[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71R5QJGAJYZ0GNG4BN5M960":3,"skill-same:01M71R5QJGAJYZ0GNG4BN5M960":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":13,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":51,"install":52,"resources":65},"01M71R5QJGAJYZ0GNG4BN5M960","security-scanner",null,"Pre-commit security scan - secrets, injection patterns, dependency vulnerabilities, supply chain risks, API usage.","LuisAlbertoMK\u002Fgentleman-agent-gh","LuisAlbertoMK","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F96153499?v=4","01M71QZX0CF9KKGQZ8ZN9BME63","01M71QZX11P5X6Z27HE1GQDF71",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-scanner\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"security scanner","security","scanner","usage","docs","supply","chain","supply chain","scan","commit security scan","dependency","check","secrets","api","pre-commit","injection","security scan","commit","vulnerabilities","safe","2026-11-10 13:02:02",false,"---\nname: security-scanner\ndescription: \"Pre-commit security scan - secrets, injection patterns, dependency vulnerabilities, supply chain risks, API usage.\"\ntriggers: \"Security, seguridad, vulnerabilidad, auditar, safe check, harden\"\nchangelog: docs\u002Fciclos\u002Fcycle28-20260815.md\ntoken_budget: 2950\n---\n## When to Use\nPre-commit, pre-deploy, or \"is this secure?\"\n## SCAN DIMENSIONS\nSecrets · Injection · Sensitive APIs · Supply chain · Dependencies · Config · File access · API security\n## QUICK PATTERNS\nGo: `grep -rn \"apiKey\\|password\\|secret\\|sql\\.Exec\\|os\u002Fexec\" --include=\"*.go\"` · JS\u002FTS: `grep -rn \"process\\.env\\.\\|eval(\\|child_process\" --include=\"*.{js,ts}\"` · Py: `grep -rn \"password\\|secret\\|api_key\\|subprocess\\.\" --include=\"*.py\"` · audit: `npm audit --json` · no lockfile = HIGH · postinstall: `grep -rn \"postinstall\\|preinstall\" package.json` · typosquat: `npm ls --all` · API: `grep -rn \"rate.limit\\|RateLimiter\" --include=\"*.{ts,js,py,go}\"` + `grep -rn \"zod\\|joi\\|pydantic\"`\n## OUTPUT FORMAT\n`## Security Scan: {scope} — Secrets:{N} Injection:{N} Supply:{N} API:{N} Vuln:{N} | Issues CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW: {type} in {file:line} — Pattern: {found} → Fix: {fix}`\n## Rules\n1. Tool first, then manual. 2. Critical+High fix before commit; Medium→suggest. 3. Verify FPs — don't auto-flag env vars. 4. Always provide fix, not just warning. 5. End with risk summary: NONE\u002FLOW\u002FMED\u002FHIGH (why)\n## API REST Playbook\nOWASP23: API1 BOLA -> per-object authz | API2 authn -> JWT (auth-hardening) | API3 BOPLA -> allowlist parse | API4 -> rate.limit per-IP+user | API7 SSRF -> webhook\u002Fcallback URL allowlisted host+scheme only\nRate-limit+lockout: key IP+user, NOT client X-Forwarded-For (spoof bypass) | 429+Retry-After | N fails -> lockout\nErrors: no stack\u002Fparams\u002FSQL echo - generic 400\u002F500 + err-id, debug OFF | Pag\u002Fbulk: cap page size, opaque cursor, per-item authz\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 1)\n## Refs\nquality-gate · best-practices · command-wrapper · research · code-review-agent · llm-security · auto-metrics · external-auditor · immune-system\n## Anti-Rationalization\n\n| Rationalization | Red Flag | Verification |\n|-----------------|----------|--------------|\n| \"No secrets in this repo\" | Skipping secrets scan | `grep -rn \"process.env\\|apiKey\\|password\" --include=\"*.{js,ts,go,py}\"` on staged files |\n| \"npm audit is enough\" | Only `npm audit`, no supply chain | Check postinstall\u002Ftyposquat + `npm ls --all` (rule 1: tool first + manual) |\n| \"Medium can wait\" | Deferring MEDIUM | Medium→suggest now, CRITICAL+HIGH fix before commit (rule 2) |\n\n## Red Flags\n- Flagging `process.env` vars as secrets without verifying FP → STOP, verify rule 3\n- No risk summary `NONE\u002FLOW\u002FMED\u002FHIGH` at end → reject, add summary per rule 5\n\n## Verification\n- Scan output format `Secrets:{N} Injection:{N} ... | CRITICAL\u002FHIGH...` with `file:line` + fix per issue\n- `security-audit-mcp.ps1` (P0-2) as pre-flight for MCP configs; `llm-security` skill for prompt injection\n\n## Anti-Patterns\nFlag env vars as secrets · Skip dependency audit · Fix without solution · Ignore medium · No risk summary · npm audit alone (miss supply chain)\n> docs\u002Fskills\u002Fsecurity-scanner\u002Freference.md\n","## When to Use\nPre-commit, pre-deploy, or \"is this secure?\"\n## SCAN DIMENSIONS\nSecrets · Injection · Sensitive APIs · Supply chain · Dependencies · Config · File access · API security\n## QUICK PATTERNS\nGo: `grep -rn \"apiKey\\|password\\|secret\\|sql\\.Exec\\|os\u002Fexec\" --include=\"*.go\"` · JS\u002FTS: `grep -rn \"process\\.env\\.\\|eval(\\|child_process\" --include=\"*.{js,ts}\"` · Py: `grep -rn \"password\\|secret\\|api_key\\|subprocess\\.\" --include=\"*.py\"` · audit: `npm audit --json` · no lockfile = HIGH · postinstall: `grep -rn \"postinstall\\|preinstall\" package.json` · typosquat: `npm ls --all` · API: `grep -rn \"rate.limit\\|RateLimiter\" --include=\"*.{ts,js,py,go}\"` + `grep -rn \"zod\\|joi\\|pydantic\"`\n## OUTPUT FORMAT\n`## Security Scan: {scope} — Secrets:{N} Injection:{N} Supply:{N} API:{N} Vuln:{N} | Issues CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW: {type} in {file:line} — Pattern: {found} → Fix: {fix}`\n## Rules\n1. Tool first, then manual. 2. Critical+High fix before commit; Medium→suggest. 3. Verify FPs — don't auto-flag env vars. 4. Always provide fix, not just warning. 5. End with risk summary: NONE\u002FLOW\u002FMED\u002FHIGH (why)\n## API REST Playbook\nOWASP23: API1 BOLA -> per-object authz | API2 authn -> JWT (auth-hardening) | API3 BOPLA -> allowlist parse | API4 -> rate.limit per-IP+user | API7 SSRF -> webhook\u002Fcallback URL allowlisted host+scheme only\nRate-limit+lockout: key IP+user, NOT client X-Forwarded-For (spoof bypass) | 429+Retry-After | N fails -> lockout\nErrors: no stack\u002Fparams\u002FSQL echo - generic 400\u002F500 + err-id, debug OFF | Pag\u002Fbulk: cap page size, opaque cursor, per-item authz\n> changelog: odd\u002Ftasks\u002Fmejora-security.md (2026-09-18, slice 1)\n## Refs\nquality-gate · best-practices · command-wrapper · research · code-review-agent · llm-security · auto-metrics · external-auditor · immune-system\n## Anti-Rationalization\n\n| Rationalization | Red Flag | Verification |\n|-----------------|----------|--------------|\n| \"No secrets in this repo\" | Skipping secrets scan | `grep -rn \"process.env\\|apiKey\\|password\" --include=\"*.{js,ts,go,py}\"` on staged files |\n| \"npm audit is enough\" | Only `npm audit`, no supply chain | Check postinstall\u002Ftyposquat + `npm ls --all` (rule 1: tool first + manual) |\n| \"Medium can wait\" | Deferring MEDIUM | Medium→suggest now, CRITICAL+HIGH fix before commit (rule 2) |\n\n## Red Flags\n- Flagging `process.env` vars as secrets without verifying FP → STOP, verify rule 3\n- No risk summary `NONE\u002FLOW\u002FMED\u002FHIGH` at end → reject, add summary per rule 5\n\n## Verification\n- Scan output format `Secrets:{N} Injection:{N} ... | CRITICAL\u002FHIGH...` with `file:line` + fix per issue\n- `security-audit-mcp.ps1` (P0-2) as pre-flight for MCP configs; `llm-security` skill for prompt injection\n\n## Anti-Patterns\nFlag env vars as secrets · Skip dependency audit · Fix without solution · Ignore medium · No risk summary · npm audit alone (miss supply chain)\n> docs\u002Fskills\u002Fsecurity-scanner\u002Freference.md\n",{"name":5,"triggers":43,"changelog":44,"description":7,"token_budget":45},"Security, seguridad, vulnerabilidad, auditar, safe check, harden","docs\u002Fciclos\u002Fcycle28-20260815.md",2950,"main","4af6946b30783e2c8f9182082324d530fc28f838",".agents\u002Fskills\u002Fsecurity-scanner","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK","2026-11-10 18:34:27",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add LuisAlbertoMK\u002Fgentleman-agent-gh --skill security-scanner",{"tool":58,"command":59},"bunx","bunx skills add LuisAlbertoMK\u002Fgentleman-agent-gh --skill security-scanner",{"tool":61,"command":62},"pnpm","pnpm dlx skills add LuisAlbertoMK\u002Fgentleman-agent-gh --skill security-scanner","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-scanner\u002FSKILL.md",true,[66],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"references\u002Fpatterns-guide.md","REFERENCE","参考文档",1009,"https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-scanner\u002Freferences\u002Fpatterns-guide.md",[73,116,139,159,184,210],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":95,"publishedAt":38},"01M71R7K35P668DYEPYGDQP2QA","web-quality-audit","Comprehensive web audit: performance, a11y, SEO, responsive, animation, design tokens.","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002Fdocs\u002Fciclos\u002Fc28-w1-backup\u002Fweb-quality-audit\u002FSKILL.md",[79,84,87,92],{"categoryNo":80,"categoryName":81,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":85,"categoryName":86,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000019","营销推广",{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",{"categoryNo":93,"categoryName":94,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000035","市场营销",[96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115],"quality","quality audit","web quality audit","audit","web","Animation","design audit","design","website","ui","responsive","seo","tokens","ui audit","Lighthouse","performance","review","optimize","a11y","page",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":38},"01M71R7H1RA7CQ568DHRK37PE2","ui-engine","UI system — Grid\u002FFlexbox\u002F@layer\u002F:has(), container queries, compositor-only animation, OKLCH tokens, component patterns","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002Fdocs\u002Fciclos\u002Fc28-w1-backup\u002Fui-engine\u002FSKILL.md",[122],{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},[124,125,105,101,126,127,128,115,129,108,130,131,132,103,133,134,135,136,137,138],"ui engine","engine","compositor","css","dark","system","mode","hooks","container","only","query","components","dark mode","grid","queries",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":147,"publishedAt":38},"01M71R7EPMZFKB833WE4B3GTHC","baseline-ui","Anti-slop UI — layout, typography, responsive, animation, tokens. Use for cleanup or polish.","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002Fdocs\u002Fciclos\u002Fc28-w1-backup\u002Fbaseline-ui\u002FSKILL.md",[145,146],{"categoryNo":80,"categoryName":81,"taxonomyType":82,"taxonomyTypeDesc":83},{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},[148,149,105,101,150,151,152,153,108,154,132,103,155,156,157,109,158,134,137,112],"baseline ui","baseline","generic","slop","for","anti-slop","fix","interface","cleanup","design review","use",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":168,"publishedAt":38},"01M71R7CWK3FBW77Z8WD9GXQFE","skill-creator","Create new AI agent skills following Agent Skills spec -- auto-bootstrap unknown tasks, define structure, register in AGENTS.md","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.archive\u002Fskills\u002Fskill-creator\u002FSKILL.md",[165],{"categoryNo":166,"categoryName":167,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000023","Skill与智能体开发",[169,170,171,172,173,174,175,176,177,178,179,180,181,182,183],"skill creator","creator","create","structure","register","2026","spec","new","ai skill","auto","define","ai agent","unknown","tasks","bootstrap",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":192,"publishedAt":38},"01M71R78DZM1GA16F1KN8ND926","senior-engineer","Apply senior engineering competencies — system design, trade-off analysis, delegation, mentoring, and tech debt strategy","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.archive\u002Fskills\u002Fsenior-engineer\u002FSKILL.md",[190,191],{"categoryNo":80,"categoryName":81,"taxonomyType":82,"taxonomyTypeDesc":83},{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},[193,194,195,196,197,198,199,103,200,201,174,202,203,204,129,205,206,207,208,209],"engineer","senior","senior engineer","system design","trade-offs","senior engineering","delegation","senior architect","analysis","debt","architect","tech","strategy","apply","trade","tech debt","engineering",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":220,"publishedAt":38},"01M71R74WQTXZMG3219RND96CE","prompt-engineering","Design effective prompts using SPEARS framework — scope, principles, examples, assertions, refinements, with ReAct and multi-agent patterns","https:\u002F\u002Fgithub.com\u002FLuisAlbertoMK\u002Fgentleman-agent-gh\u002Fblob\u002Fmain\u002F.archive\u002Fskills\u002Fprompt-engineering\u002FSKILL.md",[216,219],{"categoryNo":217,"categoryName":218,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":166,"categoryName":167,"taxonomyType":82,"taxonomyTypeDesc":83},[221,222,209,223,224,103,225,174,19,226,227,228,229,230,231,232,233,234,235,236],"prompt","prompt engineering","scope","improve","react","patterns","multi-agent","framework","agent patterns","assertions","examples","with","multi","principles","improve prompt","prompts"]