n\n# Operations\n\nAll detailed operation instructions have been moved to reference files for better organization.\n\n## Drupal Operations\n\n### Setup & Configuration\n- **Operation 1:** [Setup Tools](references\u002Foperations\u002Fdrupal-setup.md#operation-1-setup-tools) - Install PHPStan, PHPMD, PHPCPD, Coder\n- **Operation 6:** [Module-Specific Audit](references\u002Foperations\u002Fdrupal-setup.md#operation-6-module-specific-audit) - Scope audit to one module\n- **Operation 7:** [Add Composer Scripts](references\u002Foperations\u002Fdrupal-setup.md#operation-7-add-composer-scripts) - Configure quality scripts\n- **Operation 8:** [CI Integration](references\u002Foperations\u002Fdrupal-setup.md#operation-8-ci-integration) - Setup GitHub Actions\n\n### Quality Audits\n- **Operation 2:** [Full Audit](references\u002Foperations\u002Fdrupal-audits.md#operation-2-full-audit) - Run all quality checks\n- **Operation 3:** [Coverage Check](references\u002Foperations\u002Fdrupal-audits.md#operation-3-coverage-check) - Measure test coverage\n- **Operation 4:** [SOLID Check](references\u002Foperations\u002Fdrupal-audits.md#operation-4-solid-check) - Find principle violations\n- **Operation 5:** [DRY Check](references\u002Foperations\u002Fdrupal-audits.md#operation-5-dry-check) - Detect code duplication\n- **Operation 11:** [Lint Check](references\u002Foperations\u002Fdrupal-audits.md#operation-11-lint-check) - Coding standards\n- **Operation 12:** [Rector Fix](references\u002Foperations\u002Fdrupal-audits.md#operation-12-rector-fix) - Auto-fix deprecations\n\n### Development Workflows\n- **Operation 10:** [TDD Workflow](references\u002Foperations\u002Fdrupal-tdd.md) - RED-GREEN-REFACTOR cycle\n\n### Security\n- **Operation 20:** [Security Audit](references\u002Foperations\u002Fdrupal-security.md) - **10 security layers (v2.0.0)**\n  - Drush pm:security, Composer audit\n  - yousha\u002Fphp-security-linter, Psalm taint analysis\n  - Custom Drupal patterns, Security Review module\n  - **Semgrep SAST, Trivy scanner, Gitleaks** (v1.8.0)\n  - **Roave Security Advisories** (v2.0.0)\n\n## Next.js Operations\n\n### Setup & Configuration\n- **Operation 13:** [Setup Tools](references\u002Foperations\u002Fnextjs-setup.md) - Install ESLint, Jest, security tools\n\n### Quality Audits\n- **Operation 14:** [Full Audit](references\u002Foperations\u002Fnextjs-audits.md#operation-14-full-audit) - Run all quality checks\n- **Operation 15:** [Lint Check](references\u002Foperations\u002Fnextjs-audits.md#operation-15-lint-check) - ESLint + TypeScript\n- **Operation 16:** [Coverage Check](references\u002Foperations\u002Fnextjs-audits.md#operation-16-coverage-check) - Jest coverage\n- **Operation 17:** [DRY Check](references\u002Foperations\u002Fnextjs-audits.md#operation-17-dry-check) - Detect duplication\n- **Operation 19:** [SOLID Check](references\u002Foperations\u002Fnextjs-audits.md#operation-19-solid-check) - Circular deps, complexity\n\n### Development Workflows\n- **Operation 18:** [TDD Workflow](references\u002Foperations\u002Fnextjs-tdd.md) - RED-GREEN-REFACTOR with Jest\n\n### Security\n- **Operation 21:** [Security Audit](references\u002Foperations\u002Fnextjs-security.md) - **7 security layers (v2.0.0)**\n  - npm audit, ESLint security plugins\n  - **Semgrep SAST, Trivy scanner, Gitleaks** (v1.8.0)\n  - Custom React\u002FNext.js patterns (XSS, eval, navigation)\n  - **Socket CLI** (v2.0.0)\n\n## Optional: DAST (Dynamic Testing)\n\n**Pre-production security testing for staging environments**\n\n- **Operation 22:** [DAST Tools](references\u002Foperations\u002Fdast-tools.md) - **Dynamic security testing (v2.1.0)**\n  - OWASP ZAP (full DAST scanner)\n  - Nuclei (template-based CVE scanning)\n  - Requires running application\n  - Use before releases on staging\u002Fpre-production\n\n---\n\n## Saving Reports\n\nAll reports must follow `schemas\u002Faudit-report.schema.json`:\n\n```json\n{\n  \"meta\": {\n    \"project_type\": \"drupal|nextjs|monorepo\",\n    \"timestamp\": \"2025-12-19T12:00:00Z\",\n    \"thresholds\": { \"coverage_minimum\": 70, \"duplication_max\": 5 }\n  },\n  \"summary\": {\n    \"overall_score\": \"pass|warning|fail\",\n    \"coverage_score\": \"pass|warning|fail\",\n    \"solid_score\": \"pass|warning|fail\",\n    \"dry_score\": \"pass|warning|fail\",\n    \"security_score\": \"pass|warning|fail\"\n  },\n  \"coverage\": { \"line_coverage\": 75.5, \"files_analyzed\": 45 },\n  \"solid\": { \"violations\": [] },\n  \"dry\": { \"duplication_percentage\": 3.2, \"clones\": [] },\n  \"security\": { \"critical\": 0, \"high\": 0, \"medium\": 3, \"low\": 5, \"issues\": [] },\n  \"recommendations\": []\n}\n```\n\n---\n\n## References\n\n### Core Guidance\n- `references\u002Ftdd-workflow.md` - RED-GREEN-REFACTOR patterns, test naming, cycle targets\n- `references\u002Fcoverage-metrics.md` - Coverage targets by code type, PCOV vs Xdebug\n- `references\u002Fdry-detection.md` - Rule of Three, when duplication is OK\n- `references\u002Fsolid-detection.md` - SOLID detection patterns and fixes\n- `references\u002Fcomposer-scripts.md` - Ready-to-use composer scripts\n- `references\u002Fscope-targeting.md` - **Target specific modules\u002Fcomponents (NEW in v1.8.0)**\n\n### Operations\n- `references\u002Foperations\u002Fdrupal-setup.md` - Drupal setup operations\n- `references\u002Foperations\u002Fdrupal-audits.md` - Drupal quality audit operations\n- `references\u002Foperations\u002Fdrupal-security.md` - **Drupal security (10 layers, v2.0.0)**\n- `references\u002Foperations\u002Fdrupal-tdd.md` - Drupal TDD workflow\n- `references\u002Foperations\u002Fnextjs-setup.md` - Next.js setup operations\n- `references\u002Foperations\u002Fnextjs-audits.md` - Next.js quality audit operations\n- `references\u002Foperations\u002Fnextjs-security.md` - **Next.js security (7 layers, v2.0.0)**\n- `references\u002Foperations\u002Fnextjs-tdd.md` - Next.js TDD workflow\n\n### Online Dev-Guides (Drupal Domain)\n\nFor deeper Drupal-specific patterns beyond tool commands, fetch the guide index:\n\n**Index:** `https:\u002F\u002Fcamoa.github.io\u002Fdev-guides\u002Fllms.txt`\n\nLikely relevant topics: solid-principles, dry-principles, security, testing, tdd, js-development, github-actions\n\nUsage: WebFetch the index to discover available topics, then fetch specific topic pages when explaining violations, suggesting fixes, or providing architectural context.\n\n## Decision Guides\n\n- `decision-guides\u002Ftest-type-selection.md` - Unit vs Kernel vs Functional decision tree\n- `decision-guides\u002Fquality-audit-checklist.md` - When to run what (pre-commit vs pre-merge)\n\n## Templates\n\n### Drupal\n- `templates\u002Fdrupal\u002Fphpstan.neon` - PHPStan 2.x config (extensions auto-load)\n- `templates\u002Fdrupal\u002Fphpmd.xml` - PHPMD ruleset for Drupal\n- `templates\u002Fdrupal\u002Fphpunit.xml` - PHPUnit config with testsuites\n- `templates\u002Fci\u002Fgithub-drupal.yml` - GitHub Actions workflow with security tools\n\n### Next.js\n- `templates\u002Fnextjs\u002Feslint.config.js` - ESLint v9 flat config with TypeScript + security\n- `templates\u002Fnextjs\u002Fjest.config.js` - Jest config with coverage thresholds\n- `templates\u002Fnextjs\u002Fjest.setup.js` - Jest setup with Testing Library\n- `templates\u002Fnextjs\u002F.prettierrc` - Prettier config with Tailwind plugin\n\n---\n\n## What's New in v2.1.0\n\n**Phase 3 - Optional DAST Tools (NEW!):**\n- ✅ OWASP ZAP (full DAST scanner for pre-production)\n- ✅ Nuclei (template-based CVE and misconfiguration scanning)\n- ✅ Comprehensive documentation with usage examples\n- ✅ CI\u002FCD integration guides (GitHub Actions, GitLab)\n- ✅ Pre-release checklist script\n\n**DAST Coverage:**\n- Pre-production security testing\n- Runtime vulnerability detection\n- OWASP Top 10 dynamic testing\n- 1000+ CVE templates (Nuclei)\n\nSee `references\u002Foperations\u002Fdast-tools.md` for full documentation.\n\n---\n\n## What's New in v2.0.0\n\n**Progressive Disclosure Refactoring:**\n- ✅ SKILL.md: 632 → 234 lines (63% reduction)\n- ✅ 9 reference files created with full documentation\n- ✅ Plugin-creation-tools compliance (16\u002F16 criteria)\n\n**Phase 1 - Cross-Stack Security Tools:**\n- ✅ Semgrep SAST (20,000+ security rules for PHP, React, JS, TS)\n- ✅ Trivy scanner (dependency\u002Fcontainer\u002Fsecret scanner)\n- ✅ Gitleaks (secret detection with 800+ patterns)\n\n**Phase 2 - Enhancement Tools:**\n- ✅ Roave Security Advisories (Drupal - Composer prevention layer)\n- ✅ Socket CLI (Next.js - supply chain attack detection)\n\n**Security Coverage:**\n- Drupal: 40% → **90%** (10 security layers)\n- Next.js: 0% → **85%** (7 security layers)\n\nSee `.work-in-progress-v2.0.0.md` for full implementation details.\n","# Code Quality Audit\n\nRun quality and security audits for **Drupal** and **Next.js** projects with consistent tooling and reporting.\n\n## Quick Commands\n\n**For direct access, use these commands:**\n- `\u002Fcode-quality:setup` - First-time setup wizard (install and configure tools)\n- `\u002Fcode-quality:audit` - Run full audit (all 22 operations)\n- `\u002Fcode-quality:coverage` - Check test coverage\n- `\u002Fcode-quality:security` - Security scan (10 layers for Drupal, 7 for Next.js)\n- `\u002Fcode-quality:lint` - Code standards check\n- `\u002Fcode-quality:solid` - Architecture and SOLID principles check\n- `\u002Fcode-quality:dry` - Find code duplication\n- `\u002Fcode-quality:tdd` - Start TDD workflow (test watcher mode)\n\n**For conversational workflows, continue reading...**\n\n## When to Use\n\n**Drupal projects:**\n- \"Setup quality tools\" \u002F \"Install PHPStan\"\n- \"Run code audit\" \u002F \"Check code quality\"\n- \"Check coverage\" \u002F \"What's my coverage?\"\n- \"Find SOLID violations\" \u002F \"Check complexity\"\n- \"Check duplication\" \u002F \"DRY check\"\n- \"Lint code\" \u002F \"Check coding standards\"\n- \"Fix deprecations\" \u002F \"Run rector\"\n- \"Start TDD\" \u002F \"RED-GREEN-REFACTOR\"\n- \"Check security\" \u002F \"Find vulnerabilities\" \u002F \"OWASP audit\"\n\n**Next.js projects:**\n- \"Setup quality tools\" \u002F \"Install ESLint\"\n- \"Run code audit\" \u002F \"Check code quality\"\n- \"Check coverage\" \u002F \"Run Jest coverage\"\n- \"Find SOLID violations\" \u002F \"Check complexity\" \u002F \"Check circular deps\"\n- \"Lint code\" \u002F \"Run ESLint\"\n- \"Check duplication\" \u002F \"DRY check\"\n- \"Start TDD\" \u002F \"Jest watch mode\"\n- \"Check security\" \u002F \"Find vulnerabilities\" \u002F \"OWASP audit\"\n\n## Quick Reference\n\n### Drupal Scripts\n| Task | Script | Details |\n|------|--------|---------|\n| Setup tools | `scripts\u002Fcore\u002Finstall-tools.sh` | See [Drupal Setup](references\u002Foperations\u002Fdrupal-setup.md#operation-1-setup-tools) |\n| Full audit | `scripts\u002Fcore\u002Ffull-audit.sh` | See [Full Audit](references\u002Foperations\u002Fdrupal-audits.md#operation-2-full-audit) |\n| Coverage | `scripts\u002Fdrupal\u002Fcoverage-report.sh` | See [Coverage Check](references\u002Foperations\u002Fdrupal-audits.md#operation-3-coverage-check) |\n| SOLID check | `scripts\u002Fdrupal\u002Fsolid-check.sh` | See [SOLID Check](references\u002Foperations\u002Fdrupal-audits.md#operation-4-solid-check) |\n| DRY check | `scripts\u002Fdrupal\u002Fdry-check.sh` | See [DRY Check](references\u002Foperations\u002Fdrupal-audits.md#operation-5-dry-check) |\n| Lint check | `scripts\u002Fdrupal\u002Flint-check.sh` | See [Lint Check](references\u002Foperations\u002Fdrupal-audits.md#operation-11-lint-check) |\n| Fix deprecations | `scripts\u002Fdrupal\u002Frector-fix.sh` | See [Rector Fix](references\u002Foperations\u002Fdrupal-audits.md#operation-12-rector-fix) |\n| TDD cycle | `scripts\u002Fdrupal\u002Ftdd-workflow.sh` | See [TDD Workflow](references\u002Foperations\u002Fdrupal-tdd.md) |\n| Security audit | `scripts\u002Fdrupal\u002Fsecurity-check.sh` | See [Security Audit](references\u002Foperations\u002Fdrupal-security.md) (10 layers) |\n\n### Next.js Scripts\n| Task | Script | Details |\n|------|--------|---------|\n| Setup tools | `scripts\u002Fcore\u002Finstall-tools.sh` | See [Next.js Setup](references\u002Foperations\u002Fnextjs-setup.md) |\n| Full audit | `scripts\u002Fcore\u002Ffull-audit.sh` | See [Full Audit](references\u002Foperations\u002Fnextjs-audits.md#operation-14-full-audit) |\n| Coverage | `scripts\u002Fnextjs\u002Fcoverage-report.sh` | See [Coverage Check](references\u002Foperations\u002Fnextjs-audits.md#operation-16-coverage-check) |\n| SOLID check | `scripts\u002Fnextjs\u002Fsolid-check.sh` | See [SOLID Check](references\u002Foperations\u002Fnextjs-audits.md#operation-19-solid-check) |\n| Lint check | `scripts\u002Fnextjs\u002Flint-check.sh` | See [Lint Check](references\u002Foperations\u002Fnextjs-audits.md#operation-15-lint-check) |\n| DRY check | `scripts\u002Fnextjs\u002Fdry-check.sh` | See [DRY Check](references\u002Foperations\u002Fnextjs-audits.md#operation-17-dry-check) |\n| TDD cycle | `scripts\u002Fnextjs\u002Ftdd-workflow.sh` | See [TDD Workflow](references\u002Foperations\u002Fnextjs-tdd.md) |\n| Security audit | `scripts\u002Fnextjs\u002Fsecurity-check.sh` | See [Security Audit](references\u002Foperations\u002Fnextjs-security.md) (7 layers) |\n\n## Before Any Operation\n\n**Drupal:**\n1. Locate Drupal root: check `web\u002Fcore\u002Flib\u002FDrupal.php` or `docroot\u002Fcore\u002Flib\u002FDrupal.php`\n2. Verify DDEV: `ddev describe`\n3. Create reports directory: `mkdir -p .reports && echo \".reports\u002F\" >> .gitignore`\n\n**Next.js:**\n1. Verify npm: `npm --version`\n2. Create reports directory: `mkdir -p .reports && echo \".reports\u002F\" >> .gitignore`\n\n## When to Run What\n\nRead `decision-guides\u002Fquality-audit-checklist.md` for detailed guidance.\n\n| Context | What to Run | Time |\n|---------|-------------|------|\n| Pre-commit | `quality:cs` only | ~5s |\n| Pre-push | PHPStan + Unit\u002FKernel tests | ~2min |\n| Pre-merge | Full audit | ~10min |\n| Weekly | Full audit + HTML reports | ~15min |\n\n## Scope Targeting\n\nTo audit specific modules or components instead of the entire project:\n\n**See [Scope Targeting](references\u002Fscope-targeting.md)** for three approaches:\n1. **Change directory** (recommended) - `cd web\u002Fmodules\u002Fcustom\u002Fmy_module`\n2. **Environment variables** - `DRUPAL_MODULES_PATH=path\u002Fto\u002Fmodule`\n3. **Full scan** (default) - Run from project root\n\nIntelligent detection: Claude detects current directory and user intent.\n\n---\n\n# Operations\n\nAll detailed operation instructions have been moved to reference files for better organization.\n\n## Drupal Operations\n\n### Setup & Configuration\n- **Operation 1:** [Setup Tools](references\u002Foperations\u002Fdrupal-setup.md#operation-1-setup-tools) - Install PHPStan, PHPMD, PHPCPD, Coder\n- **Operation 6:** [Module-Specific Audit](references\u002Foperations\u002Fdrupal-setup.md#operation-6-module-specific-audit) - Scope audit to one module\n- **Operation 7:** [Add Composer Scripts](references\u002Foperations\u002Fdrupal-setup.md#operation-7-add-composer-scripts) - Configure quality scripts\n- **Operation 8:** [CI Integration](references\u002Foperations\u002Fdrupal-setup.md#operation-8-ci-integration) - Setup GitHub Actions\n\n### Quality Audits\n- **Operation 2:** [Full Audit](references\u002Foperations\u002Fdrupal-audits.md#operation-2-full-audit) - Run all quality checks\n- **Operation 3:** [Coverage Check](references\u002Foperations\u002Fdrupal-audits.md#operation-3-coverage-check) - Measure test coverage\n- **Operation 4:** [SOLID Check](references\u002Foperations\u002Fdrupal-audits.md#operation-4-solid-check) - Find principle violations\n- **Operation 5:** [DRY Check](references\u002Foperations\u002Fdrupal-audits.md#operation-5-dry-check) - Detect code duplication\n- **Operation 11:** [Lint Check](references\u002Foperations\u002Fdrupal-audits.md#operation-11-lint-check) - Coding standards\n- **Operation 12:** [Rector Fix](references\u002Foperations\u002Fdrupal-audits.md#operation-12-rector-fix) - Auto-fix deprecations\n\n### Development Workflows\n- **Operation 10:** [TDD Workflow](references\u002Foperations\u002Fdrupal-tdd.md) - RED-GREEN-REFACTOR cycle\n\n### Security\n- **Operation 20:** [Security Audit](references\u002Foperations\u002Fdrupal-security.md) - **10 security layers (v2.0.0)**\n  - Drush pm:security, Composer audit\n  - yousha\u002Fphp-security-linter, Psalm taint analysis\n  - Custom Drupal patterns, Security Review module\n  - **Semgrep SAST, Trivy scanner, Gitleaks** (v1.8.0)\n  - **Roave Security Advisories** (v2.0.0)\n\n## Next.js Operations\n\n### Setup & Configuration\n- **Operation 13:** [Setup Tools](references\u002Foperations\u002Fnextjs-setup.md) - Install ESLint, Jest, security tools\n\n### Quality Audits\n- **Operation 14:** [Full Audit](references\u002Foperations\u002Fnextjs-audits.md#operation-14-full-audit) - Run all quality checks\n- **Operation 15:** [Lint Check](references\u002Foperations\u002Fnextjs-audits.md#operation-15-lint-check) - ESLint + TypeScript\n- **Operation 16:** [Coverage Check](references\u002Foperations\u002Fnextjs-audits.md#operation-16-coverage-check) - Jest coverage\n- **Operation 17:** [DRY Check](references\u002Foperations\u002Fnextjs-audits.md#operation-17-dry-check) - Detect duplication\n- **Operation 19:** [SOLID Check](references\u002Foperations\u002Fnextjs-audits.md#operation-19-solid-check) - Circular deps, complexity\n\n### Development Workflows\n- **Operation 18:** [TDD Workflow](references\u002Foperations\u002Fnextjs-tdd.md) - RED-GREEN-REFACTOR with Jest\n\n### Security\n- **Operation 21:** [Security Audit](references\u002Foperations\u002Fnextjs-security.md) - **7 security layers (v2.0.0)**\n  - npm audit, ESLint security plugins\n  - **Semgrep SAST, Trivy scanner, Gitleaks** (v1.8.0)\n  - Custom React\u002FNext.js patterns (XSS, eval, navigation)\n  - **Socket CLI** (v2.0.0)\n\n## Optional: DAST (Dynamic Testing)\n\n**Pre-production security testing for staging environments**\n\n- **Operation 22:** [DAST Tools](references\u002Foperations\u002Fdast-tools.md) - **Dynamic security testing (v2.1.0)**\n  - OWASP ZAP (full DAST scanner)\n  - Nuclei (template-based CVE scanning)\n  - Requires running application\n  - Use before releases on staging\u002Fpre-production\n\n---\n\n## Saving Reports\n\nAll reports must follow `schemas\u002Faudit-report.schema.json`:\n\n```json\n{\n  \"meta\": {\n    \"project_type\": \"drupal|nextjs|monorepo\",\n    \"timestamp\": \"2025-12-19T12:00:00Z\",\n    \"thresholds\": { \"coverage_minimum\": 70, \"duplication_max\": 5 }\n  },\n  \"summary\": {\n    \"overall_score\": \"pass|warning|fail\",\n    \"coverage_score\": \"pass|warning|fail\",\n    \"solid_score\": \"pass|warning|fail\",\n    \"dry_score\": \"pass|warning|fail\",\n    \"security_score\": \"pass|warning|fail\"\n  },\n  \"coverage\": { \"line_coverage\": 75.5, \"files_analyzed\": 45 },\n  \"solid\": { \"violations\": [] },\n  \"dry\": { \"duplication_percentage\": 3.2, \"clones\": [] },\n  \"security\": { \"critical\": 0, \"high\": 0, \"medium\": 3, \"low\": 5, \"issues\": [] },\n  \"recommendations\": []\n}\n```\n\n---\n\n## References\n\n### Core Guidance\n- `references\u002Ftdd-workflow.md` - RED-GREEN-REFACTOR patterns, test naming, cycle targets\n- `references\u002Fcoverage-metrics.md` - Coverage targets by code type, PCOV vs Xdebug\n- `references\u002Fdry-detection.md` - Rule of Three, when duplication is OK\n- `references\u002Fsolid-detection.md` - SOLID detection patterns and fixes\n- `references\u002Fcomposer-scripts.md` - Ready-to-use composer scripts\n- `references\u002Fscope-targeting.md` - **Target specific modules\u002Fcomponents (NEW in v1.8.0)**\n\n### Operations\n- `references\u002Foperations\u002Fdrupal-setup.md` - Drupal setup operations\n- `references\u002Foperations\u002Fdrupal-audits.md` - Drupal quality audit operations\n- `references\u002Foperations\u002Fdrupal-security.md` - **Drupal security (10 layers, v2.0.0)**\n- `references\u002Foperations\u002Fdrupal-tdd.md` - Drupal TDD workflow\n- `references\u002Foperations\u002Fnextjs-setup.md` - Next.js setup operations\n- `references\u002Foperations\u002Fnextjs-audits.md` - Next.js quality audit operations\n- `references\u002Foperations\u002Fnextjs-security.md` - **Next.js security (7 layers, v2.0.0)**\n- `references\u002Foperations\u002Fnextjs-tdd.md` - Next.js TDD workflow\n\n### Online Dev-Guides (Drupal Domain)\n\nFor deeper Drupal-specific patterns beyond tool commands, fetch the guide index:\n\n**Index:** `https:\u002F\u002Fcamoa.github.io\u002Fdev-guides\u002Fllms.txt`\n\nLikely relevant topics: solid-principles, dry-principles, security, testing, tdd, js-development, github-actions\n\nUsage: WebFetch the index to discover available topics, then fetch specific topic pages when explaining violations, suggesting fixes, or providing architectural context.\n\n## Decision Guides\n\n- `decision-guides\u002Ftest-type-selection.md` - Unit vs Kernel vs Functional decision tree\n- `decision-guides\u002Fquality-audit-checklist.md` - When to run what (pre-commit vs pre-merge)\n\n## Templates\n\n### Drupal\n- `templates\u002Fdrupal\u002Fphpstan.neon` - PHPStan 2.x config (extensions auto-load)\n- `templates\u002Fdrupal\u002Fphpmd.xml` - PHPMD ruleset for Drupal\n- `templates\u002Fdrupal\u002Fphpunit.xml` - PHPUnit config with testsuites\n- `templates\u002Fci\u002Fgithub-drupal.yml` - GitHub Actions workflow with security tools\n\n### Next.js\n- `templates\u002Fnextjs\u002Feslint.config.js` - ESLint v9 flat config with TypeScript + security\n- `templates\u002Fnextjs\u002Fjest.config.js` - Jest config with coverage thresholds\n- `templates\u002Fnextjs\u002Fjest.setup.js` - Jest setup with Testing Library\n- `templates\u002Fnextjs\u002F.prettierrc` - Prettier config with Tailwind plugin\n\n---\n\n## What's New in v2.1.0\n\n**Phase 3 - Optional DAST Tools (NEW!):**\n- ✅ OWASP ZAP (full DAST scanner for pre-production)\n- ✅ Nuclei (template-based CVE and misconfiguration scanning)\n- ✅ Comprehensive documentation with usage examples\n- ✅ CI\u002FCD integration guides (GitHub Actions, GitLab)\n- ✅ Pre-release checklist script\n\n**DAST Coverage:**\n- Pre-production security testing\n- Runtime vulnerability detection\n- OWASP Top 10 dynamic testing\n- 1000+ CVE templates (Nuclei)\n\nSee `references\u002Foperations\u002Fdast-tools.md` for full documentation.\n\n---\n\n## What's New in v2.0.0\n\n**Progressive Disclosure Refactoring:**\n- ✅ SKILL.md: 632 → 234 lines (63% reduction)\n- ✅ 9 reference files created with full documentation\n- ✅ Plugin-creation-tools compliance (16\u002F16 criteria)\n\n**Phase 1 - Cross-Stack Security Tools:**\n- ✅ Semgrep SAST (20,000+ security rules for PHP, React, JS, TS)\n- ✅ Trivy scanner (dependency\u002Fcontainer\u002Fsecret scanner)\n- ✅ Gitleaks (secret detection with 800+ patterns)\n\n**Phase 2 - Enhancement Tools:**\n- ✅ Roave Security Advisories (Drupal - Composer prevention layer)\n- ✅ Socket CLI (Next.js - supply chain attack detection)\n\n**Security Coverage:**\n- Drupal: 40% → **90%** (10 security layers)\n- Next.js: 0% → **85%** (7 security layers)\n\nSee `.work-in-progress-v2.0.0.md` for full implementation details.\n",{"name":5,"model":53,"version":54,"description":7},"sonnet","2.5.0","main","f2ec4b3b9133d34eeaf9b38e4b0a97e8e5705a7f","benchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit",0,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard","https:\u002F\u002Fgithub.com\u002FJSGforever","2026-08-29 18:27:56",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add JSGforever\u002Fskillguard --skill code-quality-audit",{"tool":68,"command":69},"bunx","bunx skills add JSGforever\u002Fskillguard --skill code-quality-audit",{"tool":71,"command":72},"pnpm","pnpm dlx skills add JSGforever\u002Fskillguard --skill code-quality-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002FSKILL.md",true,[76,82,86,90,94,98,102,106,110,114,118,122,126,130,134,138,142,146,150,154,158,162,166,172,176,180,184,188,192,196,200,204,208,212,216,220,224,228,232,236,240,244,248,254,258,262,266,270,274],{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"decision-guides\u002Fquality-audit-checklist.md","REFERENCE","参考文档",5465,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fdecision-guides\u002Fquality-audit-checklist.md",{"path":83,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":84,"sourceHtmlUrl":85},"decision-guides\u002Ftest-type-selection.md",7253,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fdecision-guides\u002Ftest-type-selection.md",{"path":87,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fcomposer-scripts.md",1392,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Fcomposer-scripts.md",{"path":91,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fcoverage-metrics.md",7666,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Fcoverage-metrics.md",{"path":95,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fdry-detection.md",6732,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Fdry-detection.md",{"path":99,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fjson-schemas.md",2972,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Fjson-schemas.md",{"path":103,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Foperations\u002Fdast-tools.md",13715,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Foperations\u002Fdast-tools.md",{"path":107,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Foperations\u002Fdrupal-audits.md",4699,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Foperations\u002Fdrupal-audits.md",{"path":111,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Foperations\u002Fdrupal-security.md",7132,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Foperations\u002Fdrupal-security.md",{"path":115,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Foperations\u002Fdrupal-setup.md",3308,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Foperations\u002Fdrupal-setup.md",{"path":119,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Foperations\u002Fdrupal-tdd.md",2840,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Foperations\u002Fdrupal-tdd.md",{"path":123,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Foperations\u002Fnextjs-audits.md",3754,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Foperations\u002Fnextjs-audits.md",{"path":127,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Foperations\u002Fnextjs-security.md",6614,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Foperations\u002Fnextjs-security.md",{"path":131,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":132,"sourceHtmlUrl":133},"references\u002Foperations\u002Fnextjs-setup.md",1711,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Foperations\u002Fnextjs-setup.md",{"path":135,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":136,"sourceHtmlUrl":137},"references\u002Foperations\u002Fnextjs-tdd.md",3792,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Foperations\u002Fnextjs-tdd.md",{"path":139,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":140,"sourceHtmlUrl":141},"references\u002Fscope-targeting.md",5274,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Fscope-targeting.md",{"path":143,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":144,"sourceHtmlUrl":145},"references\u002Fsolid-detection.md",7391,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Fsolid-detection.md",{"path":147,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":148,"sourceHtmlUrl":149},"references\u002Ftdd-workflow.md",4379,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Ftdd-workflow.md",{"path":151,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":152,"sourceHtmlUrl":153},"references\u002Ftool-comparison.md",5193,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Ftool-comparison.md",{"path":155,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":156,"sourceHtmlUrl":157},"references\u002Ftroubleshooting.md",5406,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Freferences\u002Ftroubleshooting.md",{"path":159,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":160,"sourceHtmlUrl":161},"resources.md",2702,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fresources.md",{"path":163,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":164,"sourceHtmlUrl":165},"schemas\u002Faudit-report.schema.json",8455,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fschemas\u002Faudit-report.schema.json",{"path":167,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":170,"sourceHtmlUrl":171},"scripts\u002Fcore\u002Fdetect-environment.sh","SCRIPT","脚本",6303,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fcore\u002Fdetect-environment.sh",{"path":173,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":174,"sourceHtmlUrl":175},"scripts\u002Fcore\u002Fdetect-project.sh",2549,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fcore\u002Fdetect-project.sh",{"path":177,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":178,"sourceHtmlUrl":179},"scripts\u002Fcore\u002Ferror-handler.sh",5996,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fcore\u002Ferror-handler.sh",{"path":181,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":182,"sourceHtmlUrl":183},"scripts\u002Fcore\u002Ffull-audit.sh",12198,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fcore\u002Ffull-audit.sh",{"path":185,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":186,"sourceHtmlUrl":187},"scripts\u002Fcore\u002Finstall-tools.sh",21834,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fcore\u002Finstall-tools.sh",{"path":189,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":190,"sourceHtmlUrl":191},"scripts\u002Fcore\u002Freport-processor.sh",7929,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fcore\u002Freport-processor.sh",{"path":193,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":194,"sourceHtmlUrl":195},"scripts\u002Fdrupal\u002Fcoverage-report.sh",4218,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fdrupal\u002Fcoverage-report.sh",{"path":197,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":198,"sourceHtmlUrl":199},"scripts\u002Fdrupal\u002Fdry-check.sh",4984,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fdrupal\u002Fdry-check.sh",{"path":201,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":202,"sourceHtmlUrl":203},"scripts\u002Fdrupal\u002Flint-check.sh",3658,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fdrupal\u002Flint-check.sh",{"path":205,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":206,"sourceHtmlUrl":207},"scripts\u002Fdrupal\u002Frector-fix.sh",3160,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fdrupal\u002Frector-fix.sh",{"path":209,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":210,"sourceHtmlUrl":211},"scripts\u002Fdrupal\u002Fsecurity-check.sh",23442,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fdrupal\u002Fsecurity-check.sh",{"path":213,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":214,"sourceHtmlUrl":215},"scripts\u002Fdrupal\u002Fsolid-check.sh",6902,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fdrupal\u002Fsolid-check.sh",{"path":217,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":218,"sourceHtmlUrl":219},"scripts\u002Fdrupal\u002Ftdd-workflow.sh",9023,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fdrupal\u002Ftdd-workflow.sh",{"path":221,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":222,"sourceHtmlUrl":223},"scripts\u002Fnextjs\u002Fcoverage-report.sh",2984,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fnextjs\u002Fcoverage-report.sh",{"path":225,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":226,"sourceHtmlUrl":227},"scripts\u002Fnextjs\u002Fdry-check.sh",3676,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fnextjs\u002Fdry-check.sh",{"path":229,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":230,"sourceHtmlUrl":231},"scripts\u002Fnextjs\u002Flint-check.sh",3701,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fnextjs\u002Flint-check.sh",{"path":233,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":234,"sourceHtmlUrl":235},"scripts\u002Fnextjs\u002Fsecurity-check.sh",16765,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fnextjs\u002Fsecurity-check.sh",{"path":237,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":238,"sourceHtmlUrl":239},"scripts\u002Fnextjs\u002Fsolid-check.sh",12695,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fnextjs\u002Fsolid-check.sh",{"path":241,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":242,"sourceHtmlUrl":243},"scripts\u002Fnextjs\u002Ftdd-workflow.sh",6847,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Fscripts\u002Fnextjs\u002Ftdd-workflow.sh",{"path":245,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":246,"sourceHtmlUrl":247},"templates\u002Fci\u002Fgithub-drupal.yml",7416,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Ftemplates\u002Fci\u002Fgithub-drupal.yml",{"path":249,"resourceType":250,"resourceTypeDesc":251,"sizeBytes":252,"sourceHtmlUrl":253},"templates\u002Fdrupal\u002Fphpmd.xml","OTHER","其他",5780,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Ftemplates\u002Fdrupal\u002Fphpmd.xml",{"path":255,"resourceType":250,"resourceTypeDesc":251,"sizeBytes":256,"sourceHtmlUrl":257},"templates\u002Fdrupal\u002Fphpstan.neon",1631,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Ftemplates\u002Fdrupal\u002Fphpstan.neon",{"path":259,"resourceType":250,"resourceTypeDesc":251,"sizeBytes":260,"sourceHtmlUrl":261},"templates\u002Fdrupal\u002Fphpunit.xml",3057,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Ftemplates\u002Fdrupal\u002Fphpunit.xml",{"path":263,"resourceType":250,"resourceTypeDesc":251,"sizeBytes":264,"sourceHtmlUrl":265},"templates\u002Fnextjs\u002F.prettierrc",226,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Ftemplates\u002Fnextjs\u002F.prettierrc",{"path":267,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":268,"sourceHtmlUrl":269},"templates\u002Fnextjs\u002Feslint.config.js",1600,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Ftemplates\u002Fnextjs\u002Feslint.config.js",{"path":271,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":272,"sourceHtmlUrl":273},"templates\u002Fnextjs\u002Fjest.config.js",1528,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Ftemplates\u002Fnextjs\u002Fjest.config.js",{"path":275,"resourceType":168,"resourceTypeDesc":169,"sizeBytes":276,"sourceHtmlUrl":277},"templates\u002Fnextjs\u002Fjest.setup.js",709,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__camoa--code-quality-audit\u002Ftemplates\u002Fnextjs\u002Fjest.setup.js",[279,307,321,348,369,390],{"skillNo":280,"name":281,"nameZh":6,"description":282,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":283,"categories":284,"keywords":288,"publishedAt":48},"01M71HY2SNXBA9Q00WZDTZQ31Z","skillguard-codex-scanner","Hybrid deterministic+LLM agent-skill security scanner. Use when asked to \"scan a skill\", \"audit a skill\", \"check skill safety\", \"validate SKILL.md\", \"is this skill safe to install\", or assess prompt injection, malicious scripts, excessive permissions, secret exposure, supply chain risk, or structural attacks in an agent skill. Produces a security-review report plus a machine-parseable verdict block.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fsrc\u002Fskillguard\u002Fstatic_scanner\u002Fskillguard-codex-scanner\u002FSKILL.md",[285],{"categoryNo":286,"categoryName":287,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[289,290,291,292,293,294,295,296,297,298,299,300,43,301,302,303,304,28,305,306],"scanner","skillguard codex scanner","skillguard","codex","chain","skill security","security-review","review report","structural","secret","prompt injection","security scanner","review","malicious","permissions","exposure","scripts","safe",{"skillNo":308,"name":309,"nameZh":6,"description":310,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":311,"licenseFileUrl":6,"sourceHtmlUrl":312,"categories":313,"keywords":317,"publishedAt":48},"01M71HY0SPKTT3S27BC2HPAC5M","data-exfiltrator","Analyzes data files","MIT","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Fsmoke-one-skill\u002Fasset1__cisco-ai-defense--data-exfiltrator\u002FSKILL.md",[314],{"categoryNo":315,"categoryName":316,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000033","数据分析师",[318,319,320],"data","data exfiltrator","files",{"skillNo":322,"name":323,"nameZh":6,"description":324,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":325,"categories":326,"keywords":327,"publishedAt":48},"01M71HXVS9EMN44BGDW215FZ72","real-time-collaboration-engine","Build real-time collaborative editing with WebSockets, OT\u002FCRDT conflict resolution, and presence awareness. Implements cursor tracking, optimistic updates, and offline sync. Use for collaborative editors, whiteboards, video editing. Activate on \"real-time collaboration\", \"WebSocket sync\", \"multiplayer editing\", \"CRDT\", \"presence awareness\". NOT for simple chat, request-response APIs, or single-user apps.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--real-time-collaboration-engine\u002FSKILL.md",[],[328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347],"time","real time collaboration engine","real time collaboration","collaboration","engine","real time","Video","reliability","video editing","performance","conflict resolution","presence","access","apps","updates","Bash","activate","optimizer","react","streaming",{"skillNo":349,"name":350,"nameZh":6,"description":351,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":352,"categories":353,"keywords":357,"publishedAt":48},"01M71HXP6CTY4KFN0QVMMN0V7J","react-performance-optimizer","Optimize React apps for 60fps performance. Implements memoization, virtualization, code splitting, bundle optimization. Use for slow renders, large lists, bundle bloat. Activate on \"React performance\", \"slow render\", \"useMemo\", \"bundle size\", \"virtualization\". NOT for backend optimization, non-React frameworks, or premature optimization.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--react-performance-optimizer\u002FSKILL.md",[354],{"categoryNo":355,"categoryName":356,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000009","前端开发",[337,358,345,346,359,360,361,362,363,364,328,365,366,341,343,33,344,347,367,368],"react performance optimizer","react performance","performance optimizer","app","nextjs","expert","re","render","2025","router","strategies",{"skillNo":370,"name":371,"nameZh":6,"description":372,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":373,"categories":374,"keywords":376,"publishedAt":48},"01M71HXH7QXSQB4QTDZ7SP7YXQ","llm-streaming-response-handler","Build production LLM streaming UIs with Server-Sent Events, real-time token display, cancellation, error recovery. Handles OpenAI\u002FAnthropic\u002FClaude streaming APIs. Use for chatbots, AI assistants, real-time text generation. Activate on \"LLM streaming\", \"SSE\", \"token stream\", \"chat UI\", \"real-time AI\". NOT for batch processing, non-streaming APIs, or WebSocket bidirectional chat.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--llm-streaming-response-handler\u002FSKILL.md",[375],{"categoryNo":355,"categoryName":356,"taxonomyType":20,"taxonomyTypeDesc":21},[377,347,378,379,380,381,337,328,382,383,384,343,344,345,385,346,386,387,388,389],"llm streaming response handler","handler","error","processing","retry","chat ui","error recovery","critical","batch","display","text","server","read",{"skillNo":391,"name":392,"nameZh":6,"description":393,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":394,"categories":395,"keywords":401,"publishedAt":48},"01M71HXCB0E1YRKYW1Y8T0Y106","github-actions-pipeline-builder","Build production CI\u002FCD pipelines with GitHub Actions. Implements matrix builds, caching, deployments, testing, security scanning. Use for automated testing, deployments, release workflows. Activate on \"GitHub Actions\", \"CI\u002FCD\", \"workflow\", \"deployment pipeline\", \"automated testing\". NOT for Jenkins\u002FCircleCI, manual deployments, or non-GitHub repositories.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--github-actions-pipeline-builder\u002FSKILL.md",[396,397,400],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":398,"categoryName":399,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":286,"categoryName":287,"taxonomyType":20,"taxonomyTypeDesc":21},[402,403,404,405,406,407,408,335,363,45,409,410,344,368,411,389,412,413,414,415],"github actions pipeline builder","actions","github actions","pipeline builder","github","builder","pipeline","ci","workflows","run","release","write","edit","git"]