[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M74YHPMZ84RMKDA2XPCQCDCS":3,"skill-same:01M74YHPMZ84RMKDA2XPCQCDCS":49},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":29,"commitSha":30,"skillDirectory":5,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":33,"ownerDescription":6,"updatedAt":34,"install":35,"resources":48},"01M74YHPMZ84RMKDA2XPCQCDCS","exa-security-basics",null,"Apply Exa security best practices for secrets and access control.\nUse when securing API keys, implementing least privilege access,\nor auditing Exa security configuration.\nTrigger with phrases like \"exa security\", \"exa secrets\",\n\"secure exa\", \"exa API key security\".","SamuelChien\u002Fmega-skills-collection","SamuelChien","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F4652114?v=4","01M74KK34WVHA0P5ZYSJRDDFMG","Samuel Chien","01M74KK35FQN1N9VZ9EPTH3P2S",0,"MIT","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fexa-security-basics\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: exa-security-basics\ndescription: |\n  Apply Exa security best practices for secrets and access control.\n  Use when securing API keys, implementing least privilege access,\n  or auditing Exa security configuration.\n  Trigger with phrases like \"exa security\", \"exa secrets\",\n  \"secure exa\", \"exa API key security\".\nallowed-tools: Read, Write, Grep\nversion: 1.0.0\nlicense: MIT\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\ncompatible-with: claude-code, codex, openclaw\n---\n# Exa Security Basics\n\n## Overview\nSecurity best practices for Exa API keys, tokens, and access control.\n\n## Prerequisites\n- Exa SDK installed\n- Understanding of environment variables\n- Access to Exa dashboard\n\n## Instructions\n\n### Step 1: Configure Environment Variables\n```bash\n# .env (NEVER commit to git)\nEXA_API_KEY=sk_live_***\nEXA_SECRET=***\n\n# .gitignore\n.env\n.env.local\n.env.*.local\n```\n\n### Step 2: Implement Secret Rotation\n```bash\nset -euo pipefail\n# 1. Generate new key in Exa dashboard\n# 2. Update environment variable\nexport EXA_API_KEY=\"new_key_here\"\n\n# 3. Verify new key works\ncurl -H \"Authorization: Bearer ${EXA_API_KEY}\" \\\n  https:\u002F\u002Fapi.exa.com\u002Fhealth\n\n# 4. Revoke old key in dashboard\n```\n\n### Step 3: Apply Least Privilege\n| Environment | Recommended Scopes |\n|-------------|-------------------|\n| Development | `read:*` |\n| Staging | `read:*, write:limited` |\n| Production | `Only required scopes` |\n\n## Output\n- Secure API key storage\n- Environment-specific access controls\n- Audit logging enabled\n\n## Error Handling\n| Security Issue | Detection | Mitigation |\n|----------------|-----------|------------|\n| Exposed API key | Git scanning | Rotate immediately |\n| Excessive scopes | Audit logs | Reduce permissions |\n| Missing rotation | Key age check | Schedule rotation |\n\n## Examples\n\n### Service Account Pattern\n```typescript\nconst clients = {\n  reader: new ExaClient({\n    apiKey: process.env.EXA_READ_KEY,\n  }),\n  writer: new ExaClient({\n    apiKey: process.env.EXA_WRITE_KEY,\n  }),\n};\n```\n\n### Webhook Signature Verification\n```typescript\nimport crypto from 'crypto';\n\nfunction verifyWebhookSignature(\n  payload: string, signature: string, secret: string\n): boolean {\n  const expected = crypto.createHmac('sha256', secret).update(payload).digest('hex');\n  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));\n}\n```\n\n### Security Checklist\n- [ ] API keys in environment variables\n- [ ] `.env` files in `.gitignore`\n- [ ] Different keys for dev\u002Fstaging\u002Fprod\n- [ ] Minimal scopes per environment\n- [ ] Webhook signatures validated\n- [ ] Audit logging enabled\n\n### Audit Logging\n```typescript\ninterface AuditEntry {\n  timestamp: Date;\n  action: string;\n  userId: string;\n  resource: string;\n  result: 'success' | 'failure';\n  metadata?: Record\u003Cstring, any>;\n}\n\nasync function auditLog(entry: Omit\u003CAuditEntry, 'timestamp'>): Promise\u003Cvoid> {\n  const log: AuditEntry = { ...entry, timestamp: new Date() };\n\n  \u002F\u002F Log to Exa analytics\n  await exaClient.track('audit', log);\n\n  \u002F\u002F Also log locally for compliance\n  console.log('[AUDIT]', JSON.stringify(log));\n}\n\n\u002F\u002F Usage\nawait auditLog({\n  action: 'exa.api.call',\n  userId: currentUser.id,\n  resource: '\u002Fv1\u002Fresource',\n  result: 'success',\n});\n```\n\n## Resources\n- [Exa Security Guide](https:\u002F\u002Fdocs.exa.com\u002Fsecurity)\n- [Exa API Scopes](https:\u002F\u002Fdocs.exa.com\u002Fscopes)\n\n## Next Steps\nFor production deployment, see `exa-prod-checklist`.","# Exa Security Basics\n\n## Overview\nSecurity best practices for Exa API keys, tokens, and access control.\n\n## Prerequisites\n- Exa SDK installed\n- Understanding of environment variables\n- Access to Exa dashboard\n\n## Instructions\n\n### Step 1: Configure Environment Variables\n```bash\n# .env (NEVER commit to git)\nEXA_API_KEY=sk_live_***\nEXA_SECRET=***\n\n# .gitignore\n.env\n.env.local\n.env.*.local\n```\n\n### Step 2: Implement Secret Rotation\n```bash\nset -euo pipefail\n# 1. Generate new key in Exa dashboard\n# 2. Update environment variable\nexport EXA_API_KEY=\"new_key_here\"\n\n# 3. Verify new key works\ncurl -H \"Authorization: Bearer ${EXA_API_KEY}\" \\\n  https:\u002F\u002Fapi.exa.com\u002Fhealth\n\n# 4. Revoke old key in dashboard\n```\n\n### Step 3: Apply Least Privilege\n| Environment | Recommended Scopes |\n|-------------|-------------------|\n| Development | `read:*` |\n| Staging | `read:*, write:limited` |\n| Production | `Only required scopes` |\n\n## Output\n- Secure API key storage\n- Environment-specific access controls\n- Audit logging enabled\n\n## Error Handling\n| Security Issue | Detection | Mitigation |\n|----------------|-----------|------------|\n| Exposed API key | Git scanning | Rotate immediately |\n| Excessive scopes | Audit logs | Reduce permissions |\n| Missing rotation | Key age check | Schedule rotation |\n\n## Examples\n\n### Service Account Pattern\n```typescript\nconst clients = {\n  reader: new ExaClient({\n    apiKey: process.env.EXA_READ_KEY,\n  }),\n  writer: new ExaClient({\n    apiKey: process.env.EXA_WRITE_KEY,\n  }),\n};\n```\n\n### Webhook Signature Verification\n```typescript\nimport crypto from 'crypto';\n\nfunction verifyWebhookSignature(\n  payload: string, signature: string, secret: string\n): boolean {\n  const expected = crypto.createHmac('sha256', secret).update(payload).digest('hex');\n  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));\n}\n```\n\n### Security Checklist\n- [ ] API keys in environment variables\n- [ ] `.env` files in `.gitignore`\n- [ ] Different keys for dev\u002Fstaging\u002Fprod\n- [ ] Minimal scopes per environment\n- [ ] Webhook signatures validated\n- [ ] Audit logging enabled\n\n### Audit Logging\n```typescript\ninterface AuditEntry {\n  timestamp: Date;\n  action: string;\n  userId: string;\n  resource: string;\n  result: 'success' | 'failure';\n  metadata?: Record\u003Cstring, any>;\n}\n\nasync function auditLog(entry: Omit\u003CAuditEntry, 'timestamp'>): Promise\u003Cvoid> {\n  const log: AuditEntry = { ...entry, timestamp: new Date() };\n\n  \u002F\u002F Log to Exa analytics\n  await exaClient.track('audit', log);\n\n  \u002F\u002F Also log locally for compliance\n  console.log('[AUDIT]', JSON.stringify(log));\n}\n\n\u002F\u002F Usage\nawait auditLog({\n  action: 'exa.api.call',\n  userId: currentUser.id,\n  resource: '\u002Fv1\u002Fresource',\n  result: 'success',\n});\n```\n\n## Resources\n- [Exa Security Guide](https:\u002F\u002Fdocs.exa.com\u002Fsecurity)\n- [Exa API Scopes](https:\u002F\u002Fdocs.exa.com\u002Fscopes)\n\n## Next Steps\nFor production deployment, see `exa-prod-checklist`.",{"name":5,"author":24,"license":15,"version":25,"description":26,"allowed-tools":27,"compatible-with":28},"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Apply Exa security best practices for secrets and access control.\nUse when securing API keys, implementing least privilege access,\nor auditing Exa security configuration.\nTrigger with phrases like \"exa security\", \"exa secrets\",\n\"secure exa\", \"exa API key security\".\n","Read, Write, Grep","claude-code, codex, openclaw","main","c2b1fdccc779e99ac814e55fb69ca8d71215dd0f","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection","https:\u002F\u002Fgithub.com\u002FSamuelChien","http:\u002F\u002Fsamuelchien.com\u002F","2026-05-26 08:27:14",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add SamuelChien\u002Fmega-skills-collection --skill exa-security-basics",{"tool":41,"command":42},"bunx","bunx skills add SamuelChien\u002Fmega-skills-collection --skill exa-security-basics",{"tool":44,"command":45},"pnpm","pnpm dlx skills add SamuelChien\u002Fmega-skills-collection --skill exa-security-basics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fexa-security-basics\u002FSKILL.md",true,[],[50,57,64,71,78,86],{"skillNo":51,"name":52,"nameZh":6,"description":53,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":56,"publishedAt":19},"01M76R4WZQZAXGGXMQCA0FZ716","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reactive state patterns with Zustand.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-ts\u002FSKILL.md",[],[],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":19},"01M76R4T9KENDH7FENGZQHBW4G","zustand-store-creator","Zustand Store Creator - Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":19},"01M76R3YWN84B7SANJ52X799ZE","zero-trust-config-helper","Zero Trust Config Helper - Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":19},"01M76R3HNSV2AEYSKHM915GJ58","zapier-integration-helper","Zapier Integration Helper - Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":82,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M76R3DJSKAT4FA7DV4BF3GCE","zai-cli","Execute z.AI CLI providing vision, search, reader, and GitHub exploration via CLI and MCP.\nUse when user needs image\u002Fvideo analysis, OCR, UI-to-code conversion, error diagnosis,\nreal-time web search, web page to markdown extraction, or GitHub code exploration.\nTrigger with phrases like \"analyze this image\", \"search the web for\", \"read this page\",\n\"explore this repo\", or \"use zai\". Requires Z_AI_API_KEY.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzai-cli\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M76R2KAM699XE9AJVAWE4H2E","yt-research","Research competitor YouTube channels, niches, and trending topics for your content strategy.\nUse this skill whenever the user says \"research channels\", \"analyze competitors\", \"find trending topics\",\n\"niche analysis\", \"competitive research\", \"what are other creators doing\", \"scrape YouTube channels\",\nor wants to understand the competitive landscape for a specific tool or topic area. Use when working with yt research. Trigger with 'yt', 'research'.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fyt-research\u002FSKILL.md",[],[]]