[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M78FGWGJBJ10SW8DF0EVGSFC":3,"skill-same:01M78FGWGJBJ10SW8DF0EVGSFC":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":6,"ownerHtmlUrl":29,"ownerBlogUrl":30,"ownerDescription":31,"updatedAt":32,"install":33,"resources":46},"01M78FGWGJBJ10SW8DF0EVGSFC","security-review",null,"Threat model alignment, security diff analysis, SAST integration, independent verifier policy, escape hatch denial, and audit logging","poppyTM\u002Foride","poppyTM","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F339400917?v=4","01M78F6YNKFR5S5JQR27X9F09Z","Poppy Team","01M78F6YP8ZZTRES9X8Q2ZAD21",1,"MIT","https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fsecurity-review\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: security-review\ndescription: Threat model alignment, security diff analysis, SAST integration, independent verifier policy, escape hatch denial, and audit logging\n---\n# Security-Focused Code Review\n\n## 1. Threat Model Alignment\nVerify every pull request against the system threat model and trust boundaries. Evaluate whether proposed changes introduce new attack vectors, expand attack surfaces, or alter privilege boundaries.\n\n## 2. Security-Focused Diff Prioritization\nPrioritize scrutiny on code modifications touching authentication, authorization, cryptographic routines, session handling, input deserialization, and network egress.\n\n## 3. Automated SAST & Security Linter Gates\nRequire 100% clean passes from static application security testing (SAST) tools (e.g. CodeQL, Semgrep, gosec) as mandatory pre-conditions for review approval.\n\n## 4. Independent Verifier Policy\nEnforce the Prumo Independent Verifier policy: any change categorized with High or Critical risk must be reviewed by a distinct, specialized security reviewer or persona.\n\n## 5. Security Acceptance Criteria Verification\nVerify that security-related pull requests include dedicated automated regression test cases demonstrating that the identified vulnerability is eliminated.\n\n## 6. Denial of Unregistered Escape Hatches\nStrictly reject pull requests introducing banned unsafe constructs (raw pointers, @trusted, memory reinterpret casts, or linter suppression directives) without formal registration in .prumo\u002Fescape-hatches.json.\n\n## 7. Defense-in-Depth Verification\nEnsure that security architecture does not rely on a single defensive layer. Verify multiple interlocking safeguards (e.g. database-level constraints combined with application-level authorization).\n\n## 8. Security Regression Prevention\nMandate automated unit or integration tests for every security bug fix, ensuring the test fails against the vulnerable baseline and passes with the fix.\n\n## 9. Structured Review Findings Format\nEmit security review findings using standard severity ratings (Critical, High, Medium, Low) with explicit file links, line ranges, vulnerability explanations, and suggested code patches.\n\n## 10. Audit Trail & Compliance Records\nLog the final security review verdict, reviewer identity, timestamp, commit hash, and verification gate evidence permanently into the project compliance history.\n","# Security-Focused Code Review\n\n## 1. Threat Model Alignment\nVerify every pull request against the system threat model and trust boundaries. Evaluate whether proposed changes introduce new attack vectors, expand attack surfaces, or alter privilege boundaries.\n\n## 2. Security-Focused Diff Prioritization\nPrioritize scrutiny on code modifications touching authentication, authorization, cryptographic routines, session handling, input deserialization, and network egress.\n\n## 3. Automated SAST & Security Linter Gates\nRequire 100% clean passes from static application security testing (SAST) tools (e.g. CodeQL, Semgrep, gosec) as mandatory pre-conditions for review approval.\n\n## 4. Independent Verifier Policy\nEnforce the Prumo Independent Verifier policy: any change categorized with High or Critical risk must be reviewed by a distinct, specialized security reviewer or persona.\n\n## 5. Security Acceptance Criteria Verification\nVerify that security-related pull requests include dedicated automated regression test cases demonstrating that the identified vulnerability is eliminated.\n\n## 6. Denial of Unregistered Escape Hatches\nStrictly reject pull requests introducing banned unsafe constructs (raw pointers, @trusted, memory reinterpret casts, or linter suppression directives) without formal registration in .prumo\u002Fescape-hatches.json.\n\n## 7. Defense-in-Depth Verification\nEnsure that security architecture does not rely on a single defensive layer. Verify multiple interlocking safeguards (e.g. database-level constraints combined with application-level authorization).\n\n## 8. Security Regression Prevention\nMandate automated unit or integration tests for every security bug fix, ensuring the test fails against the vulnerable baseline and passes with the fix.\n\n## 9. Structured Review Findings Format\nEmit security review findings using standard severity ratings (Critical, High, Medium, Low) with explicit file links, line ranges, vulnerability explanations, and suggested code patches.\n\n## 10. Audit Trail & Compliance Records\nLog the final security review verdict, reviewer identity, timestamp, commit hash, and verification gate evidence permanently into the project compliance history.\n",{"name":5,"description":7},"main","1cd515630b8ceb57777d466bee4970fe7c2e30e0",".ai\u002Fskills\u002Fsecurity-review",0,"https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride","https:\u002F\u002Fgithub.com\u002FpoppyTM","https:\u002F\u002Fpoppy.lat","Construímos linguagens de programação e ferramentas para quem lê código com o mesmo cuidado com que escreve.","2026-09-30 10:15:52",{"source":8,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add poppyTM\u002Foride --skill security-review",{"tool":39,"command":40},"bunx","bunx skills add poppyTM\u002Foride --skill security-review",{"tool":42,"command":43},"pnpm","pnpm dlx skills add poppyTM\u002Foride --skill security-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fsecurity-review\u002FSKILL.md",true,[47,53,57,61,65,71,75],{"path":48,"resourceType":49,"resourceTypeDesc":50,"sizeBytes":51,"sourceHtmlUrl":52},"checks\u002Fsecurity-review-checklist.md","REFERENCE","参考文档",575,"https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fsecurity-review\u002Fchecks\u002Fsecurity-review-checklist.md",{"path":54,"resourceType":49,"resourceTypeDesc":50,"sizeBytes":55,"sourceHtmlUrl":56},"examples\u002Fpr_security_review.md",2435,"https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fsecurity-review\u002Fexamples\u002Fpr_security_review.md",{"path":58,"resourceType":49,"resourceTypeDesc":50,"sizeBytes":59,"sourceHtmlUrl":60},"manifest.json",1795,"https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fsecurity-review\u002Fmanifest.json",{"path":62,"resourceType":49,"resourceTypeDesc":50,"sizeBytes":63,"sourceHtmlUrl":64},"references\u002Fcode-review-guide.md",1851,"https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fsecurity-review\u002Freferences\u002Fcode-review-guide.md",{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"scripts\u002Freview_checklist_generator.sh","SCRIPT","脚本",63,"https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fsecurity-review\u002Fscripts\u002Freview_checklist_generator.sh",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"scripts\u002Fverify.sh",4099,"https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fsecurity-review\u002Fscripts\u002Fverify.sh",{"path":76,"resourceType":49,"resourceTypeDesc":50,"sizeBytes":77,"sourceHtmlUrl":78},"templates\u002Fsecurity-review-report.md",989,"https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fsecurity-review\u002Ftemplates\u002Fsecurity-review-report.md",[80,86,92,99,106,113],{"skillNo":81,"name":82,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M78FHQN254KEH0DETXT5JM29","zoom-reflow","https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fzoom-reflow\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":19},"01M78FHP1880S695V8GQEE0RXK","wireframe-styleguide","https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fwireframe-styleguide\u002FSKILL.md",[],[],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":19},"01M78FHHYM6AN2H819FABW01DZ","visual-regression","Pixel-by-pixel snapshot testing, Playwright integration, dynamic content masking, deterministic font rendering, and cross-browser CI gates","https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fvisual-regression\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":19},"01M78FHE53D8DD0QVRY5C37DA4","ui-implementation","Component-driven UI implementation, multi-state matrix (default, hover, focus-visible, active, disabled, loading, empty, error), DTCG design tokens, responsive layout contracts, and accessibility tree mapping.","https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Fui-implementation\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":19},"01M78FHBJ1KXFF734GFE509TBJ","tui-editor-engine","Text buffer and editing semantics for a terminal code editor — index conversion, transaction-first editing, multi-cursor invariants, undo grouping, and large-file behaviour.","https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Ftui-editor-engine\u002FSKILL.md",[],[],{"skillNo":114,"name":115,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":19},"01M78FH9X6CPJX1H61ZDWTTVW8","tree-sitter-context-indexing","https:\u002F\u002Fgithub.com\u002FpoppyTM\u002Foride\u002Fblob\u002Fmain\u002F.ai\u002Fskills\u002Ftree-sitter-context-indexing\u002FSKILL.md",[],[]]