[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71R1FJC5YGSAZYWMFDTS77W":3,"skill-same:01M71R1FJC5YGSAZYWMFDTS77W":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":13,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":69},"01M71R1FJC5YGSAZYWMFDTS77W","container-security",null,"Trigger: Dockerfile, docker-compose, Kubernetes, k8s, pod, deployment, helm. Audit container security hardening.","LuisAlbertoMK\u002Fgentleman-agent-gh","LuisAlbertoMK","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F96153499?v=4","01M71QZX0CF9KKGQZ8ZN9BME63","01M71QZX11P5X6Z27HE1GQDF71",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcontainer-security\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"security","container security","container","hardening","container security hardening","trigger","k8s","docker-compose","compose","security hardening","helm","image","audit","deployment","dockerfile","orchestration","kubernetes","docker","docs","2026-11-10 13:02:02",false,"---\nname: container-security\ndescription: \"Trigger: Dockerfile, docker-compose, Kubernetes, k8s, pod, deployment, helm. Audit container security hardening.\"\ntriggers: \"Dockerfile, docker-compose, container, image, Kubernetes, k8s, pod, deployment, helm, docker, orchestration\"\nchangelog: docs\u002Fciclos\u002Fcycle28-20260815.md\ntoken_budget: 2807\n---\n## When to Use\nReviewing Dockerfiles, docker-compose, K8s manifests, Helm charts, or \"is this container secure\"\n\n## CHECKLIST\n\n| Check | Sev | Pattern |\n|-------|-----|---------|\n| Runs as root | CRIT | Missing USER or `runAsUser: 0` |\n| ADD remote code | CRIT | `ADD http` (matches http\u002Fhttps) |\n| Secrets in ENV\u002FARG | CRIT | Visible in docker history |\n| Privileged container | CRIT | `privileged: true` |\n| Docker socket mount | CRIT | `\u002Fvar\u002Frun\u002Fdocker.sock` |\n| No securityContext | HIGH | K8s pod without securityContext |\n| hostPath volume | HIGH | Data exfil risk |\n| Dangerous caps | HIGH | SYS_ADMIN, NET_ADMIN, SYS_MODULE, SYS_RAWIO, DAC_OVERRIDE, SYS_PTRACE, SYS_CHROOT, NET_RAW, ALL |\n| No health check | MED | Missing readiness\u002Fliveness |\n| No resource limits | MED | Pod can exhaust node |\n| `latest` tag | MED | Non-reproducible |\n\n## OUTPUT\n```\n## Container Security: {scope}\n### Summary\n- Dockerfile: {N} | Compose: {N} | K8s: {N} | Image: {N}\n### Issues\n# CRITICAL: {type} in {file:line}\n- Pattern: `{found}` → Fix: `{fix}`\n```\n\n## Rules\n1. USER FIRST. 2. Secrets in ENV\u002FARG = CRITICAL. 3. Multi-stage for prod. 4. Pin versions. 5. End: \"Remaining risk: NONE\u002FLOW\u002FMED\u002FHIGH (why)\"\n\n## Anti-Rationalization\n\n| Rationalization | Red Flag | Verification |\n|-----------------|----------|--------------|\n| \"root user en dev está OK\" | Dockerfile sin `USER` \u002F `runAsUser: 0` | CHECKLIST CRIT Runs as root + Rule USER FIRST |\n| \"latest tag en prod es práctico\" | `latest`\u002F`:` sin pin | CHECKLIST `latest` tag MED + Rule Pin versions |\n| \"secrets en env vars es suficiente\" | Secrets en ENV\u002FARG visibles en history | CHECKLIST CRIT Secrets in ENV\u002FARG + grep `ENV.*SECRET` |\n\n## Red Flags\n- Skipping secrets scan → STOP, re-read skill\n- Second occurrence of same rationalization → force RED zone\n\n## Verification\n- grep -rn `process.env` + npm audit before commit\n- cross-ref-check.ps1 → SKILL.md OK\n## Containers\u002FIaC Playbook\nImage: non-root USER 10001 + runAsNonRoot + readOnlyRootFilesystem\nPriv: privileged false | drop ALL + add min | no cap-add ALL | no hostNetwork\u002FPID\u002Fsock\nSecrets: k8s Secret \u002F mounts - never ENV\u002FARG (history) | tmpfs 0444\nTags\u002FScan: pin @sha256 digest - never :latest | trivy\u002Fgrype in CI fail CRIT\u002FHIGH\nCaps: drop ALL + add min | cap-add individual FORBIDDEN: NET_ADMIN, SYS_MODULE, SYS_RAWIO, DAC_OVERRIDE, SYS_PTRACE, SYS_CHROOT, SYS_BOOT, IPC_LOCK (any=HIGH) | SYS_MODULE = kernel module load = escape vector\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 6)\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 4)\n## Refs\nsecurity-scanner · best-practices · quality-gate · auth-hardening · llm-security · infra-audit\n---\ndocs\u002Fskills\u002Fcontainer-security\u002Freference.md\n---\n\n","## When to Use\nReviewing Dockerfiles, docker-compose, K8s manifests, Helm charts, or \"is this container secure\"\n\n## CHECKLIST\n\n| Check | Sev | Pattern |\n|-------|-----|---------|\n| Runs as root | CRIT | Missing USER or `runAsUser: 0` |\n| ADD remote code | CRIT | `ADD http` (matches http\u002Fhttps) |\n| Secrets in ENV\u002FARG | CRIT | Visible in docker history |\n| Privileged container | CRIT | `privileged: true` |\n| Docker socket mount | CRIT | `\u002Fvar\u002Frun\u002Fdocker.sock` |\n| No securityContext | HIGH | K8s pod without securityContext |\n| hostPath volume | HIGH | Data exfil risk |\n| Dangerous caps | HIGH | SYS_ADMIN, NET_ADMIN, SYS_MODULE, SYS_RAWIO, DAC_OVERRIDE, SYS_PTRACE, SYS_CHROOT, NET_RAW, ALL |\n| No health check | MED | Missing readiness\u002Fliveness |\n| No resource limits | MED | Pod can exhaust node |\n| `latest` tag | MED | Non-reproducible |\n\n## OUTPUT\n```\n## Container Security: {scope}\n### Summary\n- Dockerfile: {N} | Compose: {N} | K8s: {N} | Image: {N}\n### Issues\n# CRITICAL: {type} in {file:line}\n- Pattern: `{found}` → Fix: `{fix}`\n```\n\n## Rules\n1. USER FIRST. 2. Secrets in ENV\u002FARG = CRITICAL. 3. Multi-stage for prod. 4. Pin versions. 5. End: \"Remaining risk: NONE\u002FLOW\u002FMED\u002FHIGH (why)\"\n\n## Anti-Rationalization\n\n| Rationalization | Red Flag | Verification |\n|-----------------|----------|--------------|\n| \"root user en dev está OK\" | Dockerfile sin `USER` \u002F `runAsUser: 0` | CHECKLIST CRIT Runs as root + Rule USER FIRST |\n| \"latest tag en prod es práctico\" | `latest`\u002F`:` sin pin | CHECKLIST `latest` tag MED + Rule Pin versions |\n| \"secrets en env vars es suficiente\" | Secrets en ENV\u002FARG visibles en history | CHECKLIST CRIT Secrets in ENV\u002FARG + grep `ENV.*SECRET` |\n\n## Red Flags\n- Skipping secrets scan → STOP, re-read skill\n- Second occurrence of same rationalization → force RED zone\n\n## Verification\n- grep -rn `process.env` + npm audit before commit\n- cross-ref-check.ps1 → SKILL.md OK\n## Containers\u002FIaC Playbook\nImage: non-root USER 10001 + runAsNonRoot + readOnlyRootFilesystem\nPriv: privileged false | drop ALL + add min | no cap-add ALL | no hostNetwork\u002FPID\u002Fsock\nSecrets: k8s Secret \u002F mounts - never ENV\u002FARG (history) | tmpfs 0444\nTags\u002FScan: pin @sha256 digest - never :latest | trivy\u002Fgrype in CI fail CRIT\u002FHIGH\nCaps: drop ALL + add min | cap-add individual FORBIDDEN: NET_ADMIN, SYS_MODULE, SYS_RAWIO, DAC_OVERRIDE, SYS_PTRACE, SYS_CHROOT, SYS_BOOT, IPC_LOCK (any=HIGH) | SYS_MODULE = kernel module load = escape vector\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 6)\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 4)\n## Refs\nsecurity-scanner · best-practices · quality-gate · auth-hardening · llm-security · infra-audit\n---\ndocs\u002Fskills\u002Fcontainer-security\u002Freference.md\n---\n\n",{"name":5,"triggers":47,"changelog":48,"description":7,"token_budget":49},"Dockerfile, docker-compose, container, image, Kubernetes, k8s, pod, deployment, helm, docker, orchestration","docs\u002Fciclos\u002Fcycle28-20260815.md",2807,"main","4af6946b30783e2c8f9182082324d530fc28f838",".agents\u002Fskills\u002Fcontainer-security","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK","2026-11-10 18:34:27",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add LuisAlbertoMK\u002Fgentleman-agent-gh --skill container-security",{"tool":62,"command":63},"bunx","bunx skills add LuisAlbertoMK\u002Fgentleman-agent-gh --skill container-security",{"tool":65,"command":66},"pnpm","pnpm dlx skills add LuisAlbertoMK\u002Fgentleman-agent-gh --skill container-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcontainer-security\u002FSKILL.md",true,[],[71,111,133,153,178,204],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":91,"publishedAt":42},"01M71R7K35P668DYEPYGDQP2QA","web-quality-audit","Comprehensive web audit: performance, a11y, SEO, responsive, animation, design tokens.","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002Fdocs\u002Fciclos\u002Fc28-w1-backup\u002Fweb-quality-audit\u002FSKILL.md",[77,80,83,88],{"categoryNo":78,"categoryName":79,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":81,"categoryName":82,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000019","营销推广",{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",{"categoryNo":89,"categoryName":90,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000035","市场营销",[92,93,94,35,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110],"quality","quality audit","web quality audit","web","Animation","design audit","design","website","ui","responsive","seo","tokens","ui audit","Lighthouse","performance","review","optimize","a11y","page",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":42},"01M71R7H1RA7CQ568DHRK37PE2","ui-engine","UI system — Grid\u002FFlexbox\u002F@layer\u002F:has(), container queries, compositor-only animation, OKLCH tokens, component patterns","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002Fdocs\u002Fciclos\u002Fc28-w1-backup\u002Fui-engine\u002FSKILL.md",[117],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},[119,120,100,96,121,122,123,110,124,103,125,126,25,98,127,128,129,130,131,132],"ui engine","engine","compositor","css","dark","system","mode","hooks","only","query","components","dark mode","grid","queries",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":141,"publishedAt":42},"01M71R7EPMZFKB833WE4B3GTHC","baseline-ui","Anti-slop UI — layout, typography, responsive, animation, tokens. Use for cleanup or polish.","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002Fdocs\u002Fciclos\u002Fc28-w1-backup\u002Fbaseline-ui\u002FSKILL.md",[139,140],{"categoryNo":78,"categoryName":79,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},[142,143,100,96,144,145,146,147,103,148,25,98,149,150,151,104,152,128,131,107],"baseline ui","baseline","generic","slop","for","anti-slop","fix","interface","cleanup","design review","use",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":162,"publishedAt":42},"01M71R7CWK3FBW77Z8WD9GXQFE","skill-creator","Create new AI agent skills following Agent Skills spec -- auto-bootstrap unknown tasks, define structure, register in AGENTS.md","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.archive\u002Fskills\u002Fskill-creator\u002FSKILL.md",[159],{"categoryNo":160,"categoryName":161,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[163,164,165,166,167,168,169,170,171,172,173,174,175,176,177],"skill creator","creator","create","structure","register","2026","spec","new","ai skill","auto","define","ai agent","unknown","tasks","bootstrap",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":186,"publishedAt":42},"01M71R78DZM1GA16F1KN8ND926","senior-engineer","Apply senior engineering competencies — system design, trade-off analysis, delegation, mentoring, and tech debt strategy","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.archive\u002Fskills\u002Fsenior-engineer\u002FSKILL.md",[184,185],{"categoryNo":78,"categoryName":79,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},[187,188,189,190,191,192,193,98,194,195,168,196,197,198,124,199,200,201,202,203],"engineer","senior","senior engineer","system design","trade-offs","senior engineering","delegation","senior architect","analysis","debt","architect","tech","strategy","apply","trade","tech debt","engineering",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":214,"publishedAt":42},"01M71R74WQTXZMG3219RND96CE","prompt-engineering","Design effective prompts using SPEARS framework — scope, principles, examples, assertions, refinements, with ReAct and multi-agent patterns","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.archive\u002Fskills\u002Fprompt-engineering\u002FSKILL.md",[210,213],{"categoryNo":211,"categoryName":212,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":160,"categoryName":161,"taxonomyType":20,"taxonomyTypeDesc":21},[215,216,203,217,218,98,219,168,23,220,221,222,223,224,225,226,227,228,229,230],"prompt","prompt engineering","scope","improve","react","patterns","multi-agent","framework","agent patterns","assertions","examples","with","multi","principles","improve prompt","prompts"]