[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71R0FRQRPFS9ACG07C23VYS":3,"skill-same:01M71R0FRQRPFS9ACG07C23VYS":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":13,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":51,"install":52,"resources":65},"01M71R0FRQRPFS9ACG07C23VYS","auth-hardening",null,"Trigger: auth, JWT, OAuth, RBAC, CSRF, session, login, password hashing. Audit and harden auth flows.","LuisAlbertoMK\u002Fgentleman-agent-gh","LuisAlbertoMK","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F96153499?v=4","01M71QZX0CF9KKGQZ8ZN9BME63","01M71QZX11P5X6Z27HE1GQDF71",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fauth-hardening\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"auth","hardening","auth hardening","cookie","docs","login","flows","trigger","token","harden","hashing","session","password","csrf","jwt","authorization","OAuth","audit","authentication","rbac","2026-11-10 13:02:02",false,"---\nname: auth-hardening\ndescription: \"Trigger: auth, JWT, OAuth, RBAC, CSRF, session, login, password hashing. Audit and harden auth flows.\"\ntriggers: \"auth, authentication, authorization, JWT, OAuth, RBAC, CSRF, session, login, password hashing, token, cookie\"\nchangelog: docs\u002Fciclos\u002Fcycle28-20260815.md\ntoken_budget: 3471\n---\n\n## When to Use\nReview auth flows, login, tokens, RBAC — \"is this auth secure?\"\n\n## TESTING (3 patterns)\nAuth integration: test DB → `POST \u002Flogin` → 200 + `Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax`\nToken validation: expired JWT→401; `alg=none`→401; wrong aud→403\nRBAC matrix: parametrize roles×endpoints → 200 allowed, 403 denied, no 500s\n\n## CHECKLIST (sev: pattern)\nCRIT: JWT alg=none `algorithm.*[\"']none[\"']` | Hardcoded secret `secret\\s*=\\s*[\"'][^\"']+[\"']` excl env | MD5\u002FSHA1 password `md5\\|sha1`\nHIGH: No CSRF on POST | OAuth no PKCE `auth_code` w\u002Fo `code_verifier` | No HttpOnly `httpOnly.*false` | JWT no expiry `expiresIn` missing\u002F>24h | Role after fetch | No refresh rotation\nMED: Session fixation (login doesn't regenerate ID)\n\n## OUTPUT\n```\n## Auth Hardening: {scope}\n### Summary\n- JWT:{N} OAuth:{N} RBAC:{N} CSRF:{N} Sessions:{N} Passwords:{N}\n### Issues\n# CRITICAL: {type} in {file:line}\n- Pattern: `{found}` → Fix: `{fix}`\n```\n\n## Rules\n1. JWT alg FIRST. 2. Role checks BEFORE data. 3. CSRF on ALL state-changing. 4. bcrypt\u002Fargon2 ONLY. 5. \"Remaining risk: NONE\u002FLOW\u002FMED\u002FHIGH (why)\"\n\n## Anti-Rationalization\n\n| Rationalization | Red Flag | Verification |\n|-----------------|----------|--------------|\n| \"JWT HS256 default porque es fácil\" | HS256 sin rotación\u002F`alg=none` permitido | JWT alg FIRST + test `alg=none`→401, `expiresIn` check |\n| \"PKCE opcional\" | OAuth `auth_code` sin `code_verifier` | CHECKLIST PKCE HIGH + grep `code_verifier` |\n| \"CSRF solo para cookies\" | POST\u002FPUT sin token CSRF | Rule 3 CSRF on ALL state-changing + grep `csrf` |\n\n## Red Flags\n- Doing work without checking output format → STOP, re-read skill\n- Second occurrence of same rationalization → force RED zone\n\n## Verification\n- Output matches skill ## Output contract + file:line citaton\n- cross-ref-check.ps1 → SKILL.md OK\n## API REST Playbook\nJWT: alg allowlist HS256\u002FRS256\u002FES256 - REJECT none\u002Falg-confusion\u002Fsymmetric+pubkey | exp required server-clock skew\u003C=60s | aud+iss match else 401\nAuthZ: BOLA userA->\u002Fusers\u002F{B} 403\u002F404 never 200 | bulk foreign ids per-item reject | BOPLA mass-assign strict allowlist (zod\u002Fjoi\u002Fpydantic) | IDOR roles x endpoints no 500s\nJWT keys: jku\u002Fx5u REJECT unless explicit https allowlist (TLS verify, no user-controlled URL) | x5c\u002Fx5t: chain vs TRUST STORE + revocation - never self-declared | kid: server-side allowlist lookup only - no path\u002Findex traversal, no weak-key (alg-confusion) selection\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 6)\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 1)\n## SPA Playbook (token storage \u002F cookie-auth CSRF)\nToken storage: httpOnly cookie=cookie-auth XSS-leak-proof (JS can't read) | sessionStorage=same-tab ephemeral only | localStorage NEVER for access\u002Frefresh tokens (any injected script reads it)\nCookies: Secure+HttpOnly+SameSite=Lax (Strict for money) + Path=\u002F | CSRF: token header\u002Fdouble-submit on POST\u002FPUT\u002FDELETE when cookie-auth, fetch credentials:'include', logout=Max-Age 0\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 2)\n## Refs\nsecurity-scanner · best-practices · quality-gate · code-review-agent · llm-security · container-security · infra-audit\n\n## Anti-Patterns (8)\nFlag bcrypt weak · Skip JWT alg · Happy path only · Ignore refresh tokens · Client-side-only roles · Flag env vars hardcoded · Use `alg: none` for testing · Store JWT in localStorage\n## Reference\n> docs\u002Fskills\u002Fauth-hardening\u002Freference.md\n\n","## When to Use\nReview auth flows, login, tokens, RBAC — \"is this auth secure?\"\n\n## TESTING (3 patterns)\nAuth integration: test DB → `POST \u002Flogin` → 200 + `Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax`\nToken validation: expired JWT→401; `alg=none`→401; wrong aud→403\nRBAC matrix: parametrize roles×endpoints → 200 allowed, 403 denied, no 500s\n\n## CHECKLIST (sev: pattern)\nCRIT: JWT alg=none `algorithm.*[\"']none[\"']` | Hardcoded secret `secret\\s*=\\s*[\"'][^\"']+[\"']` excl env | MD5\u002FSHA1 password `md5\\|sha1`\nHIGH: No CSRF on POST | OAuth no PKCE `auth_code` w\u002Fo `code_verifier` | No HttpOnly `httpOnly.*false` | JWT no expiry `expiresIn` missing\u002F>24h | Role after fetch | No refresh rotation\nMED: Session fixation (login doesn't regenerate ID)\n\n## OUTPUT\n```\n## Auth Hardening: {scope}\n### Summary\n- JWT:{N} OAuth:{N} RBAC:{N} CSRF:{N} Sessions:{N} Passwords:{N}\n### Issues\n# CRITICAL: {type} in {file:line}\n- Pattern: `{found}` → Fix: `{fix}`\n```\n\n## Rules\n1. JWT alg FIRST. 2. Role checks BEFORE data. 3. CSRF on ALL state-changing. 4. bcrypt\u002Fargon2 ONLY. 5. \"Remaining risk: NONE\u002FLOW\u002FMED\u002FHIGH (why)\"\n\n## Anti-Rationalization\n\n| Rationalization | Red Flag | Verification |\n|-----------------|----------|--------------|\n| \"JWT HS256 default porque es fácil\" | HS256 sin rotación\u002F`alg=none` permitido | JWT alg FIRST + test `alg=none`→401, `expiresIn` check |\n| \"PKCE opcional\" | OAuth `auth_code` sin `code_verifier` | CHECKLIST PKCE HIGH + grep `code_verifier` |\n| \"CSRF solo para cookies\" | POST\u002FPUT sin token CSRF | Rule 3 CSRF on ALL state-changing + grep `csrf` |\n\n## Red Flags\n- Doing work without checking output format → STOP, re-read skill\n- Second occurrence of same rationalization → force RED zone\n\n## Verification\n- Output matches skill ## Output contract + file:line citaton\n- cross-ref-check.ps1 → SKILL.md OK\n## API REST Playbook\nJWT: alg allowlist HS256\u002FRS256\u002FES256 - REJECT none\u002Falg-confusion\u002Fsymmetric+pubkey | exp required server-clock skew\u003C=60s | aud+iss match else 401\nAuthZ: BOLA userA->\u002Fusers\u002F{B} 403\u002F404 never 200 | bulk foreign ids per-item reject | BOPLA mass-assign strict allowlist (zod\u002Fjoi\u002Fpydantic) | IDOR roles x endpoints no 500s\nJWT keys: jku\u002Fx5u REJECT unless explicit https allowlist (TLS verify, no user-controlled URL) | x5c\u002Fx5t: chain vs TRUST STORE + revocation - never self-declared | kid: server-side allowlist lookup only - no path\u002Findex traversal, no weak-key (alg-confusion) selection\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 6)\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 1)\n## SPA Playbook (token storage \u002F cookie-auth CSRF)\nToken storage: httpOnly cookie=cookie-auth XSS-leak-proof (JS can't read) | sessionStorage=same-tab ephemeral only | localStorage NEVER for access\u002Frefresh tokens (any injected script reads it)\nCookies: Secure+HttpOnly+SameSite=Lax (Strict for money) + Path=\u002F | CSRF: token header\u002Fdouble-submit on POST\u002FPUT\u002FDELETE when cookie-auth, fetch credentials:'include', logout=Max-Age 0\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 2)\n## Refs\nsecurity-scanner · best-practices · quality-gate · code-review-agent · llm-security · container-security · infra-audit\n\n## Anti-Patterns (8)\nFlag bcrypt weak · Skip JWT alg · Happy path only · Ignore refresh tokens · Client-side-only roles · Flag env vars hardcoded · Use `alg: none` for testing · Store JWT in localStorage\n## Reference\n> docs\u002Fskills\u002Fauth-hardening\u002Freference.md\n\n",{"name":5,"triggers":43,"changelog":44,"description":7,"token_budget":45},"auth, authentication, authorization, JWT, OAuth, RBAC, CSRF, session, login, password hashing, token, cookie","docs\u002Fciclos\u002Fcycle28-20260815.md",3471,"main","4af6946b30783e2c8f9182082324d530fc28f838",".agents\u002Fskills\u002Fauth-hardening","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK","2026-11-10 18:34:27",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add LuisAlbertoMK\u002Fgentleman-agent-gh --skill auth-hardening",{"tool":58,"command":59},"bunx","bunx skills add LuisAlbertoMK\u002Fgentleman-agent-gh --skill auth-hardening",{"tool":61,"command":62},"pnpm","pnpm dlx skills add LuisAlbertoMK\u002Fgentleman-agent-gh --skill auth-hardening","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fauth-hardening\u002FSKILL.md",true,[],[67,109,132,152,177,203],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":89,"publishedAt":38},"01M71R7K35P668DYEPYGDQP2QA","web-quality-audit","Comprehensive web audit: performance, a11y, SEO, responsive, animation, design tokens.","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002Fdocs\u002Fciclos\u002Fc28-w1-backup\u002Fweb-quality-audit\u002FSKILL.md",[73,78,81,86],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":79,"categoryName":80,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000019","营销推广",{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",{"categoryNo":87,"categoryName":88,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000035","市场营销",[90,91,92,35,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108],"quality","quality audit","web quality audit","web","Animation","design audit","design","website","ui","responsive","seo","tokens","ui audit","Lighthouse","performance","review","optimize","a11y","page",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":38},"01M71R7H1RA7CQ568DHRK37PE2","ui-engine","UI system — Grid\u002FFlexbox\u002F@layer\u002F:has(), container queries, compositor-only animation, OKLCH tokens, component patterns","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002Fdocs\u002Fciclos\u002Fc28-w1-backup\u002Fui-engine\u002FSKILL.md",[115],{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},[117,118,98,94,119,120,121,108,122,101,123,124,125,96,126,127,128,129,130,131],"ui engine","engine","compositor","css","dark","system","mode","hooks","container","only","query","components","dark mode","grid","queries",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":140,"publishedAt":38},"01M71R7EPMZFKB833WE4B3GTHC","baseline-ui","Anti-slop UI — layout, typography, responsive, animation, tokens. Use for cleanup or polish.","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002Fdocs\u002Fciclos\u002Fc28-w1-backup\u002Fbaseline-ui\u002FSKILL.md",[138,139],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},[141,142,98,94,143,144,145,146,101,147,125,96,148,149,150,102,151,127,130,105],"baseline ui","baseline","generic","slop","for","anti-slop","fix","interface","cleanup","design review","use",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":161,"publishedAt":38},"01M71R7CWK3FBW77Z8WD9GXQFE","skill-creator","Create new AI agent skills following Agent Skills spec -- auto-bootstrap unknown tasks, define structure, register in AGENTS.md","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.archive\u002Fskills\u002Fskill-creator\u002FSKILL.md",[158],{"categoryNo":159,"categoryName":160,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000023","Skill与智能体开发",[162,163,164,165,166,167,168,169,170,171,172,173,174,175,176],"skill creator","creator","create","structure","register","2026","spec","new","ai skill","auto","define","ai agent","unknown","tasks","bootstrap",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":185,"publishedAt":38},"01M71R78DZM1GA16F1KN8ND926","senior-engineer","Apply senior engineering competencies — system design, trade-off analysis, delegation, mentoring, and tech debt strategy","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.archive\u002Fskills\u002Fsenior-engineer\u002FSKILL.md",[183,184],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},[186,187,188,189,190,191,192,96,193,194,167,195,196,197,122,198,199,200,201,202],"engineer","senior","senior engineer","system design","trade-offs","senior engineering","delegation","senior architect","analysis","debt","architect","tech","strategy","apply","trade","tech debt","engineering",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":213,"publishedAt":38},"01M71R74WQTXZMG3219RND96CE","prompt-engineering","Design effective prompts using SPEARS framework — scope, principles, examples, assertions, refinements, with ReAct and multi-agent patterns","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.archive\u002Fskills\u002Fprompt-engineering\u002FSKILL.md",[209,212],{"categoryNo":210,"categoryName":211,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":159,"categoryName":160,"taxonomyType":76,"taxonomyTypeDesc":77},[214,215,202,216,217,96,218,167,219,220,221,222,223,224,225,226,227,228,229,230],"prompt","prompt engineering","scope","improve","react","security","patterns","multi-agent","framework","agent patterns","assertions","examples","with","multi","principles","improve prompt","prompts"]