[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71NEF3A84DT24N741KBQF3V":3,"skill-same:01M71NEF3A84DT24N741KBQF3V":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M71NEF3A84DT24N741KBQF3V","ln-628-concurrency-correctness-auditor",null,"Checks races, deadlocks, async hazards, TOCTOU, blocking I\u002FO, and shared resource contention. Use when auditing concurrency correctness.","vitalikpestov\u002FSkills-Catalog","vitalikpestov","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F13882997?v=4","01M71N4QG0CWRXX4R24JQZXDDQ","Vitalik Pestov","01M71N4QGMSYRW607DDSE0CQMM",2,"MIT","https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"correctness","concurrency","ln 628 concurrency correctness auditor","auditor","ln","grep","paths","read","line","outline","toctou","file","Bash","when","use","MCP","hex","async","search","shared","2026-11-10 10:56:23",false,"---\nname: ln-628-concurrency-correctness-auditor\ndescription: \"Checks races, deadlocks, async hazards, TOCTOU, blocking I\u002FO, and shared resource contention. Use when auditing concurrency correctness.\"\nallowed-tools: Read, Grep, Glob, Bash, mcp__hex-graph__trace_dataflow, mcp__hex-graph__trace_paths, mcp__hex-line__read_file, mcp__hex-line__grep_search, mcp__hex-line__outline\nlicense: MIT\n---\n\n> **Paths:** File paths (`references\u002F`, `..\u002Fln-*`) are relative to this skill directory.\n\n# Concurrency Correctness Auditor (L3 Worker)\n\n**Type:** L3 Worker\n\nSpecialized worker auditing concurrency correctness, async hazards, and cross-process resource access.\n\n## Purpose & Scope\n\n- Audit **concurrency** (Category 11: High Priority)\n- 7 checks: async races, thread safety, TOCTOU, deadlocks, blocking I\u002FO, resource contention, cross-process races\n- Two-layer detection: grep finds candidates, agent reasons about context\n- Emit `FIX_RACE`, `FIX_DEADLOCK`, or `CONTROL_ASYNC_SIDE_EFFECT`\n- Calculate compliance score (X\u002F10)\n\n## Inputs\n\n**MANDATORY READ:** Load `references\u002Faudit_worker_core_contract.md`.\nTool policy: follow host AGENTS.md MCP preferences; load `references\u002Fmcp_tool_preferences.md` and `references\u002Fmcp_integration_patterns.md` only when host policy is absent or MCP behavior is unclear.\n\nReceives `contextStore` with: `tech_stack`, `best_practices`, `codebase_root`, `output_dir`.\n\nUse `hex-graph` first when dataflow or call-path analysis materially improves concurrency findings. Use `hex-line` first for local code reads when available. If MCP is unavailable, unsupported, or not indexed, continue with built-in `Read\u002FGrep\u002FGlob\u002FBash` and state the fallback in the report.\n\n## Workflow\n\nDetection policy: use two-layer detection (candidate scan, then context verification); load `references\u002Ftwo_layer_detection.md` only when the verification method is ambiguous.\n\n1) **Parse context** -- extract tech_stack, language, output_dir from contextStore\n2) **Per check (1-7):**\n   - **Layer 1:** Grep\u002FGlob scan to find candidates\n   - **Layer 2:** Read 20-50 lines around each candidate. Apply check-specific critical questions. Classify: confirmed \u002F false positive \u002F needs-context\n3) **Collect** confirmed findings with severity, location, effort, recommendation\n4) **Calculate score** per `references\u002Faudit_scoring.md`\n5) **Write Report** -- build in memory, write to `{output_dir}\u002Fln-628--global.md` (atomic single Write)\n6) **Return Summary**\n\n## Audit Rules\n\n**Unified severity escalation:** For ALL checks -- if finding affects payment\u002Fauth\u002Ffinancial code -> escalate to **CRITICAL** regardless of other factors.\n\n### 1. Async\u002FEvent-Loop Races (CWE-362)\n\n**What:** Shared state corrupted across await\u002Fyield boundaries in single-threaded async code.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Pattern | Grep |\n|----------|---------|------|\n| JS\u002FTS | Read-modify-write across await | `\\w+\\s*[+\\-*\u002F]?=\\s*.*await` (e.g., `result += await something`) |\n| JS\u002FTS | Check-then-initialize race | `if\\s*\\(!?\\w+\\)` followed by `\\w+\\s*=\\s*await` in same block |\n| Python | Read-modify-write across await | `\\w+\\s*[+\\-*\u002F]?=\\s*await` inside `async def` |\n| Python | Shared module-level state in async | Module-level `\\w+\\s*=` + modified inside `async def` |\n| All | Shared cache without lock | `\\.set\\(|\\.put\\(|\\[\\w+\\]\\s*=` in async function without lock\u002Fmutex nearby |\n\n**Layer 2 -- Critical questions:**\n- Is the variable shared (module\u002Fglobal scope) or local?\n- Can two async tasks interleave at this await point?\n- Is there a lock\u002Fmutex\u002Fsemaphore guarding the access?\n\n**Severity:** CRITICAL (payment\u002Fauth) | HIGH (user-facing) | MEDIUM (background)\n\n**Safe pattern exclusions:** Local variables, `const` declarations, single-use await (no interleaving possible).\n\n**Effort:** M\n\n### 2. Thread\u002FGoroutine Safety (CWE-366)\n\n**What:** Shared mutable state accessed from multiple threads\u002Fgoroutines without synchronization.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Pattern | Grep |\n|----------|---------|------|\n| Go | Map access without mutex | `map\\[.*\\].*=` in struct without `sync.Mutex` or `sync.RWMutex` |\n| Go | Variable captured by goroutine | `go func` + variable from outer scope modified |\n| Python | Global modified in threads | `global\\s+\\w+` in function + `threading.Thread` in same file |\n| Java | HashMap shared between threads | `HashMap` + `Thread\\|Executor\\|Runnable` in same class without `synchronized\\|ConcurrentHashMap` |\n| Rust | Rc in multi-thread context | `Rc\u003CRefCell` + `thread::spawn\\|tokio::spawn` in same file |\n| Node.js | Worker Threads shared state | `workerData\\|SharedArrayBuffer\\|parentPort` + mutable access without `Atomics` |\n\n**Layer 2 -- Critical questions:**\n- Is this struct\u002Fobject actually shared between threads? (single-threaded code -> FP)\n- Is mutex\u002Flock in embedded struct or imported module? (grep may miss it)\n- Is `go func` capturing by value (safe) or by reference (unsafe)?\n\n**Severity:** CRITICAL (payment\u002Fauth) | HIGH (data corruption possible) | MEDIUM (internal)\n\n**Safe pattern exclusions:** Go map in `init()` or `main()` before goroutines start. Rust `Arc\u003CMutex\u003CT>>` (already safe). Java `Collections.synchronizedMap()`.\n\n**Effort:** M\n\n### 3. TOCTOU -- Time-of-Check Time-of-Use (CWE-367)\n\n**What:** Resource state checked, then used, but state can change between check and use.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Check | Use | Grep |\n|----------|-------|-----|------|\n| Python | `os.path.exists()` | `open()` | `os\\.path\\.exists\\(` near `open\\(` on same variable |\n| Python | `os.access()` | `os.open()` | `os\\.access\\(` near `os\\.open\\(\\|open\\(` |\n| Node.js | `fs.existsSync()` | `fs.readFileSync()` | `existsSync\\(` near `readFileSync\\(\\|readFile\\(` |\n| Node.js | `fs.accessSync()` | `fs.openSync()` | `accessSync\\(` near `openSync\\(` |\n| Go | `os.Stat()` | `os.Open()` | `os\\.Stat\\(` near `os\\.Open\\(\\|os\\.Create\\(` |\n| Java | `.exists()` | `new FileInputStream` | `\\.exists\\(\\)` near `new File\\|FileInputStream\\|FileOutputStream` |\n\n**Layer 2 -- Critical questions:**\n- Is the check used for control flow (vulnerable) or just logging (safe)?\n- Is there a lock\u002Fretry around the check-then-use sequence?\n- Is the file in a temp directory controlled by the application (lower risk)?\n- Could an attacker substitute the file (symlink attack)?\n\n**Severity:** CRITICAL (security-sensitive: permissions, auth tokens, configs) | HIGH (user-facing file ops) | MEDIUM (internal\u002Fbackground)\n\n**Safe pattern exclusions:** Check inside try\u002Fcatch with retry. Check for logging\u002Fmetrics only. Check + use wrapped in file lock.\n\n**Effort:** S-M (replace check-then-use with direct use + error handling)\n\n### 4. Deadlock Potential (CWE-833)\n\n**What:** Lock acquisition in inconsistent order, or lock held during blocking operation.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Pattern | Grep |\n|----------|---------|------|\n| Python | Nested locks | `with\\s+\\w+_lock:` (multiline: two different locks nested) |\n| Python | Lock in loop | `for.*:` with `\\.acquire\\(\\)` inside loop body |\n| Python | Lock + external call | `\\.acquire\\(\\)` followed by `await\\|requests\\.\\|urllib` before release |\n| Go | Missing defer unlock | `\\.Lock\\(\\)` without `defer.*\\.Unlock\\(\\)` on next line |\n| Go | Nested locks | Two `\\.Lock\\(\\)` calls in same function without intervening `\\.Unlock\\(\\)` |\n| Java | Nested synchronized | `synchronized\\s*\\(` (multiline: nested blocks with different monitors) |\n| JS | Async mutex nesting | `await\\s+\\w+\\.acquire\\(\\)` (two different mutexes in same function) |\n\n**Layer 2 -- Critical questions:**\n- Are these the same lock (reentrant = OK) or different locks (deadlock risk)?\n- Is the lock ordering consistent across all call sites?\n- Does the external call inside lock have a timeout?\n\n**Severity:** CRITICAL (payment\u002Fauth) | HIGH (app freeze risk)\n\n**Safe pattern exclusions:** Reentrant locks (same lock acquired twice). Locks with explicit timeout (`asyncio.wait_for`, `tryLock`).\n\n**Effort:** L (lock ordering redesign)\n\n### 5. Blocking I\u002FO in Async Context (CWE-400)\n\n**What:** Synchronous blocking calls inside async functions or event loop handlers.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Blocking Call | Grep | Replacement |\n|----------|--------------|------|-------------|\n| Python | `time.sleep` in async def | `time\\.sleep` inside `async def` | `await asyncio.sleep` |\n| Python | `requests.*` in async def | `requests\\.(get\\|post\\|put\\|delete)` inside `async def` | `httpx` or `aiohttp` |\n| Python | `open()` in async def | `open\\(` inside `async def` | `aiofiles.open` |\n| Node.js | `fs.readFileSync` in async | `fs\\.readFileSync\\|fs\\.writeFileSync\\|fs\\.mkdirSync` | `fs.promises.*` |\n| Node.js | `execSync` in async | `execSync\\|spawnSync` in async handler | `exec` with promises |\n| Node.js | Sync crypto in async | `crypto\\.pbkdf2Sync\\|crypto\\.scryptSync` | `crypto.pbkdf2` (callback) |\n\n**Layer 2 -- Critical questions:**\n- Is this in a hot path (API handler) or cold path (startup script)?\n- Is the blocking duration significant (>100ms)?\n- Is there a legitimate reason (e.g., sync read of small config at startup)?\n\n**Severity:** HIGH (blocks event loop\u002Fasync context) | MEDIUM (minor blocking \u003C100ms)\n\n**Safe pattern exclusions:** Blocking call in `if __name__ == \"__main__\"` (startup). `readFileSync` in config loading at init time. Sync crypto for small inputs.\n\n**Effort:** S-M (replace with async alternative)\n\n### 6. Resource Contention (CWE-362)\n\n**What:** Multiple concurrent accessors compete for same resource without coordination.\n\n**Layer 1 -- Grep patterns:**\n\n| Pattern | Risk | Grep |\n|---------|------|------|\n| Shared memory without sync | Data corruption | `SharedArrayBuffer\\|SharedMemory\\|shm_open\\|mmap` without `Atomics\\|Mutex\\|Lock` nearby |\n| IPC without coordination | Message ordering | `process\\.send\\|parentPort\\.postMessage` in concurrent loops |\n| Concurrent file append | Interleaved writes | Multiple `appendFile\\|fs\\.write` to same path from parallel tasks |\n\n**Layer 2 -- Critical questions:**\n- Are multiple writers actually concurrent? (Sequential = safe)\n- Is there OS-level atomicity guarantee? (e.g., `O_APPEND` for small writes)\n- Is ordering important for correctness?\n\n**Severity:** HIGH (data corruption) | MEDIUM (ordering issues)\n\n**Safe pattern exclusions:** Single writer pattern. OS-guaranteed atomic operations (small pipe writes, `O_APPEND`). Message queues with ordering guarantees.\n\n**Effort:** M\n\n### 7. Cross-Process & Invisible Side Effects (CWE-362, CWE-421)\n\n**What:** Multiple processes or process+OS accessing same exclusive resource, including operations with non-obvious side effects on shared OS resources.\n\n**Layer 1 -- Grep entry points:**\n\n| Pattern | Risk | Grep |\n|---------|------|------|\n| Clipboard dual access | OSC 52 + native clipboard in same flow | `osc52\\|\\\\x1b\\\\]52` AND `clipboard\\|SetClipboardData\\|pbcopy\\|xclip` in same file |\n| Subprocess + shared file | Parent and child write same file | `spawn\\|exec\\|Popen` + `writeFile\\|open.*\"w\"` on same path |\n| OS exclusive resource | Win32 clipboard, serial port, named pipe | `OpenClipboard\\|serial\\.Serial\\|CreateNamedPipe\\|mkfifo` |\n| Terminal escape sequences | stdout triggers terminal OS access | `\\\\x1b\\\\]\\|\\\\033\\\\]\\|writeOsc\\|xterm` |\n| External clipboard tools | Clipboard via spawned process | `pbcopy\\|xclip\\|xsel\\|clip\\.exe` |\n\n**Layer 2 -- This check relies on reasoning more than any other:**\n\n1. **Build Resource Inventory:**\n\n   | Resource | Exclusive? | Accessor 1 | Accessor 2 | Sync present? |\n   |----------|-----------|------------|------------|---------------|\n\n2. **Trace Timeline:**\n   ```\n   t=0ms  operation_A() -> resource_X accessed\n   t=?ms  side_effect   -> resource_X accessed by external process\n   t=?ms  operation_B() -> resource_X accessed again -> CONFLICT?\n   ```\n\n3. **Critical Questions:**\n   - Can another process (terminal, OS, child) access this resource simultaneously?\n   - Does this operation have invisible side effects on shared OS resources?\n   - What happens if the external process is slower\u002Ffaster than expected?\n   - What happens if user triggers this action twice rapidly?\n\n**Severity:** CRITICAL (two accessors to exclusive OS resource without sync) | HIGH (subprocess + shared file without lock) | HIGH (invisible side effect detected via reasoning)\n\n**Safe pattern exclusions:** Single accessor. Retry\u002Fbackoff pattern present. Operations sequenced with explicit delay\u002Fawait.\n\n**Effort:** M-L (may require removing redundant access path)\n\n## Scoring Algorithm\n\n**MANDATORY READ:** Load `references\u002Faudit_scoring.md`.\n\n## Output Format\n\n**MANDATORY READ:** Load `references\u002Ftemplates\u002Faudit_worker_report_template.md`.\n\nWrite JSON summary per `references\u002Faudit_summary_contract.md`. In managed mode the caller passes both `runId` and `summaryArtifactPath`; in standalone mode the worker generates its own run-scoped artifact path per shared contract.\n\nWrite report to `{output_dir}\u002Fln-628--global.md` with `category: \"Concurrency\"` and checks: async_races, thread_safety, toctou, deadlock_potential, blocking_io, resource_contention, cross_process_races.\n\nReturn summary per `references\u002Faudit_summary_contract.md`.\n\nWhen `summaryArtifactPath` is absent, write the standalone runtime summary under `.hex-skills\u002Fruntime-artifacts\u002Fruns\u002F{run_id}\u002Fevaluation-worker\u002F{worker}--{identifier}.json` and optionally echo the same summary in structured output.\n```\nReport written: .hex-skills\u002Fruntime-artifacts\u002Fruns\u002F{run_id}\u002Faudit-report\u002Fln-628--global.md\nScore: X.X\u002F10 | Issues: N (C:N H:N M:N L:N)\n```\n\n## Critical Rules\n\nApply the already-loaded `references\u002Faudit_worker_core_contract.md`.\n\n- **Do not auto-fix:** Report only -- concurrency fixes require careful human review\n- **Two-layer detection:** Always apply Layer 2 reasoning after Layer 1 grep. Never report raw grep matches without context analysis\n- **Language-aware detection:** Use language-specific patterns per check\n- **Unified CRITICAL escalation:** Any finding in payment\u002Fauth\u002Ffinancial code = CRITICAL\n- **Effort realism:** S = \u003C1h, M = 1-4h, L = >4h\n- **Exclusions:** Skip test files, skip single-threaded CLI tools, skip generated code\n- **Unique angle:** Audit concurrency correctness only. Do not audit lifecycle readiness, layer ownership, or local code style.\n- **Action required:** Every finding uses `FIX_RACE`, `FIX_DEADLOCK`, or `CONTROL_ASYNC_SIDE_EFFECT`.\n\n## Definition of Done\n\nApply the already-loaded `references\u002Faudit_worker_core_contract.md`.\n\n- [ ] contextStore parsed (language, concurrency model, output_dir)\n- [ ] All 7 checks completed with two-layer detection:\n  - async races, thread safety, TOCTOU, deadlock potential, blocking I\u002FO, resource contention, cross-process races\n- [ ] Layer 2 reasoning applied to each candidate (confirmed \u002F FP \u002F needs-context)\n- [ ] Findings collected with severity, location, effort, action, recommendation\n- [ ] Score calculated per `references\u002Faudit_scoring.md`\n- [ ] Report written to `{output_dir}\u002Fln-628--global.md` (atomic single Write call)\n- [ ] Summary written per contract\n\n## Reference Files\n\n- **Two-layer detection methodology:** `references\u002Ftwo_layer_detection.md`\n- **Audit output schema:** `references\u002Faudit_output_schema.md`\n\n---\n**Version:** 4.0.0\n**Last Updated:** 2026-03-04\n","> **Paths:** File paths (`references\u002F`, `..\u002Fln-*`) are relative to this skill directory.\n\n# Concurrency Correctness Auditor (L3 Worker)\n\n**Type:** L3 Worker\n\nSpecialized worker auditing concurrency correctness, async hazards, and cross-process resource access.\n\n## Purpose & Scope\n\n- Audit **concurrency** (Category 11: High Priority)\n- 7 checks: async races, thread safety, TOCTOU, deadlocks, blocking I\u002FO, resource contention, cross-process races\n- Two-layer detection: grep finds candidates, agent reasons about context\n- Emit `FIX_RACE`, `FIX_DEADLOCK`, or `CONTROL_ASYNC_SIDE_EFFECT`\n- Calculate compliance score (X\u002F10)\n\n## Inputs\n\n**MANDATORY READ:** Load `references\u002Faudit_worker_core_contract.md`.\nTool policy: follow host AGENTS.md MCP preferences; load `references\u002Fmcp_tool_preferences.md` and `references\u002Fmcp_integration_patterns.md` only when host policy is absent or MCP behavior is unclear.\n\nReceives `contextStore` with: `tech_stack`, `best_practices`, `codebase_root`, `output_dir`.\n\nUse `hex-graph` first when dataflow or call-path analysis materially improves concurrency findings. Use `hex-line` first for local code reads when available. If MCP is unavailable, unsupported, or not indexed, continue with built-in `Read\u002FGrep\u002FGlob\u002FBash` and state the fallback in the report.\n\n## Workflow\n\nDetection policy: use two-layer detection (candidate scan, then context verification); load `references\u002Ftwo_layer_detection.md` only when the verification method is ambiguous.\n\n1) **Parse context** -- extract tech_stack, language, output_dir from contextStore\n2) **Per check (1-7):**\n   - **Layer 1:** Grep\u002FGlob scan to find candidates\n   - **Layer 2:** Read 20-50 lines around each candidate. Apply check-specific critical questions. Classify: confirmed \u002F false positive \u002F needs-context\n3) **Collect** confirmed findings with severity, location, effort, recommendation\n4) **Calculate score** per `references\u002Faudit_scoring.md`\n5) **Write Report** -- build in memory, write to `{output_dir}\u002Fln-628--global.md` (atomic single Write)\n6) **Return Summary**\n\n## Audit Rules\n\n**Unified severity escalation:** For ALL checks -- if finding affects payment\u002Fauth\u002Ffinancial code -> escalate to **CRITICAL** regardless of other factors.\n\n### 1. Async\u002FEvent-Loop Races (CWE-362)\n\n**What:** Shared state corrupted across await\u002Fyield boundaries in single-threaded async code.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Pattern | Grep |\n|----------|---------|------|\n| JS\u002FTS | Read-modify-write across await | `\\w+\\s*[+\\-*\u002F]?=\\s*.*await` (e.g., `result += await something`) |\n| JS\u002FTS | Check-then-initialize race | `if\\s*\\(!?\\w+\\)` followed by `\\w+\\s*=\\s*await` in same block |\n| Python | Read-modify-write across await | `\\w+\\s*[+\\-*\u002F]?=\\s*await` inside `async def` |\n| Python | Shared module-level state in async | Module-level `\\w+\\s*=` + modified inside `async def` |\n| All | Shared cache without lock | `\\.set\\(|\\.put\\(|\\[\\w+\\]\\s*=` in async function without lock\u002Fmutex nearby |\n\n**Layer 2 -- Critical questions:**\n- Is the variable shared (module\u002Fglobal scope) or local?\n- Can two async tasks interleave at this await point?\n- Is there a lock\u002Fmutex\u002Fsemaphore guarding the access?\n\n**Severity:** CRITICAL (payment\u002Fauth) | HIGH (user-facing) | MEDIUM (background)\n\n**Safe pattern exclusions:** Local variables, `const` declarations, single-use await (no interleaving possible).\n\n**Effort:** M\n\n### 2. Thread\u002FGoroutine Safety (CWE-366)\n\n**What:** Shared mutable state accessed from multiple threads\u002Fgoroutines without synchronization.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Pattern | Grep |\n|----------|---------|------|\n| Go | Map access without mutex | `map\\[.*\\].*=` in struct without `sync.Mutex` or `sync.RWMutex` |\n| Go | Variable captured by goroutine | `go func` + variable from outer scope modified |\n| Python | Global modified in threads | `global\\s+\\w+` in function + `threading.Thread` in same file |\n| Java | HashMap shared between threads | `HashMap` + `Thread\\|Executor\\|Runnable` in same class without `synchronized\\|ConcurrentHashMap` |\n| Rust | Rc in multi-thread context | `Rc\u003CRefCell` + `thread::spawn\\|tokio::spawn` in same file |\n| Node.js | Worker Threads shared state | `workerData\\|SharedArrayBuffer\\|parentPort` + mutable access without `Atomics` |\n\n**Layer 2 -- Critical questions:**\n- Is this struct\u002Fobject actually shared between threads? (single-threaded code -> FP)\n- Is mutex\u002Flock in embedded struct or imported module? (grep may miss it)\n- Is `go func` capturing by value (safe) or by reference (unsafe)?\n\n**Severity:** CRITICAL (payment\u002Fauth) | HIGH (data corruption possible) | MEDIUM (internal)\n\n**Safe pattern exclusions:** Go map in `init()` or `main()` before goroutines start. Rust `Arc\u003CMutex\u003CT>>` (already safe). Java `Collections.synchronizedMap()`.\n\n**Effort:** M\n\n### 3. TOCTOU -- Time-of-Check Time-of-Use (CWE-367)\n\n**What:** Resource state checked, then used, but state can change between check and use.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Check | Use | Grep |\n|----------|-------|-----|------|\n| Python | `os.path.exists()` | `open()` | `os\\.path\\.exists\\(` near `open\\(` on same variable |\n| Python | `os.access()` | `os.open()` | `os\\.access\\(` near `os\\.open\\(\\|open\\(` |\n| Node.js | `fs.existsSync()` | `fs.readFileSync()` | `existsSync\\(` near `readFileSync\\(\\|readFile\\(` |\n| Node.js | `fs.accessSync()` | `fs.openSync()` | `accessSync\\(` near `openSync\\(` |\n| Go | `os.Stat()` | `os.Open()` | `os\\.Stat\\(` near `os\\.Open\\(\\|os\\.Create\\(` |\n| Java | `.exists()` | `new FileInputStream` | `\\.exists\\(\\)` near `new File\\|FileInputStream\\|FileOutputStream` |\n\n**Layer 2 -- Critical questions:**\n- Is the check used for control flow (vulnerable) or just logging (safe)?\n- Is there a lock\u002Fretry around the check-then-use sequence?\n- Is the file in a temp directory controlled by the application (lower risk)?\n- Could an attacker substitute the file (symlink attack)?\n\n**Severity:** CRITICAL (security-sensitive: permissions, auth tokens, configs) | HIGH (user-facing file ops) | MEDIUM (internal\u002Fbackground)\n\n**Safe pattern exclusions:** Check inside try\u002Fcatch with retry. Check for logging\u002Fmetrics only. Check + use wrapped in file lock.\n\n**Effort:** S-M (replace check-then-use with direct use + error handling)\n\n### 4. Deadlock Potential (CWE-833)\n\n**What:** Lock acquisition in inconsistent order, or lock held during blocking operation.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Pattern | Grep |\n|----------|---------|------|\n| Python | Nested locks | `with\\s+\\w+_lock:` (multiline: two different locks nested) |\n| Python | Lock in loop | `for.*:` with `\\.acquire\\(\\)` inside loop body |\n| Python | Lock + external call | `\\.acquire\\(\\)` followed by `await\\|requests\\.\\|urllib` before release |\n| Go | Missing defer unlock | `\\.Lock\\(\\)` without `defer.*\\.Unlock\\(\\)` on next line |\n| Go | Nested locks | Two `\\.Lock\\(\\)` calls in same function without intervening `\\.Unlock\\(\\)` |\n| Java | Nested synchronized | `synchronized\\s*\\(` (multiline: nested blocks with different monitors) |\n| JS | Async mutex nesting | `await\\s+\\w+\\.acquire\\(\\)` (two different mutexes in same function) |\n\n**Layer 2 -- Critical questions:**\n- Are these the same lock (reentrant = OK) or different locks (deadlock risk)?\n- Is the lock ordering consistent across all call sites?\n- Does the external call inside lock have a timeout?\n\n**Severity:** CRITICAL (payment\u002Fauth) | HIGH (app freeze risk)\n\n**Safe pattern exclusions:** Reentrant locks (same lock acquired twice). Locks with explicit timeout (`asyncio.wait_for`, `tryLock`).\n\n**Effort:** L (lock ordering redesign)\n\n### 5. Blocking I\u002FO in Async Context (CWE-400)\n\n**What:** Synchronous blocking calls inside async functions or event loop handlers.\n\n**Layer 1 -- Grep patterns:**\n\n| Language | Blocking Call | Grep | Replacement |\n|----------|--------------|------|-------------|\n| Python | `time.sleep` in async def | `time\\.sleep` inside `async def` | `await asyncio.sleep` |\n| Python | `requests.*` in async def | `requests\\.(get\\|post\\|put\\|delete)` inside `async def` | `httpx` or `aiohttp` |\n| Python | `open()` in async def | `open\\(` inside `async def` | `aiofiles.open` |\n| Node.js | `fs.readFileSync` in async | `fs\\.readFileSync\\|fs\\.writeFileSync\\|fs\\.mkdirSync` | `fs.promises.*` |\n| Node.js | `execSync` in async | `execSync\\|spawnSync` in async handler | `exec` with promises |\n| Node.js | Sync crypto in async | `crypto\\.pbkdf2Sync\\|crypto\\.scryptSync` | `crypto.pbkdf2` (callback) |\n\n**Layer 2 -- Critical questions:**\n- Is this in a hot path (API handler) or cold path (startup script)?\n- Is the blocking duration significant (>100ms)?\n- Is there a legitimate reason (e.g., sync read of small config at startup)?\n\n**Severity:** HIGH (blocks event loop\u002Fasync context) | MEDIUM (minor blocking \u003C100ms)\n\n**Safe pattern exclusions:** Blocking call in `if __name__ == \"__main__\"` (startup). `readFileSync` in config loading at init time. Sync crypto for small inputs.\n\n**Effort:** S-M (replace with async alternative)\n\n### 6. Resource Contention (CWE-362)\n\n**What:** Multiple concurrent accessors compete for same resource without coordination.\n\n**Layer 1 -- Grep patterns:**\n\n| Pattern | Risk | Grep |\n|---------|------|------|\n| Shared memory without sync | Data corruption | `SharedArrayBuffer\\|SharedMemory\\|shm_open\\|mmap` without `Atomics\\|Mutex\\|Lock` nearby |\n| IPC without coordination | Message ordering | `process\\.send\\|parentPort\\.postMessage` in concurrent loops |\n| Concurrent file append | Interleaved writes | Multiple `appendFile\\|fs\\.write` to same path from parallel tasks |\n\n**Layer 2 -- Critical questions:**\n- Are multiple writers actually concurrent? (Sequential = safe)\n- Is there OS-level atomicity guarantee? (e.g., `O_APPEND` for small writes)\n- Is ordering important for correctness?\n\n**Severity:** HIGH (data corruption) | MEDIUM (ordering issues)\n\n**Safe pattern exclusions:** Single writer pattern. OS-guaranteed atomic operations (small pipe writes, `O_APPEND`). Message queues with ordering guarantees.\n\n**Effort:** M\n\n### 7. Cross-Process & Invisible Side Effects (CWE-362, CWE-421)\n\n**What:** Multiple processes or process+OS accessing same exclusive resource, including operations with non-obvious side effects on shared OS resources.\n\n**Layer 1 -- Grep entry points:**\n\n| Pattern | Risk | Grep |\n|---------|------|------|\n| Clipboard dual access | OSC 52 + native clipboard in same flow | `osc52\\|\\\\x1b\\\\]52` AND `clipboard\\|SetClipboardData\\|pbcopy\\|xclip` in same file |\n| Subprocess + shared file | Parent and child write same file | `spawn\\|exec\\|Popen` + `writeFile\\|open.*\"w\"` on same path |\n| OS exclusive resource | Win32 clipboard, serial port, named pipe | `OpenClipboard\\|serial\\.Serial\\|CreateNamedPipe\\|mkfifo` |\n| Terminal escape sequences | stdout triggers terminal OS access | `\\\\x1b\\\\]\\|\\\\033\\\\]\\|writeOsc\\|xterm` |\n| External clipboard tools | Clipboard via spawned process | `pbcopy\\|xclip\\|xsel\\|clip\\.exe` |\n\n**Layer 2 -- This check relies on reasoning more than any other:**\n\n1. **Build Resource Inventory:**\n\n   | Resource | Exclusive? | Accessor 1 | Accessor 2 | Sync present? |\n   |----------|-----------|------------|------------|---------------|\n\n2. **Trace Timeline:**\n   ```\n   t=0ms  operation_A() -> resource_X accessed\n   t=?ms  side_effect   -> resource_X accessed by external process\n   t=?ms  operation_B() -> resource_X accessed again -> CONFLICT?\n   ```\n\n3. **Critical Questions:**\n   - Can another process (terminal, OS, child) access this resource simultaneously?\n   - Does this operation have invisible side effects on shared OS resources?\n   - What happens if the external process is slower\u002Ffaster than expected?\n   - What happens if user triggers this action twice rapidly?\n\n**Severity:** CRITICAL (two accessors to exclusive OS resource without sync) | HIGH (subprocess + shared file without lock) | HIGH (invisible side effect detected via reasoning)\n\n**Safe pattern exclusions:** Single accessor. Retry\u002Fbackoff pattern present. Operations sequenced with explicit delay\u002Fawait.\n\n**Effort:** M-L (may require removing redundant access path)\n\n## Scoring Algorithm\n\n**MANDATORY READ:** Load `references\u002Faudit_scoring.md`.\n\n## Output Format\n\n**MANDATORY READ:** Load `references\u002Ftemplates\u002Faudit_worker_report_template.md`.\n\nWrite JSON summary per `references\u002Faudit_summary_contract.md`. In managed mode the caller passes both `runId` and `summaryArtifactPath`; in standalone mode the worker generates its own run-scoped artifact path per shared contract.\n\nWrite report to `{output_dir}\u002Fln-628--global.md` with `category: \"Concurrency\"` and checks: async_races, thread_safety, toctou, deadlock_potential, blocking_io, resource_contention, cross_process_races.\n\nReturn summary per `references\u002Faudit_summary_contract.md`.\n\nWhen `summaryArtifactPath` is absent, write the standalone runtime summary under `.hex-skills\u002Fruntime-artifacts\u002Fruns\u002F{run_id}\u002Fevaluation-worker\u002F{worker}--{identifier}.json` and optionally echo the same summary in structured output.\n```\nReport written: .hex-skills\u002Fruntime-artifacts\u002Fruns\u002F{run_id}\u002Faudit-report\u002Fln-628--global.md\nScore: X.X\u002F10 | Issues: N (C:N H:N M:N L:N)\n```\n\n## Critical Rules\n\nApply the already-loaded `references\u002Faudit_worker_core_contract.md`.\n\n- **Do not auto-fix:** Report only -- concurrency fixes require careful human review\n- **Two-layer detection:** Always apply Layer 2 reasoning after Layer 1 grep. Never report raw grep matches without context analysis\n- **Language-aware detection:** Use language-specific patterns per check\n- **Unified CRITICAL escalation:** Any finding in payment\u002Fauth\u002Ffinancial code = CRITICAL\n- **Effort realism:** S = \u003C1h, M = 1-4h, L = >4h\n- **Exclusions:** Skip test files, skip single-threaded CLI tools, skip generated code\n- **Unique angle:** Audit concurrency correctness only. Do not audit lifecycle readiness, layer ownership, or local code style.\n- **Action required:** Every finding uses `FIX_RACE`, `FIX_DEADLOCK`, or `CONTROL_ASYNC_SIDE_EFFECT`.\n\n## Definition of Done\n\nApply the already-loaded `references\u002Faudit_worker_core_contract.md`.\n\n- [ ] contextStore parsed (language, concurrency model, output_dir)\n- [ ] All 7 checks completed with two-layer detection:\n  - async races, thread safety, TOCTOU, deadlock potential, blocking I\u002FO, resource contention, cross-process races\n- [ ] Layer 2 reasoning applied to each candidate (confirmed \u002F FP \u002F needs-context)\n- [ ] Findings collected with severity, location, effort, action, recommendation\n- [ ] Score calculated per `references\u002Faudit_scoring.md`\n- [ ] Report written to `{output_dir}\u002Fln-628--global.md` (atomic single Write call)\n- [ ] Summary written per contract\n\n## Reference Files\n\n- **Two-layer detection methodology:** `references\u002Ftwo_layer_detection.md`\n- **Audit output schema:** `references\u002Faudit_output_schema.md`\n\n---\n**Version:** 4.0.0\n**Last Updated:** 2026-03-04\n",{"name":5,"license":15,"description":7,"allowed-tools":49},"Read, Grep, Glob, Bash, mcp__hex-graph__trace_dataflow, mcp__hex-graph__trace_paths, mcp__hex-line__read_file, mcp__hex-line__grep_search, mcp__hex-line__outline","main","fbfb242f793fdf040f3a1a6b100896c188c228c8","_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor",1,"https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog","https:\u002F\u002Fgithub.com\u002Fvitalikpestov","Listing on crypto exchanges","2026-06-15 22:12:56",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add vitalikpestov\u002FSkills-Catalog --skill ln-628-concurrency-correctness-auditor",{"tool":64,"command":65},"bunx","bunx skills add vitalikpestov\u002FSkills-Catalog --skill ln-628-concurrency-correctness-auditor",{"tool":67,"command":68},"pnpm","pnpm dlx skills add vitalikpestov\u002FSkills-Catalog --skill ln-628-concurrency-correctness-auditor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002FSKILL.md",true,[72,78,82,86,90,94,98,102],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Faudit_output_schema.md","REFERENCE","参考文档",4439,"https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002Freferences\u002Faudit_output_schema.md",{"path":79,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Faudit_scoring.md",1117,"https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002Freferences\u002Faudit_scoring.md",{"path":83,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Faudit_summary_contract.md",2206,"https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002Freferences\u002Faudit_summary_contract.md",{"path":87,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Faudit_worker_core_contract.md",1851,"https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002Freferences\u002Faudit_worker_core_contract.md",{"path":91,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fmcp_integration_patterns.md",1567,"https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002Freferences\u002Fmcp_integration_patterns.md",{"path":95,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fmcp_tool_preferences.md",2338,"https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002Freferences\u002Fmcp_tool_preferences.md",{"path":99,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Ftemplates\u002Faudit_worker_report_template.md",1686,"https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002Freferences\u002Ftemplates\u002Faudit_worker_report_template.md",{"path":103,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Ftwo_layer_detection.md",1504,"https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_AI-Automation\u002Fclaude-code-skills-levnikolaevich\u002Fplugins\u002Fcodebase-audit-suite\u002Fskills\u002Fln-628-concurrency-correctness-auditor\u002Freferences\u002Ftwo_layer_detection.md",[107,145,169,184,207,240],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":125,"publishedAt":144},"01M71V1MC994P553631JZSWVYD","solana-dev","Use when user asks to \"build a Solana dapp\", \"write an Anchor program\", \"create a token\", \"debug Solana errors\", \"set up wallet connection\", \"test my Solana program\", \"deploy to devnet\", or \"explain Solana concepts\" (rent, accounts, PDAs, CPIs, etc.). End-to-end Solana development playbook covering wallet connection, Anchor\u002FPinocchio programs, Codama client generation, LiteSVM\u002FMollusk\u002FSurfpool testing, and security checklists. Integrates with the Solana MCP server for live documentation search. Prefers framework-kit (@solana\u002Fclient + @solana\u002Freact-hooks) for UI, wallet-standard-first connection (incl. ConnectorKit), @solana\u002Fkit for client\u002FRPC code, and @solana\u002Fweb3-compat for legacy boundaries.","https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_Web3\u002Fsolana-dev\u002Fskill\u002FSKILL.md",[113,116,119,120],{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[126,127,128,129,42,130,131,132,39,133,134,135,136,137,138,139,140,141,142,143],"dev","solana dev","solana","Wallet","testing","solana cli","kit","web3","react","create","server","write","playbook","live","security","ui","concepts","toolchain","2026-11-10 13:02:02",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":144},"01M71TYQPHE2YGKTT7DG9QCW3K","generating-trading-signals","Generate trading signals using technical indicators (RSI, MACD, Bollinger Bands, etc.).\nCombines multiple indicators into composite signals with confidence scores.\nUse when analyzing assets for trading opportunities or checking technical indicators.\nTrigger with phrases like \"get trading signals\", \"check indicators\", \"analyze for entry\",\n\"scan for opportunities\", \"generate buy\u002Fsell signals\", or \"technical analysis\".","https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_Trading-Finance\u002Fgenerating-trading-signals\u002FSKILL.md",[],[152,153,154,155,156,157,158,159,160,161,162,163,38,37,36,164,165,166,167,168],"generating trading signals","signals","trading signals","trading","get","technical indicators","for","scan","rsi","trigger","python","technical","analysis","code","io","check","analyze",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":144},"01M71TY4CR3GKGQ3M12X9WN95Y","prediction-monitor","Prediction Monitor - Auto-activating skill for ML Deployment.\nTriggers on: prediction monitor, prediction monitor\nPart of the ML Deployment skill category.","https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_Trading-Finance\u002FAI Predictions\u002Fprediction-monitor\u002FSKILL.md",[],[176,177,178,158,179,31,137,180,181,29,182,183,36],"prediction","monitor","prediction monitor","deployment","edit","triggers","auto","ml",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":144},"01M71TXD9MYXZC39HCPP909HTZ","strategy-advisor","High-level strategic thinking and business decision guidance for planning and direction-setting.\nUse when: making strategic decisions, evaluating business options, setting direction, analyzing\ntrade-offs, or when user mentions strategy, business planning, competitive analysis, or long-term planning.","https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_Product-Apps\u002Fstrategy-advisor\u002FSKILL.md",[],[191,192,193,194,195,196,197,198,199,158,200,201,202,38,203,204,37,205,164,206],"strategy advisor","strategy","advisor","competitive","setting","thinking","planning","direction","trade-offs","long","decision","strategic","business","apps","decisions","trade",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":211,"sourceHtmlUrl":212,"categories":213,"keywords":220,"publishedAt":144},"01M71TWHBT2R1P1FNWTW67ZREP","app-paywall-pilot","Design, audit, debug, and implement App Store-compliant mobile paywalls, subscription flows, pricing screens, trials, offers, feature gates, and subscription lifecycle UX. Use when the user asks to audit my paywall, fix App Store 3.1.2 rejection, improve trial-to-paid, choose plans\u002Fprices\u002Ftrials, review RevenueCat\u002FAdapty\u002FApphud\u002FSuperwall setup, calculate LTV\u002FROAS, or build paywall implementation.","https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_Product-Apps\u002Ffrom-dosesync\u002Fapp-paywall-pilot\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_Product-Apps\u002Ffrom-dosesync\u002Fapp-paywall-pilot\u002FSKILL.md",[214,217],{"categoryNo":215,"categoryName":216,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":218,"categoryName":219,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000032","设计师",[221,222,223,224,225,226,227,228,229,230,231,232,37,233,234,235,236,237,238,239],"app","paywall","app paywall pilot","paid","paywalls","prices","choose","flows","fix","improve","design","app store","review","audit","ux","subscription","mobile","my","calculate",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":244,"licenseFileUrl":245,"sourceHtmlUrl":246,"categories":247,"keywords":250,"publishedAt":144},"01M71TWET8GFKEB7ZHJPMQX29V","figma","Use the Figma MCP server to fetch design context, screenshots, variables, and assets from Figma, and to translate Figma nodes into production code. Trigger when a task involves Figma URLs, node IDs, design-to-code implementation, or Figma MCP setup and troubleshooting.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_Product-Apps\u002Ffigma\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fvitalikpestov\u002FSkills-Catalog\u002Fblob\u002Fmain\u002F_Product-Apps\u002Ffigma\u002FSKILL.md",[248,249],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":218,"categoryName":219,"taxonomyType":123,"taxonomyTypeDesc":124},[242,251,252,253,254,161,231,39,38,37,255,256,165,257,136,258,259,260,261,262],"fetch","ids","mcp setup","translate","mcp server","Variables","task","Nodes","figma mcp","code implementation","node","assets"]