[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M751BBXCSR5RVG5PW01GKAS3":3,"skill-same:01M751BBXCSR5RVG5PW01GKAS3":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":35,"commitSha":36,"skillDirectory":5,"forksCount":14,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":39,"ownerDescription":6,"updatedAt":40,"install":41,"resources":54},"01M751BBXCSR5RVG5PW01GKAS3","implementing-kubernetes-pod-security-standards",null,"Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PS","SamuelChien\u002Fmega-skills-collection","SamuelChien","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F4652114?v=4","01M74KK34WVHA0P5ZYSJRDDFMG","Samuel Chien","01M74KK35FQN1N9VZ9EPTH3P2S",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-kubernetes-pod-security-standards\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-kubernetes-pod-security-standards\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: implementing-kubernetes-pod-security-standards\ndescription: Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PS\ndomain: cybersecurity\nsubdomain: container-security\ntags: [containers, kubernetes, security, pod-security, PSA]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Implementing Kubernetes Pod Security Standards\n\n## Overview\n\nPod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PSA replaces the deprecated PodSecurityPolicy and provides namespace-level enforcement with three modes: enforce, audit, and warn.\n\n\n## When to Use\n\n- When deploying or configuring implementing kubernetes pod security standards capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster 1.25+ (PSA GA)\n- kubectl configured with cluster-admin access\n- Understanding of Linux capabilities and security contexts\n\n## Core Concepts\n\n### Three Security Profiles\n\n| Profile | Purpose | Restrictions |\n|---------|---------|-------------|\n| **Privileged** | Unrestricted, system workloads | None |\n| **Baseline** | Prevents known escalations | No hostNetwork, hostPID, hostIPC, privileged containers, dangerous capabilities |\n| **Restricted** | Hardened best practices | Non-root, drop ALL caps, seccomp required, read-only rootfs recommended |\n\n### Three Enforcement Modes\n\n| Mode | Behavior |\n|------|----------|\n| **enforce** | Rejects pods that violate the policy |\n| **audit** | Logs violations in audit log but allows pod |\n| **warn** | Returns warning to user but allows pod |\n\n## Workflow\n\n### Step 1: Label Namespaces for PSA\n\n```yaml\n# Restricted namespace - production workloads\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: latest\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: latest\n```\n\n```yaml\n# Baseline namespace - general workloads\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: staging\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: baseline\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: latest\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: latest\n```\n\n```yaml\n# Privileged namespace - system components only\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: kube-system\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: privileged\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n```\n\n### Step 2: Apply Labels to Existing Namespaces\n\n```bash\n# Apply restricted enforcement to production\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Apply baseline to staging with restricted warnings\nkubectl label namespace staging \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Check labels on all namespaces\nkubectl get namespaces -L pod-security.kubernetes.io\u002Fenforce\n```\n\n### Step 3: Create Compliant Pod Specs\n\n```yaml\n# Restricted-compliant deployment\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: secure-app\n  namespace: production\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: secure-app\n  template:\n    metadata:\n      labels:\n        app: secure-app\n    spec:\n      automountServiceAccountToken: false\n      securityContext:\n        runAsNonRoot: true\n        runAsUser: 65534\n        runAsGroup: 65534\n        fsGroup: 65534\n        seccompProfile:\n          type: RuntimeDefault\n      containers:\n        - name: app\n          image: myregistry.com\u002Fmyapp:v1.0.0@sha256:abc123\n          ports:\n            - containerPort: 8080\n              protocol: TCP\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            capabilities:\n              drop:\n                - ALL\n            runAsNonRoot: true\n            runAsUser: 65534\n          resources:\n            requests:\n              memory: \"64Mi\"\n              cpu: \"100m\"\n            limits:\n              memory: \"256Mi\"\n              cpu: \"500m\"\n          volumeMounts:\n            - name: tmp\n              mountPath: \u002Ftmp\n            - name: cache\n              mountPath: \u002Fvar\u002Fcache\n      volumes:\n        - name: tmp\n          emptyDir:\n            sizeLimit: 100Mi\n        - name: cache\n          emptyDir:\n            sizeLimit: 50Mi\n```\n\n### Step 4: Gradual Migration Strategy\n\n```bash\n# Phase 1: Audit mode - discover violations without blocking\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n\n# Check audit logs for violations\nkubectl logs -n kube-system -l component=kube-apiserver | grep \"pod-security\"\n\n# Phase 2: Enforce baseline, warn on restricted\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Phase 3: Full restricted enforcement\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  --overwrite\n```\n\n### Step 5: Dry-Run Enforcement Testing\n\n```bash\n# Test what would happen with restricted enforcement\nkubectl label --dry-run=server --overwrite namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=restricted\n\n# Example output:\n# Warning: existing pods in namespace \"my-namespace\" violate the new\n# PodSecurity enforce level \"restricted:latest\"\n# Warning: nginx-xxx: allowPrivilegeEscalation != false,\n#   unrestricted capabilities, runAsNonRoot != true, seccompProfile\n```\n\n## Baseline Profile Restrictions\n\n| Control | Restricted | Requirement |\n|---------|-----------|-------------|\n| HostProcess | Must not set | Pods cannot use Windows HostProcess |\n| Host Namespaces | Must not set | No hostNetwork, hostPID, hostIPC |\n| Privileged | Must not set | No privileged: true |\n| Capabilities | Baseline list only | Only NET_BIND_SERVICE, drop ALL for restricted |\n| HostPath Volumes | Must not use | No hostPath volume mounts |\n| Host Ports | Must not use | No hostPort in container spec |\n| AppArmor | Default\u002Fruntime | Cannot set to unconfined |\n| SELinux | Limited types | Only container_t, container_init_t, container_kvm_t |\n| \u002Fproc Mount Type | Default only | Must use Default proc mount |\n| Seccomp | RuntimeDefault or Localhost | Must specify seccomp profile (restricted) |\n| Sysctls | Safe set only | Limited to safe sysctls |\n\n## Validation Commands\n\n```bash\n# Verify namespace labels\nkubectl get ns --show-labels | grep pod-security\n\n# Test pod creation against policy\nkubectl run test-pod --image=nginx --namespace=production --dry-run=server\n\n# Check for violations in audit logs\nkubectl get events --field-selector reason=FailedCreate -A\n\n# Scan with Kubescape for PSS compliance\nkubescape scan framework nsa --namespace production\n```\n\n## References\n\n- [Pod Security Standards - Kubernetes](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-standards\u002F)\n- [Pod Security Admission - Kubernetes](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-admission\u002F)\n- [Migrate from PodSecurityPolicy](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Ftasks\u002Fconfigure-pod-container\u002Fmigrate-from-psp\u002F)\n- [Kubescape PSS Scanner](https:\u002F\u002Fgithub.com\u002Fkubescape\u002Fkubescape)\n","# Implementing Kubernetes Pod Security Standards\n\n## Overview\n\nPod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PSA replaces the deprecated PodSecurityPolicy and provides namespace-level enforcement with three modes: enforce, audit, and warn.\n\n\n## When to Use\n\n- When deploying or configuring implementing kubernetes pod security standards capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster 1.25+ (PSA GA)\n- kubectl configured with cluster-admin access\n- Understanding of Linux capabilities and security contexts\n\n## Core Concepts\n\n### Three Security Profiles\n\n| Profile | Purpose | Restrictions |\n|---------|---------|-------------|\n| **Privileged** | Unrestricted, system workloads | None |\n| **Baseline** | Prevents known escalations | No hostNetwork, hostPID, hostIPC, privileged containers, dangerous capabilities |\n| **Restricted** | Hardened best practices | Non-root, drop ALL caps, seccomp required, read-only rootfs recommended |\n\n### Three Enforcement Modes\n\n| Mode | Behavior |\n|------|----------|\n| **enforce** | Rejects pods that violate the policy |\n| **audit** | Logs violations in audit log but allows pod |\n| **warn** | Returns warning to user but allows pod |\n\n## Workflow\n\n### Step 1: Label Namespaces for PSA\n\n```yaml\n# Restricted namespace - production workloads\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: latest\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: latest\n```\n\n```yaml\n# Baseline namespace - general workloads\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: staging\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: baseline\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: latest\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: latest\n```\n\n```yaml\n# Privileged namespace - system components only\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: kube-system\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: privileged\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n```\n\n### Step 2: Apply Labels to Existing Namespaces\n\n```bash\n# Apply restricted enforcement to production\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Apply baseline to staging with restricted warnings\nkubectl label namespace staging \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Check labels on all namespaces\nkubectl get namespaces -L pod-security.kubernetes.io\u002Fenforce\n```\n\n### Step 3: Create Compliant Pod Specs\n\n```yaml\n# Restricted-compliant deployment\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: secure-app\n  namespace: production\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: secure-app\n  template:\n    metadata:\n      labels:\n        app: secure-app\n    spec:\n      automountServiceAccountToken: false\n      securityContext:\n        runAsNonRoot: true\n        runAsUser: 65534\n        runAsGroup: 65534\n        fsGroup: 65534\n        seccompProfile:\n          type: RuntimeDefault\n      containers:\n        - name: app\n          image: myregistry.com\u002Fmyapp:v1.0.0@sha256:abc123\n          ports:\n            - containerPort: 8080\n              protocol: TCP\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            capabilities:\n              drop:\n                - ALL\n            runAsNonRoot: true\n            runAsUser: 65534\n          resources:\n            requests:\n              memory: \"64Mi\"\n              cpu: \"100m\"\n            limits:\n              memory: \"256Mi\"\n              cpu: \"500m\"\n          volumeMounts:\n            - name: tmp\n              mountPath: \u002Ftmp\n            - name: cache\n              mountPath: \u002Fvar\u002Fcache\n      volumes:\n        - name: tmp\n          emptyDir:\n            sizeLimit: 100Mi\n        - name: cache\n          emptyDir:\n            sizeLimit: 50Mi\n```\n\n### Step 4: Gradual Migration Strategy\n\n```bash\n# Phase 1: Audit mode - discover violations without blocking\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n\n# Check audit logs for violations\nkubectl logs -n kube-system -l component=kube-apiserver | grep \"pod-security\"\n\n# Phase 2: Enforce baseline, warn on restricted\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Phase 3: Full restricted enforcement\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  --overwrite\n```\n\n### Step 5: Dry-Run Enforcement Testing\n\n```bash\n# Test what would happen with restricted enforcement\nkubectl label --dry-run=server --overwrite namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=restricted\n\n# Example output:\n# Warning: existing pods in namespace \"my-namespace\" violate the new\n# PodSecurity enforce level \"restricted:latest\"\n# Warning: nginx-xxx: allowPrivilegeEscalation != false,\n#   unrestricted capabilities, runAsNonRoot != true, seccompProfile\n```\n\n## Baseline Profile Restrictions\n\n| Control | Restricted | Requirement |\n|---------|-----------|-------------|\n| HostProcess | Must not set | Pods cannot use Windows HostProcess |\n| Host Namespaces | Must not set | No hostNetwork, hostPID, hostIPC |\n| Privileged | Must not set | No privileged: true |\n| Capabilities | Baseline list only | Only NET_BIND_SERVICE, drop ALL for restricted |\n| HostPath Volumes | Must not use | No hostPath volume mounts |\n| Host Ports | Must not use | No hostPort in container spec |\n| AppArmor | Default\u002Fruntime | Cannot set to unconfined |\n| SELinux | Limited types | Only container_t, container_init_t, container_kvm_t |\n| \u002Fproc Mount Type | Default only | Must use Default proc mount |\n| Seccomp | RuntimeDefault or Localhost | Must specify seccomp profile (restricted) |\n| Sysctls | Safe set only | Limited to safe sysctls |\n\n## Validation Commands\n\n```bash\n# Verify namespace labels\nkubectl get ns --show-labels | grep pod-security\n\n# Test pod creation against policy\nkubectl run test-pod --image=nginx --namespace=production --dry-run=server\n\n# Check for violations in audit logs\nkubectl get events --field-selector reason=FailedCreate -A\n\n# Scan with Kubescape for PSS compliance\nkubescape scan framework nsa --namespace production\n```\n\n## References\n\n- [Pod Security Standards - Kubernetes](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-standards\u002F)\n- [Pod Security Admission - Kubernetes](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-admission\u002F)\n- [Migrate from PodSecurityPolicy](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Ftasks\u002Fconfigure-pod-container\u002Fmigrate-from-psp\u002F)\n- [Kubescape PSS Scanner](https:\u002F\u002Fgithub.com\u002Fkubescape\u002Fkubescape)\n",{"name":5,"tags":25,"author":31,"domain":32,"license":15,"version":33,"subdomain":34,"description":7},[26,27,28,29,30],"containers","kubernetes","security","pod-security","PSA","mahipal","cybersecurity","1.0","container-security","main","c2b1fdccc779e99ac814e55fb69ca8d71215dd0f","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection","https:\u002F\u002Fgithub.com\u002FSamuelChien","http:\u002F\u002Fsamuelchien.com\u002F","2026-05-26 08:27:14",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add SamuelChien\u002Fmega-skills-collection --skill implementing-kubernetes-pod-security-standards",{"tool":47,"command":48},"bunx","bunx skills add SamuelChien\u002Fmega-skills-collection --skill implementing-kubernetes-pod-security-standards",{"tool":50,"command":51},"pnpm","pnpm dlx skills add SamuelChien\u002Fmega-skills-collection --skill implementing-kubernetes-pod-security-standards","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-kubernetes-pod-security-standards\u002FSKILL.md",true,[55,61,65,71,75,79,85],{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"assets\u002Ftemplate.md","ASSET","资产文件",1681,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-kubernetes-pod-security-standards\u002Fassets\u002Ftemplate.md",{"path":62,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"references\u002Fapi-reference.md","REFERENCE","参考文档",1575,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-kubernetes-pod-security-standards\u002Freferences\u002Fapi-reference.md",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fstandards.md",3276,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-kubernetes-pod-security-standards\u002Freferences\u002Fstandards.md",{"path":76,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fworkflows.md",3701,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-kubernetes-pod-security-standards\u002Freferences\u002Fworkflows.md",{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"scripts\u002Fagent.py","SCRIPT","脚本",7680,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-kubernetes-pod-security-standards\u002Fscripts\u002Fagent.py",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},"scripts\u002Fprocess.py",11335,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fimplementing-kubernetes-pod-security-standards\u002Fscripts\u002Fprocess.py",[90,98,105,112,119,126],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":20},"01M76R4WZQZAXGGXMQCA0FZ716","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reactive state patterns with Zustand.","MIT","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-ts\u002FSKILL.md",[],[],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":20},"01M76R4T9KENDH7FENGZQHBW4G","zustand-store-creator","Zustand Store Creator - Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":20},"01M76R3YWN84B7SANJ52X799ZE","zero-trust-config-helper","Zero Trust Config Helper - Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":20},"01M76R3HNSV2AEYSKHM915GJ58","zapier-integration-helper","Zapier Integration Helper - Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":20},"01M76R3DJSKAT4FA7DV4BF3GCE","zai-cli","Execute z.AI CLI providing vision, search, reader, and GitHub exploration via CLI and MCP.\nUse when user needs image\u002Fvideo analysis, OCR, UI-to-code conversion, error diagnosis,\nreal-time web search, web page to markdown extraction, or GitHub code exploration.\nTrigger with phrases like \"analyze this image\", \"search the web for\", \"read this page\",\n\"explore this repo\", or \"use zai\". Requires Z_AI_API_KEY.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzai-cli\u002FSKILL.md",[],[],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":20},"01M76R2KAM699XE9AJVAWE4H2E","yt-research","Research competitor YouTube channels, niches, and trending topics for your content strategy.\nUse this skill whenever the user says \"research channels\", \"analyze competitors\", \"find trending topics\",\n\"niche analysis\", \"competitive research\", \"what are other creators doing\", \"scrape YouTube channels\",\nor wants to understand the competitive landscape for a specific tool or topic area. Use when working with yt research. Trigger with 'yt', 'research'.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fyt-research\u002FSKILL.md",[],[]]