[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M72YP9FCKA2FNMPKCEN5XYXP":3,"skill-same:01M72YP9FCKA2FNMPKCEN5XYXP":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":25,"commitSha":26,"skillDirectory":27,"forksCount":28,"repositoryHtmlUrl":29,"repositoryHomepageUrl":6,"ownerHtmlUrl":30,"ownerBlogUrl":31,"ownerDescription":32,"updatedAt":33,"install":34,"resources":47},"01M72YP9FCKA2FNMPKCEN5XYXP","laravel-security",null,"Laravel security best practices for authn\u002Fauthz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.","SriramGandhiS\u002FSkills","SriramGandhiS","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F211849986?v=4","01M72WQCW12BYX71C6WN584TTA","Sriram S","01M72WQCWTJ2RD0ET1X31AF1RC",1,"MIT","https:\u002F\u002Fgithub.com\u002FSriramGandhiS\u002FSkills\u002Fblob\u002Fmaster\u002Feverything-claude-code\u002Fskills\u002Flaravel-security\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: laravel-security\ndescription: Laravel security best practices for authn\u002Fauthz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.\norigin: ECC\n---\n\n# Laravel Security Best Practices\n\nComprehensive security guidance for Laravel applications to protect against common vulnerabilities.\n\n## When to Activate\n\n- Adding authentication or authorization\n- Handling user input and file uploads\n- Building new API endpoints\n- Managing secrets and environment settings\n- Hardening production deployments\n\n## How It Works\n\n- Middleware provides baseline protections (CSRF via `VerifyCsrfToken`, security headers via `SecurityHeaders`).\n- Guards and policies enforce access control (`auth:sanctum`, `$this->authorize`, policy middleware).\n- Form Requests validate and shape input (`UploadInvoiceRequest`) before it reaches services.\n- Rate limiting adds abuse protection (`RateLimiter::for('login')`) alongside auth controls.\n- Data safety comes from encrypted casts, mass-assignment guards, and signed routes (`URL::temporarySignedRoute` + `signed` middleware).\n\n## Core Security Settings\n\n- `APP_DEBUG=false` in production\n- `APP_KEY` must be set and rotated on compromise\n- Set `SESSION_SECURE_COOKIE=true` and `SESSION_SAME_SITE=lax` (or `strict` for sensitive apps)\n- Configure trusted proxies for correct HTTPS detection\n\n## Session and Cookie Hardening\n\n- Set `SESSION_HTTP_ONLY=true` to prevent JavaScript access\n- Use `SESSION_SAME_SITE=strict` for high-risk flows\n- Regenerate sessions on login and privilege changes\n\n## Authentication and Tokens\n\n- Use Laravel Sanctum or Passport for API auth\n- Prefer short-lived tokens with refresh flows for sensitive data\n- Revoke tokens on logout and compromised accounts\n\nExample route protection:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::middleware('auth:sanctum')->get('\u002Fme', function (Request $request) {\n    return $request->user();\n});\n```\n\n## Password Security\n\n- Hash passwords with `Hash::make()` and never store plaintext\n- Use Laravel's password broker for reset flows\n\n```php\nuse Illuminate\\Support\\Facades\\Hash;\nuse Illuminate\\Validation\\Rules\\Password;\n\n$validated = $request->validate([\n    'password' => ['required', 'string', Password::min(12)->letters()->mixedCase()->numbers()->symbols()],\n]);\n\n$user->update(['password' => Hash::make($validated['password'])]);\n```\n\n## Authorization: Policies and Gates\n\n- Use policies for model-level authorization\n- Enforce authorization in controllers and services\n\n```php\n$this->authorize('update', $project);\n```\n\nUse policy middleware for route-level enforcement:\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::put('\u002Fprojects\u002F{project}', [ProjectController::class, 'update'])\n    ->middleware(['auth:sanctum', 'can:update,project']);\n```\n\n## Validation and Data Sanitization\n\n- Always validate inputs with Form Requests\n- Use strict validation rules and type checks\n- Never trust request payloads for derived fields\n\n## Mass Assignment Protection\n\n- Use `$fillable` or `$guarded` and avoid `Model::unguard()`\n- Prefer DTOs or explicit attribute mapping\n\n## SQL Injection Prevention\n\n- Use Eloquent or query builder parameter binding\n- Avoid raw SQL unless strictly necessary\n\n```php\nDB::select('select * from users where email = ?', [$email]);\n```\n\n## XSS Prevention\n\n- Blade escapes output by default (`{{ }}`)\n- Use `{!! !!}` only for trusted, sanitized HTML\n- Sanitize rich text with a dedicated library\n\n## CSRF Protection\n\n- Keep `VerifyCsrfToken` middleware enabled\n- Include `@csrf` in forms and send XSRF tokens for SPA requests\n\nFor SPA authentication with Sanctum, ensure stateful requests are configured:\n\n```php\n\u002F\u002F config\u002Fsanctum.php\n'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost')),\n```\n\n## File Upload Safety\n\n- Validate file size, MIME type, and extension\n- Store uploads outside the public path when possible\n- Scan files for malware if required\n\n```php\nfinal class UploadInvoiceRequest extends FormRequest\n{\n    public function authorize(): bool\n    {\n        return (bool) $this->user()?->can('upload-invoice');\n    }\n\n    public function rules(): array\n    {\n        return [\n            'invoice' => ['required', 'file', 'mimes:pdf', 'max:5120'],\n        ];\n    }\n}\n```\n\n```php\n$path = $request->file('invoice')->store(\n    'invoices',\n    config('filesystems.private_disk', 'local') \u002F\u002F set this to a non-public disk\n);\n```\n\n## Rate Limiting\n\n- Apply `throttle` middleware on auth and write endpoints\n- Use stricter limits for login, password reset, and OTP\n\n```php\nuse Illuminate\\Cache\\RateLimiting\\Limit;\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\RateLimiter;\n\nRateLimiter::for('login', function (Request $request) {\n    return [\n        Limit::perMinute(5)->by($request->ip()),\n        Limit::perMinute(5)->by(strtolower((string) $request->input('email'))),\n    ];\n});\n```\n\n## Secrets and Credentials\n\n- Never commit secrets to source control\n- Use environment variables and secret managers\n- Rotate keys after exposure and invalidate sessions\n\n## Encrypted Attributes\n\nUse encrypted casts for sensitive columns at rest.\n\n```php\nprotected $casts = [\n    'api_token' => 'encrypted',\n];\n```\n\n## Security Headers\n\n- Add CSP, HSTS, and frame protection where appropriate\n- Use trusted proxy configuration to enforce HTTPS redirects\n\nExample middleware to set headers:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Symfony\\Component\\HttpFoundation\\Response;\n\nfinal class SecurityHeaders\n{\n    public function handle(Request $request, \\Closure $next): Response\n    {\n        $response = $next($request);\n\n        $response->headers->add([\n            'Content-Security-Policy' => \"default-src 'self'\",\n            'Strict-Transport-Security' => 'max-age=31536000', \u002F\u002F add includeSubDomains\u002Fpreload only when all subdomains are HTTPS\n            'X-Frame-Options' => 'DENY',\n            'X-Content-Type-Options' => 'nosniff',\n            'Referrer-Policy' => 'no-referrer',\n        ]);\n\n        return $response;\n    }\n}\n```\n\n## CORS and API Exposure\n\n- Restrict origins in `config\u002Fcors.php`\n- Avoid wildcard origins for authenticated routes\n\n```php\n\u002F\u002F config\u002Fcors.php\nreturn [\n    'paths' => ['api\u002F*', 'sanctum\u002Fcsrf-cookie'],\n    'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n    'allowed_origins' => ['https:\u002F\u002Fapp.example.com'],\n    'allowed_headers' => [\n        'Content-Type',\n        'Authorization',\n        'X-Requested-With',\n        'X-XSRF-TOKEN',\n        'X-CSRF-TOKEN',\n    ],\n    'supports_credentials' => true,\n];\n```\n\n## Logging and PII\n\n- Never log passwords, tokens, or full card data\n- Redact sensitive fields in structured logs\n\n```php\nuse Illuminate\\Support\\Facades\\Log;\n\nLog::info('User updated profile', [\n    'user_id' => $user->id,\n    'email' => '[REDACTED]',\n    'token' => '[REDACTED]',\n]);\n```\n\n## Dependency Security\n\n- Run `composer audit` regularly\n- Pin dependencies with care and update promptly on CVEs\n\n## Signed URLs\n\nUse signed routes for temporary, tamper-proof links.\n\n```php\nuse Illuminate\\Support\\Facades\\URL;\n\n$url = URL::temporarySignedRoute(\n    'downloads.invoice',\n    now()->addMinutes(15),\n    ['invoice' => $invoice->id]\n);\n```\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::get('\u002Finvoices\u002F{invoice}\u002Fdownload', [InvoiceController::class, 'download'])\n    ->name('downloads.invoice')\n    ->middleware('signed');\n```\n","# Laravel Security Best Practices\n\nComprehensive security guidance for Laravel applications to protect against common vulnerabilities.\n\n## When to Activate\n\n- Adding authentication or authorization\n- Handling user input and file uploads\n- Building new API endpoints\n- Managing secrets and environment settings\n- Hardening production deployments\n\n## How It Works\n\n- Middleware provides baseline protections (CSRF via `VerifyCsrfToken`, security headers via `SecurityHeaders`).\n- Guards and policies enforce access control (`auth:sanctum`, `$this->authorize`, policy middleware).\n- Form Requests validate and shape input (`UploadInvoiceRequest`) before it reaches services.\n- Rate limiting adds abuse protection (`RateLimiter::for('login')`) alongside auth controls.\n- Data safety comes from encrypted casts, mass-assignment guards, and signed routes (`URL::temporarySignedRoute` + `signed` middleware).\n\n## Core Security Settings\n\n- `APP_DEBUG=false` in production\n- `APP_KEY` must be set and rotated on compromise\n- Set `SESSION_SECURE_COOKIE=true` and `SESSION_SAME_SITE=lax` (or `strict` for sensitive apps)\n- Configure trusted proxies for correct HTTPS detection\n\n## Session and Cookie Hardening\n\n- Set `SESSION_HTTP_ONLY=true` to prevent JavaScript access\n- Use `SESSION_SAME_SITE=strict` for high-risk flows\n- Regenerate sessions on login and privilege changes\n\n## Authentication and Tokens\n\n- Use Laravel Sanctum or Passport for API auth\n- Prefer short-lived tokens with refresh flows for sensitive data\n- Revoke tokens on logout and compromised accounts\n\nExample route protection:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::middleware('auth:sanctum')->get('\u002Fme', function (Request $request) {\n    return $request->user();\n});\n```\n\n## Password Security\n\n- Hash passwords with `Hash::make()` and never store plaintext\n- Use Laravel's password broker for reset flows\n\n```php\nuse Illuminate\\Support\\Facades\\Hash;\nuse Illuminate\\Validation\\Rules\\Password;\n\n$validated = $request->validate([\n    'password' => ['required', 'string', Password::min(12)->letters()->mixedCase()->numbers()->symbols()],\n]);\n\n$user->update(['password' => Hash::make($validated['password'])]);\n```\n\n## Authorization: Policies and Gates\n\n- Use policies for model-level authorization\n- Enforce authorization in controllers and services\n\n```php\n$this->authorize('update', $project);\n```\n\nUse policy middleware for route-level enforcement:\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::put('\u002Fprojects\u002F{project}', [ProjectController::class, 'update'])\n    ->middleware(['auth:sanctum', 'can:update,project']);\n```\n\n## Validation and Data Sanitization\n\n- Always validate inputs with Form Requests\n- Use strict validation rules and type checks\n- Never trust request payloads for derived fields\n\n## Mass Assignment Protection\n\n- Use `$fillable` or `$guarded` and avoid `Model::unguard()`\n- Prefer DTOs or explicit attribute mapping\n\n## SQL Injection Prevention\n\n- Use Eloquent or query builder parameter binding\n- Avoid raw SQL unless strictly necessary\n\n```php\nDB::select('select * from users where email = ?', [$email]);\n```\n\n## XSS Prevention\n\n- Blade escapes output by default (`{{ }}`)\n- Use `{!! !!}` only for trusted, sanitized HTML\n- Sanitize rich text with a dedicated library\n\n## CSRF Protection\n\n- Keep `VerifyCsrfToken` middleware enabled\n- Include `@csrf` in forms and send XSRF tokens for SPA requests\n\nFor SPA authentication with Sanctum, ensure stateful requests are configured:\n\n```php\n\u002F\u002F config\u002Fsanctum.php\n'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost')),\n```\n\n## File Upload Safety\n\n- Validate file size, MIME type, and extension\n- Store uploads outside the public path when possible\n- Scan files for malware if required\n\n```php\nfinal class UploadInvoiceRequest extends FormRequest\n{\n    public function authorize(): bool\n    {\n        return (bool) $this->user()?->can('upload-invoice');\n    }\n\n    public function rules(): array\n    {\n        return [\n            'invoice' => ['required', 'file', 'mimes:pdf', 'max:5120'],\n        ];\n    }\n}\n```\n\n```php\n$path = $request->file('invoice')->store(\n    'invoices',\n    config('filesystems.private_disk', 'local') \u002F\u002F set this to a non-public disk\n);\n```\n\n## Rate Limiting\n\n- Apply `throttle` middleware on auth and write endpoints\n- Use stricter limits for login, password reset, and OTP\n\n```php\nuse Illuminate\\Cache\\RateLimiting\\Limit;\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\RateLimiter;\n\nRateLimiter::for('login', function (Request $request) {\n    return [\n        Limit::perMinute(5)->by($request->ip()),\n        Limit::perMinute(5)->by(strtolower((string) $request->input('email'))),\n    ];\n});\n```\n\n## Secrets and Credentials\n\n- Never commit secrets to source control\n- Use environment variables and secret managers\n- Rotate keys after exposure and invalidate sessions\n\n## Encrypted Attributes\n\nUse encrypted casts for sensitive columns at rest.\n\n```php\nprotected $casts = [\n    'api_token' => 'encrypted',\n];\n```\n\n## Security Headers\n\n- Add CSP, HSTS, and frame protection where appropriate\n- Use trusted proxy configuration to enforce HTTPS redirects\n\nExample middleware to set headers:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Symfony\\Component\\HttpFoundation\\Response;\n\nfinal class SecurityHeaders\n{\n    public function handle(Request $request, \\Closure $next): Response\n    {\n        $response = $next($request);\n\n        $response->headers->add([\n            'Content-Security-Policy' => \"default-src 'self'\",\n            'Strict-Transport-Security' => 'max-age=31536000', \u002F\u002F add includeSubDomains\u002Fpreload only when all subdomains are HTTPS\n            'X-Frame-Options' => 'DENY',\n            'X-Content-Type-Options' => 'nosniff',\n            'Referrer-Policy' => 'no-referrer',\n        ]);\n\n        return $response;\n    }\n}\n```\n\n## CORS and API Exposure\n\n- Restrict origins in `config\u002Fcors.php`\n- Avoid wildcard origins for authenticated routes\n\n```php\n\u002F\u002F config\u002Fcors.php\nreturn [\n    'paths' => ['api\u002F*', 'sanctum\u002Fcsrf-cookie'],\n    'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n    'allowed_origins' => ['https:\u002F\u002Fapp.example.com'],\n    'allowed_headers' => [\n        'Content-Type',\n        'Authorization',\n        'X-Requested-With',\n        'X-XSRF-TOKEN',\n        'X-CSRF-TOKEN',\n    ],\n    'supports_credentials' => true,\n];\n```\n\n## Logging and PII\n\n- Never log passwords, tokens, or full card data\n- Redact sensitive fields in structured logs\n\n```php\nuse Illuminate\\Support\\Facades\\Log;\n\nLog::info('User updated profile', [\n    'user_id' => $user->id,\n    'email' => '[REDACTED]',\n    'token' => '[REDACTED]',\n]);\n```\n\n## Dependency Security\n\n- Run `composer audit` regularly\n- Pin dependencies with care and update promptly on CVEs\n\n## Signed URLs\n\nUse signed routes for temporary, tamper-proof links.\n\n```php\nuse Illuminate\\Support\\Facades\\URL;\n\n$url = URL::temporarySignedRoute(\n    'downloads.invoice',\n    now()->addMinutes(15),\n    ['invoice' => $invoice->id]\n);\n```\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::get('\u002Finvoices\u002F{invoice}\u002Fdownload', [InvoiceController::class, 'download'])\n    ->name('downloads.invoice')\n    ->middleware('signed');\n```\n",{"name":5,"origin":24,"description":7},"ECC","master","d6ca01da0f24a3b0e26e4a8b7b66cbd25d429f5d","everything-claude-code\u002Fskills\u002Flaravel-security",0,"https:\u002F\u002Fgithub.com\u002FSriramGandhiS\u002FSkills","https:\u002F\u002Fgithub.com\u002FSriramGandhiS","https:\u002F\u002Fsriram.website\u002F","Curious guy who keeps tinkering until something works","2026-05-20 16:21:34",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add SriramGandhiS\u002FSkills --skill laravel-security",{"tool":40,"command":41},"bunx","bunx skills add SriramGandhiS\u002FSkills --skill laravel-security",{"tool":43,"command":44},"pnpm","pnpm dlx skills add SriramGandhiS\u002FSkills --skill laravel-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSriramGandhiS\u002FSkills\u002Fblob\u002Fmaster\u002Feverything-claude-code\u002Fskills\u002Flaravel-security\u002FSKILL.md",true,[],[49,56,61,67,74,81],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":19},"01M732609EPJWV13PVTX3GT4TM","webgpu-threejs-tsl","Comprehensive guide for developing WebGPU-enabled Three.js applications using TSL (Three.js Shading Language). Covers WebGPU renderer setup, TSL syntax and node materials, compute shaders, post-processing effects, and WGSL integration. Use this skill when working with Three.js WebGPU, TSL shaders, node materials, or GPU compute in Three.js.","https:\u002F\u002Fgithub.com\u002FSriramGandhiS\u002FSkills\u002Fblob\u002Fmaster\u002Fwebgpu-threejs-tsl\u002Fskills\u002Fwebgpu-threejs-tsl\u002FSKILL.md",[],[],{"skillNo":57,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":58,"categories":59,"keywords":60,"publishedAt":19},"01M7325XM47AGWB6K6C4VXKE6B","https:\u002F\u002Fgithub.com\u002FSriramGandhiS\u002FSkills\u002Fblob\u002Fmaster\u002Fwebgpu-threejs-tsl\u002FSKILL.md",[],[],{"skillNo":62,"name":63,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":64,"categories":65,"keywords":66,"publishedAt":19},"01M7325WP6DES69JKC840VMFEP","verification-loop","https:\u002F\u002Fgithub.com\u002FSriramGandhiS\u002FSkills\u002Fblob\u002Fmaster\u002Fweb-assets\u002Fdocs\u002Fzh-TW\u002Fskills\u002Fverification-loop\u002FSKILL.md",[],[],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":73,"publishedAt":19},"01M7325TFQF1DZTQ6J3WGQQ1VR","tdd-workflow","Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.","https:\u002F\u002Fgithub.com\u002FSriramGandhiS\u002FSkills\u002Fblob\u002Fmaster\u002Fweb-assets\u002Fdocs\u002Fzh-TW\u002Fskills\u002Ftdd-workflow\u002FSKILL.md",[],[],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":19},"01M7325RGV9AY9PK92D2V8KKPW","strategic-compact","Suggests manual context compaction at logical intervals to preserve context through task phases rather than arbitrary auto-compaction.","https:\u002F\u002Fgithub.com\u002FSriramGandhiS\u002FSkills\u002Fblob\u002Fmaster\u002Fweb-assets\u002Fdocs\u002Fzh-TW\u002Fskills\u002Fstrategic-compact\u002FSKILL.md",[],[],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":19},"01M7325MZC28SE86E7NMCNEFS4","security-review","Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment\u002Fsensitive features. Provides comprehensive security checklist and patterns.","https:\u002F\u002Fgithub.com\u002FSriramGandhiS\u002FSkills\u002Fblob\u002Fmaster\u002Fweb-assets\u002Fdocs\u002Fzh-TW\u002Fskills\u002Fsecurity-review\u002FSKILL.md",[],[]]